Skip to content
CommitCycleCommitCycleCC Docs

Memory and governance modes

A repository runs CommitCycle in one of two modes (CC-1149). The choice belongs to a person on the board, and it is set under Settings → Access defaults, or with cycle mode from a signed-in shell. cycle init starts a repository in memory mode unless you pass --mode governance (CC-1176).

Memory (the default for a repository with no zones)

Section titled “Memory (the default for a repository with no zones)”

Everything that makes the work legible, and one rule at the edit.

  • Every request becomes a task with a goal, non-goals and acceptance criteria, scoped before work starts.
  • The task moves through the five states, with a note at every transition.
  • The close keeps the audit record on the board, with the files the work touched.
  • The rule: an edit needs an active task. Without one, the hook denies the write and says a task has to be started first; with one, it raises no objection.
  • Zones, approvals and Bash containment are not judged, even if the repository has a zone map.

Governance

Section titled “Governance”

Everything in memory, plus least privilege.

  • Zones with owners, declared in .zones/zones.yml and mirrored to the board.
  • A task declares the zones it will touch; a high-risk zone needs its owner’s approval before work starts.
  • The grant opens only the declared zones, for the declared branch, for a limited time.
  • Bash commands that write outside the grant are reverted after they run.

Choose it where a write in the wrong place costs more than a stopped session: a schema, a payment path, the guard itself.

How the mode is decided and applied

Section titled “How the mode is decided and applied”
  • Unchosen, a repository whose zone map is on the board is in governance, and one without is in memory. No repository changed behaviour when modes were introduced.
  • A person chooses it in Settings or with cycle mode memory / cycle mode governance from a signed-in shell. A machine token can read it and never change it: an agent choosing to switch its own zones off would defeat the point.
  • It travels inside the grant. When a task starts in memory mode, the board issues its grant with repo_mode: memory, covered by the board’s signature. The hook relaxes zones only for an active, signed grant that says so. A file an agent could edit is not involved, so the mode cannot be forged, and a change applies from the next task started.
  • The diff check at close stays in both modes. In memory mode it reports what the work touched; it does not refuse a close for touching an undeclared zone.
Section titled “Related”