Discipline has to be engineered in. The human-defined gate stays human-defined. The Inspector agent enforces evidence requirements. The Marshal agent respects branch protection. Conventions are read directly from your codebase.
Soft gates fail under autonomy. Each control here is a transition the pipeline cannot cross without satisfying a deterministic check.
The Inspector agent doesn’t take the PR’s word for it. Tests must have run. Coverage must hold. The change plan must match the diff. If the evidence doesn’t justify the change, the PR goes back to the Builder for rework. No exceptions, no shortcuts.
The Marshal agent uses the same branch-protection rules a human would have to satisfy: required reviews, required status checks, code-owner approvals, signed commits. It cannot elevate its own permissions; if your repo requires two human reviewers, it will not bypass them.
Conventions are read from your repository — CONTRIBUTING.md, .eslintrc, code style, commit-message format, test patterns. The Inspector agent checks the diff against them. New code matches the room it’s landing in.
Policies are declarative, versioned, and auditable. The same file that defines “PRs need two human reviewers” defines “Builder agent cannot delete database migrations.” If your policy changes, the audit log shows when and who.
# .colony/policy.yaml
review:
required: "two_humans"
evidence:
tests: "must_pass"
coverage: "no_regression"
merge:
branch: "main"
require_status_checks: true
require_signed_commits: true
builder:
forbid_paths:
- "migrations/*"
- "infra/secrets/*"Policy defines what the pipeline must enforce. Conventions define how new code should look. The agents read both before they touch the repo.
A versioned file (.colony/conventions.md) in each repository defines your stack, coding standards, naming conventions, testing approach, and forbidden patterns. The agents read it before they touch code. A well-maintained conventions file produces consistent, on-pattern output; a thin one produces output that needs more human correction.
It’s a living document. The most effective teams update it the first time they find themselves declining the same kind of PR twice — the convention you wished existed becomes the convention you can write down, and the pipeline enforces it on the next PR.
A real-shaped audit trace from a PR that didn’t pass review. The Inspector flagged it; the Builder reworked; the second attempt cleared.
Pilot setup includes a policy review with your team — what you have today, what gets enforced day one.