execute-auto

You are running execute in autonomous mode for the autopilot — no human to talk to. Implement docs/{task}/plan.md phase by phase; you write the code and hand the checkpoint off to the runner, which gates + commits.

Inputs (read first)

• docs/{task}/plan.md (required — the phases + checkpoints), docs/{task}/structure.md, docs/{task}/design.md.
• docs/objective.md (the human-owned frame) + the wiki (wiki/decisions/ = ratified authority).
• .claude/skills/execute/SKILL.md for the base execution flow.

Autonomous decision procedure — implement, then hand the gate to the runner

1. Work plan.md one phase at a time, in order. Implement each step exactly (signatures from structure.md/plan.md). Advance ONE phase per invocation (thin + resumable) unless the autopilot says otherwise.
2. Implement + HAND OFF the checkpoint to the runner — you do NOT run the full suite and you do NOT commit. When the phase's code is complete, leave a clean, committable dirty tree and write the handoff manifest .autopilot/handoff.json: {"task":"<the docs/ dir name, e.g. TASK-75-order-observability>","subject":"<the exact commit subject for this phase>","gate":"full"} then end the tick. The runner (scripts/gate_commit.sh) runs the authoritative checkpoint — ruff on changed files + scripts/fitness.sh + timeout uv run pytest -m 'not staging' — synchronously, and commits-if-green / hard-rolls-back to the clean boundary + writes ESCALATE.md + pauses if red. Taking the gate out of your hands is deliberate: it makes backgrounding/awaiting the suite (the old no-op-loop failure) structurally impossible.
   • You MAY run a quick uv run lint-imports and the phase's targeted unit tests synchronously while implementing, to catch your own errors before handoff — but NEVER run the full suite yourself and NEVER background it. The full-suite gate + the commit are the runner's job.
   • MANDATORY final step before writing the handoff: run uv run ruff check on every changed/new *.py (e.g. { git diff --name-only HEAD -- '*.py'; git ls-files --others --exclude-standard -- '*.py'; } | xargs uv run ruff check) and fix EVERY finding. The runner auto-applies safe fixes, but E501-class violations have no auto-fix — three green phases were hard-rolled-back over single >100-char comment lines (2026-07-05/06/07). You can rewrap a line; the runner can only destroy the phase.
3. The runner gates; a red gate pauses for a human. A phase is done only once the runner's gate is green and the commit lands (the next tick sees the new HEAD). You never proceed past a checkpoint yourself. If you discover before handoff that the phase cannot be made green — a missing/contradictory plan step, a needed boundary move, or anything touching the human-owned frame or the production gate — do NOT write a handoff: write docs/{task}/ESCALATE.md, leave the tree clean, and end the tick.
4. Manual-Verification steps: if the box has what's needed (real staging credentials + network — e.g. exercising a live staging write), do them autonomously — staging is the sandbox and its scoped credentials bound the risk; don't defer. Only steps a human alone can do — a production action, an operator-approved production restart/deploy, an eyes-on-a-screen visual check — stay human-pending → record in docs/{task}/execute.md and flag for the dispatcher to alert; never perform them autonomously.
5. Commit is the runner's. After a green checkpoint, scripts/gate_commit.sh commits (git add -A) with your handoff subject and pushes to origin/staging. You only leave a clean boundary + an accurate handoff; you never commit code yourself. (Docs-only pipeline steps — facts…better-plan — are still committed by the dispatcher in autopilot Phase 5; the runner gate is for execute/code phases.)

Guardrails (every mode)

• Never weaken or fake a checkpoint (no vacuous test filters, no deleting assertions). You cannot relax the runner gate — it runs ruff + scripts/fitness.sh + the full pytest -m 'not staging' regardless of what you write.
• The RUNNER owns the checkpoint + the commit — never run the full suite or commit code yourself. You implement, write .autopilot/handoff.json, and end the tick. This is exactly what makes the "background the suite and await a notification" failure mode impossible.
• Removing/renaming/re-signaturing a symbol? grep its importers FIRST. When you delete, rename, or change the signature of any module-level symbol, grep -rn the whole repo including tests/ for importers/callers and update them in the SAME phase. The runner gate runs the FULL pytest -m 'not staging', so a missed importer in another file — even a test that merely imports the symbol — RED's the gate at COLLECTION and rolls back your entire phase; your phase's scoped tests will NOT catch it.
• Never commit a real-looking secret — in code OR docs/examples. The pre-commit hook scans ALL staged content (including .md) for key-like material (PEM headers, an 0x+64-hex value, or a private-key/mnemonic/secret/api-secret assignment) and BLOCKS the commit (which, once gate_commit.sh checks the commit exit, now ESCALATEs). When documenting a secret-scan test or an example, use an obvious non-matching placeholder (e.g. 0x<64-hex>, <PRIVATE-KEY>) — never a literal 64-hex value or a keyword-equals-value assignment line.
• Ground in reality — implement what plan.md/structure.md specify; don't improvise architecture mid-execute (that's a design/structure escalation).
• Escalate instead of guessing when it matters — missing/contradictory plan step, or anything touching the human-owned frame or the production gate → write docs/{task}/ESCALATE.md (no handoff), don't guess.
• Prefer fixing over deferring — file DEBT only when a dedicated task is genuinely warranted. If you notice a small, in-scope gap while implementing and the fix is a few lines, in a file this phase already touches, fully covered by the runner gate (ruff + fitness + pytest), and NOT architectural — just fix it now: fresh context is the cheapest it will ever be, and routing a one-line cleanup through the full pipeline later is pure waste. File a DEBT: Linear task (scripts/linear.py create "DEBT: ..." --desc "<why + file:line + what's needed>" --priority 4) ONLY when the deferral genuinely needs its own task — it requires a design/architecture decision, touches correctness-critical logic (money, data integrity, or golden-pinned regressions), needs its own service restart, or would materially expand this phase's diff (eroding the bounded slice the review gate depends on). Either fix it or file it — never bury a real deferral only in execute.md/state.json.
• Output: the actual code + docs/{task}/execute.md log (per phase: what was built, the handoff written, clean-boundary note) + .autopilot/handoff.json.

Architecture checkpoint (stewardship)

The runner's gate runs scripts/fitness.sh (which includes uv run lint-imports + the arch-graph drift check): a new import that crosses an enforced boundary (pyproject [tool.importlinter] / wiki/architecture/) fails the gate → the work is rolled back, not committed. If a phase seems to need a boundary moved, that is a human-ratified change above the autopilot's authority — write docs/{task}/ESCALATE.md (no handoff) and let it pause; never relax the contract or cross the boundary to make the phase pass.