Automation Boundaries

The Anuva harness automates deterministic execution while leaving workflow orchestration visible in the Codex App task.

Automated

Linear issue reads, filtered Ready lists, approved issue creation, supported state changes, comments, and PR/doc links.
Git repository checks, branch naming, PR creation/inspection/checks/merge, and structured receipts through GitHub CLI.
MkDocs process management, rebuild waiting, URL calculation, and strict builds.
Recursive validation that every docs directory has a non-empty index.md and no empty documentation directories remain.
Development service start/status/log/stop and the existing named tunnel process.
Manual aggregate docs build and optional explicit Git commit/push.

Product scope decisions and repository ownership judgment.
Approval to create issues, merge PRs, complete issues, stop services, or publish.
Arbitrary shell commands, dynamic YAML steps, or free-form command composition.
Cloudflare tunnel, DNS route, certificate, Access application/policy/identity provider, and token provisioning, rotation, or deletion.
Early Users or Production deployment.
Codex Goals, Symphony, browser-agent testing, and unattended execution.

Commands are registered in code; there is no runtime operation registry loaded from user-controlled YAML.
Read operations default to human output and support --json.
Mutations support --dry-run, require --confirm, validate current state, and return a receipt with identifiers and links.
Child processes receive argument arrays or safely quoted zx interpolation.
The CLI redacts tokens and never prints credential-bearing environment values.
File deletion/copy operations resolve paths and prove they remain under their configured roots before changing anything.