The first auto-commit path trusted parent git diff, but real parent workspaces can set diff.ignoreSubmodules=all. That hides exactly the gitlink drift this feature needs to commit, so detection now compares the parent gitlink index SHA to the nested repo HEAD and parent HEAD tree entry.

Constraint: Parent workspaces may intentionally hide submodule noise in normal status output.

Rejected: Disable diff.ignoreSubmodules temporarily | mutates parent repo configuration and still leaves hidden-index edge cases.

Confidence: high

Scope-risk: narrow

Directive: Keep gitlink drift detection SHA-based; do not rely on git diff status for subrepo pointer updates.

Tested: bash -n scripts/agent-branch-finish.sh; bash -n templates/scripts/agent-branch-finish.sh; node --test test/finish.test.js; openspec validate agent-codex-auto-commit-parent-subrepo-upgrades-2026-04-23-11-59 --strict; git diff --check

Not-tested: Full npm test after follow-up; full suite passed before this narrow SHA-detection fix