0.3.x design spec: autonomous delivery loop (automation + perception) [blocked on #194]

[jasonhnd]

Status: HOLD (blocked-by the staged gate #160). Do not start until released.

Doc-first design spec for loopcoder 0.4.0 = "autonomous delivery loop" (automation + perception). Guardrails were split out to the 0.3.2 spec. Code slices are filed only AFTER this spec merges (per docs/PROCESS.md).

Alignment note (2026-06-28, post v0.3.1): scope narrowed to automation + perception; guardrails moved to 0.3.2; P1 attestation already shipped in v0.3.1.

Context

0.3.0 shipped multi-provider workers; 0.3.1 shipped attestation; 0.3.2 (separate spec) adds budget + circuit-breaker guardrails. 0.4.0 is the paradigm jump: the loop runs unattended (system self-drives), human still merges.

Hard prerequisite STILL OPEN (not delivered by v0.3.1)

• A RELIABLE loopreview verifier. v0.3.1 was attestation, not verifier reliability. The claude verifier exceeds the 180s timeout and returns needs-human; gemini cannot run headless (issue [pending] gemini worker/verifier unusable headless on this host (Gemini CLI auth) -- revisit later #188). An unattended tick calling an unreliable verifier only mass-produces needs-human. This must finish before A2.

Scope

Automation (the 0.4.0 core) — gated on a RELIABLE loopreview + the 0.3.2 guardrails

• A1 ROADMAP.md -> issue DAG compiler (idempotent; hidden unit-id marker).
• A2 tick: one unattended pass (scan -> ready-set -> dispatch-wave -> verify-local + loopreview -> report -> wait for human merge).
• A3 periodic trigger (cron / paseo schedule / GitHub Action).

Perception

• D1 discover: auto-file issues from CI failures / labels.
• D2 skills: inject project skill/convention files into the worker prompt.

Out of 0.4.0 scope (0.5.0+)

• E1 MCP connectors; E2 risk gate / optional auto-merge (DECISION NEEDED: whether to break "human always merges"); E3 cloud v2 (conductor as a GitHub Action).

Dependency rule (ready-set, blocked-by labels)

After this spec merges: every slice blocked-by THIS spec; A1 blocked-by spec; A2 blocked-by A1 + 0.3.2 guardrails + reliable-loopreview. IRON RULE: A2 tick must never precede a RELIABLE loopreview verifier (still open) and the 0.3.2 guardrails.

Doc layout (0165)

• Spec files named 0NNN-.md by issue number, with YAML frontmatter; reference under docs/reference/; update docs/reference/architecture.md (living system map).

Constraints

• English-only repo artifacts. Human-merge gate stays. doc-first. Cross-platform Go, no new runtime deps.

[jasonhnd]

Reorg 2026-06-28: 0.4.0 is no longer tracked as a separate held version; work is flattened into a continuous 0.3.x line. This autonomous-loop spec stays HELD, but the gate is now its real prerequisite -- reliable loopreview (#194) -- not the staged HOLD gate (#160). Re-pointed blocked-by:#160 -> blocked-by:#194. Guardrails were already split to 0.3.2 (spec #192, merged). Iron rule unchanged: the A2 tick must never precede a reliable loopreview verifier.

[jasonhnd]

Dependency correction: #194 was the loopreview design spec (now merged/closed), not the implementation. The autonomous tick's real prerequisite is a RELIABLE loopreview verifier == implementation slices #199 -> #200 -> #201 (provider proof). Re-pointed: blocked-by #196 (G2 circuit-breaker, completes 0.3.2 guardrails) + blocked-by #201 (loopreview provider proof); removed the now-satisfied blocked-by #194. Iron rule unchanged: A2 tick only after reliable loopreview + 0.3.2 guardrails.