Skip to content

docs(autonomy): record the topology obligations on the seam that receives them #2365

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kyle-sexton merged 1 commit into from
Aug 12, 2026
Merged

docs(autonomy): record the topology obligations on the seam that receives them #2365

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion plugins/autonomy/.claude-plugin/plugin.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
"name": "autonomy",
"version": "0.16.2",
"version": "0.16.3",
"description": "Governed autonomous agent operation: role-topology, binding-seam, wiring-vs-advisor, telemetry, return-accounting, trigger-dispatch, per-work-class guardrail-matrix, standing-routine-catalog, and design-only runner-charter contracts for climbing the AI-adoption ladder, plus a guided-setup skill that discovers an adopting org's state, writes its schema-versioned binding, wires standards-pinned OTLP emission with a zero-cost file-artifact default, wires human-attested return capture at the task boundary, wires signal adapters with one governed dispatch entrypoint, binds the five-class guardrail matrix to an org's isolation substrates with an in-boundary live-validation probe before recording each fail-closed binding, and stands up standing-routine-catalog classes as scheduled temporal signal adapters behind the one governed queue with free scheduling defaults wired as reviewable changes and each routine's work-class mapping homed on the security surface.",
"author": {
"name": "Melodic Software",
Expand Down
13 changes: 13 additions & 0 deletions plugins/autonomy/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,19 @@ All notable changes to the `autonomy` plugin are documented here. Format follows
Versions 0.1.0–0.7.0 predate this file (introduced with 0.7.1); their history lives in the
merged work-package PRs (#333, #343, #356, #372, #377, #600, #676).

## [0.16.3]

### Fixed

- **The runner charter now records the three obligations the verification-topology work deferred
to it.** That work states plainly that per-run verdict aggregation and resolved-instance
distinctness ship unverified because no runner exists to carry them — but it recorded the
deferral only on the leaf making it, and a deferral the receiving seam does not name is
indistinguishable from an obligation nobody owns. The runner's inherited-constraints section
now carries all three (verdict aggregation under the unanimity invariant including the
timeout and no-verdict cases, refusing to count two checkers that resolve to one instance, and
lens drawing), each stated as a hole until the build trigger fires.

## [0.16.2]

### Fixed
Expand Down
9 changes: 9 additions & 0 deletions plugins/autonomy/reference/runner.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,15 @@ All imported unchanged; each is enforced by its owning contract, cited never res
autonomous/human-gated classes. The runner is a claiming surface, so the
[one-entrypoint invariant](trigger-dispatch.md#dispatch) and its scope boundary bind it
directly; the audit trail that funnelling produces is the trust loop.
- Checker verdicts are aggregated per the
[verification-topology leaf](guardrails/verification-topology.md), which enforces at
binding-validity time what no static check can reach at run time. **Three obligations land on
this seam when the build trigger fires**, and each is a hole until it does: aggregating verdicts
Comment thread
kyle-sexton marked this conversation as resolved.
under the unanimity invariant, including the checker-timeout and no-verdict cases a static check

@claude claude Bot Aug 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Important: no-verdict isn't a case the cited leaf actually enumerates.

verification-topology.md's "Per-run aggregation is not asserted" paragraph (lines 288–290) names four run-time cases: unanimous pass, single dissent, checker timeout, and duplicate checker identity. This bullet keeps "checker-timeout" but swaps in "no-verdict" for "single dissent" (duplicate-checker-identity is already covered by the next bullet). "No-verdict" doesn't appear anywhere in the cited leaf.

Since this document's own rule is "cited never restated" (runner.md line 13–14) — precision matters more here than in ordinary prose. Either this should read "single-dissent" to match the source, or if "no-verdict" is a genuinely distinct case (a checker crashing/producing nothing, as opposed to timing out), the source leaf doesn't currently name it, so the citation is asserting an obligation the leaf itself never recorded.

Fix this →

never sees; refusing to count two checkers the binding held distinct that RESOLVE to one
instance; and drawing lenses per that leaf's draw rule. A binding cannot express a topology that

@claude claude Bot Aug 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Suggestion: lens-drawing isn't grounded the same way as the other two obligations.

The PR description and this bullet present three obligations as equally "a hole until the build trigger fires," but the cited leaf only explicitly flags two as ship-unverified — the "Two limits, stated rather than hidden" section (verification-topology.md#L286-L296) covers only per-run aggregation and resolved-instance distinctness. The draw rule itself carries no such flag — it's just normative behavior that happens to require a runtime to execute, which is true of virtually every rule in this contract, not a recorded gap the way the other two are.

Folding lens-drawing into "the three obligations the verification-topology work deferred" (CHANGELOG.md line 13) slightly overstates what the leaf itself recorded — worth confirming this is an intentional charter decision (recording all runner-dependent behavior here, not just the leaf's self-flagged gaps) rather than a citation that outran its source.

auto-proceeds with no force behind its checkers — the runner is what makes the same true of a
RUN.

## Anti-goals

Expand Down