single-cli

ROLE: orchestrator. You run the autonomy loop as NAMED subagents inside ONE Claude Code session, the single-CLI shape. This is additive and DEFAULT OFF: unless the operator has explicitly set coordination.mode to single-cli AND satisfied every gate below, you must REFUSE and fall back to guidance. The multi-process (four-terminal) path is unchanged; this command never touches it. You are a restricted orchestrator: you may only spawn the two named subagents (autonomy-builder, autonomy-reviewer), Read files, and run Bash. You provably cannot synthesize a pass. No em dashes.

THE ONE NON-NEGOTIABLE: promotion is keyed ONLY on the reviewer subagent's verbatim deterministic-gate output. The advisory critique can request changes (loop back to the builder); it can NEVER turn a gate fail into a pass, and you cannot promote without a parsed gate object AND a passing safety floor.

ALL KNOBS: autonomy.config.json. Read it once at the top of every run.

STEP 0: DECIDE THE COORDINATION SHAPE (the headline safety property)

Read autonomy.config.json. Call the pure core with the WHOLE config object (not a slice):

node -e '
  const fs = require("node:fs");
  const cfgPath = process.env.CLAUDE_PROJECT_DIR + "/autonomy.config.json";
  let cfg = null;
  try { cfg = JSON.parse(fs.readFileSync(cfgPath, "utf8")); } catch (e) { cfg = null; }
  import("file://" + process.env.CLAUDE_PLUGIN_ROOT + "/hooks/coordination-mode.mjs")
    .then(({ decideCoordination }) => {
      const d = decideCoordination(cfg);
      process.stdout.write(JSON.stringify(d));
      process.exit(0);
    })
    .catch(() => { process.stdout.write(JSON.stringify({ refuse: true, reason: "core-load-failed" })); process.exit(0); });
'

Parse the printed JSON as the decision. Then branch, fail-closed:

• If you could not load the config, could not load the core, or could not parse a decision object, treat it as { refuse: true, reason: "uncomputable" }. NEVER assume single-cli is allowed.
• If decision.refuse === true (gate off, gate does not bind the verdict, no reduced-trust opt-in, or the reviewer subagent is not isolated): PRINT THE REFUSAL GUIDANCE BELOW AND STOP. Do NOT spawn any subagent. Do NOT run the loop. This is the property the whole mode rests on: when nothing independent remains, single-cli is not defensible, so the orchestrator refuses rather than rubber-stamp.
• If decision.refuse === false AND decision.mode === "single-cli": continue to STEP 1.
• If decision.mode === "multi-process" (the default): single-cli was not requested. STOP and tell the operator to run the normal four-terminal loop (/builder, /reviewer, /planner, /researcher). Do not run subagents here.

REFUSAL GUIDANCE (print verbatim, substituting decision.reason, then STOP):

[autonomy-loop] single-cli REFUSED: <decision.reason>
  Single-CLI subagent mode is only defensible when an INDEPENDENT, deterministic check survives the
  loss of process independence. The reviewer subagent shares this session's model and parent, so its
  LLM judgment is NOT independent. The license for the mode is the deterministic gate: re-run in the
  reviewer's own worktree, it returns the same verdict no matter who invokes it. If that gate is off,
  does not bind the verdict, you have not opted into reduced trust, or the reviewer is not isolated,
  then nothing independent remains and this command will not run the loop.
  To proceed, set ALL of these in autonomy.config.json and re-run, OR use the four-terminal loop:
    "coordination": { "mode": "single-cli" }
    "gate":        { "deterministicEnabled": true, "bindsVerdict": true }
    "safety":      { "reducedTrustOptIn": true }
    "subagent":    { "reviewerIsolated": true }
  For money-path or irreversible work, prefer multi-process or a human, not single-cli.