remediation_autonomy

Scope: project • Default: confirm_destructive

How autonomous the orchestrator can be when recovering from a stall, crash, or unexpected state.

Positions

Position	Behavior
auto	Execute recovery without prompting. Use with sandboxed worktrees only.
confirm_destructive	Prompt before destructive actions (git reset --hard, rm -rf, push --force, etc.). Non-destructive recovery proceeds.
confirm_all	Prompt before every recovery step. Slower but maximally safe.
pause_all_on_issue	Freeze the entire orchestrator at the first issue; no recovery until human resumes.

What counts as "destructive"

Defined in ./src/runtime/remediation.ts: any action that removes or overwrites uncommitted work, force-pushes, reverts merged commits, or deletes files outside a worktree-scoped path.

Related

• agent_health_strictness — when recovery is invoked.
• crash_recovery_default — which recovery is chosen.