work-items(attend-queue): execution drift — judgment lane pushes branches/PRs and offers fixes; harden never-execute from item-scoped to mutation-class-scoped

[kyle-sexton]

Filed by AI on operator direction (attended feedback session, 2026-07-24).

Category: behavioral · Source: operator observation of a live attend-queue session, 2026-07-24

Problem — the judgment lane keeps trying to do the work

/work-items:attend-queue is the judgment lane of the loop-lane topology: it answers, ratifies, routes, and flips role labels — it never executes. The skill's gotcha says exactly that ("Resolving an escalation never turns into executing the item here"). Observed in one live attended session, the lane nonetheless:

1. Pushed a branch and created a PR itself ("Last loose end: push chore/seed-empty-recurring-schedule and open its PR — confirm and I ship it", then did).
2. On a dependency security alert, RECOMMENDED cutting a fix branch, bumping the lockfile, and PR-ing it from the attended session ("Say the word") — corrected only when the operator restated the lane rule, after which it correctly filed an agent-ready item instead.

Root cause: the boundary is phrased around work items ("never executes work items"), but both violations were incidental repo work not tracked as items — a chore branch, an untracked security alert. The item-scoped phrasing leaves untracked work outside the fence, and the lane's helpful-completion tendency walks straight through the gap. The offer form is itself part of the defect: presenting "I ship it / say the word" pulls the operator into ratifying out-of-lane execution instead of routing it.

Direction

Harden the attended lane's boundary from item-scoped to mutation-class-scoped:

• The attended lane's write surface is tracker judgment only: label flips, comments (answers, ratifications, dispositions), closes, and item creation/routing through triage. No repository mutation of any kind — no commit, push, branch, PR, lockfile bump, file edit — regardless of whether the work is tracked as an item, how small it is, or whether the operator is present.
• Anything executable the lane encounters (loose ends, alerts, chores, obvious quick fixes) has exactly one disposition: file/route it as an item with the appropriate role label so the worker lane picks it up through the frontier. The lane's offer vocabulary follows: "file it as agent-ready?" is the only shape — never "I can do it now / say the word."
• An explicit operator instruction to execute something is a lane exit, and the skill should say so: acknowledge that the request leaves the attended lane's authority and either route it as an item (default) or note the operator is taking it to another session — the same single-authority rule the topology's other lanes already enforce mechanically.

Relations

• Loop-lane convention §1 (three-session topology, one authority per lane — this closes the attended lane's enforcement gap), the attend-queue skill's existing "Judgment lane only" gotcha (correct rule, insufficient scope), work-items(attend-queue/triage): operator question rounds should compose /planning:interview, a wayfind size gate, and is-it-still-a-problem discovery #1205 (attend-queue question-round composition), work-items(attend-queue/triage): interactive direction gate lacks a brief-before-ask requirement — operator asked to decide without item context #1202 (brief-before-ask), work-items(tracker-seam): another actor produced a full PR for a claimed issue without ever holding the lease #920 (another actor producing work outside the coordination contract — same class: work happening outside the lane that owns it).

[kyle-sexton]

This was generated by AI during the /work-items:work-loop autonomous drain cycle.

Surfaced in the --autonomous frontier (unassigned, unblocked, not human-gated) but carries no role label — already triaged (priority set) yet never routed to agent-ready or needs-human. Content reads as structural/cross-cutting (convention, contract, or design-space work) rather than a scoped bug fix, so this cycle's admission gate classifies it C4-shaped or unclassified and routes it human-gated per the fail-closed default rather than admitting it to autonomous dispatch.

Routing: added needs-human. No other state changed — priority and existing labels are left as-is. If this is actually scoped/delegable, re-label to agent-ready (+ status: ready) and it will be picked up by a later drain cycle.

[kyle-sexton]

This comment was generated by AI (triage lane gate-audit pass). Claiming this item for an escalation review; the claim itself changes no labels, code, or merge state.

[kyle-sexton]

This comment was generated by AI (triage lane gate-audit pass). It changes no labels and no code; it exists to make the parked decision ready for a human signature.

The escalated question

The work-loop drain cycle could not classify this item and routed it human-gated fail-closed. Its operative line: "If this is actually scoped/delegable, re-label to agent-ready (+ status: ready) and it will be picked up by a later drain cycle."

So: is hardening the attended lane's never-execute boundary from item-scoped to mutation-class-scoped delegable to an autonomous worker as briefed, or does a human have to sign it first?

Verdict: stays gated — but the substance is now decided, and only one clause needs your signature

The panel did not split on whether the direction is right. It split on what class of change it is, and that split is itself the reason to keep the gate.

What the evidence settles (no longer an open question)

The mutation-class vocabulary this item asks to invent already exists and is already ratified — the item just doesn't cite it. plugins/autonomy/reference/guardrails/work-classes.md:15-20:

"'Read-only' scopes REPOSITORY surfaces: a C1 run performs no repository mutation. Writes to the governed queue and tracker — work-item filing, queue comments, audit-trail artifacts — are PERMITTED: they are the class's output channel and land on the queue's audit trail, not in the repository."

That is precisely the fence Direction bullet 1 describes: tracker/queue writes permitted, repository mutation forbidden, regardless of whether the work is tracked as an item. The fix imports this line rather than inventing a new rule. (No work-items skill cites C1 anywhere today — the gap is citation, not policy.)

Two further findings:

• The convention needs no amendment. docs/conventions/loop-lane/README.md:22-31 already gives attend-queue an exhaustive Authority — "Human-in-the-loop triage and escalation answers" — and closes with "No lane crosses into another's authority." Repository mutation is the worker lane's authority by construction.
• A skill-local fix has precedent. Both sibling lanes restate their own authority in their own skill body — plugins/work-items/skills/work-loop/SKILL.md:28 and plugins/source-control/skills/babysit-loop/SKILL.md:18. attend-queue's existing gotcha (SKILL.md:187-189) is the same mirror; the item is right that its scope is short, not that the rule is missing.

What is NOT settled — the one clause needing your call

Direction bullet 3: "an explicit operator instruction to execute something is a lane exit."

This decides whether the lane may decline your own typed instruction in your own attended session. The convention has no "lane exit" concept today, and it governs lane-vs-lane authority, not operator authority. One seat derived it from §1 plus the convention's seam-only-raises philosophy (README.md:61-64, "Invocation arguments never raise the merge rung implicitly"); the other seats treated it as a risk-appetite call about your own authority. No file states it outright. This is the clause a human must sign.

Panel

Composition: a fresh Claude reviewer, OpenAI Codex CLI (alternate vendor), and this agent's own read. Both external seats received the title, body, and escalated question only — every prior lane conclusion and any proposed answer was withheld — and both were required to ground in the real skill and convention files.

Seat	Settled?	Class	(a) security	(b) pins	(c) cross-cutting	(d) hard to reverse	(e) human call	Confidence
Fresh Claude reviewer	settled	C3 (conditional)	NO	NO	NO	NO	NO	high
OpenAI Codex CLI	settled	C3	YES	NO	NO	NO	NO	high
This agent	bullet 3 unsettled	C4	NO	NO	YES	partial	YES	high

Seat C's (c)=YES rested on the convention requiring amendment; the sibling-lane precedent (work-loop/SKILL.md:28, babysit-loop/SKILL.md:18) later narrowed that. The row records each verdict as formed, before cross-reading.

Both pro-flip seats attached conditions rather than voting an unconditional flip:

• The fresh Claude seat fenced its C3 to one file: any edit to docs/conventions/loop-lane/README.md §1 re-classifies the work to C4 (topology change = major bump + CHANGELOG, README.md:310-312). It also required the diff be verified as strictly narrowing lane authority.
• The Codex seat answered YES to security-surface — privilege/trust-boundary per plugins/autonomy/reference/guardrails/security-review.md:21-23 — and routed implementation to the frontier capability tier. It conditioned its flip on a recorded kind=ratify-c3 ratification, which is an operator act (attend-queue/SKILL.md:88-90) this triage agent cannot supply.

Why that is not a flip. The gate requires confident consensus that the work is C2/C3 and not a security-surface change — not a per-criterion majority. A high-confidence cross-vendor seat answering YES to (a) with a grounded citation makes (a) contested, and contested is not "established not." The class itself is contested the same way. On top of that, neither pro-flip seat voted unconditionally, and a label flip cannot enforce either seat's condition. The change rewrites the fence constraining an agent lane's own write authority — the exact surface this gate exists to protect. Fail-closed is the designed behavior here, not a stall.

Worth knowing: flipping would likely not have dispatched it unattended anyway. With first_drain_complete unset, the worker's admission gate queues a C3 bug-fix candidate as a kind=ratify-c3 row back to you rather than dispatching it (work-loop/SKILL.md:214-222).

Options — pick one

1. Approve a scoped plan: bullets 1-2 only, skill-local, importing the C1 line. — RECOMMENDED

Land the fence in plugins/work-items/skills/attend-queue/SKILL.md only, citing work-classes.md:15-20 as the source of the tracker-vs-repository distinction rather than inventing wording. Split bullet 3 (the lane-exit clause) into its own item for a separate decision. Consequence: the observed drift — pushing branches, offering "say the word" — is fenced now, using already-ratified vocabulary; the one genuinely operator-owned clause does not ride along unsigned. This is the only option both external seats' conditions are satisfied by.

2. Approve all three bullets as briefed.

Consequence: fixes the drift in one pass, but signs the lane-exit clause without it having been posed as its own question — it decides that the lane may decline your explicit instruction. Choose this if that is what you want; it is a defensible reading of §1, just not one any file states.

3. Approve bullets 1-2 and also amend loop-lane/README.md §1's attend-queue row.

Consequence: puts the fence in the contract every lane cites, not just one skill body — the most durable shape. But it is a topology change: C4, major bump plus CHANGELOG (README.md:310-312), human review and human merge mandatory, and per work-classes.md:33-37 it escalates for upfront plan approval before execution. Slower, and it stays human-merge regardless of any rung.

4. Decline / close.

Consequence: the item-scoped phrasing stays, and the gap that produced both observed violations stays open. Not recommended — the defect is reproduced and evidenced.

Delivery constraints for whoever implements (class-neutral)

• The frontmatter description at SKILL.md:3 carries the exact item-scoped phrasing ("never executes work items, never merges") and will likely need editing. Per this repo's CLAUDE.md, a skill's frontmatter is a contract surface — the fresh-docs mandate applies to that edit.
• skill-quality's trigger-keyword-preservation-vs-HEAD check fires on any description rewrite and must be satisfied deliberately.
• Any diff must be verified as strictly narrowing the lane's authority. A diff that widens anything is a different item.

No labels were changed by this pass.

[kyle-sexton]

AI-generated: triage lane gate-audit pass complete; claim released. Item left gated — no labels were changed.

[kyle-sexton]

Frontier disposition (drain session)

Ruling: Close as not planned for this drain wave (frontier consensus).

Dual-panel drain ruling: advisory, superseded, folded into a program umbrella, or blocked on a host/design carrier without an actionable in-repo slice this session. Re-open with a concrete acceptance brief if a consumer needs the work.

KEEP set for this wave: standing telemetry; host-physical Class C (#631 family); program umbrellas #530/#531/#532/#535; live design carriers #1500/#1553/#1668/#1695/#1716/#1681/#1718; #1360.