docs(decisions): D28 closed-loop controller + dependency-offloading; self-usable milestone #158

Merged

pdurlej merged 1 commit from claude/decisions-d28-closed-loop into main

2026-06-23 23:15:25 +02:00

claude commented

2026-06-23 23:09:33 +02:00

Collaborator

Summary

Records the 2026-06-23 operator/Codex strategy as D28 and makes D27's "self-usable" trigger concrete.

D28 — gate → closed-loop trust controller. Patchwarden stops asking only "may this PR merge?" and adds "was my last decision good?", calibrating from the answer. Built as three loops:

L1 pre-merge e2e/sandbox/web proof (#150/#151 as evidence-kinds),
L2 post-merge analytics (shipped: post_merge_feedback.v1, #147/#156),
L3 agent feedback contract (repair_instruction.v1 — to build; filed alongside this PR).

Plus the dependency-offloading principle + hard boundary: lean on external tools (Sandcastle, Steel, a future Opik) for execution, but retain the verdict — stdlib core re-evaluates evidence fail-closed/head-bound/sanitized; producer-unavailable → blocked; L3 repair is policy-derived not model-authored; analytics→trust stays operator-gated (#134).

self-usable-milestone.md turns D27's vague trigger into a capability checklist: 3 loops closed + merge frontier crossed safely on platform/openclaw. That checklist is now both the discovery trigger (D27) and the build north star.

Changes

docs/decisions.md — D28 section + summary-table row 28.
docs/product/self-usable-milestone.md (new) — operational definition + checklist mapping to the 3 loops, the merge frontier, and PW-G rows.
docs/STATUS.md — wedge line + entry points point to the milestone; decision-log range → D1–D28.

Does NOT change

Safety floor intact: D20/D24/D26 all bind; the closed loop runs entirely inside it (every loop emits plans/evidence/intent, never side effects). Merge actuation still build-time-banned.
Pure docs; no src/SSoT change, no drift-guard regen.

Verification

unittest discover -s tests — 656 green; git diff --check clean; disjoint files.

Authored by claude per the operator green-light ("D28 + issue L3 + self-usable milestone → rób").

## Summary Records the 2026-06-23 operator/Codex strategy as **D28** and makes D27's "self-usable" trigger concrete. **D28 — gate → closed-loop trust controller.** Patchwarden stops asking only "may this PR merge?" and adds "**was my last decision good?**", calibrating from the answer. Built as three loops: - **L1** pre-merge e2e/sandbox/web proof (#150/#151 as evidence-kinds), - **L2** post-merge analytics (shipped: `post_merge_feedback.v1`, #147/#156), - **L3** agent feedback contract (`repair_instruction.v1` — to build; filed alongside this PR). Plus the **dependency-offloading principle + hard boundary**: lean on external tools (Sandcastle, Steel, a future Opik) for execution, but **retain the verdict** — stdlib core re-evaluates evidence fail-closed/head-bound/sanitized; producer-unavailable → `blocked`; L3 repair is policy-derived not model-authored; analytics→trust stays operator-gated (#134). **self-usable-milestone.md** turns D27's vague trigger into a capability checklist: **3 loops closed + merge frontier crossed safely** on `platform`/`openclaw`. That checklist is now both the discovery trigger (D27) and the build north star. ## Changes - `docs/decisions.md` — D28 section + summary-table row 28. - `docs/product/self-usable-milestone.md` (new) — operational definition + checklist mapping to the 3 loops, the merge frontier, and PW-G rows. - `docs/STATUS.md` — wedge line + entry points point to the milestone; decision-log range → D1–D28. ## Does NOT change - Safety floor intact: D20/D24/D26 all bind; the closed loop runs entirely inside it (every loop emits plans/evidence/intent, never side effects). Merge actuation still build-time-banned. - Pure docs; no src/SSoT change, no drift-guard regen. ## Verification - `unittest discover -s tests` — 656 green; `git diff --check` clean; disjoint files. Authored by claude per the operator green-light ("D28 + issue L3 + self-usable milestone → rób").

Rows
Columns