# Phase work order

## Outcome and scope

- Phase:
- Desired observable outcome:
- Target systems/services:
- Entry evidence that must already pass:
- Required artifacts at exit:
- Operational work size: tiny | small | medium | large | XL
- Predicted LLM quota draw: tiny | small | medium | large | XL
- Prediction basis: context size | expected turns | model class | reviewer count | observed prior UI drain
- Selected client/model/reasoning effort and why:
- Active human effort: unknown | measured | sourced | guess (state basis/uncertainty)
- Agent effort: unknown | measured | sourced | guess (state basis/uncertainty)
- Elapsed waiting: unknown | measured | sourced | guess (state basis/uncertainty)
- Expected outage: none | unknown | measured | sourced | guess (state basis/uncertainty)
- Service disruption: none | possible | planned (name services/tiers)
- Network disruption: none | possible | planned
- Storage disruption/data-at-risk: none | possible | planned
- Household disruption: none | possible | planned
- Other resource limits:

## Proposed scope—not an authorization grant

- Proposed mode: Learn | Operate | Background | Incident
- Proposed in-scope actions:
- Explicitly excluded actions:
- External human grant reference, if target-enforced mutation exists:
- Grant issuer/integrity reference:
- Enforcement-point verification result: unverified
- Starts:
- Expires:
- Stop conditions:

## Agent-owned work

- Facts to discover and timestamp:
- Records to pre-fill:
- Candidate changes to stage:
- Native validators:
- Consumer-side tests:
- Transaction-local failure-cleanup actor, exact scope, recorded pre-state, authorization, deadline, hold override, validators, and evidence:
- Separately prepared rollback evidence:
- New rollback risks and exact owner choice required:

## One human packet

- Decisions only the owner can make:
- Secret values the owner must enter directly into their destination:
- Physical or graphical-interface actions:
- Destructive or authority-expanding actions requiring separate approval:
- Execution artifact absolute path and format:
- Artifact SHA-256 digest:
- Exact one-line copy/paste invocation:
- Exact host, UI surface, account, shell, and working directory:
- Complete package, binary, script, config, include, and generated-file closure:
- Sealed paths and digests:
- Target/precondition assertions:
- Bash/Python syntax or static checks:
- Regex fixtures (positive, negative, duplicate, malformed, idempotent) or `not applicable`:
- Native configuration validators:
- Consumer-side and denial postcondition tests:
- Evidence/output capture location:
- Immutable success rule: emit `SUCCESS` only after every built-in check passes
- Failure hold behavior and prepared rollback:
- Transaction-local failure cleanup boundary and later owner-chosen rollback:

The agent presents these together after completing all authorized discovery. It never feeds shell commands one at a time. One invocation runs the checks, mutation, live postconditions, consumer and denial tests, and evidence capture. On failure, an expressly disposable transaction may run only the exact transaction-local cleanup whose actor, scope, pre-state, authorization, deadline, hold override, and validators were sealed into that packet. After any authorized cleanup, it exits nonzero and never asks the owner for a second cleanup command. Physical or UI-only work arrives once as a complete screen-by-screen packet, followed by one exact verifier invocation. Each item names the target, expected result, prepared reversal, and reason a human is required. After bounded cleanup, a failed check freezes further mutation and preserves evidence. A different rollback or backtrack always requires a fresh owner choice.

## Proceed rule

After the human accepts this work order, continue through all in-scope reversible discovery, staging, validation, consumer-side testing, and recording without asking after each step. Apply a change only through authority already enforced at the target and independently verified against the referenced grant; otherwise prepare the one human packet and continue after the human executes it. This prose does not grant sudo, Docker, storage, network, or cluster authority. Stop only at a listed stop condition or when live facts require authority not granted here. An unavailable approval means deny; it does not mean wait forever or find a bypass.

## Completion

- Exit tests:
- Evidence locations:
- Observation window:
- Handoff record location:
- Exact next safe phase:
- Final response footer: `NEXT ACTION — <actor> on <host-or-UI> as <account>: <absolute script/path or exact UI action>; expect <result>; resume when <condition>.`