feat(autonomy): make AUTO_CODE_AUTONOMY=safe the recommended/CI default

.github/workflows/auto-claude-build.yml

@@ -36,6 +36,11 @@ env:
   AUTO_CLAUDE_CI: 'true'                    # Enable CI mode (non-interactive)
   AUTO_CLAUDE_JSON_OUTPUT: 'true'           # Enable JSON output
   ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+  # Autonomy level (ADR-006). 'safe' enables evidence-gated direct-API provider
+  # promotion: a provider runs fully autonomous only after it passes the
+  # recorded AutonomyPolicy gate; unproven providers stay limited. Claude
+  # remains the trusted baseline. Override per run via repo variables if needed.
+  AUTO_CODE_AUTONOMY: ${{ vars.AUTO_CODE_AUTONOMY || 'safe' }}
 
   # Optional: Configure Claude model
   # CLAUDE_MODEL: 'claude-sonnet-4-5-20250929'

apps/backend/.env.example

@@ -54,6 +54,26 @@
 # Set the default provider for all agents (default: claude)
 # AI_ENGINE_PROVIDER=claude
 #
+# Autonomy Level (PRIMARY KNOB — see docs/architecture/adr/ADR-006-autonomy-levels.md):
+# One knob controls how independently agents run. The evidence gate is ALWAYS
+# enforced for direct-API providers: a provider is only promoted to full
+# autonomous coding after it passes the recorded AutonomyPolicy gate
+# (.auto-claude/runtime/provider-smoke-history.json). Unproven providers stay
+# limited no matter the level.
+#   off    - analysis only; no autonomous edits
+#   claude - Claude Agent SDK / Codex CLI full autonomy; direct-API gate OFF
+#            (pre-ADR-006 module default; maximum backward compatibility)
+#   safe   - + direct-API providers (OpenAI, Google, OpenRouter, ...) run through
+#            generic_edit and are promoted to full autonomy WHEN they pass the
+#            evidence gate. Runtime fallback + external MCP bridge + sandbox +
+#            transactional mutating subagents on.
+#   bold   - + SKIPS the evidence gate (power-user; promotes providers
+#            without recorded evidence)
+# Recommended: safe (evidence-driven multi-provider autonomy).
+AUTO_CODE_AUTONOMY=safe
+# Promotion-gate threshold preset (strict | standard | lax; default standard):
+# AUTO_CODE_AUTONOMY_PRESET=standard
+#
 # Runtime Mode Configuration:
 # Claude and Codex CLI support full_autonomous mode. Direct API providers use
 # generic_edit, patch_proposal, or analysis_only.

docs/roadmap/non-claude-provider-autonomy.md

@@ -1,6 +1,14 @@
 # Non-Claude Provider Full Autonomy Roadmap
 
-Status: Draft, in active development.
+Status: In active development.
+Milestone (2026-06-01): OpenAI, Google, and OpenRouter pass the full provider
+e2e suite with stable + live-fault evidence and read **ready** from the
+AutonomyPolicy gate (green readiness badges). Per Principle 4, the live-fault
+probes now derive coverage from built-in fault fixtures, so readiness is proven
+from a CI run without local env toggling. `AUTO_CODE_AUTONOMY=safe` is the
+recommended setting and the shipped `.env.example` default: it promotes these
+three providers to full autonomous coding while the evidence gate stays enforced
+for every other provider.
 Owner: runtime / provider integration track.
 Audience: contributors who land code under `apps/backend/agents/runtime/`,
 `apps/backend/core/providers/`, `apps/backend/cli/runtime_commands.py`,