feat(u4-conduit-parity): --autonomy 起動宣言の導線を全面へ追記しパリティを回帰テストで固定する

README.ja.md

@@ -50,6 +50,7 @@
 - **[10の標準スコープ](docs/guide/05-scopes-and-depth.ja.md)**(enterprise から workshop まで)+ 自由記述からの自動検出、そしてタスクに合わせた EXECUTE/SKIP 計画を提案し、承認された計画を再利用可能な composed スコープとして登録する **adaptive composer**
 - **[3段階の depth と 3段階の test strategy](docs/guide/05-scopes-and-depth.ja.md)** — 成果物の詳細度とテスト量を独立に制御
 - **[全ステージの承認ゲート](docs/guide/07-interaction-modes.ja.md)** — エンジンが強制。1問ずつからファストトラックまでのインタラクションモード
+- **[Intent autonomy](docs/reference/24-intent-autonomy.ja.md)** — 1つの Intent をどこまで自律実行してよいかを `/amadeus --autonomy <none|semi|full>` で宣言(Intent を誕生させる起動でも有効)。`full` は人間によるグラント儀式が別途必要で、無人での裁定はすべてレビュー用に記録されます
 - **[スペースと intent](docs/guide/03-spaces-and-intents.ja.md)** — intent ごとの記録、チームごとのスペース、すべてリポジトリでバージョン管理
 - **[ルールと学習ループ](docs/guide/09-rules-and-the-learning-loop.ja.md)** — 人間の是正が層状のメソッドルールとして永続化。矛盾を拒否する admission check 付き
 - **[2層のナレッジ](docs/guide/08-knowledge.ja.md)** — メソドロジー知識はフレームワークに同梱、チーム・ドメイン知識はワークスペースに蓄積

README.md

@@ -50,6 +50,7 @@ At every stage the leading agent produces reviewable artifacts under the `amadeu
 - **[10 stock scopes](docs/guide/05-scopes-and-depth.md)** (enterprise through workshop) with auto-detection from freeform intent, plus the **[adaptive composer](docs/guide/05-scopes-and-depth.md#the-adaptive-composer)** that proposes a tailored EXECUTE/SKIP plan from your task — and registers approved plans as reusable composed scopes
 - **[3 depth levels](docs/guide/05-scopes-and-depth.md#the-3-depth-levels)** and **[3 test-strategy levels](docs/guide/05-scopes-and-depth.md#the-3-test-strategy-levels)** — artifact detail and test volume, controlled independently
 - **[Approval gates at every stage](docs/guide/07-interaction-modes.md)** — enforced by the engine, with interaction modes from question-by-question to fast-track
+- **[Intent autonomy](docs/reference/24-intent-autonomy.md)** — declare how autonomously one Intent may run with `/amadeus --autonomy <none|semi|full>` (it applies on the launch that births the Intent); `full` still requires the human grant ceremony, and every unattended ruling is recorded for review
 - **[Spaces and intents](docs/guide/03-spaces-and-intents.md)** — per-intent records, per-team spaces, everything version-controlled in your repo
 - **[Rules and a learning loop](docs/guide/09-rules-and-the-learning-loop.md)** — human corrections persist as layered method rules, guarded by an admission check that rejects contradictions
 - **[Two-tier knowledge](docs/guide/08-knowledge.md)** — methodology knowledge ships with the framework; team and domain knowledge accumulates in your workspace

docs/reference/24-intent-autonomy.ja.md

@@ -39,6 +39,32 @@ bun .claude/tools/amadeus-bolt.ts set-autonomy --mode full \
   --confirmed-display-digest sha256:...
 ```
 
+### 起動時にモードを宣言する
+
+`set-autonomy` は正準の記録経路ですが、Intent が既に存在していることを前提とします。
+`--autonomy <none|semi|full>` は同じ宣言を起動の一部として記録します。Intent を
+誕生させる起動でも有効です。
+
+```
+/amadeus --autonomy semi 公開 API にレート制限を追加する
+/amadeus --autonomy none
+```
+
+このフラグは記録の**手段**を追加するものであり、権限の出所ではありません。受理
+されるのは**最初の**宣言のときだけ — モードの provenance がまだ `system-default`
+である間に限られる — ため、人間が既に設定したモードを上書きすることはできません。
+同じモードを再指定した場合は no-op、異なるモードを指定した場合は拒否され
+`set-autonomy` を案内します。`none` と `semi` は唯一の正準書込経路を通ります。
+誕生直後の Intent には引用できる自身の監査履歴がないため、宣言は起動時のキー
+ストロークの human turn へ束縛されます。実 human turn を伴わない起動は明示的に
+拒否され、Intent はモード未設定のまま成立し、最初の宣言は依然として可能なままです。
+
+`--autonomy full` は受理されますが適用されることはありません。`full` の付与は上記の
+儀式そのものであり、起動フラグがそれを代替することはできません。実行はグラントを
+発行する2つのコマンドを表示してそこで停止します。アクティブなグラントがある状態で
+`none` を求める起動も同様に拒否されます。グラントの取消はフラグの副作用ではなく
+意図的な行為だからです。
+
 グラントはグローバルなスイッチではありません。Intent uuid、発行時点の scope /
 norm fingerprint、対象となる対話種別(`stage-gate`・`phase-gate`・
 `walking-skeleton`・`question`)、明示的に禁止する effect 分類を持つ scope

docs/reference/24-intent-autonomy.md

@@ -41,6 +41,33 @@ bun .claude/tools/amadeus-bolt.ts set-autonomy --mode full \
   --confirmed-display-digest sha256:...
 ```
 
+### Declaring the mode at launch
+
+`set-autonomy` is the canonical recording path, but it needs an Intent to already
+exist. `--autonomy <none|semi|full>` records the same declaration as part of the
+invocation, including the invocation that births the Intent:
+
+```
+/amadeus --autonomy semi Add rate limiting to the public API
+/amadeus --autonomy none
+```
+
+The flag is an additional recording *means*, never a source of authority. It is
+accepted only as the **first** declaration — while the mode's provenance is still
+`system-default` — so it can never overwrite a mode a human already set; re-state
+the same mode and it is a no-op, name a different one and the run is refused and
+points at `set-autonomy`. `none` and `semi` go through the one canonical write
+path, and because a freshly born Intent has no audit history of its own to cite,
+the declaration is bound to the launching keystroke's human turn: a launch that
+carries no real human turn is refused loudly, the Intent stands with its mode
+unset, and the first declaration is still available.
+
+`--autonomy full` is accepted but never applied. Granting `full` is the ceremony
+above, and a launch flag may not stand in for it: the run reports the two
+commands that issue a grant and stops there. A launch that also revokes — asking
+for `none` while an active grant exists — is likewise refused, because revoking a
+grant is a deliberate act rather than the side effect of a flag.
+
 A grant is not a global switch. It carries a scope descriptor naming the Intent
 uuid, the scope and norm fingerprints it was issued against, the interaction
 kinds it covers (`stage-gate`, `phase-gate`, `walking-skeleton`, `question`),

packages/framework/core/amadeus-common/protocols/stage-protocol.md

@@ -134,6 +134,8 @@ Quality failure is never approval. In `semi` and `full`, the conductor writes th
 
 For a question under `full`, the conductor writes the normalized question, stable option IDs, applicable norm/history facts, recommendation, and (when available) the native solo-election result to a machine-local JSON carrier, then runs `amadeus-bolt decide-question --input <carrier>`. Use the returned `decided.effect.optionId` as the answer and record it in the questions file; `parked` is a hard stop, and any `human-required`, `conflict`, or `aborted` result fails closed. The user is never asked to author JSON. When no election result is available, the Core records loud degradation before using the recommendation.
 
+For a question under `semi`, the conductor runs the **same** `amadeus-bolt decide-question --input <carrier>` procedure, unchanged — the carrier shape, the five-rung ladder, the `decided.effect.optionId` answer, the loud degradation when no election result exists, the hard stop on `parked`, and the fail-closed handling of `human-required` / `conflict` / `aborted` are identical. Two things differ, and neither is a step of the procedure: the authorization basis is the semi-scoped one (`semi` holds no Intent grant, so the current grant stays null), and pre-decision policies reach the ladder through `--policies-file` as confirmed-policy material rather than through a grant. Under `semi`, therefore, do **not** put a stage question to the human directly: `decide-question` is the route, and a `human-required` result is what sends the question to a person. Milestones are unaffected — a phase boundary, the walking skeleton, and Intent completion still require a human under `semi`.
+
 **Halt-and-ask on failure**
 
 When a Bolt's code-generation returns failure, **always halt regardless of autonomy mode** — the Bolt never proceeds on its own. This is the one case where `autonomous` mode stops to consult. Halting is unconditional; who rules on the halt is decided by the solo auto-election hook below, which names the one branch that does not present the prompt.

packages/framework/core/tools/amadeus-utility.ts

@@ -262,6 +262,7 @@ Utilities:
   --scope <scope>   Set or change scope (standalone or with --stage/--phase)
   --depth <level>   Override depth (minimal, standard, comprehensive)
   --test-strategy <level>  Override test strategy (minimal, standard, comprehensive)
+  --autonomy <mode> Declare the Intent autonomy mode (none, semi, full) — works on the launch that births the intent; full still needs the grant ceremony
   --version         Show the framework version
   --help            Show this help message
 
@@ -279,7 +280,8 @@ Examples:
   /amadeus --phase construction --scope fix    Jump to construction with fix scope
   /amadeus --scope fix --depth comprehensive  Fix with comprehensive depth
   /amadeus --depth minimal                       Change depth of active workflow
-  /amadeus --depth standard --test-strategy minimal  Full artifacts, minimal tests`;
+  /amadeus --depth standard --test-strategy minimal  Full artifacts, minimal tests
+  /amadeus --autonomy semi Add rate limiting       Start with semi autonomy declared`;
 
 /** Exported for t67 unit tests. */
 export function renderHelpText(): string {

packages/framework/harness/claude/skills/amadeus/SKILL.md

@@ -6,10 +6,10 @@ description: >
   `.claude/scopes/`; run
   `bun .claude/tools/amadeus-utility.ts help` for the authoritative list
   and descriptions. Utilities: --status, --doctor, --migrate [path], --stage,
-  --phase, --scope, --depth, --test-strategy, --version,
+  --phase, --scope, --depth, --test-strategy, --autonomy, --version,
   --help, plus the intent and space verbs.
   Or describe what you want to build and the scope will be auto-detected.
-argument-hint: "[description | --status | --migrate [path] | --stage <slug|#> | --phase <name|#> | --version | --help]"
+argument-hint: "[description | --status | --migrate [path] | --stage <slug|#> | --phase <name|#> | --autonomy <none|semi|full> | --version | --help]"
 user-invocable: true
 ---
 
@@ -45,7 +45,7 @@ Loop:
      not `done` alone: `await-completion` is terminal for this turn too.
 ```
 
-Each `next` reads the workflow state and the compiled stage graph and returns **exactly one** typed directive (JSON) on stdout. It mutates no workflow state (its only write is the machine-local sensor-invocation projection under the gitignored hooks-health runtime). The directive's `kind` names the single move to make; you make that move, then `report` commits the resulting transition so the next `next` reads fresh state. **Report once per directive; never call the state tools (`amadeus-state.ts approve/advance/…`) directly** — the engine's `report` dispatches them, and a speculative direct call gets the engine's state-guard error. Pass `$ARGUMENTS` through to the first `next` verbatim — the engine parses flags (`--status`, `--stage`, `--scope`, `--depth`, freeform text, …) and resolves the scope, so you do not pre-parse or strip them.
+Each `next` reads the workflow state and the compiled stage graph and returns **exactly one** typed directive (JSON) on stdout. It mutates no workflow state (its only write is the machine-local sensor-invocation projection under the gitignored hooks-health runtime). The directive's `kind` names the single move to make; you make that move, then `report` commits the resulting transition so the next `next` reads fresh state. **Report once per directive; never call the state tools (`amadeus-state.ts approve/advance/…`) directly** — the engine's `report` dispatches them, and a speculative direct call gets the engine's state-guard error. Pass `$ARGUMENTS` through to the first `next` verbatim — the engine parses flags (`--status`, `--stage`, `--scope`, `--depth`, `--autonomy`, freeform text, …) and resolves the scope, so you do not pre-parse or strip them.
 
 Run the engine binary directly via Bash. If a directive looks malformed or names a move you cannot make, that is an engine signal worth surfacing to the user, never a cue to improvise the routing in prose.
 
@@ -245,7 +245,8 @@ The engine reads the compiled `data/stage-graph.json` directly for all routing;
 
 - **Adaptive scope**: Scope determines which stages execute and at what depth — from 5-stage chore to 32-stage enterprise. The engine owns the resolution; you run the stages it hands you.
 - **STAGE RITUAL IS ATOMIC**: Once a stage starts, EVERY step fires: questions → artifact → reviewer (§12a, if declared) → learnings (§13) → gate. No step is skippable. "Skip to stage X" skips INTERMEDIATE stages, NOT the target stage's ritual. Complete the current stage fully (including learnings) before jumping.
-- **AUTONOMY IS NEVER INFERRED**: A user saying "go with recommended" for one stage is a one-time instruction for THAT stage. The next stage starts fresh. NEVER carry forward autonomy. NEVER self-answer questions without explicit permission for THIS specific stage.
+- **AUTONOMY IS NEVER INFERRED**: A user saying "go with recommended" for one stage is a one-time instruction for THAT stage. The next stage starts fresh. NEVER carry forward that permission, and NEVER self-answer a question on your own judgement. This forbids *inferring* authority — it does not forbid the authority the engine already holds: when the Intent's recorded autonomy mode (`semi` / `full`) resolves a gate or a question through the engine's own ladder, that is a recorded human declaration being executed, not an inference, and you follow the directive as given.
+- **Declaring Intent autonomy at launch**: `--autonomy <none|semi|full>` declares the Intent's autonomy mode as part of the invocation, including the invocation that births the intent. Pass it straight through to `next`; the engine owns the decision. `none` / `semi` are recorded through the canonical write path and take effect at once. `full` is never granted by the flag — the run prints the grant ceremony (`bun .claude/tools/amadeus-bolt.ts preview-autonomy`, then `bun .claude/tools/amadeus-bolt.ts set-autonomy --mode full --confirmed-display-digest <digest>`) and stops there. Never supply the flag on the user's behalf. See `docs/reference/24-intent-autonomy.md`.
 - **User control**: The user can override any stage decision at any approval gate.
 - **11 domain experts**: Each stage leverages the appropriate agent persona (product, design, delivery, architect, aws-platform, compliance, devsecops, developer, quality, pipeline-deploy, operations).
 - **Approval gates**: Every stage except the bootstrap initialization stages presents an approval gate (the engine signals this via `run-stage`'s `gate` field).

packages/framework/harness/codex/skills/amadeus/SKILL.md

@@ -6,7 +6,7 @@ description: >
   `.codex/scopes/`; run
   `bun .codex/tools/amadeus-utility.ts help` for the authoritative list
   and descriptions. Utilities: --status, --doctor, --migrate [path], --stage,
-  --phase, --scope, --depth, --test-strategy, --version,
+  --phase, --scope, --depth, --test-strategy, --autonomy, --version,
   --help, plus the intent and space verbs.
   Or describe what you want to build and the scope will be auto-detected.
 ---
@@ -43,7 +43,7 @@ Loop:
      not `done` alone: `await-completion` is terminal for this turn too.
 ```
 
-Each `next` reads the workflow state and the compiled stage graph and returns **exactly one** typed directive (JSON) on stdout. It mutates no workflow state (its only write is the machine-local sensor-invocation projection under the gitignored hooks-health runtime). The directive's `kind` names the single move to make; you make that move, then `report` commits the resulting transition so the next `next` reads fresh state. **Report once per directive; never call the state tools (`amadeus-state.ts approve/advance/…`) directly** — the engine's `report` dispatches them, and a speculative direct call gets the engine's state-guard error. Pass the user's invocation text through to the first `next` verbatim — the engine parses flags (`--status`, `--stage`, `--scope`, `--depth`, freeform text, …) and resolves the scope, so you do not pre-parse or strip them.
+Each `next` reads the workflow state and the compiled stage graph and returns **exactly one** typed directive (JSON) on stdout. It mutates no workflow state (its only write is the machine-local sensor-invocation projection under the gitignored hooks-health runtime). The directive's `kind` names the single move to make; you make that move, then `report` commits the resulting transition so the next `next` reads fresh state. **Report once per directive; never call the state tools (`amadeus-state.ts approve/advance/…`) directly** — the engine's `report` dispatches them, and a speculative direct call gets the engine's state-guard error. Pass the user's invocation text through to the first `next` verbatim — the engine parses flags (`--status`, `--stage`, `--scope`, `--depth`, `--autonomy`, freeform text, …) and resolves the scope, so you do not pre-parse or strip them.
 
 Run the engine binary directly via the shell tool. If a directive looks malformed or names a move you cannot make, that is an engine signal worth surfacing to the user, never a cue to improvise the routing in prose.
 
@@ -243,6 +243,7 @@ The engine reads the compiled `data/stage-graph.json` directly for all routing;
 ## Key Principles
 
 - **Adaptive scope**: Scope determines which stages execute and at what depth — from 5-stage chore to 32-stage enterprise. The engine owns the resolution; you run the stages it hands you.
+- **Declaring Intent autonomy at launch**: `--autonomy <none|semi|full>` declares the Intent's autonomy mode as part of the invocation, including the invocation that births the intent. Pass it straight through to `next`; the engine owns the decision. `none` / `semi` are recorded through the canonical write path and take effect at once. `full` is never granted by the flag — the run prints the grant ceremony (`bun .codex/tools/amadeus-bolt.ts preview-autonomy`, then `bun .codex/tools/amadeus-bolt.ts set-autonomy --mode full --confirmed-display-digest <digest>`) and stops there. Never supply the flag on the user's behalf, and never infer autonomy from a previous answer: an autonomous ruling is only ever the engine executing a recorded human declaration. See `docs/reference/24-intent-autonomy.md`.
 - **User control**: The user can override any stage decision at any approval gate.
 - **11 domain experts**: Each stage leverages the appropriate agent persona (product, design, delivery, architect, aws-platform, compliance, devsecops, developer, quality, pipeline-deploy, operations).
 - **Approval gates**: Every stage except the bootstrap initialization stages presents an approval gate (the engine signals this via `run-stage`'s `gate` field).