Supporting
Renovate governance ladder
A role-based agent workflow for dependency upgrades with explicit contracts, stop causes, investigation lanes, and merge-authority boundaries.
Merge authority
Classifier — never merges
Investigator — no merge authority
Maintainer — merges only when policy and checks allow
Phase 6 automation triggers (schedules/webhooks) are deferred until the manual path is routine.
Open Renovate PRs are handled through a manual four-step ladder: classify one active (non-draft) PR per run into a YAML execution packet; route to maintainer auto-path, investigation, or hard stop; optionally investigate high-touch/unlisted packages; then execute only when policy and CI allow.
Draft Renovate PRs stay parked until marked ready — they are reported in discovery but not selectable by the ladder.
Renovate governance ladder
Classify → investigate or maintainer path → merge gates. Walkthrough of the Codenames Renovate governance ladder.
Talk trackWalk Classify → Route → Investigate or Maintainer → Merge gates. The classifier emits a packet and never merges; the maintainer may merge only when policy and checks allow.
Node detail
no node selected
Select a node
Three agents, one routing step, one governance gate
Each node owns one write boundary in the ladder. Select one to read its summary and evidence; press it again, or click the canvas, to close.
I designed and built the role-based AI engineering workflows — planning, review, verification, investigation, and publishing — with reusable contracts, authority constraints, and evaluation while developing production software.
The Renovate ladder is one operationalization of that pattern: classifier, investigator, and maintainer agents with distinct write boundaries.
Merge authority is gated: the classifier never merges; the investigator has no merge authority and never passes --approved; the maintainer may merge only when packet shape, policy version, head SHA, and required checks allow — merge commits only.
Investigation-approved execution remains restricted to dependency-only allowed paths.
Contract: Hard stops and deferrals are first-class outcomes, not failures of the workflow.
Merge gates
Packet shape
Policy version
Head SHA
Required checks
Merge commits only.
Operators run /renovate-classifier (or /renovate-loop for batch), route by packet, and for investigation-eligible stops run the investigator, human-audit the report, then invoke /renovate-maintainer --approved.
Each maintainer run writes a gitignored audit report.
Run order
/renovate-classifier
route by packet
investigator + human audit
/renovate-maintainer --approved
Automation triggers deferred to Phase 6.
Plans and packets must name where agents stop — not only what to build.
Authority handoffs, overridable stop_causes, and draft-parking for ecosystem majors keep automation from outrunning human judgment.
Contract: Evidence-driven upgrade investigation replaces blind trust in green CI alone.
Artifacts and related writing
Field report — the investigation lane in block 04.
Field report — the authority handoffs in block 06.
Each maintainer run writes one locally; no public artifact.
Public field reports above. No invented maintenance KPIs — the system's value is explicit stop conditions and auditability. · The same role-based pattern, editorial lane — AI-assisted editorial workflow →