kami
a00bd4aade
When a write is blocked for being outside the claimed task's affected_paths, the implementer can propose widening scope via a new T2 propose_scope tool. The operator decides (invariant #4 — the agent can't self-grant). Approve unions the proposed paths into the task's affected_paths (existing TaskAffectedPathsSetEvent); activeScope re-derives the wider manifest from events so the same write then passes. Reject blocks the task (via TaskClaimCoordinator.blockActiveTask, hooked on both approval-denial branches, scoped to propose_scope) so the loop advances. No new event types.