autonomy: plan drift-delta routine extension of doc-freshness-sweep on ci-cron

[kyle-sexton]

Parent

Refs #3803

What to build

Run /planning:plan for the drift-delta routine extension, reading the container Brief on #3803 as the scope.

The plan must settle whether the fan-out extends the existing doc-freshness-sweep routine leaf or adds a sibling drift-delta-sweep row, and where the instruction content lives under the routine catalog's instruction-provenance rule. The scheduling surface is ci-cron.

Plan output is a PLAN.md under docs/topics/<slug>/ on the working branch, plus a closing comment on this issue summarizing the plan and any deferred questions.

Acceptance criteria

• PLAN.md exists under docs/topics/<slug>/ on the working branch and carries goal, approach, test strategy, and blast radius.
• The plan names the approach for the routine fan-out slice under container Epic: drift discoverability #3803, including the extend-versus-sibling-row decision.
• A closing comment on this issue summarizes the plan and lists any deferred questions.

Blocked by

None

[kyle-sexton]

[kyle-sexton]

Planning slice closed: plan for the drift-delta routine (#3803)

Plan: docs/topics/drift-delta-routine/PLAN.md (plus design/design-resolution.md, tier C early-exit) on branch plan/3809-drift-delta-routine, pre-prune commit ee69e1e98839416d78960cf4c5ad35dc1fe9ea6f. No PR is opened for the plan branch: scripts/check-contract-slice-prune.sh --check-diff red-lines any PR leaving a path under docs/topics/, and the plan's durable homes are the #3819 body and this comment.

Decision: sibling v1 row drift-delta-sweep, not an extension of doc-freshness-sweep

• doc-freshness-sweep/advisory is a ratified admission identity on org security bindings; broadening its substance would change what a ratified entry authorizes without re-review. A new identity is fail-closed until an org binds it.
• Two of the three lanes are not doc freshness. The overlap with the audit's documentation dimension is recorded as a class parameter (precedent: clone-trend-gate vs coverage-mutation-watch).
• The container's own criterion 2 pre-authorizes the sibling row.

What the plan ships in #3819 (one PR, autonomy plugin only)

New leaf reference/routines/drift-delta-sweep.md carrying the fan-out as instruction content (per the catalog's Instruction provenance rule); catalog row AGT | R + WI | repo | C1 | v1 plus a class-parameter bullet; v1 leaves list and count; regenerated generated/identity-prerequisites.json (the generator parses every leaf's Prerequisites section; CI checks it); CHANGELOG; version 0.23.0. Every worker-facing contract, including the leaf's section-by-section content, the six-row Prerequisites shape, the closed Repo needs vocabulary, the per-lane unattended rules (an /instruction-placement:audit bootstrap when the delta lane has no prior artifact; unattended plus a two-layer rotation for /overengineering:delta; one dimension flag plus a pre-invocation target check for /codebase-health:audit, which has no unattended collapse), the no-path and no-vendor-token rules, and a thirty-line Sanity Checks block, is in the #3819 body.

How "on the ci-cron surface" is expressed

The leaf states the run predicate as a fact (the delta lanes compare only with a resolvable branch identity and a memory-tier home persisted across runs), gives a scheduled job on the CI-orchestration home as one illustrative binding (what guided setup records as the ci-cron scheduler class), keeps the leaves' verbatim "No vendor scheduling surface is named here" clause, and excludes nothing. The catalog's Hosting stance keeps the surface binding org-owned; nothing in the container registers a surface, which is how "no cloud schedule surface" is met.

Verification

Two fresh-context verifiers. The first returned five CRITICAL and eleven MAJOR findings (a v1 justification the CHANGELOG [0.19.1] ruling cuts against; a ci-cron class parameter that breached the Hosting stance; wrong claims about the delta lanes' artifact homes and unattended behaviour; a five-row table where the leaves carry six; a ! grep -q absence check that does not abort under set -e; the overengineering plugin's own recurring-wiring contract uncited). The second confirmed the fixes and returned one CRITICAL and six MAJOR (the v1 evidence is class-level, not a run record for these lanes; ci-cron still over-reached; the audit's confirm stop needed a deterministic pre-check; a no-path grep that missed the real homes; counts and a stale PR state). Every finding was checked against the files before acting; all applied.

Amendments

• autonomy/routines: add the drift-delta-sweep v1 class whose leaf fans to instruction-placement:delta, overengineering:delta, codebase-health:audit #3819: title and body replaced with the verified contract (dated amendment note; /skill-quality:check marked n/a; criterion 3 reshaped; README recorded as needing no change).
• Epic: drift discoverability #3803: dated note under criterion 2; the "Deferred questions" section now lists the four below. Criteria 1, 3, 4 untouched.

In-flight slices (not planned, not disturbed)

• codebase-health/audit: Boundary routes to the sibling drift lanes #3810 shipped: PR feat(codebase-health): route the audit's Boundary to the seven sibling drift lanes #3828 merged 2026-09-06 (PR feat(codebase-health): route the audit Boundary to the sibling drift lanes #3829 was closed as a duplicate). The merged Boundary text does not contradict this plan.
• instruction-placement/delta: persist baseline in artifact-protocol baselines/ slot instead of ephemeral state-key #3811 in flight: PR feat(instruction-placement): persist the delta baseline in the artifact-protocol baselines slot #3831 open, conflicting against main, review threads open (PR feat(instruction-placement): split the delta lane's state — spine baseline in the protocol slot, declines on the tracked suppression surface #3833 was closed as a duplicate). The leaf names /instruction-placement:delta by slash name only and no path, so feat(instruction-placement): persist the delta baseline in the artifact-protocol baselines slot #3831's artifact relocation cannot contradict it.

Deferred questions

1. A generator need for "sibling plugin installed" and "memory-tier home persisted across runs", so supported stops over-reporting for this class.
2. An unattended token for /codebase-health:audit (outside this container's scope; the audit lane is unattended-viable only for small dimensions until then).
3. A consumer-side binding of the class for this repository (recurring-schedule row or autonomy binding).
4. The one judgment call: the row ships as v1 because the Brief requires a leaf and all three lanes are built, but no run record exists for these three lanes together. Recorded in autonomy/routines: add the drift-delta-sweep v1 class whose leaf fans to instruction-placement:delta, overengineering:delta, codebase-health:audit #3819 as a PR-review switch condition so the slice stays agent-ready; a join: ruling ships no leaf and re-slices autonomy/routines: add the drift-delta-sweep v1 class whose leaf fans to instruction-placement:delta, overengineering:delta, codebase-health:audit #3819. A human may pre-empt here.