@open-agent-toolkit/cli 0.1.60 → 0.1.63

package/assets/skills/oat-project-document/references/docs/autonomy-contract.md

@@ -0,0 +1,294 @@
+---
+title: OAT Autonomy Contract
+status: canonical
+last_updated: 2026-07-14
+---
+
+# OAT Autonomy Contract
+
+This document is the canonical policy for running OAT project workflows without
+mid-run user input. It defines the activation signal, boundary behavior,
+provenance requirements, and the inventory of interactive gates that an
+autonomous caller must resolve.
+
+## Activation and lifetime
+
+Autonomy is active only when the current process environment contains the exact
+signal:
+
+```bash
+export OAT_AUTONOMOUS=1
+export OAT_NON_INTERACTIVE=1
+```
+
+`OAT_AUTONOMOUS=1` implies `OAT_NON_INTERACTIVE=1`. The activating orchestrator
+must set both variables before invoking a lifecycle skill and must pass them to
+child processes and bounded subagents that participate in the same run.
+`OAT_NON_INTERACTIVE=1` by itself keeps its existing, narrower meaning: use a
+documented non-interactive default for the current skill. It does not authorize
+lifecycle chaining or autonomy-specific approvals.
+
+Both signals are session-scoped. They may be inherited by processes in the
+current run, but must never be written to `state.md`, `plan.md`,
+`implementation.md`, repository or user config, shell profiles, environment
+files, or any other persisted project artifact. A restarted session is
+interactive unless autonomy is deliberately activated again. Durable artifacts
+may record what decision was made and why, but not an active autonomy mode.
+
+## Resolution rules
+
+1. Preserve explicit project and configuration choices unless they are invalid.
+2. Apply an existing `OAT_NON_INTERACTIVE` branch before adding an
+   autonomy-specific resolution.
+3. Auto-resolve only decisions bounded by the user's original goal, the plan,
+   repository instructions, and the current run's declared write authority.
+4. Do not treat autonomy as authority to delete data, rewrite history, widen
+   scope, bypass protected-branch policy, disclose credentials, or accept an
+   unresolved Critical review finding.
+5. When the inventory says `boundary`, stop without waiting for input. Persist
+   safe bookkeeping, then report: the gate, why it cannot be auto-resolved, the
+   evidence, the exact operator action, and the resume command.
+6. A prompt reached without an inventory entry is a defect. Stop as an
+   `inventory-gap` boundary and record enough context to add the missing row.
+
+Configured lifecycle gates keep their declared `onFailure` behavior:
+
+- `warn`: record the failure and continue.
+- `block`: perform only the configured bounded remediation attempts, then stop
+  at a boundary if the gate still fails.
+- `prompt`: stop at a boundary after surfacing the failure; autonomy must not
+  reinterpret `prompt` as permission to continue.
+
+## Boundary classes
+
+| Class | Required behavior |
+| --- | --- |
+| `destructive-change-risk` | Stop before deletion, overwrite of irreplaceable state, force-push/history rewrite, or another destructive action not explicitly authorized by the project contract. |
+| `unresolved-critical-findings` | Stop while any Critical finding is unresolved or a blocking review cannot produce a passing result. Important findings follow the configured gate policy; they never silently disappear. |
+| `repository-policy-approval` | Stop when a protected branch, required reviewer, merge policy, ownership boundary, or equivalent repository rule requires a human or external approval. |
+| `missing-credentials` | Stop when a required credential is absent and no integrity-preserving offline or lower-tier route exists. Name the variable or credential class, never its value. |
+| `product-judgment` | Stop when available evidence does not support a choice within the approved goal and choosing would materially change product scope or behavior. |
+
+## Provenance
+
+Every autonomous resolution must leave durable, secret-free evidence in the
+artifact already owned by the calling workflow:
+
+- planning and artifact decisions: the relevant artifact plus its review row;
+- implementation and boundary decisions: `implementation.md`;
+- review and dispatch decisions: the dispatch record schema and the referenced
+  review artifact;
+- gate execution: structured gate result, attempt count, and disposition;
+- documentation and completion decisions: `state.md` and the normal summary or
+  PR artifact.
+
+Record the gate ID from this inventory, the selected outcome, the evidence or
+configuration source, and whether the result was auto-resolved or stopped at a
+boundary. Do not record tokens, secret values, signed URLs, or an active
+autonomy flag.
+
+## Gate inventory
+
+`classification` is either `auto-resolve` or `boundary:<class>`. A boundary row
+may first perform safe, bounded work and stop only if the stated condition
+remains.
+
+| ID | Skill | Gate | Interactive behavior | Autonomous resolution | Classification | Provenance |
+| --- | --- | --- | --- | --- | --- | --- |
+| NEW-01 | `oat-project-new` | Inherited dirty tree | Commit, proceed, or abort | Proceed without staging unrelated files; a required destructive cleanup stops | `auto-resolve` / `boundary:destructive-change-risk` | New-project preflight note |
+| NEW-02 | `oat-project-new` | Missing project name | Ask for a slug | Derive a valid slug from the explicit autonomous goal; stop if identity or collision handling is ambiguous | `auto-resolve` / `boundary:product-judgment` | Scaffold output and project path |
+| QS-01 | `oat-project-quick-start` | Inherited dirty tree | Commit, proceed, or abort | Proceed without staging unrelated files; a required destructive cleanup stops | `auto-resolve` / `boundary:destructive-change-risk` | Quick-start preflight note |
+| QS-02 | `oat-project-quick-start` | Missing name or description | Ask for required startup input | Derive a slug from the explicit goal and use the goal as the description; stop if the goal is not substantive | `auto-resolve` / `boundary:product-judgment` | Discovery initial request |
+| QS-03 | `oat-project-quick-start` | Discovery questions and approach buy-in | Ask clarifying questions and confirm the chosen direction | Answer from repository evidence, select the supported recommendation, and record assumptions; material product ambiguity stops | `auto-resolve` / `boundary:product-judgment` | `discovery.md` decisions and assumptions |
+| QS-04 | `oat-project-quick-start` | Design-depth choice | Choose plan, lightweight design, or spec-driven promotion | Use agent judgment from the documented heuristic and record the rationale | `auto-resolve` | `discovery.md` mode-choice rationale |
+| QS-05 | `oat-project-quick-start` | Requirements gate | Confirm, add a minor requirement, or redirect scope | Use the existing non-interactive auto-confirm path; contradictory or materially incomplete requirements stop | `auto-resolve` / `boundary:product-judgment` | Requirements-gate note in discovery/plan handoff |
+| QS-06 | `oat-project-quick-start` | Lightweight-design mode | Choose collaborative or draft | Use the existing non-interactive draft-and-review path | `auto-resolve` | `design.md` non-interactive banner |
+| QS-07 | `oat-project-quick-start` | Collaborative section approval | Approve or revise each section | Unreachable under the autonomous draft path; if explicitly preselected collaborative mode is encountered, switch to draft before authoring | `auto-resolve` | Design mode and review record |
+| QS-08 | `oat-project-quick-start` | Dispatch-ladder ownership | Choose shared, local, user, or no adoption | Do not choose a persistence scope; an incomplete ladder remains a readiness boundary | `boundary:repository-policy-approval` | Resolver diagnostic |
+| QS-09 | `oat-project-quick-start` | Project dispatch policy | Choose a named ceiling, uncapped, inherit, or unresolved | Preserve an explicit/configured value; unresolved non-interactive state blocks | `boundary:repository-policy-approval` | `state.md` policy or resolver diagnostic |
+| QS-10 | `oat-project-quick-start` | Optional phase-gate setup | Choose all, selected, or disabled | Use the shared non-interactive contract: leave absent and disabled unless an explicit value already exists | `auto-resolve` | Phase-gate setup status |
+| QS-11 | `oat-project-quick-start` | Plan artifact-review findings | Accept offered Medium/Minor fixes | Apply in-bundle, unambiguous fixes and re-review; preserve residuals and stop on unresolved Critical or material ambiguity | `auto-resolve` / `boundary:unresolved-critical-findings` | Plan review row and residual-finding note |
+| QS-12 | `oat-project-quick-start` | Configured exit gate | `block`, `prompt`, or `warn` after failure | Apply the configured failure semantics; `prompt` becomes a reported boundary | `auto-resolve` / `boundary:repository-policy-approval` | Structured gate result and disposition |
+| DISC-01 | `oat-project-discover` | Active-project confirmation or switch | Confirm the active project or choose another | Use only an explicitly supplied or valid active project; otherwise stop without guessing | `boundary:product-judgment` | Resolved project path |
+| DISC-02 | `oat-project-discover` | Stale knowledge | Continue or refresh | Refresh through the canonical knowledge workflow when available; otherwise record staleness and continue only when it does not create material ambiguity | `auto-resolve` / `boundary:product-judgment` | Discovery evidence note |
+| DISC-03 | `oat-project-discover` | Gray areas and clarifying questions | Select areas and answer questions | Select risk-relevant areas from evidence and record supported answers/assumptions; material ambiguity stops | `auto-resolve` / `boundary:product-judgment` | `discovery.md` Q&A and assumptions |
+| DISC-04 | `oat-project-discover` | Solution approach buy-in | Select or redirect the recommended approach | Select the evidence-backed recommendation and record tradeoffs; unsupported product choice stops | `auto-resolve` / `boundary:product-judgment` | `discovery.md` chosen direction |
+| DISC-05 | `oat-project-discover` | Mid-stream split choice | Split, continue broad discovery, or keep one project | Use the existing non-interactive behavior: record a high/soft split recommendation and stop; below threshold continues | `auto-resolve` / `boundary:product-judgment` | Detected Split Recommendation |
+| DISC-06 | `oat-project-discover` | Convergence split confirmation | Proceed as one project or split | Use the existing non-interactive behavior: below proceeds; high/soft records and stops | `auto-resolve` / `boundary:product-judgment` | Final split evaluation |
+| DISC-07 | `oat-project-discover` | Discovery HiLL approval | Approve artifact or wait | Run autonomous review/receive; approve only after passing review and no unresolved Critical finding | `auto-resolve` / `boundary:unresolved-critical-findings` | Review artifact, dispatch record, HiLL bookkeeping |
+| DISC-08 | `oat-project-discover` | Configured exit gate | `block`, `prompt`, or `warn` after failure | Apply configured failure semantics; `prompt` becomes a reported boundary | `auto-resolve` / `boundary:repository-policy-approval` | Structured gate result and disposition |
+| DES-01 | `oat-project-design` | Missing active project | Ask for project name | Use only an explicitly supplied or valid active project; otherwise stop | `boundary:product-judgment` | Resolved project path |
+| DES-02 | `oat-project-design` | Incomplete existing spec | Finish it or delete/regenerate | Never delete or overwrite it autonomously; stop for direction | `boundary:destructive-change-risk` | Incomplete-spec diagnostic |
+| DES-03 | `oat-project-design` | Design interaction mode | Choose collaborative, selective, or draft | `OAT_NON_INTERACTIVE=1` forces the existing draft-and-review path | `auto-resolve` | Design mode banner |
+| DES-04 | `oat-project-design` | Requirements completeness | Revise until the user confirms | Reconcile against discovery/evidence and self-confirm only when complete; material ambiguity stops | `auto-resolve` / `boundary:product-judgment` | `spec.md` and review evidence |
+| DES-05 | `oat-project-design` | Approach reaffirmation | Confirm or revisit the approach | Preserve a supported discovery choice; otherwise choose the evidence-backed recommendation and record rationale | `auto-resolve` / `boundary:product-judgment` | Design Overview and alternatives |
+| DES-06 | `oat-project-design` | Selective plan and section approvals | Approve/revise review plan and sections | Unreachable in forced draft mode; do not simulate live approvals | `auto-resolve` | Design mode and review record |
+| DES-07 | `oat-project-design` | Design/spec HiLL approval | Approve, revise, or wait | Run autonomous review/receive and approve only after passing; unresolved Critical findings stop | `auto-resolve` / `boundary:unresolved-critical-findings` | Review artifact, dispatch record, HiLL bookkeeping |
+| DES-08 | `oat-project-design` | Configured exit gate | `block`, `prompt`, or `warn` after failure | Apply configured failure semantics; unresolved Critical findings are always a boundary and `prompt` cannot silently continue | `auto-resolve` / `boundary:unresolved-critical-findings` | Structured gate result and disposition |
+| PLAN-01 | `oat-project-plan` | Missing design detail | Ask whether to update design | Stop and return to design; do not invent a design decision | `boundary:product-judgment` | Planning blocker |
+| PLAN-02 | `oat-project-plan` | Missing active project | Ask for project name | Use only an explicitly supplied or valid active project; otherwise stop | `boundary:product-judgment` | Resolved project path |
+| PLAN-03 | `oat-project-plan` | Incomplete design | Ask user to finish design | Stop and route to design | `boundary:product-judgment` | Design-readiness diagnostic |
+| PLAN-04 | `oat-project-plan` | Existing draft plan | Resume, view, or overwrite | Resume in place; never overwrite autonomously | `auto-resolve` | Plan continuation note |
+| PLAN-05 | `oat-project-plan` | Dispatch-ladder ownership | Choose persistence scope | Do not choose a persistence scope; incomplete ladder blocks readiness | `boundary:repository-policy-approval` | Resolver diagnostic |
+| PLAN-06 | `oat-project-plan` | Project dispatch policy | Choose a runnable policy | Preserve explicit/configured policy; unresolved non-interactive state blocks | `boundary:repository-policy-approval` | `state.md` policy or resolver diagnostic |
+| PLAN-07 | `oat-project-plan` | Plan breakdown confirmation | Confirm tasks or request changes | Complete the independent plan artifact-review loop, apply unambiguous fixes, and confirm only a clean executable plan | `auto-resolve` / `boundary:unresolved-critical-findings` | Plan review row |
+| PLAN-08 | `oat-project-plan` | Optional phase-gate setup | Choose all, selected, or disabled | Use the shared non-interactive contract: preserve explicit state or leave disabled | `auto-resolve` | Phase-gate setup status |
+| PLAN-09 | `oat-project-plan` | Plan artifact-review findings | Accept offered Medium/Minor fixes | Apply unambiguous artifact-local fixes and re-review; unresolved Critical or material ambiguity stops | `auto-resolve` / `boundary:unresolved-critical-findings` | Plan review row and residuals |
+| PLAN-10 | `oat-project-plan` | Parallel-group proposal | Confirm a candidate group | Accept only when write-set and dependency evidence proves independence; otherwise keep sequential and record why | `auto-resolve` | Plan Parallelism section |
+| PLAN-11 | `oat-project-plan` | Configured exit gate | `block`, `prompt`, or `warn` after failure | Apply configured failure semantics; `prompt` becomes a reported boundary | `auto-resolve` / `boundary:repository-policy-approval` | Structured gate result and disposition |
+| IMPORT-01 | `oat-project-import-plan` | Inherited dirty tree | Commit, proceed, or abort | Proceed without staging unrelated files; destructive cleanup stops | `auto-resolve` / `boundary:destructive-change-risk` | Import preflight note |
+| IMPORT-02 | `oat-project-import-plan` | Missing project | Ask for project identity | Use explicit invocation context; otherwise stop rather than guess | `boundary:product-judgment` | Resolved project path |
+| IMPORT-03 | `oat-project-import-plan` | Source plan selection or extension exception | Choose a candidate/path or confirm nonstandard Markdown | Use an explicit unique source; ambiguity or nonstandard content stops | `auto-resolve` / `boundary:product-judgment` | Import reference metadata |
+| IMPORT-04 | `oat-project-import-plan` | Existing source snapshot | Confirm overwrite | Never overwrite; create the documented timestamped copy | `auto-resolve` | Imported reference path |
+| IMPORT-05 | `oat-project-import-plan` | Dispatch-ladder ownership | Choose persistence scope | Do not choose a persistence scope; incomplete ladder blocks readiness | `boundary:repository-policy-approval` | Resolver diagnostic |
+| IMPORT-06 | `oat-project-import-plan` | Project dispatch policy | Choose a runnable policy | Preserve explicit/configured policy; unresolved non-interactive state blocks | `boundary:repository-policy-approval` | `state.md` policy or resolver diagnostic |
+| IMPORT-07 | `oat-project-import-plan` | Optional phase-gate setup | Choose all, selected, or disabled | Preserve explicit imported state; otherwise use the shared non-interactive disabled behavior | `auto-resolve` | Phase-gate setup status |
+| IMPORT-08 | `oat-project-import-plan` | Import-aware artifact-review findings | Accept offered Medium/Minor fixes | Apply only unambiguous canonicalization fixes; never rewrite source intent; unresolved Critical or ambiguity stops | `auto-resolve` / `boundary:unresolved-critical-findings` | Plan review row and import disposition |
+| IMPORT-09 | `oat-project-import-plan` | Configured exit gate | `block`, `prompt`, or `warn` after failure | Apply configured failure semantics; `prompt` becomes a reported boundary | `auto-resolve` / `boundary:repository-policy-approval` | Structured gate result and disposition |
+| IMPLEMENT-01 | `oat-project-implement` | Missing active project | Ask for project name | Use only an explicitly supplied or valid active project; otherwise stop | `boundary:product-judgment` | Resolved project path |
+| IMPLEMENT-02 | `oat-project-implement` | Prior-run worktrees | Resume or clean up | Resume and reconcile non-destructively; cleanup that could discard work stops | `auto-resolve` / `boundary:destructive-change-risk` | Orchestration run reconciliation |
+| IMPLEMENT-03 | `oat-project-implement` | Unconfirmed HiLL phases | Choose every, selected, or final | When absent on an autonomous first run, take `hillCheckpointDefault: final`: write the explicit final phase array and enable auto-review; preserve valid `[]` and explicit arrays | `auto-resolve` | `plan.md` frontmatter and implementation log |
+| IMPLEMENT-04 | `oat-project-implement` | Auto-review preference | Enable or disable checkpoint review | Set `oat_auto_review_at_hill_checkpoints: true` for the autonomous default path | `auto-resolve` | `plan.md` frontmatter |
+| IMPLEMENT-05 | `oat-project-implement` | Malformed phase-review setting | Ask user to repair | Stop before task execution | `boundary:repository-policy-approval` | Validation diagnostic |
+| IMPLEMENT-06 | `oat-project-implement` | Stale bookkeeping reconciliation | Approve generated repair | Repair only when plan, log, and git evidence agree; conflicting evidence stops | `auto-resolve` / `boundary:product-judgment` | Bookkeeping repair commit |
+| IMPLEMENT-07 | `oat-project-implement` | Existing tracker overwrite | Require explicit confirmation | Never overwrite in autonomy; resume or stop on corruption | `boundary:destructive-change-risk` | Tracker diagnostic |
+| IMPLEMENT-08 | `oat-project-implement` | Subagent delegation authorization | Authorize implementer and reviewer for this run | Approve once for the bounded run and both declared roles; do not widen file or command authority | `auto-resolve` | Dispatch authorization scope |
+| IMPLEMENT-09 | `oat-project-implement` | Unresolved dispatch policy | Choose a runnable policy | Preserve configured/project policy; unresolved non-interactive preflight stops | `boundary:repository-policy-approval` | Resolver report |
+| IMPLEMENT-10 | `oat-project-implement` | Non-final checkpoint pause | Wait after review | Run auto-review, auto-receive, record provenance, and continue after a passing disposition | `auto-resolve` / `boundary:unresolved-critical-findings` | Review artifact, receive commit, dispatch record |
+| IMPLEMENT-11 | `oat-project-implement` | Final-review execution route | Choose subagent, fresh session, or guarded inline | Select the highest policy-compliant target-preserving route and launch without prompting | `auto-resolve` | Final-review dispatch record |
+| IMPLEMENT-12 | `oat-project-implement` | Failed or unavailable final review | Retry/fix or wait for user | Apply bounded fix/re-review cycles; a failed blocking review or no adequate route stops | `boundary:unresolved-critical-findings` / `boundary:missing-credentials` | Review rows and blocker report |
+| IMPLEMENT-13 | `oat-project-implement` | Post-implement sequence unset | Choose summary/docs/PR or exit | Snapshot the autonomous default `{preApproval: [summary, document, pr], postApproval: []}`; do not prompt | `auto-resolve` | `oat_post_implement_sequence` with source `autonomous-default` |
+| IMPLEMENT-14 | `oat-project-implement` | Legacy post-implement sequence | Execute `wait`, `summary`, `pr`, or `docs-pr` | Normalize through the documented legacy mapping and preserve the resulting arrays; do not reinterpret an explicit value | `auto-resolve` | Immutable sequence snapshot |
+| IMPLEMENT-15 | `oat-project-implement` | Structured pre/post sequence | Execute ordered pre- and post-approval steps | Preserve exact array order and resume from the first incomplete step | `auto-resolve` | Immutable sequence snapshot and per-step commits |
+| IMPLEMENT-16 | `oat-project-implement` | Final HiLL approval | Approve, decline, or defer between pre/post steps | After passing auto-review and successful pre-approval steps, record approval and continue post-approval steps; otherwise stop | `auto-resolve` / `boundary:unresolved-critical-findings` | Sequence snapshot, review artifact, dispatch record |
+| IMPLEMENT-17 | `oat-project-implement` | Next-step prompt | Choose lifecycle tail actions | Unreachable when the autonomous sequence snapshot exists; never present the prompt | `auto-resolve` | Completed sequence snapshot |
+| IMPLEMENT-18 | `oat-project-implement` | Configured exit gate | `block`, `prompt`, or `warn` after failure | Apply configured failure semantics; `prompt` becomes a reported boundary | `auto-resolve` / `boundary:repository-policy-approval` | Structured gate result and disposition |
+| DOCUMENT-01 | `oat-project-document` | Missing project path | Ask for a path | Use explicit/active project only; otherwise stop | `boundary:product-judgment` | Resolved project path |
+| DOCUMENT-02 | `oat-project-document` | Documentation delta approval | Apply all, individual, or skip | Invoke the existing `--auto` path and apply all non-destructive recommendations | `auto-resolve` | Documentation delta and state update |
+| DOCUMENT-03 | `oat-project-document` | Delete or restructure docs | Require explicit approval | Stop before destructive or broad restructuring not already authorized by the plan | `boundary:destructive-change-risk` | Documentation blocker |
+| SUMMARY-01 | `oat-project-summary` | Missing active project | Ask for project name | Use explicit/active project only; otherwise stop | `boundary:product-judgment` | Resolved project path |
+| PRFINAL-01 | `oat-project-pr-final` | Missing active project | Ask for project name | Use explicit/active project only; otherwise stop | `boundary:product-judgment` | Resolved project path |
+| PRFINAL-02 | `oat-project-pr-final` | Missing title/base | Ask for title and resolve base | Use the documented ticket/conventional-title and base-branch resolution chains | `auto-resolve` | PR artifact frontmatter and command |
+| PRFINAL-03 | `oat-project-pr-final` | Final review not passed | Ask whether to proceed anyway | Never proceed in autonomy; stop and route to final review/re-review | `boundary:unresolved-critical-findings` | Final review row and blocker report |
+| PRFINAL-04 | `oat-project-pr-final` | Push/PR policy or credentials | Ask operator to authorize or authenticate | Stop when repository policy or missing credentials prevent push/PR creation | `boundary:repository-policy-approval` / `boundary:missing-credentials` | PR state and redacted command error |
+| COMPLETE-01 | `oat-project-complete` | Batched completion/archive/summary/PR choices | Confirm completion and choose optional actions | Confirm only after gates pass; honor explicit config, refresh missing/stale summary, avoid duplicate PR, and archive only when configured | `auto-resolve` | Completion state and summary |
+| COMPLETE-02 | `oat-project-complete` | Required documentation missing | Run document or explicitly skip | Run autonomous documentation; do not silently skip a required gate | `auto-resolve` / `boundary:repository-policy-approval` | Documentation state |
+| COMPLETE-03 | `oat-project-complete` | Unsatisfied completion gates | Continue anyway | Never continue silently; unresolved final review is a review boundary and other hard policies remain boundaries | `boundary:unresolved-critical-findings` / `boundary:repository-policy-approval` | Combined gate report |
+| COMPLETE-04 | `oat-project-complete` | Archive/PR external access | Ask for access or manual action | Stop when required credentials or repository policy prevent the selected action | `boundary:missing-credentials` / `boundary:repository-policy-approval` | Completion blocker |
+| REVIEWPROVIDE-01 | `oat-project-review-provide` | Resolved target confirmation | Confirm project/review target | Autonomous callers pass an exact project, type, and scope; continue without prompting | `auto-resolve` | Review Scope metadata |
+| REVIEWPROVIDE-02 | `oat-project-review-provide` | Missing type or scope | Infer then ask for confirmation | Use caller-provided scope or deterministic project-state inference; ambiguity stops | `auto-resolve` / `boundary:product-judgment` | Review Scope metadata |
+| REVIEWPROVIDE-03 | `oat-project-review-provide` | Detached branch | Ask which branch to review | Resolve only from authoritative worktree metadata; otherwise stop | `boundary:repository-policy-approval` | Branch-resolution diagnostic |
+| REVIEWPROVIDE-04 | `oat-project-review-provide` | Different branch without worktree | Switch, inline-only, or cancel | Do not switch branches or discard context autonomously; stop for a correct checkout/worktree | `boundary:repository-policy-approval` | Branch/worktree diagnostic |
+| REVIEWPROVIDE-05 | `oat-project-review-provide` | Re-review narrowing | Narrow to fixes or review full scope | Use configured preference; when unset, narrow to completed fix commits | `auto-resolve` | Review Scope metadata |
+| REVIEWPROVIDE-06 | `oat-project-review-provide` | Commit-range fallback | Supply a range or accept merge-base | Use a verified merge-base-to-HEAD range when it covers the declared scope; otherwise stop | `auto-resolve` / `boundary:product-judgment` | Review Scope metadata |
+| REVIEWPROVIDE-07 | `oat-project-review-provide` | Reviewer delegation authorization | Authorize `oat-reviewer` | Approve once for the exact bounded review scope | `auto-resolve` | Dispatch authorization and record |
+| REVIEWPROVIDE-08 | `oat-project-review-provide` | Fresh-session or inline fallback | Choose execution route | Use the pre-launch-selected target-preserving route; a blocking review with no adequate route stops | `auto-resolve` / `boundary:missing-credentials` | Dispatch record |
+| REVIEWPROVIDE-09 | `oat-project-review-provide` | Defer review bookkeeping commit | Confirm proceeding uncommitted | Never defer; commit the bounded review files or stop on commit failure | `auto-resolve` / `boundary:repository-policy-approval` | Bookkeeping commit |
+| REVIEWRECEIVE-01 | `oat-project-review-receive` | Artifact edit approval | Confirm proposed artifact edits | Apply unambiguous in-scope edits and re-review; `needs_user_direction` stops | `auto-resolve` / `boundary:product-judgment` | Finding disposition map |
+| REVIEWRECEIVE-02 | `oat-project-review-receive` | Review-cycle limit | Choose manual review, proceed, or override | Stop at the configured cycle limit; never self-authorize an override or proceed to PR | `boundary:repository-policy-approval` | Cycle-count blocker |
+| REVIEWRECEIVE-03 | `oat-project-review-receive` | Final deferred Medium findings | Convert or accept deferral | Convert valid findings to fix tasks; preserve only an already explicit, evidence-backed deferral; ambiguity stops | `auto-resolve` / `boundary:product-judgment` | Deferred Medium ledger |
+| REVIEWRECEIVE-04 | `oat-project-review-receive` | New Medium deferral request | Approve deferral per finding | Default to conversion; do not create a new autonomous deferral for material work | `auto-resolve` | Finding disposition map |
+| REVIEWRECEIVE-05 | `oat-project-review-receive` | Final Minor disposition | Defer selected/all or convert all | Convert in-scope Minors by default; reject only with concrete evidence | `auto-resolve` | Finding disposition map |
+| REVIEWRECEIVE-06 | `oat-project-review-receive` | Code-review next action | Execute fixes, inspect plan, or exit | Execute added fix tasks through implement, then re-review | `auto-resolve` | State pointer and receive summary |
+| REVIEWRECEIVE-07 | `oat-project-review-receive` | Artifact-review next action | Resolve direction, re-review, or continue | Re-review applied edits; continue only after passing; user-direction findings stop | `auto-resolve` / `boundary:product-judgment` | Artifact disposition and review row |
+| REVIEWRECEIVE-08 | `oat-project-review-receive` | Defer receive bookkeeping commit | Confirm proceeding uncommitted | Never defer; commit bounded bookkeeping or stop on commit failure | `auto-resolve` / `boundary:repository-policy-approval` | Bookkeeping commit |
+| REVIEWRECEIVE-09 | `oat-project-review-receive` | Unresolved Critical finding | Fix, reject, or seek direction | Convert valid findings and re-review; never pass while a Critical remains unresolved | `boundary:unresolved-critical-findings` | Review row and finding disposition |
+| DISPATCH-01 | `oat-dispatch-subagents` | Launch-surface authorization | Ask once for a user approval or scope grant | Approve once for the current run's exact bounded request and authority; re-probe and record the scope | `auto-resolve` | Generic dispatch record |
+| DISPATCH-02 | `oat-dispatch-subagents` | Agent-improvised alternate route | Approve named target and scope | Do not convert autonomy into standing route policy; use a policy-resolved/native route or stop | `boundary:repository-policy-approval` | Blocking dispatch record |
+| PDISPATCH-01 | `oat-project-dispatch-subagents` | Per-task route reauthorization | Reauthorize a configured route | No prompt: configured project policy is already standing, scope-bound authorization | `auto-resolve` | `selection_source: policy-resolved` |
+
+## Gate-inventory maintenance
+
+Any change under one of the inventory's skill roots that adds, removes, or
+rewrites a line matched by the broadened prompt scan must update the HEAD
+prompt-site coverage table in the same commit. Map each reachable gate to its
+inventory ID; map only metadata, output text, prompt payloads, no-prompt
+assertions, vendored copies, and other unreachable occurrences to `NG`. Add a
+new inventory row when no existing gate ID describes the behavior.
+
+`packages/cli/src/validation/autonomy-gate-inventory.test.ts` is the CI
+backstop. It derives the fifteen scan roots from the inventory, scans Markdown
+recursively, and matches each site by file plus a stable semantic key derived
+from its normalized heading and text, never by line number. Its failure output
+provides the key to add or replace. The committed line-number comparison below
+remains immutable baseline evidence for the original p01-t01 verification.
+
+## HEAD prompt-site coverage
+
+| Skill root / file | Stable prompt-site mappings |
+| --- | --- |
+| `oat-project-new/SKILL.md` | `f7ca8635452f -> NG`; `b137f73db20c -> NEW-01`; `45b699c1c0b5 -> NEW-01`; `ba6d120791c1 -> NEW-01`; `33ce6a6c30aa -> NEW-02`; `0f5a90f34f63 -> NG`; `d0ea3a91261d -> NG` |
+| `oat-project-quick-start/SKILL.md` | `f7ca8635452f -> NG`; `c493a38b89f2 -> QS-04`; `655d61df0a8f -> NG`; `b137f73db20c -> QS-01`; `45b699c1c0b5 -> QS-01`; `ba6d120791c1 -> QS-01`; `1a5ee85164ff -> QS-02`; `af8e2bea90d7 -> QS-04`; `a823cf5aeaec -> QS-04`; `7753dc323083 -> QS-04`; `1f557da5e03c -> QS-04`; `0960c3eb1564 -> NG`; `c24787334ade -> QS-05`; `021ba03c82c5 -> QS-05`; `5d1a9d1b661d -> QS-05`; `318f304ee3b3 -> QS-05`; `cc700d4d2cab -> QS-05`; `7ef6aa642400 -> QS-05`; `4d389b234556 -> QS-05`; `84c506dac106 -> QS-05`; `caf7622a2e02 -> QS-05`; `8917190b2e98 -> QS-06`; `5a028d846aa5 -> QS-06`; `b1d92192b8ca -> QS-06`; `bdbb18955cc4 -> QS-06`; `6d159a2e8f8e -> QS-06`; `61a9849f4dfc -> QS-06`; `31cb92052ea6 -> QS-06`; `39e3fe23dd85 -> QS-07`; `2cb069a2590b -> NG`; `fd0aff270853 -> NG`; `a114b27f8b4b -> NG`; `77dc8e1b728a -> QS-08`; `d3e3fba65b96 -> QS-09`; `71c2a0ba99bf -> QS-09`; `f47f9f9c0d03 -> QS-09`; `224a4b43fb29 -> QS-10`; `744f130d4116 -> QS-12`; `bee4c4aa34c6 -> NG`; `3f0b53056edd -> QS-12`; `857e91aa3095 -> NG` |
+| `oat-project-quick-start/references/docs/autonomy-contract.md` | `* -> NG` |
+| `oat-project-discover/SKILL.md` | `8fe35bbfbcd6 -> NG`; `6acc57686847 -> NG`; `4df56b83b98e -> NG`; `660fcdb9dd0d -> NG`; `655d61df0a8f -> NG`; `302f5a4e2f7e -> DISC-03`; `8ee1861bb37c -> DISC-03`; `5c8d5f04f6e2 -> DISC-05`; `73964bb042ab -> DISC-05`; `82cc79370b80 -> DISC-05`; `ff09e8f7774f -> DISC-06`; `323e71dca05d -> DISC-06`; `012bab5b478e -> DISC-06`; `523764981692 -> DISC-06`; `7eaa40e078b9 -> DISC-07`; `b57408be1e7b -> DISC-07`; `4683ea4a7d2f -> DISC-07`; `1195a16a0bc5 -> NG`; `d20eb00f1887 -> DISC-08`; `3f0b53056edd -> DISC-08`; `b92484ef7ca4 -> DISC-08`; `3cf10a406501 -> DISC-08` |
+| `oat-project-design/SKILL.md` | `d942bb5a75dc -> NG`; `5eb3949f32e1 -> NG`; `8bdedbff2084 -> NG`; `655d61df0a8f -> NG`; `cf317c17c586 -> DES-01`; `2fd9e4306093 -> NG`; `30aaa490f54f -> NG`; `5d39260a7350 -> DES-03`; `925238b3a9b8 -> DES-03`; `f44832c14f8f -> DES-03`; `7f6ed9174a80 -> DES-03`; `ea8a45cff484 -> DES-03`; `ae06e7f3590d -> DES-03`; `ad9715bfa9b5 -> DES-03`; `235f4eba81d9 -> DES-03`; `86d15c022ff2 -> DES-03`; `c08ee2c84186 -> DES-03`; `bd3ee332d171 -> DES-03`; `ec88b585a24d -> DES-03`; `a9595a6486f1 -> DES-04`; `accb06cd6f3c -> DES-04`; `806001c2c365 -> DES-04`; `696587b33f1e -> DES-04`; `8678cdb975d0 -> NG`; `8ad2a4dc63d2 -> DES-05`; `33cc7540d89e -> DES-05`; `51a2b698ba14 -> DES-05`; `81085592cc91 -> DES-05`; `74b952cc1121 -> DES-05`; `da7551391a41 -> DES-05`; `02c93ec05a4a -> DES-06`; `6864967fd8a4 -> DES-06`; `84e9be719156 -> DES-06`; `7ed89c44264b -> DES-06`; `dc7ba56c1cd4 -> DES-06`; `57ccefb935bf -> DES-06`; `9d27238332b2 -> NG`; `a0c758ab26aa -> NG`; `0e17c1a2de0b -> DES-07`; `e9ea8625567c -> DES-07`; `908e710e7304 -> DES-07`; `38a0adf2dcd6 -> DES-07`; `16c2036990df -> DES-07`; `b23bbe0c4282 -> DES-07`; `71972778f6b8 -> DES-07`; `7f88caab1f38 -> DES-07`; `7eb6f3a2d666 -> DES-07`; `e7a364820674 -> DES-07`; `241de26a0b0b -> DES-07`; `9d7a898331a3 -> DES-07`; `686152516d78 -> DES-07`; `8ca3cff907f3 -> DES-07`; `13e6349960fb -> DES-07`; `fd3d71fade25 -> DES-07`; `8daa828dfad0 -> NG`; `d20eb00f1887 -> DES-08`; `3f0b53056edd -> DES-08`; `b92484ef7ca4 -> DES-08`; `3cf10a406501 -> DES-08`; `033fb711de49 -> NG` |
+| `oat-project-design/references/selective-review-pass.md` | `d4956192b82e -> DES-06`; `7d6e1f926ecb -> DES-06`; `04f918a5fcac -> DES-07` |
+| `oat-project-plan/SKILL.md` | `5eb3949f32e1 -> NG`; `64a08153bb9e -> NG`; `655d61df0a8f -> NG`; `56b37486f09d -> PLAN-01`; `cf317c17c586 -> PLAN-02`; `781643b0f2c3 -> NG`; `01fd7cca8253 -> PLAN-04`; `7bc7fa3f2cbb -> NG`; `da28ce0a5f2e -> NG`; `e334f94c4d35 -> NG`; `1fa55762c038 -> NG`; `c0935b5484a2 -> NG`; `6008163054f8 -> PLAN-05`; `571271f4d71b -> PLAN-06`; `746b760289e4 -> PLAN-06`; `de195590ff83 -> NG`; `49640510829a -> PLAN-07`; `4bef7afa7a71 -> PLAN-08`; `e5886632533e -> PLAN-08`; `4cfe1df14372 -> NG`; `71d18f57db67 -> PLAN-10`; `9b6ef603b0b9 -> PLAN-10`; `bee4c4aa34c6 -> NG`; `3f0b53056edd -> PLAN-11`; `1734b2c85c5d -> NG` |
+| `oat-project-import-plan/SKILL.md` | `f7ca8635452f -> NG`; `c2e5fa410069 -> NG`; `655d61df0a8f -> NG`; `b137f73db20c -> IMPORT-01`; `45b699c1c0b5 -> IMPORT-01`; `ba6d120791c1 -> IMPORT-01`; `070ebc5259af -> IMPORT-03`; `c11552696e2e -> IMPORT-03`; `cfe661966baf -> IMPORT-04`; `baa91c0a0bf8 -> NG`; `e364e84b2702 -> NG`; `39031985a945 -> IMPORT-06`; `f106aa29a217 -> IMPORT-07`; `65038450aee3 -> IMPORT-07`; `bee4c4aa34c6 -> NG`; `3f0b53056edd -> IMPORT-09` |
+| `oat-project-implement/SKILL.md` | `c6732295bc8c -> NG`; `ffb3af0ba8ef -> NG`; `e0355c7a05e9 -> IMPLEMENT-11+IMPLEMENT-13+IMPLEMENT-16`; `6296f41ae11c -> NG`; `a167d03559fa -> NG`; `cf317c17c586 -> IMPLEMENT-01`; `8ce8a09feca4 -> NG` |
+| `oat-project-implement/references/completion-and-closeout.md` | `105600fbd045 -> IMPLEMENT-11`; `3e6055aede6c -> IMPLEMENT-11`; `0705f7533039 -> IMPLEMENT-11`; `0c39746f3cb5 -> IMPLEMENT-11`; `14d89fe39c8c -> IMPLEMENT-11`; `378a75543a72 -> IMPLEMENT-11`; `c7b25627e674 -> IMPLEMENT-11`; `51ef9a453323 -> IMPLEMENT-11`; `c67145e3fb00 -> IMPLEMENT-11`; `64fbeac64811 -> IMPLEMENT-11`; `19b13c17bddb -> NG`; `f7dab9c1f96c -> IMPLEMENT-12`; `c69c17a069a8 -> IMPLEMENT-14`; `a97fa5634a68 -> IMPLEMENT-14`; `3af58881811c -> IMPLEMENT-14`; `4203e1f49d0f -> IMPLEMENT-14`; `c3bd2458a3d3 -> IMPLEMENT-13`; `95b5eafc070d -> IMPLEMENT-13`; `25ecbe9c998b -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `f6f24fd71da4 -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `f18283bc1cf9 -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `2c1ffc4a82dd -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `3454a07aa843 -> IMPLEMENT-16`; `0d86e2098cfb -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `d5fe597d266f -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `55a152e944c1 -> IMPLEMENT-16`; `effac7cbd573 -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `9d2a34d8b148 -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `d27462aaed26 -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `9d52ecb17268 -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `5b91aabe3757 -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `fd0ad919f702 -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `63bf28df1474 -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `a4ed471dbc78 -> IMPLEMENT-16`; `6b7a64cec6e5 -> IMPLEMENT-16`; `0a4fdba0ebc0 -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `a5033c2aada5 -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `e77609eddba0 -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `351156e8dde4 -> IMPLEMENT-13+IMPLEMENT-14+IMPLEMENT-15+IMPLEMENT-16`; `51d45bd2bbd1 -> IMPLEMENT-16`; `f7796ffcc804 -> IMPLEMENT-16`; `990d730cb494 -> IMPLEMENT-16`; `6ed28bb7d384 -> IMPLEMENT-16`; `8b7d4b5bcf1b -> IMPLEMENT-16`; `88aad500e6e9 -> IMPLEMENT-16`; `877e3e3f9eda -> IMPLEMENT-16`; `fc03c97f834e -> IMPLEMENT-16`; `12939a3da5e0 -> IMPLEMENT-16`; `bdb418335a88 -> IMPLEMENT-16`; `fba97e596ebd -> IMPLEMENT-16`; `3d0b5e2f14f0 -> IMPLEMENT-17`; `f56a9ce88461 -> IMPLEMENT-17`; `9ba67b50d0ba -> IMPLEMENT-17`; `39ff911760af -> IMPLEMENT-17`; `5b560b5bd6e3 -> IMPLEMENT-17`; `fa21df5e5e01 -> IMPLEMENT-17`; `0fed77bec55e -> IMPLEMENT-17`; `6d81cfb0483f -> IMPLEMENT-17`; `bee4c4aa34c6 -> NG`; `3f0b53056edd -> IMPLEMENT-18` |
+| `oat-project-implement/references/dispatch-and-dry-run.md` | `21b85f5e4daa -> IMPLEMENT-08`; `74c92b32bb2a -> IMPLEMENT-08`; `8efd2d0517ab -> IMPLEMENT-09`; `461ed9b3e495 -> IMPLEMENT-09`; `b5ad64fd744d -> NG`; `14ce436cfffa -> NG`; `043ca36da3e2 -> NG`; `a23e45c1dc8d -> NG`; `498143bb41a7 -> NG`; `4fe3eb179023 -> NG`; `7f75485e5a33 -> NG`; `8ec3a96df029 -> NG`; `16c3f96e758d -> NG`; `5915c41fe058 -> NG`; `f51e43eeac56 -> NG`; `fd41c25623cb -> NG`; `58a932ed6453 -> NG`; `4718bd3ce12d -> NG`; `58c444a2126b -> NG` |
+| `oat-project-implement/references/docs/autonomy-contract.md` | `* -> NG` |
+| `oat-project-implement/references/phase-execution.md` | `27737e814790 -> NG`; `6dda2b8e62e2 -> IMPLEMENT-10`; `b3197086bb1e -> IMPLEMENT-10` |
+| `oat-project-implement/references/plan-and-resume.md` | `413829d31e32 -> IMPLEMENT-02`; `c7706cd8ad09 -> IMPLEMENT-03`; `a80a948df658 -> IMPLEMENT-03`; `b7ea139780ec -> IMPLEMENT-03+IMPLEMENT-04`; `8d438f2180ba -> IMPLEMENT-03`; `9e72e0518cda -> IMPLEMENT-03`; `3e177a1021e6 -> IMPLEMENT-03+IMPLEMENT-04`; `b59fc9eb9ce3 -> IMPLEMENT-03`; `a2b1d6855283 -> IMPLEMENT-03`; `44351a32e52a -> IMPLEMENT-03`; `b98b022f5523 -> IMPLEMENT-03`; `e9f5b949e214 -> IMPLEMENT-03`; `316fb6d9e980 -> IMPLEMENT-03`; `8b25a2c5c548 -> IMPLEMENT-03`; `1a59b1c0e705 -> IMPLEMENT-03`; `466cd562fc52 -> IMPLEMENT-03`; `083d896978d5 -> IMPLEMENT-03`; `f4ab11c13ae9 -> IMPLEMENT-03`; `7dc17ffcc1c4 -> IMPLEMENT-03`; `f731a90adabd -> IMPLEMENT-04`; `886ac01e7aa9 -> IMPLEMENT-04`; `b715db67df0c -> IMPLEMENT-04`; `2d9f26a539f3 -> IMPLEMENT-10`; `28384dee114f -> IMPLEMENT-05`; `f2591a4978b4 -> NG`; `8290823080b5 -> IMPLEMENT-06`; `f75789bf6c8e -> IMPLEMENT-07` |
+| `oat-project-document/SKILL.md` | `4fc2d8618208 -> NG`; `173a1c48e53c -> NG`; `40f8be47affa -> NG`; `3a3c390528f3 -> DOCUMENT-03`; `2a7ba093b315 -> DOCUMENT-02`; `252aabe44db2 -> DOCUMENT-02`; `3751172de299 -> DOCUMENT-02`; `b987a0697ba9 -> DOCUMENT-01`; `a06ff3ca7926 -> NG`; `0d04714ca9fc -> NG`; `f79af01d94c6 -> DOCUMENT-02`; `71634113c348 -> DOCUMENT-02`; `cdb707f5081e -> NG` |
+| `oat-project-document/references/docs/autonomy-contract.md` | `* -> NG` |
+| `oat-project-summary/SKILL.md` | `68c197c44c18 -> NG`; `c9b36a381b8e -> NG`; `a167d03559fa -> NG`; `cf317c17c586 -> SUMMARY-01`; `24f1f127f580 -> NG`; `626e6d6f4455 -> NG`; `f58150418ef5 -> NG`; `349f0a976a3a -> NG`; `c26231b8bb48 -> NG`; `ab1d4a57bebb -> NG`; `696bb6045b6a -> NG` |
+| `oat-project-pr-final/SKILL.md` | `601ac2b890f2 -> NG`; `5eb3949f32e1 -> NG`; `9efcbcee42ea -> NG`; `655d61df0a8f -> NG`; `cf317c17c586 -> PRFINAL-01`; `2de348a391c0 -> PRFINAL-03` |
+| `oat-project-pr-final/references/docs/autonomy-contract.md` | `* -> NG` |
+| `oat-project-complete/SKILL.md` | `6ed459f9e462 -> NG`; `a167d03559fa -> NG`; `79c2eeed668c -> COMPLETE-01`; `2c1514b9d9af -> COMPLETE-01`; `31c750b4fea7 -> COMPLETE-01`; `cfba413b1293 -> COMPLETE-01`; `ffcdc9d576c0 -> COMPLETE-01`; `7fcfce0423ac -> COMPLETE-01`; `9497d9f94eed -> COMPLETE-01`; `7b59c728d3fb -> COMPLETE-01`; `48e10a9636fe -> COMPLETE-01`; `c0dad37fc166 -> COMPLETE-01`; `aa9a36243ec1 -> COMPLETE-01`; `7bcbf58b54e9 -> NG`; `4c7f88a7f942 -> COMPLETE-02`; `6a1a95acc8cc -> COMPLETE-02`; `3b559956b3eb -> COMPLETE-03`; `14d161cdf99b -> COMPLETE-03`; `12f7c30a54c8 -> NG`; `fffe5eea5ebd -> NG` |
+| `oat-project-review-provide/SKILL.md` | `1f4b981cac8b -> NG`; `adaeca152bb2 -> NG`; `2f7c201c3c06 -> NG`; `88f79700afdc -> NG`; `655d61df0a8f -> NG`; `efafde9ef5a0 -> NG`; `d2a3861d6323 -> REVIEWPROVIDE-02`; `65f5b9cf49cd -> REVIEWPROVIDE-04`; `962cb38d246a -> REVIEWPROVIDE-04`; `1a568483ba0b -> REVIEWPROVIDE-04`; `610e27edfe85 -> REVIEWPROVIDE-04`; `fab62c510bd0 -> REVIEWPROVIDE-05`; `a9f30853c867 -> REVIEWPROVIDE-05`; `0929c916fc20 -> REVIEWPROVIDE-05`; `f9a37c63afab -> REVIEWPROVIDE-05`; `687bb9368f92 -> REVIEWPROVIDE-05`; `bb0096e95c47 -> REVIEWPROVIDE-06`; `55f6357a987d -> REVIEWPROVIDE-06`; `1bee61f8531c -> REVIEWPROVIDE-07`; `3d35091607a1 -> REVIEWPROVIDE-08`; `fb40c4341c4c -> NG`; `b22d16885150 -> NG`; `d2b25906242e -> REVIEWPROVIDE-08`; `fd8ebf72b3c4 -> NG`; `fcb9de611ff3 -> NG`; `d2a838dfb18d -> NG`; `c3d50ea7cf69 -> NG`; `09b1b8dd445c -> NG`; `7acc8f3718d2 -> REVIEWPROVIDE-09`; `b2fa883fc4a2 -> NG`; `fe4421531b4c -> NG` |
+| `oat-project-review-receive/SKILL.md` | `9b8a3743d626 -> NG`; `df49c8c6f192 -> NG`; `4ee8730382d3 -> NG`; `655d61df0a8f -> NG`; `765f897d67ac -> NG`; `53b58d16dd32 -> NG`; `fb8755a3bdf4 -> NG`; `c8ab5dd90075 -> NG`; `1f7dd98dff2f -> NG`; `56f78c6740e6 -> NG`; `76f5fb5a88cd -> NG`; `085abfa3599f -> REVIEWRECEIVE-01`; `3ad3aadb8c60 -> NG`; `a7d114059bb6 -> NG`; `ac88cfaa83d9 -> NG`; `3f758313fedb -> REVIEWRECEIVE-08`; `f31f07284718 -> REVIEWRECEIVE-02`; `aba178a21441 -> REVIEWRECEIVE-04`; `a37e601cd731 -> REVIEWRECEIVE-05`; `20e05e1a4381 -> REVIEWRECEIVE-06`; `90001dadf75f -> REVIEWRECEIVE-07`; `f8fd58180ecf -> NG`; `c3abcdc02d9f -> NG` |
+| `oat-dispatch-subagents/SKILL.md` | `cb4f86157fd6 -> DISPATCH-01`; `f165b1626192 -> DISPATCH-01`; `7ed5e2b1eb71 -> PDISPATCH-01`; `11c72bcdebad -> DISPATCH-02`; `0834ee701e12 -> DISPATCH-02`; `7fda54e1d519 -> PDISPATCH-01` |
+| `oat-dispatch-subagents/references/provider-claude.md` | `fbe3a21e9533 -> NG` |
+| `oat-dispatch-subagents/references/provider-codex.md` | `95b0f82018c7 -> NG` |
+| `oat-dispatch-subagents/references/provider-cursor.md` | `ca11e28923eb -> NG`; `be0a84c48fc0 -> NG` |
+| `oat-dispatch-subagents/references/record-schema.md` | `78f8069274a8 -> NG` |
+| `oat-project-dispatch-subagents/SKILL.md` | `eca03ad1ca12 -> PDISPATCH-01`; `59fbcdc79cea -> PDISPATCH-01` |
+
+## Prompt-scan comparison
+
+The verification scan is:
+
+```bash
+rg -n -i "AskUserQuestion|ask (the user|once)|approval|confirm|prompt|choose|wait for" \
+  .agents/skills/<root>/ --glob '*.md'
+```
+
+It was run recursively for each of the fifteen roots below. Every discovered
+site is listed. `NG` means the phrase is metadata, output text, a no-prompt
+assertion, a prompt payload, or another non-interactive occurrence rather than
+a reachable gate. A range such as `38-39` accounts for both matching lines.
+
+**Scan baseline:** `113c8f6f` (`feat(p01-t01): add autonomy contract and gate
+inventory`). The file-and-line mappings below were captured against that commit.
+
+| Skill root / file | `file:line -> inventory row` comparison |
+| --- | --- |
+| `oat-project-new/SKILL.md` | `8 -> NG`; `38-39,43 -> NEW-01`; `58 -> NEW-02`; `74,76 -> NG` |
+| `oat-project-quick-start/SKILL.md` | `9,52 -> NG`; `36,203,211,213,215 -> QS-04`; `88-89,93 -> QS-01`; `109 -> QS-02`; `236 -> NG`; `241,245,249,251,253,282,288 -> QS-05`; `306,315,326-328,331,333 -> QS-06`; `384 -> QS-07`; `393,452,464 -> NG`; `511 -> QS-08`; `532,535,543 -> QS-09`; `573 -> QS-10`; `728 -> NG`; `735 -> QS-12`; `750 -> NG` |
+| `oat-project-discover/SKILL.md` | `4,7,27-28,40 -> NG`; `246,277 -> DISC-03`; `318,320,329 -> DISC-05`; `389,392,394,398 -> DISC-06`; `405,407,423 -> DISC-07`; `476 -> NG` |
+| `oat-project-design/SKILL.md` | `4,7,16,26 -> NG`; `55 -> DES-01`; `67,84 -> NG`; `88,90,97,105,111,118,120-121,125,154,156,160 -> DES-03`; `162,165,248,250 -> DES-04`; `325 -> NG`; `330,339-340,352,355,361 -> DES-05`; `446-447,449,451,488,502 -> DES-06`; `534,547 -> NG`; `560-561,564,587,589,591,596,599,606,608,610,615,619,622,624,652 -> DES-07`; `671,700 -> NG` |
+| `oat-project-design/references/selective-review-pass.md` | `55,111 -> DES-06`; `112 -> DES-07` |
+| `oat-project-plan/SKILL.md` | `8,27,37 -> NG`; `74 -> PLAN-01`; `97 -> PLAN-02`; `170 -> NG`; `179 -> PLAN-04`; `207,326,328,332-334 -> NG`; `348 -> PLAN-05`; `374,403 -> PLAN-06`; `414 -> NG`; `418 -> PLAN-07`; `422,427 -> PLAN-08`; `488 -> NG`; `516,519 -> PLAN-10`; `606 -> NG`; `613 -> PLAN-11`; `625 -> NG` |
+| `oat-project-import-plan/SKILL.md` | `9,21,58 -> NG`; `86-87,91 -> IMPORT-01`; `141,147 -> IMPORT-03`; `159 -> IMPORT-04`; `183,196 -> NG`; `276 -> IMPORT-06`; `288-289 -> IMPORT-07`; `453 -> NG`; `460 -> IMPORT-09` |
+| `oat-project-implement/SKILL.md` | `9,29,55 -> NG`; `113 -> IMPLEMENT-01`; `158 -> NG` |
+| `oat-project-implement/references/plan-and-resume.md` | `47 -> IMPLEMENT-02`; `108,113,121,123,129-131,135,137,139,141,159,161,163 -> IMPLEMENT-03`; `168,171-172 -> IMPLEMENT-04`; `211 -> IMPLEMENT-05`; `235 -> NG`; `238 -> IMPLEMENT-06`; `255 -> IMPLEMENT-07` |
+| `oat-project-implement/references/dispatch-and-dry-run.md` | `52,69 -> IMPLEMENT-08`; `154,179 -> IMPLEMENT-09`; `198,225,244,332 -> NG`; `414,418,420-422,435,440,453,477-478,514 -> NG` |
+| `oat-project-implement/references/completion-and-closeout.md` | `165,184,194,197,219,221,236 -> IMPLEMENT-11`; `249 -> NG`; `265 -> IMPLEMENT-12`; `271-274 -> IMPLEMENT-14`; `280,282-286,292,307-308,311,313-316,318-319,321-322,329-330 -> IMPLEMENT-13, IMPLEMENT-14, IMPLEMENT-15, IMPLEMENT-16`; `332,334,336,343,359,362,370 -> IMPLEMENT-17`; `421 -> NG`; `428 -> IMPLEMENT-18` |
+| `oat-project-implement/references/phase-execution.md` | `199 -> NG`; `260-261 -> IMPLEMENT-10` |
+| `oat-project-document/SKILL.md` | `4,8,13 -> NG`; `46 -> DOCUMENT-03`; `54,76 -> DOCUMENT-02`; `106 -> DOCUMENT-01`; `200,238 -> NG`; `384,416 -> DOCUMENT-02`; `546 -> NG` |
+| `oat-project-summary/SKILL.md` | `4,7,30 -> NG`; `86 -> SUMMARY-01`; `201,203,209-210,249,257,297 -> NG` |
+| `oat-project-pr-final/SKILL.md` | `4,7,26,43 -> NG`; `104 -> PRFINAL-01` |
+| `oat-project-complete/SKILL.md` | `7,16 -> NG`; `57,61,63,80,89,92,95,103,105,114,124 -> COMPLETE-01`; `140 -> NG`; `205,214 -> COMPLETE-02`; `219,223 -> COMPLETE-03`; `283,468 -> NG` |
+| `oat-project-review-provide/SKILL.md` | `4,7,28,34,44,93 -> NG`; `166 -> REVIEWPROVIDE-02`; `236,239-240,261 -> REVIEWPROVIDE-04`; `308,314-316,318 -> REVIEWPROVIDE-05`; `370,373 -> REVIEWPROVIDE-06`; `621 -> REVIEWPROVIDE-07`; `632,664 -> REVIEWPROVIDE-08`; `645,647,751,770-772,778 -> NG`; `869 -> REVIEWPROVIDE-09`; `911,927 -> NG` |
+| `oat-project-review-receive/SKILL.md` | `4,7,26,40,71,128,178,211,215,252,259 -> NG`; `267 -> REVIEWRECEIVE-01`; `273-274,278 -> NG`; `482 -> REVIEWRECEIVE-08`; `517 -> REVIEWRECEIVE-02`; `548 -> REVIEWRECEIVE-04`; `590 -> REVIEWRECEIVE-05`; `614 -> REVIEWRECEIVE-06`; `647 -> REVIEWRECEIVE-07`; `721,724 -> NG` |
+| `oat-dispatch-subagents/SKILL.md` | `94,98 -> DISPATCH-01`; `110 -> PDISPATCH-01`; `117,123 -> DISPATCH-02`; `126 -> PDISPATCH-01` |
+| `oat-dispatch-subagents/references/provider-cursor.md` | `40,49 -> NG` |
+| `oat-dispatch-subagents/references/record-schema.md` | `74 -> NG` |
+| `oat-dispatch-subagents/references/provider-claude.md` | `44 -> NG` |
+| `oat-dispatch-subagents/references/provider-codex.md` | `64 -> NG` |
+| `oat-project-dispatch-subagents/SKILL.md` | `97,105 -> PDISPATCH-01` |
+
+Zero discovered prompt sites are unmapped. The broad scan's `NG` sites are
+accounted for explicitly and do not represent user-input waits.

package/assets/skills/oat-project-implement/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-project-implement
-version: 2.0.41
+version: 2.1.0
 description: Use when plan.md is ready for execution. Dispatches one phase implementer per phase, owns independent phase review and bounded fix routing, and supports plan-declared worktree-isolated parallel phases.
 oat_gateable: true
 argument-hint: '[--retry-limit <N>] [--dry-run]'
@@ -35,6 +35,23 @@ from `.agents/skills/oat-dispatch-subagents/references/`
 (`provider-cursor.md`, `provider-codex.md`, or `provider-claude.md`). Do not
 merge provider mechanics.
 
+## Autonomy Policy
+
+When `OAT_AUTONOMOUS=1`, read
+`references/docs/autonomy-contract.md` and keep `OAT_NON_INTERACTIVE=1` set for
+this run. Autonomy-specific behavior is routed with the rest of the workflow:
+
+- delegation authorization: `references/dispatch-and-dry-run.md`;
+- HiLL resolution and checkpoint review/receive:
+  `references/plan-and-resume.md`;
+- final review, final HiLL approval, and lifecycle-tail sequencing:
+  `references/completion-and-closeout.md`.
+
+These are additive autonomous branches. When `OAT_AUTONOMOUS` is not exactly
+`1`, preserve every existing interactive prompt and preference path. Never
+persist either autonomy environment signal in project artifacts or config;
+record only the gate decision and its review/dispatch provenance.
+
 ## Mode Assertion
 
 **OAT MODE: Implementation**

package/assets/skills/oat-project-implement/references/completion-and-closeout.md

@@ -162,6 +162,28 @@ echo "$FINAL_ROW"
 
 - Tell user: "All tasks complete. Final review required before PR."
 
+**Autonomous final-review path (before prompting):**
+
+If `OAT_AUTONOMOUS=1`, do not present a review-execution choice. Resolve the
+exact reviewer target through the project dispatch substrate, select the
+highest target-preserving route before launch, and run
+`oat-project-review-provide code final` followed immediately by
+`oat-project-review-receive`.
+
+- If receive creates fix tasks, return through the normal bounded implement and
+  re-review loop.
+- Continue to Step 15 only when the final Reviews row is `passed`.
+- A failed blocking review, unresolved Critical finding, exhausted route, or
+  missing credential with no adequate fallback is an autonomy boundary. Persist
+  the review state and report the exact resume action instead of falling
+  through to the prompt.
+- Record gate `IMPLEMENT-11`, the selected route, achieved independence, and
+  dispatch-record reference in `implementation.md`.
+
+After this autonomous branch succeeds, skip the workflow preference,
+fresh-session guidance, and standard prompt below. When `OAT_AUTONOMOUS` is not
+exactly `1`, this branch is inert.
+
 **Workflow preference check (before prompting):**
 
 First resolve the final reviewer target with the same target-first contract as
@@ -273,20 +295,40 @@ legacy or structured preference, normalize legacy values before snapshotting:
 ["summary", "pr"], postApproval: [] }`, and `docs-pr` → `{ preApproval:
 ["summary", "document", "pr"], postApproval: [] }`.
 
+If `OAT_AUTONOMOUS=1` and the preference is unset, use the inventory's
+autonomous lifecycle-tail default:
+
+```yaml
+preApproval: [summary, document, pr]
+postApproval: []
+```
+
+Treat this as an in-memory effective preference and create the same immutable
+sequence snapshot as a configured structured value. Add
+`source: autonomous-default` to that snapshot. A configured legacy or
+structured preference remains authoritative and uses `source: configured`;
+preserve its normalized arrays and stored order exactly.
+
 Persist this immutable state before dispatching a child:
 
 ```yaml
 oat_post_implement_sequence:
   status: pre_approval # pre_approval | awaiting_approval | post_approval | failed | complete
+  source: configured # configured | autonomous-default
   final_phase: pNN
   pre_approval: [summary, document, pr]
   pre_approval_completed: []
   approval: pending # pending | approved | not_required
+  approval_source: null # null | user | oat-autonomous
   post_approval: []
   post_approval_completed: []
   failure: null
 ```
 
+`source` and `approval_source` are additive provenance fields. A resumable
+snapshot created by an older skill version remains valid when either field is
+absent; do not rewrite its stored pre/post arrays merely to backfill provenance.
+
 The snapshot is immutable for this closeout: never re-resolve
 `workflow.postImplementSequence` while it is incomplete. Iterate
 `pre_approval` and `post_approval` in their stored array order; do not sort or
@@ -313,8 +355,8 @@ exact resume command: `oat-project-implement`.
 awaiting_approval` with `approval: pending` before asking for final HiLL
    approval.
 3. Record explicit approval as `approval: approved` and `status: post_approval`
-   before any post-approval dispatch. Then dispatch incomplete `post_approval`
-   steps in stored order.
+   before any post-approval dispatch. Record `approval_source: user` in the same
+   commit. Then dispatch incomplete `post_approval` steps in stored order.
 4. A decline or defer keeps `status: awaiting_approval` and `approval: pending`;
    record neither approval nor failure and run no post-approval step. State the
    boundary and exact resume command: `oat-project-implement`.
@@ -325,14 +367,37 @@ awaiting_approval` with `approval: pending` before asking for final HiLL
    implementation state, append the configured final HiLL completion, and
    continue to the existing next-step behavior.
 
-If the preference is unset, do not create a sequence snapshot. When the
-preference is unset, retain the existing next-step prompt only after final
-approval when a final checkpoint is configured.
+**Autonomous final HiLL approval:**
+
+When `OAT_AUTONOMOUS=1`, gate `IMPLEMENT-16` replaces only the approval question
+in steps 2-4:
+
+1. Require the final review row to be `passed` and verify its review artifact
+   and dispatch record. A failed blocking review or unresolved Critical finding
+   stops before approval.
+2. After all `pre_approval` steps succeed, commit `status: awaiting_approval`
+   with `approval: pending` exactly as above.
+3. Without waiting for input, commit `approval: approved`,
+   `approval_source: oat-autonomous`, and `status: post_approval`, referencing
+   the passing final review and dispatch record in `implementation.md`.
+4. Dispatch incomplete `post_approval` steps in stored order, then finish the
+   snapshot normally.
+
+The policy approval occurs after pre-approval work and before any post-approval
+work. It does not waive a failed review, child failure, repository-policy
+approval, destructive-change risk, or missing-credential boundary. When
+autonomy is inactive, the explicit user approval/decline/defer behavior above
+is unchanged.
+
+If the preference is unset and autonomy is inactive, do not create a sequence
+snapshot. Retain the existing next-step prompt only after final approval when a
+final checkpoint is configured. Under autonomy, the default snapshot above
+always resolves the unset case.
 
 ### Step 16: Prompt for Next Steps
 
-Run the standard next-step prompt only when
-`workflow.postImplementSequence` was unset and no sequence snapshot was
+Run the standard next-step prompt only when `OAT_AUTONOMOUS` is not `1`,
+`workflow.postImplementSequence` was unset, and no sequence snapshot was
 created. It occurs after final approval when a final checkpoint is configured.
 A configured legacy or structured preference has already completed through
 **Final HiLL Closeout Sequence**; do not re-dispatch its steps here. When the

package/assets/skills/oat-project-implement/references/dispatch-and-dry-run.md

@@ -49,16 +49,23 @@ block on user-initiated fresh sessions mid-run):
   context; do not rely on forked full-thread context when pinning a
   specialized OAT role.
   - Available without auth → Tier 1.
-  - Available with auth required → fail closed. Ask the user once at skill
-    start before selecting Tier 2 or starting implementation work:
+  - Available with auth required:
+    - If `OAT_AUTONOMOUS=1`, gate `IMPLEMENT-08` authorizes delegation once
+      for this run, covering only `oat-phase-implementer` and `oat-reviewer`
+      within the plan's bounded phase/review scopes. Record the authorization
+      scope in the dispatch record, re-probe, and use Tier 1 when the host
+      accepts it. If the host requires an out-of-band grant that the current
+      run cannot supply, stop at a reported authorization boundary.
+    - Otherwise, fail closed and ask the user once at skill start before
+      selecting Tier 2 or starting implementation work:
 
-    ```
-    This OAT implementation skill normally delegates phase implementation and review to subagents. Authorize subagent delegation for this run?
+      ```
+      This OAT implementation skill normally delegates phase implementation and review to subagents. Authorize subagent delegation for this run?
 
-    Yes authorizes both oat-phase-implementer and oat-reviewer across every phase in this run.
-    ```
+      Yes authorizes both oat-phase-implementer and oat-reviewer across every phase in this run.
+      ```
 
-    Approved → Tier 1. Declined → Tier 2.
+      Approved → Tier 1. Declined → Tier 2.
 
 - If the host does not resolve either generic agent, first attempt the exact
   registered role natively for any concrete managed target. Use the explicitly
@@ -69,8 +76,9 @@ block on user-initiated fresh sessions mid-run):
 **Approval scope rule:** this Tier selection applies to both phase
 implementation and checkpoint review. Do not infer a mixed mode from
 conversational emphasis on review checkpoints. If the user has not explicitly
-approved Tier 1 for the run, stay Tier 2 throughout. Mixed mode is only valid
-when the user explicitly requests it.
+approved Tier 1 for the run, and gate `IMPLEMENT-08` has not supplied the
+bounded autonomous run authorization above, stay Tier 2 throughout. Mixed mode
+is only valid when the user explicitly requests it.
 
 **Codex fail-closed rule:** after this skill is invoked, "user did not
 separately ask for subagents" is not a valid Tier 2 reason. If Codex can spawn