Merge pull request #6957 from Systemorph/docs/finish-autonomously

docs(agents): one fleet-wide 'finish autonomously' rule block

Author: rbuergi

.github/shared-rules.json

@@ -377,6 +377,27 @@
         "Landing in the three change sets this register's header describes: step 1 (this entry) names",
         "the hub only; step 2 lands the six spoke copies; step 3 widens required-in to all seven."
       ]
+    },
+    {
+      "id": "finish-autonomously",
+      "hub": "Systemorph/MeshWeaver",
+      "required-in": [
+        "Systemorph/MeshWeaver"
+      ],
+      "slots": [],
+      "why": [
+        "Maintainer directives, 2026-09-09 ('ALWAYS bring requested fixes to production … Do not ask for a second",
+        "ship-it instruction') and 2026-10-18 ('see that it is all being merged automatically. see that in central",
+        "place it is clearly stated to finish autonomously'). Before this block the rule existed as three",
+        "differently-worded passages — core's Git Workflow and GitHub PR Operations paragraphs and Plugins'",
+        "'Ship it' / 'At the end' sections — so each repo's agents stopped at a different stage.",
+        "",
+        "No slots: 'the supported pipeline' and 'the target instance' are written generically so the text reads",
+        "identically in a content repo with no image and in core.",
+        "",
+        "Landing in the three change sets this register's header describes: step 1 (this entry) names the hub",
+        "only; step 2 lands the six spoke copies; step 3 widens required-in to all seven."
+      ]
     }
   ]
 }

AGENTS.md

@@ -31,6 +31,10 @@ second tree. New skills become available to both clients through the directory l
 
 **When the task's goal is reached, automatically follow the [`pullrequest` skill](.claude/skills/pullrequest/SKILL.md)** — update the DOC PAGE the change belongs to (🚨 **not** a What's New file: those are written per RELEASE, not per change — policy `whatsnew-cadence`; see `conserve-work-products` below, which this clause used to contradict), commit, push, open the PR, wait for green CI, merge. "Goal reached" means implemented, verified, and the touched projects build clean with CI's flags; don't stop to ask permission at that point. Everything short of that stays manual: never commit or push half-done or unverified work, and **never merge with CI red or pending**.
 
+<!-- shared-rule:begin finish-autonomously -->
+🚨 **Finish AUTONOMOUSLY — a task ends MERGED, DEPLOYED and VERIFIED, with no second "go" from anyone** (maintainer, 2026-09-09 and 2026-10-18: *"see that it is all being merged automatically"*, *"clearly stated to finish autonomously"*). A request to change something authorizes the whole delivery: worktree → change → local gates → push → pull request → every review thread answered → green → merged → deployed through the supported pipeline → the changed behaviour verified on the target instance → worktrees removed. Never hand back "shall I merge?", a bare pull-request link, or "green and waiting". Once the review is answered, arm auto-merge (it lands when the required checks pass, never before) and leave ONE background REST watcher (a script polling at ≥ 60 s, never a model loop) that re-arms a disarmed pull request, lands the halves of a cross-repo change in the order the pair gates demand (a platform ADDITION before the dependent that uses it, a DELETING half only after the dependent adaptation has merged), and wakes you only for what a script cannot decide: a thread to answer, a red to fix at the root. A red the workflow itself calls infra — no runner, no verdict in time, a timeout — is waited out or re-run, never a reason to stop. Stop and ask ONLY when the next step is **fatal** (a required gate red on your own change would ship broken), **system-changing** beyond the normal deploy (branch protection, credentials, migrations, a hand-roll), or **destructive** (deleting data, rewriting a shared branch); then state the blocker, the last completed stage, and what production actually runs now — unchanged, or which deploy steps already landed. Autonomy never licenses bypassing a check, an access control or the CD pipeline.
+<!-- shared-rule:end finish-autonomously -->
+
 ### 🚨🚨🚨 ABSOLUTE: NEVER work on the primary checkout — it stays on `main`, untouched. EVERYONE creates a worktree.
 
 **The primary checkout (`/Users/roland/code/MeshWeaver`) is a READ-ONLY reference, not a workspace. It must stay parked on `main` and untouched — never edit, build, commit, `checkout`, `switch`, `reset`, or `stash` there, and never leave it on a feature branch.** It is the base every session's worktree is cut from; mutating it can clobber every concurrent session's uncommitted WIP.