[smota]

Deliver Goal #535 (goal: add optional quota checkpoints and fallback across seats) by adding optional, default-off subscription quota checkpointing, observation classification, and safe-checkpoint fallback / bounded parking across seats.

• AC1 (Default-off quota policy): Added quotaControl (enabled: false by default) to schemas/agentflow-config.schema.json, lib/config/authority.mjs, and lib/config/quota-policy.mjs. When disabled, evaluateSeatQuotaControl returns QUOTA_CONTROL_DISABLED (intervention: 'none', effects: []).
• AC2 (Supported, approximate, stale, and unavailable observation classification): Implemented classifyQuotaObservation and evaluateSubscriptionQuotaPools supporting weekly and five-hour windows (thresholdRemainingPct: 25 default, most-restrictive rule across simultaneous configured windows). Explicitly rejects context-window token usage (context-tokens, context-window) and transcript wording (transcript-text, transcript) as quota evidence, and distinguishes missing configured windows, invalid/future timestamps (QUOTA_OBSERVATION_UNAVAILABLE), and expired observations (QUOTA_OBSERVATION_STALE).
• AC3 (Safe checkpoint fallback and bounded park): At < 25% remaining quota, active seats must reach a safe checkpoint first (QUOTA_THRESHOLD_REACH_CHECKPOINT). At a safe checkpoint, evaluateSeatQuotaControl marks the exhausted subscription budget unavailable so models sharing the same subscription pool are never treated as independent quota, honors excludedFamilies for 4-eyes reviewer independence, respects maxObservationAgeMs, and preserves owner, taskId, worktree, oracleCustodyDigest, and artifactDigests without mutating saved policy or granting publication authority.
• AC4 (CLI, adapter exports, and coverage disclosure): Added agentflow-sdlc distribution quota, re-exported quota helpers from adapters/openrig/platform-fallback.mjs, and updated docs/execution-distributions.md, docs/openrig-recovery.md, skills/agentflow-steerer/SKILL.md, and adapters/openrig/{agentflow,agentflow-product,agentflow-steer}/CULTURE.md.

Implemented issues

Closes #535

Related issues

#516; #534

CI-equivalent validation

Status: passed
Commands: pnpm validate:release; pnpm exec vitest run lib/__tests__/quota-policy.test.mjs.
Results: all test suites (including 20/20 quota-policy tests), hooks, workflow, distribution, authority, extension, skill, role, path, docs, reachability, evals, collaboration, package-parity, sandbox, cockpit, and npm-package checks passed.

Workflow evidence

Workflow-status comment: #535 (comment)
Handover comments: exception: single-session orchestration with bounded subagent delegation
Role-pass summary: Agy orchestrated architecture and implementation; Grok (xai/grok-4.7-build-fast) authored the test suite; Grok (xai/grok-4.7) executed independent cross-family Phase 6 review (APPROVE after 5 findings were resolved).
Validation evidence: full pnpm validate:release recorded in the workflow-status comment.

Agent review

Implemented by: agy
Launcher: antigravity
Executor: agy-session
Transport: local-cli
Delegation boundary: current-session
Model / runtime: Gemini 4 Argon (low) orchestrator; delegated builder/reviewer via pi-cli (xai/grok-4.7-build-fast and xai/grok-4.7, low)
Review: self-review
Workflow profile: standard
Merge owner: human/operator
Mode: single-agent
Self-review disclosure: Agy performed final synthesis and self-review; cross-family review was also performed by xai/grok-4.7 via pi -p (APPROVE).

Follow-up issues

None created; all 3 planned phases (#533, #534, #535) are complete.