@event4u/agent-config 14.7.0 → 14.9.0

package/dist/agent-src/contexts/execution/host-capability-manifest.md

@@ -100,6 +100,83 @@ provenance before treating a `false` as a host limitation: on an unrecognized
 host every field is `default`, which is an absence of knowledge and not a
 measurement.
 
+## Observation protocol — what may be written into a registry row
+
+**Added 2026-08-22** (`road-to-host-capability-observations` Phase 1). The
+registry held **one** row while **eight** platform keys were declared, so on
+seven hosts every field was the safe default — and `false` carried two meanings
+at once. This protocol is what makes them distinguishable.
+
+```
+A ROW IS WRITTEN FROM AN OBSERVATION IN A REAL SESSION, NEVER FROM THE HOST'S
+DOCUMENTATION. A CAPABILITY THAT EXISTS ON PAPER AND NOT IN THE SESSION PRODUCES
+A ROUTING DECISION THAT FAILS SILENTLY.
+```
+
+**This is a written criterion a human applies, and deliberately not a script.**
+A prober that decides for itself what counts as evidence is the inference
+`host_capability.ts` already forbids, wearing an executable's authority.
+
+### Per-field criterion — each one transcript-observable
+
+| Field | What counts as an observation |
+|---|---|
+| `subagent_spawn` | a dispatch record showing a **child leg with its own turn** — a start and a stop that pair, so the child's duration is measurable rather than inferred |
+| `parallel_spawn` | **two child legs whose intervals overlap** — concurrently open children at one instant, not two children in sequence |
+| `status_polling` | a **completed poll returning a state the parent did not already hold**. A poll that returns what the parent knew is not an observation of polling |
+| `separate_quota_pool` | a **child leg continuing across a parent quota condition** — the parent constrained, the child proceeding |
+| `worker_respawn` | **one task continuing across a killed and re-spawned worker, same task id.** Never inferred from the fact that spawning and killing both exist separately |
+
+### `agent_teams` is out of scope for a row, by construction
+
+It is resolved **only** by the live environment probe and is never inferred from
+a host id — `host_capability.ts` states that in the field's own doc comment, and
+records that this repository has observed the flag's documented existence and
+never its shape on any host. So: do not add it to a registry row. Observe it, if
+at all, through the live probe.
+
+### Observed-absent is not the same row as never-looked
+
+Both render as `false`, and collapsing them is the defect this protocol opens
+against — a reader then cannot tell whether a capability was tested.
+
+- **Never looked** — the field is **absent from the row**. It resolves to the
+  safe default, and `describeHostCapabilities` reports its source as `default`.
+  This is the state that needs no marker, because the absence *is* the record.
+- **Observed absent** — the field is present and `false`, and carries a
+  `<field>_absent` citation in the same doc comment. Present-and-`false` is the
+  marker: it is only reachable by someone who wrote it deliberately, and the
+  provenance surface then reports `registry` rather than `default` — which is
+  exactly the distinction, readable from `routing:doctor` without opening the
+  file.
+
+### The four-part citation — a row without all four is not admissible
+
+1. **the host** — the platform key from `hook_manifest.yaml`;
+2. **the host version** at the time of observation;
+3. **the transcript or artefact reference** the observation is read from;
+4. **the date**.
+
+Worked example, which a later row can be pattern-matched against:
+
+```
+// subagent_spawn: OBSERVED — claude (Claude Code, Opus 5 1M session, 2026-08-22)
+//   agents/runtime/state/subagent-ledger/2026-08.jsonl: 445 `subagent_start`
+//   records and 420 stops carrying a measured `duration_ms`, i.e. 420 child legs
+//   whose start and stop pair. A measurable child duration is the criterion.
+```
+
+### Pre-state, pinned so the Phase 2 diff reads as an addition
+
+At the commit this protocol landed on, the registry was exactly:
+
+```ts
+const HOST_CAPABILITY_REGISTRY = { claude: { subagent_spawn: true, parallel_spawn: true } };
+```
+
+One host, two fields. Six fields across seven other hosts resolved to the
+all-`false` safe default.
+
 ## Related
 
 - [`subagent-configuration`](../subagent-configuration.md) — the `subagents.*`

package/dist/agent-src/contexts/execution/roadmap-execution-contract.md

@@ -4,8 +4,8 @@ Loaded by [`roadmap-process-loop § 3`](roadmap-process-loop.md) when the run's
 **derived** mode is `autonomous` or `phase-checkpoints`. The mode comes from the
 § 3a ladder — explicit invocation suffix, then frontmatter `execution.mode`,
 then the invocation form — so an ABSENT frontmatter field no longer keeps this
-context unloaded: under `process-full` / `/roadmap:next` it derives
-`autonomous`, under `process-phase` it derives `phase-checkpoints`. Only a
+context unloaded: under `process-full` it derives `autonomous`, and under
+`/roadmap:next` or `process-phase` it derives `phase-checkpoints`. Only a
 *derived* `interactive` (asked for explicitly, declared in frontmatter, or
 `process-step`) leaves this context unloaded and falls back to the legacy
 commit-step scan. Defines the run-start pre-scan,
@@ -78,6 +78,8 @@ Artifacts: <N> planned (skills/rules/commands/guidelines) —
 Open questions: <N> → decision sheet below (<M> rows); the rest via AI
      council (<members | "none configured — will halt on ambiguity">)
 Quality: <cadence> · Dashboard: <cadence>
+Late artifacts: <halt | auto-research> (default halt; cap 3 then halt)
+Deferred items: <wait | spawn-follow-up-draft | cancel-with-memo> (default wait)
 
 <decision sheet, per contract-decision-sheet — omitted entirely when M = 0>
 
@@ -97,6 +99,102 @@ re-ask inside the run. Adjust → apply, re-show once. The contract is
 re-derived on every invocation — it always reflects the roadmap's and
 repo's current state.
 
+### 2a. `late_artifacts` — what happens to an artifact the plan did not name
+
+An artifact discovered **after** Accept was outside the batched overlap check,
+so the research the contract summary reported does not cover it. Two policies,
+and the field is on the screen because the choice changes what the run may do
+without asking:
+
+| Value | Behaviour |
+|---|---|
+| `halt` (**default**) | The run stops at the discovery with the scope-out-of-roadmap halt. The artifact is reported, not authored. |
+| `auto-research` | The run re-runs Phase B (Research) and the overlap pass mid-run against the *current* artifact state — the identical procedure already accepted as non-interactive at contract time, only later. An **extend** verdict extends silently; a **create** verdict derives its understand-answers from the step text and the sheet answers; only a genuine overlap conflict halts. Capped at **three** late artifacts per run, then halt regardless. |
+
+<!-- decision 2026-08-20: the shipped default is `halt`, not `auto-research`.
+     AI council 2/2 (anthropic + openai) on the `autonomy-defaults-sheet` fork
+     of road-to-user-out-of-the-loop, record
+     agents/evidence/council/drain-blocker-dispositions-a.md. Reasoning: the
+     roadmap's own Risk 7 is that auto-research drifts the run's scope, and its
+     stated mitigation is the cap — but a cap of three is a bound on how far the
+     drift goes, not a check on whether it should happen at all. `halt` is also
+     the behaviour the tree already had, so shipping it as the default means
+     this field is purely additive: nothing that worked before changes, and the
+     aggressive path becomes a thing a run declares rather than a thing it
+     inherits. Reversibility: flipping the default is one word in this table
+     plus one word in the mechanics guideline, with no dependent mechanism to
+     unwind, and the roadmap's own kill criterion (late-artifact revisit rate)
+     only becomes measurable once some runs declare `auto-research` — which an
+     opt-in still permits and a silent default would have made unattributable. -->
+
+The cap is not negotiable by the field: a run that keeps discovering artifacts
+has a planning problem, not an autonomy problem, and the third discovery is the
+signal to say so.
+
+### 2b. `deferred_policy` — the two autonomous exits for a `[~]` item
+
+[`roadmap-progress-sync`](../../rules/roadmap-progress-sync.md) Iron Law 3
+forbids a silent archive with unresolved deferred items. That gate is
+unchanged. What this field changes is which dispositions a run may reach
+**without a synchronous prompt**, and there are exactly two, because the
+preservation test in that rule already splits them the same way:
+
+| Value | Behaviour |
+|---|---|
+| `wait` (**default**) | The synchronous halt stands. Every disposition stays conversational. |
+| `spawn-follow-up-draft` | A roadmap closing with `[~]` items spawns the follow-up draft automatically, carrying each item **and** its blocker. The item stays alive in the active estate, which is what makes this council-decidable rather than owner-reserved. |
+| `cancel-with-memo` | An item the run can show is no longer wanted is recorded `[-]` with a reasoning memo naming what changed. This is a **drop**, so it is owner-reserved by the preservation test: the run WRITES the memo and the recommendation, and the archive still waits for the user on that item. |
+
+<!-- decision 2026-08-20: the policy offers BOTH exits — a follow-up draft and
+     an explicit cancellation with a reasoning memo — not the follow-up draft
+     alone. AI council 2/2 (anthropic + openai), same record as above.
+     Reasoning: follow-up-draft-only means every deferred item must be carried,
+     and a carried item nobody wants becomes the parking lot the roadmap's own
+     Risk 5 describes for memos. Offering cancellation makes "this is no longer
+     wanted" a statable outcome with a written reason instead of an indefinite
+     deferral wearing a follow-up roadmap. Reversibility, and it is the load-
+     bearing half: the cancellation exit does NOT lower the gate, because a
+     drop stays owner-reserved — the run produces the memo, the user still
+     decides. Removing the value later removes an option nobody was obliged to
+     use; the default stays `wait` either way. -->
+
+
+### 2c. `traceability` — requirement to acceptance to evidence, OPTIONAL
+
+**Optional for every complexity, including `structural`.** Absent means *not
+declared*, which is a different claim from "there is no requirement". Nothing
+fails for omitting it, and no gate enforces it — the only consumer is a listing
+inventory (`check_requirements_trace`) that exits 0 always. Requiredness is
+deliberately **not** decided here (AI council 2/2, 2026-08-22): deciding it
+before the listing phase has produced a count is deciding it on intuition.
+
+A repeated **row**, not three flat fields:
+
+```yaml
+traceability:
+  - requirement_id: pointer-reaches-the-worker
+    acceptance_id: pointer-under-line-cap
+    evidence_refs:
+      - src/scripts/dispatch_r2_reviewer.ts
+```
+
+Three flat top-level fields would be **countable but not traceable**: with more
+than one requirement and a shared pool of refs the relation is an ambiguous
+many-to-many, so a gate could report a populated count while providing no
+dependable trace. The row carries the relation.
+
+Both grammars are reused, never invented — the claim-ledger kebab slug
+(`docs/CLAIMS.md` § Entry schema) for the two ids, and the envelope ref-token
+rule (`_lib/subagent_response.ts`) for `evidence_refs`: ref tokens, never
+bodies.
+
+Identity semantics, revision semantics, the three senses of "gate" and the
+`[AC:<id>]` convention — including the verified fact that nothing parses
+`verify:` lines structurally today — are in
+[`guideline:agent-infra/traceability-field-mechanics`](../../../../docs/guidelines/agent-infra/traceability-field-mechanics.md).
+They are not optional reading: a slug grammar does not imply a namespace, and
+`evidence_refs` are syntactically safe tokens rather than verified evidence.
+
 ## 3. Grants activated by acceptance
 
 | Grant | Boundary |

package/dist/agent-src/contexts/execution/roadmap-process-loop.md

@@ -112,7 +112,8 @@ Rung 3, by wrapper:
 
 | Wrapper | Derived mode | Contract |
 |---|---|---|
-| `/roadmap:process-full`, `/roadmap:next` | `autonomous`, **preselected** | offered |
+| `/roadmap:process-full` | `autonomous`, **preselected** | offered |
+| `/roadmap:next` | `phase-checkpoints`, **preselected** | offered |
 | `/roadmap:process-phase` | `phase-checkpoints` | offered |
 | `/roadmap:process-step` | — | none (one step needs no run contract) |
 
@@ -122,6 +123,25 @@ screen's `3. Run interactive instead` option
 ([`roadmap-execution-contract § 2`](roadmap-execution-contract.md)) stays on it
 in every case, so a derived mode is always one keystroke from being refused.
 
+<!-- decision 2026-08-20: /roadmap:next preselects `phase-checkpoints`, not
+     `autonomous`. AI council 2/2 (anthropic + openai) on the
+     `autonomy-defaults-sheet` fork of road-to-user-out-of-the-loop, record
+     agents/evidence/council/drain-blocker-dispositions-a.md. Reasoning: the two
+     wrappers differ in what the user has actually seen at Accept time.
+     `process-full` names one roadmap the user chose, so `autonomous` is a
+     preselection over a scope they read. `/roadmap:next` SELECTS the roadmap
+     itself, so `autonomous` there preselects full autonomy over a target the
+     user has not seen — the one rung where the derivation picks the object and
+     the scope in the same keystroke. Reversibility: this is a preselected
+     option on a screen that still offers `1. Go — start processing
+     autonomously`, so the aggressive path costs one keystroke and no rebuild;
+     flipping the row back is a one-line edit with no dependent mechanism.
+     Deliberately scoped to `/roadmap:next` only — the blocker's question named
+     that wrapper, and Phase 1 Step 1 of the parent roadmap landed with
+     `process-full` → `autonomous` explicitly, so widening the change would
+     silently reverse an already-shipped step nobody asked to revisit. -->
+
+
 **Why the old fallback was a defect and not a conservative default.** Absent
 `execution.mode` used to mean the legacy commit-step scan, which derives no
 contract at all — no batched artifact drafting, no council auto-enable, no
@@ -132,6 +152,23 @@ path *under the wrapper built for the opposite*, and silently — the user saw a
 A default that contradicts the wrapper the user just typed is a wrong answer,
 not a safe one.
 
+**Kill criteria — carried here, at the flip, not only in the roadmap that
+made it.** A default flip whose reversal condition lives in a roadmap is a
+flip nobody can reverse once that roadmap is archived, which is why both
+conditions below sit next to the table they govern:
+
+- **The ladder itself** (absent `execution.mode` derives a mode instead of
+  falling back to interactive): `3. Run interactive instead` chosen at the
+  contract screen in **more than 40 % of 20 runs** reverts rung 3, leaving
+  the ladder at explicit-suffix-then-frontmatter only. **No instrument
+  today** — nothing records which contract option was chosen, so the rate is
+  unmeasured rather than low. Stated so the gap is visible at the flip.
+- **The `/roadmap:next` row** (`phase-checkpoints` rather than
+  `autonomous`): reverted if checkpoint-mode runs on that wrapper are
+  observed to stop at a phase boundary the user then waves through without
+  a change — that is a contact the preselection bought nothing for. Same
+  missing instrument, same honesty: this is a condition, not a reading.
+
 **What this does NOT change.** A derived mode grants nothing on its own:
 authorization is still the single Accept on the contract screen, per
 [`roadmap-execution-contract § Principle`](roadmap-execution-contract.md). The
@@ -260,6 +297,89 @@ run can simply outlast, or a cross-roadmap dependency the run can satisfy itself
 is work. The taxonomy still lacks the row; the mislabel now has a stated test
 instead of a default.
 
+### 3d. Set contract — one contract over an enumerated set
+
+A **set contract** is the ordinary contract screen rendered over a closed,
+ordered list of roadmaps instead of one. It grants
+[`autonomy-mechanics § Task-scope`](autonomy-mechanics.md)'s **set-scoped**
+shape, whose four conditions (enumerated before Accept · closed · ordered with
+independence declared · one Accept) are the authorization contract — this
+section is only the loop's side of it.
+
+**What the screen must print, per member.** Roadmap path, derived branch name,
+open-step count, artifact count from the pre-scan, and its dependency edges.
+One decision sheet spans the whole set: a question that applies to several
+members appears once, and its answer applies to all of them.
+
+**Dependency edges come from two sources, unioned.**
+
+| Source | Shape | Trust |
+|---|---|---|
+| Declared | `depends:` in the dependent roadmap's frontmatter — a list of roadmap slugs | authoritative; a declared edge is never overridden by the heuristic |
+| Inferred | **file overlap**: the intersection of the owned-path sets the two pre-scans derived | advisory; an inferred edge orders the members and marks them non-parallelizable, and is printed as inferred so the user can see why |
+
+The union feeds exactly two decisions and nothing else: **ordering** (a
+dependent member runs after its parent) and **parallelizability** (only members
+with no edge between them and disjoint owned paths are lane candidates). An
+inferred edge is deliberately allowed to be wrong in the conservative
+direction — a false edge costs serial execution, a missed edge costs a
+collision, so overlap resolves toward *serial*.
+
+#### Auto-continuity — the next member needs no new contact
+
+Under an accepted set contract, when a member closes **green** the loop pulls
+the next member whose dependencies are all satisfied and starts it without a
+new contact. Green means: its own final report ran, its quality cadence passed,
+and no halt class fired. Anything else is not green and does not continue —
+see failure isolation below.
+
+The default stays **this one only**: auto-continuity applies to
+`/roadmap:next` and to any wrapper reaching this section **only when the set
+option was chosen on the sheet**. A single-roadmap invocation is never widened
+into a set because more roadmaps happened to be open, which is condition 4 of
+the set-scoped shape read from the loop's side.
+
+#### Failure isolation — a regression halts its own member, not the set
+
+A quality regression, a failed verify probe, or a halt class firing inside one
+member terminates **that member** and leaves the rest of the set running:
+
+1. Record the member's outcome as halted, with the halt class and the evidence.
+2. Skip every member that declares a dependency on it — transitively. A
+   dependent member of a halted parent is *blocked*, not failed, and is
+   reported as such.
+3. Continue with the next independent member.
+4. Report every member's outcome in one final report at the end of the set.
+
+Two carve-outs, and they are the reason this is isolation rather than
+tolerance. A **Hard-Floor** stop and a **locked decision class** stop the whole
+set, not one member: both are about the user's authority rather than about the
+member's code, and continuing past them under a set contract would be exactly
+the "several authorizations from one Accept" failure the enumeration guards
+against. Likewise the **N=3 validation budget** is per validation target and is
+not reset by moving to the next member.
+
+#### Parallel lanes — the shape, and why they are not on yet
+
+Lanes are **staged**, not shipped: the gate is ten clean serial set runs, and
+that gate has not been reached because no set run has happened. Recorded here
+so the shape is settled before the runs rather than designed under pressure:
+
+- **Cap: two lanes** in the first iteration — a recorded decision
+  (`decision 2026-08-20`, AI council 2/2 on the `autonomy-defaults-sheet`
+  fork), chosen over the configured `subagents.max_parallel` because a
+  collision at two lanes is diagnosable and one at N is not. Reversible: the
+  cap is one number in the set contract, and raising it after the first ten
+  clean parallel runs is strictly cheaper than recovering from a lost branch.
+- **Candidate test:** no dependency edge in either direction, and disjoint
+  owned paths.
+- **Isolation:** the existing worktree scope lock
+  ([`worktree-lifecycle`](../../skills/worktree-lifecycle/SKILL.md)).
+- **Coordination:** session-register branch claims, so two sessions never share
+  a branch.
+- **Delivery:** one branch and one PR per lane.
+- **Immediate removal:** a single scope-lock collision with data loss.
+
 ## 4. Resolve cadences — read once, cache for the run
 
 Read both keys from `.agent-settings.yml` once and cache for the whole
@@ -414,7 +534,39 @@ For each open step in the working set (scope-bound — see wrapper):
    Empty output → Iron Law 2 was violated this iteration: the step
    landed work but no checkbox flipped. **Halt loudly**, surface
    "step <N> landed without checkbox flip — flip then resume", and
-   stop the run. Do not auto-fix; the user resumes on the next turn.
+   stop the run. Outside an accepted contract: do not auto-fix; the user
+   resumes on the next turn. Inside one: exactly one self-fix attempt, under
+   the four preconditions below.
+
+   **One deterministic self-fix, contract mode only.** A forgotten flip is the
+   one halt class whose repair is mechanical — the work is on disk, the step is
+   named, and the glyph follows from the outcome. Halting a contract run on it
+   spends a user contact to retype something the run can derive. So inside an
+   accepted contract the run may attempt the flip **once**, and only when all
+   four hold:
+
+   1. **The work is citable.** The step's landed change is identifiable in this
+      iteration's own output — a diff, a file path, a command result. No
+      evidence, no flip: that is a genuine halt, not a forgotten one.
+   2. **The glyph is unambiguous.** `[x]` only for a step whose evidence is
+      present and, where the step carries a `verify:` field, whose fresh green
+      run is in this reply. Anything that would be `[~]` or `[-]` is a
+      *disposition*, never a repair — those halt exactly as before, because a
+      deferral and a cancellation are decisions.
+   3. **Exactly one attempt, per run.** Not per step. A second forgotten flip
+      in the same run halts: one is a slip, two is a broken loop, and the
+      difference is the whole justification for allowing the first.
+   4. **The attempt is verified, then re-guarded.** Re-run the
+      `git status --porcelain` probe above after the flip. Still empty → halt
+      loudly as before. A self-fix that cannot prove itself is
+      indistinguishable from the failure it was repairing.
+
+   The attempt is recorded as a decision memo (§ 4 handling), so an auto-flip is
+   reviewable after the fact rather than invisible. **Kill criterion, from the
+   originating roadmap and repeated here because a flip is a write to the source
+   of truth: one wrong auto-flip removes this allowance** and returns the guard
+   to halt-always. Reversibility is the deletion of this block — the guard
+   underneath it never changed.
 
    This guard is the deterministic counterpart to the rule's
    pre-send self-check — it catches a forgotten flip per step, not

package/dist/agent-src/contexts/execution/subagent-response-contract.md

@@ -31,6 +31,86 @@ orchestrator synthesises and re-verifies.
   chars (~3k tokens against a measured ~251k spawn floor). Constants + checks:
   `src/scripts/_lib/subagent_response.ts`.
 
+## The canonical shape, and the three-way divergence it resolves
+
+**Reconciled 2026-08-22** (`road-to-subagent-envelope-adoption` Phase 0, AI
+council 2/2 convergent). One contract existed in three mutually inconsistent
+states, and the ledger's `0 valid envelopes of 1,845 stops` could not be cited
+as evidence about any one of them, because a reader had to assume which.
+
+```
+THE BODY SCHEMA IS `validateResponse`'S FIVE REQUIRED FIELDS. PRODUCERS CONVERGE
+ON IT; THE VALIDATOR IS NOT WIDENED TO THE UNION OF WHAT PRODUCERS HAPPEN TO SEND.
+```
+
+Direction chosen: **narrow the contract to what the validator already accepts**,
+not widen the validator. Widening makes every future divergence legal by
+construction, which is how one contract came to have three states.
+
+### Per-field divergence, one row per field
+
+| Field | spawn-contract (f) | `team_dispatch` model JSON (`:297`) | `subagent_response.ts` validator | `dispatch_r2_reviewer` |
+|---|---|---|---|---|
+| `summary` | — (not a field clause) | present | **required** | silent |
+| `handoff` | — | **absent** | **required** | silent |
+| `confidence` | — | **absent** | **required** (`low\|medium\|high`) | silent |
+| `findings` | — | present, `{severity, evidence, suggested_fix, location}` | **required**, `{title, evidence_refs?, mutating?}` | silent |
+| `risks` | — | **absent** | **required** | silent |
+| `artifact_paths` | — | absent | optional | silent |
+| `assumptions` | — | absent | optional | silent |
+| `status` | — | present, 3 model values | **not a body field** | silent |
+
+An empty cell is a finding, not a pass. `dispatch_r2_reviewer` is silent on
+every row — 1,292 lines with **0** hits for `envelope`, `DONE_WITH_CONCERNS`,
+`response.contract` or `response_contract`.
+
+### Four boundaries, because "the contract" was conflating them
+
+The council's sharpest correction: schema, lifecycle state, delivery and
+classification were being treated as one thing.
+
+1. **Body schema** — the five required fields above, plus the two optional ones.
+2. **Lifecycle frame** — `DONE` / `DONE_WITH_CONCERNS` / `NEEDS_CONTEXT` from a
+   model, plus `BLOCKED` orchestrator-side only (`team_dispatch.ts:391`'s
+   `_MODEL_STATUSES` is the three-value set a model may send). **Not a body
+   field**, which is why narrowing the body does not delete it.
+3. **Delivery protocol** — serialize once, persist that exact serialization,
+   then emit the identical value as the final text-only message. This is
+   spawn-contract rule (f), and it **survives the narrowing**: its two clauses
+   are delivery invariants, not fields, so they were never candidates for the
+   validator's five.
+4. **Classification** — validate and record against an explicit contract and
+   classifier version.
+
+### Who owns the delivery protocol — and it is not the model
+
+`team_dispatch.ts:280` asks a **read-only** model with no command or filesystem
+access to return its review JSON. That model **cannot** satisfy "disk copy
+written first", so rule (f) is an impossible prompt obligation for this
+producer. The trusted dispatcher owns it: parse the producer's response, project
+it into the canonical body, add the lifecycle frame, write the durable copy,
+then emit the identical serialized value.
+
+Recorded rather than implemented here — the projection adapter is a mechanism
+this roadmap's Phase 1 does not ship, and saying so is cheaper than a contract
+clause nobody can satisfy.
+
+### The validator is not the reason the rate is zero
+
+Checked directly on 2026-08-22, because "zero valid envelopes over 1,845 stops"
+has three possible causes and they need separating: a validator that rejects
+valid input, producers that do not emit the fields, or a shape nobody can
+produce.
+
+`validateResponse` was run by hand against a minimal envelope
+(`{summary, handoff, confidence, findings: [], risks: []}`) and a rich one
+(with `findings[{title, evidence_refs, mutating}]` and `artifact_paths`).
+**Both validate.** The `team_dispatch` model shape fails on four of five.
+
+So the contract is implementable and the validator is correct; the rate is zero
+because producers do not emit the shape. That removes the precondition one
+council seat set before any narrowing.
+
 ## Durable copy — the envelope on disk before the message
 
 ```

package/dist/agent-src/rules/artifact-drafting-protocol.md

@@ -55,8 +55,12 @@ Fires once per creation task, not once per edit.
 - At most two propose → reject cycles; then stop.
 - Commit only on approval.
 - Bypass is legitimate — *"just write it"* drops the protocol immediately.
+- An artifact discovered **after** an accepted contract halts by default;
+  `late_artifacts: auto-research` is the only declared value that continues,
+  capped at three per run (mechanics guideline § Late artifacts).
 
-Body migrated to [`guideline:agent-infra/artifact-drafting-protocol-mechanics`](../docs/guidelines/agent-infra/artifact-drafting-protocol-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — Phase A/B/C procedure detail + the roadmap-run batch-mode carve-out (Research-once-at-contract-time, batch scope, no `artifact_protocol: skip`).
+Body migrated to [`guideline:agent-infra/artifact-drafting-protocol-mechanics`](../docs/guidelines/agent-infra/artifact-drafting-protocol-mechanics.md) (per P4 of `road-to-kernel-and-router.md`) — Phase A/B/C procedure detail + the roadmap-run batch-mode carve-out (Research-once-at-contract-time, batch scope, no `artifact_protocol: skip`) + § Late artifacts (the `halt` default
+and the five-step `auto-research` procedure).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
 Extends (cross-link, don't restate): `ask-when-uncertain`,

package/dist/agent-src/rules/decision-revisit-gate.md

@@ -39,25 +39,21 @@ THE USER IS REACHED FOR THE RESERVED SET — AND ALWAYS FOR IT.
 NEVER CITE A LOCK YOU HAVE NOT EVALUATED THIS TURN.
 ```
 
-An agent that finds a genuinely beneficial change blocked by a recorded
-past decision — an honest-null eval verdict, a "don't relitigate"
-memory or context note, a token-frugality/budget canon line, or an ADR —
-does not quietly comply and drop the change. It surfaces the conflict and
-re-evaluates the lock — **in the council by default**, reaching the user only
-for the reserved set below. Progress means adaptation: locks encode what was
-true when they were written, not a ceiling on what the package may ever become.
+An agent that finds a beneficial change blocked by a recorded decision — an
+honest-null verdict, a "don't relitigate" note, a budget-canon line, or an ADR —
+does not quietly comply and drop it. It surfaces the conflict and re-evaluates
+the lock **in the council by default**, reaching the user only for the reserved
+set below. Locks encode what was true when they were written, not a ceiling on
+what the package may ever become.
 
 **The default venue is the council, and this is a correction, not a new
-policy.** [`ai-council`](../skills/ai-council/SKILL.md) has said since its own
-Iron Law that *"a design decision the agent cannot settle from the tree goes to
-the council first, not to the user first"*, and its class table already lists
-"reopening a recorded decision". This rule used to say "offers the user a path",
-which contradicted that and made every lock an owner interrupt. The measured
-cost of the contradiction: across 26 days of transcripts, the agent reported a
-lock and waited, and the owner had to void the decision retroactively before the
-work resumed — in the two clearest cases the lock report is timestamped **before**
-the override demand. The ordering was the defect; the permission was never
-missing.
+policy.** [`ai-council`](../skills/ai-council/SKILL.md)'s Iron Law already sends
+a decision the agent cannot settle from the tree to the council first, and its
+class table lists "reopening a recorded decision". The old "offers the user a
+path" wording made every lock an owner interrupt; measured across 26 days of
+transcripts, the agent reported a lock and waited while the owner voided the
+decision retroactively — twice with the lock report timestamped **before** the
+override demand. The ordering was the defect; the permission was never missing.
 
 **Mechanism-match check comes FIRST**: a verdict settles the *mechanism it
 tested*, not every future proposal that resembles it — if the blocked change
@@ -81,20 +77,54 @@ distinction.
 4. **Route it** — council by default (below), user only for the reserved set.
 5. **Record** the outcome with scope and `revisit-if`.
 
-These five are the obligation and they are stated here rather than only behind
-a route, because the route was measurably unreachable: `decision-revisit-gate`
-lives in the always-on `meta` pack while `decision-review` ships
-`install.default: false` in the non-default `analysis-workbench` pack, so a
-pack-legal install received the obligation and not the procedure. `routes_to`
-now names two always-on skills; the backward-audit depth in
-[`decision-review`](../skills/decision-review/SKILL.md) stays optional, which is
-the correct status for depth.
+The five are stated here, not only behind a route, because the route was
+measurably unreachable: `decision-review` ships `install.default: false` in the
+non-default `analysis-workbench` pack, so a pack-legal install received the
+obligation and not the procedure. `routes_to` now names two always-on skills;
+the backward-audit depth in
+[`decision-review`](../skills/decision-review/SKILL.md) stays optional.
 
 Full catalog (honest nulls, don't-relitigate notes, budget-canon lines, ADRs,
 hard structural caps), the per-step detail, when-NOT-to-fire and the failure
 modes remain in [`skill:decision-review` § Decision-revisit gate — mechanics](../skills/decision-review/SKILL.md).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).
 
+## Reading a lock — the two descriptive axes
+
+Step 2 reads, in order: **effective state** (status · amendments · successors) →
+**provenance** → **evidence strength** → **discovery** → **current evidence**
+(does the basis still resolve in a clone?) → **reversibility of the proposed
+transition** → **reserved dimensions**. `adr_cite_check` prints six of them —
+read 6 is the agent's, because reversibility belongs to the proposed transition
+and no tool reading one record supplies it. What each field means, and what a
+`[found]` basis ref does NOT claim, is in that script's module docstring. The
+evidence-priced burden table stays in
+[`adr-layout § The reopen record`](../docs/contracts/adr-layout.md).
+
+```
+A GRADE IS A MEASUREMENT, NOT A PERMISSION — IT GRANTS NOTHING.
+CITING AN E0 LOCK AS A HARD BLOCKER WITHOUT SURFACING ITS GRADE IS A VIOLATION.
+NO GRADE LETS AN AGENT SUPERSEDE A RECORD, SKIP A COUNCIL, OR TAKE ANY ACTION
+IT COULD NOT TAKE YESTERDAY. THE COUNCIL-FIRST VENUE STAYS, AT EVERY GRADE.
+AN ADR'S HISTORICAL DECISION-MAKER DOES NOT DETERMINE ITS REOPEN VENUE.
+A LOW-EVIDENCE RECORD MAY STATE A DECISION; IT DOES NOT ESTABLISH THAT ITS
+ALTERNATIVES REMAIN INVALID.
+```
+
+Venue comes from the proposed transition, the trust boundaries it touches and
+the reserved dimensions below — never from who decided originally, and never
+from a grade. A weak grade changes how much a reopen must **do**, never who may
+do it: `authority_basis: owner_intent` is surfaced with its accumulated cost and
+never overruled, and council agreement never raises `evidence.strength` —
+sources and measurements do.
+
+**No E0/E1 agent path is enabled here, and no reading of this rule enables
+one.** Whether an independently validated grade may ever reduce the
+*authorization* burden is an owner-reserved open question — the
+`authority-coupling-decision` blocker — left unanswered because the party
+assigning a grade would be the party gaining authority from it, and would be
+self-classifying the transition as reversible-internal on top.
+
 ## Who decides — the owner-reserved set
 
 The discriminator, in one question: **does the proposed transition weaken an
@@ -121,27 +151,24 @@ forever. Availability is `agent-config council:status`, never a project file
 ([`council-availability`](council-availability.md)).
 
 Field on the ADR: `reopen_policy: directional | owner | unclassified`, absent →
-**`unclassified`**, which permits council investigation and reversible
-experiments and gates only execution of a reserved transition. Absent is
+**`unclassified`** — council investigation and reversible experiments are
+permitted; only execution of a reserved transition is gated. Absent is
 deliberately not `owner`: with 146 accepted ADRs that default would encode
-today's blockage into the new schema. Full contract, the reopen record, and the
+today's blockage into the new schema. Full contract, the reopen record and the
 precedent-creates-no-authority clause: [`adr-layout § Reopen authority`](../docs/contracts/adr-layout.md).
 
 ## See also
 
 - [`recurring-criticism`](recurring-criticism.md) — the **other entrance**: this
   rule fires when a lock blocks a change, that one when the same criticism arrives
-  again. It reuses the five steps and the owner-reserved table below.
+  again. It reuses the five steps and the owner-reserved table above.
 - [`decision-review`](../skills/decision-review/SKILL.md) — the backward-audit
   procedure + the migrated gate mechanics.
 - [`ai-council`](../skills/ai-council/SKILL.md) — the re-evaluation mechanism;
   owns the convergence-summary scope + `revisit-if` contract.
 - [`decision-record`](../skills/decision-record/SKILL.md) — forward-flow decision
   locking; its **§ 4 Lock the choice + consequences** requires the `Revisit-if:`
-  line that names the reopening condition up front. (This pointer used to cite an
-  "escalation litmus" heading; `grep` over `src/` + `docs/` returns two hits and
-  neither is in that file — the heading never existed, so the pointer led
-  nowhere. Corrected to the section that carries the obligation.)
+  line that names the reopening condition up front.
 - [`token-budget-discipline`](token-budget-discipline.md) — the frugality-canon
   value-over-budget escalation this rule's budget-lock case defers to.
 - [`no-cheap-questions`](no-cheap-questions.md) — the question-quality floor a
@@ -164,3 +191,8 @@ plus the curated `dist/agent-src/scripts/` list and is deliberately out of this
 change. And `docs/decisions/` is projected into no agent-visible tree at all —
 the agent sees ADR *numbers* cited across rules and skills, almost never ADR
 *text*. Until that changes, "evaluate before citing" means opening the file.
+
+`docs/contracts/` is unprojected on the same terms (`dist/agent-src/` carries no
+`docs/`), so the burden table this rule points at is maintainer-reachable only.
+That is why the reserved-set table above stays here rather than becoming a
+pointer: a consumer install receives these lines and not the contract.