babysit-loop: wire effective promotion-state resolution into the merge rung partition

[kyle-sexton]

What

The rung partition in plugins/source-control/skills/babysit-loop/SKILL.md (step 3, "Rung partition") computes merge eligibility from the tracked rung and the item's recorded work class only. It never resolves the effective promotion state of the merge cell it is exercising — the guardrail contract makes the bound state a CEILING that consumers must resolve against live promotion-evidence telemetry before every autonomous merge decision, fail-closing to unpromoted when evidence is unavailable (plugins/autonomy/skills/setup/schemas/guardrails-security-binding.schema.json, promotion_state description).

Consequence: a c3-autonomous (or c2-mechanical) seam keeps auto-merging even when a contrary event should demote the cell or evidence is unavailable. The contract's automatic fail-closed demotion is declared but not wired into the partition.

Raised by Codex review on #1694; the loop-lane prompt retains --merge human-only in its copy-blocks until this lands.

Work-class

C4 — structural: changes the merge partition's decision inputs in a governance-enforcing skill.

Acceptance

• Rung partition resolves the effective promotion state for the cell backing each rung (C2-auto-merge, C3-auto-merge) before computing the merge-eligible set, fail-closing to human-gated when the telemetry source is unavailable.
• A demotion event observed in telemetry excludes the affected class from the eligible set on the next cycle without any config change.
• Prompt copy-blocks may then direct operators to drop --merge human-only once the suggested evidence predicate is met.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PfjSBcWkzNFCydZQYsfUc4

[kyle-sexton]

This was generated by AI (triage lane, gate-audit pass — cycle 2 retry, instance melo-lap-001-triage-20260727T125559Z).

Verdict: real, well-evidenced, and on the security floor — stays human-gated regardless of how well-specified the acceptance criteria are.

Resolving this wrong widens what an autonomous lane may merge without a human: the guardrail contract makes the bound rung a ceiling that must be resolved against live promotion evidence and fail-closed when evidence is unavailable, and the partition currently skips that resolution entirely. That is an autonomous-merge-authority surface, so area: security applies as a hard floor. The issue's own C4 self-classification matches — it changes the decision inputs of a governance-enforcing skill. Priority high because the loop-lane prompt is pinned to --merge human-only until this lands.

Cross-reference: #1682 — same skill (babysit-loop); its Finding 1 recommends a gotchas addition to the surface this issue rewires, so the two should be sequenced together.

Labels: priority: high, work-class: structural, area: security, needs-human, status: needs-decision (removed priority: needs-triage).