feat(source-control): explicit-autopilot merge-rung exception with fresh-agent resolution

README.md

@@ -80,7 +80,7 @@ user opts in with `/plugin enable`; an existing install is never flipped by cata
 - [`eol-normalizer`](plugins/eol-normalizer) — Normalize a written file's working-tree line endings to its .gitattributes eol value on edit — symmetric CRLF/LF driven by git check-attr, advisory and never blocking.
 - [`powershell-format`](plugins/powershell-format) — Auto-format and lint PowerShell on edit via PSScriptAnalyzer, only when a PSScriptAnalyzerSettings.psd1 governs the repo — using the consuming repo's own analyzer settings.
 - [`actionlint`](plugins/actionlint) — Lint GitHub Actions workflow files on edit via actionlint, surfacing findings as advisory context.
-- [`source-control`](plugins/source-control) — Git and GitHub delivery workflow: /commit (Conventional Commits + Co-Authored-By trailer via safe heredoc mechanics), /pull-request (prep, create, CI monitoring, review-comment triage, merge, CI-log fetch), /babysit-prs (self-pacing fleet loop — safe by default; opt-in worker/autopilot tiers add gate-checked merge and thread resolution behind a deterministic Python engine), /babysit-loop (the loop-lane merge lane: a standing or drain loop that invokes babysit-prs per cycle, configured through repo-scoped babysit_loop_* keys on the layered source-control.md seam, with merge authority human-only until the target repo's tracked config adopts the lane, a gate-proven C2-mechanical baseline once adopted, and merge-rung raises binding from the team-tracked layer only), /worktree (create, status, cleanup, audit for parallel-session isolation), /setup (check the effective commit-subject / PR-title convention merged across its config layers and the babysit-prs config, or apply — interview the repo and write the convention config to a chosen layer), and /resolve-conflicts (intent-first merge/rebase conflict resolution with a semantic-conflict sweep — never --abort). The commit-subject / PR-title convention is configurable via a source-control.md config written by a re-runnable setup skill, layered across a ~/.claude user-global file, the tracked team file, and a gitignored .claude/source-control.local.md personal overlay merged per key; Conventional Commits is the default when no convention is declared.
+- [`source-control`](plugins/source-control) — Git and GitHub delivery workflow: /commit (Conventional Commits + Co-Authored-By trailer via safe heredoc mechanics), /pull-request (prep, create, CI monitoring, review-comment triage, merge, CI-log fetch), /babysit-prs (self-pacing fleet loop — safe by default; opt-in worker/autopilot tiers add gate-checked merge and thread resolution behind a deterministic Python engine), /babysit-loop (the loop-lane merge lane: a standing or drain loop that invokes babysit-prs per cycle, configured through repo-scoped babysit_loop_* keys on the layered source-control.md seam, with merge authority human-only until the target repo's tracked config adopts the lane, a gate-proven C2-mechanical baseline once adopted, and standing merge-rung raises binding from the team-tracked layer only — with one named exception, where an invocation line explicitly typing both the autopilot tier keyword and the dedicated raise argument --merge c3-this-run widens that single invocation's merge authority up to C3 behind a fresh independent frontier-tier resolver, while C4-structural and C5-untrusted-provenance stay unconditionally human-merge), /worktree (create, status, cleanup, audit for parallel-session isolation), /setup (check the effective commit-subject / PR-title convention merged across its config layers and the babysit-prs config, or apply — interview the repo and write the convention config to a chosen layer), and /resolve-conflicts (intent-first merge/rebase conflict resolution with a semantic-conflict sweep — never --abort). The commit-subject / PR-title convention is configurable via a source-control.md config written by a re-runnable setup skill, layered across a ~/.claude user-global file, the tracked team file, and a gitignored .claude/source-control.local.md personal overlay merged per key; Conventional Commits is the default when no convention is declared.
 - [`implementation`](plugins/implementation) — Disciplined implementation stage: execute approved plans inline (`/implementation:implement`) or via orchestrated worker subagents (`/implementation:implement-dispatch`) with incremental validation, TDD-by-default cadence, green-checkpoint commits, scope-fence drift detection, and divergence detection that routes back to planning. Build/test/lint, testing, and outcome verification live in the companion `toolchain`, `testing`, and `verification` plugins, invoked when installed.
 - [`toolchain`](plugins/toolchain) — Repo-agnostic polyglot verification toolchain: build + test + lint for changed files across .NET, Python, TypeScript, Bash, PowerShell, Markdown, Go, YAML, and cross-cutting surfaces (`/toolchain:check`, `/toolchain:lint`), plus a re-runnable `/toolchain:setup` with check (report the configured ecosystems and their command surface) and apply (interview, infer, and write the tracked per-ecosystem command config those skills resolve first).
 

docs/conventions/config-cascade/README.md

@@ -204,7 +204,7 @@ open.
 
 | Surface | Consumer config path | Layers | Conformance |
 |---|---|---|---|
-| `source-control` | `.claude/source-control.md` | all three | conforms (per-key override, #660); enforcement reads team-tracked only per [`commit-convention`](../commit-convention/README.md); loop-lane keys (`babysit_loop_*`, read by the source-control babysit lane; the work-items lanes tie in via the loop-lane convention only) ride the same surface, with the merge-rung key in the policy-floor class — raises bind from the team-tracked layer only, per [`loop-lane`](../loop-lane/README.md) |
+| `source-control` | `.claude/source-control.md` | all three | conforms (per-key override, #660); enforcement reads team-tracked only per [`commit-convention`](../commit-convention/README.md); loop-lane keys (`babysit_loop_*`, read by the source-control babysit lane; the work-items lanes tie in via the loop-lane convention only) ride the same surface, with the merge-rung key in the policy-floor class — standing raises bind from the team-tracked layer only, and the one named single-invocation exception is an explicitly typed argument rather than a config value in any layer, per [`loop-lane`](../loop-lane/README.md) |
 | `toolchain` / `ecosystem-commands` | `.claude/ecosystems/<ecosystem>.yaml` | all three | conforms |
 | `codebase-health` | `.claude/codebase-health.md` | all three | conforms (concatenating, with a declared empty-list opt-out) |
 | `github` | `.claude/github/` (`routing.yaml` per-key override, `conventions.md` concatenating) | all three | conforms; policy-floor inversion on write-posture routing keys, declared in the plugin's `change-routing.md` |

docs/conventions/loop-lane/CHANGELOG.md

@@ -5,6 +5,49 @@ topology, the escalation contract, the capability-tier vocabulary, or any loop-l
 major bump, and additive guidance is a minor bump. A new model release re-audits the capability-tier
 table (§3) and is recorded here.
 
+## 3.0.0 — 2026-07-25
+
+Repo-owner-ratified addition of a single named, explicit-argument exception to the seam-only merge
+rung, requested and scoped in
+[melodic-software/claude-code-plugins#1309](https://github.com/melodic-software/claude-code-plugins/issues/1309).
+A change to the autonomy-ladder invariant is a major bump per this file's own rule.
+
+- **Autonomy ladder** — an invocation whose own argument line explicitly types both the literal
+  `autopilot` tier keyword and the dedicated raise argument `--merge c3-this-run` (each never
+  inherited, never defaulted, never seam-supplied, never model-composed on the caller's behalf)
+  widens that single invocation's merge authority up
+  to and including C3, in a repository that has already adopted the baseline rung. The raise token
+  exists for this exception alone — `autopilot` predates it as a merge-inert tier keyword, so a
+  saved invocation or expanded template carrying the tier keyword alone acquires no merge
+  authority. Persists nothing
+  to config; is not a substitute for the recorded C3-autonomous seam flip. **C4 (structural) and C5
+  (untrusted-provenance) stay unconditionally human-gated** — no rung, seam, or argument, including
+  this one, ever reaches them, per the autonomy matrix's own "never promotes" cells. The exception
+  lifts only the *raise* restriction: every other merge-dimension value still only selects a lower
+  rung, and
+  C5 is derived from the PR's own provenance rather than the linked item's recorded class, so a fork
+  PR closing an internally-classified C2/C3 item is outside the exception.
+- **Human blocking feedback, operator-parked items, and merge conflicts stay outside the dispatch.**
+  A `CHANGES_REQUESTED` review, explicit human blocking language, or an unresolved inline human
+  thread remains a stop-and-ask condition the exception does not amend. An item wearing the §2 role
+  label *without* the machine escalation marker is operator-parked and belongs to the attended
+  queue, so the label alone never authorizes a dispatch. Conflicts route to a lane's merge-only
+  conflict path, never a rebase.
+- **The floor reads the pull request, and the dispatch holds its lease.** C5 follows the code's
+  provenance and C4 the diff's blast radius, both derived from the PR rather than the linked item's
+  stamp, with a class/diff mismatch failing closed; a repository-owner allowlist never substitutes
+  for the provenance test. The provenance test is executable, not a vibe: a cross-repository head,
+  or an author the provider does not attest as an owner or member of the base repository — an
+  outside collaborator on a base-repository branch is external despite a same-repository head — and
+  an unavailable signal fails closed to C5. The floor's verdict attaches to the exact head SHA it
+  examined: any later push, the resolver's or the merge-capable worker's own, re-derives the
+  verdict before any merge. The dispatch runs under the PR's own worker lease and resolves its
+  capability tier through §3's binding, never a family alias fixed in a lane.
+- **Capability tiers** — the explicit-`autopilot` exception's frontier-tier dispatch additionally
+  requires context independence: no shared conversation history with whatever produced or previously
+  reviewed the PR. A same-context or self-continuation dispatch does not satisfy the exception even at
+  the frontier tier.
+
 ## 2.0.0 — 2026-07-24
 
 Tier ratified as **major**. Both corrections touch a shared invariant: B4 replaces a stated

docs/conventions/loop-lane/README.md

@@ -35,10 +35,15 @@ attended queue. No lane crosses into another's authority.
 Merge authority is a configurable ladder with the safest rung shipped by default: **human merge for
 every PR except gate-proven C2-mechanical ones**. The exception is a *work-class* test, not an
 authorship test — a PR qualifies only when the item classifies C2 (mechanical), whether a bot, a
-human, or a worker authored it; bot authorship alone is never sufficient. C3, C4, C5, and
-unclassified items stay human-gated regardless of author. Higher rungs — up to full autonomy, where
-frontier-tier subagents resolve conflicts, answer review comments, and drive a PR to merge — are
-opt-in per repository.
+human, or a worker authored it; bot authorship alone is never sufficient. C3 and unclassified items
+stay human-gated regardless of author, by default. **C4 (structural) and C5 (untrusted-provenance)
+stay human-gated unconditionally — no rung, no seam config, and no invocation argument ever reaches
+them**, per the autonomy matrix's own promotion contract: "never promotes — human merge always; no
+evidence predicate exists for these cells"
+([`work-classes.md`](../../../plugins/autonomy/reference/guardrails/work-classes.md#suggested-default-predicates)).
+Higher rungs — up to full autonomy, where frontier-tier subagents resolve conflicts, answer review
+comments, and drive a PR to merge — are opt-in per repository, and are bounded by that C4/C5 floor
+regardless of rung name.
 
 This shipped default is itself the recorded baseline rung, versioned in this convention and in the
 tracked seam config. A repository adopts it through its own reviewable lane-enabling change — the
@@ -53,11 +58,63 @@ C3-autonomous merge is therefore reachable only through a recorded, reviewable f
 default — the matrix's promotion contract honored by construction. Demotion stays automatic and
 fail-closed, per the same owner doc.
 
-**Merge-rung raises are seam-only.** Invocation arguments never raise the merge rung: a raise binds
-only from the tracked seam config layer, so every increase in merge authority is the recorded,
-reviewable act above. An argument may select a *lower* (safer) rung for a single run, never a higher
-one — argument precedence, which wins for other lane dimensions, is floored at the seam-config rung
-for merge authority.
+**Merge-rung raises are seam-only, with one named, explicit paired-argument exception.** Invocation
+arguments never raise the merge rung *implicitly*: a raise binds only from the tracked seam config
+layer, so every increase in the *standing* merge authority is the recorded, reviewable act above. An
+argument may otherwise only select a *lower* (safer) rung for a single run, never a higher one.
+
+The one exception: an invocation whose own argument line explicitly types **both** the literal
+`autopilot` tier keyword **and** the dedicated raise argument `--merge c3-this-run` (each never
+inherited, never defaulted, never supplied by a config layer, never composed by a model on the
+caller's behalf) — in a repository that has already adopted the baseline rung above — widens that
+single run's merge authority to cover every work class up to and including C3, still short of the
+unconditional C4/C5 floor. The pair is deliberate: `autopilot` predates the exception as a
+merge-inert tier keyword, so a saved invocation, alias, or expanded template that already carries
+it must acquire no merge authority — the tier keyword alone leaves the merge rung at the seam
+value. `c3-this-run` exists for this exception alone, so its presence is never a leftover; it is
+not a rung name and is invalid in seam config. This is a **per-invocation, single-run widening**,
+not a standing rung change: it persists nothing to config, ratifies nothing on the governance
+surface, and reverts the moment a launched invocation omits either token. It is not a substitute
+for the recorded C3-autonomous flip above — a repository wanting *standing* C3 autonomy still needs
+that seam config change; this exception only ever covers the one invocation that named it.
+
+**A safer argument still wins.** The exception lifts only the *raise* restriction, and the raise is
+mutually exclusive with a safer cap by grammar: every merge-dimension argument value other than
+`c3-this-run` only ever selects a lower rung, so an invocation naming `autopilot` and an explicit
+`human-only` merge rung merges nothing — the resolution order is tracked rung, then the paired
+raise, then the C4/C5 ceiling.
+
+**The C4/C5 floor tests the PR, not the item's stamp.** `work-classes.md` assigns a class from the
+risk-property bundle, "not the task's surface description", so a lane implementing the floor derives
+both from the pull request before comparing any recorded class to the rung. C5 follows the code's
+provenance — a cross-repository head, or an author the provider does not attest as an owner or
+member of the base repository (an outside collaborator pushing a base-repository branch is external
+despite a same-repository head; a missing or unreadable signal fails closed to C5) — which
+"dominates every other property", so a fork PR closing an internally classified C2/C3 item is still
+outside the exception; a repository-owner allowlist is not a trusted-author list and never stands in
+for that test. C4 follows the diff's blast radius: a refactor, migration, or contract change is C4
+however its item is stamped, and a PR whose shape no longer matches its recorded class fails closed
+to escalation. The floor's verdict attaches to the exact head SHA it examined: any push after the
+verdict — the pre-escalation resolver's or the merge-capable worker's own fix alike — re-derives
+the verdict on the new head before any merge, so no head merges that the floor never examined.
+
+Every PR this exception reaches that is blocked on a **machine-escalated** `needs-human` item, a
+contradictory or security-relevant **machine-authored** review thread, or an open finding gets a
+**fresh frontier-tier subagent** dispatched to resolve the blocker — sharing no context with
+whatever produced the PR (§3), and holding the PR's own worker lease for the duration — before the
+deterministic merge gate runs; the gate itself is never bypassed or weakened by this exception, only
+the human-ratification step ahead of it is replaced by an independent agent's resolution for this
+single run. The tier is resolved through §3's capability-tier binding, never a family alias fixed in
+a lane.
+
+**What the dispatch never reaches.** Human blocking feedback — a `CHANGES_REQUESTED` review,
+explicit human blocking language, an unresolved inline human thread — remains a stop-and-ask
+condition that escalates and is never resolved past; this exception does not amend a lane's own
+human-feedback contract. Nor does it reach an **operator-parked** item: §2's role label marks parked
+and machine-escalated items alike, and only the machine marker separates them, so an item without
+that marker stays the attended queue's and draws no dispatch. Merge conflicts route to a lane's
+dedicated conflict-resolution path and integrate merge-only; this exception never authorizes
+rebasing a PR branch, which would need a force-push the lanes forbid.
 
 ## 2. Escalation contract
 
@@ -92,6 +149,15 @@ pairings are valid, and a fast orchestrator paired with an advisor at or above t
 recommended shape); a reviewer or verifier is never weaker than the implementer; a security-surface
 work class routes to the frontier tier unconditionally.
 
+**Independence, where a dispatch stands in for human ratification.** The one dispatch that resolves
+a blocker in place of a human decision — the explicit-`autopilot` merge-authority exception (above)
+— additionally requires the frontier-tier subagent to be a **fresh context sharing no conversation
+history with whatever produced or previously reviewed the PR**: not a continuation of the PR-authoring
+session, and not the same subagent instance that already replied on the thread being resolved. A
+same-context or self-continuation dispatch does not satisfy this requirement even at the frontier
+tier — the point of the tier is capability, the point of this rule is that the resolution is a
+genuinely independent second opinion, not the original author or reviewer re-affirming itself.
+
 **Runtime resolution is by model alias only.** The bare family-word aliases
 (`fable` / `opus` / `sonnet` / `haiku`) are the live-updating handles that resolve to the current
 recommended model for the provider and update over time; a dated model name is a pinned snapshot and