@ai-dev-methodologies/rlp-desk 0.15.5 → 0.16.0

package/CHANGELOG.md

@@ -11,6 +11,33 @@ For pre-v0.15.4 versions, refer to `git log` and individual GitHub release notes
 - Post-v0.15.6: remove `RLP_LIFECYCLE_METRICS` flag entirely (per plan v3 ADR follow-ups).
 - Phase D.1 (handoff documents) + Phase D.2 (per-stage agent role specialization) — both deferred per `docs/plans/v0.15.4-release-runbook.md` §7.6.
 
+## [0.16.0] — 2026-06-18
+
+Leader consolidation (ADR-001): `--mode tmux` is now the canonical production leader, self-verification works on it, and the deprecated `--mode agent` Node-CLI path is on a dated removal schedule.
+
+### Added
+- **Self-verification now works under `--mode tmux`.** `--with-self-verification` previously required the deprecated `--mode agent` path; the report is now generated by a pure-filesystem post-pass that runs after the zsh leader exits (reading the campaign's done-claim/verdict artifacts), so the canonical production path gets SV reports without the `claude --print` no-TTY hang.
+
+### Deprecated
+- **`node run.mjs run <slug> --mode agent` (Node-leader CLI alpha) is on a dated removal schedule** (ADR-001): 0.16.x louder banner → **0.17.0 hard-error** (and the Node-CLI default flips to `tmux`) → 0.18.0 dispatch branch removed. The `src/node/**` engine modules are retained throughout. Migrate direct-CLI wrappers to `--mode tmux` (canonical). This does NOT affect the slash command's `--mode native` default.
+- **The flywheel (`--flywheel` / `--flywheel-guard`) is deprecated.** It was only ever implemented in the deprecated `--mode agent` Node path (never in the canonical zsh leader, despite a stale comment that claimed otherwise). Its only output, the advisory `next_mission_candidate` field, has no shipped runnable consumer. It will not be ported to the canonical leader; use a consumer-side wrapper for multi-mission chaining.
+
+## [0.15.6] — 2026-06-18
+
+Patch: CI/test integrity, a codex command-builder security fix, and documentation reconciliation.
+
+### Fixed
+- **Codex worker command no longer passes model/reasoning unquoted.** `buildCodexCmd` now shell-quotes the model and reasoning values (parity with the claude path), closing a shell-injection / argument-splitting hazard when operator-supplied flags reach the shell via tmux send-keys.
+- **Docs now describe the correct execution modes.** The README "execution modes" section conflated the slash-command default (`--mode native`, `Agent()`-based) with the deprecated `--mode agent` (Node CLI). It is rewritten to the accurate three-mode model: `--mode tmux` is the canonical/recommended path, `--mode native` is the default companion for short/interactive use, `--mode agent` is deprecated.
+- **Docs now point to the correct scaffold path.** Getting-started and README referenced the pre-v0.13.0 `.claude/ralph-desk/` project-local path; corrected to `.rlp-desk/` (the global install path `~/.claude/ralph-desk/` is unchanged).
+
+### Changed
+- **CI now runs the behavioral test suites.** A new CI job runs `test:node` + `test:zsh` (previously CI ran only the existence-grep fast gate). First rollout is non-blocking to inventory CI-only flakiness before being made blocking.
+- **The full SV gate verifies the source tree.** `sv-gate:full`'s real-campaign E2E now targets the in-repo `src/` leader (and the correct `.rlp-desk/` sentinel paths) instead of the installed copy, so the gate validates the code being merged.
+
+### Added
+- **ADR-001 (Leader Consolidation).** Records the decision to make `--mode tmux` the canonical production leader, deprecate the `--mode agent` Node-CLI entry point on a dated schedule, and retain `--mode native` as a second-class companion. (Internal; not shipped in the tarball.)
+
 ## [0.15.5] — 2026-06-17
 
 Patch: fixes surfaced by a fresh-context live dogfood of the tmux and agent run modes, plus packaging hygiene.

package/README.md

@@ -275,45 +275,48 @@ The brainstorm phase evaluates complexity (US count, file scope, logic, dependen
 
 ## Execution Modes
 
-RLP Desk supports two execution modes. Both honor the same governance protocol.
-
-> **v0.14.0 status:** `--mode tmux` (zsh-backed) is the **stable, production** path
-> with the full safety net (heartbeat, copy-mode guard, prompt-stall timeout,
-> no-progress detection, claude model upgrade chain). `--mode agent` is **alpha**
-> and ships without those features — the runner emits a stderr warning when
-> agent mode is invoked. For long campaigns and BOS-style autonomous loops,
-> use `--mode tmux`.
+RLP Desk has three execution modes, all honoring the same governance protocol. **`--mode tmux` is the canonical, recommended path for any real campaign** (see [ADR-001](docs/plans/adr-001-leader-consolidation.md)).
+
+> **Mode status:**
+> - **`--mode tmux`** (zsh-backed) — **stable / production / canonical.** Full safety net (heartbeat,
+>   copy-mode guard, prompt-stall timeout, no-progress detection, model upgrade chain). Use this for
+>   long campaigns and autonomous loops.
+> - **`--mode native`** (the slash-command **default**) — the current Claude Code session is the Leader,
+>   dispatching via `Agent()`. Works anywhere (no tmux), good for short/interactive use, but is a
+>   second-class companion: no iteration watchdog, turn-based pauses possible. Not for long unattended runs.
+> - **`--mode agent`** (direct Node CLI) — **deprecated alpha**, on a removal schedule (ADR-001). Prints a
+>   SCHEDULED-REMOVAL banner. Do not use for new work; prefer `--mode tmux`.
 
 ### Environment Compatibility
 
-| Environment | Agent Mode (alpha) | Tmux Mode (stable) |
-|-------------|--------------------|--------------------|
-| Claude Code (any terminal) | **Works** | Requires tmux |
-| Inside tmux session | **Works** | **Works** — panes split in current window |
-| Outside tmux session | **Works** | **Rejected** — "start tmux first" |
+| Environment | Native (default) | Tmux (canonical) | Agent (deprecated) |
+|-------------|------------------|------------------|--------------------|
+| Claude Code (any terminal) | **Works** | Requires tmux | Works |
+| Inside tmux session | **Works** | **Works** — panes split in current window | Works |
+| Outside tmux session | **Works** | **Rejected** — "start tmux first" | Works |
 
 ### Choosing Your Mode
 
 | Need | Use |
 |------|-----|
-| Production / autonomous campaigns | `--mode tmux` (stable) |
-| Long campaigns, CI, overnight runs | `--mode tmux` (stable) |
-| Quick interactive exploration inside Claude Code | `--mode agent` (alpha — Node-native) |
+| Production / autonomous / overnight / CI campaigns | `--mode tmux` (canonical) |
+| Quick interactive exploration, no tmux available | `--mode native` (default) |
+| (legacy direct-Node-CLI workflows) | `--mode agent` — deprecated; migrate to `--mode tmux` |
 
-### Agent Mode (default) — "Smart Mode"
+### Native Mode (slash-command default) — "Smart Mode"
 
 ```
-/rlp-desk run calculator
+/rlp-desk run calculator        # defaults to --mode native
 ```
 
 The current Claude Code session acts as the Leader, dispatching Workers and Verifiers via `Agent()`. The Leader is an LLM that dynamically routes models and reasons about context.
 
 - Works anywhere — no tmux required
 - Dynamic model routing — Leader upgrades models on failure
-
-**Known limitation:** Agent mode runs inside Claude Code's turn-based request-response model. If the LLM outputs text without a tool call, the turn terminates and the loop pauses until the user sends "continue." This is a platform constraint — the protocol mitigates it but cannot guarantee 100% uninterrupted execution. For guaranteed autonomous loops, use tmux mode.
 - Fix Loop — extracts verifier issues and feeds them back to the next worker
-- Best for interactive development
+- Best for short, interactive development
+
+**Known limitation:** Native mode runs inside Claude Code's turn-based request-response model. If the LLM outputs text without a tool call, the turn terminates and the loop pauses until the user sends "continue." This is a platform constraint — the protocol mitigates it but cannot guarantee 100% uninterrupted execution. **For guaranteed autonomous loops, use `--mode tmux`.**
 
 ### Tmux Mode — "Lean Mode"
 
@@ -456,7 +459,7 @@ Each conflict is logged as a JSONL entry in `logs/<slug>/conflict-log.jsonl`:
 After the campaign, review the conflict log to identify systemic issues:
 
 ```bash
-cat .claude/ralph-desk/logs/<slug>/conflict-log.jsonl | jq .
+cat .rlp-desk/logs/<slug>/conflict-log.jsonl | jq .
 ```
 
 Common patterns:
@@ -471,20 +474,20 @@ After `init`, your project gets this scaffold:
 ```
 your-project/
 ├── .claude/
-│   ├── settings.local.json          # rlp-desk permissions (auto-added by init)
-│   └── ralph-desk/
-│       ├── prompts/
-│       │   ├── <slug>.worker.prompt.md
-│       │   └── <slug>.verifier.prompt.md
-│       ├── context/
-│       │   └── <slug>-latest.md
-│       ├── memos/
-│       │   └── <slug>-memory.md
-│       ├── plans/
-│       │   ├── prd-<slug>.md
-│       │   └── test-spec-<slug>.md
-│       └── logs/<slug>/
-│           └── status.json
+│   └── settings.local.json          # rlp-desk permissions (auto-added by init)
+└── .rlp-desk/                        # scaffold (v0.13.0+; was .claude/ralph-desk/)
+    ├── prompts/
+    │   ├── <slug>.worker.prompt.md
+    │   └── <slug>.verifier.prompt.md
+    ├── context/
+    │   └── <slug>-latest.md
+    ├── memos/
+    │   └── <slug>-memory.md
+    ├── plans/
+    │   ├── prd-<slug>.md
+    │   └── test-spec-<slug>.md
+    └── logs/<slug>/
+        └── status.json
 ```
 
 ### Local Settings
@@ -495,15 +498,15 @@ your-project/
 {
   "permissions": {
     "allow": [
-      "Read(.claude/ralph-desk/**)",
-      "Edit(.claude/ralph-desk/**)",
-      "Write(.claude/ralph-desk/**)"
+      "Read(.rlp-desk/**)",
+      "Edit(.rlp-desk/**)",
+      "Write(.rlp-desk/**)"
     ]
   }
 }
 ```
 
-**Why:** Claude Code treats `.claude/` files as sensitive and prompts for confirmation on each access, even with `--dangerously-skip-permissions`. Without these permissions, Worker and Verifier agents are blocked by interactive prompts during automated loop execution.
+**Why:** Since v0.13.0 the scaffold lives at `.rlp-desk/` (outside `.claude/`), so Claude Code's `.claude/` sensitive-file gate no longer blocks Worker/Verifier writes. These explicit `.rlp-desk/**` permissions are a belt-and-suspenders helper that keeps automated loop execution prompt-free.
 
 **Note:** `settings.local.json` is local to your machine and is not committed to git. If the file already exists, permissions are merged without overwriting your existing settings.
 

package/docs/rlp-desk/getting-started.md

@@ -64,7 +64,7 @@ On approval, brainstorm offers to run `init` automatically.
 This creates the scaffold:
 
 ```
-.claude/ralph-desk/
+.rlp-desk/
 ├── prompts/
 │   ├── loop-test.worker.prompt.md
 │   └── loop-test.verifier.prompt.md
@@ -78,9 +78,12 @@ This creates the scaffold:
 └── logs/loop-test/
 ```
 
+> Since v0.13.0 the scaffold lives at the project-local `.rlp-desk/` (not `.claude/ralph-desk/`),
+> so Claude Code's `.claude/` sensitive-file gate no longer blocks Worker/Verifier writes.
+
 ## Step 5: Customize the PRD
 
-Edit `.claude/ralph-desk/plans/prd-loop-test.md` to define your user stories and acceptance criteria. See [`examples/calculator/`](../examples/calculator/.claude/ralph-desk/plans/prd-loop-test.md) for a complete example.
+Edit `.rlp-desk/plans/prd-loop-test.md` to define your user stories and acceptance criteria. See [`examples/calculator/`](../examples/calculator/.claude/ralph-desk/plans/prd-loop-test.md) for a complete example.
 
 Key sections:
 - **User Stories** with Given/When/Then acceptance criteria, Task Type, and Risk Level
@@ -91,7 +94,7 @@ Key sections:
 
 ## Step 6: Define the Test Spec
 
-Edit `.claude/ralph-desk/plans/test-spec-loop-test.md` to specify verification commands:
+Edit `.rlp-desk/plans/test-spec-loop-test.md` to specify verification commands:
 
 ```markdown
 ## Verification Commands

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-dev-methodologies/rlp-desk",
-  "version": "0.15.5",
+  "version": "0.16.0",
   "description": "Fresh-context iterative loops for Claude Code — autonomous task completion with independent verification",
   "scripts": {
     "postinstall": "node scripts/postinstall.js",

package/src/commands/rlp-desk.md

@@ -303,7 +303,7 @@ Legacy `--mode agent` typed against this slash command emits a deprecation notic
 
 #### Tmux Mode (`--mode tmux`)
 
-When `--mode tmux` is specified (v0.14.0+: `run.mjs` accepts the same flags as before but spawns `run_ralph_desk.zsh` as a subprocess and inherits stdio. Flywheel and self-verification flags are not honored under tmux mode — they currently require the deprecated Node-leader direct-CLI path `node run.mjs --mode agent` (see "Direct Node CLI invocation" below). Native Agent() port is a post-Node-leader-retirement task):
+When `--mode tmux` is specified (v0.14.0+: `run.mjs` accepts the same flags as before but spawns `run_ralph_desk.zsh` as a subprocess and inherits stdio. ARCH Wave C: `--with-self-verification` **is honored** under tmux mode via a Node post-pass that runs after the zsh leader exits (see §348). `--flywheel`/`--flywheel-guard` are deprecated (ADR-001) and remain unimplemented in the zsh leader):
 
 1. **Validate scaffold** — same as Agent() mode: check `.rlp-desk/prompts/<slug>.worker.prompt.md` etc.
 2. **Check sentinels** — same as Agent() mode.
@@ -345,7 +345,7 @@ node ~/.claude/ralph-desk/node/run.mjs run '<slug>' \
 - MUST launch with `run_in_background: true` so `/rlp-desk` returns control immediately while preserving live tmux visibility.
 - Run-in-background is used so the shell can keep the command visible and keep the pane layout stable for status checks and completion flow.
 - Do NOT kill panes after completion. Panes stay alive for inspection. User cleans up with `/rlp-desk clean <slug> --kill-session`.
-- v0.14.0: `--with-self-verification`, `--flywheel`, and `--flywheel-guard` are **not honored** under `--mode tmux` — the zsh runner has no SV/flywheel implementation. The Node leader emits a stderr WARNING listing the dropped flags. For SV/flywheel today, use the deprecated Node-leader direct-CLI path `node run.mjs --mode agent` (see "Direct Node CLI invocation" below). The slash command's Native Agent() (`--mode native`) does not yet implement SV/flywheel — port is a post-Node-leader-retirement task.
+- ARCH Wave C (ADR-001): `--with-self-verification` **is honored** under `--mode tmux`. The zsh leader cannot generate the SV report in-pane (`claude --print` hangs without a TTY — hence its `$TMUX` early-return), so `run.mjs` runs the **pure-filesystem** `generateSVReport` as a **post-pass after the zsh child exits**, reading the campaign's on-disk done-claim/verdict artifacts. `--flywheel` and `--flywheel-guard` are **deprecated** (ADR-001) and remain unimplemented in the zsh leader; the Node leader emits a stderr WARNING for those two only. The slash command's Native Agent() (`--mode native`) does not yet implement SV/flywheel.
 - **For `--mode tmux` only**: the slash command invokes `node ~/.claude/ralph-desk/node/run.mjs run --mode tmux ...`. Do NOT invoke `~/.claude/ralph-desk/run_ralph_desk.zsh` directly — the Node router resolves the runner path, runs legacy detection, and surfaces actionable errors when the runner is missing. **For `--mode native`**, the slash command does NOT invoke the Node CLI — it acts as the leader itself; see Native Agent() Mode section below.
 
 **tmux UX model (5 items):**
@@ -374,7 +374,17 @@ This contract MUST be observed in every iteration of the leader loop below. Futu
 
 #### Direct Node CLI invocation (`node run.mjs run <slug> --mode agent` — deprecated alpha)
 
-Direct invocation of `node ~/.claude/ralph-desk/node/run.mjs run <slug> --mode agent` is **the deprecated Node-leader alpha path**. This is unrelated to the slash command's Native Agent() path above — different code, different leader, different lifecycle. The Node leader currently retains SV/flywheel implementations not yet ported to Native Agent(). The Node CLI emits a deprecation banner on this mode and is scheduled for hard-error in the next major release. For production tmux orchestration, use `--mode tmux`. For Claude Code Native Agent() campaigns, use `/rlp-desk run <slug> --mode native` from a Claude Code session.
+Direct invocation of `node ~/.claude/ralph-desk/node/run.mjs run <slug> --mode agent` is **the deprecated Node-leader alpha path**. This is unrelated to the slash command's Native Agent() path above — different code, different leader, different lifecycle. The Node leader currently retains SV/flywheel implementations not yet ported to Native Agent(). For production tmux orchestration, use `--mode tmux` (the **canonical** leader). For Claude Code Native Agent() campaigns, use `/rlp-desk run <slug> --mode native` from a Claude Code session.
+
+**Deprecation schedule** (per [ADR-001](../../docs/plans/adr-001-leader-consolidation.md) §3 — applies to the Node-CLI `--mode agent` entry point ONLY; the `src/node/**` engine modules are retained throughout):
+
+| Version | Behavior of `node run.mjs run <slug> --mode agent` |
+|---------|-----------------------------------------------------|
+| 0.16.x  | runs, with a louder deprecation banner |
+| **0.17.0** | **hard-errors** (exit 2) with a redirect to `--mode tmux` / `--mode native`; the Node-CLI default also flips to `tmux` |
+| 0.18.0  | the `--mode agent` dispatch branch is removed (engine modules stay) |
+
+External wrappers calling `--mode agent` must migrate to `--mode tmux` by 0.17.0. This is a breaking CLI change for that entry point, announced in CHANGELOG at each step.
 
 ### Preparation
 1. Validate scaffold: `.rlp-desk/prompts/<slug>.worker.prompt.md` etc.

package/src/node/cli/command-builder.mjs

@@ -72,14 +72,17 @@ export function buildClaudeCmd(mode, model, options = {}) {
 export function buildCodexCmd(mode, model, options = {}) {
   assertTuiMode(mode, 'buildCodexCmd');
 
+  // GAP-2 (audit): shell-quote model + reasoning for parity with buildClaudeCmd.
+  // The command string is delivered to a shell (tmux send-keys), so unquoted
+  // operator-supplied values were a shell-injection / arg-splitting hazard.
   const parts = [
     CODEX_BIN,
     '-m',
-    model,
+    shellQuote(model),
   ];
 
   if (options.reasoning !== undefined) {
-    parts.push('-c', `model_reasoning_effort="${options.reasoning}"`);
+    parts.push('-c', shellQuote(`model_reasoning_effort="${options.reasoning}"`));
   }
 
   parts.push('--disable', 'plugins', '--dangerously-bypass-approvals-and-sandbox');

package/src/node/run.mjs

@@ -5,7 +5,7 @@ import { spawn, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 
 import { initCampaign } from './init/campaign-initializer.mjs';
-import { readStatus } from './reporting/campaign-reporting.mjs';
+import { readStatus, generateSVReport } from './reporting/campaign-reporting.mjs';
 import {
   run as runCampaignMain,
   detectLegacyDeskInRunMode,
@@ -318,6 +318,10 @@ function buildZshEnv(slug, options, parentEnv) {
     AUTONOMOUS_MODE: options.autonomous ? '1' : '0',
     LANE_MODE: options.laneStrict ? 'strict' : 'warn',
     TEST_DENSITY_MODE: options.testDensityStrict ? 'strict' : 'warn',
+    // ARCH Wave C-SV: forwarded for traceability only. The zsh leader keeps its
+    // $TMUX early-return (no in-pane `claude --print`); the SV report itself is
+    // produced by the Node post-pass in runTmuxViaZsh after the zsh child exits.
+    WITH_SELF_VERIFICATION: options.withSelfVerification ? '1' : '0',
   };
 }
 
@@ -360,23 +364,47 @@ async function runTmuxViaZsh(slug, options, deps) {
     return 1;
   }
 
-  // Surface flags the zsh runner cannot honor. Flywheel and self-verification
-  // remain Node-leader features, available only in --mode agent. Warn loudly
-  // instead of silent no-op so the operator understands the trade-off.
+  // Surface flags the zsh runner cannot honor. ARCH Wave C: --with-self-verification
+  // IS now honored in tmux mode via a post-zsh-return pass (see below) — only the
+  // flywheel flags remain unsupported here. Warn loudly instead of silent no-op.
   const unsupported = [];
   if (options.flywheel !== 'off') unsupported.push('--flywheel');
   if (options.flywheelGuard !== 'off') unsupported.push('--flywheel-guard');
-  if (options.withSelfVerification) unsupported.push('--with-self-verification');
   if (unsupported.length > 0) {
     write(
       deps.stderr,
-      `WARNING: ${unsupported.join(', ')} not honored in --mode tmux (zsh runner). Use --mode agent for those features.`,
+      `WARNING: ${unsupported.join(', ')} not honored in --mode tmux (zsh runner). Flywheel is deprecated (ADR-001) — use --mode agent if you still need it.`,
     );
   }
 
   const env = buildZshEnv(slug, options, process.env);
   const spawnZsh = deps.spawnZsh ?? defaultSpawnZsh;
-  return spawnZsh(zshPath, env, options.rootDir);
+  const exitCode = await spawnZsh(zshPath, env, options.rootDir);
+
+  // ARCH Wave C-SV: home self-verification onto --mode tmux. The zsh runner cannot
+  // produce the SV report itself (`claude --print` hangs without a TTY in a tmux
+  // pane — that is why lib_ralph_desk.zsh keeps its $TMUX early-return). Instead we
+  // run the Node PURE-FS generateSVReport as a post-pass AFTER the zsh child exits:
+  // real stdout, no pane, no TTY → no hang. It reads the campaign's on-disk
+  // iter-*-done-claim/verify-verdict artifacts the zsh leader already wrote.
+  if (options.withSelfVerification) {
+    try {
+      const paths = buildPaths(options.rootDir, slug);
+      const sv = await generateSVReport({
+        slug,
+        logsDir: paths.campaignLogDir,
+        prdFile: paths.prdFile,
+        testSpecFile: paths.testSpecFile,
+        analyticsFile: paths.analyticsFile,
+        outputDir: paths.analyticsDir,
+      });
+      write(deps.stdout, `\nSelf-verification report (tmux post-pass): ${sv.summary ?? 'generated'}`);
+    } catch (err) {
+      write(deps.stderr, `WARNING: self-verification post-pass failed: ${err.message}`);
+    }
+  }
+
+  return exitCode;
 }
 
 async function runRunCommand(args, deps) {
@@ -478,7 +506,7 @@ async function runRunCommand(args, deps) {
     // not a replacement. See docs/plans/v0.15-stabilization-plan.md.
     write(
       deps.stderr,
-      'SCHEDULED REMOVAL: --mode agent (Node CLI alpha) will be removed in a future major release. Date TBD until stabilization milestones complete.',
+      'SCHEDULED REMOVAL (ADR-001): --mode agent (Node CLI alpha) hard-errors in 0.17.0 (Node-CLI default flips to tmux) and the dispatch branch is removed in 0.18.0. Engine modules stay. Migrate to --mode tmux.',
     );
     write(
       deps.stderr,

package/src/scripts/run_ralph_desk.zsh

@@ -67,8 +67,12 @@ SV_SKIPPED_REASON=""                                         # set when SV is di
 # no-progress, stale-context, claude model upgrade chain, etc.), so the
 # Node leader is now reserved for `--mode agent` (LLM-driven) only.
 # `--mode tmux` invocations from src/node/run.mjs delegate here as a
-# subprocess via env vars. zsh continues to honor FLYWHEEL,
-# FLYWHEEL_GUARD, WITH_SELF_VERIFICATION.
+# subprocess via env vars. ARCH Wave C / ADR-001: FLYWHEEL and FLYWHEEL_GUARD
+# are NOT implemented in the zsh leader (no dispatch site) and are deprecated —
+# do NOT claim otherwise. WITH_SELF_VERIFICATION is forwarded for traceability,
+# but the SV report is produced by the Node post-pass in run.mjs runTmuxViaZsh
+# after this script exits (this script keeps its $TMUX early-return to avoid the
+# `claude --print` no-TTY hang).
 AUTONOMOUS_MODE="${AUTONOMOUS_MODE:-0}"    # 1=don't stop on ambiguity, PRD is authoritative
 # P1-E Lane enforcement: WARN-only by default; --lane-strict opts into BLOCKED
 # escalation. governance §7¾. The opt-in defaults to "warn"; "strict" trips