feat(autonomy): make AUTO_CODE_AUTONOMY=safe the recommended/CI default#309
Merged
Conversation
OpenAI, Google, and OpenRouter now pass the full provider e2e suite with stable + live-fault evidence and read "ready" from the AutonomyPolicy gate. Enable the evidence-gated `safe` level across the deployment and CI surfaces (the library module default stays `claude` per ADR-006 for backward compatibility): - .env.example: add the AUTO_CODE_AUTONOMY block as the PRIMARY knob and ship it active at `safe` (the config users copy). Documents off/claude/ safe/bold and that the evidence gate is always enforced — unproven providers stay limited regardless of level. - auto-claude-build.yml (real agent-build CI): set AUTO_CODE_AUTONOMY=safe, overridable via the `AUTO_CODE_AUTONOMY` repo variable. - roadmap doc: record the 2026-06-01 milestone and that safe is the recommended/shipped default. `safe` enforces the gate (direct_api_skip_gate=False), so it promotes exactly the three providers that earned evidence and keeps every other provider limited. The Provider Autonomy Probes workflow intentionally keeps its `claude` lock for reproducible evidence runs (its badge-render step already evaluates readiness under `safe`). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Oleg Miagkov <mrobenner@gmail.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThis PR documents and configures the ChangesAutonomy policy configuration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Aligns the .env.example level descriptions with PR-7 (feat/safe-mutating-subagents): safe ships the hardened transactional mutating-subagent surface; bold's distinction is skipping the gate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Oleg Miagkov <mrobenner@gmail.com>
|
OBenner
added a commit
that referenced
this pull request
Jun 10, 2026
Phase D / PR-7 — the final step of "mutating subagents -> safe" (stacked on the PR-6 gate requirement). The protocol is no longer scaffolded: - children are write-scope confined with runtime enforcement (#319), - they stage mutations and export changesets without touching the shared workspace (#320), - the parent applies each child transactionally with per-child rollback and baseline verification (#322), - real conflicts are never auto-applied — they block finish until the parent resolves explicitly (#323), - the whole mechanism is covered by the deterministic subagent_merge_probe (PR-5) which the promotion gate now requires (PR-6). With that evidence chain in place, AutonomyLevel.SAFE now defaults mutating_subagents_enabled=True. bold's remaining distinction is skipping the evidence gate. The explicit AUTO_CODE_MUTATING_SUBAGENTS=false override still opts out (covered by a new test), per ADR-006 precedence. ADR-006's level table updated. The .env.example and UI level descriptions live on the still-open #309/#318 branches and are updated there. Tests: safe-level expectations flipped (autonomy level + direct-API runtime policy grant); explicit env opt-out covered. 694 passed across the affected surface. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Oleg Miagkov <mrobenner@gmail.com>
OBenner
added a commit
that referenced
this pull request
Jun 10, 2026
Phase D / PR-7 — the final step of "mutating subagents -> safe" (stacked on the PR-6 gate requirement). The protocol is no longer scaffolded: - children are write-scope confined with runtime enforcement (#319), - they stage mutations and export changesets without touching the shared workspace (#320), - the parent applies each child transactionally with per-child rollback and baseline verification (#322), - real conflicts are never auto-applied — they block finish until the parent resolves explicitly (#323), - the whole mechanism is covered by the deterministic subagent_merge_probe (PR-5) which the promotion gate now requires (PR-6). With that evidence chain in place, AutonomyLevel.SAFE now defaults mutating_subagents_enabled=True. bold's remaining distinction is skipping the evidence gate. The explicit AUTO_CODE_MUTATING_SUBAGENTS=false override still opts out (covered by a new test), per ADR-006 precedence. ADR-006's level table updated. The .env.example and UI level descriptions live on the still-open #309/#318 branches and are updated there. Tests: safe-level expectations flipped (autonomy level + direct-API runtime policy grant); explicit env opt-out covered. 694 passed across the affected surface. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Oleg Miagkov <mrobenner@gmail.com>
OBenner
added a commit
that referenced
this pull request
Jun 10, 2026
…326) * chore: retrigger CI after base retarget to develop Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Oleg Miagkov <mrobenner@gmail.com> * feat(autonomy): enable mutating parallel subagents at the safe level Phase D / PR-7 — the final step of "mutating subagents -> safe" (stacked on the PR-6 gate requirement). The protocol is no longer scaffolded: - children are write-scope confined with runtime enforcement (#319), - they stage mutations and export changesets without touching the shared workspace (#320), - the parent applies each child transactionally with per-child rollback and baseline verification (#322), - real conflicts are never auto-applied — they block finish until the parent resolves explicitly (#323), - the whole mechanism is covered by the deterministic subagent_merge_probe (PR-5) which the promotion gate now requires (PR-6). With that evidence chain in place, AutonomyLevel.SAFE now defaults mutating_subagents_enabled=True. bold's remaining distinction is skipping the evidence gate. The explicit AUTO_CODE_MUTATING_SUBAGENTS=false override still opts out (covered by a new test), per ADR-006 precedence. ADR-006's level table updated. The .env.example and UI level descriptions live on the still-open #309/#318 branches and are updated there. Tests: safe-level expectations flipped (autonomy level + direct-API runtime policy grant); explicit env opt-out covered. 694 passed across the affected surface. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Oleg Miagkov <mrobenner@gmail.com> * chore: retrigger CI after base retarget to develop Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Oleg Miagkov <mrobenner@gmail.com> * chore: retrigger CI on develop base Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Oleg Miagkov <mrobenner@gmail.com> --------- Signed-off-by: Oleg Miagkov <mrobenner@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
OpenAI, Google, and OpenRouter now pass the full provider e2e suite with stable + live-fault evidence and read ready from the
AutonomyPolicygate (green readiness badges, merged in #308). This enables the evidence-gatedsafelevel across the deployment and CI surfaces.Scope was confirmed as deployment + CI + docs — the library module default stays
claudeper ADR-006 (deliberate backward-compat; ~6 tests encode it). No code default flipped, no tests touched.What changes
apps/backend/.env.example— adds theAUTO_CODE_AUTONOMYblock as the PRIMARY knob and ships it active atsafe(the config users copy). Documentsoff/claude/safe/boldand that the evidence gate is always enforced..github/workflows/auto-claude-build.yml(the real agent-build CI) — setsAUTO_CODE_AUTONOMY: ${{ vars.AUTO_CODE_AUTONOMY || 'safe' }}(overridable via repo variable).docs/roadmap/non-claude-provider-autonomy.md— records the 2026-06-01 milestone and thatsafeis the recommended/shipped default.Why
safeis the right level (notbold)safesetsdirect_api_skip_gate=False, so promotion consults and enforces the recorded evidence gate:→ it promotes exactly the three providers that earned evidence and keeps every other provider (litellm/zhipuai/ollama) limited until they do.
boldwould skip the gate — not what we want.Intentionally NOT changed
AutonomyLevel.default()staysclaude(ADR-006 backward-compat).nightly-provider-autonomy.ymlkeeps itsAUTO_CODE_AUTONOMY: claudelock for reproducible evidence runs; its badge-render step already evaluates readiness undersafe.🤖 Generated with Claude Code
Summary by CodeRabbit
Configuration
Documentation