5.2 Executable Tickets & Proof-of-Green Gate

chinwag tasks split --max-loc 150 --verify-green

Traditional issue trackers store engineering tickets in cloud databases that AI coding agents cannot branch, diff, or transactionally lock alongside source code, allowing agents to mark tickets "Done" while tests are still failing or code hasn't even compiled.

Chinwag pairs your existing Linear or GitHub Projects v2 board with Executable Tickets (<org>/chinwag-tasks.git in the Chinwag Encrypted Artifact Store) · a 100% webhook-free (INV-ZERO-WEBHOOKS-01), Git-native repository where every Linear Issue (ENG-402) and GitHub Project Item (#142) is backed by a live cryptographic capsule, a zero-copy repo.fork() sandbox, a pre-warmed Shadow-KV prefix, and a synchronous Cryptographic "Proof-of-Green" Board Gate (INV-NO-FAKE-DONE-01).

# Bootstrap <org>/chinwag-tasks.git and link it to Linear or GitHub Projects v2 (100% webhook-free)
chinwag tasks init --org acme-corp --sync linear

# Start a ticket: 0s synchronous cold-start hydration in the Chinwag Encrypted Artifact Store
chinwag start ENG-402

1. Executable Tickets in the Chinwag Encrypted Artifact Store (INV-CF-ARTIFACTS-EXECUTABLE-TICKETS-01 & INV-NO-FAKE-DONE-01)

100% Webhook-Free Architecture (INV-ZERO-WEBHOOKS-01 · Zero Inbound Webhooks or Webhook Secrets): Executable Tickets requires zero inbound GitHub or Linear webhooks:

1. Synchronous Client MCP & In-Runner OIDC Sync: <org>/chinwag-tasks.git in the Chinwag Encrypted Artifact Store is mutated synchronously via K1 + K2-signed Chinwag Mesh RPCs and Git Smart HTTP (art_v1_ tokens), and synced with Linear / GitHub Projects client-side via the developer's existing local MCP (@linear/mcp-server, @modelcontextprotocol/server-github, or gh CLI) or in-runner via chinwag-ci OIDC.
2. Synchronous Edge Ref Gate (Not a Webhook): When chinwag start ENG-402 runs, the Chinwag Edge Ref Gate synchronously forks <org>/<project>--task-ENG-402.git and pre-warms Shadow-KV. When an agent tries to mark ENG-402 Done, the Chinwag Edge Ref Gate synchronously checks refs/chinwag/tasks/ENG-402/proof (TaskCompletionProofV1 signed by chinwag-ci) and blocks/snaps back any unverified Done transition at the Git ref + local MCP layer · with zero webhooks to configure, expose, or get rate-limited.

Anatomy of an Atomic chinwag-tasks Specification

Every task file in <org>/chinwag-tasks/active/TASK-204.md carries structured YAML frontmatter that both humans and agents can read deterministically:

---
id: TASK-204
title: "Add Ed25519 signature verification to webhook receiver"
status: ready
owner_seat: "@RUST"
reviewer_seat: "@ARCHITECT"
file_scope:
  - "crates/webhook-ingest/src/verify.rs"
  - "crates/webhook-ingest/tests/verify_test.rs"
estimated_loc_p90: 110
verification_cmd: "cargo test -p webhook-ingest --test verify_test"
budget_cap_credits: 250
---

## Objective
Verify incoming `X-Chinwag-Signature` headers using `ed25519-dalek` in strict batch-safe mode before deserializing the JSON payload (`INV-VERIFY-BEFORE-DECRYPT-01`).

## Acceptance Criteria
1. Reject missing or malformed signatures with `401 Unauthorized` in `< 0.2ms`.
2. Add property-based tests covering mutated payload bytes and wrong public keys.

Automatic Task Decomposition (p90 > 150 LOC Rule)

Empirical telemetry across thousands of AI-assisted pull requests shows a sharp cliff when a single task exceeds 150 lines of changed code: review latency triples, context-window hallucination rates spike, and merge conflicts multiply.

When a human or PM creates a ticket whose predicted impact in Chinwag Reflex-1 exceeds p90 > 150 LOC (or touches > 4 top-level modules), Chinwag Delivery-2 (50 Cr) automatically splits the parent ticket into 2..5 atomic sub-tasks with strictly disjoint --file-scope globs:

Parent Ticket: TASK-300 ("Implement OAuth2 PKCE + Session Store + UI Login Screen" · Est. p90: 420 LOC)
  │
  ├─► Sub-Task TASK-300A: PKCE Token Exchange & Crypto Verifier
  │     --file-scope "crates/auth-core/**" (Est. p90: 115 LOC · Parallel Wave 1)
  │
  ├─► Sub-Task TASK-300B: Durable Session Store Migration & Queries
  │     --file-scope "crates/session-db/**" (Est. p90: 95 LOC · Parallel Wave 1)
  │
  └─► Sub-Task TASK-300C: Login Modal Component & 176/176 UI Gate
        --file-scope "apps/web/src/auth/**" (Est. p90: 120 LOC · Wave 2 after 300A)

Bounded Autonomy: CustomerAutonomyFloorV1 & EmergencyBrakePolicyV1

Chinwag Delivery-2 keeps your engineering queue moving without ever running away with your cloud budget or merging unverified code. Every organization configures hard, non-bypassable autonomy rails in chinwag.workflow.yaml:

delivery_autonomy:
  schema: chinwag.autonomy.floor.v1
  max_parallel_subtasks_per_ticket: 5
  max_credits_per_ticket_without_human_ack: 500
  max_consecutive_ci_strikes: 3
  require_human_approval_for:
    - "crates/crypto-core/**"
    - ".github/workflows/**"
    - "chinwag.workflow.yaml"
  emergency_brake:
    schema: chinwag.emergency.brake.v1
    halt_on_credit_burn_per_hour: 2500
    halt_on_repeated_tombstone_collision: true
    notify_channel: "#eng-alerts"

Next Steps

• Next: .codegraph Blast-Radius Prevention & Smart FinOps Routing
• Ready to decompose complex specs into clean, parallel merges? Reserve Your Organization Credit Pack →