feat(autonomy): verification topology, merge gating, and the Q21 probe obligation

plugins/autonomy/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "autonomy",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "description": "Governed autonomous agent operation: role-topology, binding-seam, wiring-vs-advisor, telemetry, return-accounting, trigger-dispatch, per-work-class guardrail-matrix, standing-routine-catalog, and design-only runner-charter contracts for climbing the AI-adoption ladder, plus a guided-setup skill that discovers an adopting org's state, writes its schema-versioned binding, wires standards-pinned OTLP emission with a zero-cost file-artifact default, wires human-attested return capture at the task boundary, wires signal adapters with one governed dispatch entrypoint, binds the five-class guardrail matrix to an org's isolation substrates with an in-boundary live-validation probe before recording each fail-closed binding, and stands up standing-routine-catalog classes as scheduled temporal signal adapters behind the one governed queue with free scheduling defaults wired as reviewable changes and each routine's work-class mapping homed on the security surface.",
   "author": {
     "name": "Melodic Software",
@@ -25,7 +25,7 @@
     "lane_stop_gate_enabled": {
       "type": "boolean",
       "title": "lane-stop gate",
-      "description": "Opt an autonomous lane into the deterministic Stop-hook completion gate. Default OFF \u2014 a Stop-blocking hook must never engage for an interactive session. Honored from user or managed settings only (the gate reads those files itself); per-session lanes are armed by the claude-ops lane launcher instead. The env mirror is never authority (#1784).",
+      "description": "Opt an autonomous lane into the deterministic Stop-hook completion gate. Default OFF — a Stop-blocking hook must never engage for an interactive session. Honored from user or managed settings only (the gate reads those files itself); per-session lanes are armed by the claude-ops lane launcher instead. The env mirror is never authority (#1784).",
       "default": false
     },
     "lane_stop_gate_sentinel": {
@@ -43,7 +43,7 @@
     "lane_stop_gate_arm_id": {
       "type": "string",
       "title": "lane-stop gate arm id (launcher-managed)",
-      "description": "Written by the lane launcher at launch: names this session's arm record in the plugin's own data directory (hooks/lane-stop-gate-arm.sh). A capability pointer, never authority by itself \u2014 the gate validates it, honors only a record in its install-derived store, and binds it to the first presenting session. Not set by hand.",
+      "description": "Written by the lane launcher at launch: names this session's arm record in the plugin's own data directory (hooks/lane-stop-gate-arm.sh). A capability pointer, never authority by itself — the gate validates it, honors only a record in its install-derived store, and binds it to the first presenting session. Not set by hand.",
       "default": ""
     },
     "lane_notify_enabled": {
@@ -63,6 +63,18 @@
       "title": "lane-notify terminal channel",
       "description": "Audible bell + OSC 9 notification written to the controlling terminal for the lane-stop alert.",
       "default": true
+    },
+    "verification_lens_pool": {
+      "type": "string",
+      "title": "verification lens pool",
+      "description": "Ordered, comma-separated pool of verification lenses the model-adjudicated checker slots draw from — one distinct lens per slot, in pool order. Tokens come from the closed vocabulary in the verification-topology contract leaf; an unrecognized token is recorded as unresolved and draws no lens, and a pool shorter than a class's model-adjudicated slot count leaves the remaining slots unlensed rather than repeating a lens. The pool contributes to no count: how many checkers a class runs, how they must differ, and whether one must be cross-vendor are floors on the org's security binding, outside this setting's reach.",
+      "default": "specification,adversarial,contract,regression,evidence"
+    },
+    "visual_narration_enabled": {
+      "type": "boolean",
+      "title": "advisory visual narration lane",
+      "description": "Run the advisory visual narration lane: strictly downstream of deterministic detection, it writes a plain-language account of a difference the deterministic layer already found and attaches it to the run record for the human gate. Advisory only — it emits no verdict, fills no checker slot, is counted by no floor, and never gates a transition; no cell anywhere names it as authority. Default OFF: it is inert without an upstream deterministic comparator, and each narrated artifact is a metered vision-model call.",
+      "default": false
     }
   }
 }

plugins/autonomy/CHANGELOG.md

@@ -6,6 +6,47 @@ All notable changes to the `autonomy` plugin are documented here. Format follows
 Versions 0.1.0–0.7.0 predate this file (introduced with 0.7.1); their history lives in the
 merged work-package PRs (#333, #343, #356, #372, #377, #600, #676).
 
+## [0.16.0]
+
+### Changed — ACTION REQUIRED for anyone with an existing `L2`/`L3` binding, or auto-merge bound
+
+- **Every `L2`/`L3` level binding now carries `component_reachable_hosts`, and a level without it
+  is UNPROVEN.** Target selection is what makes the egress assertion mean anything: a probe that
+  samples only hosts the surface's installed components never request certifies a boundary that is
+  in fact open. Measured, not theorized — 201,961 bytes of origin data crossed a global
+  default-deny through a component-installed allow rule. The field is the human-ratified set of
+  destinations those components may request, and the probe must cover it in FULL, since each
+  destination is a separate policy decision. **The empty list is a valid and meaningful value:** it
+  is the explicit claim that the surface installs nothing carrying policy rules of its own. **To
+  restore dispatch: ratify the list (or the empty list) on the level entry and re-probe so the
+  transcript covers it.**
+- **A class bound `auto` merge with a verification layer below `blocking` is now an INVALID
+  binding.** An automatic transition requires unanimous agreement among the checkers the class
+  declares, and an advisory layer records a dissent without withholding the transition — so the
+  configuration promised a gate it could not deliver. Bindings that encoded this are rejected with
+  a finding naming the remedy. **To restore: set the layer to `blocking` (ratifying its promotion
+  cell where promotable), or bind the class to `human` merge.** Demotion now cascades from the
+  `C3` AI-review cell to `C3` auto-merge for the same reason.
+
+### Added
+
+- **Verification topology** (`reference/guardrails/verification-topology.md` + a sixth guardrail
+  matrix column): who verifies a change, how those verifiers must differ, and the per-class floor
+  for how many there are — expressed as pipeline roles, relational constraints, and predicates a
+  binding can actually evaluate, with no capability label anywhere in the contract. Floors ship as
+  `min_checkers` and `min_model_checkers` per class, both tighten-only on the agent-unwritable
+  security binding. `cross_vendor_required` is never vacuously satisfiable, and vendor disjointness
+  holds among the model-adjudicated slots rather than only against the generator.
+- **`verification_topology`** as an optional top-level security-binding key modeling all three axes.
+  Absent is not a hole — the shipped floors apply, as `escalation_severity` already does — so
+  `schema_version` stays `"1.0"` and every existing binding keeps validating.
+- **Two `userConfig` options:** `verification_lens_pool` (what angle each model-adjudicated checker
+  is asked to take) and `visual_narration_enabled` (an advisory narration lane, default off). Both
+  live on the operator surface rather than the security binding because neither counts anything —
+  the pool seats no slot and the lane has no binding cell at all, so neither can weaken a floor.
+  The lane is structurally incapable of gating: no cell exists anywhere through which authority
+  could be granted to it.
+
 ## [0.15.1]
 
 ### Changed

plugins/autonomy/README.md

@@ -26,10 +26,11 @@ state and records that binding.
   lease) — plus the setup trigger/dispatch slice, its adapter and acknowledgment templates,
   and the signal-envelope conformance check.
 - **Guardrail matrix** (`reference/guardrails.md`): five semantic work classes (`C1`–`C5`)
-  crossed with five enforcement columns — isolation floor, verification layers, merge policy,
-  cost tier, escalation — as one progressive-disclosure hub with on-demand leaves (isolation
-  ladder, work classes, security review, admission policy), human-ratified promotion with
-  automatic fail-closed demotion, and a two-surface binding split by governance sensitivity
+  crossed with six enforcement columns — isolation floor, verification layers, verification
+  topology, merge policy, cost tier, escalation — as one progressive-disclosure hub with
+  on-demand leaves (isolation ladder, work classes, security review, verification topology,
+  admission policy), human-ratified promotion with automatic fail-closed demotion, and a
+  two-surface binding split by governance sensitivity
   (security axes on the settings-as-code home outside agent blast radius; non-security remaps
   repo-local) — plus the contract-owned security-binding schema and its semantic check, and the
   setup guardrail slice that detects substrates per surface, live-validates isolation with an
@@ -192,6 +193,8 @@ reads it from.
 | `lane_notify_enabled` | boolean | `true` | `CLAUDE_PLUGIN_OPTION_LANE_NOTIFY_ENABLED` | Master switch for the operator alert fired when a lane stops without signaling completion. |
 | `lane_notify_os_toast_enabled` | boolean | `true` | `CLAUDE_PLUGIN_OPTION_LANE_NOTIFY_OS_TOAST_ENABLED` | OS-native desktop toast (macOS/Linux) for the lane-stop alert. |
 | `lane_notify_terminal_enabled` | boolean | `true` | `CLAUDE_PLUGIN_OPTION_LANE_NOTIFY_TERMINAL_ENABLED` | Audible bell + OSC 9 notification written to the controlling terminal for the lane-stop alert. |
+| `verification_lens_pool` | string | `"specification,adversarial,contract,regression,evidence"` | `CLAUDE_PLUGIN_OPTION_VERIFICATION_LENS_POOL` | Ordered, comma-separated pool of verification lenses the model-adjudicated checker slots draw from — one distinct lens per slot, in pool order. Tokens come from the closed vocabulary in the verification-topology contract leaf; an unrecognized token is recorded as unresolved and draws no lens, and a pool shorter than a class's model-adjudicated slot count leaves the remaining slots unlensed rather than repeating a lens. The pool contributes to no count: how many checkers a class runs, how they must differ, and whether one must be cross-vendor are floors on the org's security binding, outside this setting's reach. |
+| `visual_narration_enabled` | boolean | `false` | `CLAUDE_PLUGIN_OPTION_VISUAL_NARRATION_ENABLED` | Run the advisory visual narration lane: strictly downstream of deterministic detection, it writes a plain-language account of a difference the deterministic layer already found and attaches it to the run record for the human gate. Advisory only — it emits no verdict, fills no checker slot, is counted by no floor, and never gates a transition; no cell anywhere names it as authority. Default OFF: it is inert without an upstream deterministic comparator, and each narrated artifact is a metered vision-model call. |
 
 ### How to set these
 

plugins/autonomy/reference/autonomous-pipeline-reminder.md

@@ -106,9 +106,9 @@ the rest — not a gate presented as if it covered all seven.
 ## Provenance
 
 The clause set is this repository's own wording of guidance published in a model vendor's prompting
-guide for its frontier model. It is authored here rather than reproduced, per this repository's rule
-against hand-copying upstream content — so it is a locally-owned artifact that cannot silently drift
-out of sync with a copy, while the guide stays the thing to read when the upstream advice changes.
+guide. It is authored here rather than reproduced, per this repository's rule against hand-copying
+upstream content — so it is a locally-owned artifact that cannot silently drift out of sync with a
+copy, while the guide stays the thing to read when the upstream advice changes.
 
 **The citation, the exact section, and the recheck trigger live in the plugin
 [`README.md`](../README.md), not here.** These `reference/` contracts are written in surface classes

plugins/autonomy/reference/guardrails.md

@@ -1,7 +1,7 @@
 # Guardrails
 
 Normative contract for per-work-class guardrail enforcement: five semantic risk classes
-(`C1`–`C5`) crossed with five guardrail columns, in one matrix. This document is the hub and
+(`C1`–`C5`) crossed with six guardrail columns, in one matrix. This document is the hub and
 glance layer of a progressive-disclosure contract — the matrix plus the one-line class and
 column definitions below alone answer "what governs class X"; every deeper question routes to
 a named leaf under `guardrails/`, loaded on demand. Vocabulary is contract-owned; every
@@ -16,13 +16,13 @@ guardrail axis. That sentence is the playbook's; the five-class taxonomy, the pe
 blocking knobs, and the promotion predicates that fill the cells are this contract's own
 instantiation of it — the playbook names the obligation, this contract supplies the mechanism.
 
-| Class | Min isolation (unattended) | Verification | Merge policy | Cost tier | Escalation |
-|---|---|---|---|---|---|
-| C1 | L2 (exfil surface remains) | output-shape checks | n/a; artifacts via queue audit trail | economy | low |
-| C2 | L2 | deterministic blocking | auto-merge ELIGIBLE after per-class promotion trigger; ships human-gated | economy | gate failure → human |
-| C3 | L2 | deterministic blocking + AI review (advisory, promotable per [the security-review policy](guardrails/security-review.md)) | auto-merge ELIGIBLE after per-class promotion trigger; ships human-gated | standard | divergence/failed verify → human |
-| C4 | L2 | deterministic + AI + human review mandatory | human merge always | premium | upfront plan approval |
-| C5 | L3 | full gates + zero secret exposure | human merge always | standard | always |
+| Class | Min isolation (unattended) | Verification | Verification topology | Merge policy | Cost tier | Escalation |
+|---|---|---|---|---|---|---|
+| C1 | L2 (exfil surface remains) | output-shape checks | 1 checker | n/a; artifacts via queue audit trail | economy | low |
+| C2 | L2 | deterministic blocking | 1 checker | auto-merge ELIGIBLE after per-class promotion trigger; ships human-gated | economy | gate failure → human |
+| C3 | L2 | deterministic blocking + AI review (advisory, promotable per [the security-review policy](guardrails/security-review.md)) | 2 distinct checkers, 1 a model judge | auto-merge ELIGIBLE after per-class promotion trigger; ships human-gated | standard | divergence/failed verify → human |
+| C4 | L2 | deterministic + AI + human review mandatory | 3 distinct checkers, 2 vendor-disjoint model judges | human merge always | premium | upfront plan approval |
+| C5 | L3 | full gates + zero secret exposure | 3 distinct checkers, 2 vendor-disjoint model judges | human merge always | standard | always |
 
 ### Classes
 
@@ -40,6 +40,10 @@ instantiation of it — the playbook names the obligation, this contract supplie
   for running the class unattended.
 - **Verification** — the gate layers a change must pass, with per-layer blocking knobs bound
   on the governance surface.
+- **Verification topology** — the floor for how many DISTINCT checker slots verify the class
+  and whether they must be vendor-disjoint; roles, relational constraints, and predicates are
+  contract vocabulary, instances org-bound. The leaf owns these floor values; the cells above
+  are their glance restatement.
 - **Merge policy** — who lands the change; promotion-gated where the cell says so.
 - **Cost tier** — contract vocabulary (`economy` | `standard` | `premium`); the org binds
   tiers to model instances. Policy vocabulary only — cost enforcement is out of scope.
@@ -56,6 +60,7 @@ answered from this document:
 | What each level means, which substrate classes satisfy it, what happens when none does | [isolation-ladder](guardrails/isolation-ladder.md) |
 | What exactly is in each class, and how a promotable cell promotes or demotes | [work-classes](guardrails/work-classes.md) |
 | Which verification layers exist and which block, per class | [security-review](guardrails/security-review.md) |
+| Which roles verify a class, how they must differ, and the shipped checker floors | [verification-topology](guardrails/verification-topology.md) |
 | Which signals may enter the queue autonomously, and under what caps | [admission-policy](guardrails/admission-policy.md) |
 
 ## Permission posture
@@ -65,14 +70,23 @@ per-action prompts remain the control; at `L2` and above the whole-process bound
 control, replacing per-action prompts. The [isolation-ladder](guardrails/isolation-ladder.md)
 leaf carries this note in context.
 
+## Automatic transitions
+
+Unanimity is not a matrix column: every transition a run takes without a human — merge and
+every stage before it — requires unanimous agreement among the checkers the class declares,
+and one dissent hands the item to the human gate and raises `verification-divergence` below.
+It is a fixed invariant, not a knob, so no cell above can express it. The
+[verification-topology](guardrails/verification-topology.md) leaf carries it in context,
+including what is enforced at binding-validity time today and what is deferred.
+
 ## Escalation
 
 Six escalation event classes:
 
 | Event class | Fires when |
 |---|---|
 | `gate-failure` | a blocking verification gate fails |
-| `verification-divergence` | a verification outcome diverges from the expected or claimed result |
+| `verification-divergence` | a verification outcome diverges from the expected or claimed result, or two checkers of one class disagree |
 | `admission-rejection` | the admission seam rejects a signal as an audited rejection |
 | `demotion` | contrary evidence automatically demotes a promoted cell |
 | `structural-plan-approval` | a `C4` item requires upfront plan approval before execution |