refactor: make spec auto-sign always-on under /boss, drop the per-project toggle

The auto-sign panel earned its keep: in aura it signed ~20 specs autonomously and discriminates (several recent specs escalated to the human path). The needless complexity was the configuration freedom around it — spec_auto_sign was a per-project toggle that was only ever meant to be on.

Remove the toggle. Auto-sign is now fixed /boss behaviour, with the human sign-off pause as the escalation target (objective gate red / design BLOCK / INFRA_ERROR / budget spent). The panel itself, the Step-1.5 seeding machinery, grounding-check, and the spec-skeptic agent are unchanged; conventions.md can now state there is no per-project behavioural toggle at all.
This commit is contained in:
2026-06-17 13:53:00 +02:00
parent 7a58a530b1
commit c5da79f8fc
8 changed files with 63 additions and 86 deletions
+21 -28
View File
@@ -75,7 +75,7 @@ IF WRITING THE SPEC FORCES A CHOICE BETWEEN PLAUSIBLE DESIGNS THE SOURCES DO NOT
THE PRODUCTION GATES — ACCEPTANCE CRITERION, GROUNDING-CHECK, USER-REVIEW —
ARE NON-NEGOTIABLE REGARDLESS OF ENTRY PATH.
NO PLAN, SCAFFOLDING, OR DOWNSTREAM SKILL UNTIL THE SPEC IS APPROVED — BY THE USER, OR
(ONLY UNDER /boss WITH spec_auto_sign ENABLED) BY THE AUTO-SIGN GATE: ALL OBJECTIVE GATES GREEN
(UNDER /boss) BY THE AUTO-SIGN GATE: ALL OBJECTIVE GATES GREEN
AND A UNANIMOUS ADVERSARIAL spec-skeptic PANEL. MODEL SELF-CONFIDENCE ALONE IS NEVER APPROVAL.
```
@@ -150,7 +150,7 @@ the user — which is a Step-1.5 bounce, not a comment. The comment is
which is exactly why it, and not your ephemeral confidence, is what a
downstream `scope-fork` juror reads to confirm the fork is settled (see
Step 6). Recording it keeps the forward queue honest in either run mode;
under auto-sign it is *load-bearing* — without it the `scope-fork` juror
under `/boss` it is *load-bearing* — without it the `scope-fork` juror
sees only the stale issue body and (correctly) blocks.
Provenance enforcement is not yours to self-certify: you *write* the
@@ -186,9 +186,9 @@ is the wrong one — a provenance note *inside the spec* is
self-referential (the spec asserting its own sources settle it) and
stays banned, but a separate issue is independent (author + timestamp,
in the forward queue, juror-readable without opening the spec), as
auditable as a reconciliation comment. Creating it is what makes
auto-sign *reachable* here, instead of the old unconditional fall-back
to the human sign-off.
auditable as a reconciliation comment. Creating it is what lets the
`scope-fork` juror ratify the resolution here, instead of blocking for
lack of an auditable source.
The provenance gate is unchanged and load-bearing: the new issue records
*user* decisions, never fresh orchestrator ones. No real user statement
@@ -366,22 +366,15 @@ the commit itself.
**In `/boss` (autonomous):** `specify` is dispatched autonomously —
it is bounded (no interview). It runs the criterion, parse, and
grounding-check gates without a checkpoint. What happens at *this*
gate then depends on whether the project enables spec auto-sign (its
CLAUDE.md project facts):
- **Slot absent or `false` (default):** `specify` **pauses here** as a
problem-state notify ("spec X ready, please sign off") and waits for
the user. This is the final sign-off pause, not a pre-dispatch
checkpoint — the distinction from `brainstorm`, which `/boss` bounces
*before* dispatch. This is the conservative default; the user's
signature is mandatory.
- **Slot `true`:** the orchestrator MAY sign in the user's place, but
only through the **auto-sign gate** below. The gate exists because
the orchestrator that wrote the spec is the worst-placed party to
judge it — so the gate is built to *not* rely on the orchestrator's
own confidence. Run it in two stages:
grounding-check gates without a checkpoint. At *this* gate the
orchestrator signs in the user's place, but only through the
**auto-sign gate** below — never on its own confidence. The gate
exists because the orchestrator that wrote the spec is the worst-placed
party to judge it, so it is built to *not* rely on that confidence. The
human sign-off pause is not the default here; it is where the gate
**escalates** — a spec that cannot clear the gate routes to a
problem-state notify ("spec X ready, please sign off") and waits for the
user, exactly as a plain pause would. Run the gate in two stages:
1. **Objective gates (all must already hold — these are facts, not
judgements):**
@@ -496,7 +489,7 @@ discipline `tdd` applies when behaviour is not test-specifiable.
| user / issue (design settled) → `specify` | the sources: issue body, in-context design discussion, design docs |
| `brainstorm``specify` | ratified design narrative (approaches chosen, constraints, sections approved) — in-context; brainstorm writes no spec file |
| `specify``grounding-check` (Step 5) | `spec_path` (absolute) + `iteration_scope` |
| `specify``spec-skeptic` panel (Step 6, `/boss` + `spec_auto_sign` only) | `spec_path` (absolute) + `iteration_scope` + one `lens` per dispatch (five in parallel) + `seeding_issue` (index for the `scope-fork` juror to read, or `none`) |
| `specify``spec-skeptic` panel (Step 6, `/boss` only) | `spec_path` (absolute) + `iteration_scope` + one `lens` per dispatch (five in parallel) + `seeding_issue` (index for the `scope-fork` juror to read, or `none`) |
| `specify``planner` (Step 7, on PASS or overridden BLOCK) | path to spec + iteration scope |
| `specify``brainstorm` (precondition bounce) | the unresolved design question as a cycle request; no spec written |
| `specify` → issue backlog (Step 5, no-override BLOCK) | new issue naming the unratified dependency; spec file deleted from the working tree |
@@ -511,7 +504,7 @@ discipline `tdd` applies when behaviour is not test-specifiable.
| "The shape is clear from the prose, I don't need to paste the code" | If it's clear, pasting it is free; if pasting it is hard, it wasn't clear. The acceptance criterion is unjudgeable without the worked code. |
| "Just polishing a wording after PASS, no need to re-dispatch" | The grounding-check report attests to specific bytes. A polish edit changes the bytes; the attestation no longer covers them. Re-dispatch is cheap. |
| "It's in a model doc / the design ledger, so it's canonical" | A `models` / RFC / proposal doc holds aspirational code — a target, not verified fact. Flag code lifted from a `status: aspirational` source as such; it is not ratified contract. |
| "In `/boss` with auto-sign on, this spec looks solid — I'll sign and move on" | Your sense that it looks solid is the exact signal the auto-sign gate refuses to trust. Signing requires all objective gates green AND a unanimous `spec-skeptic` panel. If you find yourself wanting to sign on confidence, that is the cue to run the gate, not to skip it. |
| "In `/boss` this spec looks solid — I'll sign and move on" | Your sense that it looks solid is the exact signal the auto-sign gate refuses to trust. Signing requires all objective gates green AND a unanimous `spec-skeptic` panel. If you find yourself wanting to sign on confidence, that is the cue to run the gate, not to skip it. |
| "One lens blocked on something minor — I'll sign anyway since the rest passed" | The panel is unanimous-or-nothing by design. You never *sign over* a `BLOCK`. An editorial `BLOCK` you may *repair* (within the ≤ 2-round budget, with a full re-panel after); a design `BLOCK` routes to the human. Neither is overruling a juror — that is the whole point of replacing your eye with five independent ones. |
## Red Flags — STOP
@@ -530,7 +523,8 @@ discipline `tdd` applies when behaviour is not test-specifiable.
re-dispatching only the blocked lens rather than all five, or past
the 2-round self-correction budget
- (auto-sign) Running the panel before the objective gates are green,
or running it at all when `spec_auto_sign` is not enabled
or running it outside a `/boss` session (interactive runs take the
user's signature directly)
- Jumping straight from spec to `implement` (must go via `planner`)
- Running an interview here (that is `brainstorm`'s job — if the work
needs one, bounce)
@@ -548,10 +542,9 @@ discipline `tdd` applies when behaviour is not test-specifiable.
- **Agent dispatched:** `agents/grounding-check.md` — dispatched in
Step 5 as a hard-gate. Reads the spec with fresh context and reports
PASS / BLOCK / INFRA_ERROR.
- **Agent dispatched (auto-sign only):** `agents/spec-skeptic.md`
dispatched in Step 6 five times in parallel (one per lens) ONLY under
a `/boss` session with spec auto-sign enabled (the project's CLAUDE.md
project facts). Each
- **Agent dispatched (auto-sign):** `agents/spec-skeptic.md`
dispatched in Step 6 five times in parallel (one per lens) under
a `/boss` session. Each
juror tries to refute the spec along its lens; a unanimous `SOUND` is
what lets the orchestrator sign in the user's place. An editorial-lens
`BLOCK` (`criterion` / `ambiguity` / `plan-readiness`) is self-