Milestone planning always

- pr-green (visit 1): pass, then signoff: exit 0
- signoff (visit 1): pass, then rebase: approved by rule autonomous
- rebase (visit 1): pass, then wait-rebased: exit 0
- wait-rebased (visit 1): pass, then rebased-green: held after 1 checks
- rebased-green (visit 1): pass, then land: exit 0
- land (visit 1): pass, then wait-landed: exit 0
- wait-landed (visit 1): pass, then landed-green: held after 30 checks
- landed-green (visit 1): pass, then rebase-merge: exit 0
- rebase-merge (visit 1): pass, then wait-rebased-merge: exit 0
- wait-rebased-merge (visit 1): pass, then rebased-merge-green: held after 1 checks
- rebased-merge-green (visit 1): pass, then merge: exit 0
- merge (visit 1): pass, then wait-main: exit 0
- wait-main (visit 1): pass, then main-green: held after 1 checks
- main-green (visit 1): pass, then close-out: exit 0
- close-out (visit 1): pass, then ship: exit 0
- ship (visit 1): pass, then end: exit 0

## Leaves

- milestone-plan-refuses-autonomous (step build/build): passed: attempt 1: verifier passed
  - attempt 1 builder, session c85e7111-2a33-4019-a22a-01a1aa187cf1: pass (said done)
  - attempt 1 verifier, session 376a1866-325c-4429-aebd-01a1aa34bf13: pass (Evidence written by the verifier)
- milestone-request-owner-plan (step build/build): passed: attempt 2: verifier passed
  - attempt 1 builder, session 4872b037-0248-45fd-a61a-01a1aa34eab3: pass (said done)
  - attempt 1 verifier, session 269e8518-8653-4ca7-8907-01a1aa376f72: fail (verifier found 1 problem(s))
  - attempt 2 builder, session bdbecc65-6a44-41c8-a32e-01a1aa38b310: pass (said done)
  - attempt 2 verifier, session 84889f26-402b-422b-a6b5-01a1aa397132: pass (Evidence written by the verifier)
  - attempt 1 finding f1: The acceptance requires the feature request's daemon run start to carry --autonomous with rhiza.autonomy.plan=auto, but no test shows it. In cmd/rhiza/testdata/script/plan-requests.txtar the feature request 'Add exports' is started in the earlier pass, before autonomy is set to auto, and line 79 expects it without --autonomous. The only autonomous start the auto pass checks (line 92) is the bug request 'Fix Login fails'. The milestone half passes: go test -trimpath ./cmd/rhiza -run 'TestScripts/plan-requests$' passes, and it checks the milestone start has --milestone and no --autonomous, and its journal has no autonomous:true. To fix, assert with plan autonomy auto that a feature request's daemon start ends in --autonomous, e.g. by queuing a second feature request before the auto pass.
- milestone-plan-refuses-autonomous (step review/review): open
  - attempt 2 fixer in cycle 2, session 96026cf3-1c9c-421a-9d03-01a1aa46a5bd: pass (said done)
  - attempt 2 verifier in cycle 2, session 84d76959-7e8a-43ae-ac4e-01a1aa4d588a: pass (Evidence written by the verifier)

## Checks

- compliance (step review/review): passed after 1 cycle
  - cycle 1: passed, check session bd656e2f-270a-4a77-b22f-01a1aa3af7cf pass (said done)
  - round 1 (cycle 1): 3 findings, 0 confirmed
    - f1 minor at internal/api/run.go:543 on milestone-plan-refuses-autonomous: The statement covers a plan run 'for a request of kind milestone', but the refusal only checks --milestone and a record change set. If someone runs `run start --new X --request <milestone-kind request> --autonomous` by hand without --milestone, it opens an intention and runs autonomous: requestRun returns q.Milestone (the parent milestone), not the request's kind. The daemon always passes --milestone, so only a hand start reaches this, and no testscript covers it.
    - f2 nit at cmd/rhiza/testdata/script/run-start-milestone-autonomous.txtar:36 on milestone-plan-refuses-autonomous: The acceptance says 'the same starts without --autonomous run' for both refused starts. The script only re-runs the record change set case without --autonomous, not --new --milestone. plan-requests.txtar does run that case, with --request.
    - f3 nit at cmd/rhiza/testdata/script/plan-workflow-autonomous-left.txtar:5 on milestone-plan-refuses-autonomous: The header comment still describes the old flow: a question in a landed record write, answered in a record change set of its own. The script now asserts both questions are answered in the run's intention change set.
- quality (step review/review): passed after 1 cycle
  - cycle 1: passed, check session ed10148f-9e30-4562-9552-01a1aa3b1b76 pass (said done)
  - round 1 (cycle 1): 4 findings, 0 confirmed
    - f1 minor at internal/api/run.go:543 on milestone-plan-refuses-autonomous: The refusal for a request of kind milestone rests on --milestone alone: run start --new X --request <milestone request> --autonomous without --milestone checks no request kind (requestRun returns q.Milestone, the served milestone, not q.Kind), so it starts an autonomous plan run for a milestone request on an intention change set. Only reachable by hand-editing the daemon's command, since daemonStartPlan always adds --milestone.
    - f2 minor at internal/api/run.go:632 on milestone-plan-refuses-autonomous: planIsMilestone fails open: if the fold cannot load or the change set is not found it returns false, so the refusal is skipped and the autonomous run starts; a guard for an owner rule would rather surface the error.
    - f3 nit at cmd/rhiza/testdata/script/run-start-milestone-autonomous.txtar:44 on milestone-plan-refuses-autonomous: sed -i with the 0,/re/ address is GNU-only; BSD sed on a Mac rejects both, so the script fails there (CI is Ubuntu, so it passes).
    - f4 nit at internal/api/request.go:342 on milestone-request-owner-plan: The added sentence was appended to an existing doc comment line, making it ~100 chars where the surrounding comment wraps at ~75.
- qa (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 79d053d4-37fb-4195-b8e6-01a1aa3b436a pass (said done), critic session b19be730-e19e-4f48-900f-01a1aa45681f pass (said done)
  - cycle 2: passed, check session 40877905-afa0-4102-8c40-01a1aa5729d6 pass (said done)
  - round 1 (cycle 1): 1 finding, 1 confirmed
    - f1 major at internal/api/run.go:543 on milestone-plan-refuses-autonomous: The leaf refuses --autonomous on a plan run 'for a request of kind milestone', but only r.Milestone and a record change set are checked; requestRun (internal/api/request.go:360) never looks at the request's kind. Repro with the built binary: queue 'rhiza request "Ship v3" --kind milestone', let the daemon claim it, then 'rhiza run start --foreground --workflow plan --new "Ship v3" --request <id> --permission-mode manual --autonomous --dry-run --json' (no --milestone) exits 0 with "autonomous": true on an intention change set, so a hand start plans the milestone request with RHIZA_AUTONOMOUS=1. Refuse --autonomous (or require --milestone) when --request names a milestone-kind request, and add that case to run-start-milestone-autonomous.txtar. — confirmed: The leaf statement and Decision milestone-plan-never-autonomous name three cases: --milestone, a request of kind milestone, and a record change set. In runRunStart (internal/api/run.go:543-570) --autonomous is refused only for r.Milestone and, after newPlanChange, planIsMilestone (record kind). requestRun (internal/api/request.go:367) returns q.Run and q.Milestone (the milestone link) but never reads q.Kind, and without --milestone newPlanChange opens an intention, so run start --new X --request <milestone-kind request> --autonomous passes both gates and journals Autonomous=true. Only daemonStartPlan drops the flag; the hand path the Decision says run start must also close stays open.
  - round 2 (cycle 2): no findings
- scope (step review/review): passed after 1 cycle
  - cycle 1: passed, check session e29789aa-f10d-41ce-a252-01a1aa3b70cd pass (said done)
  - round 1 (cycle 1): no findings
- model (step review/review): passed after 2 cycles
  - cycle 1: failed, check session 52720e90-2b37-423e-a0f7-01a1aa3b9ed8 pass (said done), critic session 2f440f56-2e2a-4333-aaf6-01a1aa459683 pass (said done)
  - cycle 2: passed, check session 23dac612-6d5e-475a-ba5e-01a1aa574a56 pass (said done)
  - round 1 (cycle 1): 3 findings, 1 confirmed
    - f1 major at internal/api/run.go:543 on milestone-plan-refuses-autonomous: The leaf's statement (and the milestone-plan-never-autonomous Decision) say run start refuses --autonomous for a request of kind milestone, but the code checks only the --milestone flag and, after resolving, a record change set. requestRun returns q.Milestone (the milestone a request serves), never q.Kind, so `rhiza run start --workflow plan --new <intent> --request <milestone request> --autonomous` without --milestone opens an intention and runs autonomous. Either refuse when the request's Kind is milestone (and cover it in run-start-milestone-autonomous.txtar) or narrow the statement to what the code does. — confirmed: internal/api/run.go:543 refuses only on r.Milestone, and the post-resolve check (planIsMilestone) only on a record change set; requestRun (internal/api/request.go:360-380) returns q.Run and q.Milestone, never q.Kind. Only daemonStartPlan adds --milestone for a milestone request, so a direct run start --workflow plan --new <intent> --request <milestone request> --autonomous (its run ID drawn, not yet started) opens an intention and runs autonomous, contrary to the leaf statement's 'for a request of kind milestone'. Refusing on the request's Kind (or narrowing the statement) is needed.
    - f2 minor at .rhiza/rendered/decision/stage-autonomy-meanings.md: stage-autonomy-meanings still says 'plan auto: the daemon runs a requested plan autonomously' and run-start-autonomous says run start --autonomous starts any run autonomous; neither names the milestone exception now in the code, nor links milestone-plan-never-autonomous, so a reader of those nodes gets the old rule.
    - f3 minor at (model): The owner's rule 'milestone planning always needs a human' is a standing rule across the daemon, run start and resume but lives only as a Decision and two capabilities; filed draft change set 01M6N3T4X18W6BFW7CJ16EXGN6 (discovered-from this one) to record it as a constraint.
  - round 2 (cycle 2): 1 finding, 0 confirmed
    - f1 minor at .rhiza/rendered/decision/stage-autonomy-meanings.md: Still open from cycle 1: stage-autonomy-meanings ('plan auto: the daemon runs a requested plan autonomously') and run-start-autonomous don't name the milestone exception or link milestone-plan-never-autonomous. The constraint itself is tracked in draft change set 01M6N3T4X18W6BFW7CJ16EXGN6 (discovered-from this one).

## Code checks

- step review/code: pass

## Sign-offs

- signoff (visit 1): approved by rule autonomous

## Retries

- 2026-11-05T06:18:02Z retried at open-pr, after: step "open-pr" ended with outcome "fail"
- 2026-11-05T06:18:43Z retried at open-pr, after: step "open-pr" ended with outcome "fail"

## Sessions

- build/build, session c85e7111-2a33-4019-a22a-01a1aa187cf1: tokens input 106, output 28229, cache creation 107810, cache read 5256857; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 376a1866-325c-4429-aebd-01a1aa34bf13: tokens input 18, output 3613, cache creation 39453, cache read 516086; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 4872b037-0248-45fd-a61a-01a1aa34eab3: tokens input 34, output 5487, cache creation 35371, cache read 955460; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 269e8518-8653-4ca7-8907-01a1aa376f72: tokens input 14, output 2422, cache creation 27786, cache read 339970; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session bdbecc65-6a44-41c8-a32e-01a1aa38b310: tokens input 10, output 2057, cache creation 28962, cache read 240157; helper tokens input 0, output 0, cache creation 0, cache read 0
- build/build, session 84889f26-402b-422b-a6b5-01a1aa397132: tokens input 18, output 3061, cache creation 32285, cache read 478625; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session bd656e2f-270a-4a77-b22f-01a1aa3af7cf: tokens input 48, output 9897, cache creation 67378, cache read 1709156; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session ed10148f-9e30-4562-9552-01a1aa3b1b76: tokens input 26, output 5434, cache creation 41795, cache read 768738; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 79d053d4-37fb-4195-b8e6-01a1aa3b436a: tokens input 34, output 9557, cache creation 53752, cache read 1138933; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session e29789aa-f10d-41ce-a252-01a1aa3b70cd: tokens input 10, output 1579, cache creation 40760, cache read 268904; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 52720e90-2b37-423e-a0f7-01a1aa3b9ed8: tokens input 26, output 6116, cache creation 63542, cache read 912105; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session b19be730-e19e-4f48-900f-01a1aa45681f: tokens input 12, output 1427, cache creation 27712, cache read 282959; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 2f440f56-2e2a-4333-aaf6-01a1aa459683: tokens input 18, output 2577, cache creation 29058, cache read 453057; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 96026cf3-1c9c-421a-9d03-01a1aa46a5bd: tokens input 28, output 3728, cache creation 33463, cache read 654010; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 84d76959-7e8a-43ae-ac4e-01a1aa4d588a: tokens input 34, output 3892, cache creation 39203, cache read 869325; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 40877905-afa0-4102-8c40-01a1aa5729d6: tokens input 32, output 6759, cache creation 44727, cache read 1011308; helper tokens input 0, output 0, cache creation 0, cache read 0
- review/review, session 23dac612-6d5e-475a-ba5e-01a1aa574a56: tokens input 14, output 1801, cache creation 39943, cache read 401640; helper tokens input 0, output 0, cache creation 0, cache read 0

Totals: tokens input 482, output 97636, cache creation 753000, cache read 16257290; helper tokens input 0, output 0, cache creation 0, cache read 0