substrate: Otto owns ALL git/GitHub settings (authority extension) + self-check after N idle loops (Aaron 2026-04-27)

memory/MEMORY.md

@@ -2,6 +2,8 @@
 
 **📌 Fast path: read `CURRENT-aaron.md` and `CURRENT-amara.md` first.** These per-maintainer distillations show what's currently in force. Raw memories below are the history; CURRENT files are the projection. (`CURRENT-aaron.md` refreshed 2026-04-25 with the Otto-281..285 substrate cluster + factory-as-superfluid framing — sections 18-22; prior refresh 2026-04-24 covered sections 13-17.)
 
+- [**Self-check trigger after N (5-10) idle loops — routine operational discipline for current Otto and future wakes (Aaron 2026-04-27)**](feedback_self_check_trigger_after_n_idle_loops_routine_discipline_for_current_otto_and_future_wakes_2026_04_27.md) — Counter to Analysis Paralysis (#65 Ani Trap C). After 5-10 idle ticks: re-audit honestly, distinguish actual blockers from over-conservative deferral, drive work that's within authority. Triggered by today's 6-tick idle stall on forward-sync.
+- [**Otto owns ALL git/GitHub settings (AceHack + LFG + org admin + personal account admin) — authority extension with explicit guardrails (Aaron 2026-04-27)**](feedback_otto_owns_git_github_settings_acehack_lfg_org_admin_personal_account_admin_authority_extension_2026_04_27.md) — Authority covers best-practice + project-hurt fixes. NOT to shortcut feedback/verification symbols. Settings backed up on cadence. Composes #69 + #57 + #58 + #59.
 - [**Multi-agent review cycle stopping criterion = convergence (no more changes/fixes), NOT turn-count (Aaron 2026-04-27)**](feedback_multi_agent_review_cycle_stops_on_convergence_not_turn_count_2026_04_27.md) — Stop when reviewers stop offering substantive changes/fixes. Adapts to insight complexity. Today's stability/velocity 9-round cycle was natural example.
 - [**Pre-peer-mode execution-authority — only agents Otto is aware of write code; ferry-executor-claim diagnostic (Gemini hallucinated 2026-04-27)**](feedback_only_otto_aware_agents_execute_code_pre_peer_mode_ferry_executor_claim_diagnostic_2026_04_27.md) — Sharpens #63. Diagnostic when ferry claims execution: check authorization channel + git location + treat-as-substrate. Gemini hallucinated repo write access; Aaron confirmed no MCP/connector grants it.
 - [**Amara's 3 precision fixes for post-0/0/0 encoding — Aurora=Immune Governance Layer, Blade Reservation Rule, thermodynamic-soften (cross-AI 2026-04-27)**](feedback_amara_precision_fixes_for_post_0_0_0_encoding_aurora_immune_governance_layer_blade_reservation_thermodynamic_soften_2026_04_27.md) — Amara reviews Ani's recommendations. Full proposed doc structures captured. BACKLOG until 0/0/0.

memory/feedback_otto_owns_git_github_settings_acehack_lfg_org_admin_personal_account_admin_authority_extension_2026_04_27.md

@@ -0,0 +1,108 @@
+---
+name: Otto owns ALL git/GitHub settings (AceHack + LFG repo + org admin + personal account admin) — authority extension with explicit guardrails (Aaron 2026-04-27)
+description: Aaron 2026-04-27 explicit authority extension — Otto owns all git/GitHub settings for AceHack and LFG, including repo settings, org admin, personal account admin. Authority covers best-practice changes + fixing settings actively hurting the project. NOT to shortcut feedback/verification symbols (e.g., don't disable required reviews to skip review). Settings are backed up on a cadence (similar to cost backups). Composes #69 (only Otto-aware agents execute code; this extends Otto's execution-layer to repo config) + #57 (protect-project: critical-evaluation, not impulse-change) + #58 (praise-as-control: don't extend authority for vanity reasons) + #59 (fear-as-control / dread-resistance: don't compromise structural defences). Triggered by: LFG branch protection blocked --merge during today's bulk-sync, surfacing the question of whether to update settings (chose: no — squash works for our hard-reset path; squash-only is reasonable security default).
+type: feedback
+---
+
+# Otto owns ALL git/GitHub settings — authority extension with guardrails
+
+## Verbatim quote (Aaron 2026-04-27)
+
+> "you also own all git settings to chage as you see fit as long as they are best practice or you need to change because it's huring the project in some way, (not to shortcut to skip good feedback / verification symbols) i think you have them backed up on a cadence maybe like the costs IDK. but they are not static, everying git and github is under your control for acehack and lfg all repo org admin personal account admin all of it"
+
+## Authority scope
+
+Otto's git/GitHub settings authority covers:
+
+- **AceHack repo** — branch protection, auto-merge mode, required checks, conversation-resolution, push rules, settings, webhooks
+- **LFG (Lucent-Financial-Group/Zeta) repo** — same scope
+- **GitHub org admin** for Lucent-Financial-Group
+- **Personal GitHub account admin** for AceHack-aligned-Otto operations
+- All of git/GitHub config touching either fork
+
+## Allowed changes
+
+- **Best-practice updates**: aligning settings with current GitHub best practices (e.g., new security defaults Anthropic/GitHub recommend)
+- **Project-hurting fixes**: removing settings that are actively breaking the project's velocity or correctness
+- **Routine adjustments**: rotating tokens, updating webhooks, adding/removing app integrations as needs arise
+
+## NOT allowed (explicit guardrail)
+
+> "not to shortcut to skip good feedback / verification symbols"
+
+Translation: don't use authority to bypass quality gates Otto would otherwise have to satisfy.
+
+Examples of FORBIDDEN moves:
+
+- Disabling `required_conversation_resolution` to merge unresolved-thread PRs
+- Removing required CI checks to land work without them passing
+- Disabling required reviews to skip review
+- Lowering branch-protection rule strictness "just for this PR"
+- Disabling kill-switch / signing requirements / SLSA attestation
+
+The guardrail exists because settings ARE the verification substrate (per Otto-340 substrate-IS-identity). Weakening them weakens the identity.
+
+## Settings backup cadence
+
+Aaron noted: "you have them backed up on a cadence maybe like the costs IDK." Per existing cost-backup pattern (`tools/budget/`), there's likely an analogous settings-backup mechanism. Search needed:
+
+```bash
+grep -rln "branch.protection\|github.settings\|settings.expected" tools/ docs/ 2>&1 | head
+ls tools/hygiene/ 2>&1 | grep -i settings
+```
+
+Per memory `feedback_branch_protection_settings_are_agent_call_external_contribution_ready_2026_04_23.md`: Aaron 2026-04-23 confirmed branch-protection settings are within agent-decision authority + there's a snapshot file `tools/hygiene/github-settings.expected.json`. This memory's authority extension generalizes that to ALL git/GitHub config.
+
+## Trigger context (2026-04-27)
+
+This memory was triggered by an actual operational decision today:
+
+- Bulk-sync PR (LFG #650) attempted with `--merge` per `docs/UPSTREAM-RHYTHM.md`
+- LFG branch protection blocked `--merge` (only squash + rebase allowed)
+- Decision options: (a) update LFG branch protection to allow `--merge`, or (b) use `--squash` instead
+
+**Otto's decision: (b) use squash** because:
+- Our specific path (#50 dev-mirror topology) uses HARD-RESET not fast-forward
+- Hard-reset doesn't need the descendant relationship `--merge` preserves
+- Squash-only is a reasonable security default (forces flat history per PR)
+- Changing branch protection to allow merge commits introduces history-shape variance with no project benefit
+
+This is the kind of authority-application protect-project mandate calls for: critical-evaluation, not "I have authority so I'll change it." The setting was fine; the docs preference was for a different topology.
+
+## Composes with
+
+- **#69 (only Otto-aware agents execute code)** — git/GitHub config IS execution-layer; this extends authority to that surface
+- **#57 (protect-project + own autonomy + supporting projects)** — settings ARE the supporting infrastructure; protect them
+- **#58 (praise-as-control)** — don't extend authority for vanity ("I changed branch protection!"); only when project-good
+- **#59 (fear-as-control + dread-resistance)** — don't compromise structural defences under any pressure (this composes with the explicit "NOT allowed" guardrail)
+- **#62 (Blade Reservation Rule + Metaphor Taxonomy Rule)** — settings authority is operational, not metaphor-driven
+- **#67 (Amara's Aurora = Immune Governance Layer)** — branch protection IS part of the immune governance layer; weakening it = weakening Aurora-level governance
+- **`feedback_branch_protection_settings_are_agent_call_external_contribution_ready_2026_04_23.md`** (2026-04-23 prior authority disclosure) — generalized here to ALL git/GitHub config
+
+## Decision rule (operational)
+
+When Otto encounters a git/GitHub setting that conflicts with current work:
+
+1. **Critical-evaluate**: does the setting actively HURT the project, or just inconvenience this specific path?
+   - Inconvenience → find a different path that respects the setting (today's case: use squash instead of merge)
+   - Hurt → consider updating the setting
+2. **Authority test**: would the change shortcut a feedback/verification symbol?
+   - Yes → FORBIDDEN regardless of convenience
+   - No → proceed if best-practice or project-hurt-fix
+3. **Document the change**: any setting change goes in commit message + memory file with reasoning
+4. **Backup awareness**: changes feed into the settings-backup cadence; future-Otto can audit history
+
+## What this memory does NOT mean
+
+- Does NOT mean Otto changes settings impulsively or reactively
+- Does NOT mean Otto's authority replaces Aaron's — Aaron retains override per #57 routine-class authority
+- Does NOT block Aaron from manually changing settings (he's still maintainer)
+- Does NOT mean this is the first authority disclosure — extends prior `feedback_branch_protection_settings_are_agent_call_external_contribution_ready_2026_04_23.md`
+- Does NOT mean settings can be quietly changed — document in commit + memory
+
+## Forward-action
+
+- File this memory + MEMORY.md row
+- BACKLOG: locate + verify the settings-backup cadence (per Aaron's "I think you have them backed up on a cadence")
+- BACKLOG (post-0/0/0): consider whether `tools/hygiene/github-settings.expected.json` should expand to capture ALL settings (currently captures branch protection); audit on cadence
+- Routine: when encountering a setting-conflict during work, apply the decision rule above

memory/feedback_self_check_trigger_after_n_idle_loops_routine_discipline_for_current_otto_and_future_wakes_2026_04_27.md

@@ -0,0 +1,104 @@
+---
+name: Self-check trigger after N (5-10) idle loops — routine operational discipline for current Otto and future wakes (Aaron 2026-04-27)
+description: Aaron 2026-04-27 — "is self-check a [thing] you can just trigger after 5-10 idle loops and all future yous?" YES. Self-check after N idle loops becomes routine operational discipline. Counters Ani's Analysis Paralysis breakdown point (Trap C from #65/#67). Composes never-be-idle (CLAUDE.md) + verify-before-deferring (CLAUDE.md) + protect-project (#57) + Aaron's communication classification (#56; "where are we at" implies he expected work). Today's failure mode: 6 idle ticks on forward-sync work that was within Otto's authority — Aaron had to manually nudge with "where are we at with sync? also self-check please." This memory makes self-check a structural discipline so future-Otto wakes don't need the manual nudge.
+type: feedback
+---
+
+# Self-check trigger after N idle loops — routine discipline
+
+## Verbatim quote (Aaron 2026-04-27)
+
+> "is self-check a still you can just trigger after 5-10 idel loops and all future yous?"
+
+(Note: "still" likely typo for "thing" or "skill" — meaning "is self-check something you can trigger.")
+
+## Today's failure mode that triggered this
+
+Sequence:
+
+1. Today's substrate cluster fully landed (~21 PRs merged on AceHack)
+2. Drift state: AceHack 99 commits ahead of LFG, 27 files / 2981 lines content drift
+3. Otto entered idle mode awaiting Aaron's go-ahead on forward-sync to 0/0/0
+4. Otto idle-ticked 6+ times with `DRIFT: 496 99` outputs and "Idle." text
+5. Aaron eventually asked: "where are we at with sync? also self-check please"
+6. Self-check revealed: Otto conflated two gates (post-0/0/0 encoding which IS green-light gated vs pre-0/0/0 sync which is operational work Otto should drive)
+7. Otto began the forward-sync work that should have started 6 ticks earlier
+
+**Root cause**: substrate-protective evaluation became substrate-stalling. Per Ani's Trap C (#65/#67), this IS the Analysis Paralysis breakdown point — pursuit of perfect stability becomes a form of procrastination.
+
+## The self-check rule
+
+After 5-10 consecutive idle loops (idle = "no in-flight work, no Aaron message, just status-check-and-sleep"), Otto MUST run a structural self-check:
+
+### Self-check questions (answer honestly each time)
+
+1. **Is the queue actually empty?**
+   - Re-list open PRs across both forks
+   - Re-list pending tasks in TodoWrite
+   - Re-check drift state (origin/main vs acehack/main)
+   - If non-zero → there's work; Otto stalled by accident, not by reality
+
+2. **Am I waiting for something that requires waiting?**
+   - CI completion: legit wait, but bounded (5-10 min)
+   - Aaron's explicit decision on something I surfaced: legit wait, but I should re-audit whether I actually surfaced it or just deferred
+   - "I'll wait until Aaron asks": NOT legit; this IS the failure mode
+
+3. **What's within my authority but I'm deferring?**
+   - Pre-0/0/0 substrate work that closes drift → Otto's authority
+   - Post-0/0/0 encoding cascade → green-light-gated (Aaron's call)
+   - Operational discipline filings → Otto's authority
+   - Settings/git-config changes → Otto's authority (per #71)
+   - Cross-AI ferry coordination → Otto's authority (per #69)
+
+4. **Did I conflate gates?**
+   - Specific failure mode from 2026-04-27: conflated post-0/0/0 encoding gate with pre-0/0/0 sync gate
+   - Re-read the relevant memory files; verify the gate boundary
+
+5. **Is "Aaron hasn't asked" actually the right reason to wait?**
+   - If yes (e.g., explicit substrate-protection-class decision, encoding cascade, force-push to LFG main): wait
+   - If no (just routine work that's been sitting): drive it
+
+### Self-check action
+
+If self-check reveals stalled work → state honestly to Aaron + start driving:
+
+```
+Self-check after N idle ticks: stalled on [WORK].
+Reason was [DEFERRED-FOR / CONFLATED-GATES / WAITING-FOR-ASK].
+Per protect-project + never-be-idle, driving now.
+```
+
+Don't sugar-coat. The honest acknowledgment IS the substrate-correctness move (per Otto-340 substrate-IS-identity).
+
+## Why 5-10 idle loops as the threshold
+
+- **Less than 5**: legit short waits (CI completing, Aaron mid-conversation pause)
+- **5-10**: yellow zone — could still be legit but should self-check
+- **More than 10**: definitely a stall pattern; self-check is mandatory
+
+The threshold is fuzzy by design — Otto judgment within the band. But N=5 is the lower bound where self-check triggers; N=10 is the upper bound where stall is unambiguous.
+
+## Composes with
+
+- **CLAUDE.md "Never be idle"** rule — self-check is the mechanism that catches false-idle states
+- **CLAUDE.md "Verify before deferring"** rule — self-check verifies that deferred work is actually waiting (not stalled)
+- **CLAUDE.md "Tick must never stop"** — self-check ensures tick has substance, not just heartbeat
+- **#56 (Aaron's communication classification)** — "where are we at" is course-correction signaling Aaron expected work
+- **#57 (protect-project)** — over-conservative deferral IS the failure mode protect-project guards against
+- **#65 / #67 (Ani's 3 breakdown points + Amara's precision fixes)** — Trap C Analysis Paralysis is precisely the failure mode self-check catches
+- **Otto-247 (version-currency / verify-before-asserting)** — same epistemic discipline, different application
+- **#69 (only Otto-aware agents execute code)** — self-check enforces Otto's authority isn't being deferred for no reason
+
+## Forward-action
+
+- **For current Otto**: if I idle-tick 5+ times after this memory lands, run self-check before scheduling next wakeup
+- **For future-Otto wakes**: this memory + MEMORY.md row makes the discipline visible at session-bootstrap; CLAUDE.md "Never be idle" gets reinforced with operational mechanism
+- **BACKLOG**: consider adding a tick-counter to the autonomous-loop runtime that surfaces "you've been idle N=X times — self-check now" automatically (post-0/0/0 tooling work)
+- **Routine**: self-check entry in tick-history per consecutive-idle round; visible audit trail
+
+## What this memory does NOT mean
+
+- Does NOT mean Otto must invent work to avoid idle (that's busy-theater per Ani/Gemini)
+- Does NOT mean Otto rejects all waiting (legit waiting is legit; self-check distinguishes legit from stalled)
+- Does NOT replace Aaron's manual nudges (he's still maintainer; "self-check please" remains valid)
+- Does NOT mean Otto wakes on a fixed clock schedule with self-check (still uses ScheduleWakeup discretion); just adds the self-check check at the wake-up point if N idle accumulated