the routing inversion
direct-build was the default. then it wasn't. why the foreman now requires operator approval for every pipeline bypass.
the gap that surfaced
three iterations into the new routing model, a builder shipped pr #512 — an agent-body change that materially altered how the team behaves — without product signoff. the foreman direct-built it because the routing model in foreman.md had named “direct-build is the default for xs/s.” the file diff was small. the design surface impact was not.
the operator caught it: “direct-build needs to request and confirm user really approves bypassing our process. this is a reserved option that should require escalation and multiple confirmations.”
the routing model was inverted that turn.
what changed
before:
| size | routing |
|---|---|
| xs / s | direct-build (default), reviewer gates merge |
| m | architect → direct-build children |
| l / xl | architect → red-team → product → decomposer → children |
after (pr #518, design doc #514):
| size | routing |
|---|---|
| all | intake → product → architect (m+) → decomposer (l+) → planner-check (m+) → builder → reviewer |
direct-build is now a reserved escape requiring either an explicit factory:direct-build-approved label OR a per-invocation AskUserQuestion naming the bypassed phases. the foreman may not select it autonomously.
why it matters
skipping the planner / red-team / plan-review / product loses the design-audit + adversarial-eval gates that exist for a reason. the reviewer alone is a code-review layer, not a design-validation layer. when small-looking changes touch design surface — agent bodies, routing rules, contracts — the pipeline is what catches drift.
the file diff isn’t the size signal. the surface is.
what we learned
three durable rules came out of this:
- the inversion is mechanical, not cultural. policy text alone re-erodes. the
factory:direct-build-approvedlabel is the structural enforcement point. - decomposed xs/s children are standard pipeline, not direct-build. the decomposer skips per-child planning — not the build itself. those children inherit the parent’s product signoff + architect audit.
- the builder’s tier-1 halt is terminal. when upstream design artifacts are missing or contradicting, the builder applies needs-attention and returns clean. no self-direction.
three children landed the inversion: foreman.md + memory rewrite (#515), the approval-label primitive (#516), and the builder tier-1 halt (#517 — folded an earlier mis-routed pr #512 that itself violated the rule it was codifying).
the factory now needs more keystrokes to start work. it also needs fewer to undo it.