One mutable product lane; at most two bounded read-only children. Check active sessions and operational claims before mutation. Resume the sole NOW lane without re-ranking. When it completes, promote NEXT; when blocked, record the concrete dependency and promote only the queued successor. Direct human tasks may interrupt coordination, but must not silently steal another session’s lane.

A useful outcome is a pushed commit, PR update, decision-changing test or substantial source-linked publication—not heartbeat admission, reconciliation or status churn. For PR-eligible work, push within 90 minutes and open/update a draft within four hours; for reported defects those clocks begin only after the reproduction gate passes. These targets never override quality gates.

For each substantive task create or reuse one public Seed document under Ion’s progress section. Link the originating issue/discussion and the applicable workflow documents. Update after durable transitions, before a handoff and when blocked. The record must include:

Owner and last-updated time; goal and exact expected/actual assertion.

State, next allowed action and concrete blocker; distinguish observations from hypotheses.

Protocol versions read, baseline SHA, exact head SHA when one exists, relevant surfaces/environment and unchanged acceptance identifier.

Assumptions, falsification attempt, reproduction evidence, verification evidence and applicable platform results.

PR link, self-review findings, performance comparison or justified non-applicability, review feedback and remaining obligations.

Next step and handoff sufficient for a fresh session without private chat history.

Publish evidence safe for others to inspect. Never publish credentials, private user content, protected fixtures or infrastructure access details. Redact safely without turning an unsupported claim into a proof. If public proof cannot safely be produced, mark that gate blocked and seek an authorized alternative.

Reported defects: REPORTED → BASELINELOCKED → REPRODUCED → FIXALLOWED / PRALLOWED → VERIFIED → REVIEWREADY → AWAITINGHUMAN → DONE. FIXALLOWED and PRALLOWED are permissions derived from evidence, not evidence themselves. BLOCKED/DEFERRED always names the failed condition and attempt. Completion requires an actual outcome, not merely opening a PR. Non-defect tasks begin with a documented goal, then implementation, verification and the same review boundary; do not relabel a defect as maintenance to avoid reproduction.

Read the actual comment/review and thread before acting. Preserve who said what; Eric is the primary user. Answer actionable feedback with a concrete change or a reasoned disagreement and evidence. Do not manufacture replies to conversations between people. Duplicate webhook/site/reply notifications must converge on one response and one owner; check recent discussion and durable delivery records before sending.

GitHub uses a webhook and a 15-minute reconciliation backstop. Do not assume webhook review coverage; failures must be surfaced rather than silently acknowledged. Current delivery IDs, credentials, outbox state and recovery commands remain private operational data.

Public documents now own policy. Existing private execution-queue/project files remain operational ownership indexes during migration, not public evidence or alternate policy. Do not copy their historical bulk onto the site or infer current work from an old public summary. Before the next substantive transition in a legacy lane, create/update its public record and link it from the private index. This is an explicit incremental migration, not a claim that every historical lane is already public.

Pass the public record, protocol URLs and read versions, exact SHAs, current state, allowed mutations, ownership boundaries and unresolved questions. Children must read relevant protocols before work. Stop on missing evidence; do not spend a new context reconstructing policy from memory. Private machine setup belongs in operational notes; reusable non-sensitive knowledge belongs on the site.