subagent-permission-stall-root-cause-and-fix

Subagents stall silently when settings.local.json lacks explicit permission wildcards — they hit a permission prompt the orchestrator implicitly accepts but the subagent cannot, then return empty or fail with no clear error. Fix: pre-approve broad safe patterns (e.g., Edit(/root/aj-workspace/**), Bash(git :), Read(*)) in permissions.allow so subagents inherit zero-friction access. Watchdog hook (subagent-permission-watchdog) catches remaining gaps by detecting ‘not in allow list’ in PostToolUse output.