root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(FN-3973): document spawn agent approval policy

Browse Source 
Documents the spawn agent approval evaluation policy by adding a new `docs/spawn-agent-approval-evaluation.md` (48 lines), updating `docs/agents.md` with related guidance, trimming `docs/architecture.md`, and bumping the agent delegation section in `AGENTS.md`. The new evaluation doc captures the FN

Fusion-Task-Id: FN-3973
This commit is contained in:
Fusion
2026-05-11 01:36:10 -07:00
committed by gsxdsm
parent 28c2e7abf1
commit fcbd9a4022
4 changed files with 67 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docs/agents.md
View File

@@ -123,7 +123,7 @@ Resolver decision table (`resolveAgentProvisioningPolicy`):
| `approval-mode-trusted-only` | `require-approval` | Untrusted fallback in default mode. |
| `approval-mode-always` | `require-approval` | Approval always required unless privileged/never mode. |
Out of scope in FN-3791: `spawn_agent` (ephemeral child worktree lifecycle). Follow-up task: "Evaluate approval guards for `spawn_agent` (ephemeral worktree children)".
FN-3973 follow-through: `spawn_agent` evaluation is complete; governance remains in action-gate `task_agent_mutation` (ephemeral runtime lifecycle), not durable `agentProvisioning`.
Default and legacy fallback behavior:
@@ -807,6 +807,17 @@ Behavior:
- `maxSpawnedAgentsGlobal` (default 20)
- Child sessions terminate when parent task ends
### Approval-governance relationship (FN-3973)
`spawn_agent` is intentionally treated as an **ephemeral runtime mutation**, not durable provisioning:
- `fn_spawn_agent` stays in action-gate `task_agent_mutation` classification.
- Spawned children are created with ephemeral metadata (`metadata.type = "spawned"`) and task-scoped ownership (`reportsTo = parentTaskId`).
- Parent teardown terminates/deletes spawned children; they are not durable hires.
- Therefore `projectSettings.agentProvisioning` (FN-3791 policy for durable `fn_agent_create` / `fn_agent_delete`) does **not** govern `spawn_agent`.
If a deployment config requires approval for `task_agent_mutation`, `spawn_agent` uses the standard action-gate approval pause/resume path (`awaiting-approval` + `/api/approvals/:id/decision`).
## Agent Delegation
Executor and heartbeat agents can coordinate through six built-in tools: `list_agents`, `delegate_task`, `agent_create`, `agent_delete`, `get_agent_config`, and `update_agent_config`.