governance: unsupervised work needs a ticket, and delivery is one PR per session #6

New issue

Closed

opened 2026-08-11 16:07:36 +00:00 by agent.teyla · 0 comments

agent.teyla commented

2026-08-11 16:07:36 +00:00

Collaborator

Stable ID: VE-GOV-TICKETS
Source: owner ruling, 2026-08-11 (in-session) — filed retroactively alongside #5, which is the session that prompted it

The rulings

Two governance questions came up mid-session and were answered by the freeholder. AGENTS.md now carries both.

1. Unsupervised work needs a ticket; HITL is the freeholder's call

Unsupervised work needs a ticket. An agent working without the freeholder present has no one to answer a scope question, so the ticket is the scope: no ticket, no unsupervised change.

Supervised work does not. Whether a session runs human-in-the-loop is the freeholder's call, not the agent's, and a freeholder sitting in the loop is a better scope authority than any issue text. In an HITL session, ask and act — the ticket, if one is wanted, can be written after the fact from what the session actually did.

Bounded so it does not read as a general escape hatch: HITL relaxes what may be started without a ticket; it does not relax the perimeter, the gate (just check), or the delivery shape. This ticket and #5 are that clause being used — both written after the work, from what the session did.

2. One PR per session, not per ticket

The delivery unit is the session, not the ticket. Whatever a single working session lands — one ticket, three, or a ticket plus the doc fix it forced — goes out as one branch and one PR. Do not split a session into a PR per ticket; do not leave a session's work spread across two open PRs. Commits inside stay one-concern each; the PR is where the session's story is told.

Branches remain tango/<ticket>-<slug>, named for the session's primary ticket; a session closing more than one names the rest in the PR body, not in the branch name.

Why it needed saying

The old text said branches are "scoped to one ticket", which pulls toward a PR per ticket and, with it, either artificially split sessions or artificially split tickets. The session that prompted this landed a directory port, a bootstrap act in another repo, and two doc updates that the port made false — one story, several tickets.

Changed

AGENTS.md § Version control and delivery and § Work tracking (new subsection Tickets, and when one is required).

Stable ID: VE-GOV-TICKETS Source: owner ruling, 2026-08-11 (in-session) — filed retroactively alongside #5, which is the session that prompted it ## The rulings Two governance questions came up mid-session and were answered by the freeholder. `AGENTS.md` now carries both. ### 1. Unsupervised work needs a ticket; HITL is the freeholder's call > **Unsupervised work needs a ticket.** An agent working without the freeholder present has no one to answer a scope question, so the ticket *is* the scope: no ticket, no unsupervised change. > > **Supervised work does not.** Whether a session runs human-in-the-loop is the freeholder's call, not the agent's, and a freeholder sitting in the loop is a better scope authority than any issue text. In an HITL session, ask and act — the ticket, if one is wanted, can be written after the fact from what the session actually did. Bounded so it does not read as a general escape hatch: HITL relaxes *what may be started* without a ticket; it does not relax the perimeter, the gate (`just check`), or the delivery shape. **This ticket and #5 are that clause being used** — both written after the work, from what the session did. ### 2. One PR per session, not per ticket The delivery unit is the **session**, not the ticket. Whatever a single working session lands — one ticket, three, or a ticket plus the doc fix it forced — goes out as one branch and one PR. Do not split a session into a PR per ticket; do not leave a session's work spread across two open PRs. Commits inside stay one-concern each; the PR is where the session's story is told. Branches remain `tango/<ticket>-<slug>`, named for the session's **primary** ticket; a session closing more than one names the rest in the PR body, not in the branch name. ## Why it needed saying The old text said branches are *"scoped to one ticket"*, which pulls toward a PR per ticket and, with it, either artificially split sessions or artificially split tickets. The session that prompted this landed a directory port, a bootstrap act in another repo, and two doc updates that the port made false — one story, several tickets. ## Changed `AGENTS.md` § *Version control and delivery* and § *Work tracking* (new subsection *Tickets, and when one is required*).

agent.teyla referenced this issue

2026-08-11 16:08:48 +00:00

kanidm: the effector ports off lldap — service accounts, one api-token, no root #5