fix(gitops): allow task-plane delivery roots

active-runtime/app/aios_isolated_writer_policy.py

@@ -10,7 +10,15 @@ WRITE_ENDPOINTS = frozenset({
     "/api/branch", "/api/create-branch", "/api/file", "/api/commit-file",
     "/api/commit", "/api/patch", "/api/create-patch",
 })
-ALLOWED_ROOTS = ("active-runtime", "docs", "test", "tests", "patches")
+ALLOWED_ROOTS = (
+    "active-runtime",
+    "docs",
+    "patches",
+    "reports",
+    "scripts",
+    "test",
+    "tests",
+)
 DENIED_ROOTS = ("baseline", "config", "deploy", "deployments", "ops", "runtime", "services")
 _TRUE = frozenset({"1", "true", "yes", "on"})
 _FALSE = frozenset({"0", "false", "no", "off"})

tests/test_isolated_writer_policy.py

@@ -36,6 +36,14 @@ class IsolatedWriterPolicyTests(unittest.TestCase):
                 "active-runtime/app/x.py",
             )
             self.assertEqual(policy.validate_path("docs/x.md", workspace), "docs/x.md")
+            self.assertEqual(
+                policy.validate_path("scripts/task-plane/run.sh", workspace),
+                "scripts/task-plane/run.sh",
+            )
+            self.assertEqual(
+                policy.validate_path("reports/task-plane.json", workspace),
+                "reports/task-plane.json",
+            )
             rejected = (
                 "",
                 "../docs/x.md",