Auto-Commit Is Prompt Policy

CodeAlmanac treats auto-commit as permission given to the lifecycle agent, not as a Python-side Git committer. The Python code renders a source_control policy into build, ingest, and Garden prompts. The agent may then use normal Git commands if the policy allows it, but CodeAlmanac does not stage files or run git commit itself [@live_agreement][@commit_policy].

This decision keeps authorship and judgment together. Lifecycle agents decide what wiki source changed and whether it is worth committing within the allowed policy. Python records the harness run, refreshes the index, and validates the wiki after harness success; it does not become a separate commit orchestration pipeline [@operation_service].

Status#

Accepted. operation_commit_policy and the architecture tests forbidding a Python-side committer are both in place [@commit_policy][@architecture_tests].

Context#

The active Python agreement states the rule directly: intelligence lives in prompts, and auto-commit is prompt policy rather than CodeAlmanac staging or smart Git orchestration [@live_agreement]. It also records the default as auto_commit = true, with setup --no-auto-commit and config set auto_commit false changing only the prompt permission [@live_agreement].

The base prompt follows the same contract. It tells the agent to follow the runtime source_control policy, and if committing is allowed, to use normal Git commands and commit only the allowed wiki source files named by that policy [@kernel]. The broader prompt and manual packaging path is described in Prompts and manuals.

Decision#

operation_commit_policy builds a typed policy object with auto_commit, allowed files, forbidden files, a commit-message shape, and human-readable instructions [@commit_policy]. When auto-commit is enabled, the instructions allow committing wiki source changes, require normal Git commands from the repository root, restrict commits to allowed wiki source files, and forbid committing runtime state, application source, logs, or unrelated files [@commit_policy].

When auto-commit is disabled, the instructions tell the agent not to commit, to leave wiki source changes in the working tree, not to stage files, and not to run git commit [@commit_policy]. The allowed source files are almanac/**/*.md and almanac/topics.yaml; user config under ~/.codealmanac/, runtime state, application source files, logs, and unrelated repository files are forbidden [@commit_policy].

Build, ingest, and Garden all pass this policy into their prompt payloads [@build_workflow][@ingest_workflow][@garden_workflow]. The policy is therefore part of the operation context the agent reads, not an after-the-fact Python step.

Consequences#

Python does not own a committer abstraction. Architecture tests reject files named like committer.py, git_committer.py, staging.py, or commit_service.py, and they also fail if Python source contains direct git add or git commit command fragments [@architecture_tests].

The upside is a small lifecycle core. CodeAlmanac can render policy, run the harness, record events, refresh the index, validate the wiki, and mark the run terminal without splitting writing and committing into separate engines [@operation_service]. The cost is that commit quality depends on the agent following the prompt, so the policy must stay clear.

This decision is part of the same product stance as No propose/apply or dry-run: when judgment belongs to the agent, the product gives the agent real source material and clear constraints instead of building a second state machine around it.