An issue labelled agent:ready is now picked up by the VPS, implemented by Claude using that repository's own snag-deliver skill, reviewed by a second Claude using snag-review, and left as an open pull request labelled agent:reviewed. Nothing merges without a person clicking.

The design constraint that shaped everything: the agent is not going to be challenged in conversation, so the guardrails have to be mechanical rather than conversational. Hence enumerated tool subcommands instead of Bash(gh *) — that wildcard includes gh pr merge, which would have made "it never merges" a promise resting on a prompt. Hence a reviewer launched with no Write and no Edit, so it cannot silently patch what it was supposed to report. Hence a PAUSE file that stops every future tick without touching the crontab.

Hardened in PR #205, which moved the GitHub token out of gh auth login and into GH_TOKEN in a mode-600 .env: a fine-grained token replaces an account's OAuth token rather than sitting beside it, so installing it globally would have destroyed the machine's working interactive gh.

Installed under cron on 2026-07-30 with the PAUSE file in place, so every tick currently exits immediately. The script has not yet run end to end against a live ticket. How it works and how to operate it: guide/en/agent-runner.md.