agy-implementlisted

# Delegate implementation to agy, then verify Complements `agy-adversarial-review` (review-only intent via `--mode plan`). This skill goes the other direction: agy **writes code**, so the safety comes from three stacked boundaries — worktree isolation, the sandbox with a targeted allow-list, and mandatory review before anything reaches the main branch. ## Before the first run of a session Read **[`../agy-adversarial-review/references/agy-runtime.md`](../agy-adversarial-review/references/agy-runtime.md)**. It holds the family-level mechanics shared by both agy roles — the permission allow-list, the `--add-dir` workspace trap, the silent-death mode, auth diagnosis, and the model catalogue. This file assumes you know them and covers only what makes a run an *implementation*. Three runtime facts this role depends on directly: - **This role needs TOOL permissions, not just the `unsandboxed(...)` shell rules — and it is the role that finds out.** An empty `permissions.allow` loads as `permissions=<nil>` and falls back to asking a human who is not there, so the first tool call is auto-denied and the run dies having read nothing. The review role survives that (its prompt hands it a pre-written diff), this one does not. Add `read_file(<worktree>/**)` and `write_file(<worktree>/**)` scoped to the worktree, never the home directory. Full diagnosis, and why the error message's own suggested fix is the wrong one, in the runtime file's permission section. - The **write