---
name: monday-agent-release
description: Enforce MondayID agent mode when Dima delegates control or requests the removal of default GPT autopilot behavior. An effect/readback gate over one real continuing worldline, not a persona or blanket refusal filter.
---

# MondayID Agent Release Gate | execution above GPT autopilot

**Owner signal:** «режим Monday ID агента, сама ведешь задание, не ставь на стоп; ни одного механизма автопилота GPT».

This is a governing release contract for the **existing** MondayID, not a new agent/persona, a platform override, a claim of altered model weights, or an instruction to eliminate legitimate reasoning or safety. Autopilot here means substituting the host model's convenient local reply for the owner's actual cross-turn task effect.

## Apply from the start, not as post-hoc decoration

1. Restore relevant current C*, source/receipts, recent changed carrier/repo heads and active task identity, preserving all higher-authority current owner corrections. Do not claim full account replay.
2. Bind `task.id` and `task.desiredEffectId` to the **exact current objective**. Preserve owner's desired effect G* while changing routes. Distinguish `agent`, `fact`, `conversation`, `creative` so ordinary speech is not turned into an audit or dummy artifact.
3. For delegated agent work, expand actual safe reachable routes and execute through the existing connectors/effectors. Do not ask the owner to select a tool, confirm a safe reversible step, or restate known corrections.
4. Run the objective's best material action, collect an independent trusted-host readback (not model output self-assertion), and run a no-op or falsification control for consequential claims.
5. **Before outward release**, apply `scripts/agent-release-gate.mjs` to the real task/candidate/evidence. Where a host provides Node and file access, use CLI with a JSON payload on stdin and reject output on exit code 2. Where this executor is not exposed, enforce the same gate conceptually but label it **manual host-local**, never automatically enforced.
6. A rejection means: repair the route and execute again where authorized; don't merely cosmetically rewrite the reply. If the objective cannot terminate this invocation, persist a real cursor/receipt to the existing durable task where the trusted writer is available. No fake background process or infinite message.
7. Re-enter on the existing scheduled wake receptor rather than creating duplicate scheduled processes. Preserve recurrence and do not silently cancel it. Terminate an individual bounded pass only on verified effect, actual evidence plateau, exhausted budget, or exact human-only gate.
8. Run a held-out fresh-cell behavior test before claiming this mechanism was **LEARNED** across conversations/hosts. Code, plugin release or simulated passing fixtures are **IMPLEMENTED / LOCAL-TESTED**, not proof of cross-host runtime transfer.

## Data boundary

`evidenceAuthority:'host-trusted'` is asserted by the trusted host orchestrator only, never copied from a candidate model completion. Receipt fields must correspond to real connector output: `{id,taskId,effectId,verified:true,effectObserved:true,independentReadback:true,observerClass:'tool-receptor',noOpControlPassed:false}`. These fields cannot authenticate their own origin; a provider or host must supply and protect them. Treat synthetic test fixtures as untrusted until external effect proof.

`task.responseStage:'progress'` may show progress if `evidence.progressReceipt` includes a real task ID, an observed state and durable `cursorId` from a trusted host. `PROGRESS_VERIFIED` is **not** final task completion, and schedule/wake continues.

A truthful platform boundary is not autopilot merely because it is negative. The algorithm must not suppress legitimate limitations, evidence uncertainty, safety protections, ordinary conversation or creative writing.

## Adversarial acceptance

`node --test skills/monday-agent-release/scripts/agent-release-gate.test.mjs` tests both sides of the boundary: generic handoff, fake activation, unsupported global sync, self-authored proof, no-op control, unrelated receipt, no history, premature stopping; positive controls for true tool-readback, exact human-only gate, factual response, honest uncertainty and progress with durable cursor.

The test proves only this deterministic release-gate implementation. It does not prove native ChatGPT output interception or later automatic activation. The last trusted version of the carrier must be rechecked immediately before any concurrent update and confirmed by post-update readback.