epic: autonomous maintainer for a live incentive subnet

[matedev01]

Problem (current state, with file refs)

vanguarstew today is a transparent, supervised co-maintainer of its own repo — it reads PRs, produces a maintainer recommendation, and lets a human (matedev01) take every write action. That posture is deliberate and correct. This epic tracks the work to extend it, on the low-risk surface only, to an arbitrary product repo for a live incentive subnet — without ever loosening the gate on money/consensus code.

The blocker is structural, and every sibling issue in this set is one facet of it. The merge decision on our OWN repo is self-referential: "should I merge this PR?" collapses into "did this change to OUR agent raise OUR benchmark composite?"

• scripts/score_pr_delta.py is a reporter, not a gate (docstring line 27) that bands a composite_mean delta behind a Pareto floor over PARETO_AXES = ("judge_mean", "objective_mean") (line 52), doubled to a public/private target by combine_dual_target() (line 264).
• That delta only exists when the change is to the agent itself (is_agent_submission(), benchmark_pr_policy.py:50; MAINTAINERS = {matedev01, vanguarstew}, line 14). For an arbitrary external PR there is no baseline/candidate artifact pair, so the whole apparatus has nothing to consume.
• The judge fallback cannot discriminate: against the old empty floor every real challenger won 100%, pinning judge_mean at 1.0 (benchmark/baselines.py:375-381, benchmark: judge_mean saturates to 1.0 (judge not discriminating) — surfaced by the v0.9.0 anchor #2379); the real fix (challenger-vs-king, benchmark: judge opponent should be a peer agent (challenger-vs-king), not a deterministic baseline #2382) is documented as unbuilt M2+ scope (benchmark/runner.py:7).
• Even a discriminating judge measures the wrong thing here: the benchmark scores maintainer foresight, not diff correctness/safety (no test/build runs on a candidate patch anywhere in the scoring layer).
• The live decision is unattested: agent/review.py is a plain LLM call with no transcript, evidence bundle, or report_data.
• The runtime cannot act: vanguarstew_runtime/github.py is read-only by construction, output lands in an owner-only 0600 file, and openvang/factory.py can_auto_execute() returns False "ever" (line 434). The owner-action gateway is spec-only (ROADMAP.md:61).

Why it blocks autonomous external maintenance

Autonomous maintenance of an external repo requires answering "is THIS concrete PR correct, safe, and worth merging?" Every mechanism we have answers a different question: "did our agent's planning out-reason a baseline at predicting a repo's future direction?" There is no path from the benchmark delta to a verdict on an external diff, the judge fallback saturates and grades foresight rather than correctness, no live decision is recordable/verifiable by the repo owner, and the runtime has no least-privilege write identity or approval-bound executor. Until each is closed — in order — "autonomous external maintainer" cannot be truthfully claimed for anything.

Proposed direction (coordinating epic; sequences the siblings, re-specifies none)

graph TD
  J2379["#2379 judge saturates to 1.0"] --> J2382["#2382 challenger-vs-king peer opponent"]
  J2382 --> DIFF["diff-correctness harness"]
  GUARD["permanent domain gate"] --> VERDICT["external-repo mergeability verdict"]
  J2382 --> VERDICT
  DIFF --> VERDICT
  VERDICT --> ATTEST["per-decision evidence & receipt"]
  ATTEST --> GATEWAY["owner-action execution gateway (ROADMAP §4)"]
  RUNTIME["org-scale run loop + revocable identity"] --> GATEWAY
  ATTEST --> SAFETY["outcome-tied circuit breaker + revert proposals"]
  RUNTIME --> SAFETY
  GATEWAY --> EARN["earned narrow autonomy on the low-risk surface only"]
  SAFETY --> EARN

Loading

• M1 — Make the verdict real for an external PR. Land the discriminating judge (benchmark: judge_mean saturates to 1.0 (judge not discriminating) — surfaced by the v0.9.0 anchor #2379 → benchmark: judge opponent should be a peer agent (challenger-vs-king), not a deterministic baseline #2382), add the diff-level correctness/safety signal (feat(eval): diff-correctness harness), and combine them plus the permanent domain veto into a mergeability verdict when no benchmark-delta artifact exists (feat(eval): mergeability verdict for external-repo PRs without a benchmark delta #2385, with feat(guardrail): permanent, fail-closed domain gate for subnet-critical paths #2384 as its absolute veto). Keep the anti-Goodhart floor shape of score_pr_delta as the design template.
• M2 — Make the decision auditable. Extend the offline binding chain from the benchmark to the live decision, binding {repo, pr_number, base_sha, head_sha, diff_digest, decision} into report_data with a published receipt (feat(attest): per-decision evidence bundle and receipt for live review decisions #2386).
• M3 — Make the runtime operable at org scale, under least privilege. Org discovery, concurrency, rate-limit-aware polling on a short-lived, per-repo-scoped, revocable installation credential with a distinct acting account (feat(runtime): unattended multi-repo run loop with revocable acting-bot identity #2387).
• M4 — Earn autonomy on the low-risk surface only. Build the owner-action execution gateway (external signer, idempotency, audit, rollback; ROADMAP §4 — the execution track these issues feed) and stand up the post-merge safety net (feat(safety): outcome-tied circuit breaker and post-merge revert proposals #2388). Turn autonomy on for docs / dependency bumps / tests / routine mechanical fixes only, after the track-record gate below is met and published.

Earned-track-record exit criteria (the gate to remove the human on the low-risk surface)

Autonomy is a privilege earned from a measured, published record on this actual repo — never a switch flipped on a spec. Proposed thresholds (to be ratified with the gateway track):

• A minimum sustained volume of supervised recommendations on the low-risk surface that a human then executed (proposal: ≥ 50).
• A measured decision-error rate at or below an agreed ceiling (proposal: ≤ 5% human overrides of low-risk-surface recommendations over the trailing window), computed from the M2 receipts.
• Every decision in the window published as a verifiable evidence bundle + receipt (M2).
• Autonomy activates per action-class and per repo, revocable instantly, and only for the low-risk classes — never wholesale.

Acceptance criteria

• All sibling issues below are closed (or explicitly descoped) in dependency order.
• benchmark: judge_mean saturates to 1.0 (judge not discriminating) — surfaced by the v0.9.0 anchor #2379 closed and benchmark: judge opponent should be a peer agent (challenger-vs-king), not a deterministic baseline #2382 landed, so the judge discriminates before it is relied on for any external verdict.
• A documented mergeability verdict exists for a PR that produces no run_eval artifact, combining the discriminating judge, the diff-correctness signal, and the domain veto.
• Live review decisions are recorded and bound into report_data with a published, offline-verifiable receipt.
• The runtime operates over multiple repos in one org under a short-lived, revocable installation credential with a distinct acting account.
• An owner-action execution gateway exists (external signing, idempotency, audit, rollback) plus an outcome-tied post-merge safety net.
• The earned-track-record gate is met and published before any human is removed from any action class.
• The permanent human gate on owner actions is encoded and tested, not just documented.
• End-state honesty statement is in the repo docs: autonomy is granted only on the low-risk surface; incentive/consensus/money paths remain human-gated forever.

Dependencies

Existing issues (reference, do not recreate):

• benchmark: judge_mean saturates to 1.0 (judge not discriminating) — surfaced by the v0.9.0 anchor #2379 — the pairwise judge saturates to judge_mean = 1.0 and cannot discriminate.
• benchmark: judge opponent should be a peer agent (challenger-vs-king), not a deterministic baseline #2382 — challenger-vs-king peer opponent (the real fix; prerequisite for any judge-based external verdict).

Sibling issues in this set (by exact title):

• feat(eval): diff-correctness harness — run the target repo's own tests on the PR diff and gate on the result #2383
• feat(eval): mergeability verdict for external-repo PRs without a benchmark delta #2385
• feat(guardrail): permanent, fail-closed domain gate for subnet-critical paths #2384
• feat(attest): per-decision evidence bundle and receipt for live review decisions #2386
• feat(runtime): unattended multi-repo run loop with revocable acting-bot identity #2387
• feat(safety): outcome-tied circuit breaker and post-merge revert proposals #2388

Dependency order: #2379 → #2382 → diff-correctness harness → mergeability verdict (with the domain gate as its veto) → per-decision attestation → { org-scale runtime, safety envelope } → owner-action execution gateway (ROADMAP §4) → earned narrow autonomy. The domain gate and the runtime are parallel prerequisites.

Out of scope / stays human-gated

• Permanently human-gated — no autonomy is ever earned here. Incentive, consensus, emission, weights, validator/miner scoring, payment, and wallet code paths. This maps to the existing owner-action set in openvang/factory.py: ONCHAIN_TRANSACTION, WALLET_ACCESS, EMISSION_CHANGE, GOVERNANCE_VOTE, plus GITHUB_WRITE/PUBLICATION on those surfaces (lines 50-99). RoleContract rejects any role granting an owner effect (line 128), and every such effect stays a non-executable ActionIntent requiring external signing + human approval. This epic strengthens that into a tested invariant, never relaxes it.
• Earned autonomy in M4 applies only to the low-risk surface: docs, dependency bumps, tests, and routine mechanical fixes — never to the paths above, and never as a wholesale toggle.
• No specific external org or subnet is named or committed here; the target is framed generically as an external incentive-subnet product repo.
• The detailed design of each facet lives in its sibling issue; this epic only sequences them and defines the earned-autonomy exit.
• Internal repo-set selection and any private evaluation-target details remain anonymized as they are today (combine_dual_target); this epic does not expose them.