@event4u/agent-config 8.10.0 → 8.12.0

package/docs/decisions/ADR-092-defer-command-tier-alias-removal.md

@@ -29,13 +29,16 @@ question with the Phase-3 investigation evidence.
 Investigation findings (`road-to-metadata-and-command-surface-leanness`, Phase 3):
 
 - **Integer-`tier` readers are internal:** `src/cli/commands/commands.ts`
-  (fallback after `visibility`), `src/scripts/audit_command_surface.py`
-  (report column + budget fallback), `src/scripts/build_discovery_manifest.py`
-  (**dual-emits `tier`** into the manifest). `src/cli/python/workspace_hosts.py`
+  (fallback after `visibility`), `src/scripts/audit_command_surface.ts`
+  (report column + budget fallback), `src/scripts/build_discovery_manifest.ts`
+  (**dual-emits `tier`** into the manifest). `src/cli/python/workspace_hosts.ts`
   uses a semantically unrelated host-inventory tier.
+  <!-- paths updated 2026-07-12: every reader migrated to TS during the
+  completed ADR-200 py2ts migration; the original .py list is preserved in
+  git history. -->
 - **The discovery manifest is a published npm artifact** — `package.json`
   `files` + `build:discovery` in `prepack` + `prepublishOnly:
-  check_release_includes_discovery.py`. It dual-emits the integer `tier`.
+  check_release_includes_discovery.ts`. It dual-emits the integer `tier`.
   **External npm consumers that read the integer key are unknown.**
 - The defer rests on a **Runtime Risk that cannot be ruled out** (a consumer
   may register/branch on the integer `tier`), not on evidence that such a
@@ -75,7 +78,7 @@ forcing function so it cannot calcify into permanent debt:
 ## Consequences
 
 - The `tier:` ⇄ `visibility:` dual-field persists during the deferral;
-  drift is mitigated by the `lint_command_tiers.py` consistency check (when
+  drift is mitigated by the `lint_command_tiers.ts` consistency check (when
   both present, they must agree).
 - The removal is **cheaply reversible** if ever executed: restoring the `tier`
   field is a manifest schema patch (< 1h to publish), far below the rollback
@@ -84,6 +87,27 @@ forcing function so it cannot calcify into permanent debt:
 - `road-to-tier-removal.md` institutionalises the trigger so the defer stays
   visible in planning rather than becoming folklore.
 
+## Addendum (2026-07-12) — re-open mechanism mid-flight
+
+Recorded during `road-to-opt-decision-flips` Phase 2; not a re-litigation —
+this ADR's own forcing function is executing:
+
+- **All integer-`tier` readers are now TypeScript** (ADR-200 migration landed
+  on `main`; the reader list above updated in place).
+- **Re-open mechanism #1 shipped:** `build_discovery_manifest.ts` emits the
+  machine-readable `deprecations` block + `sunset` field announcing the
+  `tier` deprecation (road-to-tier-removal Phase 1). Verified in the
+  **released** artifact: npm `8.10.0` (published 2026-07-10) ships
+  `dist/discovery/discovery-manifest.json` with
+  `deprecations[0] = {key: tier, replacement: visibility, since: ADR-092,
+  sunset: null}`.
+- **Soak status:** the soak clock runs since publish; zero tier-related
+  breakage reports (issue sweep 2026-07-12). The unknown-external-consumer
+  hard stop is NOT lifted by the notice alone — the soak must elapse.
+- **Execution continues in `road-to-tier-removal.md`**, revived from
+  `later/` to active on 2026-07-12 with the soak evidence cited in its
+  banner (portfolio-consolidation Phase 2).
+
 ## References
 
 - [ADR-090](ADR-090-visibility-command-frontmatter-field.md) — the deferred

package/docs/decisions/ADR-093-ai-council-config-user-global.md

@@ -1,6 +1,6 @@
 ---
 adr: 093
-status: accepted
+status: superseded
 date: 2026-06-13
 decision: ai-council-config-user-global
 supersedes: —

package/docs/decisions/ADR-100-global-knowledge-card-sharing.md

@@ -11,6 +11,13 @@ type: structural
 
 # ADR-100 — Global cross-project knowledge-card sharing
 
+> **Partial supersession (clarified 2026-07-12):** this ADR supersedes
+> ADR-098 **Decision-10 only** (the measure-then-decide gate for the
+> global layer); every other ADR-098 decision stands. The frontmatter
+> `supersedes:` field carries the bare number because the index
+> link-checker validates it; this note is the qualifier's home.
+
+
 ## Status
 
 Accepted (2026-06-15). Council-designed (claude-sonnet-4-5 + gpt-4o, design

package/docs/decisions/ADR-103-global-knowledge-default-off-until-measured.md

@@ -1,10 +1,10 @@
 ---
 adr: 103
-status: accepted
+status: superseded
 date: 2026-06-16
 decision: global-knowledge-default-off-until-measured
 supersedes: —
-superseded_by: —
+superseded_by: 119
 phase: evidence-v2
 type: structural
 ---

package/docs/decisions/ADR-105-automatic-subagent-orchestration.md

@@ -4,7 +4,7 @@ status: accepted
 date: 2026-06-23
 decision: automatic-subagent-orchestration
 supersedes: —
-superseded_by: —
+superseded_by: — (Decision 2 amended by ADR-117: shipped default ask → on)
 phase: auto-subagent-orchestration
 type: structural
 ---

package/docs/decisions/ADR-114-commit-policy-iron-law-override.md

@@ -1,3 +1,14 @@
+---
+adr: 114
+status: accepted
+date: 2026-07-08
+decision: commit-policy-iron-law-override
+supersedes: —
+superseded_by: —
+phase: kernel-budget overrides (extends ADR-002)
+type: structural
+---
+
 # ADR-114 — commit-policy Iron-Law Override (per-rule cap 2.5k → ceiling 4.0k)
 
 - **Status:** Accepted (2026-07-08)

package/docs/decisions/ADR-116-memory-tripwire-activation-path.md

@@ -5,11 +5,21 @@ date: 2026-07-08
 decision: memory-tripwire-activation-path
 supersedes: —
 superseded_by: —
-phase: road-to-memory-retrieval-economy · Phase 6
+phase: road-to-memory-retrieval-economy · Phase 6 (amended — see 2026-07-12 note)
 ---
 
 # ADR-116 — Memory scale-tripwire activation path: one engine, measured at fire time
 
+> **Amended in practice (recorded 2026-07-12):** the SQLite-FTS5 engine
+> this ADR pre-decided was never built. The activation path was
+> re-resolved by road-to-retrieval-substrate-hardening B2 (done
+> 2026-07-09): a hand-rolled stdlib BM25 + trigram prefilter in
+> `src/scripts/_lib/lexical_index.ts` (no SQLite, ADR-061 honoured),
+> dormant until the `lint_knowledge_scale` tripwire fires (200/type,
+> 500 total). The tripwire thresholds and measurement-at-activation
+> discipline of this ADR stand unchanged; only the engine choice moved.
+
+
 - **Deciders:** maintainer + AI council (anthropic/claude-sonnet-4-5 +
   openai/gpt-4o; disposition debate 2 rounds + engine tie-break 2 rounds,
   2026-07-08 — tie-break converged after the in-repo `node:sqlite`

package/docs/decisions/ADR-117-subagents-auto-default-on.md

@@ -3,10 +3,11 @@ adr: 117
 status: accepted
 date: 2026-07-09
 decision: subagents-auto-default-on
-supersedes: 105
+supersedes: —
 superseded_by: —
 phase: auto-subagent-orchestration
 type: structural
+amends: 105 (Decision 2 only — the shipped default; the contract itself stands)
 ---
 
 # ADR-117 — Flip `subagents.auto` shipped default to `on` (host-gated) on bounded-downside re-evaluation

package/docs/decisions/ADR-118-loop-engineering-boundaries.md

@@ -0,0 +1,162 @@
+---
+adr: 118
+status: accepted
+date: 2026-07-10
+decision: loop-engineering-boundaries
+supersedes: —
+superseded_by: —
+phase: loop-engineering
+type: structural
+---
+
+# ADR-118 — Loop-engineering boundaries: one closure, four rejections, three deferrals, zero new loop surfaces
+
+## Status
+
+**Accepted** · 2026-07-10. Resolved by web research (five external articles + an
+independent sweep) ground-truthed against the repo's loop inventory, plus an
+AI-council debate (anthropic/claude-sonnet-4-5 + openai/gpt-4o, 2 rounds,
+2026-07-10, converged). Executed by `road-to-loop-engineering`.
+
+## Context
+
+The June-2026 "loop engineering" wave (design the system that prompts the
+agent: verification signal, budget shape, maker/checker topology, on-disk
+state) is mostly a rebranding of ReAct + eval-driven development + bounded
+autonomous agents. Its two durable contributions are the design vocabulary and
+a precise failure-mode taxonomy: verification collapse ("done" is a claim, not
+proof), comprehension debt, cognitive surrender, reward hacking (measured at
+~15% of SE-task runs in one external evaluation), cost blowup on stuck retry
+loops, context rot on long runs.
+
+This package already implements the serious end of that canon: bounded
+verify-fix loops (`verify-repair-loop` max_attempts=3, the N=3 validation
+budget, context-hygiene 15/25 aborts), maker/checker separation (`judge-*`
+cluster, `verify-budget`), human-gated self-improvement (5-stage pipeline,
+≥2 independent evidence), and measurement infrastructure (bench:ab, trigger
+evals, golden sets, orchestration telemetry, local analytics).
+
+An inventory identified 8 places where a measure exists but no adjust-step is
+wired. The question this ADR settles: which of those loops to close, and which
+loop-shaped proposals to reject so they are not relitigated per hype cycle.
+
+Constraint frame: single maintainer, token-frugality canon, no runtime daemon
+(ADR-088 / no-runtime-boundary), human gates on anything irreversible. Under
+these constraints, when human review + `git revert` is cheaper than designing,
+maintaining, and debugging a closed loop, the loop is net-negative
+infrastructure — false positives consume the binding resource (maintainer
+attention), not compute.
+
+## Decision
+
+### 1. Automation threshold (the core principle)
+
+Automate a measure→adjust loop **only** when all three hold:
+
+1. the metric is a **direct** measure of the failure mode (not a proxy or a
+   correlation),
+2. the expected false-positive rate is low (order <5%), and
+3. human judgment adds no unique information to the adjust decision.
+
+"A number exists" is not "the number is trustworthy" (metric-existence
+fallacy). Reversibility of the adjust-step alone never justifies automation:
+investigating one false-positive automated action costs 20–45 minutes of
+maintainer time against a 10-second revert.
+
+### 2. Disposition of the 8 open loops
+
+| # | Open loop | Disposition |
+|---|---|---|
+| 1 | Orchestration telemetry → `subagents.auto` demotion | **Manual by decision.** token_delta spikes for legitimate reasons; demotion needs qualitative judgment of the failure mode. The demotion path in `orchestration-benchmark-gate.md` stays a human one-line edit. |
+| 2 | Artifact-engagement counts → skill pruning | **Never automated.** Selection bias both ways (low engagement ≠ low value: security / error-recovery / niche skills; high engagement ≠ high value). Engagement stays ONE input under `evidence-based-pruning`'s ≥2-independent-evidence floor; the pruning decision is always human. |
+| 3 | Trigger-eval pass rate on cadence | **Closed** — the only closure. Structure/freshness/presence gates already ran in `task ci`; this ADR's roadmap adds a rotating live pass-rate measurement to the existing weekly canary (see §4). Direct metric, low false-positive, adjust-step = surfaced report. |
+| 4 | bench-drift → blocking gate | **Stays advisory.** High false-positive proxy (timing variance, intentional behaviour changes); the manual `bench:baseline-ready` flip remains the enforcement gate. |
+| 5 | Golden-set coverage ratchet (14/91 rules) | **Deferred; growth stays opportunistic.** A hard per-rule ratchet pressures toward mechanically-testable rules over useful rules; most uncovered rules are judgment-shaped. `road-to-golden-set-coverage` remains the deliberate path. |
+| 6 | Live-app verdict source | **Deferred, unchanged** — owned by `road-to-live-app-verdict`; the package ships config, not apps. |
+| 7 | Measured rule-adherence signal | **Rejected.** Annotated-corpus + threshold-tuning build with ongoing maintenance for marginally earlier restatement; ADR-054's coarse heuristics are intentional. |
+| 8 | Success-signal re-evaluation at eval date | **Not automated.** Retroactive evaluation of sunk promotion decisions has low marginal information; active use surfaces bad promotions. The field stays authored documentation. |
+
+### 3. Five written rejections (loop anti-patterns for this package)
+
+1. **Open-ended hill-climbing on the config.** No loop may "optimize"
+   rules/skills via iterated mutation + metric without a human checkpoint per
+   iteration; the bench:ab soak + human decision is the floor for config
+   change evaluation.
+2. **Autonomous config self-editing.** The self-improvement pipeline stays
+   human-gated at every stage; no loop commits changes to `src/skills/` or
+   `src/rules/` without human approval. (Restates the existing pipeline
+   contract as a loop boundary.)
+3. **Unattended multi-hour runs without checkpoints.** Loops must remain
+   reviewable/haltable on the maintainer's schedule; the existing halt
+   conditions and N=3 budgets are the ceiling, not a starting point.
+4. **Metric-optimizing loops without golden-set anchoring.** No loop whose
+   success criterion is "metric goes up" without a golden-set eval anchoring
+   what "good" means (Goodhart guard).
+5. **Cross-session loop state in external services.** No vector DBs, job
+   queues, or external orchestrators as loop state (restates ADR-088 in loop
+   context): state lives in git-tracked files + the conversation.
+
+Also rejected, same reasoning tier: a **loop-design contract/checklist
+artifact** (premature formalization — the caps/judges/state patterns are
+embedded in the existing loop surfaces and enforced by existing rules) and
+**consumer-facing loop templates** (`/loop:design` et al. — scope creep;
+agents answer loop-design questions in conversation using the package's
+existing vocabulary). **No new loop surfaces**: no run-until-condition goal
+command, no fresh-context re-loop mode for roadmap processing (bounded-scope
+by design), no separate nightly self-check workflow (folded into the existing
+weekly canary).
+
+### 4. The one closure — periodic live trigger-eval pass rate
+
+The existing weekly cross-model canary's secrets-gated live tier gains a
+deterministic rotation over the skills that carry `evals/triggers.json`
+(ISO-week keyed, ~5 suites/week), enforcing the per-domain precision/recall
+floors from `eval:record`. A floor breach fails the **scheduled** job — the
+failure is the maintainer notification; PRs are never blocked by live results.
+The local interactive confirmation gate on `skill_trigger_eval` is untouched;
+CI authorization derives exclusively from workflow-provided key secrets, and
+the no-secrets path stays a logged no-op.
+
+## Revisit-if
+
+- **Any rejection above:** reopen only on evidence that closing the loop saves
+  >2 h/month maintainer time in a structurally similar single-maintainer
+  project (logged hours, not vibes) — via `decision-revisit-gate`
+  mechanism-match, then council.
+- **The §4 closure:** demote the canary pass-rate job to advisory
+  (non-failing) if breaches are >~10% spurious over 50+ suite-runs.
+- **§2 #5 coverage ratchet:** reconsider if ≥3 real regressions ship in rules
+  that a golden task would have caught (counted, cited incidents).
+
+## Consequences
+
+- Future "should we automate X?" loop proposals test against §1 before any
+  build; the disposition table is the precedent record.
+- The weekly canary becomes the single periodic live-eval surface — additions
+  to periodic self-checking extend it rather than adding workflows.
+- Skill-pruning, default-demotion, and drift-blocking proposals cite this ADR
+  instead of re-deriving the argument.
+
+## Alternatives considered
+
+- **Close more loops (coverage ratchet, engagement pruning, auto-demotion):**
+  rejected — each fails at least one §1 criterion; the council's round-2
+  convergence was explicit that "metric exists + reversible" is insufficient.
+- **Loop-design contract:** rejected as compliance theater for a
+  single-maintainer project; revisit on a second maintainer with real handoff
+  friction.
+- **Do nothing (pure documentation):** rejected — the trigger-eval pass-rate
+  gap is real, direct-metric, and closable inside an existing workflow at
+  near-zero maintenance cost.
+
+## References
+
+- `road-to-loop-engineering` roadmap (execution + provenance; external source
+  links retained encrypted there per `source-confidentiality`).
+- `docs/contracts/evidence-based-pruning.md` — §2 #2 anchor.
+- `src/agent-src/contexts/execution/orchestration-benchmark-gate.md` — §2 #1 anchor.
+- `docs/contracts/measurement-baseline.md` — §2 #4 anchor.
+- ADR-088 (no external runtime), ADR-054 (adherence restate), ADR-106/-109/-117
+  (orchestration gates), `docs/contracts/no-runtime-boundary.md`.
+- Prior honest-nulls this ADR does not reopen: recursive-verification
+  (2026-06-24), enforcement-projection, reminder-injection.

package/docs/decisions/ADR-119-global-knowledge-default-on.md

@@ -0,0 +1,104 @@
+---
+adr: 119
+status: accepted
+date: 2026-07-12
+decision: global-knowledge-default-on
+supersedes: 103
+superseded_by: —
+phase: opt-decision-flips
+type: structural
+---
+
+# ADR-119 — Global knowledge sharing defaults ON (validated bounded-downside flip)
+
+## Status
+
+Accepted (2026-07-12). Supersedes ADR-103.
+
+## Context
+
+ADR-103 (2026-06-16) kept `knowledge.global_sharing.enabled: false` until
+cross-project reuse was measured across ≥ 2 projects. Verified state at
+re-evaluation (2026-07-11): the measurement instrument
+(`src/scripts/_lib/knowledge_global_promote.ts`) shipped, but no sightings
+data, no global store, and no reuse record existed — reuse can only accrue
+while the layer is ON, and ON was withheld pending reuse. The gate could
+never fire by construction: the same self-locking-measurement deadlock
+ADR-117 broke for `subagents.auto` on 2026-07-09.
+
+A two-round AI-council re-evaluation ran on 2026-07-11 (members:
+anthropic/claude-sonnet-4-5, openai/gpt-4o; cost $0.10). Round 1: both
+members stanced **Option A — flip ON now** (deadlock + ADR-117 precedent +
+shipped guards). Round 2 dissent (gpt-4o): the redaction floor was
+unvalidated for cross-project adversarial scenarios — composite inference,
+homoglyph/encoding smuggling, temporal context collapse. The named
+evidence-that-would-change-my-mind: demonstrating the redaction mechanism
+handles those classes. Convergence: **flip WITH validation** — the dissent
+becomes a pre-flip gate, not a blocker.
+
+## Decision
+
+1. **Pre-flip validation executed (2026-07-12).** Adversarial spot-check in
+   `tests/scripts/_lib_knowledge_global_redaction_adversarial.test.ts` +
+   `tests/fixtures/global-knowledge-redaction/` covering the three named
+   classes. Honest result: the zero-width-smuggling probe FAILED on first
+   run — the dissent's predicted gap was real. Closed by an additive
+   hardening in `knowledge_global_redaction.ts` (`hidden_unicode` violation
+   class + strip-then-rescan); homoglyph emails were already caught
+   (Unicode-aware pattern); temporal collapse is bounded by the freshness
+   state machine (fresh → hypothesis → stale). All 20 tests green,
+   including the 11 pre-existing parity tests.
+2. **`knowledge.global_sharing.enabled` defaults to `true`** in the shipped
+   template.
+3. **Narrowest tier default:** `allowed_tiers: [public]` (down from
+   `[public, vendor]`); `vendor` becomes a deliberate opt-in widening.
+   `proprietary` stays hard-coded manual-only in the gate.
+4. **Pre-registered demotion trigger:** any cross-project PII/secret
+   sighting in a shared card — a confirmed identifier that crossed a
+   project boundary despite the gate — auto-reverts the shipped default to
+   `false` and lands an incident note under `agents/settings/contexts/`.
+   This is the ADR-117 demotion-gate pattern applied to knowledge sharing.
+5. **Measurement window:** 60–90 days from release. The reuse data the
+   ADR-103 gate wanted now accrues; at window end the default is either
+   confirmed (reuse observed, no incidents) or reverted (no reuse — the
+   layer is dead weight — or a demotion trigger fired).
+6. **Accepted residual, pinned by test:** k-anonymity over pure
+   quasi-identifier combinations is out of scope for a write-time text
+   gate. The council accepted this on the single-install trust boundary
+   (an actor with filesystem access to the global store already reads the
+   raw projects, which are strictly more sensitive). The boundary is
+   asserted by a dedicated test so any future change to it is a deliberate
+   decision, not drift.
+
+## Consequences
+
+- Cross-project knowledge cards flow by default on the narrowest tier,
+  through the unchanged suggest-then-confirm promotion flow
+  (`auto_promote_threshold` gates a suggestion, never a silent write) and
+  the hardened redaction gate (halt-and-surface, never silent-rewrite).
+- Single-key revert: `knowledge.global_sharing.enabled: false` fully
+  no-ops the layer; v1 project-local cards are unaffected either way.
+- No new infrastructure: file-first store, no vectors, no services — the
+  ADR-094 Layer-2 sunset is untouched.
+- The hidden-unicode hardening also protects every other consumer of
+  `redaction_scan` (the Phase-4 CI linter over committed global cards).
+
+## Alternatives considered
+
+- **Keep OFF + opt-in campaign (Option B):** rejected — self-selection
+  bias, slow, and it retains the deadlock for everyone who does not
+  opt in.
+- **Maintainer-org pilot first (Option C):** rejected as the primary path —
+  the council judged the guarded flip's downside bounded enough that a
+  pilot's extra latency buys little; the demotion trigger plus the
+  measurement window deliver the same safety net in production shape.
+
+## References
+
+- ADR-103 (superseded), ADR-117 (deadlock-flip precedent), ADR-100/-094
+  (store shape + Layer-2 sunset).
+- Council session 2026-07-11 (claude-sonnet-4-5 + gpt-4o, 2 rounds,
+  convergence inlined above per `no-roadmap-references`).
+- `tests/scripts/_lib_knowledge_global_redaction_adversarial.test.ts` —
+  the validation gate.
+- `agents/roadmaps/road-to-opt-decision-flips.md` Phase 1 (execution).

package/docs/decisions/ADR-120-council-chairman-mode.md

@@ -0,0 +1,70 @@
+---
+adr: 120
+status: accepted
+date: 2026-07-12
+decision: council-chairman-mode
+supersedes: —
+superseded_by: —
+phase: opt-council-deliberation
+type: structural
+---
+
+# ADR-120 — Council chairman mode supersedes always-host synthesis
+
+## Status
+
+Accepted (2026-07-12).
+
+## Context
+
+The council skill's own Iron Law argues the host agent, having framed the
+artefact, cannot independently judge it — yet the shipped engine always let the
+host author the synthesis ("the host runs the council and synthesises
+convergence"). `road-to-opt-council-deliberation` Phase 2 applies the bias
+argument to the synthesis step itself. The contested `auto`-selection detail
+was resolved by a billable two-round council pass (anthropic/claude-sonnet-4-5 +
+openai/gpt-4o, 2026-07-12): provider-family difference is the binding
+independence property for a judge; capability (tier) is the tie-break.
+
+## Decision
+
+`ai_council.chairman: { mode: host | member | auto, member? }` — **default
+`host`**, preserving today's behaviour byte-for-byte (the compatibility
+guarantee). When `mode != host`, a **non-deliberating member** authors the
+synthesis as one billable call through the existing `consult` path (spend gate,
+daily ledger, metadata stamping unchanged):
+
+- `member` — the named member, validated fail-closed at config load (must exist
+  and be enabled) and rejected at selection time if it deliberated (a member
+  that argued cannot self-judge).
+- `auto` — provider-family difference primary (non-deliberating ⇒
+  provider-different under the one-member-per-provider invariant), optional
+  `members.<name>.tier` tie-break, deterministic config order final.
+- Every fallback path (member deliberated / unavailable / auto with no
+  candidate / call failed) degrades to the host template with a **visible
+  annotation** — never a silent substitution.
+
+## Consequences
+
+- The synthesis slot can carry a chairman-authored body (`payload.chairman`
+  → `render()`); `council:estimate` shows the extra call as its own row.
+- A new optional `tier` field exists on member config solely as the `auto`
+  tie-break.
+- Host synthesis remains the default; no consumer behaviour changes without
+  an explicit opt-in.
+
+## Alternatives
+
+- **Always-host synthesis (status quo)** — rejected: contradicts the skill's
+  own independence argument.
+- **Tier-first auto selection** — rejected by the council pass: chairing with
+  the strongest model when the deliberators share its provider concentrates
+  the decision surface on one provider's priors.
+
+## References
+
+- `docs/contracts/ai-council-config.md` § Chairman synthesis.
+- `src/scripts/ai_council/chairman.ts` (selection), `council_cli.ts`
+  `_maybe_run_chairman` (dispatch).
+- Council convergence: `road-to-opt-council-deliberation` § Council notes
+  (2026-07-12).

package/docs/decisions/ADR-121-knowledge-sensitivity-classes.md

@@ -0,0 +1,90 @@
+---
+adr: 121
+status: accepted
+date: 2026-07-12
+decision: knowledge-sensitivity-classes
+supersedes: —
+superseded_by: —
+phase: feedback-8.11
+type: structural
+---
+
+# ADR-121 — Per-card sensitivity classes for the knowledge boundary
+
+## Status
+
+Accepted (2026-07-12). Successor note to ADR-119 (global knowledge sharing
+default ON) — adds boundary teeth; does NOT revert the flip.
+
+## Context
+
+The 8.11.0 external reviews and the maintainer both name cross-project
+context transfer as the riskiest open surface of the ADR-119 flip: the only
+per-entry axis was origin tier (`public|vendor|proprietary` — where knowledge
+came from), the binary page flag `visibility: private`, and a write-time
+regex redaction gate. There was NO sensitivity taxonomy (how far an entry may
+travel), no per-card owner/expiry on shared cards, no promotion-reason
+capture, and no revocation trail — deletion was silent.
+
+A two-round council debate (anthropic/claude-sonnet-4-5 + openai/gpt-4o,
+2026-07-12) split on scope: one member argued measure-first with a 2-level
+enum at most (six classes over-fit a single-maintainer install — `team` /
+`organization` are phantom categories today); the other argued the full
+six-class taxonomy from the reviews. Resolution: a SMALL machine-anchored
+axis now (the maintainer's danger is present, not speculative), the wider
+enum behind a revisit-if.
+
+## Decision
+
+Three sensitivity classes, each anchored to a machine check
+(`agents/settings/contexts/knowledge-sensitivity.md` carries the full table):
+
+- `prohibited` — redaction-class content; a redaction hit FORCES this class
+  (declared values cannot override it); hard linter error in the global
+  store (check G6).
+- `project` — the DEFAULT; promotion structurally refused unless a human
+  reclassifies; unset/invalid resolves here, never upward.
+- `shareable` — global-store eligible; requires passing redaction AND full
+  provenance: `source_repo`, `owner`, `review_after`, `promotion_reason`
+  (checks G4/G5); `promotion_reason` is mandatory human input — there is no
+  auto-`shareable` path.
+
+Plus an append-only revocation ledger (`.revocations.jsonl` tombstones
+written by `forget`/`purge` BEFORE deletion; rendered via
+`knowledge:global:list --revoked`).
+
+ADR-119's default-ON, `allowed_tiers: [public]`, measurement window, and
+demotion trigger are unchanged.
+
+## Consequences
+
+- Cross-project transfer now requires a recorded human decision per card
+  (class + reason), machine-verified in CI (`check_knowledge_cards` G4–G6)
+  and at promotion time (`gate_sensitivity_for_promotion`).
+- Deletion is auditable; the demotion trigger of ADR-119 gains a per-entry
+  trail to point at.
+- Cost: one more frontmatter field + four footer fields on shared cards;
+  no new subsystem, no read-time machinery.
+
+## Alternatives considered
+
+- Six-class enum `{local-only, project, team, organization, confidential,
+  prohibited}` (the reviews' proposal) — rejected now: `team`/`organization`
+  have no consumer today; widening is cheap later, narrowing is not.
+  Revisit-if: a real multi-tenant org install exists.
+- Revert ADR-119 to default-OFF — rejected: re-creates the ADR-103
+  measure-then-decide deadlock; the danger is contained by classes + gates,
+  not by turning the layer off.
+- Semantic PII detection / k-anonymity — out of scope per ADR-119 §6
+  (write-time text gate, single-install trust boundary).
+
+## References
+
+- `agents/settings/contexts/knowledge-sensitivity.md` — locked design table.
+- ADR-119 — the flip this hardens.
+- Implementation: `knowledge_global.ts` (SENSITIVITIES, footer fields),
+  `knowledge_global_promote.ts` (`resolve_effective_sensitivity`,
+  `gate_sensitivity_for_promotion`, tombstones), `knowledge_global_cli.ts`
+  (promote/forget/purge/list flags), `check_knowledge_cards.ts` (G4–G6);
+  118 tests across 6 files incl. 3 cross-project-contamination adversarial
+  cases.

package/docs/decisions/ADR-200-python-to-typescript-migration.md

@@ -5,12 +5,22 @@ date: 2026-06-11
 decision: python-to-typescript-migration
 supersedes: —
 superseded_by: —
-phase: py2ts · migration-infrastructure
+phase: py2ts · migration-infrastructure (historical record — migration landed on main)
 type: structural
 ---
 
 # ADR-200 — Full Python → TypeScript migration: execution model, branch strategy, dispatcher, parity gates
 
+> **Number retained by decision (2026-07-12):** the provisional-number
+> clause ("final number assigned at the python2ts → main merge") has
+> fired — the migration is complete on `main` (0 tracked `.py` under
+> `src/`). Renumbering was evaluated and declined: 521 files reference
+> "ADR-200" as a stable identifier; a rename would be a 521-file
+> mechanical churn (projections, condensation hashes, docs) for zero
+> behavioral gain. ADR-200 stays the permanent number; the record is
+> historical (migration architecture, landed).
+
+
 > Provisional number 200 (reserved, out-of-band). main ADRs grow sequentially; the migration ADR is renumbered to a high reserved slot to stop recurring collisions on the long-lived `python2ts` branch. Final number is assigned at the `python2ts`→`main` merge.
 
 ## Status

package/docs/decisions/ADR-rule-kernel-and-router.md

@@ -1,3 +1,14 @@
+---
+adr: —
+status: accepted
+date: 2026-05-06
+decision: rule-kernel-and-router-roadmap-closure
+supersedes: —
+superseded_by: —
+phase: road-to-kernel-and-router (closure record)
+type: structural
+---
+
 # ADR — Rule Kernel and Router (Roadmap Closure)
 
 - **Status:** Accepted (2026-05-06)