feat(org): per-class autonomy levels with owner confirmation and guarded reversal (#1873) #1934

2026-11-11T16:30:00Z

jason.woltje commented

2026-11-11 16:30:00 +00:00

AU (#1873, design section 13): an organization's owner sets how far agents act on their own for each decision class, and near-the-loop actions can be reversed within a window.

Settings: strict autonomy data per class (cross-role, merge, policy, authority) and an owner-only Console writer. Agent, tester and member edits refuse; unknown classes and levels refuse. With no setting, routing is unchanged (merge to the technical arbiter, hire to a person). Each change records the authenticated owner and a writer receipt. Live and launch rails carry the chosen levels. No roles/ or contracts/ change.
In the loop: the arbiter still resolves; its resolution waits as a pending event until the owner confirms. Decline returns it to the arbiter. A confirmation cannot reopen a decline or be used twice.
Near the loop: the action takes effect and the owner gets a notice with a reverse deadline (24 hours by default, owner-set 1 to 168). A reversal consumes once and checks the deadline where it takes effect. Merge reverse is a new child revert of current main through the same gate and compare-and-swap; history is kept. Task reverse restores fields captured in the same transaction and refuses after a later edit. Authority reverse uses normal stop, revoke and fire, restores the prior definition text after the held-credential scan, and asks for a relaunch when a running agent was stopped.
The level used is the more conservative of the raise-time and current setting, so moving outward cannot skip a confirmation already required.
Resolver rights: the technical resolver's right is checked at consumption, checkLand and recordLand. Plain near-loop hires use the new decision.resolve.authority right through A4's digest-bound proposal; flagged, credential and root proposals stay with the owner. No agent resolves a decision about itself or that it raised.
Authority near needs enforced quota coverage for every selectable model or shared account, checked at raise, resolve and publication.
Console: autonomy panel under the organization's system types, and Inbox confirm, decline and reverse. Checked at 1440x900 and 390x844 in light and dark.

No new human gate. Policy near and its reverse refuse policy-reverse-unavailable (no policy writer exists). Authority out refuses authority-limits-unavailable (no per-agent limits for future hires). Both name the next step.

Review: security (daybreak-blue) changes 2 P2 and build changes 4 P2 + 3 P3 on 5fd5c8ba8, all fixed in 805138d91. Security re-check 1 changes 1 (P2: a completion-event write after a committed inverse surfaced as a reverse failure), fixed in b237abdd6. Re-check 2 approve 0 (183/0 in 15 files). The last commit updates one import-pin expectation only.

Lane gate on 58940c2a1 (based on 5320e3d2c): 549 files, 5644/0, 5 skips. Case 1 back to back, BASE 57/0 then candidate 57/0. BASE regression evidence: the new acceptance files give 36/22 on BASE. Rebased onto ce4fe048b (PR #1933): range-diff identical; the only shared file is seat sandbox.mjs. Lead check: 53 files on 88a94ddd3: the 19 touched test files, every seat test and every test that reads sandbox.mjs, 785/0.

Deferred, recorded: policy near and reverse (needs a policy effect executor); authority out (needs enforceable per-agent limits); reverse for external task adapters (needs host-owned prior state; near-loop consumption refuses meanwhile). Credential binding is not part of this change, and a reverse never restores a binding.

AU (#1873, design section 13): an organization's owner sets how far agents act on their own for each decision class, and near-the-loop actions can be reversed within a window. - Settings: strict autonomy data per class (cross-role, merge, policy, authority) and an owner-only Console writer. Agent, tester and member edits refuse; unknown classes and levels refuse. With no setting, routing is unchanged (merge to the technical arbiter, hire to a person). Each change records the authenticated owner and a writer receipt. Live and launch rails carry the chosen levels. No roles/ or contracts/ change. - In the loop: the arbiter still resolves; its resolution waits as a pending event until the owner confirms. Decline returns it to the arbiter. A confirmation cannot reopen a decline or be used twice. - Near the loop: the action takes effect and the owner gets a notice with a reverse deadline (24 hours by default, owner-set 1 to 168). A reversal consumes once and checks the deadline where it takes effect. Merge reverse is a new child revert of current main through the same gate and compare-and-swap; history is kept. Task reverse restores fields captured in the same transaction and refuses after a later edit. Authority reverse uses normal stop, revoke and fire, restores the prior definition text after the held-credential scan, and asks for a relaunch when a running agent was stopped. - The level used is the more conservative of the raise-time and current setting, so moving outward cannot skip a confirmation already required. - Resolver rights: the technical resolver's right is checked at consumption, checkLand and recordLand. Plain near-loop hires use the new `decision.resolve.authority` right through A4's digest-bound proposal; flagged, credential and root proposals stay with the owner. No agent resolves a decision about itself or that it raised. - Authority near needs enforced quota coverage for every selectable model or shared account, checked at raise, resolve and publication. - Console: autonomy panel under the organization's system types, and Inbox confirm, decline and reverse. Checked at 1440x900 and 390x844 in light and dark. No new human gate. Policy near and its reverse refuse `policy-reverse-unavailable` (no policy writer exists). Authority out refuses `authority-limits-unavailable` (no per-agent limits for future hires). Both name the next step. Review: security (daybreak-blue) changes 2 P2 and build changes 4 P2 + 3 P3 on 5fd5c8ba8, all fixed in 805138d91. Security re-check 1 changes 1 (P2: a completion-event write after a committed inverse surfaced as a reverse failure), fixed in b237abdd6. Re-check 2 approve 0 (183/0 in 15 files). The last commit updates one import-pin expectation only. Lane gate on 58940c2a1 (based on 5320e3d2c): 549 files, 5644/0, 5 skips. Case 1 back to back, BASE 57/0 then candidate 57/0. BASE regression evidence: the new acceptance files give 36/22 on BASE. Rebased onto ce4fe048b (PR #1933): range-diff identical; the only shared file is seat sandbox.mjs. Lead check: 53 files on 88a94ddd3: the 19 touched test files, every seat test and every test that reads sandbox.mjs, 785/0. Deferred, recorded: policy near and reverse (needs a policy effect executor); authority out (needs enforceable per-agent limits); reverse for external task adapters (needs host-owned prior state; near-loop consumption refuses meanwhile). Credential binding is not part of this change, and a reverse never restores a binding.

jason.woltje added 4 commits 2026-11-11 16:30:01 +00:00

jason.woltje merged commit 88a94ddd34 into refactor

2026-11-11 16:30:07 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1934