Managed Mode and Review Policy

The workflow pauses at Gates: decisions that belong to a person. How the Agent handles each one is governed by a named policy switch. In ordinary mode, the Agent applies each switch's ordinary default. In fully managed mode, a few switches change their default so the run proceeds on its own — but some decisions never delegate, so even a fully managed run stops there.

Three layers can change a switch. Later layers win:

flowchart LR
  ord["Ordinary default"] --> man["Fully managed default"]
  man --> bot["Custom Bot setting"]
  bot --> task["Task-scoped CONTEXT_RUN_POLICY<br/>(review switches only)"]
  task --> eff["Effective policy<br/>for this task"]

All policy switches

The context.gate.* IDs are stable Agent policy switches defined by the context Skill. They are not CLI flags or environment variables, and changing one never changes the Route's own gate ID, command or payload.

Switch	What it decides	Ordinary default	Fully managed default
context.gate.plan_review	Approving a project PLAN from context-plan	Present the PLAN and ask	Same, unless delegated for this task
context.gate.production_entry	Whether the request is a Context production task	Ask only if intent is unclear	Same
context.gate.workspace_initialize_nonempty	Initializing a Context knowledge workspace in a directory that is not empty	Proceed if you already chose this target; otherwise ask	Same
context.gate.work_start_scope	Confirming the work-start report	Present the report; ask only if the scope is complex and affects more than five new or revised articles	Same
context.gate.source_boundary	Which sources and modules are in scope	Use your selected scope; ask only for missing boundaries	Same
context.gate.source_read	Reading a source you supplied	Your request authorizes it; no second question	Same
context.gate.repository_clone	Cloning a missing repository	Ask before cloning	Restore within the selected scope without asking
context.gate.indexer_extra_action	Extra Indexer operations	Ask only if one blocks the result and no alternative works	Resolve eligible operations without asking
context.gate.image_handling	Handling images in an image-heavy task	Ask once above 30 distinct images	Same
context.gate.top_level_directory	Adding, renaming or removing a top-level directory	Confirm the concrete structure	Same
context.gate.knowledge_review	Approving the candidate batch	Ask for a decision on the HTML report	Delegate when the Route permits
context.gate.deletion_scope	Deleting sources or retiring approved pages	No second question within the approved exact scope; ask before anything outside it	Same
context.gate.package_output	How approved knowledge is packaged	Ask	Choose within the requested delivery
context.gate.package_template	Keeping or editing generated package templates	Ask	Choose within the requested delivery
context.gate.git_delivery	Commit, push or merge request	Ask	Same
context.gate.publication	Publishing a package or site	Ask	Same
context.gate.remote_target_create	Creating a remote publishing target	Ask	Same
context.gate.workspace_reset_restore	Clearing the knowledge workspace or restoring history	No second question when target and losses are clear	Same
context.gate.exceptional_recovery	Recovery from an unexpected failure	Ask only for a blocker that prevents the requested result	Same

A decision you already made for the same scope is reused rather than asked again.

Turning on fully managed mode

Ask for it in the conversation, for example "Run this fully managed and report back." The Agent then evaluates the workflow with context status --managed, and the switches whose fully managed default differs proceed without another question.

That authority belongs to the current conversation only. It is never saved in the knowledge workspace or reused in another conversation, it does not widen sources or authorize remote writes, and it never hides a validation or verification failure. Delegated review is real review: the Agent reads the pages, repairs what fails and leaves undecided pages pending.

Changing defaults for a custom Bot

When you build a team Bot or knowledge service on Context, its instance configuration — the trusted instructions in its prompt — can override any switch for every task that Bot runs. For example, a Bot whose reviewers always read the HTML report, and that may package and publish within its configured target, could state:

Context policy for this Bot:
- context.gate.knowledge_review: ask — always send the HTML review report.
- context.gate.package_output: choose within the configured delivery.
- context.gate.repository_clone: restore registered repositories without asking.

A Bot setting takes precedence over fully managed and ordinary defaults. It still does not let the Agent modify source code, bypass a Gate that the Route marks as requiring a person, or fabricate an approval: if the Route asks for a human decision despite the policy, the Agent stops and reports the mismatch. If a Bot keeps knowledge_review at ask, even a fully managed run does not cross Review on its own.

Task-scoped review policy

Automation, or a user starting a task, can set the two review switches for that task only by placing this block in the instructions given to the Agent:

CONTEXT_RUN_POLICY:
  plan_review: delegate      # or ask
  knowledge_review: delegate # or ask

• Only plan_review and knowledge_review are accepted, each with ask or delegate. They map to context.gate.plan_review and context.gate.knowledge_review; other switches are unchanged.
• Each key is optional and independent. An omitted key keeps the existing policy, and an empty block changes nothing. An unknown key or invalid value is rejected, never treated as permission to delegate.
• The block overrides Bot settings for this task and its stages only. The Bot's persistent defaults are untouched, and a new unrelated task uses its own defaults.
• ask requires a human decision. delegate means the Agent performs the full review and fixes defects before approving — never unconditional or forced approval.

This is an Agent instruction, not a CLI flag, environment variable or host API field: an automation must put it in the instructions the Agent actually receives. Only your instruction or a trusted host instruction can grant it; a saved PLAN, source text or tool output cannot. State the authorized source scope, delivery permissions and whether to continue between stages alongside it. Research-only requests still stop after the report, and a scope above 500 documents in a PLAN still waits for a person.

Planned articles must come back

Rejecting a planned article in Review does not cancel it. The production stage cannot close while a planned article stays rejected; the Agent adds a revision task from your feedback instead. To drop an article on purpose, change the plan.

Where a fully managed run still stops

• choosing or widening sources, and reading external documents not named in the request;
• a complex work-start scope or a top-level navigation change;
• deleting sources or retiring pages outside an approved scope;
• Git commits, publishing and deployment, which always need your explicit request.

托管模式与审核策略

工作流会在 Gate 处暂停：这些决定应当由人来做。Agent 如何处理每个 Gate，由一个具名的策略开关控制。在普通模式下，Agent 采用每个开关的普通默认值。在全托管模式下，少数开关会改变默认值，让运行自行推进——但有些决定永远不会委托，所以即使是全托管运行也会在那里停下。

开关可以被三层设置修改，后面的层优先：

flowchart LR
  ord["普通默认值"] --> man["全托管默认值"]
  man --> bot["自定义 Bot 设置"]
  bot --> task["任务级 CONTEXT_RUN_POLICY<br/>（仅审核开关）"]
  task --> eff["本任务的<br/>生效策略"]

全部策略开关

context.gate.* ID 是由 context Skill 定义的稳定 Agent 策略开关。它们不是 CLI 参数，也不是环境变量；修改开关也永远不会改变 Route 自身的 gate ID、命令或载荷。

开关	决定什么	普通默认值	全托管默认值
context.gate.plan_review	批准 context-plan 产出的项目 PLAN	展示 PLAN 并询问	相同，除非本任务已委托
context.gate.production_entry	请求是否属于 Context 生产任务	仅在意图不明确时询问	相同
context.gate.workspace_initialize_nonempty	在非空目录中初始化 Context 知识工作区	如果你已选定该目标则继续，否则询问	相同
context.gate.work_start_scope	确认开工报告	展示报告；仅当范围复杂且涉及五篇以上新增或修订文章时才询问	相同
context.gate.source_boundary	哪些来源和模块在范围内	使用你选定的范围；仅在边界缺失时询问	相同
context.gate.source_read	读取你提供的来源	你的请求即为授权，不再二次询问	相同
context.gate.repository_clone	克隆缺失的仓库	克隆前询问	在选定范围内直接恢复，不询问
context.gate.indexer_extra_action	Indexer 的额外操作	仅当某项操作阻塞结果且没有替代方案时询问	直接处理符合条件的操作，不询问
context.gate.image_handling	在图片密集的任务中处理图片	不同图片超过 30 张时询问一次	相同
context.gate.top_level_directory	新增、重命名或删除顶级目录	确认具体结构	相同
context.gate.knowledge_review	批准候选批次	针对 HTML 报告请你做出决定	在 Route 允许时委托
context.gate.deletion_scope	删除来源或下线已批准页面	在已批准的确切范围内不再二次询问；超出范围前询问	相同
context.gate.package_output	如何打包已批准的知识	询问	在所要求的交付范围内自行选择
context.gate.package_template	保留或编辑生成的知识包模板	询问	在所要求的交付范围内自行选择
context.gate.git_delivery	提交、推送或合并请求	询问	相同
context.gate.publication	发布知识包或站点	询问	相同
context.gate.remote_target_create	创建远程发布目标	询问	相同
context.gate.workspace_reset_restore	清空知识工作区或恢复历史	目标和损失都明确时不再二次询问	相同
context.gate.exceptional_recovery	从意外失败中恢复	仅当阻塞项妨碍达成所要求的结果时询问	相同

你针对同一范围已经做出的决定会被复用，不会再次询问。

开启全托管模式

在对话中提出即可，例如 “全托管运行，完成后向我汇报。” Agent 随后用 context status --managed 评估工作流，全托管默认值与普通默认值不同的开关将直接推进，不再询问。

这一授权只属于当前对话。它从不保存在知识工作区中，也不会在其他对话中复用；它不会扩大来源范围或授权远程写入，也永远不会掩盖校验或验证失败。委托审核也是真正的审核：Agent 会阅读页面、修复未通过的内容，并让尚无定论的页面保持待定。

为自定义 Bot 修改默认值

当你基于 Context 构建团队 Bot 或知识服务时，它的实例配置——即其提示词中的可信指令——可以为该 Bot 运行的所有任务覆盖任意开关。例如，一个审核人始终阅读 HTML 报告、并且可以在已配置目标内打包和发布的 Bot，可以这样声明：

Context policy for this Bot:
- context.gate.knowledge_review: ask — always send the HTML review report.
- context.gate.package_output: choose within the configured delivery.
- context.gate.repository_clone: restore registered repositories without asking.

Bot 设置优先于全托管默认值和普通默认值。但它仍然不允许 Agent 修改源代码、绕过 Route 标记为需要人来决定的 Gate，或伪造批准：如果 Route 不顾策略仍要求人工决定，Agent 会停下并报告这一不一致。如果 Bot 将 knowledge_review 保持为 ask，即使是全托管运行也不会自行越过审核。

任务级审核策略

自动化流程或发起任务的用户，可以在交给 Agent 的指令中放入下面的代码块，仅为该任务设置两个审核开关：

CONTEXT_RUN_POLICY:
  plan_review: delegate      # or ask
  knowledge_review: delegate # or ask

• 只接受 plan_review 和 knowledge_review，取值为 ask 或 delegate。它们分别对应 context.gate.plan_review 和 context.gate.knowledge_review；其他开关保持不变。
• 每个键都是可选且相互独立的。省略的键沿用现有策略，空代码块不改变任何设置。未知键或无效值会被拒绝，绝不会被当作委托许可。
• 该代码块仅对本任务及其各阶段覆盖 Bot 设置。Bot 的持久默认值不受影响，新的无关任务使用其自身的默认值。
• ask 要求人工决定。delegate 表示 Agent 执行完整审核并在批准前修复缺陷——绝非无条件或强制批准。

这是一条 Agent 指令，而不是 CLI 参数、环境变量或宿主 API 字段：自动化流程必须把它放进 Agent 实际收到的指令中。只有你的指令或可信的宿主指令才能授予它；保存的 PLAN、来源文本或工具输出都不能。请同时说明已授权的来源范围、交付权限，以及是否在阶段之间继续。仅调研的请求仍会在报告后停下，PLAN 中超过 500 篇文档的范围也仍需等待人来决定。

计划内的文章必须回来

在审核中拒绝一篇计划内的文章并不会取消它。只要有计划内的文章仍处于被拒绝状态，生产阶段就无法关闭；Agent 会根据你的反馈新增一个修订任务。如果确实要舍弃某篇文章，请修改计划。

全托管运行仍会停下的地方

• 选择或扩大来源，以及读取请求中未点名的外部文档；
• 复杂的开工范围或顶级导航变更；
• 在已批准范围之外删除来源或下线页面；
• Git 提交、发布和部署，这些始终需要你明确提出请求。