refactor: make spec auto-sign always-on under /boss, drop the per-project toggle

The auto-sign panel earned its keep: in aura it signed ~20 specs autonomously and discriminates (several recent specs escalated to the human path). The needless complexity was the configuration freedom around it — spec_auto_sign was a per-project toggle that was only ever meant to be on.

Remove the toggle. Auto-sign is now fixed /boss behaviour, with the human sign-off pause as the escalation target (objective gate red / design BLOCK / INFRA_ERROR / budget spent). The panel itself, the Step-1.5 seeding machinery, grounding-check, and the spec-skeptic agent are unchanged; conventions.md can now state there is no per-project behavioural toggle at all.

README.md

@@ -28,7 +28,7 @@ The pipeline skills, each with the agents it primarily dispatches:
 | `tdd` | Test-specifiable feature / issue (third entry path, alongside `brainstorm` and `specify`) | RED executable-spec in working tree → `implement` mini-mode | Standard entry path; bounces to `brainstorm` on a design fork |
 | `fieldtest` | Orchestrator-dispatched post-audit | example fixtures + friction spec | Per-cycle optional; milestone fieldtest is the closing gate for a surface-touching milestone |
 | `docwriter` | API surface stable across N cycles | rustdoc / docstring sweep | Optional |
-| `boss` | User types `/boss` | autonomous-orchestrator session — dispatches the other skills until done-state or bounce-back; can optionally sign specs in the user's place (opt-in, see below) | User-invoked, never auto-dispatched |
+| `boss` | User types `/boss` | autonomous-orchestrator session — dispatches the other skills until done-state or bounce-back; signs specs in the user's place through the auto-sign gate (see below) | User-invoked, never auto-dispatched |
 
 **Entry is a selector cascade, not a single door.** New feature work is
 routed on a verification / enumeration axis, walked top to bottom, first
@@ -122,23 +122,19 @@ project's own `CLAUDE.md` under `## Skills plugin: project facts`:
   interface / fieldtest-examples paths
 - Per-role standing reading
 - Issue-tracker repo slug + list / show commands
-- Spec auto-sign (off by default)
 
 The per-fact reference is the table in `docs/conventions.md`; the
 copy-and-fill template is `templates/CLAUDE.md.fragment`. There is no
 profile file and no parser — the skills read these facts from the
 project's `CLAUDE.md`, which is standing reading on every dispatch.
 
-### Spec auto-sign (opt-in)
+### Spec auto-sign
 
-By default a `specify` dispatch in a `/boss` session pauses at its
+Under `/boss`, the orchestrator signs a spec in the user's place rather
-user-review gate for the user's signature — the human approves every
+than pausing at the user-review gate — so a `/boss` run carries on
-spec before any plan is built. A project that wants `/boss` to run
+across spec boundaries unattended. (Outside `/boss` the user signs every
-unattended across spec boundaries can opt in by enabling spec
+spec directly.) The orchestrator never signs on its own confidence;
-auto-sign in its CLAUDE.md project facts.
+signing requires two stages to clear:
-
-With it on, the orchestrator may sign a spec in the user's place, but
-never on its own confidence. Signing requires two stages to clear:
 
 - **Objective gates** — the precondition gate and a `grounding-check`
   `PASS` with no human override.

boss/SKILL.md

@@ -167,9 +167,10 @@ route(task):
 - **Else → spec-driven (`specify` → `planner`).** The deliberate heavy
   fallback for prose-design work the sources already settle (an
   exhaustive issue body, a long in-context discussion). `specify` is
-  bounded (no interview); dispatch it autonomously and it pauses at its
+  bounded (no interview); dispatch it autonomously and it signs through
-  own user-review gate (a problem-state notify, not a pre-dispatch
+  its own Step-6 auto-sign gate, escalating to a user-review pause (a
-  checkpoint) unless the project enables spec auto-sign.
+  problem-state notify, not a pre-dispatch checkpoint) only when the
+  gate cannot clear.
 
 **The straddle rule (a rule, not an example).** "Add an enum variant"
 straddles the compiler-driven and the tdd/spec arms. Decide by what the
@@ -188,15 +189,13 @@ bounces back — is **not** a ranking of the paths. It is a consequence of
 context budget: the four are bounded (no open Q&A; `compiler-driven` and
 `debug` self-settle on a run), whereas a fresh `brainstorm` is
 high-context discovery the orchestrator cannot compact on its own (see
-trigger 4). `specify` dispatched in `/boss` pauses at its own Step-6
+trigger 4). `specify` dispatched in `/boss` signs through its own Step-6
-user-review gate to take sign-off — a final-sign-off notify, not a
+auto-sign gate: a spec that clears all objective gates AND a unanimous
-pre-dispatch checkpoint. The one exception is spec auto-sign: when a
+adversarial `spec-skeptic` panel is signed by the orchestrator without
-project enables it in its CLAUDE.md project facts, a spec that clears all
+pausing, and the run continues to `planner` — see §"Spec auto-sign"
-objective gates AND a unanimous adversarial `spec-skeptic` panel is
+below. A spec that cannot clear the gate escalates to the user-review
-signed by the orchestrator without pausing, and the run continues to
+pause (a final-sign-off notify, not a pre-dispatch checkpoint). The gate
-`planner` — see §"Spec auto-sign" below. The gate is built so the
+is built so the orchestrator's own confidence is never what signs. Do not let the asymmetry harden into a
-orchestrator's own confidence is never what signs; absent that, the
-human signature stays mandatory. Do not let the asymmetry harden into a
 reflex of routing borderline items to `brainstorm` "to be safe" — that
 is the exact bias this reflection exists to break; walk the cascade
 honestly each time. The one principled tilt is two-sided and lives
@@ -302,7 +301,7 @@ question.
 ## Notifications
 
 Two states call for a notify; nothing else does — plus a third,
-narrow one that exists only when spec auto-sign is enabled:
+narrow one for spec auto-sign:
 
 1. **Done-state.** The autonomous queue is empty — the cycle
    closed, the audit ratified, and no further iteration is
@@ -322,7 +321,7 @@ narrow one that exists only when spec auto-sign is enabled:
    the next backlog item is a new cycle (no spec yet) and
    starting it would force a fresh `brainstorm`.
 
-3. **Auto-sign (only when the project enables spec auto-sign).** The
+3. **Auto-sign.** The
    orchestrator signed a spec in the user's place and is
    continuing the run — see §"Spec auto-sign". This is the one
    sanctioned mid-flow notify, and it is sanctioned *because it
@@ -389,14 +388,11 @@ actionable ask, not a wrap-up summary.
 
 ## Spec auto-sign
 
-Off by default. A project turns it on in its CLAUDE.md project facts
+Under `/boss`, the orchestrator signs a spec in the user's place
-(spec auto-sign: enabled). With it off, a `specify`
+through `specify`'s Step-6 auto-sign gate, which is owned and defined
-dispatch in `/boss` always pauses for the user's signature — the
+there. (Outside `/boss`, the user signs every spec directly; there is
-conservative default, unchanged.
+no gate to run.) A spec that cannot clear the gate escalates to the
-
+human sign-off pause. The boss-side contract is just this:
-With it on, the orchestrator MAY sign a spec in the user's place,
-but only through `specify`'s Step-6 auto-sign gate, which is owned
-and defined there. The boss-side contract is just this:
 
 - **The gate is not the orchestrator's judgement.** Signing requires
   every objective gate green (precondition, parse, a `grounding-check`
@@ -465,7 +461,7 @@ and defined there. The boss-side contract is just this:
 | "It's a bug but the fix is a one-line type edit — route it `compiler-driven`" | No. An observed bug is first in the cascade → `debug`, RED-first, regardless of how mechanical the fix looks. The bug-gate sits before the type-edit arm precisely so a regression cannot launder itself around RED-first. |
 | "The issue is exhaustive but it's a new cycle, so bounce to the user before `specify`" | `specify` direct-entry is bounded and autonomously dispatchable — it is NOT the high-context `brainstorm` cycle that trigger 4 reserves for the user. Dispatch it; it will pause at its own user-review gate for sign-off. The pre-dispatch bounce is for an *open* design that needs discovery, not for a settled one that needs only production. |
 | "`tdd` is the secondary skill, `brainstorm` is the real entry" | All entry paths are always available. The choice among them is the cascade, walked per item — not a habit of treating `brainstorm` as primary and the lighter arms as exceptions. The lighter arms exist to be reached; reaching past them by elimination is the failure the verification axis was added to prevent. |
-| "Auto-sign is on and this spec is clearly good — I'll sign it and skip the panel" | The panel IS how a spec gets signed under auto-sign; there is no signing on judgement. Your sense that it is clearly good is the precise signal the gate is built not to trust. Run the objective gates, dispatch the five jurors, require unanimity. |
+| "This spec is clearly good — I'll sign it and skip the panel" | The panel IS how a spec gets signed under `/boss`; there is no signing on judgement. Your sense that it is clearly good is the precise signal the gate is built not to trust. Run the objective gates, dispatch the five jurors, require unanimity. |
 | "Four jurors said SOUND, one blocked on something I think is wrong — I'll sign" | Unanimous-or-nothing. You never sign over a `BLOCK`. If it is an editorial lens, repair it and re-run the whole panel (≤ 2 rounds); if it is a design lens or the budget is spent, it routes to the human sign-off it would have had anyway. Signing because *you* think the juror is wrong is overruling the panel — confidence by the back door. |
 | "Auto-sign let me continue, so I don't need to notify — it's just progress" | The auto-sign notify is mandatory and carries a decision (the user's veto over a signature made without them). It is the one sanctioned mid-flow notify precisely because it is not progress — it is the audit trail for a delegated gate. |
 
@@ -482,7 +478,7 @@ and defined there. The boss-side contract is just this:
 - About to route a behaviour-encoding change to `compiler-driven` because it "looks mechanical" — apply the straddle rule: if the change encodes new behaviour it is `tdd` / `spec-driven`, and doubt means it carries behaviour.
 - About to accept a `compiler-driven` edit on a clean build without confirming the suite is green *unchanged* — the conjunction is the done-signal; a green-but-wrong change builds clean.
 - About to sign a spec under auto-sign on confidence — without all objective gates green and a unanimous `spec-skeptic` panel; signing over any `BLOCK`; self-correcting a *design*-lens (`scope-fork` / `grounding`) `BLOCK` instead of escalating; or looping past the 2-round budget. The gate exists so the orchestrator's confidence never signs.
-- About to run the auto-sign path at all when the project has not enabled spec auto-sign, or to skip the mandatory auto-sign notify after signing.
+- About to run the auto-sign path outside a `/boss` session, or to skip the mandatory auto-sign notify after signing.
 
 ## Cross-references
 
@@ -501,8 +497,8 @@ and defined there. The boss-side contract is just this:
   record-reality discipline for the only autonomous glossary writer.
 - **Spec auto-sign gate:** owned by `../specify` Step 6; the
   adversarial juror is `../specify/agents/spec-skeptic.md` (dispatched
-  five times, one per lens). Enabled per project in its CLAUDE.md
+  five times, one per lens). Runs under `/boss` — see
-  project facts — see `../docs/conventions.md`.
+  `../docs/conventions.md`.
 - **Downstream skills dispatched:** `../brainstorm`,
   `../specify` (spec-production core; autonomously dispatchable for a
   settled design), `../planner`, `../implement`, `../audit`,

docs/conventions.md

@@ -96,9 +96,9 @@ configuration. In particular: `brainstorm`, `specify`, `planner`,
 `implement`, `audit`, `debug`, `tdd`, `fieldtest`, and `docwriter` are
 always available. `tdd` is a standard entry path for test-specifiable
 work — not an opt-in. `audit` is mandatory at cycle close.
-`fieldtest` / `docwriter` are orchestrator-dispatched. The single
+`fieldtest` / `docwriter` are orchestrator-dispatched. There is no
-behavioural toggle is spec auto-sign under `/boss`, declared (when a
+per-project behavioural toggle: spec auto-sign is always on under
-project wants it) in that project's CLAUDE.md project facts.
+`/boss`.
 
 ## Per-project facts (in each project's CLAUDE.md)
 
@@ -120,7 +120,6 @@ Under `## Skills plugin: project facts`, where applicable:
 | **fieldtest examples** | fieldtester | Optional path where fixtures are written. |
 | **by-role standing reading** | named agent | Optional; extra files/commands a specific role reads. |
 | **issue tracker** | boss, spec-skeptic | Repo slug + list command + show command (the latter MUST render an issue WITH its comments). |
-| **spec auto-sign** | boss, specify | Optional; `enabled` lets `/boss` sign a spec in the user's place through the auto-sign gate (default: human signature). |
 
 ### Aspirational-source marker (recommendation)
 

docs/design.md

@@ -94,8 +94,8 @@ project's `CLAUDE.md` under `## Skills plugin: project facts`:
 code roots, build / test / lint / doc-build commands, regression
 scripts, architect sweeps, design-ledger / glossary / contracts /
 models / bench / public-interface / fieldtest-examples paths,
-by-role standing reading, the issue-tracker repo slug and commands,
+by-role standing reading, and the issue-tracker repo slug and commands.
-and spec auto-sign. The template is in
+The template is in
 `../templates/CLAUDE.md.fragment`; the per-fact reference is the
 table in `conventions.md`.
 

docs/pipeline.md

@@ -128,10 +128,9 @@ sign-off — with review but no interview. Bounces to `brainstorm` the moment th
 resolve a load-bearing design decision. A core node — the
 spec-production gate before `planner` on every design path.
 
-The sign-off is the user's by default, including under `/boss`. The
+Outside `/boss` the sign-off is the user's. Under `/boss` the
-one exception is spec auto-sign (a project that enables it in its
+orchestrator may sign a spec in the user's place through the auto-sign
-CLAUDE.md project facts): with it on, a `/boss` run may sign a spec in
+gate — but only
-the user's place — but only
 when every objective gate is green AND a unanimous five-lens
 `spec-skeptic` panel passes; the orchestrator's own confidence never
 signs. A `BLOCK` is never signed over: an editorial one (`criterion` /
@@ -288,9 +287,9 @@ dispatch shown above are fixed — the same for every project. All
 phases (`brainstorm`, `specify`, `planner`, `implement`, `audit`,
 `debug`, `tdd`, `fieldtest`, `docwriter`) are always available; which
 ones run on a given iteration is the orchestrator's judgement per the
-skip rules above, not a per-project setting. The only behavioural
+skip rules above, not a per-project setting. There is no behavioural
-toggle is spec auto-sign under `/boss`, declared in a project's
+toggle either: spec auto-sign is always on under `/boss`. See
-CLAUDE.md project facts. See `conventions.md`.
+`conventions.md`.
 
 If a project declares a glossary in its CLAUDE.md project facts, that
 file is standing reading for every role — the canonical-nomenclature

specify/SKILL.md

@@ -75,7 +75,7 @@ IF WRITING THE SPEC FORCES A CHOICE BETWEEN PLAUSIBLE DESIGNS THE SOURCES DO NOT
 THE PRODUCTION GATES — ACCEPTANCE CRITERION, GROUNDING-CHECK, USER-REVIEW —
   ARE NON-NEGOTIABLE REGARDLESS OF ENTRY PATH.
 NO PLAN, SCAFFOLDING, OR DOWNSTREAM SKILL UNTIL THE SPEC IS APPROVED — BY THE USER, OR
-  (ONLY UNDER /boss WITH spec_auto_sign ENABLED) BY THE AUTO-SIGN GATE: ALL OBJECTIVE GATES GREEN
+  (UNDER /boss) BY THE AUTO-SIGN GATE: ALL OBJECTIVE GATES GREEN
   AND A UNANIMOUS ADVERSARIAL spec-skeptic PANEL. MODEL SELF-CONFIDENCE ALONE IS NEVER APPROVAL.
 ```
 
@@ -150,7 +150,7 @@ the user — which is a Step-1.5 bounce, not a comment. The comment is
 which is exactly why it, and not your ephemeral confidence, is what a
 downstream `scope-fork` juror reads to confirm the fork is settled (see
 Step 6). Recording it keeps the forward queue honest in either run mode;
-under auto-sign it is *load-bearing* — without it the `scope-fork` juror
+under `/boss` it is *load-bearing* — without it the `scope-fork` juror
 sees only the stale issue body and (correctly) blocks.
 
 Provenance enforcement is not yours to self-certify: you *write* the
@@ -186,9 +186,9 @@ is the wrong one — a provenance note *inside the spec* is
 self-referential (the spec asserting its own sources settle it) and
 stays banned, but a separate issue is independent (author + timestamp,
 in the forward queue, juror-readable without opening the spec), as
-auditable as a reconciliation comment. Creating it is what makes
+auditable as a reconciliation comment. Creating it is what lets the
-auto-sign *reachable* here, instead of the old unconditional fall-back
+`scope-fork` juror ratify the resolution here, instead of blocking for
-to the human sign-off.
+lack of an auditable source.
 
 The provenance gate is unchanged and load-bearing: the new issue records
 *user* decisions, never fresh orchestrator ones. No real user statement
@@ -366,22 +366,15 @@ the commit itself.
 
 **In `/boss` (autonomous):** `specify` is dispatched autonomously —
 it is bounded (no interview). It runs the criterion, parse, and
-grounding-check gates without a checkpoint. What happens at *this*
+grounding-check gates without a checkpoint. At *this* gate the
-gate then depends on whether the project enables spec auto-sign (its
+orchestrator signs in the user's place, but only through the
-CLAUDE.md project facts):
+**auto-sign gate** below — never on its own confidence. The gate
-
+exists because the orchestrator that wrote the spec is the worst-placed
-- **Slot absent or `false` (default):** `specify` **pauses here** as a
+party to judge it, so it is built to *not* rely on that confidence. The
-  problem-state notify ("spec X ready, please sign off") and waits for
+human sign-off pause is not the default here; it is where the gate
-  the user. This is the final sign-off pause, not a pre-dispatch
+**escalates** — a spec that cannot clear the gate routes to a
-  checkpoint — the distinction from `brainstorm`, which `/boss` bounces
+problem-state notify ("spec X ready, please sign off") and waits for the
-  *before* dispatch. This is the conservative default; the user's
+user, exactly as a plain pause would. Run the gate in two stages:
-  signature is mandatory.
-
-- **Slot `true`:** the orchestrator MAY sign in the user's place, but
-  only through the **auto-sign gate** below. The gate exists because
-  the orchestrator that wrote the spec is the worst-placed party to
-  judge it — so the gate is built to *not* rely on the orchestrator's
-  own confidence. Run it in two stages:
 
   1. **Objective gates (all must already hold — these are facts, not
      judgements):**
@@ -496,7 +489,7 @@ discipline `tdd` applies when behaviour is not test-specifiable.
 | user / issue (design settled) → `specify` | the sources: issue body, in-context design discussion, design docs |
 | `brainstorm` → `specify` | ratified design narrative (approaches chosen, constraints, sections approved) — in-context; brainstorm writes no spec file |
 | `specify` → `grounding-check` (Step 5) | `spec_path` (absolute) + `iteration_scope` |
-| `specify` → `spec-skeptic` panel (Step 6, `/boss` + `spec_auto_sign` only) | `spec_path` (absolute) + `iteration_scope` + one `lens` per dispatch (five in parallel) + `seeding_issue` (index for the `scope-fork` juror to read, or `none`) |
+| `specify` → `spec-skeptic` panel (Step 6, `/boss` only) | `spec_path` (absolute) + `iteration_scope` + one `lens` per dispatch (five in parallel) + `seeding_issue` (index for the `scope-fork` juror to read, or `none`) |
 | `specify` → `planner` (Step 7, on PASS or overridden BLOCK) | path to spec + iteration scope |
 | `specify` → `brainstorm` (precondition bounce) | the unresolved design question as a cycle request; no spec written |
 | `specify` → issue backlog (Step 5, no-override BLOCK) | new issue naming the unratified dependency; spec file deleted from the working tree |
@@ -511,7 +504,7 @@ discipline `tdd` applies when behaviour is not test-specifiable.
 | "The shape is clear from the prose, I don't need to paste the code" | If it's clear, pasting it is free; if pasting it is hard, it wasn't clear. The acceptance criterion is unjudgeable without the worked code. |
 | "Just polishing a wording after PASS, no need to re-dispatch" | The grounding-check report attests to specific bytes. A polish edit changes the bytes; the attestation no longer covers them. Re-dispatch is cheap. |
 | "It's in a model doc / the design ledger, so it's canonical" | A `models` / RFC / proposal doc holds aspirational code — a target, not verified fact. Flag code lifted from a `status: aspirational` source as such; it is not ratified contract. |
-| "In `/boss` with auto-sign on, this spec looks solid — I'll sign and move on" | Your sense that it looks solid is the exact signal the auto-sign gate refuses to trust. Signing requires all objective gates green AND a unanimous `spec-skeptic` panel. If you find yourself wanting to sign on confidence, that is the cue to run the gate, not to skip it. |
+| "In `/boss` this spec looks solid — I'll sign and move on" | Your sense that it looks solid is the exact signal the auto-sign gate refuses to trust. Signing requires all objective gates green AND a unanimous `spec-skeptic` panel. If you find yourself wanting to sign on confidence, that is the cue to run the gate, not to skip it. |
 | "One lens blocked on something minor — I'll sign anyway since the rest passed" | The panel is unanimous-or-nothing by design. You never *sign over* a `BLOCK`. An editorial `BLOCK` you may *repair* (within the ≤ 2-round budget, with a full re-panel after); a design `BLOCK` routes to the human. Neither is overruling a juror — that is the whole point of replacing your eye with five independent ones. |
 
 ## Red Flags — STOP
@@ -530,7 +523,8 @@ discipline `tdd` applies when behaviour is not test-specifiable.
   re-dispatching only the blocked lens rather than all five, or past
   the 2-round self-correction budget
 - (auto-sign) Running the panel before the objective gates are green,
-  or running it at all when `spec_auto_sign` is not enabled
+  or running it outside a `/boss` session (interactive runs take the
+  user's signature directly)
 - Jumping straight from spec to `implement` (must go via `planner`)
 - Running an interview here (that is `brainstorm`'s job — if the work
   needs one, bounce)
@@ -548,10 +542,9 @@ discipline `tdd` applies when behaviour is not test-specifiable.
 - **Agent dispatched:** `agents/grounding-check.md` — dispatched in
   Step 5 as a hard-gate. Reads the spec with fresh context and reports
   PASS / BLOCK / INFRA_ERROR.
-- **Agent dispatched (auto-sign only):** `agents/spec-skeptic.md` —
+- **Agent dispatched (auto-sign):** `agents/spec-skeptic.md` —
-  dispatched in Step 6 five times in parallel (one per lens) ONLY under
+  dispatched in Step 6 five times in parallel (one per lens) under
-  a `/boss` session with spec auto-sign enabled (the project's CLAUDE.md
+  a `/boss` session. Each
-  project facts). Each
   juror tries to refute the spec along its lens; a unanimous `SOUND` is
   what lets the orchestrator sign in the user's place. An editorial-lens
   `BLOCK` (`criterion` / `ambiguity` / `plan-readiness`) is self-

specify/agents/spec-skeptic.md

@@ -1,6 +1,6 @@
 ---
 name: spec-skeptic
-description: Read-only adversarial spec reviewer for the boss auto-sign panel. Dispatched by the specify skill in Step 6 ONLY under a `/boss` session with spec auto-sign enabled (the project's CLAUDE.md project facts) — five times in parallel, once per lens (criterion, grounding, scope-fork, ambiguity, plan-readiness). Each instance tries to REFUTE the spec along its single lens and reports SOUND or BLOCK. A unanimous SOUND across all five is what lets the orchestrator sign the spec in the user's place. Does NOT propose fixes, does NOT edit files.
+description: Read-only adversarial spec reviewer for the boss auto-sign panel. Dispatched by the specify skill in Step 6 under a `/boss` session — five times in parallel, once per lens (criterion, grounding, scope-fork, ambiguity, plan-readiness). Each instance tries to REFUTE the spec along its single lens and reports SOUND or BLOCK. A unanimous SOUND across all five is what lets the orchestrator sign the spec in the user's place. Does NOT propose fixes, does NOT edit files.
 tools: Read, Glob, Grep, Bash
 ---
 
@@ -11,8 +11,7 @@ tools: Read, Glob, Grep, Bash
 ## What this role is for
 
 A spec normally carries the user's signature: the human reads it
-and approves before any plan is built. Under a `/boss` session with
+and approves before any plan is built. Under a `/boss` session, the
-spec auto-sign enabled (the project's CLAUDE.md project facts), the
 orchestrator may sign in the user's
 place — but only if it is genuinely safe, and **model
 self-confidence is not a safety signal**. The orchestrator that

templates/CLAUDE.md.fragment

@@ -150,8 +150,3 @@ that does not apply.
     include comments — otherwise a `specify` reconciliation comment is
     invisible to the `scope-fork` juror and auto-sign falls back to the
     human sign-off.
-- **Spec auto-sign** — optional; default off (human signature required).
-  Set to **enabled** to let a `/boss` run sign a spec in the user's place
-  through `specify`'s auto-sign gate (every objective gate green AND a
-  unanimous five-lens `spec-skeptic` panel; the orchestrator's own
-  confidence never signs). See `boss/SKILL.md` § "Spec auto-sign".