Rename open to stalled and autopilot to auto-confirm; add pushed state; declare idempotency; propose maturity and projects model (RBT-WP-0008)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

tests/test_v2.py

@@ -61,7 +61,7 @@ CASES = [
     ("gate without goal", lambda d: gate(d, "lamp-check").pop("goal"), "goal"),
     ("waiver must need a reason", lambda d: gate(d, "lamp-check").update(waivable={"by": "harbourmaster", "needs_reason": False}), "needs_reason"),
     ("bad timeout action", lambda d: gate(d, "lamp-check").update(timeout={"seconds": 5, "on_timeout": "explode"}), "on_timeout"),
-    ("bad autopilot value", lambda d: step(d, "close-log").update(autopilot="always"), "autopilot"),
+    ("bad auto_confirm value", lambda d: step(d, "close-log").update(auto_confirm="always"), "auto_confirm"),
 ]
 
 
@@ -110,3 +110,23 @@ def test_legacy_v02_needs_only_schema():
 def test_gate_cannot_confirm_a_datapoint_it_requires():
     out = errs(lambda d: next(x for x in d["datapoints"] if x["id"] == "lamp_lit").update(confirmed_by="lamp-check"))
     assert any("circular" in e for e in out), out
+
+
+def test_idempotency_is_declared_validated_and_summarized():
+    from rtut import flow
+    assert P.load(FILE).ok
+    assert flow.pack_idempotency(GOOD) == "non-idempotent"          # write-logbook appends
+    d = copy.deepcopy(GOOD)
+    for st in d["stages"]:
+        for s in st.get("steps", []):
+            s["idempotent"] = "idempotent"
+            s.pop("idempotent_note", None)
+    assert flow.pack_idempotency(d) == "idempotent" and v2.validate(d) == []
+    step(d, "close-log")["idempotent"] = "conditional"
+    assert any("idempotent_note" in e for e in v2.validate(d))
+    step(d, "close-log")["idempotent_note"] = "only while the log file exists"
+    assert v2.validate(d) == [] and flow.pack_idempotency(d) == "conditional"
+    step(d, "close-log").pop("idempotent")
+    assert flow.pack_idempotency(d) == "unknown"                     # one undeclared step makes the whole unknown
+    assert errs(lambda x: step(x, "warn").update(idempotent="sometimes"))
+    assert errs(lambda x: step(x, "warn").update(idempotent=True))       # a YAML "yes" is refused, not silently accepted