fix(#6858): keep code target branches optional

AGENTS.md

@@ -157,8 +157,10 @@ workflow `env:` block even if it configures agent behavior.
 This rule is scoped to static, tunable defaults. It does not cover
 values that are genuinely computed per-repo or per-run, such as
 branch lists, tokens, or PR/issue numbers — those must stay as
-`${VAR}` passthrough, as already used by `CODE_ALLOWED_TARGET_BRANCHES`
-in [`harness/code.yaml`](harness/code.yaml)'s `env.runner` block and by `REVIEW_TOKEN`,
+`${VAR}` passthrough. `CODE_ALLOWED_TARGET_BRANCHES` is an exception: it
+is optional and read directly by the post-code script when supplied, so do
+not map it through [`harness/code.yaml`](harness/code.yaml)'s `env.runner`
+block. Required runner values include `REVIEW_TOKEN`,
 `PR_NUMBER`, and `PR_URL` in the `forge.<platform>.env.runner` blocks
 (some passthroughs like `REPO_FULL_NAME` live at top-level `env.runner`
 when identical across forges). When reviewing PRs, do not flag a

harness/code.yaml

@@ -66,7 +66,6 @@ validation_loop:
 # Environment variables for runner pre/post scripts and sandbox sessions.
 env:
   runner:
-    CODE_ALLOWED_TARGET_BRANCHES: "${CODE_ALLOWED_TARGET_BRANCHES}"
     TARGET_REPO_DIR: "${TARGET_REPO_DIR}"
     PUSH_TOKEN: "${PUSH_TOKEN}"
     PUSH_TOKEN_SOURCE: "${PUSH_TOKEN_SOURCE}"

scripts/harness-jira-test.sh

@@ -98,6 +98,15 @@ fi
 # ---------------------------------------------------------------------------
 CODE_HARNESS="${REPO_ROOT}/harness/code.yaml"
 
+# CODE_ALLOWED_TARGET_BRANCHES is optional. Mapping it through env.runner
+# makes fullsend reject runs where the host does not define it, before the
+# post-script can safely fall back to the repository default branch.
+if yq -e '.env.runner | has("CODE_ALLOWED_TARGET_BRANCHES")' "${CODE_HARNESS}" >/dev/null; then
+  assert_fail "code-optional-target-branches-not-required" "CODE_ALLOWED_TARGET_BRANCHES must not be mapped through env.runner"
+else
+  assert_pass "code-optional-target-branches-not-required"
+fi
+
 # when: must guard event.source so non-Jira runs skip instead of CEL-erroring
 code_jira_when="$(jira_overlay_field "${CODE_HARNESS}" ".when")"
 if echo "${code_jira_when}" | grep -qF 'has(event.source)'; then

scripts/post-code-test.sh

@@ -1715,7 +1715,7 @@ run_branch_validation_test "explicit-list-accepts-match" \
 run_branch_validation_test "explicit-list-includes-default" \
   "main" "main" "main,develop" "accept:main"
 
-# No agent target with explicit list still uses default
+# No agent target with explicit list still uses default.
 run_branch_validation_test "no-agent-target-ignores-allowed-list" \
   "" "main" "release-1,release-2" "default:main"