docs(autonomy): record the topology obligations on the seam that receives them

[kyle-sexton]

Summary

#2326 states plainly that per-run verdict aggregation and resolved-instance distinctness ship unverified, because no runner exists to carry them. It recorded that deferral only on the leaf making it. The runner charter — the seam receiving the work — said nothing.

A deferral the receiving seam does not name is indistinguishable from an obligation nobody owns. Whoever builds the runner reads its charter, not the leaf that quietly assigned them three requirements.

All three land in ## Inherited constraints, where the charter already cites its owning contracts rather than restating them:

• aggregating verdicts under the unanimity invariant, including the checker-timeout and no-verdict cases no static check reaches;
• refusing to count two checkers the binding held distinct that RESOLVE to one instance;
• drawing lenses per the leaf's draw rule.

Each is stated as a hole until the build trigger fires — the charter's own idiom, and consistent with its trigger-gated build.

Test plan

• node scripts/validate-plugin-contracts.mjs — 45 setup skills, 2412 files.
• bash scripts/check-changelog-parity.sh --check — passes.
• grep -rniE "frontier|flagship|daily driver" plugins/autonomy/reference/ — empty.
• Docs-only; no schema, checker, or fixture change.

Related

No linked issue — found by a post-merge sweep checking whether #2326's stated deferrals were recorded anywhere they would actually be read.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 44s —— View job

---

Security Review

• Gather context (gh pr diff, read changed files)
• Review changes for security issues
• Post findings

Scope reviewed (3 files, matches PR description):

• plugins/autonomy/.claude-plugin/plugin.json — version bump 0.16.2 → 0.16.3
• plugins/autonomy/CHANGELOG.md — new changelog entry
• plugins/autonomy/reference/runner.md — prose addition to ## Inherited constraints

Findings: none.

This PR is purely documentation/prose — it adds a changelog entry and a bulleted paragraph to a reference markdown file, plus a semver bump. There is no code, script, GitHub Actions workflow, permissions block, schema, or config logic in the diff, so there's no injection surface (command/SQL/path/template), no credential or token handling, and no authorization/access-control logic to evaluate. Nothing here touches permissions:, action pins, or trigger configuration, so there's nothing in this diff's scope for zizmor's advisory lane either.

No further action needed from a security standpoint.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 782427d473

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 2m 56s —— View job

---

Claude's Code Review

• Gather context (read CLAUDE.md, REVIEW.md, diff)
• Review changed files for correctness and alignment
• Post findings

This is a docs-only change adding three inherited-constraint bullets to plugins/autonomy/reference/runner.md's charter (plus matching CHANGELOG.md entry and patch version bump). The stated goal — making sure the runner charter, not just the verification-topology leaf, names the obligations that land on it — is sound and the change is well-scoped (23/1 lines, 3 files).

Two inline findings, both on plugins/autonomy/reference/runner.md:

1. 🔴 Important (line 76) — "checker-timeout and no-verdict cases" introduces no-verdict, a term the cited leaf (verification-topology.md lines 288–290) never uses — that paragraph names unanimous pass, single dissent, checker timeout, and duplicate checker identity. Given this document's own rule that inherited obligations are "cited never restated" (runner.md lines 13–14), the drift matters: it likely should read "single-dissent" to match the source's actual vocabulary. The same phrase is duplicated in the new CHANGELOG.md entry (line 19), so it needs the same fix there.

2. 🟡 Suggestion (line 78) — the third obligation (lens drawing) is presented as equally "a hole until the build trigger fires" alongside the other two, but only the other two are explicitly self-flagged as ship-unverified in the source leaf's "Two limits, stated rather than hidden" section. The draw rule itself carries no such flag in the leaf — it's ordinary normative behavior that (like nearly everything in this contract) simply requires a runtime to execute. Worth confirming this is a deliberate charter decision to record all runner-dependent behavior here, not an overstatement of what the leaf itself recorded.

Everything else checked out:

• Version bump (0.16.2 → 0.16.3) and CHANGELOG.md entry are consistent with each other and with the plugin's versioning pattern for prior doc-only "Fixed" entries (e.g. 0.16.2).
• The relative link guardrails/verification-topology.md resolves correctly from reference/runner.md (matches the pattern of the adjacent existing bullet's guardrails/isolation-ladder.md link).
• The second bullet's "refusing to count two checkers... that RESOLVE to one instance" accurately mirrors the leaf's "Force is checked; RESOLVED distinctness is not" passage.
• No security-relevant surface in this change (docs only); nothing for the security lane either way.

Author-claimed, not independently verified by me: the Test plan's validate-plugin-contracts.mjs, check-changelog-parity.sh, and grep commands and their stated results — I did not run these myself.

[claude]

🔴 Important: no-verdict isn't a case the cited leaf actually enumerates.

verification-topology.md's "Per-run aggregation is not asserted" paragraph (lines 288–290) names four run-time cases: unanimous pass, single dissent, checker timeout, and duplicate checker identity. This bullet keeps "checker-timeout" but swaps in "no-verdict" for "single dissent" (duplicate-checker-identity is already covered by the next bullet). "No-verdict" doesn't appear anywhere in the cited leaf.

Since this document's own rule is "cited never restated" (runner.md line 13–14) — precision matters more here than in ordinary prose. Either this should read "single-dissent" to match the source, or if "no-verdict" is a genuinely distinct case (a checker crashing/producing nothing, as opposed to timing out), the source leaf doesn't currently name it, so the citation is asserting an obligation the leaf itself never recorded.

Fix this →

[claude]

🟡 Suggestion: lens-drawing isn't grounded the same way as the other two obligations.

The PR description and this bullet present three obligations as equally "a hole until the build trigger fires," but the cited leaf only explicitly flags two as ship-unverified — the "Two limits, stated rather than hidden" section (verification-topology.md#L286-L296) covers only per-run aggregation and resolved-instance distinctness. The draw rule itself carries no such flag — it's just normative behavior that happens to require a runtime to execute, which is true of virtually every rule in this contract, not a recorded gap the way the other two are.

Folding lens-drawing into "the three obligations the verification-topology work deferred" (CHANGELOG.md line 13) slightly overstates what the leaf itself recorded — worth confirming this is an intentional charter decision (recording all runner-dependent behavior here, not just the leaf's self-flagged gaps) rather than a citation that outran its source.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.