rcourtman
afc4c9275d
Patrol could run some fixes on its own in two paid modes: assisted (Safe auto-fix) and full (Autopilot, behind a server-owned acknowledgement). Schema-v17 telemetry for the week to 2026-10-11 counts 1 assisted and 2 full installs out of 612 reporting Patrol, 4 executed Patrol actions in 30 days, all on one install, and no GitHub request for more autonomy, while the automatic path carried its own policy leases, acknowledgement store, per-resource allowlist, release gate and Colima lab. Investigation is what paid installs use, so it stays. Patrol now has two modes. Watch only reports findings. Ask first investigates and proposes fixes, and every fix waits in Actions for an operator to approve and run it. - A saved assisted, full or autonomous level reads as approval, and the update routes refuse those levels with 400 invalid_autonomy_level. - The core Patrol action broker only plans: Plan and Submit persist the plan and return. ExecuteUnderPolicy, the policy authorization lease, the policy admission store methods, the Autopilot acknowledgement persistence, routes and dialog, and the per-resource automatic-action allowlist (store column now written as NULL) are gone. GetPatrolFullModeUnlocked stays on the extension contract and reports false. - Historical action records keep their policy lease and tenant/resource reason codes decodable, labelled as retired modes. - The Patrol inbox no longer splits issues into "continuing without a decision"; every current issue is an operator decision. - Release gate RG-06 now proves Patrol never executes without an operator decision (integration tier) instead of limited unattended autonomy, and RG-02/RG-04 point at the surviving human-admission proofs. - Pro plan copy, AI docs, privacy telemetry wording and the subsystem contracts describe the two modes.
Docker restart intelligence lab
This ignored-artifact harness exercises one uniquely labelled disposable Docker
container, volume, and network in the existing Colima VM. It refuses any
implicit or non-Colima Docker context, uses the existing alpine:3.20 fixture,
and removes only resources with the exact run label.
Run only after explicit local-lab authorization:
python3 scripts/intelligence_lab/docker_restart_colima.py --run-id task06-20260712-090000
Evidence is written beneath tmp/intelligence-lab/<run-id>/, which is ignored.
Only the explicit redacted JSON, screenshot/trace, report, and checksum
basenames are retained there. Transient Pulse and Unified Agent databases live
under tmp/intelligence-lab-scratch/<run-id>/ and are deleted before the
artifact allowlist and checksum manifest are accepted.
The second cleanup must be a no-op and the preexisting resource inventory must
be unchanged. Container restart has no product rollback; fixture deletion is
lab compensation only.