feat: autonomous orchestrators p4a — shadow shifts + the pilot ledger - #571

Closes #570. Phase 4a of the autonomous-orchestrators epic. Read with the PyAutoMind PR (merge that one first).

What changes

• _brief.py: is_shadow; check refuses a shadow: value other than yes/no. The check is shared with sandbox:.
• _orchestrator.py:
  • Under shadow: yes, _tick_locked runs the same plan, then _propose records each proposal in picks (prompt, tier, pick reason, proposed: true), up to max-sessions:. It takes no lease, starts no worker and counts no session. The tick returns action: shadow.
  • finish_shift queues one batches/pilot/pilot.md row next to the digest append, so both land in one Mind commit.
  • Fix: finish_shift now returns at once when digest.posted exists. Before, a second direct call re-appended the digest to the record, although it still posted no second comment.
• _digest.py:
  • Proposals render as proposed (shadow), and backlog proposals keep their why:.
  • The packet section says nothing was dispatched, and validate asks no packet of a proposal.
  • counter_values is factored out of build.
  • New: PILOT_PATH, PILOT_COLUMNS, PILOT_HEADER, and pilot_row (the human's cells are ?).
• Docs: conductor AGENTS.md, skills/batch/batch.md.

API Changes

None to the libraries. Inside the organ: the shadow: brief key, and the batches/pilot/pilot.md row the watcher writes.

Witness

tests/test_orchestrator_shadow.py — 9 passed
  shadow tick: 0 spawns (a spawner that raises), 0 leases, 0 sessions; proposals with reasons (named task / scoped epic e1)
  second tick proposes nothing new; max-sessions caps proposals
  shadow digest lists proposals, every counter, and passes brief --check
  shadow: yes|no accepted, maybe refused
  pilot row: one cell per column, mode shadow, human cells ?
  real git: exactly one pilot row lands on Mind main beside the digest, header not duplicated; a second finish_shift writes nothing
  control: shadow branch disabled → 6 of 9 fail
tests/test_orchestrator_digest.py — 23 passed (3d unchanged)
full suites (PYAUTO_* unset): Brain 1521 passed, 1 skipped, 2 failed (test_prompt_budget [50001-*], same on main) · Mind 712 passed
tenant firewall (organ code) --root <worktree>: OK

Tier: judge — merge mode: human /prm. Heart YELLOW (autofit_test MultiStartResumeNaNCounters.py timeout; no release rehearsal) acknowledged by the human at ship.

🤖 Generated with Claude Code