Require approval before ATVM command execution

Update the ATVM automation guidance so exact planned commands must always be shown for operator review before any execution. Require explicit approval before running cmc-templates.py, run-sorry-cypress.py, or any other ATVM run command, and require fresh approval whenever the displayed command set changes. Also record the new approval rule in the ATVM run-learning notes and operator instruction file.

atvm/AGENTS.md

@@ -89,12 +89,14 @@ Do not treat example options, excludes, plugins, or filters as default operator
 1. Before planning a new run, check for active automation processes.
 2. Report running/not-running status.
 3. If running, ask before termination; terminate only with explicit approval.
-4. Always show exact planned command(s) before execution.
-5. Execute only after explicit approval.
-6. If monitoring is not requested, report immediate command success/failure and any errors.
-7. Monitor completion only when explicitly requested by the operator.
-8. For monitored runs, allow long runtime windows (15-30+ minutes or longer) and continue until completion unless operator instructs otherwise.
-9. Do not terminate monitored runs unless the operator explicitly instructs termination.
+4. Always show exact planned command(s) exactly as they will be executed before execution.
+5. Never execute `cmc-templates.py`, `run-sorry-cypress.py`, or any other ATVM run command until the operator explicitly approves the displayed command(s).
+6. Approval is required for template-generation commands as well as the runner command.
+7. If the operator changes the requested scope, plugin, config, build name, or any other option after commands are shown, rebuild the commands, display them again, and wait for fresh approval.
+8. If monitoring is not requested, report immediate command success/failure and any errors.
+9. Monitor completion only when explicitly requested by the operator.
+10. For monitored runs, allow long runtime windows (15-30+ minutes or longer) and continue until completion unless operator instructs otherwise.
+11. Do not terminate monitored runs unless the operator explicitly instructs termination.
 
 ### Status Request Format
 When the operator asks for run status, report in this order:

atvm/atvm-automation-guide.md

@@ -29,7 +29,10 @@ Run ATVM CMC automation tests on the designated automation VM without unintended
 - Always report whether automation is currently running.
 - If running, ask whether to terminate; terminate only with explicit approval.
 - After termination approval, terminate first, then present planned command(s), then wait for separate execution approval.
-- Before any run, always show exact planned command(s) and wait for explicit approval.
+- Before any run, always show exact planned command(s) exactly as they will be executed and wait for explicit approval.
+- Never execute `cmc-templates.py`, `run-sorry-cypress.py`, or any other ATVM run command until the operator explicitly approves the displayed command(s).
+- Approval is required even for preparation-only steps such as template generation.
+- If the operator changes any part of the request after commands are displayed, rebuild the commands, show the updated commands, and wait for fresh approval before executing anything.
 - Execute only after explicit approval (for example `approve`).
 - After execution, report immediate success/failure only.
 - Do not actively monitor completion unless explicitly requested.
@@ -42,9 +45,12 @@ Run ATVM CMC automation tests on the designated automation VM without unintended
 - Test execution: `./run-sorry-cypress.py`
 
 Typical sequence:
-1. Run `cmc-templates.py` with requested template/options.
-2. Wait for `cmc-templates.py` to fully finish and confirm success.
-3. Run `run-sorry-cypress.py` with matching config and build name.
+1. Build the exact `cmc-templates.py` and `run-sorry-cypress.py` commands for the request.
+2. Show those exact commands to the operator.
+3. Wait for explicit approval.
+4. Run `cmc-templates.py` with the approved options.
+5. Wait for `cmc-templates.py` to fully finish and confirm success.
+6. Run `run-sorry-cypress.py` with the matching approved config and build name.
 
 ## Config File / Gold Disk Mapping
 - `cypress.atvm-config-gold.ts` -> Gold Disk 1
@@ -121,13 +127,15 @@ Before any new automation request:
 
 ## Approval Workflow (Mandatory)
 1. Build exact command(s) for the request.
-2. Present them verbatim as planned commands.
+2. Present them verbatim as planned commands before running anything.
 3. Wait for explicit approval.
-4. Run only approved command(s), no extra options.
+4. Run only approved command(s), no extra options and no silent substitutions.
 5. When both template generation and the Cypress runner are requested, run them sequentially, not in parallel.
 6. Do not launch `run-sorry-cypress.py` until `cmc-templates.py` has exited successfully and finished updating the intended config/spec files.
-7. If monitoring was not requested, report immediate success/failure for each command.
-8. If monitoring was requested, keep monitoring until completion and report final outcome.
+7. Treat displayed commands as a review gate: do not execute either command until the operator has had a chance to review them and explicitly approve.
+8. If the operator asks to change plugin, config, filters, build name, Gold Disk, or scope after commands are shown, discard the old plan, show the revised commands, and wait for new approval.
+9. If monitoring was not requested, report immediate success/failure for each command.
+10. If monitoring was requested, keep monitoring until completion and report final outcome.
 
 ## Requested Test Style
 When asked for one VM or a VM set:

atvm/atvm-automation-runs.md

@@ -163,3 +163,14 @@ This file stores run-specific examples only when a run produced a new learning r
   - Check the automation VM at `192.168.3.190` for live runner processes and live files before looking at historical artifacts.
   - If no automation is active, reconstruct the most recent historical run from the automation VM shell history and reporter artifacts.
   - Do not use Cirrus project operations such as `atvm - cypress` as the source for ATVM automation status unless the operator explicitly asks for project-operation status.
+
+## Run Learning: 2026-03-20 (Display exact ATVM commands and wait for approval before any execution)
+- Observed failure mode:
+  - ATVM run commands were executed before the operator had a chance to review and approve them.
+  - This happened even though the operator expects a review gate before any ATVM automation command is launched.
+- Action for future runs:
+  - Always display the exact planned ATVM commands before execution.
+  - Do not run `cmc-templates.py` until the operator explicitly approves the displayed commands.
+  - Do not run `run-sorry-cypress.py` until the operator explicitly approves the displayed commands.
+  - Treat template generation as execution that also requires operator approval.
+  - If any requested option changes after commands are displayed, rebuild and redisplay the commands and wait for fresh approval.