feat(backlog): pin the commit-autonomy waiver and its degrade contract

The waiver is now a machine-read marker: ":COMMIT_AUTONOMY: yes" in notes.org's Workflow State, with ":LOOP_MAY_COMMIT: yes" as the separate grant for the unattended loop. An absent or non-yes marker reads as no, and the read is a fresh grep each run, never memory. A caller requesting autonomous-commit without the marker degrades to file-only, surfaced in both the run intro and the summary.

I stamped rulesets' own :COMMIT_AUTONOMY: and left :LOOP_MAY_COMMIT: ungranted. Letting the recurring loop commit unattended is a separate trust decision.

1 files changed, 2 insertions, 2 deletions

diff --git a/todo.org b/todo.org
index c8c9b94..0732319 100644
--- a/todo.org
+++ b/todo.org
@@ -465,8 +465,8 @@ work-the-backlog.org written (canonical + mirror): caller contract (task set + s
 *** 2026-07-02 Thu @ 01:13:33 -0400 Phase 2 landed — both callers wired
 inbox.org auto-mode item 3 regained its "run this batch next?" ask, now chaining into work-the-backlog as an explicit second step after routing (eligibility query + file-only + paging off + cap 1). work-the-backlog.org gained the two caller sections: the auto-loop contract and the no-approvals speedrun preset (seven-step pre-flight → autonomous-commit + always-push + paging-on over an explicit list; finer Q&A mechanics deferred to Phase 4). Speedrun trigger phrases live in the workflow + INDEX; "speedrun" always routes to the preset, with a disambiguation note in no-approvals.org and its INDEX entry. Each caller independently exercisable.
 
-*** TODO [#C] Phase 3 — file-only vs autonomous-commit gate :feature:solo:
-Read the per-project commit-autonomy waiver; degrade autonomous-commit to file-only when absent and surface the degrade. Spec Phase 3 / D5. Verify: default file-only is the path taken with no waiver present.
+*** 2026-07-02 Thu @ 01:18:07 -0400 Phase 3 landed — waiver-gated commit autonomy
+Pinned the waiver format per D5: two marker lines in .ai/notes.org Workflow State — :COMMIT_AUTONOMY: yes (has the waiver) and :LOOP_MAY_COMMIT: yes (the unattended loop may also commit; requires the first). Absent or non-yes reads as no; the read is a fresh grep each run, never memory. Degrade contract written into work-the-backlog.org (surface in run intro + summary, never honor without the marker, never degrade silently); caller sections + Common Mistakes updated. Stamped rulesets' own :COMMIT_AUTONOMY: yes; :LOOP_MAY_COMMIT: deliberately not granted — Craig's call. .emacs.d holds the waiver too but its notes.org is its own scope; told via inbox-send to stamp its marker.
 
 *** TODO [#C] Phase 4 — defer checklist, pre-flight Q&A, end-of-set page :feature:solo:
 Implement the act-vs-file defer checklist (test-writability keystone, enumerated data-loss list, already-satisfied, design-deliberation), the speedrun pre-flight decision-gathering (gather → classify → order → intro → batch-ask → skip/answer), VERIFY-on-ambiguity filing, and the end-of-set notify alarm --persist page. Spec Phase 4 / D3 / D6 / D8. Verify: checklist only reduces what runs; pre-flight fires only under the speedrun preset.