ADR-0403: Withdraw /justdoit's delegated autonomy tier and re-grant it to /go with a circuit breaker

This ADR withdraws the delegated session-scoped autonomy granted to /justdoit by ADR-0121, decommissions that skill, and grants a fresh envelope to its replacement /go. The tier itself survives — the two-provenance model ADR-0121 introduced is sound and stays in the Autonomous Remediation Authority Standard (ADR-0112). What is reopened is ADR-0121’s reconciliation: its explicit finding that the delegated tier needs no blast-radius cap, because scope-binding to one human-named Epic was a proportionate bound. /go fans that same authority out to disposable sub-agents, which changes who exercises it, so the reconciliation was re-argued rather than inherited — and this time it comes with a cap.


Status	Accepted
Date	2026-08-14
Epic	ADO #2251 (Delivery verbs — /go replaces /justdoit); Issue #2252
Supersedes	ADR-0121
Amends	ADR-0112, the ADO Work-Item Conventions Standard

Context

/justdoit delivered an Epic’s children inline. Every file read, every pipeline log tailed and every grep landed in the orchestrating session, so its context window was exhausted around the third child of ten. The recorded pain was never wall-clock: it was that a ten-child Epic took four sessions and a manual wrap-up-clear-paste handover each time.

The two readings of that problem produce different machines, and choosing wrongly would have been expensive. Fan-out for speed means concurrent children, which needs a merge queue and per-child worktrees, and breaks the single-threaded mutation /justdoit was deliberately built on. Fan-out for context keeps mutation serial and changes nothing about safety. The problem is context, so /go is a context firewall: one disposable sub-agent per child, one at a time, returning a short structured verdict while its own window is discarded.

That reframing is what forces this ADR. Three things changed materially from the situation ADR-0121 reasoned about:

A new exerciser. ADR-0121’s compensating control is the human-in-the-loop at grant time: Arron names one Epic, and that naming licenses the broad envelope. Under /go the authority is exercised by sub-agents Arron never sees. The grant is unchanged in scope, but it is now delegated onward, and an ADR that reconciles “human grants, agent acts” does not automatically reconcile “human grants, agent sub-delegates”.
The premise the whole architecture rests on was unverified. Sub-agents were assumed to inherit CLAUDE.md, soul.md and failure-classes.md. If they did not, every worker would operate outside the prime directives while reporting success in their vocabulary — an entire fleet of FC-04 self-reports. This was proven before anything was built (see Verification below).
ADR-0121 explicitly declined a blast-radius cap, on Arron’s instruction, recording “Impose a blast-radius cap anyway — rejected for this tier”. That rejection was defensible for a single agent working serially in one visible session, where Arron could read the run as it happened. It is not defensible when the work is done by workers whose reasoning is discarded and summarised. /go is the estate’s broadest autonomous actuator and was, uniquely, the only one with no cap at all.

Decision

Withdraw the tier from /justdoit and delete the skill. The authority is not renamed or transferred; it is withdrawn, and /go is granted a fresh envelope. /justdoit is removed from claude-config and from all nine documents that named it, atomically with /go landing — a published standard naming a skill that no longer exists is FC-13, orphaned-declaration.

Keep the delegated session-scoped tier, unchanged in shape, and record /go as its sole subject with same tier, new exerciser. The per-invocation human grant scoped to one named Epic remains the control that licenses a broad-grant-minus-hard-stops envelope rather than a whitelist.

Add a circuit breaker as the blast-radius cap this tier previously lacked. The run halts after K=2 failed-or-blocked children, enforced by exit code from go_run.py child-done rather than by the orchestrator remembering to count — a blast-radius control that depends on an agent’s diligence is not a control.

K=2 is derived, not borrowed (FC-16, borrowed-parameter). Measured 2026-08-14: 16 of 500 ADO pipeline runs failed, a 3.2% per-attempt floor. At that rate two failures inside a ten-child run is a ~4% coincidence, so the second failure is already better explained by a shared cause — a bad premise, a red main, a stale worktree, a CLI regression — than by luck. The cost asymmetry settles the rest: a false halt costs one word from Arron and the run resumes, whereas a missed halt lets every remaining child mutate shared repos on a foundation already known to be shaky. K is provisional. The 3.2% floor measures CI reds only; the BLOCKED rate was genuinely unmeasured because /go had never run when K was set. It is recalibrated from observed run data at the Production Readiness Review (Issue #2419), and changing it is an amendment to this ADR, not a quiet tune.

Three fail-closed gates replace the trust /justdoit extended by default:

The work-order contract. A child Issue is fan-out-ready only if it carries Goal, Change, Acceptance, Scope and Depends, each with substance. go_workorder_check.py refuses thin ones by name and /go does not fan out. The orchestrator must never author the spec it then delivers — that produces a fluent, self-consistent, unfalsifiable story with no seam between inventing and building (FC-19, authored-not-observed), the class that turned a 0.7-second cause into a 157-second saving and survived approval into an Epic. The contract is published as a conformance clause in the ADO Work-Item Conventions Standard so the requirement lives where Issues are written, not only where they are consumed.
Independent re-assertion before any Issue closes. A sub-agent’s verdict is an agent’s account of its own work — the same class of evidence as “no errors in the logs” (FC-04, proxy-not-artifact). The orchestrator re-runs the service test plan via /verify where one exists, else the work order’s named Acceptance assertion, from its own session. Where re-assertion disagrees with the verdict, the re-assertion wins.
The sub-agent mechanism must be proven working. A conformance test asserts directive inheritance on every claude version change; a non-green verdict is a fail-safe, not an alert — /go refuses to fan out and degrades to inline serial delivery. Slower, never wrong.

Sub-agents cannot cross a hard stop and have no channel to ask. They return BLOCKED naming exactly what a human must approve. Out-of-scope findings go to snag add, never into the run.

A run state file holds what must outlive any single context — the silences and snapshots taken, and the children completed — so /pause can halt a run at the next child boundary and clean up precisely what that run created. /pause absorbs the brake because the run and the Epic always move together in practice, and two objects that move together do not need two verbs. /drain is untouched: it operates on cc-pool sessions rather than work, and is invoked by cc-pool-manager, the reboot coordinator and the fork-resume test.

Verification

The architecture’s load-bearing premise was proven before anything was built, in both directions — a positive alone would not have distinguished inheritance from the model’s own priors:

Probe	Five Pillars	`pitlab-snapshot`	`borrowed-parameter`	Quiet hours
`go-child` sub-agent, normal session	✅	✅	✅	✅ 21:00–07:00, priority 0
Same model, same host, default system prompt suppressed	ABSENT	ABSENT	ABSENT	ABSENT

The negative control is what makes this evidence rather than assertion: those tokens are unguessable, so the positive result is attributable to inheritance and not to general knowledge. Consequently the agent definition supplies the delivery contract by reference and adds nothing — no copy of the directives, because a duplicated copy drifts silently from its original (FC-13).

Two operational facts fell out of the same work and are recorded because they are not obvious. First, a newly written agent definition is not immediately visible: the first spawn attempt failed with agent type 'go-child' not found while a fresh session started minutes later listed it, and the originating session picked it up later in the same sitting. The registry therefore refreshes on its own schedule rather than only at session start — the propagation delay is real but bounded, and the fail-safe covers the window either way, since a missing agent type is one of the conditions that degrades /go to inline delivery. Second, the contract gate refuses Issue #2252 itself, this ADR’s own parent, because it is written as prose rather than to the contract. That is the gate working, and it is the reason the contract had to be published as a standards clause rather than assumed.

Alternatives considered

Rename /justdoit and keep its ADR-0121 grant. Rejected — Arron’s decision was to withdraw the authority and design the envelope fresh. A rename would have carried forward the explicit no-cap finding without re-arguing it against a fan-out model that ADR-0121 never contemplated.
Parallel children for throughput. Rejected — the recorded problem is context, not speed. Concurrent mutation races the shared CI pool and destroys attributable rollback, and would require a merge queue and per-child worktrees for a benefit nobody asked for. Also rejected: a hybrid “parallel where provably disjoint”, whose disjointness proof is the hard part.
Enrich a thin child Issue from the Epic and design doc, then deliver it. Rejected as FC-19 — the orchestrator would be grading its own homework, and the resulting spec would be unfalsifiable by construction. Fail-closed instead, and publish the contract where Issues are authored.
Trust the sub-agent’s verdict. Rejected as FC-04. Also rejected: a second adversarial verifier agent per child, which doubles spend to settle what a deterministic test plan already settles.
A hard change cap per grant (vulnscan’s ≤10-deploy form). Rejected — it caps successful work, which is the work we want, and forces a re-grant mid-Epic. The breaker caps compounding harm instead. Also rejected: breaker plus ceiling, since a second unjustified number is exactly FC-16.
A separate /stop verb, or one /pause with a scope argument absorbing /drain. Rejected — the run and the Epic always move together, and /drain has three programmatic callers that would break.
A scheduled estate-wide silence and snapshot janitor. Rejected — verified 2026-08-14: zero active Alertmanager silences and zero stale pre-* snapshots. There is no orphan problem to justify a reconciler, and a broad sweep would delete another session’s rollback handle. /pause cleans only what the current run created.
Auto-pickup of Epics from the Grilled column. Explicitly out of scope — Arron’s call to separate automated delivery from context handover and learn the lessons first. Unattended pickup also has an unresolved quiet-hours fail-safe problem.
Headless claude -p or a real cc-pool slot as the worker. Rejected — the first forces a permission-bypass decision and reduces the verdict to string parsing; the second collides with the drain watchdog that owns those slots. The harness Agent tool needs no new infrastructure and returns structure.

Consequences

The estate’s broadest autonomous actuator now has a blast-radius cap for the first time. Change failure rate becomes directly measurable: the breaker counts failed and blocked children per run.
/go carries an SLI — the share of runs delivering an Epic with no context handover — with a zero error budget during early life, deliberately. There is no observed baseline yet, so inventing a steady-state target would itself be FC-16; every miss is investigated until the PRR sets a real budget from measured runs.
The work-order contract is a real adoption cost, not a formality: existing child Issues written as prose will be refused until someone writes the five fields. This is intended. It relocates the authoring effort to where it belongs — a human writing a spec — rather than an agent inventing one at delivery time.
Trust concentrates in three places, all load-bearing: the hard-stop set, the independent re-assertion, and the conformance test’s fail-safe. A hard stop missing from the agent definition is an authority-boundary defect, not a cosmetic omission — the same warning ADR-0121 issued, now applying to a file that many workers read.
The delegated tier has one subject again. A future human-invoked “do the whole thing” actuator inherits this shape — broad grant, hard-stop boundary, per-invocation scope-binding, and a derived circuit breaker — rather than re-deriving it.
/go depends on Claude Code sub-agent semantics, which auto-update and are not pinned. That is the same class of supply-chain exposure as fork-resume, handled the same way: the vendor’s own upgrade triggers the regression test, so nothing depends on remembering.
Whether /pause can reach a sub-agent mid-flight remains unverified. The brake therefore bites only at child boundaries, which is stated as the guarantee rather than assumed away.