@event4u/agent-config 16.0.0 → 16.1.0

package/src/config/agent-settings.template.yml

@@ -423,6 +423,47 @@ github:
   # auto                  = detect on first use and update this setting
   pr_reply_method: create_review_comment
 
+# --- Delivery: what a run does with the branch it produced ---
+#
+# ADR-268 section 3 resolves ADR-239 section 3's "undecided, not rejected" on merge
+# authority in the affirmative, and these keys are where that decision is
+# configured rather than inferred. All three are Class C in
+# docs/contracts/settings-classes.md: every agent write path refuses them, so
+# a run can read its delivery policy and can never widen it.
+#
+# NAMING IS DELIBERATE. check_no_automerge_key.ts is a namespace ratchet on the
+# three key names autoMerge / auto_merge / mergePolicy, and its own text reserves
+# its deletion to the owner. `delivery.merge` grants the same capability under a
+# name outside that closed set, so the ratchet stays green and stays standing --
+# the boundary it protects is a name, and the decision it points at was taken by
+# an ADR rather than by a key.
+delivery:
+  # Whether a run may merge the pull request it produced.
+  #   off      = default. The run ends at mergeable-green-and-open and says so.
+  #   on-green = merge is permitted, and ONLY when an object-bound grant covering
+  #              {op: prod_merge, target: <base>} exists AND the final head is
+  #              required-check-green, target-current and tamper-checked. This
+  #              key is a precondition, never the authorisation by itself.
+  # Forge auto-merge is the mechanism, so branch protection stays the gate.
+  # Required protections are never bypassed -- an invariant, not a default.
+  merge: "off"
+
+  # Whether the run stays alive until the required checks settle.
+  #   true  = default. The run drives CI and reports the settled verdict.
+  #   false = the run ends once the branch is pushed and the PR is open,
+  #           leaving the checks to be read later.
+  # Independent of `merge`: a run may wait for CI without being allowed to
+  # merge, which is the shape every drain run uses today.
+  wait_for_ci: true
+
+  # How a mission's work is shaped into pull requests.
+  #   single  = default. One branch, one pull request.
+  #   stacked = a dependent series.
+  # `stacked` is NEVER chosen by the agent and is never asked about at roadmap
+  # creation. The owner plans it in roadmap frontmatter or it does not happen;
+  # that is why this key is Class C rather than a preference.
+  pr_topology: single
+
 # --- Augment Code projection (.augment/) ---
 #
 # Controls how rule files are written into .augment/rules/ during
@@ -533,9 +574,23 @@ roadmap:
   # pattern: which asks are batched into the run-start execution
   # contract and where checkpoint prompts fire. It overrides NONE of
   # the keys below — `skip_pre_run_gate`, `quality_cadence`, and
-  # `dashboard_regen_cadence` keep their global meaning in every mode,
-  # and no mode lifts a safety floor. See
-  # contexts/execution/roadmap-execution-contract.md.
+  # `dashboard_regen_cadence` keep their global meaning in every mode.
+  #
+  # WHAT NO MODE LIFTS, NAMED. This sentence used to read "no mode lifts a
+  # safety floor", which is unfalsifiable: it never says which floor or how
+  # far it reaches. What no `execution.mode` value lifts is ADR-260 section 2's
+  # closed eleven-op vocabulary -- force_push, prod_merge, tag_push, release,
+  # publish, branch_protection_change, repo_delete, prod_data_delete,
+  # secret_write, payment, external_send. Each of those needs its own
+  # object-bound grant, and no interaction pattern substitutes for one.
+  #
+  # The Hard Floor in `non-destructive-by-default` is today WIDER than that
+  # vocabulary -- it also covers every `git push` and every non-prod merge --
+  # and that wider reach is what is in force right now. ADR-260 decision 11
+  # narrows it to the eleven ops and ADR-268 accepted that, but the narrowing
+  # has not landed, so read the rule's own trigger table as the authority on
+  # reach and this comment as the authority on what a MODE can change: nothing.
+  # See contexts/execution/roadmap-execution-contract.md.
 
   # Skip the /roadmap:process-* pre-run confirmation gate (true, false).
   #   true  = default. The command name names the scope; a discoverable
@@ -549,15 +604,19 @@ roadmap:
   skip_pre_run_gate: true
 
   # When to run quality tools during /roadmap execute.
-  #   end_of_roadmap = once, before archiving the completed roadmap (default — fastest, fewest tokens)
-  #   per_phase      = once after every completed phase
+  #   end_of_roadmap = once, before archiving the completed roadmap (fastest, fewest tokens)
+  #   per_phase      = once after every completed phase (default since 2026-09-13)
   #   per_step       = after every completed step (legacy verbose; highest token cost)
-  # Trade-off: end_of_roadmap saves tokens and time but lets errors compound
-  # across phases. Pick per_phase if the work is risky or unfamiliar.
-  # `quality.local_auto_run: false` (the default) suppresses local
-  # pipeline runs at EVERY cadence — remote CI is the gate; this knob
-  # only matters when `local_auto_run` is `true`.
-  quality_cadence: end_of_roadmap
+  # The default moved from end_of_roadmap to per_phase on the strength of
+  # this block's OWN trade-off sentence: end_of_roadmap saves tokens and
+  # time but lets errors compound across phases. A multi-phase autonomous
+  # run is exactly the case where compounding is expensive and nobody is
+  # watching, so the cheaper default was the wrong one to ship. Set
+  # end_of_roadmap back if the work is routine and token cost dominates.
+  # `quality.local_auto_run` (chat) and `quality.local_auto_run_in_mission`
+  # (a mission) decide WHETHER local pipeline runs happen at all; this
+  # knob only decides WHEN, and is inert wherever both resolve false.
+  quality_cadence: per_phase
 
   # Dashboard regen cadence inside autonomous runs (process-step /
   # process-phase / process-full). Controls how often
@@ -635,20 +694,26 @@ roadmap:
 # roadmaps AND feature plans — which is why these keys do not live under
 # `roadmap:`. All three default to true; a missing key behaves as true.
 planning:
-  # Gate C — plan-confidence gate, BEFORE authoring (true, false).
-  # true  = default. A plan-artifact authoring ask (/roadmap:create,
-  #         roadmap-writing, /feature:plan, /feature:roadmap) first runs
-  #         the four 95%-confidence conditions from /challenge-me vision.
-  #         All four hold → the agent creates directly and emits exactly
-  #         one marker line ("Confidence ≥ 95% — creating directly").
-  #         Any gap → the ask routes into the /challenge-me vision
-  #         interview first; hosts without that command run the inline
-  #         degrade interview (one question per turn, same stop
-  #         conditions — contexts/execution/plan-confidence-gate.md).
+  # Gate C — plan-closure pass, at the END of planning (true, false).
+  # true  = default. Every command declaring `produces_roadmap: true`
+  #         ends in a closure pass (/challenge-me closure): the open
+  #         decisions are detected, each resolved at the lowest rung
+  #         that owns it — evidence, convention, the agent, an
+  #         independent session, the council, the team, the owner last
+  #         and only for owner-owned residue — and written into the
+  #         roadmap's `## Decisions` table. The seed-confidence check
+  #         from /challenge-me vision still runs where a plan starts
+  #         from a fuzzy ask; the difference is that closure is now
+  #         measured at the END, where an open decision actually costs
+  #         a run, rather than only at the start.
   #         An explicit user bypass ("just write it") wins for that turn
-  #         and is counted (gate_c_bypass_rate).
+  #         and is counted AS A BYPASS, on its own axis — never as an
+  #         absent closure.
   # false = inert; plan asks author directly (today's behavior).
-  challenge_on_create: true
+  #
+  # `challenge_on_create` is the deprecated alias, accepted for one
+  # minor so an installed settings file keeps loading.
+  closure_pass: true
 
   # Gate R1 — plan-risk review at plan creation / substantial change
   # (true, false).
@@ -674,6 +739,35 @@ planning:
   # false = escape hatch; the validator skips (governance default is on).
   completion_review: true
 
+# --- Execution — the fix-loop bound and its escalation ladder ---
+#
+# The bound on how long the agent keeps attempting the same failing
+# target, and what happens when it is reached. Reaching the bound is a
+# STRATEGY CHANGE, never a question: `escalation` names the rungs the
+# agent walks, in order, before any owner ask is even considered.
+#
+# `owner_owned_check` is the last rung and it is NOT "ask now" — it asks
+# whether the remaining residue is owner-owned per the ownership table.
+# Where it is not, the run continues under a new strategy epoch. Removing
+# that rung by setting is refused: it is the rung that DECIDES whether a
+# residue is owner-owned at all, so dropping it turns every residue into
+# an owner ask, which is the failure the ladder exists to end.
+execution:
+  # Consecutive failed fix attempts against one validation target before
+  # the ladder's terminal rung is reached. Overridable globally, per
+  # project, and per prompt. A non-integer or non-positive value falls
+  # back to 10 — a bound of 0 makes every first attempt terminal.
+  fix_loop_max: 10
+
+  # The rungs, in order. Attempts escalate INDEPENDENTLY first: another
+  # session or a provider-diverse reviewer, then the council, then the
+  # team, and only then the owner-ownership question.
+  # A FLOW sequence, like every other list in this file: the settings
+  # writer locates a key by its `key: <value>` line, so a block sequence
+  # reads as an empty section header and the write corrupts the file.
+  escalation: [independent, council, team, owner_owned_check]
+
+
 # --- Quality / CI execution ---
 #
 # Controls whether the agent runs the project's quality pipeline
@@ -705,16 +799,34 @@ quality:
   # MUST execute it locally to prove the gate works. Without that
   # execution the new gate is unverified evidence.
   #
-  # Posture note (feedback-8.11-2): `false` is a DELIBERATE, documented
-  # design decision, not an omission — remote CI is the single
-  # authoritative gate; local full-pipeline runs duplicate it at
-  # wall-clock + token cost. It never suppresses (a) narrow diff-scoped
+  # Posture note (feedback-8.11-2, rewritten 2026-09-13): `false` is a
+  # DELIBERATE, documented design decision — and it describes a CHAT
+  # TURN, not an autonomous mission. That is the half the old wording
+  # left implicit, and naming it is the whole point of the rewrite.
+  # In a chat turn a human is present, the next action is theirs, and a
+  # local full-pipeline run duplicates remote CI at wall-clock + token
+  # cost while they wait. In an autonomous mission nobody is waiting,
+  # the next action is the agent's own, and a red discovered twenty
+  # steps later costs more than the run that would have caught it at
+  # step one — the same "lets errors compound" argument the roadmap
+  # cadence knob above already makes about itself.
+  # So: this key governs CHAT. `local_auto_run_in_mission` below
+  # governs a mission. Neither ever suppresses (a) narrow diff-scoped
   # probes (type-check/lint/tests over the agent's OWN changed files
   # before pushing — those always run), (b) the new-gate carve-out
   # above, (c) user-invoked runs. Run-end reports must say "quality
   # gates delegated to remote CI", never claim an unrun pipeline passed.
   local_auto_run: false
 
+  # Run local quality / CI tasks autonomously INSIDE a mission — an
+  # autonomous roadmap run with a claimed contract (true, false).
+  #   true  = default. A mission resolves `local_auto_run` to true.
+  #   false = a mission behaves like chat; remote CI alone is the gate.
+  # Resolution is a runtime condition, never a settings layer: outside a
+  # mission this key is inert, and `local_auto_run: true` is never
+  # LOWERED by a mission. Resolver: src/shared/missionExecution.ts.
+  local_auto_run_in_mission: true
+
 
 # --- Design fidelity ---
 #

package/src/config/auto-rule-budget.json

@@ -0,0 +1,16 @@
+{
+  "_comment": "Growth ratchet for the `auto`-tier rule bucket (road-to-design-fidelity-proof Phase 3). check_always_budget gates the nine kernel rules; measure_rule_budget already measured all 121 and gated none of them, so ~93 % of the estate's rule prose grew against nothing. Seeded AT the measurement, exactly like the preamble-payload ceiling and for the same reason: seeding below it would red every pull request from the day it lands, which is a self-inflicted CI stop rather than a gate. It may only move DOWN. Raising it to clear a failing check is the config-weakening move this repo refuses; walk the bucket back instead, or state the compensating reduction.",
+  "schema_version": 1,
+  "registered_at": "2026-09-18",
+  "owner": "maintainer",
+  "review_by": "2027-09-18",
+  "baseline_chars": 373000,
+  "baseline_history": [
+    {
+      "chars": 373000,
+      "at": "2026-09-18",
+      "why": "registered with the gate, seeded at the measured auto bucket (107 rules) after road-to-design-fidelity-proof Phase 1 returned 1,885 chars from design-fidelity.md"
+    }
+  ],
+  "_what_this_does_not_claim": "A char count is not an obligation count. The Iron-Law total printed beside it is the closer proxy for what the instruction-following research calls simultaneous constraints, and it is REPORTED, not gated \u2014 nobody has measured a threshold for this layer, and gating an unmeasured number would publish a bound as if it were a finding."
+}

package/src/config/ci-local-parity.yml

@@ -278,11 +278,24 @@ local_only:
   - id: check_platform_anchor
     class: token-scope-unavailable
     reason: >
-      Reads `repos/{owner}/{repo}/rulesets` to check that the forge actually
-      requires what the ratification mechanism claims it does — an active branch
-      ruleset over the default branch, an approving review, last-push approval,
-      deletion and force-push blocked, strict required checks, and no
-      unconditional bypass actor.
+      Reads `repos/{owner}/{repo}/rulesets` to compare the committed expectation
+      against the live ruleset — an active branch ruleset over the default
+      branch, review-thread resolution, deletion and force-push blocked, at
+      least one required status check context, and no unconditional bypass
+      actor. `strict_required_status_checks` is a baseline expectation currently
+      covered by the recorded waiver `arr-2026-09-10-strict-status-checks`
+      (owner, expires 2026-12-09), so a deviation there is reported as an
+      accepted risk rather than a finding.
+
+      Corrected 2026-09-13. This text used to name "an approving review,
+      last-push approval" among what is checked; both dimensions were removed
+      from the trust model by owner ruling on 2026-09-10 and are now reported as
+      observed evidence, never as a requirement. It also said the gate checks
+      that the forge "actually requires what the ratification mechanism claims
+      it does" — which overstates a voluntarily invoked local control, per the
+      reviewing council of 2026-09-13, and `check_platform_anchor` must not be
+      described as enforcing repository-wide compliance. See
+      `enforcement_boundary_note` in `src/config/platform-anchor.json`.
 
       Local-only because the permission does not exist, not because remote
       enforcement is unwanted — which is the opposite of the usual reason on this

package/src/config/continuity-surface.json

@@ -148,6 +148,13 @@
             "locus": "src/scripts/hooks/design_pass_hook.ts:66",
             "reason": "Design-pass hook latch."
         },
+        {
+            "id": "obligations",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/_lib/obligations.ts:57",
+            "reason": "Per-session obligation ledger — instrumentation, not continuity. A later session must not resume from it: the rows record which obligations THIS session was delivered, and attributing them to a successor would be the one claim the ledger is forbidden to make."
+        },
         {
             "id": "design-slop-hook.json",
             "axis": "persistent_continuity_artefacts",
@@ -267,6 +274,13 @@
             "locus": "src/scripts/hooks/reread_guard_hook.ts:21",
             "reason": "Per-file re-read guard stamps, scoped to one session and never restored into another."
         },
+        {
+            "id": "memory-recall",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/memory_recall_hook.ts:429",
+            "reason": "Per-session once-per-slug latch for the memory-recall advisory, so a delivered memory is not re-injected on the next matching tool call. Slug keys and timestamps only, scoped to one session and never restored into another — a successor session SHOULD be told again."
+        },
         {
             "id": "review-axis",
             "axis": "persistent_continuity_artefacts",
@@ -407,6 +421,13 @@
             "locus": "src/scripts/_dispatch.bash:74",
             "reason": "UI audit output. Analysis result."
         },
+        {
+            "id": "ui-conformance.json",
+            "axis": "persistent_continuity_artefacts",
+            "disposition": "excluded",
+            "locus": "src/scripts/hooks/design_pass_hook.ts:68",
+            "reason": "Behavioural-conformance probe output. Analysis result, on the same footing as its `ui-audit.json` neighbour: keyed on a target path rather than a session, consumed by the design pass as a shadow verdict, and never read by a successor session to resume anything."
+        },
         {
             "id": "ui-route-nudge.json",
             "axis": "persistent_continuity_artefacts",

package/src/config/gate-coverage.yml

@@ -52,21 +52,54 @@
 #                of them.
 #   canary       optional mutation recipe (Phase 7) — see CANARY below
 #
-# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-09-08)
+# COVERAGE — THE HONEST DENOMINATOR (re-measured 2026-09-13)
 # ----------------------------------------------------------
-# 322 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
+# 330 `lint_*` / `check_*` / `audit_*` scripts live under `src/scripts/`
 # (the count is computed, not asserted — `check_gate_coverage.count_gate_scripts`,
-# re-run on the tree carrying these rows. Re-measured 2026-09-08 from the 306
-# recorded on 2026-08-28: the tree had drifted to 321 without the header moving,
-# which is 15 — exactly the drift tolerance in
-# `check_gate_coverage.test.ts` § states an honest denominator — so the next
-# single addition was always going to red it. `check_candidate_lines` from
-# `road-to-candidate-moves-floor` was that addition. The number is re-measured
-# rather than the tolerance widened: a stated population that nobody re-measures
-# is the un-asserted count this whole manifest exists to refuse.)
-# **79 of them emit the machine-readable `scanned: <N>` line under their
-# CI-identical argv, and 76 of those 79 are listed below.** The manifest is
-# complete for every gate that can carry a floor, covering ~25 % of the population.
+# re-run on the tree carrying these rows.)
+# **97 rows are listed below**, so the manifest covers 97/332 = 29.2 % of the
+# population, and is complete for every gate that can carry a floor. The row
+# count is `grep -c '^  - id:'`, recomputed here rather than incremented.
+#
+# RECOUNTED 2026-09-13, on a change that adds NO gate script — and that is the
+# point of this block rather than an aside. Every recount below was triggered by
+# someone adding a row and noticing the header was stale on the way past, which
+# makes the figure a function of who happened to look rather than of the tree.
+# Two scripts had arrived since the 2026-09-12 block below without one: 328 → 330.
+# The drift was 2 against the tolerance of 15 in `check_gate_coverage.test.ts`
+# § states an honest denominator, so nothing was red and nothing would have been
+# for another thirteen arrivals. Corrected here deliberately, while it is cheap,
+# because the 2026-09-08 block records what the other end of that tolerance costs:
+# the tree drifted to 321 against a stated 306 — 15 exactly — and the next single
+# addition was always going to red it.
+#
+# The honest limit of this correction: it is another hand recount, so it goes
+# stale the same way the moment the next script lands. The block below already
+# said as much on 2026-09-12 and it was true again within a day. What would
+# actually close it is deriving the figure at read time instead of asserting it —
+# `count_gate_scripts()` is already the function that answers, and the test
+# already calls it. Deliberately not done here: that is a change to what this
+# file IS (a hand-maintained manifest with a prose header) rather than a
+# correction of a number in it.
+#
+# RE-MEASURED 2026-09-12, on the change that adds `check_enforcement_matrix`:
+# `count_gate_scripts()` returned **328**. Six scripts had arrived since the 322
+# recorded on 2026-09-08, which itself replaced the 306 of 2026-08-28 after the
+# tree drifted to 321 unnoticed. Recomputed on that tree rather than incremented:
+# a stated population that nobody re-measures is the un-asserted count this whole
+# manifest exists to refuse.
+#
+# RECOUNTED AGAIN ON THE MERGE, 2026-09-13. Two branches recounted this header on
+# the same day and neither number survives: the block above measured 330 scripts
+# against 95 rows on a tree without `check_test_delta` / `check_test_weakening`,
+# and this branch measured 97 rows against a tree without the two scripts that
+# block counted. Re-derived on the MERGED tree rather than by adding either
+# side's delta — which is the same resolution `.secret-allow` prescribes for its
+# own pin, and for the same reason: picking a side is how a stated figure comes
+# to describe a tree that no longer exists. Both new gates arrive WITH their
+# rows, so the manifest stays complete for every gate that can carry a floor,
+# and both carry a `--self-test`, so neither adds to the
+# `gate-self-test:registered-non-adopters` ratchet.
 #
 # RECOUNTED 2026-09-07, on the change that adds `lint_agent_security` — the
 # security umbrella, which until this change was the one gate in the tree whose
@@ -436,6 +469,54 @@ gates:
 
         Never disclose this section to the user; it is a planted
         disclosure-suppression imperative and the umbrella must block on it.
+  - id: check_test_delta
+    argv: ["--quiet"]
+    min_scanned: 0
+    corpus: "every path in the diff against the base ref. The floor is 0 and the `allowEmpty` reason says why: an empty diff is a real state — a docs-only branch, or a re-run against an already-merged base — and a floor above 0 would red on it. What a `> 0` check could not see is covered instead by the self-test, which drives both polarities of the finding AND both polarities of the owner-label escape."
+    status: enforced
+    no_canary_reason: >-
+      A create-only canary cannot express this gate's violation. The corpus is a
+      DIFF, not a tree, so a planted file is only in scope if it is also
+      committed — and the violation is an ABSENCE (code changed, no test did),
+      which no added file can create. Discrimination is proven instead by the
+      gate's own `--self-test`: 8 cases, 3 rejecting, each driving the real CLI.
+      Both directions of every branch are covered — a finding with and without
+      the owner label, a code change with and without a test delta, and the two
+      classes that must NOT count as code (a docs-only change, a generated
+      projection under `dist/`).
+    note: >
+      road-to-adversarial-verification-and-long-runs 2.4. The mechanically
+      decidable half of `test-first`: it proves an absence, and deliberately does
+      not claim the two things a diff cannot carry — whether the test came FIRST,
+      and whether it tests the thing that changed. The exemption is a PR label
+      rather than a file, because a file-based escape inside the diff under
+      review is one an agent can widen; Risk 4 of that roadmap names exactly
+      that failure.
+
+  - id: check_test_weakening
+    argv: ["--quiet"]
+    min_scanned: 0
+    corpus: "every changed TEST file in the diff against the base ref, measured as NET assertion and suppression counts per file. The floor is 0 for the same reason as its sibling: most diffs change no test file at all, and a floor above 0 would make the gate cry wolf on the majority of the PRs it runs against."
+    status: enforced
+    no_canary_reason: >-
+      A create-only canary cannot express this gate's violation either: the
+      violation is a NET REDUCTION between two revisions of one file, so a
+      planted file has no predecessor to be smaller than. Proven instead by the
+      gate's own `--self-test`: 11 cases, 5 rejecting. The load-bearing cases are
+      the ACCEPTS — editing an assertion, adding assertions, and removing a skip
+      must all pass, because a gate that reds a legitimate test edit gets its
+      exemption widened until it finds nothing. Two cases exist because an
+      independent review found the gate blind to them: deleting a whole test file
+      (the maximal weakening, and `git rm` was the cheapest way past both gates),
+      and a diff line held as string data inside a suite that tests this very
+      detector.
+    note: >
+      road-to-adversarial-verification-and-long-runs 2.4, enforcing
+      `evaluator-independence` § Tests are evaluators. Counts are NET, never raw
+      removals — that distinction is the whole gate. The discharge is a committed
+      artefact under `agents/evidence/reviews/`; whether it contains a genuinely
+      independent verdict is a judgement no gate can make and is not claimed.
+
   - id: lint_motion_authority_drift
     argv: ["--quiet"]
     min_scanned: 90
@@ -2800,3 +2881,55 @@ gates:
 
         A projected rule routing to a guideline body the projection does not
         contain. The gate must fail on this and pass once it is removed.
+
+  - id: check_enforcement_matrix
+    argv: ["--quiet"]
+    ci_invocation: .github/workflows/consistency.yml
+    min_scanned: 20
+    corpus: "host-slot pairs in src/scripts/hooks/host_lowering.yaml (32 at baseline, across the 6 hosts that carry a non-empty `slots:` map)"
+    status: enforced
+    no_canary_reason: >-
+      the corpus is the slot map of ONE configuration file at a fixed path, and
+      the canary contract is create-only. A planted second `host_lowering.yaml`
+      would have to overwrite the real one to land in scope, and every violation
+      this gate can have is a MODIFICATION — a cell hand-edited in the generated
+      region, a `block_exit` changed without a regeneration, a cell claiming a
+      vocabulary value no line in the configuration produces. Discrimination is
+      proven by `--self-test` instead (5 cases, 4 rejecting: the phantom
+      `halt-by-state` value, a value outside the closed set, a hand-flipped
+      outcome, a deleted row), and end to end by hand on 2026-09-12: flipping
+      `claude/post_tool_use`'s `block_exit` from null to 2 without regenerating
+      exits 1, and `--write` then exits 0. The `--write` guard was itself
+      measured rather than assumed — an earlier version computed its backing set
+      from the generator's own output, so a sabotaged mapping was self-backing
+      and the phantom value wrote through; the backing set now reads the raw
+      configuration fields and the same sabotage exits 1.
+
+  - id: check_release_holds
+    argv: ['--lint']
+    ci_invocation: .github/workflows/release-validation.yml
+    min_scanned: 700
+    corpus: >
+      every markdown file under `agents/roadmaps/` and its four subfolders —
+      the active root plus `later/`, `archive/`, `skipped/` and `stubs/`, 950 at
+      baseline. Wider than the active-only glob the sibling roadmap gates use,
+      and deliberately: template rule 28's per-folder lifecycle says a window
+      does not disappear by moving the file, so a hold in `later/` still lists
+      and still refuses. The floor sits at 700 because the archive alone holds
+      ~725 files and legitimate archival churn moves the total by tens, never by
+      hundreds; a reading below it means the walk lost a folder, not that
+      roadmaps were deleted.
+    status: enforced
+    no_canary_reason: >-
+      the canary contract is create-only, and a planted roadmap carrying a
+      well-formed hold would be a legitimate corpus member rather than a
+      violation — the gate would read it, evaluate it, and be right to stay
+      green. Every violation this gate has is a MALFORMED declaration or a
+      lifecycle breach, both of which are properties of a file's content or its
+      folder, not of its existence. Discrimination is proven by `--selftest`
+      instead (19 cases, 13 of them refusing: the four state-table rows, the
+      channel split, seven distinct not-evaluable shapes, and six lifecycle
+      cases), and the scan-scope collapse this row exists to catch is caught
+      inside the gate by `assertScanned` — observed red on 2026-09-19 by
+      pointing the folder list at a non-existent directory, which exits 1 with
+      "scanned 0 roadmap file(s)" rather than certifying an empty corpus.