Skip to content

Rig autonomy level

In shadow: the slider is live, nothing is enforced yet. One rig-wide setting for how much the rig does without a human. The operator's words (2026-10-04): "We should have a setting in the rig. Where lowest security setting is full automation with no humans and highest has human gate for all deploys. It can be like a bar slide in rig-cockpit that can be adjusted."

The design

  • A slider in Rig Cockpit, from Full speed to Full security, with 4 levels.
  • Only the operator moves it. Lowering it needs Face ID (the rig-approve passkey), which the conductor verifies. Raising it is instant.
  • The level lives in the conductor, in a hash-chained event log that starts at the most secure level. A bypass or tampering sets it back to the most secure level.
  • A hard floor at every level: credentials, spend and the gate machinery always need the operator.
  • Review-E is required at every level.
  • No read-only level. A separate Freeze switch may come later.
  • How it acts: MergeGate holds PRs, and deploys choose between gated and ungated environments that OpenTofu creates ahead of time.

The design also found gaps, tracked on #2640.

Status (2026-10-05)

  • Design: on dashecorp/rig-conductor#2640, as comments. The operator approved it on 2026-10-04, with these decisions: the names Full speed and Full security; the hard floor; no read-only level; shadow mode first.
  • Plan: the PRs land in shadow mode first, then one switch PR turns enforcement on.
  • Merged, all in shadow:
  • Batch 1 (rig-conductor): A1 #2642, A2 #2651, A3 #2653, A5 #2655 and A4 #2657. A5 adds GET /api/autonomy and /history.
  • Batch 2: A4b #2662 and A6 #2664 (rig-conductor), and A8 infra#589 and A10 infra#591, the gated and ungated environments.
  • Batch 3: A11 rig-conductor#2669 and #2671, the decision endpoint; B1 rig-cockpit-worker#289, the proxy; B2 rig-cockpit-worker#291, the slider.
  • Batch 4: A9 infra#593, infra#596, A12 in dashecorp/.github (#5, #7), and B4 rig-cockpit-worker#295, the registry, merged and deployed at 16:14Z. Batches 1–4 are complete.
  • A9 was checked live after its apply: only the exact decision path reaches the conductor, and every other path stays behind Access.

The slider is live in Rig Cockpit, deployed on 2026-10-04. It shows Full security with a red "Shadow: not enforced yet" badge, so nothing it shows is enforced yet. Lowering is plain text ("needs your passkey") until C0 and B3 exist. The iOS app loads the same live dashboard, so the slider shows there too, with no rebuild; this isn't confirmed on the operator's phone yet.

Merged on 2026-10-05, after the operator answered decision 4 YES (operator-inbox #8, closed): tripwires may raise the rig to Full security on their own, and only the operator lowers it, with Face ID. - A7, in two parts. rig-conductor#2675 adds the tripwire policy (chain_invalid, seq_regression, anchor_mismatch) and an incident store that records each finding once. Every read replays the whole log, which grows only when the level changes; past about 10,000 entries the upgrade is a verified checkpoint. rig-conductor#2677 adds AutonomyExpiryWatcher, which ends time-boxes and runs the tripwires, writing only through the fenced AutonomyWriter. It stays off until the passkey anchor (C0) is pinned. - A7b, rig-conductor#2684: the genesis entry goes through AutonomyWriter too, so every append takes the one fenced path. Nothing changes while the location fence is inert (no LOCATION set). - D0, the shadow fallback: the design is rig-conductor#2681, and the code is dashecorp/.github#9. When a deploy job can't ask the conductor, the fallback mode decides: in shadow it keeps its legacy environment (today's behaviour) with a warning; in enforce it uses the gated environment. The mode is the file actions/autonomy-decide/fallback-mode in dashecorp/.github, read at the commit the job pins, and only the exact word shadow loosens it. A fallback looser than the conductor fails closed (drift:fallback_looser). The file says shadow today, and no deploy job calls the action yet.

PAUSED before D1. Wiring any deploy pipeline (D1 onwards) waits for the operator's OK. - Still open on #2640: whether raises ("Lock down", the tripwire raise) skip the location fence. It must be settled before LOCATION is set anywhere. - B3 and B5 touch rig-approve, so they wait on its go-live (Operator inbox → Face ID approvals). B5 is the iOS app's handoff to rig-approve for lowering, after B3. C0 is the operator's to do. - The switch to enforce takes two steps: E3a (the fallback file plus every deploy repo's pin), then E3 (gates.yaml). E3 merges only after a required pin-guard check passes.