[jflavan]

Three features that make the loop safer to leave alone and easier to tune. Design: docs/superpowers/specs/2026-10-27-risk-retro-acceptance-design.md; plan: docs/superpowers/plans/2026-10-27-risk-retro-acceptance.md; each call is a bullet in docs/decisions.md.

Risky changes need a person

• gates.merge.risky: { paths, lines, human }. A change that touches a matching file (Bun.Glob, renames count under either name), or changes more than lines lines, waits for a person even with gates.merge.human: none.
• Decided once, in passMergeGate, on the code that will merge. It is recorded as a runtime merge_gate: pr | status frontmatter field in the same record as the move to merge-review, plus a merge/risk gate row. Its note names up to 3 files.
• changeGates gives every reader the change's own gate: waitsForPerson, isRunnable, offers, attention, mayMergeFirst, the merge stage, and Per-change resources and automatic conflict resolution #90's kept-mergeable check.
• Off by default. loopstra setup github suggests paths from the files in the repo.

loopstra retro [--days N]

• A read-only plain-text report over the trace: what reached main, where changes blocked (classified by the runtime's own note constants), gate first-time pass rates, spending by kind of step, how long people kept changes waiting.
• Ends with suggestions, each with its evidence and the setting to change: cheaper judges, fix loops, timeouts, review rounds, spending limit, a person who may not be needed, risky paths, acceptance tests.

Acceptance tests from Done when

• stages.build.acceptance_tests (schema default off; loopstra init turns it on). Before each build, a fresh acceptance session writes tests from the owner's Done when list.
• The tests are committed on the branch and recorded as intent/<slug>/acceptance.md. The protect-tests hook keeps build/fix/reconcile/revise off them, and the done-check reads them as evidence.
• A failed acceptance step never blocks. A wrong acceptance test is named in the block note.
• New step key acceptance (model follows the build stage), steerable like build.

Review

I ran /code-review high on the branch and fixed these findings:

• The acceptance step held only test paths, and dropped test-command output before committing. The test-path rule now lives in src/test-paths.ts, shared by the hook, which now also allows fixture folders.
• The done-check ignores a stale acceptance.md.
• Risk is not scored when a person is already on the merge gate.
• The risk note says how to stop the change and gives way to a pull request's wait.
• Retro leaves merge/risk out of gate lines.
• Retro's waits are found in one pass.
• The hook comment is up to date.

Left as designed:

• merge_gate stays on a merged change as a record.
• buildRetro keeps its own window filter, since it is a pure function over all-time status moves.

Merged with main after #90; staleWhileWaiting now reads each change's own gate.

Test plan

• bun run check: typecheck, lint, dead-code, and 1953 tests pass, 0 fail
• New tests: tests/unit/risk.test.ts, tests/integration/risk-gate.test.ts, tests/unit/retro.test.ts, the acceptance cases in stages-build/stages-verify/hook, the risky kept-mergeable case in conflicts
• CI on ubuntu, macOS and Windows

🤖 Generated with Claude Code