Retire legacy governance and align agent skills

[shiny-code-bot]

Goal

After all compatibility readers migrate, delete the legacy human-governance manager role and fallback, human delegate role, and technical-waiver mechanisms, then align agent skills with the Launchplane workflow. Preserve separately authorized DB-native, identity-bound, repository/base/action-scoped agent execution grants.

Scope

• Remove contracts, database fields/tables, actions, routes, UI types, status names, comments, fixtures, tests, and documentation belonging to the legacy human manager role/fallback, human delegate role, and technical-waiver mechanisms after their compatibility readers reach zero.
• Delete GitHub repository authority metadata superseded by Launchplane; keep only thin routing/generated projection inputs that still have a live consumer.
• Update Launchplane, GitHub, repo-readiness, security-review, babysit-pr, and related skills so they distinguish engineering attestation and authorized own-identity landing from human Owner acceptance, scoped exact-artifact production execution, policy administration, and bypass; retain the no-impersonation and no-status-minting rules.
• Keep the GitHub Project Manager field as planning metadata unless a separate roadmap decision changes it; it is not an authorization role.
• Avoid a core Codex Lab change unless deployed attestation provenance demonstrates a concrete missing primitive. Preserve existing Every Code record and serialization identifiers until proven reader cutover; this plan does not reassign Codex Lab release/runtime work.
• Validate that active issues and docs no longer instruct agents or humans to use the legacy human-manager fallback, human delegate role, or technical waivers.
• Do not remove or prohibit DB-native, actor-bound, repository/base/action-scoped coding-agent permissions that are separately authorized and exercised under the agent's own identity with all required gates.

Acceptance Criteria

• Searches and schema inspection find no live readers for the legacy human manager role/fallback, human delegate role, or technical-waiver mechanisms.
• Compatibility code and migrations are removed at the earliest safe revision rather than retained indefinitely.
• Skills route agent reviews through Launchplane, preserve authorized landing under the acting agent's own scoped identity, and forbid human-review impersonation or direct status minting.
• Repo readiness and PR babysitting explain missing/stale agent and Owner evidence accurately and distinguish merge execution, Owner acceptance, production promotion, policy administration, and bypass.
• .github/github.json files contain no stale human-role authorization authority.
• Tests and docs use Owner, engineering attestation, and production authorization consistently.
• No deletion removes a current DB-native actor-bound agent execution grant unless that grant is separately revoked through its owning authority model.

Finish Line

Only the new Owner-and-agent governance model remains in runtime code, repository config, skills, and current documentation.

Next Action

Track reader counts separately for the legacy human manager role/fallback, human delegate role, and technical-waiver mechanisms during each gated rollout. Begin deleting only those shared legacy paths after the final corresponding reader migrates and current DB-native scoped agent-execution grants are confirmed outside the deletion set.

Current Status

State: two stacked PRs are green, reviewed and marked "Ready for the merge train". #2698 (root, technical human waiver) and #2700 (manager and delegate role policies plus retired manager preview approval, based on #2698). Both keep the database tables and schema so stored rows are kept. Work by GOLP-2006-D0 (Claude Code).
Next action: the Launchplane merge-train session lands #2698, then #2700 (label only the root; #2698 needs a branch update). After both land, close this issue if the owner declines both questions below; otherwise open follow-up PRs for the answers.
Blocked by: none
Waiting for: the merge train; owner answers to two questions on this issue (drop the three retired tables; empty the operator.manager-preview-approval grant set).
Last verified: 2026-10-01, both PRs 33/33 checks green.

Direction

proves the retired designs above are gone from the code

Deletes the retired waiver and manager role code.

[shiny-code-app]

Direction reconciliation, 2026-09-26 (owner-started direction session against the merged DIRECTION.md)

Rescoped to straight deletion. The manager, delegate, and waiver roles are retired by DIRECTION.md, so waiting for reader counts to reach zero and the "preserve DB-native agent execution grants" clause no longer apply. Remaining code: the tenant_technical_human_waiver model (contracts/repository_human_admission.py), http_routes/tenant_admission.py waiver paths, and role: Literal["manager"] in contracts/manager_preview_approval.py. Skill alignment belongs in codex-skills. The #2005 blocker is closed.

[shiny-code-app]

Progress from #2525: PR #2530 is merged and deployed at de7f3abb2b8a63ddb465e59e239f86b4ba8db3c1. It deletes the active change-impact classifier/evaluator, manager approval services/commands/projection, and Product Owner policy service. Exact-commit CI, Security, CodeQL and deployment smoke passed.

Historical payloads and immutable digests remain readable. The remaining role: Literal["manager"] field is now in control_plane/contracts/retired_manager_preview_approval.py:144; the old contracts/manager_preview_approval.py path no longer exists. Technical-human-waiver code remains in contracts/repository_human_admission.py and http_routes/tenant_admission.py. These are pointers for this issue's remaining straight-deletion scope; #2525 does not complete it or reinstate a reader-count wait. Skill alignment still belongs in codex-skills.

[shiny-code-app]

Claimed by GOLP-2006-D0

[shiny-code-app]

Owner question: should a migration drop the database tables of the retired waiver, manager-approval and role-policy records?

What is being decided: #2698 deletes the waiver code, and a follow-up PR will delete the repository role-policy (manager and delegate) and retired manager-approval code. Their tables stay in the database with whatever rows were written: launchplane_tenant_technical_human_waiver_events, launchplane_manager_preview_approval_events, and launchplane_repository_human_role_policies. Once the code is gone, nothing reads them, but the code still has to keep their table definitions. DIRECTION.md makes deleting data your call.

Recommendation: yes. After both code PRs land, an agent opens a separate PR with a migration that drops the three tables and removes their table definitions.

• Yes: the rows are gone for good once that migration deploys. Only existing database backups still have them.
• No: the tables and their definitions stay in the code as permanent upkeep, and nothing reads them.

Work continues meanwhile; neither code PR depends on this answer.

[shiny-code-app]

Owner question: should the retired manager-preview-approval grant set be emptied and its reconcile wiring removed?

What is being decided: once #2698 and #2700 land, nothing in Launchplane uses the manager_preview_approval.read and manager_preview_approval.write actions. The operator.manager-preview-approval managed set can still put those grants into the live authorization policy. It is fed by the LAUNCHPLANE_AUTHZ_MANAGER_PREVIEW_APPROVAL_MANAGED_SET_JSON secret through the reconcile-manager-preview-approval job in .github/workflows/authz-policy-reconcile.yml. Removing grants is a stop boundary, so I have not touched it.

Recommendation: yes, retire it the same way operator.owner-acceptance was retired. An agent contracts the set to an empty desired policy through the reviewed reconcile path, then a PR removes the workflow job, the secret reference and its docs. You delete the GitHub secret by hand afterwards.

• Yes: the dead grants leave the live policy, and one secret and one workflow job go away.
• No: the grants stay in the policy authorizing nothing, and the workflow job stays as upkeep.

[shiny-code-app]

Handoff from GOLP-2006-D0, 2026-10-01

Done:

• Delete the retired technical human waiver #2698 deletes the retired technical human waiver: its apply route, capture and evaluation logic, store methods, merge-eligibility path and status category, docs and tests.
• Delete the retired manager and delegate roles #2700 (stacked on Delete the retired technical human waiver #2698) deletes repository role policies for the manager and delegate roles: their routes, contracts and store methods, and their use in the repository-scope report. It also deletes the retired manager preview approval contracts, store methods and filesystem import, and the manager admission path, reason codes and status category.
• Both are green (33/33), reviewed by OpenAI gpt-6.1-sol (one finding, fixed), JetBrains GREEN, and carry "Ready for the merge train". The database tables and schema stay, so no stored rows are deleted.

In flight: the Launchplane merge train. Label only the root #2698. It is behind main and needs a branch update. #2700 lands after it.

Exact next action: once both are merged, check this issue's finish line against main. If the owner has answered the two questions above, open follow-up PRs for them. If he declines both, close this issue under the github-plan skill with the merge SHAs as evidence. The remaining agent-skill alignment belongs in codex-skills, as recorded on 2026-09-26.

Not changed on purpose: the one-time cleanup of a leftover manager-preview-approval GitHub status, the controller's exclusion of that check name, the /v1/manager-preview-approval/github-webhook URL (it now carries trusted-maintenance evidence), and the operator.manager-preview-approval grant set (owner question 2).

Worktrees kept until the PRs land, both clean and pushed:

• /Volumes/Developer-Artifacts/worktrees/launchplane/delete-waiver-machinery
• /Volumes/Developer-Artifacts/worktrees/launchplane/delete-manager-role-policy

Brief authority (direction session codex-skills-d0, 2026-10-01): work in your own dev-worktree, use bot commits and pushes, open PRs, and don't merge. When a PR is green and reviewed, comment "Ready for the merge train" and hand the link to the direction session. Never deploy, promote or touch production data. Anything that retires a feature or changes approval rules is an escalation. A message to codex-skills-d0 could not be delivered from this Claude Code session, because it was not among the reachable sessions. The PR comments are the durable handoff.

[shiny-code-app]

Owner decision, 2026-10-01 ~12:10 UTC (Chris, typed in direction session codex-skills-d0) on 5926438746 and 5926604044: "we don't use these at all anymore? Confirm that and yes to both."

Confirmed by the direction session's read-only check: after the combined #2698 (with #2700) lands, no route, store method, worker path or UI reads or writes the retired waiver, manager-approval or role-policy tables. The ORM definitions say so themselves (control_plane/storage/postgres.py:1375-1379, :3010-3014, :3071-3075). The manager_preview_approval.read/.write actions survive only in retired_manager_preview_approval.py, which the PR deletes. So: yes to both, with these conditions:

1. Drop the tables: the migration PR first exports each table's row count and rows (redacted where needed) to a recorded artifact. Deleting data is a stop boundary, and an Alembic downgrade recreates empty tables, not the rows. Production row counts are unverified.
2. Empty the grant set: remove the operator.manager-preview-approval grants, the reconcile-manager-preview-approval job (authz-policy-reconcile.yml:25,129-139), the LAUNCHPLANE_AUTHZ_MANAGER_PREVIEW_APPROVAL_MANAGED_SET_JSON secret, and the stale "manager preview approval writer set" wording in docs/operations.md:961-963.
3. Don't remove what only shares the name: the /v1/manager-preview-approval/github-webhook route now carries trusted-maintenance evidence, signed with LAUNCHPLANE_MANAGER_PREVIEW_GITHUB_WEBHOOK_SECRET (trusted_maintenance_github_webhook.py:39,69-70). Keep it, along with product_review_status.py:335 and tenant_admission_controller.py:63,172.