[FEATURE] Add evidence-based earned autonomy policy engine

[Joncallim]

Problem Statement

Forge has explicit approval gates and bounded execution, but it does not yet have a policy engine that can safely increase or reduce autonomy based on verified historical performance. A simple global success percentage would be unsafe because it ignores capability scope, risk, model/runtime changes, critical failures, and evidence freshness.

Parent Epic: #184
Depends on: #185, #186, #188
Related: #40, #60, #172

Desired Outcome

Forge can evaluate versioned autonomy policies for a specific project + capability + scope + runtime/model/policy cohort, issue an auditable promotion/hold/demotion/revocation decision, and enforce the resulting ceiling before execution or GitHub/repository actions.

User Story

As a Forge operator,
I want narrowly scoped capabilities to earn and lose autonomy through transparent verified evidence,
So that reliable workflows become lower-friction without turning an agent into a broadly trusted autonomous actor.

Requirements

• Define a versioned autonomy policy contract including:
  • project and capability key;
  • normalized scope fingerprint;
  • risk classification;
  • current and maximum permitted autonomy level;
  • minimum comparable attempts;
  • rolling evaluation window;
  • verified-pass threshold;
  • demotion threshold;
  • critical-failure and policy-violation overrides;
  • evidence freshness/expiry;
  • runtime/model/harness/policy compatibility rules;
  • human cap/override;
  • requalification rules.
• Support an initial ladder:
  • L0 — plan only;
  • L1 — execute in sandbox after approval;
  • L2 — execute bounded low-risk work, human reviews result;
  • L3 — create branch and draft PR after independent verification;
  • L4 — open ready-for-review PR after independent verification;
  • L5 — reserved for narrowly defined reversible operations; no general auto-merge.
• Keep levels as policy ceilings. Existing MCP admission, tool policy, security gates, repository-edit policy, and human approvals may impose stricter limits.
• Consume only comparable evidence from [FEATURE] Add capability reliability ledger #186 and independent verification from [FEATURE] Add independent Verification Workforce execution #188.
• Promotion must require a minimum sample size, fresh evidence, no unresolved critical failures, and any required human approval.
• Immediate revocation/demotion triggers must include:
  • critical regression;
  • security/policy violation;
  • rollback caused by the capability;
  • failed required proof goal;
  • missing/tampered verification evidence;
  • material runtime/model/harness/policy/scope change;
  • explicit human revocation.
• Persist every policy evaluation and decision with inputs, thresholds, result, reason codes, evidence references, and actor.
• Make evaluation deterministic and replayable.
• Add a dry-run/advisory mode before enforcement.
• Enforce the approved autonomy level at the admission boundary before execution, branch/PR actions, or other privileged operations.
• Fail closed when the policy or required evidence cannot be loaded.

Acceptance Criteria

• Autonomy is scoped to project + capability + resource scope, never granted globally to an agent.
• Promotion cannot occur below the configured minimum sample size.
• Unverified successes do not count as verified passes.
• A critical failure can revoke autonomy immediately regardless of aggregate percentage.
• Runtime/model/harness/policy/scope changes trigger hold or requalification according to policy.
• Human-defined ceilings and revocations override automated promotion.
• Every policy decision is replayable from stored inputs and evidence.
• Enforcement cannot bypass stricter MCP, security, repository, or approval policies.
• Initial implementation does not auto-merge general coding changes.
• Tests cover promotion, hold, demotion, expiry, critical revocation, human override, and fail-closed evidence loss.

Out of Scope

• One global trust score.
• Self-promotion based on model confidence.
• General auto-merge or production deployment authority.
• Broad filesystem, credential, or system-level autonomy.
• Replacing adversarial/security review, MCP admission, or human final approval.
• UI polish beyond the minimum operator review surface; broader reporting belongs to [FEATURE] Add reliability, autonomy, and regression reporting #191.

Implementation Scope

Large — policy contracts, persistence, evaluation, enforcement integration, audit, and tests.

Technical Notes

Suggested persistence:

• autonomy_policies — desired policy and operator ceiling;
• autonomy_decisions — immutable evaluated decisions and evidence snapshots;
• optional current-state projection rebuildable from decision history.

Example decision reasons:

• insufficient_samples;
• verified_threshold_met;
• reliability_below_floor;
• critical_failure;
• evidence_expired;
• scope_changed;
• runtime_changed;
• human_cap;
• human_revocation;
• verification_missing.

Do not hard-code example thresholds such as 95%/90% into architecture. They should be configurable policy defaults and reviewed by risk class.