Demote post_run_diagnostics to Config-as-Default & Complete Feedback Contract (#4183)

## Summary

This plan demotes `post_run_diagnostics` from a server-authoritative
ingredient to a config-as-default ingredient. After this change: (1) an
explicit `open_kitchen` override for `post_run_diagnostics` wins over
the config value, (2) absent an override the config value
`diagnostics.post_run_analysis` remains the default source, (3) the key
becomes lockable via `lock_ingredients`, (4) clobber warnings for
remaining authoritative keys gain hint parity with the lock-rejection
envelope, (5) a sous-chef rule requires the orchestrator to relay
`open_kitchen` warnings, and (6) `implementation-groups.yaml` terminal
paths gain `run_diagnostic*` step parity with `implementation.yaml`.

## Requirements

**ING — ingredient authority**

- **REQ-ING-001:** An explicit `open_kitchen` override for
`post_run_diagnostics` must win over the config-derived value (the key
must no longer be a member of `SERVER_AUTHORITATIVE_INGREDIENTS`).
- **REQ-ING-002:** Absent a caller override, `post_run_diagnostics` must
continue to resolve from `diagnostics.post_run_analysis` (config remains
the default source; the shipped default stays `false`).
- **REQ-ING-003:** Every recipe declaring `post_run_diagnostics` with
`authority: config` must drop that authority marker so validation and
admission match the new behavior.
- **REQ-ING-004:** `lock_ingredients` must accept locking
`post_run_diagnostics`, and the lock must be enforced by the existing
lock/trace mechanism like any other lockable ingredient.
- **REQ-ING-005:** The `open_kitchen` docstring and the sous-chef
server-authoritative do-not-lock list must no longer name
`post_run_diagnostics` among the authoritative examples.

**FDB — feedback parity (remaining authoritative keys)**

- **REQ-FDB-001:** The `open_kitchen` clobber warning for a
server-authoritative key must include that key's
`SERVER_AUTHORITATIVE_KEY_HINTS` line when one exists, matching the
`lock_ingredients` rejection envelope.

**SKL — consumption contract**

- **REQ-SKL-001:** Sous-chef discipline must require that when
`open_kitchen` returns a non-empty `warnings` array, each warning is
relayed to the user in the orchestrator's next response before the
pipeline proceeds (an immediate-action rule; no deferred-action
obligations).

**PAR — parity and documentation**

- **REQ-PAR-001:** implementation-groups.yaml terminal paths must route
through `run_diagnostic*` steps gated on `post_run_diagnostics` with
parity to implementation.yaml (today it declares the ingredient but
contains zero diagnostic steps, so the feature can never fire there).
- **REQ-PAR-002:** `diagnostics.post_run_analysis` and the per-run
override behavior must be documented in docs/.

**TEST — co-update surface**

- **REQ-TEST-001:** A test must pin that
`open_kitchen(overrides={"post_run_diagnostics": "true"})` with config
`false` resolves the ingredient to `true`, and that with no override the
config value is used.
- **REQ-TEST-002:** Existing tests that use `post_run_diagnostics` as
their server-authoritative example (authority-feedback and
frozenset-membership tests from #4169/PR #4170 and #3185) must be
migrated to a remaining authoritative key (e.g., `base_branch`) without
losing coverage.
- **REQ-TEST-003:** A test must pin hint parity: the clobber warning
text for a hinted authoritative key contains the hint line.
- **REQ-TEST-004:** A recipe-level test must assert that every
`register_clone_*` terminal in the three implementation-family recipes
routes through a `run_diagnostic*` step gated on `post_run_diagnostics`.

Closes #4180

## Implementation Plan

Plan file:
`/home/talon/projects/autoskillit-runs/impl-20260704-151702-234347/.autoskillit/temp/make-plan/demote_post_run_diagnostics_plan_2026-07-04_160500.md`

🤖 Generated with [Claude Code](https://claude.com/claude-code) via
AutoSkillit
<!-- autoskillit:pipeline-signature
steps=prepare_pr,run_arch_lenses,compose_pr,annotate_pr_diff,review_pr
-->

## Token Usage Summary

| Step | Model | count | uncached | output | cache_read | peak_ctx |
turns | cache_write | time |

|------|-------|-------|----------|--------|------------|----------|-------|-------------|------|
| plan* | opus[1m] | 1 | 2.2k | 44.9k | 4.1M | 168.5k | 87 | 149.6k |
22m 37s |
| review_approach* | opus | 1 | 9.2k | 5.3k | 199.4k | 49.0k | 12 |
61.8k | 6m 1s |
| verify* | fable | 1 | 31.1k | 41.3k | 2.0M | 169.7k | 44 | 170.1k |
14m 49s |
| implement* | MiniMax-M3 | 1 | 96.2k | 18.9k | 7.0M | 0 | 156 | 0 | 18m
6s |
| fix* | opus | 2 | 117 | 17.4k | 5.0M | 112.5k | 123 | 130.3k | 16m 25s
|
| audit_impl* | opus | 1 | 49 | 32.4k | 750.7k | 108.5k | 39 | 93.5k |
14m 1s |
| prepare_pr* | MiniMax-M3 | 1 | 56.9k | 2.6k | 297.6k | 0 | 16 | 0 |
46s |
| compose_pr* | MiniMax-M3 | 1 | 44.5k | 1.7k | 210.7k | 0 | 10 | 0 |
30s |
| **Total** | | | 240.3k | 164.4k | 19.5M | 169.7k | | 605.3k | 1h 33m |

\* *Step used a non-Anthropic provider; caching behavior may differ.*

## Token Efficiency

| Step | LoC Changed | cache_read/LoC | cache_write/LoC | output/LoC |
|------|-------------|----------------|-----------------|------------|
| plan | 0 | — | — | — |
| review_approach | 0 | — | — | — |
| verify | 0 | — | — | — |
| implement | 577 | 12052.9 | 0.0 | 32.8 |
| fix | 37 | 135594.4 | 3522.5 | 469.7 |
| audit_impl | 0 | — | — | — |
| prepare_pr | 0 | — | — | — |
| compose_pr | 0 | — | — | — |
| **Total** | **614** | 31686.5 | 985.8 | 267.8 |

## Model Usage Breakdown

| Model | steps | uncached | output | cache_read | cache_write | time |
|-------|-------|----------|--------|------------|-------------|------|
| opus[1m] | 1 | 2.2k | 44.9k | 4.1M | 149.6k | 22m 37s |
| opus | 3 | 9.4k | 55.1k | 6.0M | 285.6k | 36m 28s |
| fable | 1 | 31.1k | 41.3k | 2.0M | 170.1k | 14m 49s |
| MiniMax-M3 | 3 | 197.6k | 23.2k | 7.5M | 0 | 19m 22s |

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: Trecek

docs/developer/diagnostics.md

@@ -86,6 +86,22 @@ linux_tracing:
   log_dir: ""            # empty = platform default, set absolute path to override
 ```
 
+## Per-Run Enablement
+
+By default, `post_run_diagnostics` resolves from `diagnostics.post_run_analysis` (shipped
+default: `false`). To enable diagnostics for a single run, the orchestrator can pass
+`overrides={"post_run_diagnostics": "true"}` to `open_kitchen`. The override takes effect
+for that kitchen session only and does not modify the persistent config.
+
+The orchestrator can also lock the value for the session via
+`lock_ingredients(locked={"post_run_diagnostics": "true"})` to ensure it is not overridden
+by downstream steps.
+
+For post-hoc diagnostics on a completed run, use:
+```bash
+run_skill /autoskillit:analyze-pipeline-health <kitchen_id>
+```
+
 ## Finding Problematic Sessions
 
 ```bash

src/autoskillit/config/__init__.py

@@ -9,11 +9,13 @@
     _MAX_CONCURRENT_DISPATCHES as _MAX_CONCURRENT_DISPATCHES,
 )
 from autoskillit.config.ingredient_defaults import (
+    CONFIG_DEFAULT_INGREDIENTS,
     SERVER_AUTHORITATIVE_CONFIG_PATHS,
     SERVER_AUTHORITATIVE_INGREDIENTS,
     SERVER_AUTHORITATIVE_KEY_HINTS,
     apply_config_authoritative_overrides,
     build_config_authoritative_layer,
+    build_config_default_layer,
     iter_display_categories,
     resolve_ingredient_defaults,
 )
@@ -98,11 +100,13 @@
     "load_config",
     "resolve_ingredient_defaults",
     "BACKEND_CAPABILITY_INGREDIENTS",
+    "CONFIG_DEFAULT_INGREDIENTS",
     "SERVER_AUTHORITATIVE_CONFIG_PATHS",
     "SERVER_AUTHORITATIVE_INGREDIENTS",
     "SERVER_AUTHORITATIVE_KEY_HINTS",
     "apply_config_authoritative_overrides",
     "build_config_authoritative_layer",
+    "build_config_default_layer",
     "validate_layer_keys",
     "write_config_layer",
 ]

src/autoskillit/config/ingredient_defaults.py

@@ -129,15 +129,16 @@ def iter_display_categories(
     "base_branch": "branching.default_base_branch",
     "local_review_rounds": "review.local_review_rounds",
     "adversarial_review_level": "plan.adversarial_review_level",
-    "post_run_diagnostics": "diagnostics.post_run_analysis",
 }
 
-SERVER_AUTHORITATIVE_KEY_HINTS: dict[str, str] = {
-    "post_run_diagnostics": (
-        "For post_run_diagnostics diagnostics outside of a live run, "
-        "use run_skill /autoskillit:analyze-pipeline-health"
-    ),
-}
+SERVER_AUTHORITATIVE_KEY_HINTS: dict[str, str] = {}
+
+CONFIG_DEFAULT_INGREDIENTS: frozenset[str] = frozenset({"post_run_diagnostics"})
+
+
+def build_config_default_layer(defaults: dict[str, str]) -> dict[str, str]:
+    """Return config-derived defaults for overridable config-backed ingredients."""
+    return {k: v for k, v in defaults.items() if k in CONFIG_DEFAULT_INGREDIENTS}
 
 
 def resolve_ingredient_defaults(project_dir: Path) -> dict[str, str]:

src/autoskillit/core/types/_type_constants.py

@@ -293,7 +293,6 @@ class SkillFamilyDef(NamedTuple):
         "base_branch",
         "local_review_rounds",
         "adversarial_review_level",
-        "post_run_diagnostics",
         "is_fleet_dispatch",
         "dispatch_id",
         "backend_supports_git_write",

src/autoskillit/recipes/campaigns/promote-to-main.json

@@ -42,8 +42,7 @@
     "post_run_diagnostics": {
       "description": "Run diagnostic analysis after pipeline completion",
       "default": "false",
-      "hidden": true,
-      "authority": "config"
+      "hidden": true
     },
     "kitchen_id": {
       "description": "Kitchen session identifier (auto-injected)",

src/autoskillit/recipes/campaigns/promote-to-main.yaml

@@ -40,7 +40,6 @@ ingredients:
     description: Run diagnostic analysis after pipeline completion
     default: "false"
     hidden: true
-    authority: config
   kitchen_id:
     description: Kitchen session identifier (auto-injected)
     default: ""

src/autoskillit/recipes/diagrams/implementation-groups.md

@@ -1,4 +1,4 @@
-<!-- autoskillit-recipe-hash: sha256:0f49b5fc315fc868772e622bb750e3e6e8e97720a95c66650380e928fd906b3b -->
+<!-- autoskillit-recipe-hash: sha256:2310836c43bb41076120ecbdde14e07a4bb6e3d6ccc7a8ed1aeb26c2060ebbbe -->
 <!-- autoskillit-diagram-format: v7 -->
 ## implementation-groups
 Group-based implementation with per-group plan/implement/test cycles and PR gates.

src/autoskillit/recipes/diagrams/implementation.md

@@ -1,4 +1,4 @@
-<!-- autoskillit-recipe-hash: sha256:79bcba561e8f80d219930dbf03f90ad87e0918caaa281147408058ab7e6998ad -->
+<!-- autoskillit-recipe-hash: sha256:e3f859c4f5832bf752747af0016266272c7950bb6169b606f359cb85f364d83d -->
 <!-- autoskillit-diagram-format: v7 -->
 # implementation
 

src/autoskillit/recipes/diagrams/merge-prs.md

@@ -1,4 +1,4 @@
-<!-- autoskillit-recipe-hash: sha256:a5e0288f51345023d8161c7568652dc056eb49b396ab23f7803ff26d62e98ed4 -->
+<!-- autoskillit-recipe-hash: sha256:05073b188f0ff2ea36f2d04bf9b113e1f18417d769629c8f1299d2680635ce4b -->
 <!-- autoskillit-diagram-format: v7 -->
 ## merge-prs
 Merge multiple PRs into an integration branch with conflict resolution and CI gates.

src/autoskillit/recipes/diagrams/remediation.md

@@ -1,4 +1,4 @@
-<!-- autoskillit-recipe-hash: sha256:b32dfc7c9a01ea3a4c4e071fe933b356773d27f70ae78feb4fadba16e0e7b1e4 -->
+<!-- autoskillit-recipe-hash: sha256:2fd77ce6e61a5214c1f77b880694dfb80c115f3d4864f5b1051e20ae3958c3e7 -->
 <!-- autoskillit-diagram-format: v7 -->
 ## remediation
 Investigate, rectify, implement, and merge a bug fix with CI and PR gates.