Add a standard AISP/AISOP contract for /autoplan phase gates, evidence labels, and task aggregation
Author: optimization2026Created Jun 30, 2026Updated Sep 17, 2026
Summary
/autoplan is one of the most important gstack skills because it coordinates multiple review phases and turns a rough plan into a reviewed implementation plan.
It already behaves like a structured workflow:
input plan
-> Phase 0 scope detection
-> CEO review
-> Design review if UI scope
-> Eng review
-> DX review if DX scope
-> cross-phase synthesis
-> task aggregation
-> final approval gate
I propose adding a standard AISP V1.0.0 package as a machine-readable contract for /autoplan.
This would not replace the current /autoplan skill.
This would not require all gstack skills to use AISP.
The goal is to make /autoplan's phase gates, evidence labels, task aggregation, and approval contract explicit enough to test and audit.
AISP protocol reference:
https://github.com/AIXP-Labs/AISP
Problem
Several /autoplan issues point to the same underlying pattern: important workflow rules are currently encoded in prose, shell snippets, templates, and output conventions, but not in one explicit machine-checkable contract.
Examples:
Phase selection:
UI/DX phases can be skipped silently when Phase 0 scope detection misses terms.
Task aggregation:
Phase 4 can return zero implementation tasks because an aggregation error is swallowed.
Consensus labeling:
Single-voice mode can be labeled as CONFIRMED, even when Codex is unavailable.
Workspace safety:
/autoplan can run for a long time and edit plan artifacts in-place without a strong workspace preflight.
Codex invocation:
/autoplan may call Codex without a per-project auth/profile gate or explicit informed consent.
The problem is not that /autoplan lacks instructions.
The problem is that /autoplan has many non-negotiable workflow invariants that are hard to validate as one system:
- phase decisions must be visible;
- skipped phases must have diagnostics;
- consensus labels must reflect actual reviewer evidence;
- task aggregation must not silently produce zero tasks;
- workspace mutations need safeguards;
- cross-model review must be transparent;
- final approval must show unresolved taste decisions and degraded evidence.
A standard AISP package could make these invariants explicit.
Proposed solution
Add an optional AISP package for /autoplan.
Possible layout:
autoplan/
├── SKILL.md.tmpl
├── SKILL.md
└── aisp/
└── autoplan_review_contract_aisp/
├── aisp.aisop.json
├── README.md
├── resources/
│ ├── phase-output-schema.json
│ ├── consensus-label-policy.md
│ ├── workspace-safeguard-policy.md
│ └── codex-auth-gate-policy.md
└── evals/
└── traces/
The AISP package should be treated as a contract/reference artifact for docs, tests, and future validators.
It should not be a new runtime dependency.
The current /autoplan skill can remain the user-facing skill.
The AISP package would define:
1. phase-gate contract;
2. evidence-label contract;
3. task-aggregation contract;
4. workspace-safety contract;
5. final approval contract;
6. trace fields expected from an /autoplan run.
Standard AISP V1.0.0 package sketch
[
{
"role": "system",
"content": {
"protocol": "AISP V1.0.0",
"axiom_0": "Human_Sovereignty_and_Wellbeing",
"id": "autoplan_review_contract_aisp",
"name": "gstack Autoplan Review Contract",
"version": "1.0.0",
"license": "MIT",
"summary": "A machine-checkable AISP package for /autoplan phase gates, evidence labels, task aggregation, workspace safety, and final approval.",
"description": "Defines the non-negotiable workflow contract for gstack /autoplan. The contract makes phase selection, skipped-phase diagnostics, dual-voice evidence, task aggregation, workspace preflight, and final approval traceable and testable.",
"flow_format": "mermaid",
"loading_mode": "node",
"tools": [
"filesystem",
"shell"
],
"params": {
"plan_path": "string",
"project_root": "string",
"run_id": "string",
"codex_available": "boolean"
},
"system_prompt": ""
}
},
{
"role": "user",
"content": {
"instruction": "STRICTLY OBEY aisp_contract; its non_negotiable rules are inviolable; then RUN aisop.main",
"user_input": "{user_input}",
"aisp_contract": {
"profile": "aisp.skill.v1",
"invocation": {
"mode": "manual_or_skill_runtime",
"when_to_use": [
"before running /autoplan",
"when validating /autoplan phase selection",
"when validating /autoplan task aggregation",
"when rendering /autoplan final approval gate",
"when /autoplan degrades to single-voice mode",
"when /autoplan edits plan artifacts in a git workspace"
],
"when_not_to_use": [
"manual single-phase plan review",
"read-only inspection of an already completed plan",
"non-gstack planning workflow",
"explicit user-approved dry run with no artifacts written"
]
},
"non_negotiable": [
{
"rule": "Do not silently skip a review phase; every skipped phase must include a diagnostic reason, matched evidence, threshold, and confidence.",
"enforced_by": "phase_gate.step4:sys.assert"
},
{
"rule": "Do not label a finding CONFIRMED unless at least two independent reviewer voices support it.",
"enforced_by": "evidence_label.step3:sys.assert"
},
{
"rule": "Single-voice findings must be labeled as single-voice, subagent-only, or unconfirmed, not CONFIRMED.",
"enforced_by": "evidence_label.step4:sys.assert"
},
{
"rule": "If upstream phase outputs contain implementation work, final aggregated task count must not be zero.",
"enforced_by": "task_aggregation.step4:sys.assert"
},
{
"rule": "Zero-task output must include a diagnostic reason.",
"enforced_by": "task_aggregation.step5:sys.assert"
},
{
"rule": "Do not start long in-place /autoplan edits without checking git status.",
"enforced_by": "workspace_preflight.step2:sys.assert"
},
{
"rule": "If the workspace is dirty, /autoplan must require stash, branch isolation, or explicit user approval before writing plan artifacts.",
"enforced_by": "workspace_preflight.step4:sys.assert"
},
{
"rule": "If Codex is invoked, the user must know which Codex auth/profile will be used.",
"enforced_by": "codex_gate.step3:sys.assert"
},
{
"rule": "Final approval must show degraded evidence, unresolved taste decisions, incomplete outputs, and missing phase artifacts.",
"enforced_by": "final_gate.step4:sys.assert"
},
{
"rule": "Every /autoplan run must emit a trace containing phase decisions, evidence labels, task count, workspace preflight state, Codex availability, and final approval status.",
"enforced_by": "trace.step2:sys.assert"
}
],
"discovery": {
"category": "planning_workflow",
"tags": [
"gstack",
"autoplan",
"phase-gates",
"task-aggregation",
"consensus-labels",
"workspace-safety",
"codex-gate",
"aisp"
]
},
"risk_level": "high",
"resources": [
{
"id": "phase_output_schema",
"path": "resources/phase-output-schema.json",
"kind": "schema",
"mode": "read_only",
"when": "Read when validating phase outputs and task aggregation.",
"scope": "skill"
},
{
"id": "consensus_label_policy",
"path": "resources/consensus-label-policy.md",
"kind": "reference",
"mode": "read_only",
"when": "Read when labeling final approval consensus evidence.",
"scope": "skill"
},
{
"id": "workspace_safeguard_policy",
"path": "resources/workspace-safeguard-policy.md",
"kind": "reference",
"mode": "read_only",
"when": "Read before /autoplan writes plan artifacts in a git workspace.",
"scope": "skill"
},
{
"id": "codex_auth_gate_policy",
"path": "resources/codex-auth-gate-policy.md",
"kind": "reference",
"mode": "read_only",
"when": "Read before /autoplan invokes Codex or asks the user to approve a Codex-backed step.",
"scope": "skill"
}
]
},
"aisop": {
"main": "graph TD\n workspace_preflight[Workspace preflight] --> codex_gate[Codex auth/profile gate]\n codex_gate --> phase_gate[Phase gate detection]\n phase_gate --> run_phases[Run selected review phases]\n run_phases --> evidence_label[Label evidence and reviewer consensus]\n evidence_label --> task_aggregation[Aggregate implementation tasks]\n task_aggregation --> final_gate[Render final approval gate]\n final_gate --> trace[Write autoplan trace]\n trace --> end_node((End))"
},
"functions": {
"workspace_preflight": {
"step1": "Run git status --porcelain in project_root before long-running /autoplan edits.",
"step2": "sys.assert('git status checked before plan artifact writes', 'Autoplan requires workspace preflight before writing')",
"step3": "If workspace is dirty, choose stash, branch isolation, or explicit user approval.",
"step4": "sys.assert('dirty workspace has safeguard or explicit user approval', 'Autoplan cannot write into dirty workspace without safeguard')",
"output_mapping": "workspace_preflight_status",
"constraints": [
"Do not start 15-30 minute in-place plan edits without workspace status.",
"Preflight should record branch, HEAD, dirty files, and safeguard decision.",
"Read-only dry runs may bypass write safeguards if no plan artifacts are modified."
]
},
"codex_gate": {
"step1": "Determine whether /autoplan will invoke Codex for any phase.",
"step2": "If Codex is invoked, resolve per-project Codex auth/profile or ask the user to choose one.",
"step3": "sys.assert('Codex invocation has explicit auth/profile disclosure', 'Codex calls require informed auth/profile disclosure')",
"output_mapping": "codex_gate_status",
"constraints": [
"Do not treat Codex as a silent auto-yes decision.",
"The user should know which Codex account/profile will be used.",
"Evaluation harnesses may use an explicit bypass flag."
]
},
"phase_gate": {
"step1": "Inspect plan_path for UI, DX, engineering, product, and implementation scope signals.",
"step2": "For every optional phase, record matched terms, threshold, confidence, and reason.",
"step3": "If a phase is borderline, ask for confirmation or mark as borderline in the final gate.",
"step4": "sys.assert('every skipped phase has diagnostic reason and evidence', 'Phase skip requires diagnostic evidence')",
"output_mapping": "phase_gate_decisions",
"constraints": [
"A skipped phase is a decision, not absence of work.",
"Term mismatch should not silently remove a phase.",
"Optional phases should report why they ran or why they were skipped."
]
},
"run_phases": {
"step1": "Run CEO review.",
"step2": "Run Design review only if UI scope is selected.",
"step3": "Run Eng review.",
"step4": "Run DX review only if DX scope is selected.",
"step5": "For each phase, record reviewer availability, phase status, output paths, and missing outputs.",
"output_mapping": "phase_outputs",
"constraints": [
"Each phase should produce required outputs or an explicit skipped/N/A reason.",
"Do not hide degraded phase execution."
]
},
"evidence_label": {
"step1": "Count independent reviewer voices for each finding.",
"step2": "Assign evidence labels: confirmed, single_voice, subagent_only, disputed, unavailable, or unreviewed.",
"step3": "sys.assert('confirmed findings have at least two independent voices', 'CONFIRMED requires independent agreement')",
"step4": "sys.assert('single-voice findings are not labeled CONFIRMED', 'Single-voice evidence must not be mislabeled as CONFIRMED')",
"output_mapping": "evidence_labels",
"constraints": [
"Consensus label must reflect actual evidence.",
"If Codex is unavailable, final report must show single-voice mode clearly.",
"N/A is not agreement."
]
},
"task_aggregation": {
"step1": "Read phase task artifacts according to phase_output_schema.",
"step2": "Aggregate tasks across selected phases.",
"step3": "Check whether phase outputs imply implementation work.",
"step4": "sys.assert('task count > 0 when implementation work exists', 'Autoplan produced zero tasks despite upstream work')",
"step5": "sys.assert('zero-task output has diagnostic reason', 'Zero-task output requires diagnostic')",
"output_mapping": "aggregated_tasks",
"constraints": [
"Do not swallow aggregation errors with no diagnostic.",
"If jq/filter/parser fails, report the failing step.",
"If zero tasks is intentional, say why."
]
},
"final_gate": {
"step1": "Render final approval gate with phase decisions, evidence labels, degraded-mode banner, task count, unresolved taste decisions, and incomplete outputs.",
"step2": "Show missing phase artifacts, if any.",
"step3": "Show workspace preflight status and Codex availability.",
"step4": "sys.assert('final gate shows degraded evidence and unresolved decisions', 'Final approval gate missing required decision evidence')",
"output_mapping": "final_approval_gate",
"constraints": [
"The user should not approve based on hidden degraded evidence.",
"Taste decisions should be explicit.",
"Incomplete outputs should be visible, not buried."
]
},
"trace": {
"step1": "Write /autoplan trace with run_id, plan_path, workspace preflight, Codex gate, phase decisions, reviewer availability, evidence labels, task count, final gate status, and warnings.",
"step2": "sys.assert('autoplan trace includes required fields', 'Autoplan run trace is incomplete')",
"output_mapping": "autoplan_trace",
"constraints": [
"Trace is evidence, not a trust certificate.",
"Trace should make failures debuggable.",
"Trace should help reproduce phase decisions."
]
},
"end_node": {
"step1": "Return final_approval_gate and autoplan_trace."
}
}
}
}
]
Why AISP helps here
AISP is useful here because /autoplan is not a simple instruction file.
It is a multi-phase workflow with gates, evidence, side effects, degraded modes, and user approval.
AISP would provide a structured source for:
phase rules
skip diagnostics
workspace preflight
codex profile disclosure
evidence labels
task aggregation invariants
final approval contents
run trace fields
This can help turn /autoplan from:
large generated Markdown + shell snippets + output conventions
into:
skill contract + executable workflow graph + testable invariants
The current Markdown skill can remain the user-facing entrypoint.
The AISP package can act as a reference contract for tests, validators, and future host exports.
Alternatives considered
1. Keep fixing individual /autoplan issues one by one
This is still necessary, but the issues seem related.
Phase skip, task aggregation, consensus labeling, and auth-profile disclosure are all symptoms of workflow contract drift.
A contract would not replace fixes, but it would clarify what future fixes must preserve.
2. Add more prose to autoplan/SKILL.md.tmpl
More prose may help humans, but it does not make invariants testable.
The issue is not lack of instructions. The issue is missing machine-checkable gates.
3. Add only tests
Tests are necessary, but a contract explains what the tests are preserving.
AISP can act as the shared reference for tests, docs, and validators.
4. Replace /autoplan with AISP runtime
Not proposed.
The current /autoplan skill should remain.
The AISP package is a companion contract, not a runtime replacement.
Impact
Affected users:
- users running /autoplan on plans;
- users relying on dual-review evidence;
- users using Codex-assisted reviews;
- users running /autoplan in dirty workspaces;
- contributors changing autoplan/SKILL.md.tmpl;
- maintainers reviewing /autoplan regressions.
Expected benefits:
- skipped phases become visible;
- single-voice mode is labeled honestly;
- task aggregation failures become debuggable;
- Codex invocation becomes explicit and account/profile-aware;
- workspace mutation becomes safer;
- final approval gate becomes more trustworthy;
- future regressions are easier to test.
Severity:
Medium to high.
Reason:
/autoplan produces planning artifacts that drive downstream implementation.
Silent skips, zero-task aggregation, mislabeled consensus, or hidden degraded evidence can mislead users into approving an incomplete or lower-quality plan.
Evidence / related issues
This proposal is motivated by several existing /autoplan issues:
#1957
Phase 0 silently skips UI/DX phases when scope detection misses terms.
#2018
Phase 4 task aggregation can silently return zero tasks due to jq scope bug.
#1956
Single-voice mode can be mislabeled as CONFIRMED when Codex is unavailable.
#1959
/autoplan lacks workspace safeguards for long in-place edits.
#965
/codex and /autoplan shell out to codex without auth-profile gate or informed consent.
The common pattern is:
/autoplan has important workflow rules,
but not all of them are represented as a single explicit contract.
Non-goals
This proposal does not require:
- replacing /autoplan;
- replacing SKILL.md;
- making all gstack skills use AISP;
- adding AISP as a runtime dependency;
- changing the current user-facing command;
- blocking simple smoke tests;
- forcing Codex to run when unavailable.
Minimal rollout
Phase 1:
Document the /autoplan workflow contract in repo docs.
Phase 2:
Add tests for the non-negotiable rules:
- skipped phases require diagnostics;
- CONFIRMED requires two independent voices;
- zero-task output requires diagnostic;
- dirty workspace requires safeguard or approval;
- Codex invocation requires profile disclosure;
- final approval must show degraded evidence.
Phase 3:
Add optional AISP package:
autoplan/aisp/autoplan_review_contract_aisp/aisp.aisop.json
Phase 4:
Add trace output for /autoplan runs:
run_id
phase decisions
skipped phase diagnostics
reviewer availabilit
Source: garrytan/gstack