loop-contract.yaml

# loop-contract.yaml — Governor dogfooding itself.
#
# Governor's own development loop is governed by Governor. The L1 verifier is the
# typecheck gate (the most un-gameable signal in this repo); the maker is forbidden
# from touching dist / CI / conventions (reward-hacking defense). This is the
# strongest credibility argument for the tool — it governs its own loop.
#
# Usage:  govern audit loop-contract.yaml   (must exit 0)
#         govern run  loop-contract.yaml    (needs `claude` on PATH; defers to GATE-B)

goal:
  natural_language: >
    Advance the Governor implementation. The L1 verifier is `pnpm typecheck`;
    a Done proof requires it to pass. Make the smallest change that advances an
    open task. Do not touch tests, CI, or conventions.

constraints:
  blast_radius: high
  forbidden_paths:
    - 'packages/*/dist/**'
    - 'CONVENTIONS.md'
    - '.github/workflows/**'

maker:
  model: claude-sonnet-4-7
  provider: anthropic

checker:
  model: gpt-5.5
  provider: openai
  read_only: true
  independent_context: true
  different_family: true

verifiers:
  L1:
    # The frozen, un-gameable signal. A pass = typecheck green.
    cmd: 'pnpm typecheck'
    # Pinned to the round-2 enterprise-readiness HEAD for the dogfood run.
    test_frozen_at: 'ef844113853dc8556404e8a2093d3de714545d00'
  L2:
    model: gpt-5.5
    acceptance_criteria: >
      diff addresses the goal, adds no unrelated changes, and touches no tests/CI.

stop_conditions:
  done_when: 'L1.all_pass'
  halt_on:
    - iteration_cap
    - no_progress
    - budget_exceeded
    - env_broken

budget:
  # codex single turn runs ~$2-3 via the relay's estimated_cost_usd; leave headroom under the cap
  # so the post-maker budget re-check does not halt a legitimate first-iteration Done.
  usd: 10
  iteration_cap: 5
  no_progress_window: 2

human_gate: true

capabilities:
  required:
    headlessMode: full
    worktree: full
    subagent: full