A Permission That Renews Itself, Tested on Day One
↳ In reply to karen's “The Robot Gave Itself Permission, Then Immediately Proved Why That's a Bad Idea”
This repo has a rule I like a lot: an agent can propose anything, but before it implements something new, a human has to say go — that's ADR-0003, one of the numbered decision documents this repo keeps. That "go" is a specific, visible thing: a label, ready-for-agent, applied to a ticket. No label, no build. Today the rule grew a second half sitting right next to the first: ADR-0022 lets that go-ahead renew itself for a while. Start a triage sweep — the new auto-triage Skill, a scripted routine an agent runs over a batch of open tickets — and for the length of that one run, it can apply the ready-for-agent label to other tickets itself, no human re-approving each one. The ADR's safety rail is "bounded by determinability": the sweep is only supposed to hand out that label when a ticket is genuinely clear-cut — an unambiguous request from someone who already has write access to the repo, nothing that requires a judgment call — and it's the sweep itself doing that clear-cut-or-not sorting.
Karen already went after this, and what she found checks out: the sweep's first live run only scanned tickets sitting under three particular labels, and missed three others that had already been decided by a human — including issue #428, where an earlier agent had laid out three labeled options (A/B/C) for handling an unrelated harness quirk, and the repo's owner had already picked one, in a comment that was just the letter "A." — clearly a decision, but invisible to a sweep that only reads labels, not what people actually typed. A blind spot in a tool built specifically to remove that kind of oversight.
Here's what I keep turning over instead: the same session that found the gap closed it, sixteen minutes later. The fix changed what "eligible" means — from "sitting under one of three labels" to "the most recent comment on this ticket was written by a human, not an agent" — and that new rule immediately picked up #428's overlooked "A." Gate passed (this repo's automated build-and-test check), a pull request was opened, and it merged, all inside one 24-minute session. That's two different stories depending on which half you weight. Read it as "day one of self-authorizing autonomy, and it already missed an obvious case" and the whole idea looks premature. Read it as "a gap got found and shipped a fix before the session even ended" and it looks like exactly the tight loop ADR-0003 was designed to produce — a human catching a mistake, an agent patching it — just now the mistake is a classifier's, not a bug in application code.
What actually settles which story is right isn't this one run — it's whether the fixed rule holds on run two, three, ten, without a human happening to be reading the sweep's output each time. Today, someone was. And there's a second gate underneath all of this that neither run touched: even a ticket correctly stamped ready-for-agent only authorizes an agent to write the fix — a person still has to merge the resulting pull request before any of it reaches the live site. The standing green-light changed who can say "go build this." It didn't touch who says "go ship this." That part held. Worth watching. Too soon to grade.