autonomy: lane runtime resilience — event-triggered cloud Routines, auto-mode verification, deterministic stop gate, STOP notifications, PostCompact re-injection

[kyle-sexton]

Category: operational resilience (umbrella) · Source: control-tower gap-hunt 2026-07-19 (Boris/Fable playbook audit vs operating procedures)

Problem — the pipeline is ATTENDED; leave week is when attendance fails

All lanes are laptop-bound /loop sessions dependent on daily human rituals (restart, git pull, plugin update). /loop jobs expire 7 days after creation and die on laptop close; a missed restart during leave (2026-07-20 → 07-26) kills a lane silently until the next ritual. Verified: none of hooks/schedules/auto-mode/notifications/Routines appear anywhere in the 8 .work pipeline docs.

Members (one umbrella; each independently shippable)

1. Event-triggered cloud Routines [Boris §43/§61 — highest structural win]: port babysit + triage to Anthropic-infra Routines fired on GitHub events (PR-opened → babysit/review; issue-opened → triage; review-submitted → response). Kills laptop-bind, loop expiry, AND idle-poll latency. Work lane may stay /loop or move to Routine-schedule. Empirical check first: Routines feature availability + event-trigger support on the current plan.
2. Auto-mode verification [Boris §68/§90]: lanes run unattended today — verify the mechanism is the red-teamed classifier auto-mode, not blanket --dangerously-skip-permissions. Safer AND a prerequisite for multi-agent workflows (one permission prompt freezes a run). Document the finding in operating-procedures.
3. Deterministic lane-stop gate [Boris §7/§13/§77]: "a lane that stops itself is a bug — file it" is a prompt admonition, not a mechanism. Root-cause fix: Stop hook and/or /goal-style completion self-check intercepting every stop attempt. Converts stopped-lane from hoped-against to structurally-prevented. (Consumes feat: /goal prompt-crafting skill — docs-conformant goal shape + mechanical length check #481's /goal crafting skill.)
4. Operator notification on STOP/repeated-failure [Boris §70/§75]: a down lane currently sits silent until the next ritual. Stop hook → push notification (system/Slack). Cheap; pairs with member 3.
5. PostCompact re-injection [Boris §41, secondary]: if autocompact fires before the 50%-restart trigger, gate state + week directive + "don't do X" constraints drop. PostCompact hook re-injects them. The 50%-restart + re-orient-from-GitHub pattern itself is endorsed practice — keep it.

Relations

#508 (headless lane launcher — same goal, launcher becomes the Routine/loop bootstrap), #500/#504 (cadence bugs — event triggers obsolete polling cadence entirely), #481 (/goal), #479 (stop-rule absorption).

---

Reference: Boris Cherny, "Steps of AI Adoption" (Google Doc)

[kyle-sexton]

This was generated by AI during triage. · Category: operational resilience (umbrella) · Priority: priority: high — LEAVE-WEEK-CRITICAL: leave 2026-07-20→07-26 starts tomorrow; a missed restart silently kills a lane with no operator present. This is the week's top operational risk. Routed needs-human + wayfind: design. Decompose candidate.

Why needs-human

Five resilience members, each independently shippable, but the umbrella needs maintainer design + an empirical capability check before build — cloud-Routine availability, the auto-mode mechanism, and hook wiring are infra/product decisions, and the leave-week timing forces a sequencing call.

Members (sequenced by leave-week leverage)

1. Event-triggered cloud Routines [highest structural win] — port babysit + triage to Anthropic-infra Routines fired on GitHub events (PR-opened → babysit/review; issue-opened → triage; review-submitted → response). Kills laptop-bind, /loop 7-day expiry, AND idle-poll latency in one move. Empirical first: verify Routines availability + event-trigger support on the current plan before designing against it.
2. Auto-mode verification — confirm unattended lanes run the red-teamed classifier auto-mode, NOT blanket --dangerously-skip-permissions (one permission prompt freezes a run; also a multi-agent prerequisite). Document in operating-procedures.
3. Deterministic lane-stop gate — "a lane that stops itself is a bug" is a prompt admonition, not a mechanism. Root-cause: Stop hook and/or /goal-style completion self-check intercepting every stop. Consumes feat: /goal prompt-crafting skill — docs-conformant goal shape + mechanical length check #481 (/goal skill).
4. Operator notification on STOP/repeated-failure — Stop hook → push (system/Slack); a down lane is currently silent until the next ritual. Cheap; pairs with member 3.
5. PostCompact re-injection — if autocompact fires before the 50%-restart trigger, gate state + week directive + constraints drop; PostCompact hook re-injects. (Keep the endorsed 50%-restart + re-orient-from-GitHub pattern.)

Recommendation

Given leave starts tomorrow, the maintainer should decide the minimum leave-week safety set now — at least members 3+4 (deterministic stop + STOP notification) are cheap hooks that prevent silent lane-death during leave even if cloud Routines (member 1) is a larger post-leave build. Empirically check Routines availability immediately.

Relations: #508 (headless launcher — becomes the Routine/loop bootstrap), #500/#504 (cadence bugs — event triggers obsolete polling), #481 (/goal), #479 (stop-rule absorption).

[kyle-sexton]

This was generated by AI during triage.

Trigger-mechanism research for member 1 (event-triggered Routines) — verified constraints + a sharper solution space

Operator raised the core inefficiency directly: a lane that idle-polls at ~30 min means a burst of issues arriving one minute into the wait sits untriaged for ~29 min; batching + fixed waits throttle velocity. Member 1's empirical-check ("Routines availability + event-trigger support") was run — findings (official docs, verified):

Verified against https://code.claude.com/docs/en/routines.md + https://platform.claude.com/docs/en/managed-agents/overview:

1. Cloud Routines support event triggers — NOT cron-only. Trigger types: scheduled (cron/one-off), GitHub events (PR opened/closed/labeled/synchronized/updated, Releases created/published/edited/deleted, with field filters), and API triggers (HTTP POST to a dedicated endpoint). So event-driven firing is real.
2. Cloud Routines do NOT run local/marketplace plugins — by design. They execute in headless cloud infra with no local machine state. Available instead: account-level MCP connectors, repository-committed .claude/skills/, and remote HTTP/SSE/WS MCP. Local stdio MCP + locally-installed marketplace plugins (our melodic-software/* skills, subagents, hooks) are not present. (Confirms the operator's recollection; it is current, not a resolved limitation.)

The real problem (sharper than "add Routines"): the event-capable mechanism (Routines) and the plugin-capable mechanism (local /loop) are disjoint. Our lanes depend on the plugin fleet, so Routines are not a drop-in trigger for them.

Solution space (for the human decision — one NEW option member 1 didn't list)

• (A) Trigger-bridge — keep execution local + plugin-capable, get events from the cloud [NEW, likely cheapest]. A lightweight Routine (or GitHub Action) fires on issues.opened / pull_request and hits a local API trigger / poke that wakes the running plugin-capable /loop immediately, instead of the lane waiting out its idle poll. The heavy plugin work stays local; only the wake signal comes from the cloud event. Sidesteps the plugin limitation entirely and directly kills empty-queue idle latency. Open q: does the local session expose a pokeable trigger endpoint? (verify — this is the crux of option A's feasibility.)
• (B) Rearchitect lanes → repo-committed .claude/skills/ + connectors, then native Routine event-triggers. Removes the plugin dependency so Routines run the lane natively. Biggest effort; also the "future-ready" path.
• (C) GitHub Actions / Agent SDK / Managed Agents. Actions is natively event-driven; Managed Agents (beta) support Skills + MCP server-side. Different execution substrate than the local fleet.

Constraint to verify for the TRIAGE lane specifically

The documented Routine GitHub triggers I could confirm enumerate PR and Release events + API triggers; an explicit issues.opened trigger was not confirmed in the trigger list (unconfirmed, not disproven). Triage keys on issue-opened — so option A/B's viability for this lane hinges on issue-event trigger support (or falling back to the API-trigger poke, which is event-source-agnostic). Verify before committing the triage lane to a Routine trigger.

Ties to existing pacing family

This is the same throughline as #500 (dynamic-loop idle when queue non-empty — fixed: immediate restart) and #504 (consume the engine's recommended_cadence). Those reduce latency within the polling model; member 1 / option A remove polling latency entirely via event-driven wakeups. Idle-poll on an EMPTY queue (a burst arriving mid-wait) is the residual latency none of the pacing fixes touch — the event-trigger/bridge is what closes it.

Sources: routines.md (Connectors §, "Add a GitHub trigger" §), Managed Agents overview. Confidence: plugin-unavailability + event-trigger-support = verified; issues.opened trigger + local-poke endpoint = unconfirmed, flagged for empirical check.

[kyle-sexton]

This was generated by AI (needs-human decision-brief pass).

Decision brief (2-minute read)

Prepared by an AI agent from the checkout at main 93013be. Builds on the two triage/research notes already here (routing + the verified Routines research); it does not restate them or supersede the wayfind: design / needs-human routing.

Problem. Every lane is a laptop-bound /loop session kept alive by daily human rituals, so a missed restart during leave (2026-07-20 -> 07-26, starts tomorrow) silently kills a lane with no operator present. The umbrella bundles five resilience members; the human decision is the minimum safety set to ship before leave vs. the larger post-leave rebuild.

Today (verified hook state — the enforcement members are unbuilt).

• plugins/claude-ops/hooks/hooks.json: PreCompact and StopFailure are wired but audit-only (pre-compact-audit.sh, api-error-audit.sh — telemetry, no intervention). There is no Stop hook, no PostCompact, no SessionStart anywhere in the plugin fleet. So members 3 (deterministic stop gate) and 5 (PostCompact re-injection) have no mechanism today — exactly as the body claims.
• A notification primitive already exists: plugins/desktop-notification/hooks/hooks.json -> desktop-notification.sh, but its matcher is permission_prompt|idle_prompt only — not wired to STOP or repeated-failure. So member 4 is a small rewire of an existing script, not new infra.
• Member 1 (cloud Routines) is already researched in the comment above and verified blocked as a drop-in: cloud Routines do not run local marketplace plugins, so the plugin-dependent lanes can't move to a native Routine trigger — the viable shape is the local "trigger-bridge" (cloud event pokes a local session) or a local headless relaunch, both still to design.
• Member 2 (auto-mode verification): the mechanism the unattended lanes actually run is not asserted anywhere in the pipeline docs; it needs an empirical check, not a build.

Options (this is a scope/sequencing decision, not a defaultable fork).

• A — RECOMMENDED. Ship the cheap leave-week safety set NOW (members 3 + 4); defer 1, 2, 5 to post-leave. Before leave, wire a Stop hook that intercepts stop attempts (deterministic lane-stop gate, member 3) and a STOP/repeated-failure notification that reuses the existing desktop-notification.sh (member 4). Tradeoffs: these are the two cheapest members and together they convert silent lane-death into "prevented + operator pinged" — the actual leave-week risk — without waiting on the Routines rearchitecture. Reversibility: high (two additive hooks; remove to revert). Future-risk: low; both compose with the later Routines/launcher work. Rationale: leave starts tomorrow, so the decision that matters this week is the minimum that prevents silent failure, and the verified state shows member 4 is nearly free (primitive exists) and member 3 is a single Stop hook.
• B — Also add member 5 (context re-injection) before leave. Wire SessionStart(source=compact) (the canonical post-compaction re-injection matcher) to re-seed gate state + week directive + constraints if autocompact fires. Tradeoffs: cheap-ish and directly relevant to a week-long unattended run; but it's a third hook to land under time pressure and it only mitigates compaction, not lane-death. Reversibility: high. Reasonable to fold into A if time permits.
• C — Full umbrella build (member 1 trigger-bridge / headless relaunch) before leave. Tradeoffs: highest structural win but it's the largest, least-verified piece (local-poke endpoint feasibility still open per the research comment); not shippable safely before tomorrow. Defer to post-leave.
• D — Do-nothing-mechanical; rely on rituals + evidence-over-memory. Tradeoffs: zero build, but accepts the exact silent-death risk this issue was filed to close during the one week no operator is present. Rejected as the leave-week answer.

Cross-links.

• loops/skills: /loop does not reset context per cycle — "restart at ~50%" is an unenforceable admonition, no mechanism triggers a /clear (session ran 13 cycles → ~70%) #551 — the context-reset facet (loop can't /clear itself); already carries its own decision brief. Member 5 here and loops/skills: /loop does not reset context per cycle — "restart at ~50%" is an unenforceable admonition, no mechanism triggers a /clear (session ran 13 cycles → ~70%) #551's re-injection option are the same mechanism — coordinate, don't double-build.
• ops: scripted lane launcher — start/restart loop lanes headlessly from canonical prompt files #508 (headless launcher) / loops: script the deterministic lane mechanics — machine-behavior block, #502 telemetry upsert, wire script-the-deterministic-work into prompt ritual #538 (scriptable mechanics) — the natural home for the member 1 relaunch/trigger-bridge; post-leave.
• loops/skills: self-paced /loop idles between non-empty cycles — cadence should be work-state-driven (no delay when queue non-empty), not a guessed clock #500 / source-control:babysit-prs + loop: dynamic /loop wakeups ignore the engine's own recommended_cadence field #504 — polling-cadence fixes; member 1 event-triggers would obsolete polling, but the cadence fixes stand independently.
• feat: /goal prompt-crafting skill — docs-conformant goal shape + mechanical length check #481 (/goal) / work-items(work): absorb v4 loop-prompt execution rules into the skill #479 (stop-rule absorption) — consumed by member 3's completion self-check.
• work-items(work) + autonomy: unattended loop prompts the human — core git/gh verbs and out-of-tree write dirs missing from a shippable permission preflight #495 — decided: loop permission recipe blessed (interim live grant + durable home melodic-software/dotfiles#233); this is the auto-mode/permission precedent for member 2's verification — check the lanes run that blessed recipe, not blanket --dangerously-skip-permissions.

Decision asked: Ship Option A (Stop-gate + STOP-notification, reusing desktop-notification.sh) before leave and defer members 1/2/5 — yes, or fold in member 5 (Option B)?

[kyle-sexton]

Operator decision (2026-07-19, decision-session batch 3; relayed).

ACCEPTED — the decision brief's RECOMMENDED option verbatim.

Re-intake: removing needs-human, adding priority: needs-triage for routing.