# Track Specification: Tier 2 Autonomous Sandbox (unattended track execution with bounded blast radius)

**Track ID:** `tier2_autonomous_sandbox_20260616`
**Status:** Planned (spec pending user review)
**Priority:** A (user-blocking; eliminates the manual `permission: ask` bottleneck for well-regularized tracks)
**Owner:** Tier 2 Tech Lead (per `conductor/workflow.md`)
**Type:** feature (meta-tooling — adds a new execution mode to the existing MMA workflow, not to the Manual Slop app itself)
**Scope:** ~7 new files in main repo + 1 sibling clone at `C:\projects\manual_slop_tier2\` (one-time bootstrap)
**Parent tracks:** `opencode_config_overhaul_20260310` (shipped; established the agent profile scaffolding this track extends)
**Sibling tracks:** none (independent)

> **Note on effort estimates:** this spec measures effort by **scope**
> only (N files, M sites, N tests). The user / Tier 2 agent decides
> the actual pacing.

---

## 0. TL;DR

This track adds an **unattended execution mode** for Tier 2: you open
OpenCode in a sibling clone (`C:\projects\manual_slop_tier2\`), type
`/tier-2-auto-execute <track-name>`, and Tier 2 runs the track
autonomously — **no `permission: ask` prompts** — while a **3-layer
defense-in-depth** enforcement stack prevents it from touching the
filesystem outside its clone + an app-data temp dir, and from running
destructive git operations (`git restore`, `git push*`, `git checkout`,
`git reset`). If Tier 2 can't make progress (3 red-phase failures, 3
green-phase failures, or 30 minutes with no commit/green), it stops
early, writes a failure report, and notifies you. You review the
feature branch with Tier 1 in the main repo, then merge.

**Scope:** 7 new files in main repo (mostly config + scripts + 1 small
Python module), 4 new test files, 1 PowerShell wrapper, 1 bootstrap
script, 1 user guide. ~600 lines of new code.

---

## 1. Overview

### 1.1 The State Before This Track (as of `88e44d1c`)

The current OpenCode configuration has these properties:

- **One repo, two modes via agent profile.** `opencode.json:11` sets
  `default_agent: "tier2-tech-lead"`. Tier 1 and Tier 2 are
  distinguished by which agent profile the user selects in the OpenCode
  session, not by which directory they're in.
- **Permission bottleneck on Tier 2.** `.opencode/agents/tier2-tech-lead.md:6-9`
  sets `permission: { edit: "ask", bash: "ask", 'manual-slop_*': allow }`.
  Every `edit` and every `bash` call from Tier 2 prompts the user for
  approval. For well-regularized tracks (TDD red/green/refactor with
  atomic per-task commits, e.g., the upcoming `result_migration_*`
  tracks), this is **noise** — the user has already pre-approved the
  track plan, and the per-task approval doesn't add safety, it just
  adds 50+ clicks per track.
- **No filesystem boundary enforcement.** Tier 2 has the same
  filesystem access as the user. There is nothing preventing Tier 2 (or
  a delegated Tier 3 worker) from reading `C:\Users\Ed\.aws\credentials`
  or writing to a different project entirely.
- **No git ban enforcement.** Nothing prevents Tier 2 from running
  `git restore`, `git push origin`, `git checkout -- <file>`, or
  `git reset --hard`. These are the four operations the user has
  called out as "destructive to its progress or affects the origin
  server" in the original ask.
- **No failure threshold / give-up mechanism.** A stuck Tier 2 runs
  until the user notices or the agent self-terminates. There is no
  "3 red-phase attempts without progress → stop and write a report"
  guardrail.
- **One OpenCode session at a time.** The main repo's OpenCode session
  is the only execution environment. Tier 2 cannot run in parallel with
  Tier 1 review.

### 1.2 The Goal

Add a **second execution mode** for Tier 2 that is:

- **Autonomous** — no `permission: ask` prompts for `edit` or `bash`
- **Sandboxed** — file access is restricted to the Tier 2 clone + an
  app-data temp dir, enforced at 3 independent layers (OpenCode
  permission system, Windows restricted token + ACLs, git hooks)
- **Bounded** — a one-shot run with a failure threshold; stuck runs
  stop early and write a report
- **Reviewable** — the run produces a feature branch in the clone;
  the user fetches it back to main and reviews with Tier 1
- **Opt-in to the app's test suite** — the sandbox / bootstrap / smoke
  tests are env-var-gated so the default `uv run pytest` run stays
  app-focused and fast

The main repo (the Tier 1 control plane) is **not modified** —
`opencode.json` stays the same (Tier 1 still has `permission: ask`),
and the existing MMA agents stay the same.

### 1.3 What the User Experiences

**One-time bootstrap (the user runs once):**
```powershell
cd C:\projects\manual_slop
pwsh scripts/tier2/setup_tier2_clone.ps1
```

**Per-track invocation (the user's normal flow from now on):**
1. `cd C:\projects\manual_slop_tier2`
2. Open OpenCode in that directory (the "Tier 2 Sandboxed" desktop
   shortcut the bootstrap created)
3. In the OpenCode session, type:
   ```
   /tier-2-auto-execute result_migration_review_pass
   ```
4. Tier 2 fetches the spec, creates `tier2/result_migration_review_pass`
   branch, runs the plan, commits per task
5. On success: prints a summary. On give-up: writes a failure report
   and prints its path.
6. `cd C:\projects\manual_slop` (back to main)
7. `git fetch C:/projects/manual_slop_tier2 tier2/result_migration_review_pass`
8. Review the diff with Tier 1 (interactive)
9. `git merge --no-ff tier2/result_migration_review_pass` to main

**No `permission: ask` prompts in step 4.** If a Tier 2 tool call
attempts a banned operation, the OpenCode permission system denies it;
if a delegated Tier 3 worker tries to escape via a Python subprocess,
the Windows ACLs deny it; if a `git push` somehow slips through, the
pre-push hook blocks it. **Three independent layers, all enforcing the
same ban list.**

---

## 2. Current State Audit (as of `88e44d1c`)

### 2.1 Already Implemented (DO NOT re-implement)

- **OpenCode agent profile scaffolding** —
  `.opencode/agents/tier{1,2,3,4}-*.md:1-200` and the
  `opencode.json:1-50` config file. The `tier2-autonomous` agent
  profile this track adds follows the same pattern.
- **Slash command pattern** — `.opencode/commands/conductor-implement.md:1-100`
  is the existing pattern for slash commands. The
  `tier-2-auto-execute.md` command follows the same structure (front
  matter `agent:` and `description:`, markdown body with protocol).
- **Conductor track convention** — `conductor/tracks/<id>/{spec,plan}.md`
  and `metadata.json` per `conductor/workflow.md` "State.toml
  Template" + "Track Dependencies and Execution Order" sections. This
  track's artifacts follow that pattern.
- **Project-level test opt-in convention** — the `live_gui` fixture
  in `tests/conftest.py` and the existing env-var-gated tests (e.g.,
  the `RUN_LIVE_GUI=1` pattern in `tests/test_live_*.py`). The
  `TIER2_SANDBOX_TESTS=1` opt-in gate for this track's sandbox tests
  follows the same shape.
- **PowerShell-based tooling** — `scripts/` already contains
  PowerShell-adjacent Python scripts. The new wrapper is a pure
  PowerShell script, consistent with `pywin32`-based operations on
  Windows.
- **`scripts/audit_*.py` pattern** — the 4 existing audit scripts
  (`audit_exception_handling.py`, `audit_weak_types.py`,
  `audit_main_thread_imports.py`, `audit_no_models_config_io.py`) are
  the project's enforcement mechanism. This track does not introduce
  a new audit (the failcount thresholds are TOML-config, not
  statically checkable), but follows the `scripts/audit_<name>.py`
  naming for any future addition.

### 2.2 Gaps to Fill (This Track's Scope)

**Gap 1: A second clone as the Tier 2 execution environment.**

The main repo (`C:\projects\manual_slop\`) currently doubles as both
the Tier 1 control plane and the Tier 2 execution environment. The
fix is a sibling clone at `C:\projects\manual_slop_tier2\` with
`origin` set to the main repo's local path (no remote). The clone is
where the feature branch lives; the user fetches the branch back into
main for review.

**Gap 2: A `tier2-autonomous` agent profile with deny rules.**

The existing `tier2-tech-lead` agent has `permission: ask` for `edit`
and `bash`. The fix is a new `tier2-autonomous` agent profile (in the
Tier 2 clone's `opencode.json`) with:
- `permission.edit: allow`
- `permission.bash: { "*": "allow", "git push*": "deny",
  "git checkout*": "deny", "git restore*": "deny", "git reset*": "deny" }`
- `permission.read` / `permission.write` restricted to the Tier 2
  clone + `C:\Users\Ed\AppData\Local\manual_slop\tier2\`

**Gap 3: A sandboxed launcher (Windows restricted token + ACLs).**

OpenCode's permission system is process-level. A determined Tier 3
worker calling `os.system("...")` from a delegated Python script
could in principle bypass OpenCode. The fix is a PowerShell wrapper
that:
- Acquires a Windows restricted token (drops `SeBackupPrivilege`,
  `SeRestorePrivilege`, `SeTakeOwnershipPrivilege`, `SeDebugPrivilege`,
  `SeLoadDriverPrivilege`)
- Sets explicit ACLs on the Tier 2 clone + app-data temp dir (allow
  the restricted token, deny everything else)
- Wraps the process tree in a Job Object (no breakaway)
- Launches OpenCode + the MCP server under the restricted token via
  `CreateProcessWithTokenW`

**Gap 4: A `tier-2-auto-execute` slash command.**

The existing slash commands are conductor-style ("start
implementation", "create track"). The new slash command takes a
`<track-name>` argument, fetches the spec from `origin/main`, creates
a `tier2/<track-name>` branch via `git switch -c` (NOT `git checkout`),
runs the plan via Tier 2, monitors the failcount, and reports back.

**Gap 5: A failure threshold + give-up mechanism (`failcount.py`).**

The current Tier 2 has no built-in "I can't make progress" detection.
A stuck agent burns tokens until the user notices. The fix is a pure
Python module that tracks three orthogonal signals:
- `red_phase_failures` (3 = give up)
- `green_phase_failures` (3 = give up)
- `no_progress_minutes` (30 = give up)

Whichever signal hits its threshold first triggers give-up. The
module is pure logic, fully unit-testable, with a TOML config for
threshold overrides.

**Gap 6: A failure report writer + flag file + notification.**

When give-up fires, the system needs to:
- Write a markdown report to
  `C:\Users\Ed\AppData\Local\manual_slop\tier2_failures\<track>_<utc-timestamp>.md`
  with: header, tasks completed, current task state, last 3 failures,
  failcount state, git log, recommendation
- Create a `.STOPPED` flag file alongside the report
- Print a clear "TRACK ABORTED" banner in the OpenCode session with
  the report path
- Optionally: Windows toast notification (opt-in via `--toast` flag)

**Gap 7: Git hooks as defense-in-depth (Layer 3).**

The OpenCode permission system is the primary enforcement for git bans.
A pre-push hook (`pre-push` in the clone's `.git/hooks/`) is the
backup that catches `git push origin*` even if the OpenCode deny rule
is somehow misconfigured. A `post-checkout` hook logs any checkout of
tracked files to a detection log.

**Gap 8: A user guide for bootstrap + invocation + manual verification.**

The user needs to know:
- How to run the bootstrap once
- How to invoke the slash command
- What the failure report looks like
- How to review and merge the feature branch
- How to manually verify the sandbox blocks the banned operations

---

## 3. Goals

- **Eliminate the `permission: ask` bottleneck** for well-regularized
  tracks. The user clicks zero times during a normal Tier 2 run
  (excluding the "did Tier 2 give up?" check at the end).
- **Enforce the 4 hard git bans** (`git restore`, `git push*`,
  `git checkout`, `git reset`) at 3 independent layers (OpenCode,
  Windows OS, git hooks). A bypass of one layer is caught by another.
- **Enforce the filesystem boundary** (Tier 2 clone + app-data temp
  only) at 2 independent layers (OpenCode path allowlist, Windows
  ACLs). Even a delegated Python subprocess can't read outside the
  allowlist.
- **Bound the blast radius** with a failure threshold. A stuck Tier 2
  stops within ~30 minutes and writes a report, instead of running
  indefinitely.
- **Keep the default test run app-focused.** All sandbox/bootstrap/
  smoke tests are env-var-gated; `uv run pytest` with no env vars
  stays fast and never touches the Windows ACL subsystem.
- **Keep Tier 1 unchanged.** The main repo's `opencode.json` is not
  modified. Tier 1 retains its `permission: ask` workflow.

## 4. Functional Requirements

### 4.1 Bootstrap (one-time, user-driven)

**FR1.1:** `scripts/tier2/setup_tier2_clone.ps1` (new) clones the
main repo to `C:\projects\manual_slop_tier2\`, sets
`origin = C:\projects\manual_slop`, copies the agent/command/
opencode.json templates to the clone, installs the git hooks into
the clone's `.git/hooks/`, creates the app-data temp dir
`C:\Users\Ed\AppData\Local\manual_slop\tier2\` with restricted ACLs,
and creates a "Tier 2 (Sandboxed)" desktop shortcut.

**FR1.2:** The bootstrap is idempotent — re-running it does not
destroy an existing clone's feature branches (it `git fetch origin`
and pulls the latest templates, but does not `git reset` the clone).

**FR1.3:** The bootstrap dry-run mode (`-WhatIf`) shows what would
happen without making changes. Required for safety.

### 4.2 The tier2-autonomous agent profile

**FR2.1:** `.opencode/agents/tier2-autonomous.md` (template) in main
repo; copied to Tier 2 clone during bootstrap. Defines the
autonomous-mode agent with the deny rules in §2.2 Gap 2.

**FR2.2:** The agent's `temperature: 0.4` (matches Tier 2 Tech Lead).
The agent uses `git switch -c <branch>` for new branches and
`git switch <branch>` for switching — `git checkout` is banned
project-wide.

**FR2.3:** The agent prompt includes the failcount monitoring
contract: "After each task commit, check
`<app-data>/tier2/<track>/state.json` via the failcount module. If
`should_give_up` returns true, write the failure report and stop."

### 4.3 The sandboxed launcher

**FR3.1:** `scripts/tier2/run_tier2_sandboxed.ps1` (new) is the
entry point that opens OpenCode in the Tier 2 clone under a
restricted token.

**FR3.2:** The wrapper acquires a restricted token via .NET
(`CreateRestrictedToken`), sets ACLs on the Tier 2 clone + app-data
dir to grant the restricted token read/write, wraps the process
tree in a Job Object, and launches OpenCode + the MCP server under
the restricted token via `CreateProcessWithTokenW`.

**FR3.3:** The wrapper is the target of the "Tier 2 (Sandboxed)"
desktop shortcut created during bootstrap. Right-click → Properties
shows the command: `pwsh -File C:\projects\manual_slop\scripts\tier2\run_tier2_sandboxed.ps1`.

### 4.4 The slash command

**FR4.1:** `.opencode/commands/tier-2-auto-execute.md` (template) in
main repo; copied to Tier 2 clone during bootstrap. Takes a
required `<track-name>` argument.

**FR4.2:** The slash command:
1. Reads `conductor/tracks/<track-name>/spec.md` + `plan.md` from
   the current branch (after a `git fetch origin main`)
2. Creates a `tier2/<track-name>` branch via
   `git switch -c tier2/<track-name> origin/main`
3. Initializes the failcount state file at
   `<app-data>/tier2/<track-name>/state.json`
4. Delegates the plan to the tier2-autonomous agent
5. After each task commit, checks failcount; on give-up, writes the
   report and stops
6. On success, prints a summary (branch name, N commits, M tasks)

**FR4.3:** The slash command's protocol is duplicated in a CLI
entry point (`scripts/tier2/run_track.py`) so the smoke e2e test
can invoke the same logic without spinning up an OpenCode session.

**FR4.4:** The slash command supports `--resume` to continue a
previously-give-up track from the last completed task (state is in
the state.json file). Default behavior: refuse to resume, ask for
explicit confirmation.

### 4.5 The failcount module

**FR5.1:** `scripts/tier2/failcount.py` (new) is a pure-Python module
with no external deps. Exposes:
- `class FailcountState` — the signal state dataclass
- `class FailcountConfig` — threshold loader (from TOML or defaults)
- `def should_give_up(state: FailcountState, config: FailcountConfig,
  now: datetime) -> Result[bool, ErrorInfo]`
- `def record_red_failure(state: FailcountState) -> FailcountState`
- `def record_green_failure(state: FailcountState) -> FailcountState`
- `def record_green_success(state: FailcountState,
  now: datetime) -> FailcountState` (resets no_progress)
- `def record_commit(state: FailcountState,
  now: datetime) -> FailcountState` (resets no_progress)
- `def to_dict(state) -> dict`, `def from_dict(d) -> FailcountState`
- `def load_state(track_name: str) -> Result[FailcountState, ErrorInfo]`
- `def save_state(track_name: str, state: FailcountState) -> Result[None, ErrorInfo]`

**FR5.2:** Default thresholds (override via `failcount.toml`):
- `red_phase_threshold: 3`
- `green_phase_threshold: 3`
- `no_progress_minutes: 30`

**FR5.3:** `should_give_up` returns `True` if ANY signal hits its
threshold. The `now` parameter is injectable for testing.

**FR5.4:** `record_green_success` and `record_commit` reset the
`no_progress_minutes` timer. They do NOT reset the red/green
failure counters (those only reset on the next progress signal of
the same type — e.g., a red failure is reset by a green test that
eventually passes).

### 4.6 The failure report writer

**FR6.1:** `scripts/tier2/write_report.py` (new) takes a track name,
branch name, state, and a list of `TaskResult` records, and writes
the markdown report to
`C:\Users\Ed\AppData\Local\manual_slop\tier2_failures\<track>_<utc-timestamp>.md`.

**FR6.2:** The report contains the 7 sections in order:
1. Header (track, branch, started-at, stopped-at, duration, give-up signal)
2. Tasks completed (list with task IDs, commit SHAs, summaries)
3. Current task state (where it stopped: task ID, phase, worker output, test failure)
4. Last 3 failures (truncated to 50 lines, full output in `..._full.log`)
5. Failcount state at give-up
6. Git state (`git log --oneline tier2/<track> ^origin/main`)
7. Recommendation (heuristic-based: "track too complex", "spec needs clearer plan", "external dependency missing", "review carefully")

**FR6.3:** A `.STOPPED` flag file is created at
`C:\Users\Ed\AppData\Local\manual_slop\tier2_failures\<track>.STOPPED`.

**FR6.4:** The report writer returns the report path on success
(via `Result[str, ErrorInfo]`).

### 4.7 The git hooks (Layer 3)

**FR7.1:** `conductor/tier2/githooks/pre-push` (template) is a
shell/PowerShell script that refuses `git push` invocations to any
remote. The script returns exit code 1 with the message
"Tier 2 autonomous mode: `git push` is disabled. Push the branch
manually from the main repo after review."

**FR7.2:** `conductor/tier2/githooks/post-checkout` (template) is a
detection-only hook that logs any checkout of tracked files to
`C:\Users\Ed\AppData\Local\manual_slop\tier2\tier2_checkout_log.txt`
with a timestamp, the commit hash, and the affected paths.

**FR7.3:** The bootstrap script copies both hooks to the Tier 2
clone's `.git/hooks/` and `chmod +x` (on Linux/WSL) or sets the
executable bit via `icacls` (on Windows).

### 4.8 The user guide

**FR8.1:** `docs/guide_tier2_autonomous.md` (new) covers:
- Why this exists (the `permission: ask` bottleneck)
- One-time bootstrap procedure (with `-WhatIf` instructions)
- Per-track invocation procedure
- The slash command arguments (`<track-name>`, `--resume`, `--toast`)
- The failure report layout (with screenshot/example)
- How to review and merge the feature branch
- The "Verify the sandbox" checklist (manual verification)
- Troubleshooting (common errors: origin not set, hooks not
  executable, failcount.toml missing)

**FR8.2:** The guide includes a "Verify the sandbox" section that
walks the user through attempting each banned operation manually
and confirming the denial. This is the user-driven checklist from
the design.

### 4.9 The test suite (opt-in)

**FR9.1:** `tests/test_failcount.py` (new) — **default-on**. Unit
tests for the failure threshold module. The full test inventory:
- `test_initial_state_zero`
- `test_red_phase_failure_increments`
- `test_green_success_resets_red_counter`
- `test_green_phase_failure_increments`
- `test_no_progress_advances`
- `test_no_progress_resets_on_commit`
- `test_no_progress_resets_on_green`
- `test_threshold_fires_at_three`
- `test_threshold_does_not_fire_at_two`
- `test_multi_signal_independence`
- `test_any_signal_triggers`
- `test_state_persistence_round_trip`
- `test_configurable_thresholds`

Target: 100% line + branch coverage on `failcount.py`.

**FR9.2:** `tests/test_tier2_slash_command_spec.py` (new) — **default-on**.
Loads the slash command markdown, verifies its protocol contract
(argument parsing, git commands, failcount check, report writing).

**FR9.3:** `tests/test_tier2_setup_bootstrap.py` (new) — **opt-in**
(`TIER2_SANDBOX_TESTS=1`). Runs `setup_tier2_clone.ps1` against a
fixture workspace, verifies the side effects (clone exists, origin
set, templates copied, hooks installed, app-data dir created with
ACLs).

**FR9.4:** `tests/test_tier2_sandbox_enforcement.py` (new) —
**opt-in** (`TIER2_SANDBOX_TESTS=1`). The critical test: spawns the
wrapper in a subprocess, inside the sandboxed context attempts
each banned operation, verifies each is denied.

**FR9.5:** `tests/test_tier2_report_writer.py` (new) — **opt-in**
(`TIER2_SANDBOX_TESTS=1`). Invokes failcount until give-up,
verifies the report file is created at the right path with the
right 7 sections.

**FR9.6:** `tests/test_tier2_smoke_e2e.py` (new) — **opt-in**
(`TIER2_SANDBOX_TESTS=1 TIER2_SMOKE=1`). Runs the full pipeline
against a fixture workspace: bootstrap → invoke the CLI entry
point → verify the feature branch exists with 1 commit → verify
the report file is NOT created (success path).

## 5. Non-Functional Requirements

**NFR1. Performance:** the failcount module adds <1ms per check.
The slash command's protocol adds <500ms to a typical Tier 2 task
(spec fetch + branch creation + state init).

**NFR2. Reliability:** the failcount state is persisted after every
commit. A killed run can be resumed (or refused to resume) on the
next invocation. The state file uses atomic write (write to
`state.json.tmp` + `os.replace`) to survive crashes mid-write.

**NFR3. Security:**
- The 4 git bans are enforced at 3 independent layers (OpenCode
  permission system, Windows OS-level via restricted token, git
  hooks). A bypass of one layer is caught by another.
- The filesystem boundary is enforced at 2 independent layers
  (OpenCode path allowlist, Windows ACLs).
- The Tier 2 process tree is wrapped in a Job Object that
  prevents child process escape.

**NFR4. Testability:**
- The failcount module is pure logic, 100% unit-testable without
  any infrastructure.
- The slash command's protocol is duplicated in
  `scripts/tier2/run_track.py` (CLI entry point) so the smoke e2e
  test runs without an OpenCode session.
- All sandbox / bootstrap / smoke tests are env-var-gated
  (`TIER2_SANDBOX_TESTS=1`, `TIER2_SMOKE=1`).

**NFR5. Auditability:** every Tier 2 run writes to
`C:\Users\Ed\AppData\Local\manual_slop\tier2\<track>\state.json`
and (on give-up) `C:\Users\Ed\AppData\Local\manual_slop\tier2_failures\<track>_<timestamp>.md`.
The user can inspect the state at any time.

**NFR6. UX:** the user clicks zero times during a normal Tier 2
run. The "did Tier 2 give up?" check is passive (an OpenCode
banner, an optional Windows toast, and a flag file the user can
check on next Tier 1 session start).

**NFR7. Backward compatibility:** the main repo's `opencode.json`
is not modified. Tier 1 retains its `permission: ask` workflow.
The new agent profile (`tier2-autonomous`) is in the Tier 2 clone
only. The new slash command is in the Tier 2 clone only.

## 6. Architecture Reference

**This track's design follows these existing patterns:**

- **`docs/guide_architecture.md`** §"Threading model" — the
  Tier 2 process tree runs in its own Job Object, isolated from
  the user's main session.
- **`docs/guide_mma.md`** §"Tier 2/3/4 lifecycles" — the Tier 2
  Tech Lead's existing delegation patterns (Task tool to
  `@tier3-worker`, `@tier4-qa`) are preserved in the autonomous
  mode.
- **`docs/guide_meta_boundary.md`** — this track is squarely in
  the "Meta-Tooling" environment (it builds execution infrastructure
  for the agents), not the "Application" environment. No changes
  to `src/*.py`.
- **`docs/guide_testing.md`** §"Authoring robust live_gui tests"
  + the `live_gui` session-scoped pattern — the smoke e2e test
  follows the same opt-in env-var-gated pattern.
- **`conductor/code_styleguides/python.md`** — 1-space indentation,
  CRLF line endings, no comments, strict type hints. All new Python
  code in this track follows this styleguide.
- **`conductor/code_styleguides/error_handling.md`** — the
  failcount module uses `Result[T, ErrorInfo]` per the convention
  (the 3 refactored baseline files use it; the convention is being
  rolled out across the codebase per
  `data_oriented_error_handling_20260606` + the upcoming
  `result_migration_20260616` sub-tracks).

**This track's NEW patterns (the contribution to the codebase):**

- **Sibling clone as execution mode switch** — opening OpenCode in
  a different directory IS the mode switch (no `mode:` flag in
  `opencode.json`, no env var, just a directory).
- **3-layer enforcement stack** — OpenCode permission system +
  Windows restricted token + git hooks. Documented in
  `docs/guide_tier2_autonomous.md` (this track's new guide).
- **Bounded autonomous run with fail-loud** — the failcount module
  is a general-purpose "I'm stuck" detector, applicable to any
  future autonomous run (not just Tier 2). The pattern is
  reusable for any sub-agent that has a contract to follow.

## 7. Out of Scope

- **No changes to the Manual Slop app (`src/*.py`).** This is
  meta-tooling, not the app. The 4 audit scripts
  (`audit_exception_handling.py`, `audit_weak_types.py`,
  `audit_main_thread_imports.py`, `audit_no_models_config_io.py`)
  are not modified.
- **No changes to the main repo's `opencode.json` or MMA agent
  profiles.** The new `tier2-autonomous` profile lives in the
  Tier 2 clone only.
- **No new top-level `src/<thing>.py` files.** Per the file-naming
  convention (`AGENTS.md` §"File Size and Naming Convention"), the
  new code is in `scripts/tier2/`, `conductor/tier2/`, and `tests/`
  (all namespace-isolated by directory).
- **No changes to existing tracks or in-flight work.** The
  `result_migration_20260616` umbrella track, the
  `data_oriented_error_handling_20260606` track, and the
  `exception_handling_audit_20260616` track are not affected.
- **No new audit script.** The failcount thresholds are TOML config,
  not statically checkable. If a future track adds a checkable
  convention (e.g., "all CLI entry points must use Result[T]"),
  the new audit script should follow the
  `scripts/audit_<name>.py` pattern from the existing 4.
- **No WSL2 / Docker / Windows Sandbox variants.** The user
  approved Approach 1 (OpenCode + Windows restricted token + git
  hooks, all native Windows). WSL2 was considered and deferred;
  the failure to run Dear PyGui/ImGui tests in WSL2 was the
  deciding factor.
- **No parallel Tier 2 runs.** The Tier 2 clone is a single
  workspace. Two parallel Tier 2 runs would conflict on the
  feature branch. If parallel runs become a need, that's a
  follow-up track.
- **No `git push` to non-origin remotes.** Even though the deny
  rule is `git push*` (any push), the practical use case is
  "Tier 2 doesn't push at all; the user pushes after review."
  Adding a "push to a tier2-remote bare dir" workflow is a
  follow-up if needed.
- **No automated review of the feature branch.** Tier 1 reviewing
  Tier 2's branch is a future track (out of scope here).

---

**Spec ends.** The implementation plan (`plan.md` + `metadata.json`)
will be written by the `writing-plans` skill in the next phase, after
the user reviews this spec.
