v2.8.0 — 🛡️ Self-governing autonomy

The autonomous manager loop becomes self-governing — it now enforces its own safety preconditions before it runs, and reaches a human the moment it's genuinely stuck.

New capabilities

A run refuses to start unsafely. Before the factory dispatches an unattended goal-pursuit, it now checks the floor: the secrets backend must be configured and valid, the dev-server state is verified rather than assumed, and it warns — loudly — if it has no spend meter. An autonomous run can no longer silently begin without safe secrets or a way to see the burn. The safety preconditions are self-enforcing, not a checklist someone has to remember.

A stuck run comes and finds you. When an unattended run hits a blocker it can't clear, or spends its budget without meeting the bar, it now escalates actively — a durable escalation record plus a desktop notification — instead of waiting silently in a log for someone to check back. Unattended work that needs a human decision surfaces immediately, and only then.

Honest by construction. The readiness checks report only what they actually verify — "configured," not "will decrypt"; "defined," not "live" — so a green precondition means what it says. The loop still never takes an irreversible or outward-facing action on its own; anything that needs a human, a credential, or a risky action stops and asks.

Together: autonomy you can leave running because it knows its own limits — it won't start without its safety floor, and it won't fail silently.