Rename open to stalled and autopilot to auto-confirm; add pushed state; declare idempotency; propose maturity and projects model (RBT-WP-0008)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

schema/runbook-pack-v0.2.schema.json

@@ -48,7 +48,7 @@
     },
     "timeout": {
       "$ref": "#/$defs/timeout",
-      "description": "Default for autopilot runs."
+      "description": "Default for auto-confirm runs."
     },
     "legacy": {
       "type": "object",
@@ -341,6 +341,16 @@
               "type": "string"
             }
           }
+        },
+        "idempotent": {
+          "enum": [
+            "idempotent",
+            "non-idempotent",
+            "conditional"
+          ]
+        },
+        "idempotent_note": {
+          "type": "string"
         }
       }
     },
@@ -417,18 +427,30 @@
             "$ref": "#/$defs/alternative"
           }
         },
-        "autopilot": {
+        "timeout": {
+          "$ref": "#/$defs/timeout"
+        },
+        "downstream_risk": {
+          "type": "string"
+        },
+        "auto_confirm": {
           "enum": [
             "allowed",
             "manual-only"
           ],
           "default": "allowed"
         },
-        "timeout": {
-          "$ref": "#/$defs/timeout"
+        "idempotent": {
+          "enum": [
+            "idempotent",
+            "non-idempotent",
+            "conditional"
+          ],
+          "description": "Is re-running this step after a partial or complete earlier attempt safe? Omit if unknown. Values are words, never yes/no: YAML reads unquoted yes/no as booleans."
         },
-        "downstream_risk": {
-          "type": "string"
+        "idempotent_note": {
+          "type": "string",
+          "description": "Required when idempotent is conditional: under what condition."
         }
       },
       "anyOf": [