From 4ec7a832a9468a024b91be413f0067113f9c29af Mon Sep 17 00:00:00 2001 From: ci Date: Thu, 27 Aug 2026 20:46:04 -0400 Subject: [PATCH 1/2] roadmap: qualify autonomy per workflow --- ROADMAP.md | 60 +++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 48 insertions(+), 12 deletions(-) diff --git a/ROADMAP.md b/ROADMAP.md index a3bb538..43dcaf2 100644 --- a/ROADMAP.md +++ b/ROADMAP.md @@ -75,12 +75,24 @@ Every implementation must preserve these rules regardless of adapter: credential worth stealing. 7. Events are wake-up signals. A durable reconciler reads canonical state and repairs missed, repeated, canceled, or partially completed runs. -8. Autonomy is earned in stages: manual → shadow/read-only → bounded write → - risk-tiered automation. Every stage has a kill switch. +8. Autonomy is earned for a recorded workflow scope, not granted to an agent in + general. The record identifies the target and the target versions or conditions + it covers; workflow, task class, and risk tier; resolved profile; harness and + adapter identities and config; capabilities and permissions; model, tool, prompt, + skill, and verification-instruction versions; and execution environment. + Policy names which changes invalidate that qualification and which gate they + return to. Each execution environment qualifies separately. + Progress remains manual → shadow/read-only → bounded write → risk-tiered + automation, and every stage has a kill switch. 9. Configuration changes are tested like code. Prompts, skills, hooks, models, adapters, and permissions run against versioned evals. 10. The loop is measured by user value, quality, flow, recovery, and human attention — never by code volume or token use alone. +11. Every stage attempt ends with an explicit status such as `completed`, + `skipped`, `stale`, `blocked`, or `failed`. An attempt that executes work also + returns an evidence-backed result such as `changed`, `no-change`, or + `inconclusive`. A useful run does not have to change code. Silence or a + confident claim without evidence never counts as a pass. ## Stable interfaces @@ -117,6 +129,17 @@ The core should use capabilities rather than vendor commands. - retain check state and artifacts; - enforce environment-specific gates. +### Verification + +- name the finish condition and required proof kind before a stage starts; +- keep deterministic/static, behavioral/runtime, architecture/boundary, and + independent-review evidence distinct; +- bind proof to the target, source, release, and output identities when they + apply, plus the execution environment, verifier, and versioned verification + instructions; +- return an explicit result, including `inconclusive` when required proof cannot + run, without forcing every useful outcome to produce a patch or PR. + ### Execution - provision a disposable, policy-bound environment; @@ -164,18 +187,26 @@ label must not erase the underlying state. Each stage record must make these facts recoverable: -- initiative and stage; +- initiative, stage, workflow, task class, terminal status, and result when work + executed; - input and output commit identities; - risk tier and required gate; - harness and adapter identity/config, plus model, effort, prompt/skill version, and cost when they apply; -- run, retry, skip, stale, and failure reason; -- proof identity and check result; +- reference to the qualification record; +- attempt, retry, and failure or recovery reason; +- proof identity, proof kind, execution environment, versioned verification + instructions, and check result; - human decision and timestamp. Delivery is **at least once**. Idempotency and reconciliation make repeated delivery safe; the system does not pretend webhook delivery is exactly once. +Qualification is authority attached to that exact recorded workflow scope. It is +not reputation attached to an agent, model, or profile. Nothing outside the scope +inherits authority by inference. A policy-controlled change returns the affected +scope to its named shadow or eval gate before authority resumes. + ## Risk-tiered gates The target policy is: @@ -251,8 +282,10 @@ The operating dashboard should pair flow and quality: The roadmap is intentionally ordered by dependency, not by playbook stage name. Each numbered item becomes its own intent/spec/plan chain and small PRs. -1. **Portable control-plane core** — canonical contracts, capability manifests, - profile resolution, fake adapters, and adapter contract tests. +1. **Portable control-plane core** — canonical contracts, typed stage results, + evidence and references to qualification records, capability manifests, profile + resolution, fake adapters, and adapter contract tests. It carries references; + later initiatives decide and enforce qualification policy. 2. **Control foundation** — brain/verifier/publisher separation, sandbox and credential policy, risk gates, kill switch, and immutable evidence. 3. **Durable orchestrator** — canonical state scanner, at-least-once retry, @@ -264,11 +297,13 @@ Each numbered item becomes its own intent/spec/plan chain and small PRs. 6. **Alternative adapters** — prove at least one alternative harness and one alternative forge against the same contract and safety evals. GitLab is the recommended first alternative forge. -7. **Shadow vertical slice** — run the artifact lane read-only/manual on real - self-host and external-target changes, including adversarial and recovery - smoke tests. -8. **Bounded autonomous writes** — enable one low-risk stage at a time in an - independent PR after shadow evidence passes. +7. **Shadow vertical slice** — prove one narrow read-only workflow locally, then + prove it separately in every other execution environment where it will run. + Incident reproduction is the preferred first case when practical because + `no-change` and `inconclusive` are useful outcomes. Run on real self-host and + external-target changes, including adversarial and recovery smoke tests. +8. **Bounded autonomous writes** — enable one low-risk qualified workflow scope at + a time in an independent PR after that scope's own shadow evidence passes. 9. **Safe review-fix loop** — add autonomous fixes only after the credential and reconciliation boundaries are proven. 10. **Target packaging** — install profiles and adapters into a fresh target @@ -293,6 +328,7 @@ Each numbered item becomes its own intent/spec/plan chain and small PRs. - implementing every harness or forge; - opening autonomous write access; +- treating an agent, model, or profile as globally trusted; - deployment or production monitoring; - replacing Git as the first artifact store; - preserving Claude, Codex, or GitHub as mandatory dependencies. From 760ac16771b1689003d9e74ec4384be1c5b8b637 Mon Sep 17 00:00:00 2001 From: ci Date: Thu, 27 Aug 2026 20:57:22 -0400 Subject: [PATCH 2/2] docs: align rollout with qualified workflows --- README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index f2e6b43..dbd8f74 100644 --- a/README.md +++ b/README.md @@ -267,6 +267,7 @@ RESTORE.md Disaster-recovery runbook: rebuild the team from this `merge-ready` PRs, they never merge**. No agent merges: `main` needs a pull request plus an approving review the comments-only reviewer cannot give, and no agent has a bypass. - **Next** — migrate the current profile behind portable adapters, establish the - control/eval/reconciliation foundation, then enable bounded writes one stage at a - time. [`ROADMAP.md`](ROADMAP.md) is authoritative. **The merge gate does not widen** — + control/eval/reconciliation foundation, then qualify and enable one bounded + workflow scope at a time in each execution environment. + [`ROADMAP.md`](ROADMAP.md) is authoritative. **The merge gate does not widen** — the operator merges in every phase.