Resolving via `jj new` in-place clobbered the main workspace's `@`.
Move the resolution work into a dedicated jj workspace (per the
jj-workspaces skill) so it stays isolated, and tighten allowed-tools to
exact commands scoped to the resolve-<change-id>/work/resolve-* names
instead of broad jj workspace/rm/cd wildcards.

Assisted-by: Claude Sonnet 5 via Claude Code

diff --git a/ai/skills/resolve-conflicts/SKILL.md b/ai/skills/resolve-conflicts/SKILL.md
index 32a0ffd5..da387ce7 100644
--- a/ai/skills/resolve-conflicts/SKILL.md
+++ b/ai/skills/resolve-conflicts/SKILL.md
@@ -1,28 +1,41 @@
 ---
 name: resolve-conflicts
-description: Use when resolving jj conflicts after rebase, squash, or merge — handles conflict markers, mergiraf automation, and file-by-file manual resolution
+description: Use when resolving jj conflicts after rebase, squash, or merge — handles conflict markers, mergiraf automation, and file-by-file manual resolution in an isolated workspace
 argument-hint: [change-id]
-allowed-tools: [Bash(jj new *), Bash(jj status *), Bash(jj resolve *), Bash(jj diff *), Bash(jj log *)]
+allowed-tools: [Bash(mkdir -p work), Bash(jj workspace add --name=resolve-* -r * work/resolve-*), Bash(cd work/resolve-*), Bash(jj status), Bash(jj resolve *), Bash(jj diff *), Bash(jj log *), Bash(jj squash *), Bash(jj workspace forget resolve-*), Bash(jj workspace update-stale), Bash(rm -rf work/resolve-*)]
 ---
 
 # Resolve Conflicts
 
 `$ARGUMENTS`
 
-## Step 1 — Set up the resolution change
+This skill resolves conflicts in an isolated workspace so the resolution
+work never touches the main workspace's `@`. Invoke the `jj-workspaces`
+skill for the general mechanics referenced below (workspace naming,
+`work/` layout, sync behavior); the steps here are the conflict-specific
+application of it, using the exact commands `allowed-tools` permits.
 
-If `$ARGUMENTS` contains a change ID, create a new change on top of it:
+## Step 1 — Set up an isolated resolution workspace
 
-```
-jj new $ARGUMENTS
-```
+If `$ARGUMENTS` contains a change ID, use it as the conflicted revision.
+Otherwise run `jj status` in the main workspace and use `@-` if it has
+conflicts; stop and ask the user for a change ID if it doesn't.
 
-If no argument was given, run `jj status` to verify:
+Per `jj-workspaces`' "Creating a Workspace" recipe, but anchored on the
+conflicted revision instead of trunk (skip its DAG-placement rebase step —
+this workspace's working-copy commit belongs directly on `<change-id>`,
+not on trunk):
 
-- The current change `@` is empty (no pending edits)
-- The parent `@-` has conflicts
+```
+mkdir -p work
+jj workspace add --name=resolve-<change-id> -r <change-id> work/resolve-<change-id>
+cd work/resolve-<change-id>
+```
 
-If `@` is not empty, stop and tell the user to `jj new` first.
+`-r <change-id>` makes the new workspace's working-copy commit a child of
+`<change-id>` — the same relationship `jj new <change-id>` would have
+created in the main workspace — but isolated in its own checkout. Run all
+remaining steps from inside `work/resolve-<change-id>`.
 
 ## Step 2 — Run mergiraf
 
@@ -77,12 +90,28 @@ conflicts remain in the parent.
 > The Read and Edit tools handle file-level resolution directly. They are not
 > restricted by `allowed-tools`, which only governs Bash commands.
 
-## Step 4 — Squash the resolution
+## Step 4 — Squash the resolution and clean up
 
 Do not run `jj squash` automatically. Prompt the user:
 
-> All conflicts are resolved. Run `jj squash` to fold the resolution back
-> into the conflicted change, or review the diff first with `jj diff`.
+> All conflicts are resolved. Run `jj squash` (from
+> `work/resolve-<change-id>`) to fold the resolution back into
+> `<change-id>`, or review the diff first with `jj diff`.
+
+Once the user confirms the squash, `<change-id>` is fixed up and the
+workspace's working-copy commit is left empty. Clean up per
+`jj-workspaces`' cleanup recipe:
+
+```
+jj workspace forget resolve-<change-id>
+rm -rf work/resolve-<change-id>
+```
+
+Then, from the main workspace, sync so it sees the resolved change:
+
+```
+jj workspace update-stale
+```
 
 ---