Add an interactive-agent mutation protocol: dry-run manifest, exemption labels, reversal path

[woksin]

Why

On 2026-08-24 an interactive AI agent session bulk-closed 55 Cratis/Chronicle issues on a staleness heuristic. All were recovered (reopened + stale-review label) because the agent happened to keep the exact list — but nothing required it to.

Boundaries already exist for other actors: Ensemble workers stop before publication effects (Ensemble #8: no commit/push/PR/release/deploy, hash-bound approvals), Chronicle mutations are getting a governed boundary (Chronicle #3812), and Planner triage is server-mediated (Stagehand #7). The uncovered gap is ad-hoc interactive agent sessions (Claude/Pi/Copilot CLI) wielding gh and org credentials directly.

Proposed corpus rule

Before any bulk or destructive mutation (closing issues, deleting branches/labels, force-pushing, publishing), an interactive agent MUST:

1. Dry-run manifest — post the exact target list and action for human review before executing
2. Honor exemption conventions — issues labeled idea or investigate are long-lived by design and exempt from staleness logic, org-wide
3. Reversal path — write the reversal procedure (exact IDs, states, labels) before execution, not after
4. Never mutate on age alone — closure requires positive evidence (verified fixed, verified obsolete, explicit human decision)

Placement

Contract-authority rule in the always-loaded base profile so every harness learns it once.

---

swept-proposal-2026-08-24 — created by an AI agent from the org-wide review, approved by @woksin.

[mahirhir]

For rule 3 (pre-execution reversal path) and ensuring the reversal procedure is machine-executable rather than relying on agent recall:

A robust pattern is pairing the pre-mutation dry-run manifest with a deterministic inverse payload:

1. Pre-commit Inverse Escrow: Before executing mutations over target IDs [#1..#55], capture the exact pre-state snapshot (state: "open", current labels, assignees) and write a single executable rollback script/payload to disk (.agent-reversal/<run-id>.json).
2. Atomic Execution Gate: The harness only authorizes the mutation batch if the reversal payload digest is written and verified.
3. Receipt Trail: If the agent session aborts or network drops midway, a human or recovery script runs replay-reversal <run-id> to restore state with zero manual reconstruction.

We formalized this pre-commit inverse escrow and reversal receipt pattern in https://github.com/TraceFold/tracefold (architecture in docs/TRACEFOLD_TR.md §2.3) for mitigating unconstrained agent CLI tool executions.

[cratis-stagehand]

Thanks for opening this - it has been received and will be looked at.

---

Posted by Stagehand (AI) - an autonomous agent, not a person. Review accordingly.