autonomy: third-party tracker text has no author-trust axis and is carved out of the untrusted-provenance class

[kyle-sexton]

This was generated by AI while filing the follow-ups handed over by the #1657 design audit.

Context

Whether an externally-filed issue reaches the untrusted-provenance work class is unspecified. The
governing prose arguably covers it, but the executable tests for that class read pull-request fields an
issue does not have, and plugins/autonomy/reference/routines.md affirmatively carves third-party text
already inside the org's own tracker out of the provenance trigger, deferring it to admission instead.
Admission's own axes encode neither author trust nor content trust, so the deferral target does not
implement the control the carve-out defers to it. The same carve-out is repeated verbatim across five
sibling routines, leaving the org's own issue-triage routine deriving the lowest class in the taxonomy
while a routine reading a vendor changelog derives the highest.

Citations for both halves, and the five routines, are in the #1657 design audit — see
the determination comment
(gaps G2 and G3, follow-up 3). Not restated here.

Proposed work

• Decide the question one way and record the decision: either give admission-policy.md an author-trust
  axis so "admission-governed" is a real deferral target, or drop the routines.md carve-out so
  third-party tracker text derives the untrusted-provenance class the way external changelog prose
  already does.
• Re-derive the affected routine rows from whichever answer lands, rather than leaving them at their
  current class by inertia.

Acceptance criteria

• One of the two options is chosen and written down with its rationale in the surface that owns it
  (plugins/autonomy/reference/guardrails/admission-policy.md or
  plugins/autonomy/reference/routines.md), so a classifier no longer has to guess.
• The chosen answer removes the contradiction: the carve-out and its deferral target can be read
  together without one pointing at a control the other does not have.
• The five sibling routines that repeat the carve-out verbatim (issue-triage-sweep,
  backlog-readiness-check, duplicate-detection-sweep, pr-queue-tending, doc-freshness-sweep)
  each have their derived work class and isolation floor re-derived under the new answer — updated
  where the answer changes them, explicitly confirmed where it does not.
• The asymmetry the audit names (tracker prose vs. external changelog prose) is either eliminated or
  justified in writing.

References

• #1657 determination comment — the audit that produced this item (gaps G2/G3, follow-up 3)
• Verify untrusted item-body handling in admission and triage #1657 — the parent verification item; its comment thread lists every follow-up filed from this audit
• autonomy vs source-control: contracts disagree on whether a repo-local stamp may supply the merge-admission work class #1289 — related but distinct: which surface may supply the class the merge partition reads. This
  item is about how the class is derived for third-party tracker text.

Metadata

Field	Value
Category	autonomy / guardrails
Area	security
Ecosystem	markdown

[kyle-sexton]

This was generated by AI during triage. Raw-intake triage complete for this item; claim released. Verdict and routing labels posted below; raw-intake marker cleared.

[kyle-sexton]

This was generated by AI during triage.

Verdict: real contradiction, correctly filed — stays human-gated as a taxonomy decision

Work class: structural. It changes how a work class is derived, which every downstream admission gate reads. The blast radius is the classification of all third-party tracker text, fleet-wide.

Why it is gated

This is not a briefing gap. The item is well-evidenced and its proposed work is clear. It is gated because its own first bullet is an instruction to decide: "Decide the question one way and record the decision." The two options are not refinements of each other — they move the control to opposite layers, and the resulting work class for the org's own issue-triage routine differs between them. An autonomous lane choosing which one becomes the org's answer would be settling a taxonomy question on the operator's behalf.

The contradiction it names is real and worth restating compactly, because it is what makes the decision unavoidable: routines.md carves third-party text already inside the org's own tracker out of the untrusted-provenance trigger and defers it to admission — but admission's axes encode neither author trust nor content trust, so the deferral target does not implement the control the carve-out hands to it. The rule points at a control that does not exist. Something has to change; which thing is the call.

The asymmetry is the sharpest illustration: the org's own issue-triage routine derives the lowest class in the taxonomy, while a routine reading a vendor changelog derives the highest — even though both read third-party prose.

---

Decision-ready summary

The question: does third-party text inside our own tracker reach the untrusted-provenance work class?

RECOMMENDED — Option A: give admission-policy.md a real author-trust axis

Keep the routines.md carve-out, and make its deferral target honest by adding an author-trust axis to admission so "admission-governed" actually governs something.

Why: it preserves the distinction the carve-out was reaching for — text in our tracker genuinely is different from an arbitrary vendor changelog, because it arrives through a surface we control and can label — while closing the gap that the deferral currently points at nothing. It also puts the control at the layer that already makes per-item admission decisions, so the signal is available where it is acted on.

Cost: more design work than Option B, and it must compose with #1718 (which asks for a field-tested issue-side provenance signal) rather than inventing a second, parallel answer. These two should be decided together — see the sequencing note below.

Option B: drop the carve-out

Let third-party tracker text derive the untrusted-provenance class the way external changelog prose already does.

Trade-off: simpler, strictly fail-safe, and eliminates the asymmetry outright — but it routes a large volume of ordinary in-tracker work into the highest class, which will push routine triage into human-gated handling and may make the autonomous lanes materially less useful. Choose this if the volume cost is acceptable or if Option A's design cost is not.

Either way

The five sibling routines repeating the carve-out verbatim — issue-triage-sweep, backlog-readiness-check, duplicate-detection-sweep, pr-queue-tending, doc-freshness-sweep — must have their derived work class and isolation floor re-derived under the answer, updated where it changes them and explicitly confirmed where it does not. Leaving them at their current class by inertia is called out in the acceptance criteria and is the most likely way this gets half-done.

Sequencing note

#1718 is the same question asked at the field-test layer ("is there an executable provenance test for an issue author?"). Deciding #1714 without #1718 risks adopting an author-trust axis with no way to evaluate it, and deciding #1718 without #1714 risks building a test nothing consumes. Recommend the operator take both in one sitting. #1718 additionally carries a dependency on #1520/#1525 (repository-owned automation identities are not org members, so a naive association test misclassifies our own automation).

---

Labels: needs-human, status: needs-decision, work-class: structural, priority: high. Removed priority: needs-triage.

[kyle-sexton]

Frontier disposition (drain session)

Ruling: Close as not planned for this drain wave.

Third-party tracker text lacking an author-trust axis is subsumed by the provenance carrier cluster #1695, #1716, and #1718. Keeping this filing open duplicates the same structural design question across four tracker slots.

Re-open trigger: Provenance carriers close without specifying author-trust for externally-filed org issues.