[Jammy2211]

Closes #572. Phase 4b of the autonomous-orchestrators epic: the unattended glance close-out. Read with the PyAutoMind PR (merge that one first).

What changes

• worker_template.md: a glance worker under a brief ends at PR-open, with no in-turn wait or merge. A notify task still merges in-turn.

• _orchestrator._closeouts, which runs on every tick after the reap:

  • It first reaps running close-outs from <task>.closeout. A session that is gone without a verdict is recorded as refused.
  • For each PR a worker named, it checks the guards the watcher can see with its own reads: the recorded tier is glance; gh pr checks is green (pending waits a tick, red is refused); merges plus in-flight close-outs are under merge-cap:; the shift is not shadow.
  • It then starts one close-out via spawner.spawn_closeout, never two for the same PR.
  • A merged verdict increments glance_auto_merges, marks the PR merged, and queues one stage-2 row. Every refusal is final for the shift.

• closeout_template.md (new), started as claude --bg --name shift-close:<task> --model opus. The session:

  • runs the Witness: itself;
  • reviews the diff adversarially against the fixed list of "substantive" changes;
  • refuses on the decision-taken label, a non-glance tier or Heart RED;
  • otherwise runs the /prm close-out, queuing its Mind changes through shift_ledger, and writes the verdict file.

  The label and Heart are checked here, not in the watcher, so the watcher's network surface is unchanged (human, 2026-11-04).

• _mind_writer: a table-append op plus table_append(), which inserts a row after the last table line under a named ## heading so later sections stay put.

• _digest: each PR's line shows merged unattended (close-out, <model>), close-out running, or awaiting /prm — close-out refused: <why>.

• AUTONOMY.md — "Stage-2 adversary amendment — 2026-11-04" (human): the adversary leg of an unattended merge may be the same model (Opus 5.5) when it is a fresh, independent close-out session that runs the witness itself. Any stage-2 row reverted or amended merged-after-substantive-change restores the different-model requirement. The unattended-merge rule and Consumers point at it, and 4 doctrine tests pin it.

• Docs: conductor AGENTS.md and skills/batch/batch.md. The 3d digest test fixture gains a health stub and a close-out-capable spawner, because that shift now reaches the close-out step.

API Changes

None to the libraries. Inside the organ: the close-out session, the table-append op, and the <task>.closeout verdict contract.

Witness

tests/test_orchestrator_closeout.py — 13 passed
  green glance PRs → exactly one close-out each, never twice over three ticks
  merged verdict → glance_auto_merges 1, PR merged, one table-append stage-2 row; digest says merged unattended
  guards alone: tier notify → refused; CI FAILED → refused, RUNNING → waits then starts; merge-cap counts in-flight; cap 0 → none; shadow → none
  refused verdict → digested "awaiting /prm — close-out refused: decision-taken label", never retried
  session gone without a verdict → refused, never retried
  closeout_command: shift-close:<task>, --model opus, mode checked (bypassPermissions refused)
  table_append keeps the following section; real git: one stage-2 row lands on Mind main, later section kept
  controls: never-twice check removed → 4 fail; tier guard removed → 1 fails
tests/test_autonomy_doctrine.py — 23 passed (4 new for the amendment)
full suites (PYAUTO_* unset): Brain 1538 passed, 1 skipped, 2 failed (test_prompt_budget [50001-*], same on main) · Mind 716 passed
tenant firewall (organ code) --root <worktree>: OK

Not exercised here: a real claude --bg close-out session merging a real PR. That is the pilot's job (4c), and the first live merges are stage-2 rows the human reads.

Tier: judge — merge mode: human /prm. Heart YELLOW (autofit_test MultiStartResumeNaNCounters.py timeout; no release rehearsal) acknowledged by the human at ship.

🤖 Generated with Claude Code