docs(autonomy,source-control): codify Boris-intent audit — attribution seams, merge-tier precision precondition, ADR 0002 ruling

[kyle-sexton]

Closes #509 — supersedes #782 (identical content, rebased: a source-control 0.15.5 landed mid-flight, so the precision-precondition entry stacks as 0.15.6).

The enforcement/evidencing design ruling is recorded in ADR 0002's dated addendum (execution evidence → required status check via always-run workflow + job-level conditional; verdict gating unchanged; check run canonical evidence, label glance-only; implementation-ordering guard: caller restructure → ci-workflows shape → github-iac ruleset; merge_group revisit trigger). Plus the Boris-intent audit's attribution seams (guardrail matrix, blocking knob, promotion predicates) and the autopilot merge tier's bot-review precision enabling precondition (tier remains DISABLED). Autonomy 0.7.4, source-control 0.15.6.

All review threads from #782 were addressed there (ordering guard added, thread resolved); markdownlint 0 errors; versions match CHANGELOG heads.

Related

• autonomy pipeline: no dedicated security-review pass — automated code review only #509 (closes)
• docs(autonomy,source-control): codify Boris-intent audit — attribution seams, merge-tier precision precondition, ADR 0002 ruling #782 (superseded — pre-rebase head of this change)
• feat(source-control): babysit autopilot merge tier — bot-account review + criteria-gated merge #476 / source-control: no read/consume-only posture — "safe" babysit tier and pull-request monitor write to GitHub autonomously #440 / work-items(work): per-issue execution should compose installed skills as a role-separated mini-SDLC (implementer ≠ reviewer ≠ verifier, ephemeral fresh-context agents) #513 (sibling audit outcomes)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[claude]

Claude finished @kyle-sexton's task in 1m 2s —— View job

---

Security Review — PR #784

• Gather PR diff and changed files
• Read changed files for security issues
• Post findings

---

No security issues found.

All 9 changed files are documentation prose, version string bumps (0.7.3→0.7.4, 0.15.5→0.15.6), and changelog entries. No executable code, GitHub Actions workflow files, secrets, credentials, injection surfaces, dependency pins, or permission changes are present in this diff.

Specific surfaces checked:

Surface	Finding
plugin.json version bumps	Version field only; no new URLs, dependencies, or execution paths
ADR 0002 addendum	Prose design ruling; contains accurate security analysis (check runs vs labels, Triage-level label mutability) — no exploitable surface
guardrails.md, security-review.md, work-classes.md	Attribution prose; no code, no config changes
safety.md — bot-review precision precondition	Adds an operator-enabling gate; this is a security-hardening constraint, not a vulnerability
GitHub Actions / workflows	No workflow files modified
Secrets / credentials	None present

The ADR's implementation-ordering guard (caller restructure → workflow shape → ruleset required-check) is correctly sequenced and avoids the wedge condition it documents.

[claude]

Claude finished @kyle-sexton's task in 2m 0s —— View job

---

PR Review — docs(autonomy,source-control): Boris-intent codification v2

• Gather context and load changed files
• Review ADR 0002 addendum
• Review autonomy plugin changes (guardrails, work-classes, security-review, CHANGELOG, plugin.json)
• Review source-control plugin changes (safety.md, CHANGELOG, plugin.json)
• Verify version consistency across plugin.json / CHANGELOG heads
• Final assessment

---

Summary

This PR records three related, discrete outcomes as documentation: the #509 enforcement design ruling (ADR 0002 addendum), three Boris-intent attribution seams across the autonomy guardrail contract, and a second enabling precondition for the source-control autopilot merge tier. All changes are prose/contract only — no behavioral shifts in any plugin.

---

ADR 0002 Addendum

docs/adr/0002-default-on-ai-review-advisory-with-earned-promotion.md

The addendum is technically precise and well-structured. A few observations:

Implementation ordering (lines 54–59): The load-bearing ordering guard — caller restructure → ci-workflows shape → ruleset — is the most operationally critical piece in this PR. The ADR correctly states "must NOT mark this check required until the caller restructure has landed" and describes each step as independently verifiable before the next. The guard is clear and actionable.

Execution evidence vs verdict gating (lines 60–63): The distinction between "required check proves the pass ran" vs "findings blocking" is sharp and necessary. Worth having this explicit, since the two are easy to conflate.

Evidence model (lines 65–71): The Triage-flippability rationale for why labels are glance-only is correct — any actor with Triage access can add/remove a label, which is a lower bar than App-only check creation. The reasoning holds.

Merge-queue revisit trigger (lines 86–88): This is a real operational hazard — a required check that never fires for merge_group events would wedge every queued PR. Recording it as a revisit trigger is the right place.

Attribution paragraph (lines 72–76): The explicit "not the source playbook" attribution is exactly what the Boris-intent audit asked for. The three cited standards (OpenSSF Scorecard, GitHub protected-branch docs, NIST SP 800-218A) are accurate and applicable.

One style note: The Status field updates from "accepted (interim — pending…)" to simply "accepted" — correct and clean.

No issues in this file.

---

Autonomy Plugin (0.7.3 → 0.7.4)

guardrails.md (lines 13–17)

The attribution sentence is correctly positioned — it follows the verbatim Boris step-4 quote and explicitly partitions ownership: "the playbook names the obligation, this contract supplies the mechanism." Clear.

security-review.md (lines 35–38)

Placement is slightly interesting — the paragraph is inserted after the advisory knob definition but before "Knobs are security-sensitive…" It reads logically because it's attributing the knob concept as a whole (not just one value), and the "rather than inheriting it" phrasing captures the Boris-vs-contract distinction accurately.

work-classes.md (lines 48–52)

Framing the numeric-predicate promotion apparatus as this contract's quantification of the qualitative "earned widespread trust" bar is accurate. The contract's own telemetry-backed predicate is meaningfully more precise than the playbook's bar, and the attribution paragraph makes that explicit without overclaiming.

CHANGELOG [0.7.4]: Correctly categorized under Changed (documentation only, no contract semantics change). The entry accurately summarizes all three seams: hub, security-review leaf, work-classes leaf.

plugin.json: 0.7.3 → 0.7.4 ✓ consistent with CHANGELOG head.

---

Source-Control Plugin (0.15.5 → 0.15.6)

safety.md — Bot-review precision precondition (lines 220–229)

The new precondition is correctly partitioned from the existing review-workflow requiredness one. The closing sentence draws the distinction cleanly: "The requiredness precondition above governs whether the review workflow ran; this one governs whether its verdicts have earned the authority to stand in for a human approval." That's the right framing — two separate failure modes, each its own precondition.

The cross-reference to ADR 0002 is appropriate (no file path needed — "ADR 0002" is how other entries in this file cross-reference external docs).

The "operator discretion alone is insufficient" wording is deliberate and important — it closes the loophole where an operator could argue that subjective confidence substitutes for a recorded precision window.

CHANGELOG [0.15.6]: Correctly under Changed (prose/contract change, no behavioral shift). The stacking rationale (0.15.5 landed mid-flight → 0.15.6 for this change) is documented in the PR description and the CHANGELOG entry is clean.

plugin.json: 0.15.5 → 0.15.6 ✓ consistent with CHANGELOG head.

---

Version Consistency

Plugin	plugin.json	CHANGELOG head
autonomy	0.7.4	[0.7.4] ✓
source-control	0.15.6	[0.15.6] ✓

---

Verdict

Approved. The changes are internally consistent, factually accurate, and well-scoped to documentation only. The implementation ordering guard in ADR 0002 (the most operationally sensitive piece) is precise and actionable. No issues found.