Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@agents/gsd-executor.md`:
- Around line 361-369: The current pre-commit check (using HEAD_REF and
ACTUAL_BRANCH) only denies detached or protected refs but still permits
arbitrary branches (e.g., feature/*); change it to require a positive per-agent
branch allow-list by asserting ACTUAL_BRANCH matches an explicit agent namespace
pattern (for example a regex like '^agent/|^agents/|^claude-agent/'); if
ACTUAL_BRANCH does not match the allow-list, print the same FATAL message and
exit non-zero — keep the existing DETACHED/protected checks and do NOT attempt
any self-recovery via git update-ref.

In `@get-shit-done/workflows/execute-phase.md`:
- Around line 658-660: The workflow uses the config key
workflow.worktree_skip_hooks but that key is not registered in the SDK config
schema; open sdk/src/query/config-schema.ts and add
"workflow.worktree_skip_hooks" to the exported set/array/object of valid config
keys (look for symbols like VALID_CONFIG_KEYS, validKeys, or registerConfigKey)
and include a default/description entry if the schema structure requires it so
the key is recognized by gsdk query config-get and the worktree skip-hooks
opt-out functions correctly.
- Around line 661-663: The script currently runs "git diff --cached --quiet ||
git stash" to stash unstaged changes but never restores them; change this to
create a named stash (e.g., git stash push -u -m "pre-hook-$(date +%s)") and
record whether a stash was created, then after "git hook run pre-commit" (and
after the post-wave hook sequence) conditionally restore it with "git stash pop"
(or "git stash pop --index" to restore index) and handle pop failures gracefully
(print a warning and exit non-zero if conflicts occur); reference the existing
commands "git diff --cached --quiet", "git stash" and "git hook run pre-commit"
when implementing the stash/create-flag and the subsequent "git stash pop"
restore logic.

In `@get-shit-done/workflows/quick.md`:
- Around line 642-647: The pre-dispatch git commit currently swallows failures
via "|| true"; remove that so real commit errors surface. Update the SKIP_HOOKS
branch and the normal branch where git commit is invoked (the lines using
SKIP_HOOKS, git commit --no-verify and git commit) to drop "|| true" and instead
check the commit exit status and abort the script on failure (print a clear
error referencing QUICK_DIR/${quick_id}-PLAN.md, quick_id and DESCRIPTION) by
exiting non-zero so the dispatcher cannot proceed without the PLAN.md committed.

In `@tests/bug-2924-worktree-head-attachment.test.cjs`:
- Around line 171-177: Extend the test's required protected-ref set by adding
'trunk' and 'release/*' to the required array so the loop that iterates over
required (for (const name of required)) asserts those refs too; ensure the regex
construction (new RegExp(`\\b${name}\\b`)) accounts for the literal asterisk in
'release/*' (escape or match the slash and asterisk) so the
assert.ok(re.test(scripts), `worktree_branch_check must reference '${name}' in
its protected-branch list`) correctly verifies the presence of 'trunk' and the
'release/*' protected-ref.
- Around line 359-363: The current workflowFiles collection only reads top-level
files under path.join(REPO_ROOT, 'get-shit-done', 'workflows') and misses nested
.md files; change the discovery used by workflowFiles to recursively walk the
workflows directory (or use a glob like **/*.md) so it collects all Markdown
files in subdirectories as well, then map those results to absolute paths as
before (reference workflowFiles and the path.join(REPO_ROOT, 'get-shit-done',
'workflows') call to locate where to replace the non-recursive readdirSync).

---

Nitpick comments:
In `@tests/bug-2924-worktree-head-attachment.test.cjs`:
- Around line 186-189: The tests currently assert by checking raw strings with
block.includes('update-ref') in the worktree_branch_check test and similar
checks at the other noted ranges; instead locate the parsed representation
produced by the test harness (e.g., the parsed block/statement AST or the array
like blocks/statements returned by the parser used in this file) and assert the
presence and properties of a specific node (for example assert that a node of
type 'command' or 'update-ref' exists, or that a recovery action node has name
'update-ref' and expected flags) rather than doing a substring search; update
the assertions in worktree_branch_check and the other occurrences (lines
~288-291 and ~390-405) to inspect the parsed node types/fields (the same parsed
structure used elsewhere in this suite) and assert on those structured fields.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tests/bug-2924-worktree-head-attachment.test.cjs`:
- Around line 255-258: The code slices subBlock using block.indexOf('**If
running as the sole', headingIdx) without checking for -1, which can cause an
incorrect slice; capture the end index into a variable (e.g., endIdx =
block.indexOf('**If running as the sole', headingIdx)), assert or throw if
endIdx === -1 (use assert.notStrictEqual or assert.ok with a clear message),
then use block.slice(headingIdx, endIdx) to build subBlock so the test fails
clearly when the subsection end marker is missing.

---

Nitpick comments:
In `@tests/bug-2924-worktree-head-attachment.test.cjs`:
- Around line 202-210: The test currently uses block.includes('update-ref');
replace this raw text check with a parser-driven assertion: use
extractFencedCodeBlocks (to locate the same fenced/code block that populates the
variable block in the test) and run shellStatements on that block, then assert
using a command predicate (e.g., a hasCommand-like predicate that checks command
=== 'git' && subcommand === 'update-ref') that the parsed statements do not
contain a git update-ref invocation (or, if the intent is to assert the
prohibition exists as guidance, assert there is a standalone comment/echo shell
statement that explicitly forbids update-ref). Update the test named "block
forbids `git update-ref` self-recovery in its guidance text" (and analogous
checks at the other ranges) to use extractFencedCodeBlocks + shellStatements +
the command/comment predicate instead of block.includes/indexOf/regex.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@tests/bug-2924-worktree-head-attachment.test.cjs`:
- Around line 441-458: The test uses content.slice(idx, idx + 2000) which can
truncate the "Parallel agents" section; replace this fixed window with logic
that captures from idx to the next Markdown section boundary or end of content:
compute an end index by searching content (starting at idx) for the next heading
marker (e.g., a regex matching ^\s*#{1,6}\s in multiline mode) or other section
delimiter, and use content.slice(idx, endIdxOrContentEnd) to produce tail;
update the variables tail and sentences (and related assertions) accordingly so
the loop examines the entire "Parallel agents" section rather than a fixed
2,000-character substring.