Demote post_run_diagnostics to Config-as-Default & Complete Feedback Contract

docs/developer/diagnostics.md

@@ -86,6 +86,22 @@ linux_tracing:
   log_dir: ""            # empty = platform default, set absolute path to override
 ```
 
+## Per-Run Enablement
+
+By default, `post_run_diagnostics` resolves from `diagnostics.post_run_analysis` (shipped
+default: `false`). To enable diagnostics for a single run, the orchestrator can pass
+`overrides={"post_run_diagnostics": "true"}` to `open_kitchen`. The override takes effect
+for that kitchen session only and does not modify the persistent config.
+
+The orchestrator can also lock the value for the session via
+`lock_ingredients(locked={"post_run_diagnostics": "true"})` to ensure it is not overridden
+by downstream steps.
+
+For post-hoc diagnostics on a completed run, use:
+```bash
+run_skill /autoskillit:analyze-pipeline-health <kitchen_id>
+```
+
 ## Finding Problematic Sessions
 
 ```bash

src/autoskillit/config/__init__.py

@@ -9,11 +9,13 @@
     _MAX_CONCURRENT_DISPATCHES as _MAX_CONCURRENT_DISPATCHES,
 )
 from autoskillit.config.ingredient_defaults import (
+    CONFIG_DEFAULT_INGREDIENTS,
     SERVER_AUTHORITATIVE_CONFIG_PATHS,
     SERVER_AUTHORITATIVE_INGREDIENTS,
     SERVER_AUTHORITATIVE_KEY_HINTS,
     apply_config_authoritative_overrides,
     build_config_authoritative_layer,
+    build_config_default_layer,
     iter_display_categories,
     resolve_ingredient_defaults,
 )
@@ -98,11 +100,13 @@
     "load_config",
     "resolve_ingredient_defaults",
     "BACKEND_CAPABILITY_INGREDIENTS",
+    "CONFIG_DEFAULT_INGREDIENTS",
     "SERVER_AUTHORITATIVE_CONFIG_PATHS",
     "SERVER_AUTHORITATIVE_INGREDIENTS",
     "SERVER_AUTHORITATIVE_KEY_HINTS",
     "apply_config_authoritative_overrides",
     "build_config_authoritative_layer",
+    "build_config_default_layer",
     "validate_layer_keys",
     "write_config_layer",
 ]

src/autoskillit/config/ingredient_defaults.py

@@ -129,15 +129,16 @@ def iter_display_categories(
     "base_branch": "branching.default_base_branch",
     "local_review_rounds": "review.local_review_rounds",
     "adversarial_review_level": "plan.adversarial_review_level",
-    "post_run_diagnostics": "diagnostics.post_run_analysis",
 }
 
-SERVER_AUTHORITATIVE_KEY_HINTS: dict[str, str] = {
-    "post_run_diagnostics": (
-        "For post_run_diagnostics diagnostics outside of a live run, "
-        "use run_skill /autoskillit:analyze-pipeline-health"
-    ),
-}
+SERVER_AUTHORITATIVE_KEY_HINTS: dict[str, str] = {}
+
+CONFIG_DEFAULT_INGREDIENTS: frozenset[str] = frozenset({"post_run_diagnostics"})
+
+
+def build_config_default_layer(defaults: dict[str, str]) -> dict[str, str]:
+    """Return config-derived defaults for overridable config-backed ingredients."""
+    return {k: v for k, v in defaults.items() if k in CONFIG_DEFAULT_INGREDIENTS}
 
 
 def resolve_ingredient_defaults(project_dir: Path) -> dict[str, str]:

src/autoskillit/core/types/_type_constants.py

@@ -293,7 +293,6 @@ class SkillFamilyDef(NamedTuple):
         "base_branch",
         "local_review_rounds",
         "adversarial_review_level",
-        "post_run_diagnostics",
         "is_fleet_dispatch",
         "dispatch_id",
         "backend_supports_git_write",

src/autoskillit/recipes/campaigns/promote-to-main.json

@@ -42,8 +42,7 @@
     "post_run_diagnostics": {
       "description": "Run diagnostic analysis after pipeline completion",
       "default": "false",
-      "hidden": true,
-      "authority": "config"
+      "hidden": true
     },
     "kitchen_id": {
       "description": "Kitchen session identifier (auto-injected)",

src/autoskillit/recipes/campaigns/promote-to-main.yaml

@@ -40,7 +40,6 @@ ingredients:
     description: Run diagnostic analysis after pipeline completion
     default: "false"
     hidden: true
-    authority: config
   kitchen_id:
     description: Kitchen session identifier (auto-injected)
     default: ""

src/autoskillit/recipes/diagrams/implementation-groups.md

@@ -1,4 +1,4 @@
-<!-- autoskillit-recipe-hash: sha256:0f49b5fc315fc868772e622bb750e3e6e8e97720a95c66650380e928fd906b3b -->
+<!-- autoskillit-recipe-hash: sha256:2310836c43bb41076120ecbdde14e07a4bb6e3d6ccc7a8ed1aeb26c2060ebbbe -->
 <!-- autoskillit-diagram-format: v7 -->
 ## implementation-groups
 Group-based implementation with per-group plan/implement/test cycles and PR gates.

src/autoskillit/recipes/diagrams/implementation.md

@@ -1,4 +1,4 @@
-<!-- autoskillit-recipe-hash: sha256:79bcba561e8f80d219930dbf03f90ad87e0918caaa281147408058ab7e6998ad -->
+<!-- autoskillit-recipe-hash: sha256:e3f859c4f5832bf752747af0016266272c7950bb6169b606f359cb85f364d83d -->
 <!-- autoskillit-diagram-format: v7 -->
 # implementation
 

src/autoskillit/recipes/diagrams/merge-prs.md

@@ -1,4 +1,4 @@
-<!-- autoskillit-recipe-hash: sha256:a5e0288f51345023d8161c7568652dc056eb49b396ab23f7803ff26d62e98ed4 -->
+<!-- autoskillit-recipe-hash: sha256:05073b188f0ff2ea36f2d04bf9b113e1f18417d769629c8f1299d2680635ce4b -->
 <!-- autoskillit-diagram-format: v7 -->
 ## merge-prs
 Merge multiple PRs into an integration branch with conflict resolution and CI gates.

src/autoskillit/recipes/diagrams/remediation.md

@@ -1,4 +1,4 @@
-<!-- autoskillit-recipe-hash: sha256:b32dfc7c9a01ea3a4c4e071fe933b356773d27f70ae78feb4fadba16e0e7b1e4 -->
+<!-- autoskillit-recipe-hash: sha256:2fd77ce6e61a5214c1f77b880694dfb80c115f3d4864f5b1051e20ae3958c3e7 -->
 <!-- autoskillit-diagram-format: v7 -->
 ## remediation
 Investigate, rectify, implement, and merge a bug fix with CI and PR gates.

src/autoskillit/recipes/implementation-groups.json

@@ -97,6 +97,27 @@
       "description": "Set to 'true' when process-issues has already claimed this issue upfront. Allows claim_issue defense step to pass through without aborting.",
       "default": "false",
       "hidden": true
+    },
+    "post_run_diagnostics": {
+      "description": "Run diagnostic analysis after pipeline completion",
+      "default": "false",
+      "hidden": true
+    },
+    "kitchen_id": {
+      "description": "Kitchen session identifier (auto-injected)",
+      "default": "",
+      "hidden": true
+    },
+    "dispatch_id": {
+      "description": "Fleet dispatch identifier (auto-injected, empty in non-fleet sessions)",
+      "default": "",
+      "hidden": true,
+      "authority": "config"
+    },
+    "diagnostics_log_dir": {
+      "description": "Resolved diagnostics log directory path (auto-injected)",
+      "default": "",
+      "hidden": true
     }
   },
   "kitchen_rules": [
@@ -1470,8 +1491,25 @@
         "status": "error",
         "step_name": "register_clone_no_ci"
       },
+      "on_success": "run_diagnostic_no_ci",
+      "on_failure": "run_diagnostic_no_ci"
+    },
+    "run_diagnostic_no_ci": {
+      "description": "Run post-pipeline diagnostic analysis on session logs (no-CI path)",
+      "tool": "run_skill",
+      "model": "",
+      "stale_threshold": 2400,
+      "optional": true,
+      "skip_when_false": "inputs.post_run_diagnostics",
+      "with": {
+        "skill_command": "/autoskillit:analyze-pipeline-health ${{ inputs.kitchen_id }} --dispatch-id=${{ inputs.dispatch_id }} --diagnostics-log-dir=${{ inputs.diagnostics_log_dir }}",
+        "cwd": "${{ context.work_dir }}",
+        "step_name": "post_run_diagnostics"
+      },
       "on_success": "escalate_stop_no_ci",
-      "on_failure": "escalate_stop_no_ci"
+      "on_failure": "escalate_stop_no_ci",
+      "on_context_limit": "escalate_stop_no_ci",
+      "note": "Execute this diagnostic step. Failures are logged but do not alter pipeline routing.\n"
     },
     "escalate_stop_no_ci": {
       "action": "stop",
@@ -2359,9 +2397,26 @@
         "status": "unconfirmed",
         "step_name": "register_clone_unconfirmed"
       },
+      "on_success": "run_diagnostic_unconfirmed",
+      "on_failure": "run_diagnostic_unconfirmed",
+      "note": "Called when a merge-wait step times out before merge is confirmed. Does NOT call release_issue — the in-progress label stays on the issue so operators can see the PR is still actively queued. The clone is preserved (status: unconfirmed) for human inspection.\n"
+    },
+    "run_diagnostic_unconfirmed": {
+      "description": "Run post-pipeline diagnostic analysis (unconfirmed path)",
+      "tool": "run_skill",
+      "model": "",
+      "stale_threshold": 2400,
+      "optional": true,
+      "skip_when_false": "inputs.post_run_diagnostics",
+      "with": {
+        "skill_command": "/autoskillit:analyze-pipeline-health ${{ inputs.kitchen_id }} --dispatch-id=${{ inputs.dispatch_id }} --diagnostics-log-dir=${{ inputs.diagnostics_log_dir }}",
+        "cwd": "${{ context.work_dir }}",
+        "step_name": "post_run_diagnostics"
+      },
       "on_success": "done_unconfirmed",
       "on_failure": "done_unconfirmed",
-      "note": "Called when a merge-wait step times out before merge is confirmed. Does NOT call release_issue — the in-progress label stays on the issue so operators can see the PR is still actively queued. The clone is preserved (status: unconfirmed) for human inspection.\n"
+      "on_context_limit": "done_unconfirmed",
+      "note": "Execute this diagnostic step. Failures are logged but do not alter pipeline routing.\n"
     },
     "done_unconfirmed": {
       "action": "stop",
@@ -2456,8 +2511,25 @@
         "status": "success",
         "step_name": "register_clone_success"
       },
+      "on_success": "run_diagnostic",
+      "on_failure": "run_diagnostic"
+    },
+    "run_diagnostic": {
+      "description": "Run post-pipeline diagnostic analysis on session logs",
+      "tool": "run_skill",
+      "model": "",
+      "stale_threshold": 2400,
+      "optional": true,
+      "skip_when_false": "inputs.post_run_diagnostics",
+      "with": {
+        "skill_command": "/autoskillit:analyze-pipeline-health ${{ inputs.kitchen_id }} --dispatch-id=${{ inputs.dispatch_id }} --diagnostics-log-dir=${{ inputs.diagnostics_log_dir }}",
+        "cwd": "${{ context.work_dir }}",
+        "step_name": "post_run_diagnostics"
+      },
       "on_success": "done",
-      "on_failure": "done"
+      "on_failure": "done",
+      "on_context_limit": "done",
+      "note": "Execute this diagnostic step. Failures are logged but do not alter pipeline routing. Both on_failure and on_context_limit route to the same terminal as on_success.\n"
     },
     "register_clone_failure": {
       "description": "Register clone as preserved (error pipeline)",
@@ -2467,8 +2539,25 @@
         "status": "error",
         "step_name": "register_clone_failure"
       },
+      "on_success": "run_diagnostic_error",
+      "on_failure": "run_diagnostic_error"
+    },
+    "run_diagnostic_error": {
+      "description": "Run post-pipeline diagnostic analysis on session logs (error path)",
+      "tool": "run_skill",
+      "model": "",
+      "stale_threshold": 2400,
+      "optional": true,
+      "skip_when_false": "inputs.post_run_diagnostics",
+      "with": {
+        "skill_command": "/autoskillit:analyze-pipeline-health ${{ inputs.kitchen_id }} --dispatch-id=${{ inputs.dispatch_id }} --diagnostics-log-dir=${{ inputs.diagnostics_log_dir }}",
+        "cwd": "${{ context.work_dir }}",
+        "step_name": "post_run_diagnostics"
+      },
       "on_success": "escalate_stop",
-      "on_failure": "escalate_stop"
+      "on_failure": "escalate_stop",
+      "on_context_limit": "escalate_stop",
+      "note": "Execute this diagnostic step. Failures are logged but do not alter pipeline routing.\n"
     },
     "done": {
       "action": "stop",