@event4u/agent-config 16.0.0 → 16.1.0

package/dist/agent-src/commands/pr/merge.md

@@ -127,8 +127,8 @@ So the record carries **two** SHAs per PR and they mean different things:
 Before every merge, re-read the PR and refuse when the live head is **neither**
 the snapshot head **nor** the head this run last pushed. That is the
 force-push-after-authorization case, and it is the only one the check exists
-for. A PR that appeared after the snapshot is not in scope for this run — § 6
-says what happens to it.
+for. A PR that appeared after the snapshot is never merged by this run — § 6
+says what happens to it instead.
 
 ## 2. Sync with the base
 
@@ -161,13 +161,44 @@ it now means two humans edited the same policy sentence — read both sides.
 | Evidence files | `agents/evidence/**` | Append-only. Keep both sides. |
 
 ```
-A CONFLICT OUTSIDE THESE FOUR CLASSES HALTS THE RUN.
-IT IS NOT RESOLVED BY JUDGEMENT AND NOT ESCALATED TO A WARNING.
+THE FOUR CLASSES ARE AIDS, NOT EXHAUSTIVE AUTHORITY.
+AN UNENUMERATED CONFLICT IS ROUTED, NOT HALTED — AND NEVER RESOLVED SILENTLY.
+UNDERSTAND BOTH INTENTS → INSPECT RECENCY, AUTHORS AND OPEN PRs →
+PRESERVE BOTH WHERE COMPATIBLE → INDEPENDENT REVIEW FOR A RISKY MERGE →
+COUNCIL OR TEAM → THE OWNER ONLY FOR A PRODUCT-SEMANTIC INCOMPATIBILITY.
 ```
 
-The classes exist so a merge resolution is reproducible by a second reader. An
-unenumerated conflict is a case nobody has decided yet, and deciding it silently
-inside a drain loop is how work disappears.
+The classes exist so a merge resolution is reproducible by a second reader, and
+that is still their job. What changed is what happens when a conflict falls
+outside them: **`road-to-adversarial-verification-and-long-runs` 5.2** replaced
+the halt with the ladder above, because "nobody has decided this yet" describes
+a class of conflict, not a class of thing only an owner may touch. Most
+unenumerated conflicts are two branches editing adjacent prose, and halting a run
+on one converts a two-minute read into an owner interrupt.
+
+Read the ladder as ordered, and note where the owner sits. The first three rungs
+are the agent's own work — **understand what each side was trying to do**,
+**inspect recency, authorship and the open PRs** that produced them, and
+**preserve both where they are compatible**, which most textual conflicts are.
+The fourth and fifth escalate *laterally* — an independent reviewer for a merge
+whose risk the run cannot bound alone, then the council or the team. The owner is
+the **last** rung and is reached on one condition: the two sides encode
+incompatible PRODUCT semantics, where choosing is a decision about what the thing
+should do rather than about how to combine two edits.
+
+```
+A CONFLICT THE RUN CANNOT UNDERSTAND IS NOT AUTOMATICALLY OWNER-OWNED.
+"I DO NOT KNOW WHICH SIDE IS RIGHT" IS A REASON TO ESCALATE INDEPENDENTLY,
+NOT A REASON TO ASK. THE OWNER RUNG IS REACHED BY THE SEMANTIC TEST,
+NEVER BY THE RUN'S OWN UNCERTAINTY.
+```
+
+Deciding it **silently** inside a drain loop is still how work disappears, and
+that prohibition is unchanged: an unenumerated resolution is recorded — which
+rung settled it, what both intents were, and why the chosen resolution preserves
+them — so the second reader the classes exist for can still follow it.
+
+**`process-full`'s halt 6 retires with this**, per that command's own halt table.
 
 ## 4. Superseded check — before any CI is spent
 
@@ -258,11 +289,19 @@ a PR its own predecessor invalidated, because it has no predecessor that
 landed. The cutoff below bounds both forms.
 
 **Cutoff.** When the manifest is exhausted, recompute the open-PR list
-**exactly once**. PRs that appeared during the run are drained as ONE final
+**exactly once**. PRs that appeared during the run are **prepared** as ONE final
 straggler batch. After that batch the run ends unconditionally; anything
 arriving during or after it is recorded as `arrived-after-cutoff` and is not
 processed.
 
+**The straggler batch is prepared and never merged — in both forms.** It is not
+in § 1's manifest, so the invocation does not reach it (the Iron Law above § 1,
+and § 7's first rule). "Drained" is therefore preparation here: each straggler
+is synced, classified, greened and reported, ends at mergeable-and-open exactly
+as under `--no-merge`, and is recorded `unauthorized` with the go-ahead it needs.
+Reading "drained" as "merged" is the one way `all` could merge a PR the owner
+never named, which is why the word is pinned rather than left to context.
+
 ```
 THE CUTOFF IS THE TERMINATION PROOF.
 WITHOUT IT, "THE QUEUE MUST SHRINK" DOES NOT TERMINATE AGAINST A SECOND
@@ -315,6 +354,11 @@ Write the summary as-is with an `unauthorized` disposition per unprocessed PR
 and name the exact authorization needed. Then STOP and wait — do not end the
 run, and do not proceed to the next PR.
 
+That is the same `unauthorized` row § 6's straggler batch carries, and
+deliberately one token rather than two: both mean *prepared by this run, not
+authorized for it to merge*, and a reader of the summary needs the distinction
+between merged and not-merged, not between two reasons for the same outcome.
+
 ## 8. Kill switches, and what happens after a merge
 
 **Armed during preparation, not only before a merge** — otherwise a
@@ -369,7 +413,14 @@ conflict classes hit, CI iterations used, disposition, and any edits dropped in
 conflict resolution. The disposition set is closed:
 
 `merged <sha>` · `superseded-closed` · `blocked-external` · `twice-exhausted` ·
-`window-expired` · `arrived-after-cutoff`
+`unauthorized` · `arrived-after-cutoff`
+
+`unauthorized` replaces `window-expired`, and the swap is one-for-one on
+purpose. `window-expired` named a clock ADR-254 removed on 2026-09-04, so no run
+can produce that row any more, and a closed set holding an unproducible member
+is a set nobody can check a run against. `unauthorized` names what actually
+happens in its place — § 7's pause and § 6's straggler batch, the two ways a PR
+ends this run prepared and unmerged.
 
 ## Rules
 

package/dist/agent-src/commands/roadmap/ai-council.md

@@ -132,7 +132,13 @@ Append a **Host verdict** sub-block under the Council review block in the roadma
 | 4 | <one-line> | `needs-input` | open question — user picks below |
 ```
 
-Then surface a single numbered-options block per [`user-interaction`](../../rules/user-interaction.md), carrying the verdict per option:
+Then, **when the verdict is owed to the owner** — it is owner-owned
+(`product-owned`, `business-owned`, `destructive-owned`) or the council did not
+converge — surface a single numbered-options block per
+[`user-interaction`](../../rules/user-interaction.md), carrying the verdict per
+option. A conclusive **technical** verdict emits no block at all: it is a
+resolution, it is recorded in the roadmap's `## Decisions` table as
+`resolved by: council:<record>`, and the run continues on it (ADR-268 § 10).
 
 > 1. `[accept]` Apply finding 1 — <one-line patch summary>
 > 2. `[accept-with-modification]` Apply finding 2 (modified) — <one-line patch summary + adjustment>

package/dist/agent-src/commands/roadmap/create.md

@@ -1,6 +1,7 @@
 ---
 model_tier: inherit
 name: roadmap-create
+produces_roadmap: true
 pack: product-basic
 visibility: internal
 cluster: roadmap
@@ -23,7 +24,7 @@ packs:
 
 Before anything else, run the plan-confidence gate per
 [`plan-confidence-gate`](../../contexts/execution/plan-confidence-gate.md):
-read `planning.challenge_on_create` (missing = `true`), do the codebase
+read `planning.closure_pass` (missing = `true`), do the codebase
 lookup, and assess the four 95%-conditions against the seed.
 
 - **Confident** (all four hold) → emit the single marker line and continue
@@ -171,6 +172,23 @@ exact honest-null grammar from the contract. Self-review suffices.
 `lint_plan_risk_register` enforces this at pre-push + CI; drafts are
 exempt until flipped to ready.
 
+### 5c. Release-holds self-check (template rule 28) — before save
+
+Ask once: *does any intermediate tree state of this roadmap have to stay
+unpublished?* The default answer is **no**, and a roadmap declaring no hold is
+the normal shape. Roadmap *incompleteness* is never a release condition.
+
+If the answer is yes, walk rule 28's authoring order and stop at the first rung
+that works — **re-sequence → guard → hold**. A hold is the last resort and its
+entry carries a mandatory `Why not a guard:` field.
+
+**Record the outcome either way.** Reaching rung 1 or 2 writes the one-line
+`resequenced:` / `guarded:` note inside the commented `## Release holds` block
+the skeleton emits; reaching rung 3 uncomments the entry. A considered hold that
+was avoided is a counted outcome — see
+[`roadmap-writing § 5b-holds`](../../../../skills/roadmap-writing/SKILL.md).
+Checked by `./scripts-run src/scripts/check_release_holds --lint`.
+
 ### 6. Save the file
 
 - Generate a filename from the title: kebab-case, e.g. `optimize-webhook-jobs.md`.
@@ -234,37 +252,40 @@ Regenerate `agents/roadmaps-progress.md` so the new roadmap shows up:
 
 Mention the new overall count to the user.
 
-### 9. Offer council review (B1 hook, verbosity-gated)
-
-Read `verbosity.offer_council_in_delivery` from `.agent-settings.yml`
-(default `false`):
-
-- `false` (default): skip the prompt silently. When `ai_council.enabled:
-  true` AND at least one member enabled, emit one line: `→ council
-  skipped (set verbosity.offer_council_in_delivery: true to enable, or
-  run /council roadmap:<path> directly)`. Otherwise emit nothing.
-- `true`: when `ai_council.enabled: true` **and** at least one member
-  enabled (`anthropic` or `openai`), ask (in the user's language):
+### 9. Council review — a step, not an offer
 
-  > 1. Run the council on this roadmap before execution? (billable)
-  > 2. Skip council review
+```
+UNDER A MISSION THE COUNCIL IS A STEP. NEVER AN OFFER.
+AVAILABILITY IS `agent-config council:status`. NOTHING ELSE DECIDES IT.
+```
 
-  Also suppress when `personal.autonomy: on` (council is billable; see
-  `road-to-ai-council.md` Decision 3 / Q47).
+The offer that used to sit here was verbosity-gated and suppressed under
+`personal.autonomy: on`, on the stated ground that the council is billable.
+That premise is false: the transport resolves CLI-first
+(`src/scripts/ai_council/transport_resolver.ts`), so the ordinary path spends
+no metered USD, and a question asked to avoid spend that does not happen is a
+cheap question under `no-cheap-questions`. Where an API rung genuinely would
+cross the configured ceiling, the answer is `spend-exhaustion` — pause and
+report (ADR-268 § 8) — never a question either.
 
-If the user picks **1**:
+Run the free availability probe — no API call, no spend, any directory:
 
-- Run `/council roadmap:<path>` with the user's original ask captured
-  in step 1 as `original_ask` (the handoff preamble carries it
-  verbatim, see `scripts/ai_council/prompts.ts`).
-- Append the council findings as a `## Council review (<UTC date>)`
-  section at the bottom of the roadmap. Include the trace path to
-  `agents/runtime/council/sessions/<timestamp>/raw-text.md` so future readers
-  can audit.
-- Do **not** rewrite the roadmap based on the findings — surface them,
-  let the user decide what to act on.
+```bash
+agent-config council:status
+```
 
-If the user picks **2** → continue.
+- **CONFIGURED** → run `/council roadmap:<path>` as a step, carrying the
+  user's original ask from step 1 as `original_ask` (the handoff preamble
+  carries it verbatim, see `scripts/ai_council/prompts.ts`). Append the
+  findings as a `## Council review (<UTC date>)` section at the bottom of the
+  roadmap, inlined with date and members per the council record contract.
+  Do **not** rewrite the roadmap from the findings — surface them; a technical
+  verdict resolves per the ownership table, an owner-owned one becomes a
+  `## Decisions` row.
+- **NOT CONFIGURED** → state the resolver's own message in one line and
+  continue. Never infer this from the project tree: the config is
+  user-global (ADR-104), and the missing-file reflex is the measured failure
+  `council-availability` exists over.
 
 ### 10. Ask the execution mode — ONE question, then write frontmatter
 
@@ -384,3 +405,29 @@ Failure modes covered by this hard stop:
 - Follow the roadmap template from `.augment/templates/roadmaps.md`; write in English (project convention).
 - Keep the file focused: 500–1000 lines max. If larger, suggest splitting.
 - **Never overwrite an existing roadmap.** Step 6 scans `active/`, `archive/`, `skipped/` (+ subdirs); on collision → STOP, present rename / open / abort. Auto-suffix requires explicit pick.
+
+## Closure — the last step, always
+
+```
+THIS COMMAND PRODUCES A ROADMAP, SO IT ENDS IN CLOSURE.
+NEVER HAND BACK A PLAN CARRYING A DECISION PLANNING COULD HAVE CLOSED.
+```
+
+Declared by `produces_roadmap: true` in the frontmatter and enforced by
+`lint_roadmap_producers`: a producer that does not end here reds CI.
+
+Read `planning.closure_pass` (missing = `true`). When active, run
+[`/challenge-me closure`](../../../meta/challenge-me/closure/command.md) on the
+roadmap this command just produced, before handing back:
+
+```bash
+./scripts-run src/scripts/closure_scan <roadmap-path>
+```
+
+Every detected decision is resolved at the lowest rung that owns it and written
+into the roadmap's `## Decisions` table. Owner-owned residue is asked **now**,
+one question per turn, and its answer recorded — never handed back as *"the
+open questions are in the file"*.
+
+An explicit *just write it* drops the pass and is recorded as a **bypass** on
+its own axis, never as an absent closure. A mission grant is not a bypass.

package/dist/agent-src/commands/roadmap/materialize.md

@@ -1,6 +1,7 @@
 ---
 model_tier: high
 name: roadmap-materialize
+produces_roadmap: true
 pack: product-basic
 visibility: internal
 cluster: roadmap
@@ -70,3 +71,29 @@ pastes a ticket into Linear/Jira (or creates it via MCP), or runs a per-ticket b
 - **Do NOT commit or push.**
 - Bundle is the source of truth; the tracker is a projection
   ([`ticket-bundle-format`](../../docs/contracts/ticket-bundle-format.md)).
+
+## Closure — the last step, always
+
+```
+THIS COMMAND PRODUCES A ROADMAP, SO IT ENDS IN CLOSURE.
+NEVER HAND BACK A PLAN CARRYING A DECISION PLANNING COULD HAVE CLOSED.
+```
+
+Declared by `produces_roadmap: true` in the frontmatter and enforced by
+`lint_roadmap_producers`: a producer that does not end here reds CI.
+
+Read `planning.closure_pass` (missing = `true`). When active, run
+[`/challenge-me closure`](../../../meta/challenge-me/closure/command.md) on the
+roadmap this command just produced, before handing back:
+
+```bash
+./scripts-run src/scripts/closure_scan <roadmap-path>
+```
+
+Every detected decision is resolved at the lowest rung that owns it and written
+into the roadmap's `## Decisions` table. Owner-owned residue is asked **now**,
+one question per turn, and its answer recorded — never handed back as *"the
+open questions are in the file"*.
+
+An explicit *just write it* drops the pass and is recorded as a **bypass** on
+its own axis, never as an absent closure. A mission grant is not a bypass.

package/dist/agent-src/commands/roadmap/process-full.md

@@ -153,6 +153,46 @@ waiting on that remote CI is part of the run per the Iron Law below. It is
 the whole of what this command delivers: there is no flag that carries it
 further, and § Merging below says why.
 
+### The six required layers, in order, each with the command that runs it
+
+`road-to-adversarial-verification-and-long-runs` 3.1. Correctness is owned by the
+forge and CI, not by an owner reading a diff — so the layers are named, ordered,
+and each one carries the command that produces its verdict. A layer with no
+command is a claim; a layer with one is a check.
+
+| # | Layer | Command that runs it |
+|---|---|---|
+| 1 | A targeted local RED, then GREEN | the test runner filtered to the failing name — `npm run test:ts -- <file>`, never the suite |
+| 2 | Quality scoped to the changed surface | the type-checker and linter over the diff — `npm run typecheck`, the linter on changed files |
+| 3 | Per-phase fast CI | `roadmap.quality_cadence: per_phase` (Phase 0.2) at each phase boundary |
+| 4 | The final full required CI | `./scripts-run src/scripts/ci_settle <PR> --timeout 1700` — its LAST OUTPUT LINE is the verdict |
+| 5 | Forge branch protection | `agent-config doctor --json` → `forge_protection` (Phase 3.2), read from the forge |
+| 6 | Final-head verification | `ci_settle`'s verdict line names the head; it must be the head that was pushed last |
+
+**Layer 1 before layer 2 before layer 3, and the order is the substance.** Each
+layer is cheaper and narrower than the one after it, so running them out of order
+spends the expensive verdict on a failure the cheap one would have named. A run
+that reaches layer 4 with layer 1 unrun has not saved a step; it has moved the
+same failure to where it costs a CI cycle.
+
+```
+CI REJECTS: A SKIPPED OR DISABLED REQUIRED CHECK · UNRESOLVED GENERATED DRIFT ·
+POLICY-PROJECTION DRIFT · A STALE-HEAD MERGE · A CONFLICT RESOLUTION THAT WAS
+NOT REVALIDATED.
+CI NEVER REQUIRES A HUMAN APPROVAL MERELY BECAUSE A CHANGE IS LARGE.
+```
+
+That last line is not a courtesy. Size is the one property of a diff that
+correlates with nothing a reviewer can check mechanically, and gating on it is
+how *ask the owner* re-enters through a door marked prudence — which is the loop
+ADR-268 § 0 is trying to end. Gate on the five conditions above, which are
+falsifiable, and never on how big the change looks.
+
+**A disabled required check cannot reach delivery-ready**, and that is the
+condition to test rather than assert: a PR whose required context is skipped has
+a green rollup and an unenforced gate, so a delivery-ready test that reads only
+the rollup passes exactly when it should fail.
+
 ### Merging — out of scope, cancelled rather than deferred
 
 ```
@@ -219,7 +259,7 @@ RUNNING" IS NOT A BOUNDARY, NOT A HALT, AND NOT A REPORT — THE RUN ENDS
 AT A MERGEABLE PR, NEVER AT AN OFFER TO GO CHECK ON ONE.
 ```
 
-The **six — and only six — halt conditions** (exhaustive; nothing else
+The **five — and only five — live halt conditions** (exhaustive; nothing else
 stops the run):
 
 1. **Hard-Floor** trigger ([`non-destructive-by-default`](../../rules/non-destructive-by-default.md)).
@@ -227,13 +267,21 @@ stops the run):
 3. **Security-sensitive** surface reached.
 4. **Scope-out-of-roadmap** work discovered.
 5. **Test / quality red** that cannot be cleared within the N=3 budget.
-6. **A merge conflict outside the four enumerated classes** of
-   [`/pr:merge` § 3](../../../git/pr/merge/command.md), during the delivery
-   loop. Added when delivery became unconditional: the loop runs on every
-   completed run, `--all` or not, so its stop is a stop of this command and
-   calling it "a kill switch rather than a halt reason" would not change that —
-   a run that stops has stopped. It fires only where a run reaches delivery,
-   which is the one thing that distinguishes it from the five above.
+6. **RETIRED 2026-09-13** by `road-to-adversarial-verification-and-long-runs`
+   5.2. This read *a merge conflict outside the four enumerated classes of
+   [`/pr:merge` § 3](../../../git/pr/merge/command.md)*. That section now ROUTES
+   an unenumerated conflict — understand both intents, inspect recency and
+   authorship, preserve both where compatible, independent review, council or
+   team, and the owner **only** for a product-semantic incompatibility — so
+   there is no longer a conflict class whose arrival ends a run. Numbered rather
+   than renumbered: the list is cited by index from several places, and silently
+   shifting five conditions up one is how a citation comes to name a different
+   halt. **Five live halt conditions, not six.**
+
+   What did NOT change: an unenumerated conflict may still never be resolved
+   silently. The ladder's own record — which rung settled it, both intents, why
+   the resolution preserves them — is the replacement for the stop, and the
+   reason the stop could be removed at all.
 
 **Under `--all`, which of these end the roadmap and which end the loop.** Two
 of the five are safety floors and they end the **whole run**, not the current
@@ -246,7 +294,7 @@ roadmap:
 | 2. Council-off + genuine ambiguity | Ends the roadmap; the loop records it and continues. |
 | 4. Scope-out-of-roadmap work | Ends the roadmap; the loop records it and continues. |
 | 5. Test / quality red past N=3 | Ends the roadmap; the loop records it and continues. |
-| 6. Unenumerated merge conflict in delivery | Ends the roadmap; the loop records it and continues. |
+| ~~6. Unenumerated merge conflict in delivery~~ | **RETIRED** — `/pr:merge` § 3 routes it instead of stopping. |
 
 **And the conditions that end the loop without ending a roadmap:**
 estate-queue exhaustion (always), a
@@ -257,8 +305,9 @@ authorization-window expiry — which is **unreachable in this command**,
 because it never performs a `BLOCK_OPS` operation for the window to govern. Three conditions, one of them currently inert, and this
 table is the only place the set is stated.
 
-Nothing here widens a run without `--all`: it still has exactly the six
-above, all of them ending the run because there is no loop to continue.
+Nothing here widens a run without `--all`: it still has exactly the five live
+conditions above, all of them ending the run because there is no loop to
+continue.
 
 ```
 FORBIDDEN NON-HALT REASONS — NEVER STOP THE RUN FOR ANY OF THESE:
@@ -272,12 +321,13 @@ FORBIDDEN NON-HALT REASONS — NEVER STOP THE RUN FOR ANY OF THESE:
   · "the branch is not protected" / "a branch must be created"
   · "a PR must be opened" / "a GitHub setting must change"
   · "CI must be re-run" / "the merge base needs updating" / "there are
-    conflicts" — resolving these IS the work. The one exception, and it is a
-    kill switch rather than a halt reason: a conflict **outside** the four
-    enumerated classes of [`/pr:merge` § 3](../../../git/pr/merge/command.md)
-    stops the delivery loop, because that is a case nobody has decided yet and
-    deciding it silently is how work disappears. An enumerated conflict is
-    never a stop.
+    conflicts" — resolving these IS the work, and since 2026-09-13 that holds
+    for an UNENUMERATED conflict too: [`/pr:merge` § 3](../../../git/pr/merge/command.md)
+    routes it (understand both intents → recency and authorship → preserve both
+    where compatible → independent review → council or team → the owner only for
+    a product-semantic incompatibility) instead of stopping. The prohibition that
+    survives is on resolving one SILENTLY: the rung that settled it, both
+    intents, and why the resolution preserves them are recorded.
   · "a paid service is needed" — authorised under the ceiling below
   · "a maintainer should do this" when the agent can perform the same action
   · any agent-invented caution not in the five halt conditions above.
@@ -313,9 +363,64 @@ branch setting, push, open a PR, re-run CI, update a merge base, fix a failing
 test, authorise spend inside a budget — is machine-executable by the agent, and
 is therefore remediation work rather than a blocker.
 
+### `complete` requires DELIVERY, not only checkboxes
+
+```
+A RUN WHOSE CHECKBOXES READ COMPLETE AND WHOSE PR SITS ON RED CI OR ON A
+MOVED TARGET HAS NOT COMPLETED. CHECKBOXES ARE ONE COMPLETION; DELIVERY IS
+THE OTHER, AND ONLY TWO POSITIONS END A RUN: `merged` AND `open-green`.
+```
+
+`road-to-adversarial-verification-and-long-runs` 8.1. The delivery machine is
+`working → local-green → pushed → pr-open → ci-pending → (red → the recovery
+ladder → pushed | green) → target-sync-check → (moved → sync → tests → pushed |
+current) → delivery-ready → (grant → merged | no grant → open-green)`.
+
+`run_continuation_hook` reads the position the run RECORDED — it does not probe
+the forge, because a `gh` call on the stop path is the cost the premise rung
+already declined — and any position that is not an ending keeps the run engaged
+at zero open steps. Two bounds survive that hold, and one is deliberately lifted:
+the iteration and wall-clock caps still end it, while the **stall** rung is
+skipped, because during delivery the open-step count it measures cannot move and
+a metric that cannot move is not a stall signal. A run that recorded no position
+decides exactly as it did before.
+
+```
+THE CONSUMER IS LIVE. NO PRODUCER SHIPS YET — NOTHING WRITES `delivery` INTO
+THE RUN-STATE FILE, SO ON EVERY RUN TODAY THE POSITION IS ABSENT AND THE HOLD
+DOES NOT FIRE. READ THE PARAGRAPH ABOVE AS THE CONTRACT, NOT AS BEHAVIOR YOU
+WILL OBSERVE.
+```
+
+Said in a fence because the surrounding prose reads as a description of live
+behavior and an independent review of the change that introduced it read it
+exactly that way. The ladder, the round-trip and the ledger field are built,
+tested and correct for any recorded value; what is missing is the step that
+records one, and a run that wants the hold must write the position itself until
+that lands.
+
+**`open-green` is a success, not a shortfall.** A run with no merge grant is not
+supposed to merge; what it owes is an open PR whose CI is green **on the head CI
+actually observed**, and a report that says so.
+
+### The PR body is one page for the owner's review
+
+8.2. The end-of-run PR body carries these six, each as its own named section:
+
+1. **Delivery target reached** — `merged` or `open-green`, and the head SHA CI observed.
+2. **Decisions taken, and by whom** — agent, council, team or owner, per decision.
+3. **Open owner-owned residue** — what is left that only the owner can settle, or *none*.
+4. **Scope delta** — what the run added to or dropped from the roadmap's stated scope.
+5. **Spend** — actual against the authorised ceiling.
+6. **Fix-loop epochs** — how many strategies were opened, and what ended each.
+
+Six sections because each answers a different question the owner would otherwise
+have to ask, and a run that omits one has moved that question back into the
+conversation this roadmap exists to end.
+
 | Outcome | When | Success? | terminal state |
 |---|---|---|---|
-| `complete` | `count_open == 0` and the PR is open | yes — archival check runs | `success` |
+| `complete` | `count_open == 0`, the PR is open, and delivery reached an ending | yes — archival check runs | `success` |
 | `blocked` | every remaining open step is **externally impossible** for the agent | **no** — partial progress, labelled as such | `blocked`, or `approval-required` where the work is finished and waiting on a human |
 | a halt | one of the five conditions fired | **no** — the halt is reported | `exhausted` when a declared budget ran out; `stagnated` when the same failure signature repeated with budget left |
 

package/dist/agent-src/commands/team.md

@@ -130,6 +130,28 @@ control, no background jobs, no delegate write path; the capability delta
 vs. the native plugin is stated in the output. When the codex CLI itself is
 absent, the same fail-closed principle applies: state it plainly and stop.
 
+## Records — the same shape and the same place as a council record
+
+```
+A TEAM VERDICT IS RECORDED THE WAY A COUNCIL VERDICT IS. NO SECOND FORMAT.
+THE OPTIONS BLOCK IS CONDITIONAL ON OWNERSHIP HERE TOO.
+```
+
+A team run produces the same seven fields a council record carries — question,
+evidence, member positions, convergence, verdict, confidence, revisit
+condition — and lives in the same place: the dev-time artifact under
+`agents/runtime/` (gitignored, pruned on the configured retention window), and
+the **durable** record inlined into the artifact the decision serves, with date
+and members. Never a link to the scratch file; it is not in a clone.
+
+Where the decision closes a roadmap question, the durable record is one
+`## Decisions` row with `resolved by: team:<record>`.
+
+The options block follows the same ownership condition as a council record: a
+conclusive **technical** verdict emits none, an owner-owned or non-convergent
+one carries the proposal the owner confirms. Both directions are checkable —
+`./scripts-run src/scripts/council_record_shape <record.md>`.
+
 ## No-claims note
 
 The review-lift value of cross-model team review is **unproven** until the

package/dist/agent-src/contexts/authority/scope-growth-ownership.md

@@ -0,0 +1,80 @@
+# Scope Growth — Ownership
+
+Loaded from [`scope-mechanics`](scope-mechanics.md). The size question — *is
+this small and aligned enough to do now* — is the remediation ladder's. This is
+the other axis, *whose decision is it*, and a change must clear BOTH to be done
+inline: something small and council-owned is still not the agent's to decide,
+and something agent-owned and large is still bounded by the smallest-diff rule.
+
+```
+SCOPE GROWTH DISCOVERED MID-MISSION IS ROUTED BY WHO OWNS IT, NOT BY HOW BIG
+IT LOOKS. THE THREE LISTS BELOW ARE CLOSED. GROWTH THAT MATCHES THE FIRST IS
+DONE AND RECORDED AS A SCOPE DELTA — IT IS NEVER ASKED ABOUT.
+GROWTH THAT MATCHES NEITHER OF THE FIRST TWO IS NOT SCOPE GROWTH AT ALL:
+IT IS A FOLLOW-UP ARTIFACT, AND THE MISSION DOES NOT EXPAND TO HOLD IT.
+```
+
+`active-remediation`'s ladder answers *how big is this and is it aligned*.
+This answers the other axis — *whose decision is it* — and the two run
+together: a change must clear BOTH to be done inline. Something small and
+council-owned is still not the agent's to decide; something agent-owned and
+large is still bounded by `minimal-safe-diff`.
+
+### Agent-owned growth — done, recorded, never asked about
+
+Six kinds, and the list is closed:
+
+1. **A necessary internal refactor** — the change cannot land correctly
+   without it, and it changes no public surface.
+2. **A missing test** on a path this change touched.
+3. **A regression on a touched path** — the change surfaced it, so the change
+   owns it.
+4. **A small dependency adjustment** inside the existing major, no new
+   dependency.
+5. **A local API change inside already-defined semantics** — the contract does
+   not move, only its implementation.
+6. **A Boy-Scout cleanup** that is ALL of: small, local, low blast radius,
+   testable, and carrying no new product decision. Any one of the five
+   missing and it is not this row.
+
+Each is **recorded as a scope delta in the PR body** — one line naming what
+grew and why it was the agent's. The record is what makes the autonomy
+reviewable afterwards, which is the condition under which it is legitimate at
+all; growth done and not recorded is indistinguishable from scope creep.
+
+### Council-owned growth — resolved by the council, still not asked of the owner
+
+Four kinds:
+
+1. **A larger internal re-cut** — the shape of the change, not its size.
+2. **Two equal technical strategies** with no evidence between them.
+3. **A risky compatibility design** — a technical risk, which is still
+   technical.
+4. **An unclear boundary carrying no new product semantics.**
+
+These route through the ownership ladder — independent session → council →
+team — and the verdict becomes a `## Decisions` row. None of them reaches the
+owner, however consequential: a technical decision does not become owner-owned
+because it is hard.
+
+### Owner-owned growth — the only rows that reach a person
+
+Two, and only two:
+
+1. **The work changes what the product or the business does.** New
+   user-visible semantics, a commitment, a price, a policy.
+2. **It needs a typed op** — an operation from ADR-260's eleven-op vocabulary
+   for which no grant exists.
+
+### Everything else is a follow-up artifact
+
+A larger unrelated opportunity — a refactor the mission did not touch, a
+subsystem that deserves attention, a debt the change merely passed — does
+**not** expand the mission. It becomes a follow-up artifact (a roadmap under
+`agents/roadmaps/`, per `active-remediation`'s third tier), named in the PR
+body, and the mission delivers what it was given.
+
+The failure this prevents is the one that looks like diligence: a mission that
+absorbs every good idea it meets delivers none of them, and the PR that
+carries it cannot be reviewed against anything.
+

package/dist/agent-src/contexts/communication/rules-auto/user-interaction-mechanics.md

@@ -252,3 +252,50 @@ block and the closing reply carries none. It sees one user turn on one host,
 so everything outside that is model-carried, exactly like Iron Law 2's own
 "no gate ships for this" note. `check_reply_consistency` reads a single draft
 and holds no cross-turn state; it cannot see this law at all.
+
+## The native ask — per host, and what it changes
+
+> **Why this is here and not in the rule.** `user-interaction` is a
+> project-scope rule, so its every byte is re-written into the preamble on
+> **every subagent spawn**, and `check_preamble_payload_budget` is a measured
+> ratchet with no headroom — a four-line addition to the rule measured +219
+> tokens per spawn and failed it. The rule's own § Mechanics already routes
+> "everything you look up rather than obey" here, and the ask SHAPE is lookup
+> material: Iron Law 1 governs the recommendation identically on both shapes,
+> so the rule needed no new obligation, only this contract to point at.
+
+`ask: native | text` is declared per host in `src/scripts/hook_manifest.yaml`
+and printed by `agent-config hooks:status`. It is **declared, not probed**: the
+row records what the host's documented tool surface offers. A host declaring
+`native` whose primitive turns out to be absent degrades to the text block —
+the same question, the same content — so a wrong row costs a missed upgrade and
+never a broken ask. Absent reads `text`.
+
+| Shape | What the ask is | Where the recommendation lives |
+|---|---|---|
+| `native` | the host's structured-ask tool call | the **default option** of the native ask |
+| `text` | the numbered block, per Iron Law 1 | the `Recommendation:` / `Empfehlung:` line directly under the block |
+
+Four obligations hold on both shapes, and three of them are why the native
+form is preferred rather than merely available:
+
+1. **One decision point per turn.** A native ask presenting several unrelated
+   questions is the same violation as several text blocks. One number — or one
+   selection — answers it, or it is two asks.
+2. **Every option says what changes by answering it.** Not the option's name
+   again: the consequence. A native ask makes this structural, because an
+   option carries a description field the text form leaves to discipline.
+3. **The recommendation has exactly ONE source.** On a native ask that source
+   is the default option; naming it a second time in the prose above is the
+   drift Iron Law 1 exists to make structurally impossible.
+4. **The answer is recorded before the next step runs.** Where the ask came out
+   of a plan-closure pass, it becomes a `## Decisions` row — id, ownership,
+   `resolved by: owner`, the decision, its evidence, its `revisit if`. An
+   answer that lives only in the transcript is re-derived after the next
+   context reset, which is the repeat the ask census counts as a defect.
+
+**What the native shape does NOT change.** It is not a license to ask more: the
+one-question-per-turn floor, the no-cheap-questions floor and the ownership
+routing all run first, and a question that should not have been asked is not
+improved by a better widget. Nor does it change who may be asked — a technical
+decision does not reach the owner on any host.