Agentic delivery

Gated-delivery pattern, not a runtime or standing swarm. Does not replace deep-code-review (review is the bar; this is how work reaches it); one delivery OS per repo. Persisted artifacts are normal English. No files/tools? Say so once, never claim a reference loaded or a command run: write would run: <cmd>, mark unverified-depth. Full gate table, roles, worktree, human-gate, failure text: references/full-map.md.

Task to entry — a match skips INDEX.md; else read it and open only matching rows.

Open references/full-map.md for multi-lane work, a red gate, host sizing, an unattended loop or a human-gate edge case. Sections cited as "SKILL.md <section>" (Conductor operating rhythm, Worktrees and occupancy, Local environment, Environment probe, Gate epistemology, Output contract) now live there.

When to Use

Use when a change spans build plus QA or security, writers would collide, or the owner asked for a feature, migration or release; not a typo. Load idea-critic before any agent-originated "we should" reaches the owner.

Hard rules

• Smallest sufficient team, hats from risk. The Conductor never self-approves. A builder never reviews builder and never wears QA, security or release-approval. Physical or social-engineering security is human-led under written ROE.
• Conductor reacts to a blocked gate, receipt, budget breach or collision; never does a lane's work. After two equivalent failures change approach.
• Low-blast work may collapse adjacent gates; it may not remove independent verification or an applicable human approval.

Missing evidence is UNVERIFIED, never pass. Missing price is UNPRICED, never zero. Missing spend cap is BLOCKED, never unlimited. A lane's completion is G7; G8 is separate and owner-gated.

Exact revision

Every packet names deep-code-review, its scope (FULL/DIFF <base>/FILE <paths>) and the base or reviewed SHA. QA and security get the final SHA; a stale SHA fails closed.

Worktrees

One writer per worktree; assume a shared tree until proven isolated. Preflight: list worktrees and open PRs, claim the work, never duplicate a running lane. Use the repo's own script for repeatable steps. A child lane branches off the parent's local ref, never polls the remote. Spawn a heavy lane only while free RAM >15% and swap is flat (scripts/host_probe.py).

Human gates

Agents prepare; humans approve push, open/merge PR, publish, deploy, external replies or refunds, scopes/secrets/IAM, destructive migrations, force-push, flag flips, waiving a Blocker/High finding.

Standing grant. A grant counts only from an owner-authored artifact: the owner's own commit (author = owner) to CLAUDE.md or the state record, or their message quoted verbatim with date. The agent never creates, widens, extends, or re-dates a grant. Absent or ambiguous means gated. A merge that triggers deploy or publish is a deploy, never covered. Force-push, history rewrite, deploy, secrets, spend, external sends and destructive data stay gated. Park a gated item with its next step and continue.

Ask as Issue: one line, A: (recommended), B:, ≤12 words each; never a list of questions.

Output and failure

Workers return role, exact SHA, artifacts, commands run with exit status, findings with severity and location, remaining risk, cost or UNPRICED. A work item needs Where, Done-when, Verify, Why; missing Done-when or Verify is sent back.

A start or auth failure is no work done. A running lane is not a finished one. Done means verified — a green gate at the exact SHA. A model outage fails the lane closed. No uncommitted writer work without a recovery record.