its-magic 0.1.3-3 → 0.1.3-4

package/template/.cursor/scratchpad.local.example.md

@@ -1,4 +1,4 @@
-# its-magic scratchpad (framework default catalog — Model B / DEC-0055)
+# its-magic scratchpad (framework default catalog — Model B / DEC-0055)
 #
 # Copy this file to `.cursor/scratchpad.local.md` for personal overrides (gitignored).
 # Merge precedence: local > materialized `.cursor/scratchpad.md` > this example
@@ -49,15 +49,15 @@ MAGIC_BENCH_SESSION=
 # - AUTO_EXECUTE_ON_BLOCK: stop|skip (behavior when a planned item blocks)
 # - AUTO_EXECUTE_SELECTION: planned_then_priority
 # - AUTO_TEAM_SCOPE_ENFORCE: 0|1 (when TEAM_MODE=1, enforce TEAM_MEMBER + ACTIVE_TASK_IDS)
-# Optional bug-queue mode (US-0087) — default-off when absent/unset after merge
+# Optional bug-queue mode (US-0087) — default-off when absent/unset after merge
 # - AUTO_BUG_QUEUE: 0|1 (1 = enable bug-targeted /auto; mutex vs AUTO_BACKLOG_DRAIN without bug-target argv)
 # - AUTO_BUG_TARGET: all-open|BUG-#### (required when AUTO_BUG_QUEUE=1 unless bug-target= argv supplies target)
 # - AUTO_BUG_MAX_ITEMS: non-negative integer (0 or unset = no cap for all-open queue per run)
 # - AUTO_BUG_ON_BLOCK: stop|skip (bug segment pause/stop boundary)
-# Quiet mode (US-0088) — suppress routine per-phase success chatter only
+# Quiet mode (US-0088) — suppress routine per-phase success chatter only
 # - AUTO_QUIET: 0|1 (default 0; 1 = quiet routine notifications)
 #   Non-suppressible: decision_gate, errors, pause, loop_max, blocked, missing inputs.
-#   Orthogonal to TOKEN_PROFILE (DEC-0035 / US-0080) — TOKEN_PROFILE controls
+#   Orthogonal to TOKEN_PROFILE (DEC-0035 / US-0080) — TOKEN_PROFILE controls
 #   context breadth / token cost, not notification policy.
 AUTO_QUIET=1
 AUTO_FLOW_MODE=full_autonomy
@@ -83,12 +83,14 @@ AUTO_BLOCK_RETRY_MAX=5
 # `/auto` phase role policy (US-0069 / DEC-0051)
 # - AUTO_ROLE_RESEARCH: po|tech-lead (empty -> default tech-lead)
 # - AUTO_ROLE_PLAN_VERIFY: qa|tech-lead (empty -> default qa)
-# - AUTO_ROLE_REFRESH_CONTEXT: curator|po (empty -> default curator)
+# - AUTO_ROLE_REFRESH_CONTEXT: curator|po (empty -> default curator)
+# - AUTO_ROLE_CLOSURE: qe|curator (empty -> default qe) (US-0120 / DEC-0051)
 # - AUTO_EXECUTE_ROLE_OVERRIDE: empty or allowed_non_dev_execute (execute default is dev)
 # - EXECUTE_OVERRIDE_GOVERNANCE_REF: parseable waiver pointer (DEC-xxxx / state anchor) when override set
 AUTO_ROLE_RESEARCH=
 AUTO_ROLE_PLAN_VERIFY=
 AUTO_ROLE_REFRESH_CONTEXT=
+AUTO_ROLE_CLOSURE=
 AUTO_EXECUTE_ROLE_OVERRIDE=
 EXECUTE_OVERRIDE_GOVERNANCE_REF=
 #
@@ -184,6 +186,20 @@ LEAN_MEMORY_WRITE=1
 LEAN_COLD_READ_MAX_SECTIONS=4
 LEAN_STATE_INDEX_ROWS=80
 AUTO_DELIVERY_ROUTING=scratchpad_only
+#
+# Work-kind routing (US-0118 / DEC-0118)
+# Default-off per-story work-kind classifier. When WORK_KIND_ROUTING=0,
+# /auto resolve_delivery_mode step 0 + /intake step 5 skip the classifier
+# entirely (zero overhead — byte-identical to pre-US-0118). When 1, the
+# classifier derives (delivery_mode, phase_plan) per the L8 precedence
+# chain: explicit DELIVERY_MODE > AUTO_PHASE_* > WORK_KIND_ROUTING-derived
+# > current default. Merge precedence (US-0078 model B): local > baseline
+# > example. Reuses scripts/dev_environment_lib.classify_touched_files.
+# - WORK_KIND_ROUTING: 0|1 (default 0; absence = 0)
+# - WORK_KIND_TIE_BREAK: highest_tier_wins (default; LOCKED Q1 — code > mini > doc)
+WORK_KIND_ROUTING=0
+WORK_KIND_TIE_BREAK=highest_tier_wins
+
 EARLY_RESEARCH=1
 INTAKE_GUIDED_MODE=1
 INTAKE_SUBAGENT_FALLBACK=deny
@@ -259,7 +275,7 @@ README_FEATURE_COVERAGE_ENFORCE=1
 # Project-owned root README bootstrap + per-story catalog growth.
 # - PROJECT_README_ENFORCE: 0|1 (default 1 post-bootstrap)
 #   When 0, /release step 3g skips (migration/grandfathering only). When 1, blocking.
-#   Flip 0→1 only after validate_project_readme_coverage.py --report shows coverage_missing: [].
+#   Flip 0→1 only after validate_project_readme_coverage.py --report shows coverage_missing: [].
 # - FRAMEWORK_KIT_REPO: 0|1 (default 0)
 #   When 1 (its-magic dev kit repo only), skip execute 23a/23b and project validator root check.
 #   Consumer repos never set FRAMEWORK_KIT_REPO=1.
@@ -271,9 +287,9 @@ FRAMEWORK_KIT_REPO=0
 # Two-tier browser probe: stdlib lib classifies + agent owns Cursor browser MCP (BUG-0006).
 # - UAT_BROWSER_PROBE_MODE: cursor|http_fallback|playwright_fallback (default cursor)
 #   - cursor: agent executes MCP sequence; lib emits plan + UAT_PROBE_UNRESOLVED until evidence
-#   - http_fallback: stdlib HTTP GET (CI recipe — set this in CI)
+#   - http_fallback: stdlib HTTP GET (CI recipe — set this in CI)
 #   - playwright_fallback: subprocess Playwright primary; HTTP fallback when missing
-# - UAT_BROWSER_FALLBACK_CHAIN: 0|1 (default 1; enable HTTP → Playwright after MCP unavailable)
+# - UAT_BROWSER_FALLBACK_CHAIN: 0|1 (default 1; enable HTTP → Playwright after MCP unavailable)
 # - UAT_PROCESS_HEALTH_POLL_SECONDS: positive int (default 60; process_health readiness cap)
 # - UAT_PROCESS_HEALTH_POLL_INTERVAL_SECONDS: positive int (default 2; poll interval)
 # - DEV_SERVER_PORT: int (optional; URL/port inference override)
@@ -289,7 +305,7 @@ DEV_SERVER_COMMAND=
 
 #
 # ## Dev environment auto-launch (US-0098 / DEC-0084)
-# Execute-phase bounded rebuild/relaunch + Connect surfacing — distinct from US-0065 phase QA,
+# Execute-phase bounded rebuild/relaunch + Connect surfacing — distinct from US-0065 phase QA,
 # US-0086 test routing, and US-0067 release hints. Orthogonal to AUTO_REMOTE_AUTOMATION_PROFILE.
 # When off, execute step 24 skipped with zero overhead.
 # - DEV_AUTO_LAUNCH_PROFILE: off|deterministic_v1 (default off)
@@ -326,37 +342,37 @@ CAVEMAN_FILE_SCOPE=
 #
 # ## Per-phase model tier selection (US-0101 / DEC-0086)
 # MODEL_TIER selects LLM model strength (which model runs).
-# MODEL_TIER ≠ TOKEN_PROFILE ≠ DELIVERY_MODE — these are independent axes;
+# MODEL_TIER ≠ TOKEN_PROFILE ≠ DELIVERY_MODE — these are independent axes;
 #   none substitutes for the other (DEC-0062 / US-0080 / US-0096).
 # - MODEL_TIER_DEFAULT: cheap|balanced|strong (default balanced)
 # - MODEL_TIER_<PHASE>: cheap|balanced|strong (per-phase override; PHASE = canonical phase id)
 #   Examples: MODEL_TIER_EXECUTE=cheap, MODEL_TIER_QA=strong, MODEL_TIER_RESEARCH=balanced
 #   Set in .cursor/scratchpad.local.md to override per phase without touching committed defaults.
 #   Default matrix (architecture-locked):
-#     cheap    — ask, refresh-context, memory-audit, status-reconcile, pause
-#     balanced — intake, discovery, research, release, plan-verify
-#     strong   — architecture, execute, quick, qa, verify-work, security-review
-#     (inherit parent) — auto (orchestrator always inherits parent model)
+#     cheap    — ask, refresh-context, memory-audit, status-reconcile, pause
+#     balanced — intake, discovery, research, release, plan-verify
+#     strong   — architecture, execute, quick, qa, verify-work, security-review
+#     (inherit parent) — auto (orchestrator always inherits parent model)
 # - MODEL_CATALOG: path to local slug catalog (default .cursor/model-catalog.local.json)
 # - MODEL_RESOLVE: alias_only|local_catalog|role_catalog (default alias_only)
 #   alias_only    = use Cursor-stable aliases (cheap->fast, balanced->inherit, strong->omit model:)
 #   local_catalog = look up vendor model slugs from MODEL_CATALOG; requires valid JSON catalog
-#   role_catalog  = opt-in phase→role→catalog slug lookup (US-0102 / DEC-0087); falls through on miss
+#   role_catalog  = opt-in phase→role→catalog slug lookup (US-0102 / DEC-0087); falls through on miss
 # - MODEL_FALLBACK: fallback when catalog lookup fails (default inherit)
 # - MODEL_PROVIDER_MODE: cursor|api (default cursor)
 #   cursor = all subagents route through Cursor-managed infrastructure
-#   api = operator uses BYOK via Cursor Settings → Models → API Key
+#   api = operator uses BYOK via Cursor Settings → Models → API Key
 #   Known limitation: subagents do NOT inherit custom API keys/base URLs.
 #
 # Example catalogs for 4 software-complexity levels + a Cursor-only variant:
-#   .cursor/model-catalog.local.example.json                           — minimal placeholder template
-#   .cursor/model-catalog.local.example.cursor-only.json             — only Cursor-integrated Composer models
-#   .cursor/model-catalog.local.example.level-1-easy.json            — small/simple apps
-#   .cursor/model-catalog.local.example.level-2-complex.json         — complex multi-service apps
-#   .cursor/model-catalog.local.example.level-3-mega.json            — mega-complex / modular monoliths
-#   .cursor/model-catalog.local.example.level-4-super.json            — super-high-sophisticated / mission-critical
-#   .cursor/model-catalog.local.example.role-based-balanced.json     — v2 role preset (balanced)
-#   .cursor/model-catalog.local.example.role-based-highend.json      — v2 role preset (high-end)
+#   .cursor/model-catalog.local.example.json                           — minimal placeholder template
+#   .cursor/model-catalog.local.example.cursor-only.json             — only Cursor-integrated Composer models
+#   .cursor/model-catalog.local.example.level-1-easy.json            — small/simple apps
+#   .cursor/model-catalog.local.example.level-2-complex.json         — complex multi-service apps
+#   .cursor/model-catalog.local.example.level-3-mega.json            — mega-complex / modular monoliths
+#   .cursor/model-catalog.local.example.level-4-super.json            — super-high-sophisticated / mission-critical
+#   .cursor/model-catalog.local.example.role-based-balanced.json     — v2 role preset (balanced)
+#   .cursor/model-catalog.local.example.role-based-highend.json      — v2 role preset (high-end)
 # Copy one to .cursor/model-catalog.local.json and set MODEL_RESOLVE=local_catalog or role_catalog to activate.
 MODEL_TIER_DEFAULT=balanced
 MODEL_CATALOG=.cursor/model-catalog.local.json
@@ -365,20 +381,20 @@ MODEL_FALLBACK=inherit
 MODEL_PROVIDER_MODE=cursor
 #
 # ## Direct per-phase model slug override + role catalog (US-0102 / DEC-0087)
-# Composes on US-0101 / DEC-0086 — tier baseline unchanged; overlays are optional.
+# Composes on US-0101 / DEC-0086 — tier baseline unchanged; overlays are optional.
 # Precedence chain (deterministic, per canonical phase_id):
-#   1. MODEL_<PHASE>           — direct vendor slug override (highest priority)
-#   2. MODEL_TIER_<PHASE>      — DEC-0086 tier→alias / local_catalog chain
-#   3. role_catalog lookup     — only when MODEL_RESOLVE=role_catalog; miss falls through
-#   4. MODEL_TIER_DEFAULT      — DEC-0086 tier chain
-#   5. Cursor stable alias     — DEC-0086 built-in mapping (fast / inherit / omit)
+#   1. MODEL_<PHASE>           — direct vendor slug override (highest priority)
+#   2. MODEL_TIER_<PHASE>      — DEC-0086 tier→alias / local_catalog chain
+#   3. role_catalog lookup     — only when MODEL_RESOLVE=role_catalog; miss falls through
+#   4. MODEL_TIER_DEFAULT      — DEC-0086 tier chain
+#   5. Cursor stable alias     — DEC-0086 built-in mapping (fast / inherit / omit)
 # Scratchpad merge precedence for all MODEL_* keys: MODEL_<PHASE> > MODEL_TIER_<PHASE> > MODEL_TIER_DEFAULT
 # - MODEL_<PHASE>: direct vendor slug; <PHASE> = canonical phase id (same list as MODEL_TIER_<PHASE>)
-#   Set in .cursor/scratchpad.local.md only — use <your-vendor-slug> placeholders in committed files.
+#   Set in .cursor/scratchpad.local.md only — use <your-vendor-slug> placeholders in committed files.
 #   Canonical phase ids: ask, refresh-context, memory-audit, status-reconcile, pause,
 #     intake, discovery, research, release, plan-verify, architecture, execute, quick,
 #     qa, verify-work, security-review, auto
-#   Examples (placeholders — replace in scratchpad.local.md):
+#   Examples (placeholders — replace in scratchpad.local.md):
 #     MODEL_ASK=<your-vendor-slug>
 #     MODEL_EXECUTE=<your-vendor-slug>
 #     MODEL_QA=<your-vendor-slug>
@@ -386,10 +402,10 @@ MODEL_PROVIDER_MODE=cursor
 #   MODEL_ASK participates in step 1 like any other phase (no special-case bypass).
 #
 # AI Decision Ledger + Plan Fidelity (US-0103 / DEC-0103)
-# Sovereign-loop foundation. Default-off — zero overhead when AI_DECISION_LEDGER=0.
-# - AI_DECISION_LEDGER: 0|1 (default 0) — when 0: no ledger reads/writes/schema checks.
-# - AUTO_PLAN_FIDELITY: strict|relaxed|extended (default strict) — active only when ledger enabled.
-#   strict   = any unapproved drop/reorder/scope-add → PLAN_FIDELITY_VIOLATION hard stop
+# Sovereign-loop foundation. Default-off — zero overhead when AI_DECISION_LEDGER=0.
+# - AI_DECISION_LEDGER: 0|1 (default 0) — when 0: no ledger reads/writes/schema checks.
+# - AUTO_PLAN_FIDELITY: strict|relaxed|extended (default strict) — active only when ledger enabled.
+#   strict   = any unapproved drop/reorder/scope-add → PLAN_FIDELITY_VIOLATION hard stop
 #   relaxed  = drop/reorder allowed (ledger entry); scope-add still hard stop
 #   extended = scope-add allowed (extension report); drop/reorder allowed
 AI_DECISION_LEDGER=0
@@ -397,7 +413,7 @@ AUTO_PLAN_FIDELITY=strict
 #
 # Goal-Based Convergence (US-0110 / DEC-0110)
 # Default-off sovereign-loop terminal predicate. When SOVEREIGN_GOAL_MODE=phase_driven,
-# zero overhead — no evaluation, no goal_progress block, no partial-delivery write.
+# zero overhead — no evaluation, no goal_progress block, no partial-delivery write.
 # Compose do NOT amend US-0088 / US-0092 / US-0095 / US-0044 / US-0103 (read-only surfaces).
 # - SOVEREIGN_GOAL_MODE: phase_driven|goal_convergence (default phase_driven)
 # - SOVEREIGN_GOAL: explicit goal text (wins over vision auto-derive; default empty)
@@ -411,7 +427,7 @@ SOVEREIGN_GOAL_MAX_CHARS=512
 SOVEREIGN_GOAL_TIMEOUT_MAX=0
 #
 # Cross-Model Adversarial Critic (US-0104 / DEC-0104)
-# Default-off cross-model review. When CROSS_MODEL_REVIEW=0, zero overhead — no critic
+# Default-off cross-model review. When CROSS_MODEL_REVIEW=0, zero overhead — no critic
 # spawn, no findings writes, no anti-slop gate. Compose do NOT amend US-0048 / US-0069 /
 # US-0023 / US-0110 / US-0103 (additive surfaces only).
 # - CROSS_MODEL_REVIEW: 0|1 (default 0)
@@ -422,14 +438,14 @@ CROSS_MODEL_ANTISLOP_THRESHOLD=6
 CROSS_MODEL_REWORK_MAX=2
 #
 # Sovereign Memory (US-0105 / DEC-0105)
-# Default-off institutional memory. When SOVEREIGN_MEMORY=0, zero overhead —
+# Default-off institutional memory. When SOVEREIGN_MEMORY=0, zero overhead —
 # no JSONL writes, no injection reads, no spawn digest assembly.
 # Compose do NOT amend US-0029 / US-0080 / US-0103 / US-0072 / US-0096.
 # - SOVEREIGN_MEMORY: 0|1 (default 0)
-# - SOVEREIGN_MEMORY_TOP_N: int >= 0 (default 5) — global recent pool (all four JSONL families)
-# - SOVEREIGN_MEMORY_TOP_K: int >= 0 (default 3) — high-impact pool (patterns + mistakes only)
-# - SOVEREIGN_MEMORY_MAX_CHARS: int >= 0 (default 2048) — hard cap on assembled digest_text
-# - SOVEREIGN_MEMORY_JSONL_MAX_LINES: int >= 1 (default 500) — active JSONL line cap before archive rollover
+# - SOVEREIGN_MEMORY_TOP_N: int >= 0 (default 5) — global recent pool (all four JSONL families)
+# - SOVEREIGN_MEMORY_TOP_K: int >= 0 (default 3) — high-impact pool (patterns + mistakes only)
+# - SOVEREIGN_MEMORY_MAX_CHARS: int >= 0 (default 2048) — hard cap on assembled digest_text
+# - SOVEREIGN_MEMORY_JSONL_MAX_LINES: int >= 1 (default 500) — active JSONL line cap before archive rollover
 SOVEREIGN_MEMORY=0
 SOVEREIGN_MEMORY_TOP_N=5
 SOVEREIGN_MEMORY_TOP_K=3
@@ -437,19 +453,19 @@ SOVEREIGN_MEMORY_MAX_CHARS=2048
 SOVEREIGN_MEMORY_JSONL_MAX_LINES=500
 #
 # Sovereign Loop Mode (US-0107 / DEC-0107)
-# Default-off project orchestration. When AUTO_SOVEREIGN=0, zero overhead — no deferral
+# Default-off project orchestration. When AUTO_SOVEREIGN=0, zero overhead — no deferral
 # reads/writes, no advance, no notifications. Requires SOVEREIGN_GOAL_MODE=goal_convergence
 # when enabled (fail-closed SOVEREIGN_LOOP_GOAL_MODE_REQUIRED). Compose do NOT amend
 # US-0088 / US-0092 / US-0095 / US-0044 / US-0103 / US-0105 / US-0110 (additive hooks only).
 # - AUTO_SOVEREIGN: 0|1 (default 0)
-# - AUTO_SOVEREIGN_DEFERRAL_MAX: int >= 1 (default 50) — max open deferral rows
-# - AUTO_SOVEREIGN_DRAIN_GENERATE_MAX: int >= 0 (default 3) — drain-generate iterations per run
+# - AUTO_SOVEREIGN_DEFERRAL_MAX: int >= 1 (default 50) — max open deferral rows
+# - AUTO_SOVEREIGN_DRAIN_GENERATE_MAX: int >= 0 (default 3) — drain-generate iterations per run
 # - AUTO_SOVEREIGN_DEFERRAL_POLICY: stop|skip|resolve_first (default resolve_first)
 # - SOVEREIGN_NOTIFY_TARGET: off|ntfy|email|hook (default off)
-# - SOVEREIGN_NOTIFY_NTFY_TOPIC: string (default empty — local-only)
-# - SOVEREIGN_NOTIFY_NTFY_BASE: URL (default empty — local-only ntfy base override)
-# - SOVEREIGN_NOTIFY_HOOK_URL: URL (default empty — local-only webhook)
-# - SOVEREIGN_NOTIFY_EMAIL_TO: email (default empty — email v1 deferred)
+# - SOVEREIGN_NOTIFY_NTFY_TOPIC: string (default empty — local-only)
+# - SOVEREIGN_NOTIFY_NTFY_BASE: URL (default empty — local-only ntfy base override)
+# - SOVEREIGN_NOTIFY_HOOK_URL: URL (default empty — local-only webhook)
+# - SOVEREIGN_NOTIFY_EMAIL_TO: email (default empty — email v1 deferred)
 AUTO_SOVEREIGN=0
 AUTO_SOVEREIGN_DEFERRAL_MAX=50
 AUTO_SOVEREIGN_DRAIN_GENERATE_MAX=3
@@ -462,14 +478,14 @@ SOVEREIGN_NOTIFY_EMAIL_TO=
 #
 # Sovereign Role-Behavior Manifest (US-0106 / DEC-0106)
 # Default-off per-role objective + inter-role review obligations. When SOVEREIGN_ROLE_MANIFEST=0,
-# zero overhead — no manifest reads, no objective injection, no review dispatch.
-# Compose do NOT amend US-0069 (phase→role matrix unchanged; review spawns supplementary),
+# zero overhead — no manifest reads, no objective injection, no review dispatch.
+# Compose do NOT amend US-0069 (phase→role matrix unchanged; review spawns supplementary),
 # US-0104 (critic lenses + findings schema unchanged; role reviews additive),
 # US-0003 / US-0023 / US-0103 / US-0105 / US-0107 (unchanged surfaces).
 # - SOVEREIGN_ROLE_MANIFEST: 0|1 (default 0)
-# - SOVEREIGN_ROLE_OBJECTIVE_MAX_CHARS: int >= 1 (default 512) — hard truncate for injection
-# - SOVEREIGN_ROLE_REVIEW_MAX_PER_PHASE: int >= 0 (default 2) — per-phase review cap
-# - SOVEREIGN_ROLE_REVIEW_REWORK_MAX: int >= 0 (default 1) — bounded rework before decision gate
+# - SOVEREIGN_ROLE_OBJECTIVE_MAX_CHARS: int >= 1 (default 512) — hard truncate for injection
+# - SOVEREIGN_ROLE_REVIEW_MAX_PER_PHASE: int >= 0 (default 2) — per-phase review cap
+# - SOVEREIGN_ROLE_REVIEW_REWORK_MAX: int >= 0 (default 1) — bounded rework before decision gate
 SOVEREIGN_ROLE_MANIFEST=0
 SOVEREIGN_ROLE_OBJECTIVE_MAX_CHARS=512
 SOVEREIGN_ROLE_REVIEW_MAX_PER_PHASE=2
@@ -477,20 +493,20 @@ SOVEREIGN_ROLE_REVIEW_REWORK_MAX=1
 #
 # Parallel Instance Arbitrage (US-0108 / DEC-0108)
 # Default-off parallel execute-phase instance orchestration. When SOVEREIGN_PARALLEL_DEV=0,
-# zero overhead — no worktrees, no parallel QA, no pick JSON, no resource guard.
+# zero overhead — no worktrees, no parallel QA, no pick JSON, no resource guard.
 # Compose do NOT amend US-0047 (bulk execute unchanged), US-0092 (full autonomy unchanged),
 # US-0103 (ledger schema unchanged; read-only consumer), US-0104 (critic schema unchanged;
 # read-only anti_slop_score consumer), US-0107 (sovereign loop unchanged; consumer only).
-# - SOVEREIGN_PARALLEL_DEV: 0|1 (default 0) — global enable gate
-# - AUTO_SOVEREIGN_PARALLEL_N: int >= 1 (default 3) — instances per execute cycle
-# - AUTO_SOVEREIGN_PARALLEL_MAX_TOTAL: int >= 1 (default 6) — system-wide instance cap
+# - SOVEREIGN_PARALLEL_DEV: 0|1 (default 0) — global enable gate
+# - AUTO_SOVEREIGN_PARALLEL_N: int >= 1 (default 3) — instances per execute cycle
+# - AUTO_SOVEREIGN_PARALLEL_MAX_TOTAL: int >= 1 (default 6) — system-wide instance cap
 # - AUTO_SOVEREIGN_MERGE_RESOLVE: first_pass_wins|last_pass_wins|winner_takes_all|manual (default first_pass_wins)
-# - AUTO_SOVEREIGN_WORKTREE_KEEP: 0|1 (default 0) — retain loser worktrees for debugging
-# - AUTO_SOVEREIGN_PARALLEL_QA: 0|1 (default 0) — enable parallel QA cross-review (v2)
+# - AUTO_SOVEREIGN_WORKTREE_KEEP: 0|1 (default 0) — retain loser worktrees for debugging
+# - AUTO_SOVEREIGN_PARALLEL_QA: 0|1 (default 0) — enable parallel QA cross-review (v2)
 # - AUTO_SOVEREIGN_PARALLEL_QA_ARBITER: critic_first_pass|majority_vote (default critic_first_pass)
-# - AUTO_SOVEREIGN_PARALLEL_ANTI_SLOP_THRESHOLD: int 0-10 (default 6) — anti-slop floor
-# - AUTO_SOVEREIGN_PARALLEL_REWORK_MAX: int >= 0 (default 2) — per-instance rework cap
-# - AUTO_SOVEREIGN_PARALLEL_MERGE_TIMEOUT_SEC: int >= 10 (default 60) — merge timeout
+# - AUTO_SOVEREIGN_PARALLEL_ANTI_SLOP_THRESHOLD: int 0-10 (default 6) — anti-slop floor
+# - AUTO_SOVEREIGN_PARALLEL_REWORK_MAX: int >= 0 (default 2) — per-instance rework cap
+# - AUTO_SOVEREIGN_PARALLEL_MERGE_TIMEOUT_SEC: int >= 10 (default 60) — merge timeout
 # - AUTO_SOVEREIGN_PARALLEL_MODEL_<idx>: model slug per instance (optional)
 # - AUTO_SOVEREIGN_PARALLEL_LENS_<idx>: lens config per instance (optional)
 SOVEREIGN_PARALLEL_DEV=0
@@ -506,16 +522,16 @@ AUTO_SOVEREIGN_PARALLEL_MERGE_TIMEOUT_SEC=60
 #
 # Self-Healing Deploy Loop (US-0109 / DEC-0109)
 # Default-off auto-heal post-publish probe + bounded retry + DEPLOY_DEFERRED.
-# When AUTO_SOVEREIGN_SELF_HEALING_DEPLOY=0 zero overhead, byte-identical US-0054 publish path —
+# When AUTO_SOVEREIGN_SELF_HEALING_DEPLOY=0 zero overhead, byte-identical US-0054 publish path —
 # no probe, no retry, no deferral, no execute steps 29-31. Compose do NOT amend US-0054 / US-0100 /
 # US-0103 / US-0107 / US-0110 (US-0109 consumer-only hook after US-0054 publish PASS).
-# - AUTO_SOVEREIGN_SELF_HEALING_DEPLOY: 0|1 (default 0) — global gate
-# - AUTO_SOVEREIGN_DEPLOY_RETRY_MAX: int >= 1 (default 3) — max retry attempts after probe FAIL
-# - AUTO_SOVEREIGN_DEPLOY_SMOKE_TIMEOUT_SEC: int >= 1 (default 30) — per-stage probe HTTP timeout
+# - AUTO_SOVEREIGN_SELF_HEALING_DEPLOY: 0|1 (default 0) — global gate
+# - AUTO_SOVEREIGN_DEPLOY_RETRY_MAX: int >= 1 (default 3) — max retry attempts after probe FAIL
+# - AUTO_SOVEREIGN_DEPLOY_SMOKE_TIMEOUT_SEC: int >= 1 (default 30) — per-stage probe HTTP timeout
 # - AUTO_SOVEREIGN_DEPLOY_PROBE_KIND: health_endpoint|acceptance_smoke|both (default both)
 # - SOVEREIGN_DEPLOY_ACCEPTANCE_SMOKE_PATH: repo-relative path (default tests/deploy_smoke/)
 # - AUTO_SOVEREIGN_DEPLOY_HEALTH_ENDPOINT: names-only env ref (US-0085 compose); empty = unresolvable
-# Reason codes (DEC-0109 §7): DEPLOY_HEALING_DISABLED (info), DEPLOY_HEALING_SMOKE_HEALTH_FAIL,
+# Reason codes (DEC-0109 §7): DEPLOY_HEALING_DISABLED (info), DEPLOY_HEALING_SMOKE_HEALTH_FAIL,
 #   DEPLOY_HEALING_SMOKE_ACCEPTANCE_FAIL, DEPLOY_HEALING_RETRY_ATTEMPT,
 #   DEPLOY_HEALING_RETRY_CAP_EXHAUSTED, DEPLOY_HEALING_DEFERRED,
 #   DEPLOY_HEALING_PROBE_TARGET_MISSING, DEPLOY_HEALING_TIMEOUT.
@@ -529,7 +545,7 @@ AUTO_SOVEREIGN_DEPLOY_HEALTH_ENDPOINT=
 # Release Trigger Adapters (US-0111 / DEC-0111)
 # Dispatch release flow by trigger source (GitHub webhook, npm publish, Git tag
 # push, manual /release). Default source is manual (zero behavior change vs
-# pre-US-0111 /release path — byte-identical). Compose with US-0100; reuses
+# pre-US-0111 /release path — byte-identical). Compose with US-0100; reuses
 # release_changelog_lib APIs without modification.
 # - RELEASE_TRIGGER_SOURCE: manual|github|npm|git_tag|auto (default manual)
 # - RELEASE_TRIGGER_TIMEOUT_SEC: int >= 1 (default 10; adapter subprocess timeout)
@@ -537,3 +553,85 @@ AUTO_SOVEREIGN_DEPLOY_HEALTH_ENDPOINT=
 RELEASE_TRIGGER_SOURCE=manual
 RELEASE_TRIGGER_TIMEOUT_SEC=10
 RELEASE_TRIGGER_FALLBACK_TO_LOCAL=0
+#
+# Autonomy presets (US-0119 / DEC-0119)
+# Configurable autonomy presets and per-feature autonomy flags.
+# Default-off; byte-identical pre-US-0119 when AUTONOMY_PRESET=none.
+#
+# Merge precedence (LOCKED):
+#   1. Explicit per-flag value (in scratchpad or scratchpad.local)
+#   2. AUTONOMY_PRESET expansion (via scripts/autonomy_preset_lib.py)
+#   3. Scratchpad defaults (this file)
+#
+# AUTONOMY_PRESET: none|balanced|full (default=none)
+#   none:    empty {} — byte-identical pre-US-0119
+#   balanced: 8 flags — moderate autonomy
+#   full:     12 flags — maximum autonomy (superset of balanced)
+#
+# AUTONOMY_STOP_POLICY: block|auto_repair_then_block|auto_repair_then_skip (default=block)
+#   block:                  all fail-closed codes block (pre-US-0119 behavior)
+#   auto_repair_then_block: autonomy_resolvable codes get bounded repair; cap exhaustion -> BLOCK
+#   auto_repair_then_skip:  autonomy_resolvable codes get bounded repair; cap exhaustion -> SKIP
+#
+# Per-feature autonomy flags (12 total — DEC-0119 §7):
+#
+# INTAKE_AUTONOMY_MODE: 0|1 (default=0)
+# balanced: OFF | full: ON
+# Auto-derives intake answers on known-stack repeat projects (US-0068 compose).
+#
+# INTAKE_MINIMAL_PACK: 0|1 (default=0)
+# balanced: OFF | full: ON
+# Shrinks follow-up intake on established projects (Q7: MAX_US_ID >= US-0100 AND STACK_KNOWN = true).
+#
+# INTAKE_ASSUME_STACK_CONTEXT: 0|1 (default=0)
+# balanced: OFF | full: ON
+# Auto-fills stack/runtime from backlog history with assumption_confirmation_ref contract (BUG-0007 compose).
+#
+# WORK_KIND_AUTO_ACCEPT: 0|1 (default=0)
+# balanced: ON | full: ON
+# Auto-accepts classifier output when WORK_KIND_ROUTING=1.
+#
+# CROSS_MODEL_REWORK_EXHAUSTED_POLICY: block|downgrade (default=block)
+# balanced: downgrade | full: downgrade
+# Converts decision gate to warning when critic rework cap exhausted (US-0104 compose).
+#
+# CROSS_MODEL_SKIP_PHASES: csv (default=empty)
+# balanced: empty | full: empty
+# Skips critic for low-risk phases (e.g., refresh-context,release) (US-0104 compose).
+#
+# RESUME_BRIEF_AUTO_REFRESH: 0|1 (default=0)
+# balanced: ON | full: ON
+# Auto-refreshes stale brief; RESUME_BRIEF_STALE becomes autonomy_resolvable when ON.
+#
+# RUNTIME_PROOF_KIND: strict|lightweight (default=strict)
+# balanced: lightweight | full: lightweight
+# Counter+timestamp attestation instead of SHA-256; TTL unchanged (Q4: 3600s) (US-0056 compose).
+#
+# GOAL_CONVERGENCE_INTERVAL: int >= 1 (default=3)
+# balanced: 3 | full: 1
+# Evaluates goal every N phases (3 = balanced cadence; 1 = every phase) (US-0107 compose).
+#
+# SOVEREIGN_DRAIN_AUTO_ACCEPT: 0|1 (default=0)
+# balanced: ON | full: ON
+# Auto-accepts drain candidates below medium risk tier (Q5) (US-0107 compose).
+#
+# RELEASE_PUBLISH_AUTO_CONFIRM: 0|1 (default=0)
+# balanced: OFF | full: OFF
+# Auto-confirms publish targets when in RELEASE_TARGETS_ALLOWLIST (Q6) (US-0054 compose).
+#
+# AUTONOMY_REPAIR_CAP_OVERRIDE: int >= 1 or empty (default=empty)
+# Operator override for per-run repair cap (empty = use matrix default cap=3 per DEC-0119 §5).
+AUTONOMY_PRESET=none
+AUTONOMY_STOP_POLICY=block
+INTAKE_AUTONOMY_MODE=0
+INTAKE_MINIMAL_PACK=0
+INTAKE_ASSUME_STACK_CONTEXT=0
+WORK_KIND_AUTO_ACCEPT=0
+CROSS_MODEL_REWORK_EXHAUSTED_POLICY=block
+CROSS_MODEL_SKIP_PHASES=
+RESUME_BRIEF_AUTO_REFRESH=0
+RUNTIME_PROOF_KIND=strict
+GOAL_CONVERGENCE_INTERVAL=3
+SOVEREIGN_DRAIN_AUTO_ACCEPT=0
+RELEASE_PUBLISH_AUTO_CONFIRM=0
+AUTONOMY_REPAIR_CAP_OVERRIDE=

package/template/docs/engineering/autonomy-stop-matrix.md

@@ -0,0 +1,101 @@
+# Autonomy Stop Matrix (US-0119 / DEC-0119)
+
+**Owner**: `DEC-0119` (Accepted 2026-07-05)
+**Story**: `US-0119` — Autonomous-autonomy presets and configurable hard-stop relaxation
+**Consumer**: `scripts/validate_autonomy_stop_matrix.py` (validator)
+**Template parity**: `template/docs/engineering/autonomy-stop-matrix.md` (byte-identical)
+
+## Purpose
+
+Classifies all fail-closed reason codes into two stop classes to support `AUTONOMY_STOP_POLICY` dispatch:
+
+- **`security_hard`**: NEVER auto-repaired under any preset/policy. Block immediately.
+- **`autonomy_resolvable`**: Bounded auto-repair permitted when `AUTONOMY_STOP_POLICY != block`. Cap per (run, reason_code) from matrix `cap` column (default 3 per R-0107 Q3).
+
+## Stop class rules
+
+| Stop class | `auto_repair_kind` | `cap` | Rationale |
+|------------|--------------------|----|-----------|
+| `security_hard` | `n/a` (MUST) | `0` (MUST) | Security boundary — never softened |
+| `autonomy_resolvable` | one of 9 taxonomy values (MUST) | `>= 1` or `0` for terminal stops (MUST) | Bounded repair with audit trail |
+
+## `auto_repair_kind` taxonomy (9 values — R-0107 Q2)
+
+| auto_repair_kind | Description |
+|------------------|-------------|
+| `reorder_anchors` | Sort H1s by story ID |
+| `fix_timestamp` | Replace stale timestamp with `now()` |
+| `truncate_hot_surface` | Archive rollover |
+| `reset_retry_counter` | Reset to 0 |
+| `disambiguate_state` | Pick last-known phase |
+| `auto_refresh_brief` | Regenerate from state.md |
+| `approve_plan_deviation` | Ledger waiver |
+| `regenerate_isolation_evidence` | Re-run context-refresh |
+| `skip_confirmation_gate` | Allowlist-gated skip |
+
+## Security-hard gates (18 codes)
+
+Reason codes that are NEVER auto-repaired. Violation of any triggers terminal `AUTONOMY_REPAIR_CAP_EXHAUSTED` escalation.
+
+| Reason code | Rationale |
+|-------------|-----------|
+| `PHASE_CONTEXT_ISOLATION_VIOLATION` | Context isolation is a fundamental security boundary |
+| `PHASE_CONTEXT_ISOLATION_MISSING` | Missing isolation evidence = untrusted context |
+| `ISOLATION_EVIDENCE_STALE` | Stale evidence = untrusted context |
+| `RUNTIME_PROOF_MISSING` | Proof absence = unverifiable execution |
+| `RUNTIME_PROOF_REUSED` | Proof reuse = unverifiable execution |
+| `RUNTIME_PROOF_STALE` | Stale proof = unverifiable execution |
+| `RUNTIME_PROOF_AMBIGUOUS_LINK` | Ambiguous link = unverifiable execution |
+| `PHASE_ROLE_CAPABILITY_MISSING` | Role capability is a security boundary |
+| `PHASE_ROLE_MISMATCH` | Role mismatch is a security boundary |
+| `PHASE_OWNERSHIP_VIOLATION` | Ownership is a security boundary |
+| `PHASE_OVERRIDE_EVIDENCE_MISSING` | Override evidence is a security boundary |
+| `INTAKE_BUG_ROUTING_REQUIRED` | Bug routing is a structural gate |
+| `INTAKE_ANSWER_REF_NOT_TOPIC_DISTINCT` | Topic distinctness is a truthfulness boundary |
+| `INTAKE_REQUIRED_TOPIC_MISSING` | Required topic absence blocks intake |
+| `INTAKE_PERSISTENCE_BLOCKED` | Persistence failure = unreliable state |
+| `AUTO_SCHEDULER_CONFLICT` | Scheduler conflict = unreliable sequencing |
+| `RESUME_BRIEF_STALE` (when `RESUME_BRIEF_AUTO_REFRESH != 1`) | Stale brief = unreliable context (when auto-refresh not enabled) |
+| `SECURITY_REVIEW_CRITICAL_FINDING` | Security review critical = security boundary |
+
+## Autonomy-resolvable gates (9 codes)
+
+Reason codes that may be auto-repaired when `AUTONOMY_STOP_POLICY` allows. Cap per (run, reason_code) from matrix `cap` column.
+
+| Reason code | `auto_repair_kind` | `cap` | Rationale |
+|-------------|---------------------|-------|-----------|
+| `ARTIFACT_ORDERING_ANCHOR_AMBIGUOUS` | `reorder_anchors` | `3` | Sort H1s by story ID (mechanical fix) |
+| `STATE_TIMESTAMP_NON_MONOTONIC` | `fix_timestamp` | `3` | Replace stale timestamp (mechanical fix) |
+| `ARTIFACT_HOT_SURFACE_OVERSIZE` | `truncate_hot_surface` | `3` | Archive rollover (mechanical fix) |
+| `BLOCK_RETRY_CAP_EXHAUSTED` | `reset_retry_counter` | `3` | Reset to 0 (ledger entry) |
+| `STATE_PHASE_AMBIGUOUS` | `disambiguate_state` | `3` | Pick last-known phase (unambiguous selection) |
+| `RESUME_BRIEF_MISSING` | `auto_refresh_brief` | `3` | Regenerate brief from state.md (when `RESUME_BRIEF_AUTO_REFRESH=1`) |
+| `PLAN_FIDELITY_VIOLATION` | `approve_plan_deviation` | `3` | Ledger waiver (bounded audit trail) |
+| `ISOLATION_EVIDENCE_INVALID` | `regenerate_isolation_evidence` | `3` | Re-run context-refresh (mechanical fix) |
+| `RELEASE_PUBLISH_MODE` | `skip_confirmation_gate` | `3` | Allowlist-gated skip (when target in `RELEASE_TARGETS_ALLOWLIST`) |
+
+## Terminal stop reasons
+
+Reason codes emitted by the bounded auto-repair ledger when cap is exhausted.
+
+| Reason code | `auto_repair_kind` | `cap` | Rationale |
+|-------------|---------------------|-------|-----------|
+| `AUTONOMY_REPAIR_CAP_EXHAUSTED` | `n/a` | `0` | Terminal stop — cap exhaustion escalates to operator (distinct from `BLOCK_RETRY_CAP_EXHAUSTED` per R-0107 Q9) |
+
+## Matrix validator
+
+`scripts/validate_autonomy_stop_matrix.py --self-test` enforces:
+- No orphan reason codes in scripts (grep `scripts/*.py` for codes not in YAML → fail)
+- `security_hard` rows carry `auto_repair_kind=n/a`
+- `autonomy_resolvable` rows carry finite `cap` (default 3)
+- Every reason code in `.cursor/commands/*.md` is in YAML (grep-based cross-check per R-0107 Q8)
+
+Exit 0 = matrix valid. Exit non-zero = matrix invalid (list of violations on stderr).
+
+## YAML single source of truth
+
+`scripts/data/autonomy_stop_matrix.yaml` is the machine-readable companion. Validator reads YAML, not this markdown file. Markdown is operator-facing documentation; YAML is the contract.
+
+## Compose guards
+
+US-0119 composes read-only with US-0092 / US-0095 / US-0056 / US-0068 / US-0096 / BUG-0007. This matrix does NOT amend their architectural surfaces. Stop classification is additive only.

package/template/docs/engineering/context/installer-owned-paths.manifest

@@ -48,6 +48,13 @@ scripts/auto_outer_driver.py
 scripts/uat_probe_lib.py
 scripts/project_readme_coverage_lib.py
 scripts/validate_project_readme_coverage.py
+scripts/work_kind_classify_lib.py
+scripts/work_kind_routing_lib.py
+scripts/autonomy_preset_lib.py
+scripts/autonomy_repair_ledger_lib.py
+scripts/data/autonomy_stop_matrix.yaml
+scripts/validate_closure_verification.py
+scripts/validate_autonomy_stop_matrix.py
 .github/workflows
 its_magic
 
@@ -82,6 +89,9 @@ scripts/auto_outer_driver.py
 scripts/uat_probe_lib.py
 scripts/project_readme_coverage_lib.py
 scripts/validate_project_readme_coverage.py
+scripts/work_kind_classify_lib.py
+scripts/work_kind_routing_lib.py
+scripts/validate_closure_verification.py
 .github/workflows/ci.yml
 .github/workflows/deploy.yml
 its_magic
@@ -102,3 +112,5 @@ scripts/remote_config_summary.py
 scripts/guard_installer_publish.py
 scripts/enforce-triad-hot-surface.py
 scripts/caveman_compress_input.py
+scripts/work_kind_classify_lib.py
+scripts/work_kind_routing_lib.py