Nested Guardex repos can finish and clean their own branch while the containing repo still shows a changed gitlink in VS Code. The finish flow now detects the tracked superproject path after the nested base worktree fast-forwards and commits only that gitlink, leaving unrelated parent staged paths alone.

Constraint: Parent repo may already have staged changes, so the commit is path-scoped to the single gitlink.

Rejected: Commit all parent changes after nested finish | would bundle unrelated user work from the containing repo.

Confidence: high

Scope-risk: moderate

Directive: Do not widen parent auto-commit beyond the detected 160000 gitlink path without tests proving unrelated staged files remain untouched.

Tested: bash -n scripts/agent-branch-finish.sh; bash -n templates/scripts/agent-branch-finish.sh; node --test test/cli-args-dispatch.test.js test/finish.test.js; openspec validate agent-codex-auto-commit-parent-subrepo-upgrades-2026-04-23-11-59 --strict; git diff --check; npm test

Not-tested: Parent protected-branch hook rejection beyond warning-path behavior