refactor: make spec auto-sign always-on under /boss, drop the per-project toggle
The auto-sign panel earned its keep: in aura it signed ~20 specs autonomously and discriminates (several recent specs escalated to the human path). The needless complexity was the configuration freedom around it — spec_auto_sign was a per-project toggle that was only ever meant to be on. Remove the toggle. Auto-sign is now fixed /boss behaviour, with the human sign-off pause as the escalation target (objective gate red / design BLOCK / INFRA_ERROR / budget spent). The panel itself, the Step-1.5 seeding machinery, grounding-check, and the spec-skeptic agent are unchanged; conventions.md can now state there is no per-project behavioural toggle at all.
This commit is contained in:
+21
-28
@@ -75,7 +75,7 @@ IF WRITING THE SPEC FORCES A CHOICE BETWEEN PLAUSIBLE DESIGNS THE SOURCES DO NOT
|
||||
THE PRODUCTION GATES — ACCEPTANCE CRITERION, GROUNDING-CHECK, USER-REVIEW —
|
||||
ARE NON-NEGOTIABLE REGARDLESS OF ENTRY PATH.
|
||||
NO PLAN, SCAFFOLDING, OR DOWNSTREAM SKILL UNTIL THE SPEC IS APPROVED — BY THE USER, OR
|
||||
(ONLY UNDER /boss WITH spec_auto_sign ENABLED) BY THE AUTO-SIGN GATE: ALL OBJECTIVE GATES GREEN
|
||||
(UNDER /boss) BY THE AUTO-SIGN GATE: ALL OBJECTIVE GATES GREEN
|
||||
AND A UNANIMOUS ADVERSARIAL spec-skeptic PANEL. MODEL SELF-CONFIDENCE ALONE IS NEVER APPROVAL.
|
||||
```
|
||||
|
||||
@@ -150,7 +150,7 @@ the user — which is a Step-1.5 bounce, not a comment. The comment is
|
||||
which is exactly why it, and not your ephemeral confidence, is what a
|
||||
downstream `scope-fork` juror reads to confirm the fork is settled (see
|
||||
Step 6). Recording it keeps the forward queue honest in either run mode;
|
||||
under auto-sign it is *load-bearing* — without it the `scope-fork` juror
|
||||
under `/boss` it is *load-bearing* — without it the `scope-fork` juror
|
||||
sees only the stale issue body and (correctly) blocks.
|
||||
|
||||
Provenance enforcement is not yours to self-certify: you *write* the
|
||||
@@ -186,9 +186,9 @@ is the wrong one — a provenance note *inside the spec* is
|
||||
self-referential (the spec asserting its own sources settle it) and
|
||||
stays banned, but a separate issue is independent (author + timestamp,
|
||||
in the forward queue, juror-readable without opening the spec), as
|
||||
auditable as a reconciliation comment. Creating it is what makes
|
||||
auto-sign *reachable* here, instead of the old unconditional fall-back
|
||||
to the human sign-off.
|
||||
auditable as a reconciliation comment. Creating it is what lets the
|
||||
`scope-fork` juror ratify the resolution here, instead of blocking for
|
||||
lack of an auditable source.
|
||||
|
||||
The provenance gate is unchanged and load-bearing: the new issue records
|
||||
*user* decisions, never fresh orchestrator ones. No real user statement
|
||||
@@ -366,22 +366,15 @@ the commit itself.
|
||||
|
||||
**In `/boss` (autonomous):** `specify` is dispatched autonomously —
|
||||
it is bounded (no interview). It runs the criterion, parse, and
|
||||
grounding-check gates without a checkpoint. What happens at *this*
|
||||
gate then depends on whether the project enables spec auto-sign (its
|
||||
CLAUDE.md project facts):
|
||||
|
||||
- **Slot absent or `false` (default):** `specify` **pauses here** as a
|
||||
problem-state notify ("spec X ready, please sign off") and waits for
|
||||
the user. This is the final sign-off pause, not a pre-dispatch
|
||||
checkpoint — the distinction from `brainstorm`, which `/boss` bounces
|
||||
*before* dispatch. This is the conservative default; the user's
|
||||
signature is mandatory.
|
||||
|
||||
- **Slot `true`:** the orchestrator MAY sign in the user's place, but
|
||||
only through the **auto-sign gate** below. The gate exists because
|
||||
the orchestrator that wrote the spec is the worst-placed party to
|
||||
judge it — so the gate is built to *not* rely on the orchestrator's
|
||||
own confidence. Run it in two stages:
|
||||
grounding-check gates without a checkpoint. At *this* gate the
|
||||
orchestrator signs in the user's place, but only through the
|
||||
**auto-sign gate** below — never on its own confidence. The gate
|
||||
exists because the orchestrator that wrote the spec is the worst-placed
|
||||
party to judge it, so it is built to *not* rely on that confidence. The
|
||||
human sign-off pause is not the default here; it is where the gate
|
||||
**escalates** — a spec that cannot clear the gate routes to a
|
||||
problem-state notify ("spec X ready, please sign off") and waits for the
|
||||
user, exactly as a plain pause would. Run the gate in two stages:
|
||||
|
||||
1. **Objective gates (all must already hold — these are facts, not
|
||||
judgements):**
|
||||
@@ -496,7 +489,7 @@ discipline `tdd` applies when behaviour is not test-specifiable.
|
||||
| user / issue (design settled) → `specify` | the sources: issue body, in-context design discussion, design docs |
|
||||
| `brainstorm` → `specify` | ratified design narrative (approaches chosen, constraints, sections approved) — in-context; brainstorm writes no spec file |
|
||||
| `specify` → `grounding-check` (Step 5) | `spec_path` (absolute) + `iteration_scope` |
|
||||
| `specify` → `spec-skeptic` panel (Step 6, `/boss` + `spec_auto_sign` only) | `spec_path` (absolute) + `iteration_scope` + one `lens` per dispatch (five in parallel) + `seeding_issue` (index for the `scope-fork` juror to read, or `none`) |
|
||||
| `specify` → `spec-skeptic` panel (Step 6, `/boss` only) | `spec_path` (absolute) + `iteration_scope` + one `lens` per dispatch (five in parallel) + `seeding_issue` (index for the `scope-fork` juror to read, or `none`) |
|
||||
| `specify` → `planner` (Step 7, on PASS or overridden BLOCK) | path to spec + iteration scope |
|
||||
| `specify` → `brainstorm` (precondition bounce) | the unresolved design question as a cycle request; no spec written |
|
||||
| `specify` → issue backlog (Step 5, no-override BLOCK) | new issue naming the unratified dependency; spec file deleted from the working tree |
|
||||
@@ -511,7 +504,7 @@ discipline `tdd` applies when behaviour is not test-specifiable.
|
||||
| "The shape is clear from the prose, I don't need to paste the code" | If it's clear, pasting it is free; if pasting it is hard, it wasn't clear. The acceptance criterion is unjudgeable without the worked code. |
|
||||
| "Just polishing a wording after PASS, no need to re-dispatch" | The grounding-check report attests to specific bytes. A polish edit changes the bytes; the attestation no longer covers them. Re-dispatch is cheap. |
|
||||
| "It's in a model doc / the design ledger, so it's canonical" | A `models` / RFC / proposal doc holds aspirational code — a target, not verified fact. Flag code lifted from a `status: aspirational` source as such; it is not ratified contract. |
|
||||
| "In `/boss` with auto-sign on, this spec looks solid — I'll sign and move on" | Your sense that it looks solid is the exact signal the auto-sign gate refuses to trust. Signing requires all objective gates green AND a unanimous `spec-skeptic` panel. If you find yourself wanting to sign on confidence, that is the cue to run the gate, not to skip it. |
|
||||
| "In `/boss` this spec looks solid — I'll sign and move on" | Your sense that it looks solid is the exact signal the auto-sign gate refuses to trust. Signing requires all objective gates green AND a unanimous `spec-skeptic` panel. If you find yourself wanting to sign on confidence, that is the cue to run the gate, not to skip it. |
|
||||
| "One lens blocked on something minor — I'll sign anyway since the rest passed" | The panel is unanimous-or-nothing by design. You never *sign over* a `BLOCK`. An editorial `BLOCK` you may *repair* (within the ≤ 2-round budget, with a full re-panel after); a design `BLOCK` routes to the human. Neither is overruling a juror — that is the whole point of replacing your eye with five independent ones. |
|
||||
|
||||
## Red Flags — STOP
|
||||
@@ -530,7 +523,8 @@ discipline `tdd` applies when behaviour is not test-specifiable.
|
||||
re-dispatching only the blocked lens rather than all five, or past
|
||||
the 2-round self-correction budget
|
||||
- (auto-sign) Running the panel before the objective gates are green,
|
||||
or running it at all when `spec_auto_sign` is not enabled
|
||||
or running it outside a `/boss` session (interactive runs take the
|
||||
user's signature directly)
|
||||
- Jumping straight from spec to `implement` (must go via `planner`)
|
||||
- Running an interview here (that is `brainstorm`'s job — if the work
|
||||
needs one, bounce)
|
||||
@@ -548,10 +542,9 @@ discipline `tdd` applies when behaviour is not test-specifiable.
|
||||
- **Agent dispatched:** `agents/grounding-check.md` — dispatched in
|
||||
Step 5 as a hard-gate. Reads the spec with fresh context and reports
|
||||
PASS / BLOCK / INFRA_ERROR.
|
||||
- **Agent dispatched (auto-sign only):** `agents/spec-skeptic.md` —
|
||||
dispatched in Step 6 five times in parallel (one per lens) ONLY under
|
||||
a `/boss` session with spec auto-sign enabled (the project's CLAUDE.md
|
||||
project facts). Each
|
||||
- **Agent dispatched (auto-sign):** `agents/spec-skeptic.md` —
|
||||
dispatched in Step 6 five times in parallel (one per lens) under
|
||||
a `/boss` session. Each
|
||||
juror tries to refute the spec along its lens; a unanimous `SOUND` is
|
||||
what lets the orchestrator sign in the user's place. An editorial-lens
|
||||
`BLOCK` (`criterion` / `ambiguity` / `plan-readiness`) is self-
|
||||
|
||||
Reference in New Issue
Block a user