docs(autonomy): commit autonomy-ignition sub-topic plan (stress-tested)

[kyle-sexton]

Phase I ignition plan for the ladder-climb roadmap: operator decisions recorded (Sonnet 5 pin, hourly + keep-awake, reconcile-first, native task + plan-window backstop, subscription auth) and the fresh-context devils-advocate reversals folded — human-merge during the accumulation window, real CI gate with check-run-API outcomes, native worktree isolation, governance-sourced C2-label claims, mechanical per-run bounds, availability trio, durable failure signal, evidence backup.

Related

No related issue: this PR commits the autonomy-ignition sub-topic plan; the items below are referenced for context and are not closed here.

• autonomy: ignite the 2-to-3 loop — first standing routine (hourly C2 drain) + C2-promotion evidence drain on the proving ground #778 (the ignition item this plan executes — not closed here)
• docs/topics/ladder-climb-roadmap/PLAN.md Phase I (merged via docs(roadmap): commit ladder-climb-roadmap plan (interview-ratified) #794)
• autonomy: context-pull leg of 2-to-3 — let Claude read wikis and discussions #779 (deferred sibling), work-readiness burn list — split-gauge classification of the open backlog (tower-maintained, week of 7/20) #627 (gauge)

🤖 Generated with Claude Code

https://claude.ai/code/session_01RdeVMaDzwP26bNiDjqM59Q

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[claude]

Claude finished @kyle-sexton's task in 1m 35s —— View job

---

PR Review — docs(autonomy): autonomy-ignition sub-topic plan

Tasks

• Gather context and load tools
• Read changed files (PLAN.md, design-resolution.md)
• Review for correctness, internal consistency, and alignment with CLAUDE.md
• Post final review

---

Summary

Docs-only PR adding two files: an implementation plan for the autonomy-ignition phase and a design-resolution record. No code, no credentials, no executable artifacts. The REVIEW.md blocking criteria (object-level auth, tenant scoping, secrets, injection, audit logging, atomicity) do not apply here. No critical or important findings. Three suggestions noted below.

The core stress-test reversals are sound and well-documented:

• Human-merge-during-accumulation correctly avoids evidence circularity and step-skipping — the predicate requires autonomous completion (claim→implement→PR), not autonomous merge, which is the right distinction.
• Real CI gate with check-run API outcomes (never agent-written) is a correct independence guarantee.
• Governance-sourced C2 label as the only classification key (read-only to the run, .claude/autonomy/** allowlist-excluded) is the right prompt-injection mitigation.
• Sonnet pin + --max-turns + wrapper timeout kill on the inner invocation correctly closes the Opus-hardcode and unbounded-run gaps.

---

Suggestions

1. --max-turns <N> placeholder has no specified range
PLAN.md L79-80, L104

The plan correctly mandates a mechanical per-run bound ("a number in a doc bounds nothing"), but leaves N as an open placeholder. A builder choosing a trivially large value (e.g., --max-turns 1000) would satisfy the letter but not the spirit. Consider adding a concrete ballpark to the plan — even "≤50 turns for a single drain item" — so the sanity check (L104: --max-turns present) can also check that it's reasonable.

2. Evidence backup "second location" is unspecified
PLAN.md L88-90

Phase 1 item 6 says "nightly deterministic copy to a second location" but doesn't specify what that location is. If it's another directory on the same machine, it doesn't protect against machine failure or disk loss — which would destroy the 14-day evidence window the predicate depends on. Worth naming the target explicitly (repo push, cloud storage, second machine) so the sanity check at Phase 3 can verify the backup actually satisfies the durability requirement.

3. Worktree branch point left to be verified at smoke
PLAN.md L115

Phase 2 item 2 notes "verify at smoke what the worktree branches from." If the Desktop task's worktree branches from a stale commit (e.g., a cached HEAD rather than the tip of the default branch), the agent could work against outdated content without knowing it. Given this is a Phase 3 empirical check, the risk is bounded — but specifying the expected branch point (main / default branch at task-fire time) as the assumed behavior, with failure defined as anything else, would make the smoke check unambiguous rather than exploratory.

---

No additional nits beyond the three above. The plan is internally consistent, the known build gaps section is honest and actionable, and the execution shape (Opus builder in worktree / main thread verifies before commit) matches the repo's standing orchestration contract.

[claude]

Claude finished @kyle-sexton's task in 1m 27s —— View job

---

Tasks

• Load tools
• Read changed files at HEAD
• Inspect sync commit (what triggered this re-review)
• Review for correctness, consistency, and CLAUDE.md alignment
• Post final review

---

PR Review — docs(autonomy): autonomy-ignition sub-topic plan

Scope of this pass

The sync commit (c23ef94) that triggered this re-review made a single targeted change: replaced the hardcoded Windows path D:\repos\github.com\kyle-sexton\autonomy-demo-scratch\tools\** in the builder scope-fence with the portable placeholder <scratch-repo-root>/tools/**. The previous review pass covered the full document; this pass confirms that fix and re-checks the prior suggestions.

---

Sync commit — correct and minimal

The fix in PLAN.md L201 is aligned with the repo's design rules (no hardcoded machine-specific paths) and would correctly pass the hygiene gate. The placeholder is appropriate for a planning document where the concrete path is bound by the operator at build time. No issues with this change.

---

Prior suggestions — status

The three suggestions from the previous review pass remain open (the sync commit did not address them):

1. --max-turns <N> has no specified ballpark (L79, L104) — sanity check only confirms presence, not that the value is sane.

2. Evidence backup "second location" unspecified (L89) — same-machine copy doesn't protect the 14-day evidence window against disk failure.

3. Worktree branch point exploratory rather than asserted (L115) — naming the expected branch point (main / default branch tip at task-fire time) would make the smoke check unambiguous.

These were suggestions in the prior pass and remain suggestions here — none are blockers for merging the plan.

---

One new minor nit

Line-number cross-reference will drift
PLAN.md L37

The plan cites trigger-dispatch.md:45 as the source for the six adapter obligations. Pinning a line number in a prose reference will silently go stale as trigger-dispatch.md evolves. A concept name or section heading would be more durable. Low severity — the obligation list itself is what matters.

---

Overall

Docs-only PR; no code, credentials, or executable artifacts. The sync commit's fix is correct. The plan is internally consistent, the stress-test reversals are sound, and the execution shape (Opus builder in worktree / main thread verifies before commit) continues to match the standing orchestration contract. No blockers.