# I1 Default Full-Chain Autonomy Gates — 2026-08-23

Status: implementation complete and buildbox-green on `fix/i1-default-autonomy` @ `b70f099a7a388cfc56917faaf7554dbcf591ee38`. The branch also incorporates dogfood recovery commit `0d135f4` so full-chain autonomy and restart-safe downstream dispatch are verified together.

This slice repairs the direction-audit finding that the current I1 product invents an owner Merge click after independent Review and required checks. Binding `AWP-PAIN-INVARIANTS.md` Chain 3 requires the original user request to authorize the delivery chain through Review and Merge under the default Policy, with HITL hooks off unless explicitly configured or a genuine authority boundary is crossed.

No owner account login, GitHub publication credential provisioning, FactoryRun, or live repository mutation is part of this slice.

## Required gates

- [x] **G1 — No default owner Merge/refresh action:** canonical U4/U5 UI exposes no `data-command="merge"` or owner required-check refresh action. Reviewing/verifying/ready states explain that reconciliation and trusted Merge continue automatically.
- [x] **G2 — Durable continuation:** approved independent Review schedules exactly one deterministic DBOS workflow keyed by ChangeSet identity. A repeated schedule maps to the same DBOS operation/workflow identity.
- [x] **G3 — Durable check wait:** the DBOS auto-merge workflow repeatedly re-observes repository-required checks through a DBOS durable sleep, not an in-process timer/loop owned by AWP runtime mechanics.
- [x] **G4 — Trusted system authority:** automatic Merge executes through the existing repository-scoped trusted boundary under a control-plane `system` Principal, never the coder/reviewer Agent Principal.
- [x] **G5 — No Approval row:** default full-chain automatic Merge creates zero `Approval` rows.
- [x] **G6 — Fail closed:** pending/missing/failed Review/check/evidence/target conditions do not merge; the durable workflow remains waiting or terminates only for a genuine terminal ChangeSet state.
- [x] **G7 — Downstream Task keeps provider chain:** after trusted Merge, newly dependency-eligible Tasks dispatch through the durable execution dispatcher so DBOS/Fabro remain in the path; no direct lower-level Kubernetes bypass for Task 2+.
- [x] **G8 — Restart contract:** AC-27 no longer manually POSTs Merge after restart. It requires DBOS/review/check reconciliation to reach merged automatically with zero Approval rows. The FactoryRun lookup uses PlanRevision/work-graph identity rather than obsolete `factory_runs.task_id` semantics.
- [x] **G9 — Acceptance contract:** `GOLIVE.md` AC-11 explicitly binds one FactoryRun per PlanRevision/work graph; AC-19 binds default automatic trusted Merge with no second owner action/Approval.
- [x] **G10 — Exact candidate gates green:** focused application/integration/UI tests and full repository `pnpm check` pass on an authorized buildbox for the exact pushed candidate.

## Current implementation shape

- `WorkspaceExecutionDispatcher.completeReview()` schedules durable auto-merge only for an approved reviewer disposition.
- `DurableAutoMergeDispatcher` maps `ChangeSetId -> automerge:<id>` and starts workflow kind `i1-changeset-automerge` through the existing `DurableWorkflowProvider`.
- DBOS registers a second workflow alongside Task dispatch. It runs one reconciliation step, durably sleeps while the ChangeSet is waiting, and retries after restart.
- `WorkspaceExecutionDispatcher.reconcileAutoMerge()` refreshes exact publication required checks, derives a control-plane system MutationContext, and performs trusted Merge only from `ready-to-merge`.
- `requestMerge()` remains as a protected low-level command/test seam, but canonical default UI no longer exposes it as a required owner action.
- post-merge Task dispatch uses the injected durable dispatcher; production composition routes that back through DBOS/Fabro.

## Verification / evidence

Exact candidate: `b70f099a7a388cfc56917faaf7554dbcf591ee38`.

Authorized buildbox: `debian2`, Node `v22.23.1`.

`pnpm check` PASS:

- recursive build/typecheck: PASS;
- ESLint: PASS;
- Vitest: 45 files passed / 2 skipped; 166 tests passed / 5 skipped;
- build: PASS;
- architecture: 6/6 PASS;
- dependency-cruiser: zero violations across 111 modules / 194 dependencies;
- Prettier: PASS.

Focused convergence evidence also proves:

- approved independent Review schedules the deterministic auto-merge continuation;
- automatic trusted merge executes as a `system` Principal;
- default path creates zero `Approval` rows;
- merge replay does not repeat the provider merge mutation;
- repeated downstream dispatch recovery carries one FactoryRun/Task identity, which the durable DBOS dispatcher maps to one deterministic operation;
- the dogfood crash-window regression still recovers a persisted merged ChangeSet without duplicating its AgentRun.

No owner credentials, account login, FactoryRun, publication, or live repository mutation were used for these gates. GOLIVE remains 0/30 until the canonical owner journey is re-proven.