Bound Each Run Before Scaling a Migration

A migration across two hundred files needs a task inventory and a way to check every result. One headless run per bounded change can make failures easier to isolate.

A flag such as --allowedTools "Edit,Bash(git commit *)" is not a complete containment policy. Allow rules govern permission handling; they do not by themselves restrict edits to one intended file, disable every other capability or prevent effects reached indirectly through permitted commands. Inspect the effective permissions.

Use an isolated checkout, explicit paths, disposable inputs and no production credentials. Try a few representative cases, including one that should fail. Review each diff and run the migration's real checks before committing.

Keep a results ledger tied to file and commit hashes. An agent returning OK is a report to verify, not the gate that authorizes the rest of the batch.