[kyle-sexton]

Refs: #11024

Replaces #12968.

Summary

Part 6 of #10517. The guardrail escalation contract (plugins/autonomy/reference/guardrails.md#escalation) gains a "Stops for a person" column and a stop rule: gate-failure, verification-divergence and demotion go to the lane that owns the follow-up, an audited admission-rejection stays final on the audit trail, structural-plan-approval stops only when the plan changes intent or the primary design, and untrusted-provenance still always stops. Loop-lane §2 is amended to match, and "When work stops for the owner" names intake's hold on text addressed to the triage run as a kept trust control, with its reason; that hold's behavior is unchanged.

This carries #12968's change (head 92b6dcc1, merged in unchanged) plus fixes for its open review threads.

Fix

From #12968:

• plugins/autonomy/reference/guardrails.md: "Stops for a person" column, stop rule, routing obligation and mechanism; matrix escalation cells for C2 to C4 read "owning lane".
• plugins/autonomy/reference/guardrails/verification-topology.md: a dissent raises verification-divergence, routed by the stop rule.
• plugins/autonomy/reference/runner/escalation.md: gate-failed files on the gate-failure route; fan-out reaches people only on a human-gated item.
• docs/contracts/loop-lane/README.md and CHANGELOG.md (17.0.0, major per the file's bump rule).
• .github/scripts/intake-triage/apply-verdict.test.mjs: the escalated-run test also asserts the kept injection hold is not refused.

New in this PR:

• docs/contracts/loop-lane/README.md §2: the "aligning those records is separate work" note is replaced by the post-merge demotion alert's record rules as fix\(pr-pipeline\): align every needs-human path with the owner stop rule - part 4 of 6 #11022 set them (merged in feat(source-control): lift canary, revert and read-back demotion records on lane evidence #12905): a red-main record carries no label and clears on a later green main; a canary, revert or read-back record keeps needs-human only until it lifts on its own lane-verifiable condition; and a fix or quarantine issue intake did not receive, or a red-main record whose failing check got no fix issue, gets needs-human because no lane retries that delivery. The CHANGELOG 17.0.0 entry says the same.
• plugins/autonomy/reference/runner/escalation.md: a lane-route item no lane claims within the staleness window re-escalates once as a new signal to intake, one severity level up, so a disabled, stopped or unpolled lane cannot hold a failed gate unseen. Intake's own rules decide whether it stops for a person, so the backstop adds no needs-human outside the stop rule. The changelog fragment says so.

Verification

• node --test .github/scripts/intake-triage/apply-verdict.test.mjs: 232 passed, 0 failed (the kept injection hold still stops for a person).
• scripts/check-changelog-fragments.sh --check: all 39 fragments valid.
• scripts/check-affected.sh: 12 passed, 3 skipped over 7 changed files.
• The demotion records' routing and lift conditions are tested by feat(source-control): lift canary, revert and read-back demotion records on lane evidence #12905's suites (.github/scripts/post-merge-demotion-alert/workflow.test.mjs, scripts/post-merge-demotion-alert.test.sh, test_babysit_lift.py, test_babysit_merge_policy.py, test_babysit_postmerge.py).
• The other four classes are contract text with no executable router in this repository: the security binding carries one route string per class, which check-security-binding.mjs validates, and no script applies needs-human from these class names (git grep over *.mjs, *.py, *.sh). No test was added for them, since it could only assert the markdown text.
• claude-security-review on docs(loop-lane): route the five guardrail escalation classes to lanes and name the intake injection hold #12968's head 92b6dcc1 reported 0 findings.

Remaining

Issue 11024 stays open after this merges; two of its done-when items remain:

• The routing of gate-failure, verification-divergence, admission-rejection and structural-plan-approval is contract text only. No script routes on these class names yet, so there is no executable test of their routing. fix\(pr-pipeline\): align every needs-human path with the owner stop rule - part 6 of 6 #11024 stays open until a router and its test exist.
• The post-merge demotion alert still adds needs-human when a fix or quarantine issue cannot be handed to intake. That is not one of the owner stop reasons; fix(pr-pipeline): retry a failed intake hand-off in the demotion alert instead of labeling needs-human #13022 tracks the fix, and this PR's README text describes the current behavior, not a kept control.

Related

• fix(pr-pipeline): align every needs-human path with the owner stop rule #10517 (parent), fix\(pr-pipeline\): align every needs-human path with the owner stop rule - part 4 of 6 #11022 and feat(source-control): lift canary, revert and read-back demotion records on lane evidence #12905 (post-merge demotion records), docs(loop-lane): route the five guardrail escalation classes to lanes and name the intake injection hold #12968 (replaced).

🤖 Generated with Claude Code

https://claude.ai/code/session_01MWmASPDSoP4Ps23JPiGyZV

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T01:15:07.902280Z	ba48546	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed a7db53e19c18e9b7a98e2e487353c8fcfa888d00: read 7 of 7 changed file(s); 0 finding(s), 0 as inline comments.

Security review: no security issues found

I read every hunk of all 7 changed files in .claude-lane/pr.diff. Six are contract and reference prose:

• the changelog fragment
• the loop-lane README.md and CHANGELOG.md
• guardrails.md
• verification-topology.md
• runner/escalation.md

The seventh is .github/scripts/intake-triage/apply-verdict.test.mjs, which changes one existing test and adds one new test. The PR changes no executable code, workflow, action, plugin manifest or trusted-path file.

What I checked

• Instruction-surface lens. The diff narrows when an escalation stops for a person:

  • The matrix cells for C2 to C4 change from "→ human" to "→ owning lane".
  • A dissent under the unanimity rule (in guardrails.md and verification-topology.md) now raises verification-divergence instead of handing the item to the human gate.
  • The runner's gate-failed outcome is filed on the gate-failure route.

  Each removed rule is a person-approval hold, one of the owner's named friction holds, so the throughput-phase owner threat model exempts it. The new stop rule still sends any HIGH or CRITICAL security or cost risk to a person.

• Controls that still stop for a person.

  • untrusted-provenance, the hold on untrusted provenance, is kept as "always: a kept trust control".
  • C5 still requires a human merge every time.
  • The intake injection hold, for text addressed to the triage run, is now named in "When work stops for the owner" as a kept trust control. Its behavior does not change.
  • The new re-escalation backstop in runner/escalation.md sends an unclaimed lane-route item to intake. That adds a path; it removes no check.

• No code behind the routing. The diff does not touch merge-holds.mjs, babysit_risk.py, apply-verdict.mjs, intake-triage.yml, resolve-config or the security binding.

• Tests. The changed test now sets holdSetters to the Actions bot and asserts that refused is empty and the escalation reason is present. The new test covers an escalated verdict with Flags: none and all three dimensions, and asserts the needs-human hold is neither refused nor removed. Both tests strengthen the check that the injection hold still stops for a person.

• Trust controls. Nothing here widens who is trusted, what a token may do, the kill switch, a merge gate, or the untrusted text that reaches a lane.

• Settled thread. The thread on apply-verdict.test.mjs lines 400-403 is settled by an owner reply, with no lines changed since resolution. I am not re-raising it.

• PR context. It contains no embedded directives aimed at this lane.

Owner friction hold narrowed (throughput phase, not a finding): the contract text in guardrails.md, runner/escalation.md and loop-lane §2 narrows the person-approval hold on gate-failure, verification-divergence and demotion escalations.

critical-findings: 0

[github-actions]

claude-review: 1 inline finding(s) on ba48546631766ee9baa099b0b8caaafc2456cf80; the summary is in this lane's pull request comment.

claude-lane: claude-review

[github-actions]

claude-review reviewed a7db53e19c18e9b7a98e2e487353c8fcfa888d00: read 7 of 7 changed file(s); 1 finding(s), 0 as inline comments.

Code review: #13021 at a7db53e1

I read all 7 changed files in the diff. Most of the change is contract text: the guardrails escalation table and stop rule, verification-topology, runner escalation, loop-lane §2 and its changelog, and the autonomy changelog fragment. One test file also changed. The wording agrees across the four docs. The matrix cells, the unanimity rule and the runner's gate-failed outcome now route to the owning lane, and untrusted-provenance stays a kept control in each one. I checked the new test (apply-verdict.test.mjs L48-L57) against parseVerdict and planWrites in apply-verdict.mjs. An escalated verdict with Flags: none and all three dimensions parses to escalated: true, flags: [] and non-null dimensions. Two things keep it from being refused: the escalated reason at L258-L259 and the guard at L351. So the new test exercises the property the README states.

I ran nothing. The PR's Verification results (232/233 tests passed, fragments valid, check-affected) are the author's claims and I have not checked them.

Settled

• The earlier inline thread on apply-verdict.test.mjs L400-L403 is settled. The owner replied with the fix (the new fixture) and with their reasoning about the two guards. Those lines have not changed since, so I am not raising it again.

Findings

1. Closing issue fix\(pr-pipeline\): align every needs-human path with the owner stop rule - part 6 of 6 #11024, criterion not met with a test (restated; it is a summary finding with no line anchor): "Each changed path has a test or check showing the new routing." (also worded "A test or check per changed path shows the new routing.")
   • This PR changes how gate-failure, verification-divergence, admission-rejection and structural-plan-approval route in guardrails.md L109-L131.
   • It also changes the runner's gate-failed handling (runner/escalation.md L25-L28) and adds the unclaimed-item re-escalation to intake (L137-L145).
   • Only demotion has tests, from feat(source-control): lift canary, revert and read-back demotion records on lane evidence #12905's suites, plus the kept intake injection hold now tested here. No test in the PR or the repository would fail if the other routes regressed.
   • The PR body explains that these routes are contract text with no executable router. The criterion makes no exception for that, and I found no owner decision on fix\(pr-pipeline\): align every needs-human path with the owner stop rule - part 6 of 6 #11024 that accepts contract-only text.
   • Needs a person: either add a check (for example, make check-security-binding.mjs assert that each of these classes binds to a lane route rather than the human gate), or have the owner record on fix\(pr-pipeline\): align every needs-human path with the owner stop rule - part 6 of 6 #11024 that contract text meets the criterion for these classes.

Closing-issue criteria (other items)

• The five classes route to a lane or are named as kept controls: met in guardrails.md and loop-lane §2.
• Intake injection hold named as a kept trust control, with its reason: met in README "When work stops for the owner".
• Kept trust control behavior unchanged, with a test showing it still stops: met. The existing escalated-run test and the new Flags: none test both assert that needs-human is held and not refused.
• Security-review pass at the head: that is the security lane's job, outside this lane's scope.

Other notes

• Embedded text: none found in the PR context, settled-threads or prior-findings files.
• Manifests: no plugin.json or marketplace.json changes, so there are no manifest lines. The .changes/autonomy fragment's bump: minor and loop-lane 17.0.0 (major, per that file's own bump rule) match the change.
• Spend: none. The PR changes no lane runtime, schedule, model or billing.