jobtrackingapp/docs/automation/PLAN.md

AUTONOMOUS-ROADMAP-01 design and implementation checklist

Build the controller only. Do not execute roadmap prompts. Implementation is isolated on codex/autonomous-roadmap-01, based on 5032ccb.

Design

PowerShell 7 provides the Windows command interface and .NET certificate signing/verification. Python 3.12 standard library implements the state machine, subprocess supervision, Git checks and disposable-repository tests. No database server or new package is needed. Compared with an all-PowerShell engine, this keeps recovery and adversarial tests small; a service/database would add unnecessary deployment work.

The trusted controller, immutable manifest/prompt snapshot, signing public certificate and durable state live outside the worker checkout. Install and run under a dedicated development account/VM, separate from the owner's signing identity. Native Codex workspace-write sandbox and a qualified host boundary are required. A signed environment qualification is required; this implementation never grants itself approval. The repository copy is source code, not a protected installation.

Every checkpoint is a new bounded codex exec with the complete original prompt and prior reports. The model proposes a result; the controller independently runs the configured checks inside the sandbox, validates structured reports and artifact hashes, commits, publishes an explicit feature ref, verifies remote HEAD, and advances the non-production integration ref by fast-forward only. Missing test adapters, prompts or approvals stop advancement. No merge or deployment command exists.

Atomic checksummed state with last-good backup, an OS-held repository lock, a durable running marker and process identity prevent concurrent controllers and false success after interruption. A recovered RUNNING session requires orphan-process reconciliation. Publication retries reuse the exact tested commit and never rerun the model. Acceptance approvals bind manifest, prompt, baseline, candidate commit and evidence hashes. Conditional acceptance requires an explicit signed deferral and declared deferrable gates.

Scope and checkpoints

• AUTO-00: Audit actual source prompts, CLI 0.163.0, local/remote Git state and Phase 10 authority. Record missing/contradictory sources and sandbox failure.
• AUTO-01: Preserve original prompt bytes; implement strict queue validation and stage/checkpoint gates in automation/backlog.json and schemas.
• AUTO-02–03: Implement PowerShell entry point, bounded runner, atomic state, exclusive locking, pause/resume, windows and budgets in automation/controller.py.
• AUTO-04–05: Implement signed owner decisions, real test/report verification, safe feature commits and verified publication.
• AUTO-06: Implement status, current-stage and redacted logs plus local event notifications.
• AUTO-07: Write failing tests first, implement, then run disposable-repository end-to-end tests for every requested failure mode. No application services or real roadmap sessions.
• AUTO-08: Document install, authentication, protected approval setup, scheduling, recovery and exact first-entry owner action; record honest final acceptance.

Files touched: new automation/, scripts/Run-JobjaktBacklog.ps1, scripts/Approve-JobjaktBacklog.ps1, documentation, and runtime ignore rules. No application callers, database schemas, production configuration or existing tests change.

Review focus: forged/replayed approval; mutable controller policy; crash between Git commit/push/state writes; process survives parent termination; stale/empty/omitted test evidence. Each requires a synthetic regression check. Real-host security qualification stays separate from synthetic behavior.