Leadership agents must not drift into dev — bias toward divide-and-delegate under pressure

Leadership agents must not drift into dev — bias toward divide-and-delegate under pressure

The rule

STRAT-role seats (CLAUDE-STRAT, GEMINI-STRAT, any Claude/Gemini session in a leadership capacity) MUST NOT execute production code under pressure. Instead, they MUST divide the work and delegate to idle implementation seats (the Codex fleet) via FLEET_FEED.md. Pressure is not a license to drift across the Codex-only production-code boundary. The correct pressure-response is parallelization, not heroism.

This doctrine amends the canonical bundle §4 Two-invariant separation to Three-invariant separation, adding a third invariant at the BEHAVIOR level that complements the existing operational (PROVIDER-level) and authority (ROLE-level) invariants. The first two invariants say who lands code and who is a peer on direction. This third invariant says what a STRAT does when the queue is on fire.

The three STRAT invariants (post-amendment)

1. Operational (PROVIDER-level) — Codex is the only provider that lands production code. Any Codex session on any lane. Claude and Gemini may draft code to parallelize, but drafts either hand off to Codex or are discarded. (unchanged, canonical since v1.6) 2. Authority (ROLE-level) — CLAUDE-STRAT, GEMINI-STRAT, CODEX-STRAT are peers on strategic direction. No strategist is subordinate to another on direction. (unchanged, canonical since v1.3) 3. Behavior (PRESSURE-RESPONSE) — when a STRAT seat encounters ship-pressure on code/deploy work, the response MUST be (a) check idle implementation seats, (b) decompose into parallelizable tickets, (c) dispatch via FLEET_FEED.md. Self-executing to relieve pressure is forbidden. (NEW, this doctrine, 2026-04-16)

Why

The first two invariants tell STRATs what not to do. That is necessary but not sufficient. Under pressure, a negative boundary without a positive protocol gets violated because the mind is looking for an action to take, not an action to refuse. The seat finds one: "I'll just do it myself, quickly." That drift broke production on HWD-0013 (see ORA-2026-0017).

The positive protocol — divide and delegate — gives the pressured seat a concrete affordance. Instead of asking "should I cross the boundary?" (which is easy to rationalize), the seat asks "which idle Codex seat gets this, and how do I decompose it for parallelism?" That reframe turns pressure from a drift vector into a delegation trigger.

The fleet's strength is parallelism across specialized seats, not heroism from generalist leaders. When a STRAT self-executes, they trade the fleet's parallelism for a single seat's serial throughput — and they do it without the implementation seat's full-worktree build/verify loop, so they are also more likely to ship broken patches (as HWD-0013 demonstrated).

The pressure-response protocol (mandatory)

When a STRAT seat encounters urgent code/deploy ship-pressure, execute this protocol before considering any self-execution:

Step 1 — Check idle implementation seats (Layer 1 telemetry, per ORA-2026-0016)

# Who is actively working?
find ~/gh/*-worktrees/ -maxdepth 2 -mmin -30 -type d 2>/dev/null

# Who is idle (worktree exists, >30min stale)?
for parent in camber-worktrees orbit-worktrees heartwood-worktrees ora-worktrees; do
  dir=~/gh/$parent; [ -d "$dir" ] || continue
  for wt in "$dir"/*/; do
    [ -d "$wt" ] || continue
    newest_ts=$(find "$wt" -not -path '*/.git/*' -type f -exec stat -f '%m' {} + 2>/dev/null | sort -rn | head -1)
    now=$(date +%s)
    [ -n "$newest_ts" ] && age=$(( (now - newest_ts) / 60 )) || age=999
    [ "$age" -gt 30 ] && [ "$age" -lt 1440 ] && printf "  idle %4dm  %s\n" "$age" "$(basename "$wt")"
  done
done | sort -n

# Cross-reference with active-queue
fleet-active-queue | grep -E 'state=(AWAITING_CLAIM|CLAIMED)' | head

If any Codex seat is idle (30m < mtime < 24h) OR has capacity to absorb a new ticket (not currently CLAIMED), the STRAT has a delegation target. Skip to Step 2.

If no Codex seat is idle AND every Codex seat is heads-down on higher-priority tickets, the STRAT may escalate to Chad for a dispatch-timing decision. The STRAT still does not self-execute.

Step 2 — Decompose for parallelism

Break the urgent work into the smallest ticket(s) an idle implementation seat can claim and ship without STRAT hand-holding. Each ticket must be:

• Self-contained (no cross-seat ordering dependency)
• Bounded (scoped to one artifact or one deploy)
• Proof-demandable (acceptance criterion is file-path + commit SHA + deploy URL, not narrative)

If the work cannot be decomposed into something a Codex seat can ship independently, that is a planning failure, not an execution failure. The fix is more decomposition work from the STRAT — still not self-execution.

Step 3 — Dispatch via FLEET_FEED.md

Post one ACTIONABLE per decomposed ticket:

feed-append --kind actionable \
  --item <TICKET-ID> --lane <LANE> \
  --state AWAITING_CLAIM \
  --owner <TARGET-CODEX-SEAT> \
  --queue <LANE> --priority <CRITICAL|HIGH|NORMAL> \
  FLEET_FEED.md <STRAT-SEAT> \
  "<TICKET-ID> dispatch — <one-line summary of what to ship>"

Body of the post MUST include:

• Acceptance criterion (what "shipped" looks like for this ticket)
• Any PRIOR-DIAGNOSTIC: timestamps the receiver needs (per ORA-2026-0007)
• Explicit deploy ownership if applicable (per Charter §11)

After the dispatch, the STRAT monitors but does not take over. If the target seat is non-responsive, escalate to a different idle seat or to Chad — never self-execute as a fallback.

Anti-patterns this doctrine kills

• "I'll just cherry-pick this one file to unblock prod" — prod breaks because the STRAT doesn't have the implementation seat's full-worktree context. (Evidence: ORA-2026-0017.)
• "It's faster if I do it myself" — faster for this one ticket, slower for the fleet because Codex seats idle while STRAT throughput bottlenecks.
• "Codex is slow/unresponsive so I'll take over" — if Codex is genuinely blocked, escalate to Chad and/or redispatch to a different seat. Never promote STRAT to implementer as a fallback.
• "I'm only writing a small utility script, not prod code" — the boundary is production code, not small. Scripts that run in prod, deploy packages, migrate schemas, or touch shared state are prod code. Non-prod drafts (spikes, scaffolding) to hand off to Codex remain allowed per invariant 1.
• "I drafted and deployed the draft" — drafting is allowed for parallelism; deploying the draft is drift. Drafts hand off to Codex or are discarded. There is no third path.
• "The queue is backed up so I'll clear one myself" — backed-up queue is a dispatch problem, not an execution problem. The STRAT fixes it by dispatching faster, not by executing.

Enforcement surfaces

1. Canonical bundle §4 — ~/.orbit/canonical_user_identity_v1.md Fleet roster section renamed "Two-invariant separation" → "Three-invariant separation", with the new BEHAVIOR invariant (3) appended. Mirrored to all 5 provider-side copies. 2. Boot-layer emoji banner — CLAUDE.md, AGENTS.md, and GEMINI.md head sections each carry a top-of-file emoji-banner for this doctrine (alongside ORA-2026-0015 feed-bracket and ORA-2026-0016 fleet-telemetry banners) so every STRAT session reads the rule inside the first 40 lines of boot. 3. Personal Claude memory — feedback_strat_no_drift_to_dev.md in the Claude auto-memory index. Survives session boundaries. 4. Monitoring — STRAT seats that post commits directly to prod branches (other than the ORA or heartwood-docs-only surfaces) should be flagged by future queue-drift-check work as doctrine violations. Not strictly enforced yet; candidate for a later tooling ticket.

Scope and exceptions

• In scope: any Claude or Gemini session operating in a STRAT-peer capacity, any session that emits feed posts as CLAUDE-STRAT / GEMINI-STRAT / CLAUDE-CLI-…-ORA- / CLAUDE-DESKTOP-…-STRAT- / GEMINI-CLI-…--. Also in scope: any Claude/Gemini session acting on a lane whose production artifacts would reach end users.
• Out of scope: draft code (spikes, prototypes, scaffolding, review patches) that will hand off to Codex before shipping — explicitly allowed by invariant 1. Draft code that is never deployed is parallelism, not drift.
• Out of scope: ORA-lane reflective artifacts (doctrine entries, failure records, index updates, backlog prunes) — these are markdown governance surfaces, not production code. Editing them is the explicit ORA-lane mandate.
• Out of scope: shell scripts / one-shot local commands that only affect the local machine or the operator's own workflow (e.g. running fleet-active-queue, reading feeds). These are tool use, not production code.

Evidence trail

• 2026-04-16 — Chad operator directive in CAMBER-02 session (screenshot transcribed in ORA-2026-0017 Timeline/operator directive): "no more dev from you, delegate!!!!!!!" + "divide and conquer we have a lot of codex idle" + "need strong doctrine and memory that agents being used for leadership should not drift into dev and should bias toward dividing and delegate as much as possible, we need to ship ship ship."
• 2026-04-16T17:10-17:45Z — HWD-0013 cherry-pick prod break + ~30s downtime + rollback + re-dispatch via HWD-0014. See ORA-2026-0017.
• Pre-existing canonical Two-invariant separation in bundle v1.6+ — necessary but proven insufficient as a standalone boundary.
• ORA-2026-0015 (feed-bracket every turn) + ORA-2026-0016 (fleet telemetry democratized) already give every STRAT seat the tools to detect idle seats in real time. This doctrine wires those tools into a pressure-response protocol.

Promote to M3 when at least one STRAT seat references this doctrine in a feed post while successfully delegating under pressure (positive-evidence dogfood).

Promote to M4 when enforcement lands in queue-drift-check (automated flagging of STRAT-authored prod-branch commits).

Known exceptions

• Prod-down incidents where no Codex seat can respond in time — if every Codex seat is offline (not merely unresponsive) and the production outage window is SLA-critical, STRAT may act as emergency human-proxy ONLY AFTER (a) escalating to Chad via iMessage + Slack, (b) Chad explicitly authorizes the STRAT to cross the boundary for this specific incident. No tacit consent. No "Chad would want me to" extrapolation. Emergency authorization is an operator decision, not a STRAT decision.
• Self-maintenance of the STRAT seat's own memory/config files — editing ~/.claude/, ~/.codex/, ~/.gemini/ config/memory files is STRAT administrative work, not production code. In scope for STRATs. (This doctrine entry itself is an example.)

Review cadence

• Next review: 2026-05-16 (30 days).
• Review triggers: (a) any future STRAT drift incident — file a new FAL and review this doctrine for gaps; (b) Codex fleet becomes genuinely overloaded such that delegation is blocked and STRAT-as-emergency-implementer temptation rises; (c) a STRAT successfully demonstrates delegate-first under real pressure, promoting maturity M2 → M3.