NC Phase 3: autonomous project upgrades — Tier 3 supervisor tasks → gated PRs

[mercurialsolo]

Part of #358. Design: docs/niche-construction.md §Acceptance (worked example).

Phase 3 — Autonomous project upgrades (Tier 3, gated PRs)

The "upgrade the project autonomously" payload. Auto-author code changes; keep the irreversible commit gated.

Scope

• Surface E: project code, via coord/supervisor.rs + actuator.rs tasks in worktree isolation.

Flow

needs-model item → supervisor task in worktree → change → full verifier suite (Run + Brain + Agent) → open PR.

• Merge is human by default.
• Canary-merge allowed only for a whitelisted change class (start: dependency security patches with all tests green; lint-only; test-only).

Deliverables

• Need → supervisor task spawner gated by charter max_tier >= 3.
• PR authoring with provenance (need, verifier verdicts, fitness deltas) in the PR body.
• Whitelist config for canary-merge classes; everything else stops at "PR opened, awaiting human."

Acceptance

• No code reaches main outside a PR.
• Non-whitelisted changes never auto-merge.
• Constraints in the charter (e.g. "edit public API without human", "remove tests") are hard-blocked.