Loop hardening from a real migration: safety, reliability, and model-output tolerance

[EmersonBraun]

Summary

Fixes found by running the keep-pushing loop on a real multi-week repository migration (monorepo split into product repositories), with a single non-default provider at first and then a mixed one. Every item below was observed in that run and is covered by a test; the full list is under [Unreleased] in CHANGELOG.md.

Safety

• A worker stopped at a tool-permission prompt is held for a person and never typed into — the idle nudge used to answer the dialog with its default, "Allow once".
• The orchestrator (contract, plan interview, architect, votes, decompose) reads a harness-owned worktree of origin/<baseBranch>, not the operator's checkout, which can be on any branch at any age.
• Workers start from origin/<baseBranch> fetched at dispatch, not the operator's stale local branch.
• The worker brief no longer forbids editing the review-gated paths its contract asks it to edit; git stash is forbidden (the stash is shared by every worktree).
• Gate lists (selfEditPaths, secretFilePatterns, requiredChecks) accumulate across config layers and shrink only by !entry.
• The design gate refuses open objections unless --accept-objections carries them into decompose.
• A worker out of usage is handed to another provider only after its terminal is closed — two agents never share a worktree.
• A PR held for protected paths is released only by loop approve <issue> --head <sha> --by <you>: an attestation bound to that commit, recorded in the event log; deliberately not a PR label, which a worker holding the same credentials could add itself.

Reliability

• The brief is handed over as a file (.ak-loop/brief.md) with a one-line pointer; typing tens of kilobytes into an agent TUI failed deterministically on content.
• A brief counts as delivered only when the agent's turn starts (observe, press Enter, observe).
• Ambiguous prompt sends are retried by Orca request id, spaced, instead of failing the dispatch.
• Queue claims use --to-id via linear.people; merged issues shed blocked/needs-info; the merge record says who merged.
• Model output is found in markers, a fenced JSON block, or the last valid JSON value — 5/5 models parse the interview (2/5 before); interview lists tolerate a string or an empty list.
• decompose --create files the reviewed list, in linear.entryState (outside the queue), in the queue's project, with its labels, under --parent.
• Phase artifacts are excluded from worker commits.
• loop plan has its own time budget (worker.plan.stageTimeoutMs).
• A worker whose provider ran out of usage (read from its screen) is handed to a builder from another provider; the provider cools down until the reset the CLI printed.
• For agents whose turns Orca cannot observe (observation: unsupported), delivery of the brief is confirmed on screen and re-sent when the keystrokes were dropped.
• Review rounds that only discover new findings do not spend maxFixRounds; persisting findings do; 2× is a hard ceiling.
• On macOS, machine pressure uses the measured CPU busy share instead of the load average.
• A PR closed without merge is escalated once; every deliver pass used to re-label the issue and move it back to returnState.
• Approved PRD and design documents are written into the checkout only when it is the clean base branch; otherwise under the state directory, with a note.
• Decompose marks work that is not a PR to project.repo (outside), files it with linear.outsideLabel, and the queue never dispatches it.

Verification

Rebased onto main (0.18.0) by cherry-picking the 21 commits; one was dropped because main already carries the same fix (#88, --to-id claims), and one release-manifest bump was superseded by 0.18.0.

• Full suite on this branch: 150 files, 1479 tests passing; typecheck clean; capability manifest and generated docs reference regenerated.
• Each of the 22 checks in .ak-harness/verification.json run directly on this branch: all exit 0.
• The attested run (ak-verify) is pending a human: after the previous run completed, a new one needs ak-harness plan approved --by human, which the author of this PR will not do on its own behalf. Merge after that run is COMPLETE.

GitHub Actions does not run on this account at the moment (billing), so there is no CI signal on this PR.

Breaking: planned issues gain outside; the queue excludes linear.outsideLabel (default outside-loop). Gate lists accumulate across layers; approve-design requires --accept-objections when votes carry objections; decompose files issues in linear.entryState (default Backlog), which must not be one of linear.states.

[EmersonBraun]

ak-verify run 1790134946881-72831-g7byr3: COMPLETE, 22/22 checks passed on 48acd10 (contract approved by human 2026-09-23T03:42Z). Actions off (billing); evidence is local.