[Jammy2211]

Closes #555. Phase 3a of the autonomous-orchestrators epic — the shift watcher's core, fake workers only. Read with PyAutoLabs/PyAutoMind/pull/524 (merge that one first).

What changes

• agents/conductors/batch/_orchestrator.py (new, stdlib) — tick(brief, mind), in order: (1) STOP in the slot dir → no-op before any other read; (2) brief --check must pass and review-at: must not have passed; (3) tick lock by exclusive create (stale after 10 min or a dead holder); (4) reap leases — .done marker → released, exited without it → dead after a grace, counted, task re-dispatched at most once per shift then abandoned; (5) candidates from plan(..., brief=...); (6) max-workers / max-sessions caps → exclusive-create lease → spawn. State home $PYAUTO_ORCHESTRATOR_HOME or pyauto_wt_root()/.orchestrator (no path in organ code); per brief: STOP, leases/, counters.json, tick.log. FakeSpawner stub workers; RealSpawner refuses ("phase 3b"), and a refused spawn leaves no lease behind.
• bin/orchestrator_watch.py — one tick per call; bin/systemd/pyauto-orchestrator.{service,timer} templates (%h + EnvironmentFile, no workspace path). Installing them is documented as the human's act; nothing here installs or arms anything.
• _brief.py — optional max-workers / max-sessions (defaults 2 / 6), validated.
• AUTONOMY.md — new The watcher's network surface — 2026-11-03: read-only gh pr checks and claude agents --json, one issue comment per shift (3d); opt-in via a human-installed timer, laptop-only, never a write/merge/push/label; revert condition. The hard-invariant network bullet gains it as the third named exception; Consumers entry added. Revert-condition count 11 → 12.
• Docs — the watcher's detail lives in agents/conductors/batch/AGENTS.md "The watcher" (the batch skill keeps a two-line pointer: it is a known over-budget skill, 268 vs main 263).
• Tests — tests/test_orchestrator_watcher.py (16; clause (a) races four real tick processes), 3 doctrine tests.

Next slices: 3b real claude --bg dispatch + permission mode (decided with the human at plan time), 3c one Mind writer, 3d digest + the one comment.

Tier: judge — merge mode: human /prm. Heart YELLOW reason set acknowledged by the human at ship.

Witness

$ pytest tests/test_orchestrator_watcher.py -v   (witness clauses a–e, fake workers)
test_overlapping_tick_processes_dispatch_one_worker_per_task  PASSED
test_a_held_lock_makes_the_second_tick_back_off  PASSED
test_an_existing_lease_is_never_spawned_twice  PASSED
test_a_dead_worker_is_redispatched_once_then_abandoned  PASSED
test_a_dead_lease_waits_out_its_grace  PASSED
test_a_finished_worker_is_released_and_never_redispatched  PASSED
test_stop_is_read_before_anything_else  PASSED
test_stop_halts_a_running_shift_at_the_next_tick  PASSED
test_max_workers_refuses_the_next_spawn  PASSED
test_max_sessions_refuses_past_the_shift_total  PASSED
test_a_cap_that_is_not_a_number_refuses_the_brief  PASSED
test_a_brief_past_review_at_dispatches_nothing  PASSED
test_a_refused_brief_dispatches_nothing  PASSED
test_real_dispatch_is_refused_until_3b  PASSED
test_home_comes_from_the_environment  PASSED
test_entry_script_runs_one_idle_tick  PASSED

$ grep -c 'Revert condition' AUTONOMY.md   → main 11, branch 12
$ pytest tests/test_autonomy_doctrine.py   → 14 passed in 0.07s
$ repos_sync.py --check --only 'tenant firewall (organ code)' --root <task worktree>   → check tenant firewall (organ code): OK
$ batch brief --check PyAutoMind/batches/examples/shift_brief_example.md   → OK ==

full suites (PYAUTO_* unset): PyAutoBrain 1456 passed in 163.14s (0:02:43)  ·  PyAutoMind 712 passed in 69.66s (0:01:09)
repos_sync.py --check --root ~/Code/PyAutoLabs: exit 0 · lifecycle.py check: DRIFT only the pre-existing active/chapter2-explanations.md
skill line-count (report-only): batch 268 vs main 263 — watcher detail lives in agents/conductors/batch/AGENTS.md

🤖 Generated with Claude Code