feat(autonomy): human-authorized corrective-PR exception for Heart RED - #113
Merged
Conversation
#112) Heart RED forbids commit/push/PR-open at every autonomy level, yet Heart cannot clear a RED until the fixing source reaches main, wheels rebuild, and release-integration validation passes -- so a source fix that repairs the exact defect named by the RED reason cannot be shipped. A deadlock. Add a narrow, auditable, human-authorized exception to AUTONOMY.md: - Trigger: Heart RED + a source fix that directly repairs a named RED reason. - Authorization: explicit, contemporaneous human authorization quoting the exact RED reason and approving the specific corrective issue. - Permitted, nothing else: commit, push, one pending-release feature PR whose issue/plan/diff map to the named reason. - Forbidden: automatic merge, issue close, release, release rehearsal, unrelated scope. Merge stays a separate human act; every release stays blocked while Heart is RED. - Human-only: never fires under --auto; the invariant "Heart YELLOW/RED is never acknowledged autonomously" stands verbatim. - Records in four sinks (issue, PR body, active.md - corrective-red: block, autonomy_log.md corrective row); names exactly one reason when RED has several; parks without shipping on mixed-scope/stale-reason/missing-evidence/ not-causal; recovery = human merge -> fresh wheels + release-integration validation -> new Heart verdict. Ship skills (ship_library/ship_workspace/WORKFLOW) link the exception at the RED-handling step -- no policy duplication. New deterministic contract test pins the guardrails and the no-duplication seam. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…quote The exception requires the human to quote the exact Heart RED reason string, but a human can only quote what they are shown. Make the agent responsible for providing the quote: when the corrective-PR circumstance arises it surfaces the exact RED reason string(s) verbatim from `pyauto-heart readiness`, together with the specific corrective request, so the human authorizes what the agent put in front of them rather than reconstructing the wording from memory. Updates the AUTONOMY.md Authorization clause and the RED-handling step of ship_library / ship_workspace / WORKFLOW; adds a contract test. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
Resolves the Heart-RED ship deadlock: Heart RED forbids commit/push/PR-open at every autonomy level, but Heart cannot clear a RED until the fixing source reaches
main, wheels rebuild, and release-integration validation passes — so a source fix that repairs the exact defect named by the RED reason cannot be shipped. This adds a narrow, auditable, human-authorized corrective-PR exception.Closes #112.
What changed
AUTONOMY.md— new section "Corrective-PR exception for Heart RED (human-authorized)": trigger, authorization (contemporaneous human, quoting the exact RED reason), permitted set (commit/push/one pending-release PR — nothing else), forbidden set (merge/close/release/rehearsal/unrelated scope), four record sinks, name-one-of-several handling, park-without-shipping failures, and the recovery sequence (human merge → fresh wheels + release-integration validation → new Heart verdict). Plus levels-table pointer, a hard-invariant bullet (keeping "Heart YELLOW/RED is never acknowledged autonomously" verbatim), a Consumers note, and acorrectiveoutcome tag in the calibration log.skills/ship_library,ship_workspace,WORKFLOW.md— link the exception at the RED-handling step; no policy duplication.tests/test_corrective_red_exception.py— 12 deterministic contract tests pinning the guardrails and the no-duplication seam.Design decisions (confirmed with the human): human-only (never under
--auto) and name-one-of-several RED reasons.API Changes
None — doctrine/documentation + tests only. No source API, imports, or signatures changed.
Heart status at ship
Shipped through organism-scoped Heart RED, human-authorized — every RED reason (
release validation FAILED (stage integrate),workspace validation not passing (2026-07-09),58 stale parked scripts,PyAutoMind open PR 14d old,install verification not run) is organism-scoped and nothing branch-related to this doc-only change. This PR creates the corrective-exception mechanism but does not itself qualify for it (it repairs none of the named RED reasons). Merge stays a human act.Tests
python -m pytest tests/ -q→ 58 passed (46 pre-existing + 12 new).