Field Rules

Rule 1: Builder Fixed to Coordinator

In wdi-daily-autopilot, roles.builder in .control/custom-dispatch.yaml is fixed to coordinator. Delegating code to subagents led to false completion reports (a subagent claiming the tests passed without editing a file). The coordinating session writes the code itself, test-first.

Rule 2: Read-Only Reviewers

Peer reviewers run read-only. They challenge edge cases and read diffs, but never change code or run builds; only the coordinating session writes. At risk_accepted: low a peer-review bypass is refused, because the code there needs two reviewers who are not the builder.

Rule 3: Windows File Locks (Desktop Process Gate)

On Windows, a running app binary or a background build daemon holds file handles open, and a rebuild or worktree deletion then fails with Access is denied. With the desktop target, wdi-daily-what-to-test checks whether the app binary is still running before it rebuilds. It closes the app only if its own previous smoke run started it; otherwise it reports the PID and stops, so you can close it yourself. It never force-kills a process.

Rule 4: The Loop Runs on Its Own Branch

Spec and ticket authoring happens on the development branch. The loop runs on its own branch, autopilot/<mandate-id>, in an isolated worktree or in a clean checkout used only by that run. It never runs on a shared or dirty checkout.

Rule 5: One Cloud CI Run Per Autopilot Run

The loop commits per ticket, and the local test suite is the evidence during the run. Cloud CI runs once per autopilot run, at the end: when the one PR is marked ready for review, or when the workflow is dispatched once. Pushes during the run start no cloud run.

Rule 6: Machine-Local Smoke Files

Smoke cursors (.work/smoke/last-sync) and runtime manifests belong to one machine. The installer adds .work/smoke/ to .gitignore, so machine-local smoke files never leave the working tree dirty.