Verification-driven merge button: feature map + verify-merge skill + forge pr merge #83

New issue

Closed

opened 2026-10-18 22:47:26 +01:00 by vnprc-agent · 2 comments

vnprc-agent commented

2026-10-18 22:47:26 +01:00

Contributor

Give agents a merge button: a per-project behavior feature map, a verify-then-merge skill, and a forge pr merge command, with merge autonomy graduated by risk class — agents prove a PR behaves, merge the routine majority themselves, and earn wider autonomy on a visible track record.

Primary goals:

Feature-map convention — each agent-driven repo carries verification/features/*.md: one file per behavior area, each answering the same four questions (what exists, how a user reaches it, how to drive it, what usually lies), with a README holding baseline preconditions, the proof standard (success/cancel/error/empty/persistence paths), a top-to-bottom sweep order, and the rule that map drift is fixed in the same PR as the behavior change.
verify-merge skill — skills/verify-merge/ in this repo, shaped on poteto's verification-skill pattern (github.com/poteto/verification-skill-example): match the diff to feature files, drive every reachable entry point through the project's real harness, capture evidence, post the proof comment on the PR, and only then merge. Evidence, never assertion; the skill refuses to merge on skipped coverage without saying so.
forge pr merge — allod/tools gains the missing subcommand: merge by number with an optional proof-comment flag. Thin API wrapper only; gating policy lives in the skill, not the binary.
Graduated autonomy by risk class, not a staging branch — no agent-master; master with cheap revert is the probation mechanism. R0–R1 (docs, comments, dead code, tests): agent merges directly with posted proof, plus a daily digest and one-command revert. R2: agent merges after the cold-reviewer pass, human veto window. R3+ and multi-repo: human gate as today, per risk.md and delegate-impl. Promotion is evidence-based, ledger-style: a class earns the next rung after one week clean (no reverts, no missed coverage); any bad merge demotes it back to human-gate. git-workflow.md gains this ladder in the same PR.

Probation schedule

Week one: R0–R1 only, all repos, with the daily digest as the human's window. At the week review (ledger-style: sightings of clean merges vs any revert), R2 unlocks or the stay extends; R3+ follows the same evidence rule later. The schedule is the trust mechanism — autonomy is earned by class and repo, never granted wholesale, and the human gate always remains one demotion away.

Current state and specifics

forge has no merge subcommand (forge --help: pr ends at comment/close), so every merge is a human session and agent PRs queue on click-through. The merge-gate convention (human restates the owner summary) is right for large arcs and pure friction below that; nothing distinguishes the two today — the risk ladder already does, it just is not wired to merge rights. The pattern to copy is poteto's verification-skill-example: a skill that drives the real product over a CLI contract (doctor / drive / prove / cleanup), a behavior-level feature map instead of a wiki, proof = captured observable state, map maintained as code. Closest existing allod pieces: delegate-impl (review side, pre-merge) and per-repo justfile scenarios; neither drives, proves, nor merges.

Natural pilot: hashpool — regtest scenario runner and justfile targets as the driver; a feature map there (share→quote, epoch rotation, faucet, mint HTTP, admin lever, pool listeners) doubles as the full-flow verification the security review found missing (notes/hashpool/security-review-2026-10-15.md). R0 hashpool PRs (like vnprc/hashpool#47) are the exact probation corpus.

Open items to settle in implementation: confirm the agent identity holds merge rights per repo (surface the API error otherwise, per token-handling rules); merged-state correctness — see allod/tools#246, the button must not trust a stale merged flag; the digest/revert helper is part of the skill, not the binary.

Scope

In scope: this repo's skill + git-workflow.md amendment (autonomy ladder, one-week R0 probation, promotion/demotion rule, digest+revert); the forge pr merge subcommand in allod/tools, referenced here and PR-linked. Out of scope, own issues later: hashpool's feature map and driver bindings, CI-check integration, auto-merge on label, multi-repo orchestration. Validation: allod skill verify-merge prints the skill; one R0 PR merged end-to-end by an agent during week one with the proof comment linked from this issue.

Give agents a merge button: a per-project behavior feature map, a verify-then-merge skill, and a `forge pr merge` command, with merge autonomy graduated by risk class — agents prove a PR behaves, merge the routine majority themselves, and earn wider autonomy on a visible track record. Primary goals: - **Feature-map convention** — each agent-driven repo carries `verification/features/*.md`: one file per behavior area, each answering the same four questions (what exists, how a user reaches it, how to drive it, what usually lies), with a README holding baseline preconditions, the proof standard (success/cancel/error/empty/persistence paths), a top-to-bottom sweep order, and the rule that map drift is fixed in the same PR as the behavior change. - **`verify-merge` skill** — `skills/verify-merge/` in this repo, shaped on poteto's verification-skill pattern (github.com/poteto/verification-skill-example): match the diff to feature files, drive every reachable entry point through the project's real harness, capture evidence, post the proof comment on the PR, and only then merge. Evidence, never assertion; the skill refuses to merge on skipped coverage without saying so. - **`forge pr merge`** — allod/tools gains the missing subcommand: merge by number with an optional proof-comment flag. Thin API wrapper only; gating policy lives in the skill, not the binary. - **Graduated autonomy by risk class, not a staging branch** — no agent-master; master with cheap revert is the probation mechanism. R0–R1 (docs, comments, dead code, tests): agent merges directly with posted proof, plus a daily digest and one-command revert. R2: agent merges after the cold-reviewer pass, human veto window. R3+ and multi-repo: human gate as today, per risk.md and delegate-impl. Promotion is evidence-based, ledger-style: a class earns the next rung after one week clean (no reverts, no missed coverage); any bad merge demotes it back to human-gate. `git-workflow.md` gains this ladder in the same PR. ### Probation schedule Week one: R0–R1 only, all repos, with the daily digest as the human's window. At the week review (ledger-style: sightings of clean merges vs any revert), R2 unlocks or the stay extends; R3+ follows the same evidence rule later. The schedule is the trust mechanism — autonomy is earned by class and repo, never granted wholesale, and the human gate always remains one demotion away. ### Current state and specifics `forge` has no merge subcommand (`forge --help`: pr ends at comment/close), so every merge is a human session and agent PRs queue on click-through. The merge-gate convention (human restates the owner summary) is right for large arcs and pure friction below that; nothing distinguishes the two today — the risk ladder already does, it just is not wired to merge rights. The pattern to copy is poteto's verification-skill-example: a skill that drives the real product over a CLI contract (doctor / drive / prove / cleanup), a behavior-level feature map instead of a wiki, proof = captured observable state, map maintained as code. Closest existing allod pieces: `delegate-impl` (review side, pre-merge) and per-repo justfile scenarios; neither drives, proves, nor merges. Natural pilot: hashpool — regtest scenario runner and justfile targets as the driver; a feature map there (share→quote, epoch rotation, faucet, mint HTTP, admin lever, pool listeners) doubles as the full-flow verification the security review found missing (`notes/hashpool/security-review-2026-10-15.md`). R0 hashpool PRs (like vnprc/hashpool#47) are the exact probation corpus. Open items to settle in implementation: confirm the agent identity holds merge rights per repo (surface the API error otherwise, per token-handling rules); merged-state correctness — see allod/tools#246, the button must not trust a stale merged flag; the digest/revert helper is part of the skill, not the binary. ### Scope In scope: this repo's skill + `git-workflow.md` amendment (autonomy ladder, one-week R0 probation, promotion/demotion rule, digest+revert); the `forge pr merge` subcommand in allod/tools, referenced here and PR-linked. Out of scope, own issues later: hashpool's feature map and driver bindings, CI-check integration, auto-merge on label, multi-repo orchestration. Validation: `allod skill verify-merge` prints the skill; one R0 PR merged end-to-end by an agent during week one with the proof comment linked from this issue.

vnprc-agent referenced this issue from vnprc/hashpool

2026-10-18 23:18:23 +01:00

Verification feature map: behavior-level map the verify-merge skill drives #48