@event4u/agent-config 9.7.0 → 9.9.0

package/docs/decisions/ADR-071-launch-drive-integration.md

@@ -1,95 +0,0 @@
----
-adr: 071
-status: accepted
-date: 2026-06-08
-decision: launch-drive-integration
-supersedes: —
-superseded_by: —
-phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
-type: structural
----
-
-# ADR-071 — Wire the Tier-1 drive loop into `POST /launch` (v0)
-
-## Status
-
-**Accepted** · 2026-06-08. Design converged via AI-council (claude-sonnet-4-5 +
-gpt-4o, design mode, 2026-06-08). This is **PR 2** of the drive-loop work
-([`ADR-070`](ADR-070-tier1-drive-loop.md) was PR 1 — the executor). The council
-heavily stress-tested the failure paths; two facts defused the sharpest
-critiques and shaped the final design (see Consequences).
-
-## Context
-
-The pieces existed but were unwired: `workspace_render.py` (ADR-069) renders a
-task prompt; `workspace_drive.py` (ADR-070) drives one Tier-1 turn;
-`workspace_sessions.py` records encrypted events; `detectHostTier` (ADR-068)
-reported `tier1-drive-pending`. `POST /launch {role, task, host}` wrote a
-session header and stopped. This ADR makes a Tier-1 launch actually drive a
-turn, and degrades cleanly everywhere else.
-
-## Decision
-
-| # | Question | Verdict | Rationale |
-|---|---|---|---|
-| 1 | Where the prompt comes from | **Fat launch** — `POST /launch {role, task, inputs?, host}` resolves task→prompt, renders in-process, drives. | One round-trip is the natural UX; the render *endpoint* stays pure (launch calls the render module, doesn't re-implement it). Render failure → `host.error(render-error)` + `{driven:false}`, **no drive attempt**. |
-| 2 | Backwards compatibility | **Additive.** Header always written first; driving only when the task resolves to a prompt AND the host is tier 1. Inputs supplied to a no-prompt task → explicit `{driven:false, reason:"no-prompt-for-task", ignored_inputs:true}`. | The legacy `{role, task, host}` → header contract is unchanged; no silent input drops. |
-| 3 | What gets appended | Header (`launcher.input`), then **exactly one** `host.turn` (success) or `host.error` (render / drive failure). | Each launch mints a **fresh** session id → no shared-session append race; "single append" needs no lock in v0. |
-| 4 | Degrade matrix | Tier-3 host, or tier-1 drive failure: **best-effort** inbox hand-off when the flag is on (write rendered prompt, append `inbox.handoff`); flag off → header + tier only. | The session record is the source of truth; the inbox is a convenience, so its write is best-effort (try/catch, never fails the response). |
-| 5 | Timeout response | **HTTP 200** always, with `{driven:false, error_kind:"timeout"}`; never 202. | The session + error are recorded synchronously; a 202 would imply async continuation that does not exist. |
-
-### Response shape
-
-`POST /launch` always returns 200 with the session header fields + tier, plus:
-
-- success: `{driven:true, turn:{…uniform turn…}}`
-- no prompt: `{driven:false, reason:"no-prompt-for-task", ignored_inputs?:true}`
-- render error: `{driven:false, error_kind:"render-error", error}`
-- tier-3 / drive failure: `{driven:false, error_kind?, error?, handoff?}` (`handoff` present iff the inbox flag was on and the write succeeded)
-
-## Consequences
-
-- **No shared-session race** (council's biggest concern): every launch mints a
-  new session id, so two concurrent launches write two sessions, never a
-  double-append to one. The "single append" invariant is per-launch and needs
-  no lock in v0.
-- **No partial-output-on-timeout** (council's second concern): `claude -p
-  --output-format json` is non-streaming; on a timeout the subprocess is killed
-  with no parseable envelope, so `host.error(timeout)` carries metadata only.
-- The session log stays the single source of truth — every outcome (turn,
-  render-error, drive-error, handoff) is recorded through the encrypted store
-  (ADR-064); the response mirrors what was recorded.
-- Driving is opt-in and additive; existing GUI callers that send no inputs and
-  hit a no-prompt task keep their header-only behaviour.
-
-## Alternatives considered
-
-- **Thin launch (client renders via `/render`, passes the prompt to launch)** —
-  rejected for v0: two round-trips for the common path; the render endpoint
-  staying pure already preserves the separation the thin shape was protecting.
-- **Separate `POST /launch/:id/drive`** — rejected (ADR-070 decision 4):
-  orphaned-session risk with no rollback/dedup in v0.
-- **202 on timeout** — rejected: implies async continuation we do not have; the
-  error is recorded synchronously, so 200 is honest.
-- **Fail the response when the inbox degrade write fails** — rejected: the
-  session error is already recorded; the hand-off is a convenience, so its
-  failure must not mask a recorded outcome.
-
-## Deferred to v1 (debt)
-
-- Multi-turn / tool execution (inherited from ADR-070).
-- `codex` / `gemini` drive configs (the unified `drive()` is ready).
-- Pre-flight checks (disk / key validity) + write-ahead recovery for the
-  header→turn sequence — v0 relies on best-effort append + the always-present
-  header for recovery.
-- Drive metrics + a kill-switch flipping tier-1 to inbox-only on a failure-rate
-  threshold.
-
-## References
-
-- [`ADR-070`](ADR-070-tier1-drive-loop.md) — the drive executor (PR 1).
-- [`ADR-069`](ADR-069-prompt-renderer.md) — the renderer launch calls in-process.
-- [`ADR-068`](ADR-068-host-tier-detection.md) — tier detection gating the drive.
-- [`ADR-065`](ADR-065-tier3-inbox-handoff-v0.md) — the inbox the degrade path writes to.
-- [`ADR-064`](ADR-064-append-jsonl-per-record-encryption.md) — the encrypted session store.
-- [`daily-workspace`](../contracts/daily-workspace.md) — `/launch` surface contract.

package/docs/decisions/ADR-072-codex-gemini-drive-configs.md

@@ -1,90 +0,0 @@
----
-adr: 072
-status: accepted
-date: 2026-06-08
-decision: codex-gemini-drive-configs
-supersedes: —
-superseded_by: —
-phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
-type: structural
----
-
-# ADR-072 — Codex + Gemini drive configs
-
-## Status
-
-**Accepted** · 2026-06-08. Implementation follow-up to
-[`ADR-070`](ADR-070-tier1-drive-loop.md), which shipped the unified drive loop
-with the `claude-code` config and left `codex` / `gemini` as v1 debt. This is a
-**mechanical extension**, not a new design decision: the unified `drive()` is
-unchanged; each host adds a `build_args` + envelope parser. No AI-council round
-was needed — the only unknowns were the two CLIs' envelope shapes, which are
-**facts to verify, not trade-offs to debate** (per `think-before-action`).
-
-## Context
-
-`workspace_drive.py` (ADR-070) drives one Tier-1 turn through a per-host config.
-All three Tier-1 hosts (Claude Code / Codex / Gemini — ADR-023) are now CLI-
-present; the launch integration (ADR-071) already drives any `effective_tier==1`
-host, so adding the two configs lights up codex / gemini end-to-end with **no
-Node change**.
-
-## Decision
-
-Add `codex` and `gemini` to `HOST_CONFIGS`, refactoring the per-host hook from
-`normalise(dict)` to `parse(stdout)` so a host can own a multi-line stream
-(codex) rather than a single JSON object.
-
-**Envelope shapes — verified, not guessed:**
-
-| Host | Invocation | Shape | Text key | Usage | Session |
-|---|---|---|---|---|---|
-| `claude-code` | `claude -p <p> --output-format json` | single JSON | `result` | `usage.{input,output}_tokens` | `session_id` |
-| `codex` | `codex exec --json <p>` | **NDJSON** event stream | last `item.completed` → `item.content[].text` | `turn.completed.usage` | `session.created.session_id` |
-| `gemini` | `gemini -p <p> --output-format json` | single JSON | `response` | `stats.models.<model>.tokens` (model name dynamic) | `session_id` |
-
-- **Codex** shape is reused verbatim from the actively-used
-  `ai_council.clients.OpenAICliClient` parser (`item.completed` /
-  `turn.completed` / `session.created`); unknown events are skipped, event
-  order is tolerated. Missing assistant text → fail-closed (`bad-envelope`).
-- **Gemini** shape was confirmed by a live `gemini -p … --output-format json`
-  probe (2026-06-08): top-level `response` + `session_id`, token usage nested
-  under `stats.models.<dynamic-model>.tokens` (take the first model entry
-  best-effort; `output ≈ total − prompt`). Missing `response` → fail-closed.
-- **Tool calls** stay opaque (recorded, never executed) — same as ADR-070.
-
-## Consequences
-
-- A workspace launch (ADR-071) against `host: "codex"` or `host: "gemini"` now
-  drives a real turn when the CLI is on PATH; no other code path changes.
-- The drift-detection posture from ADR-070 extends to all three hosts: an
-  opt-in contract test per host (skipped when the CLI is absent) catches a
-  vendor-side envelope rename the moment it runs where the CLI is present.
-- The `parse(stdout)` refactor is backwards-compatible: the claude config's
-  behaviour and the uniform turn shape are unchanged.
-
-## Alternatives considered
-
-- **Guess the gemini envelope from the contract prose** — rejected: the exact
-  keys (`response`, nested `stats.models`) are not documented in-repo; a live
-  probe is cheap and removes the guess (`think-before-action`).
-- **Per-host `drive_*` functions** — rejected again (ADR-070 decision 3): the
-  variance is CLI flags + envelope parsing, both already captured by the config
-  table; control flow stays single.
-- **Pass `--model` to codex / gemini** — deferred: the drive loop uses each
-  host's default model in v0; model selection is a later concern.
-
-## Deferred to v1 (debt)
-
-Inherited from ADR-070: multi-turn / tool execution, drive metrics +
-kill-switch, error-taxonomy refinement. Plus: explicit model selection per
-host, and a normalised cross-host `usage` schema (codex/claude expose
-input/output tokens directly; gemini is derived).
-
-## References
-
-- [`ADR-070`](ADR-070-tier1-drive-loop.md) — the unified drive loop (claude-code config).
-- [`ADR-071`](ADR-071-launch-drive-integration.md) — the launch integration that drives any tier-1 host.
-- [`ADR-023`](ADR-023-host-agent-protocol.md) — the three Tier-1 hosts.
-- [`host-agent-protocol`](../contracts/host-agent-protocol.md) — envelope-as-contract + fail-closed posture.
-- `src/scripts/ai_council/clients.py` — the proven claude / codex CLI envelope parsers reused here.

package/docs/decisions/ADR-073-drive-health-kill-switch.md

@@ -1,81 +0,0 @@
----
-adr: 073
-status: accepted
-date: 2026-06-08
-decision: drive-health-kill-switch
-supersedes: —
-superseded_by: —
-phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
-type: structural
----
-
-# ADR-073 — Drive health + kill-switch (v0)
-
-## Status
-
-**Accepted** · 2026-06-08. Design converged via AI-council (claude-sonnet-4-5 +
-gpt-4o, design mode, 2026-06-08). Closes the observability + kill-switch gap the
-drive-loop councils (ADR-070/071/072) repeatedly flagged: there was no way to
-see "this host keeps timing out" and no automatic degrade when a host CLI goes
-bad.
-
-## Context
-
-Every Tier-1 drive (ADR-070/071/072) writes one session record — `host.turn`
-(success) or `host.error` (`error_kind` ∈ timeout / cli-missing / nonzero-exit
-/ bad-envelope / …). That store is the **canonical** history, but it is
-encrypted and per-session; the kill-switch needs a *cheap, frequent* read on
-every launch ("is this host healthy enough to drive?"). Scanning session files
-per launch is the wrong shape.
-
-## Decision
-
-Add `workspace_drive_health.py`: a tiny per-host **cache** counter at
-`<writeRoot>/workspace/health/<host>.json`, plus a kill-switch.
-
-| # | Question | Verdict | Rationale |
-|---|---|---|---|
-| 1 | Metrics source | **Dedicated counter file, as a cache.** Session log stays canonical; a missing / unreadable cache **fails open** (host treated as healthy). Minimal schema (`consecutive_failures`, `killed`, lifetime totals, last outcome) — no histograms. | The kill-switch needs O(1) reads; deriving from encrypted session scans per launch is wrong. The cache never fabricates a kill. |
-| 2 | Kill-switch trigger | **Auto + manual.** Auto-trips at **5 consecutive failures**; a manual `kill` forces it. | A consecutive-failure streak is simpler than windowing math; 5 lets transient blips self-heal while a broken CLI trips fast. |
-| 3 | State + reset | On-disk per host; **manual reset only** in v0. A success resets the *streak* but not a tripped `killed` flag. | Auto-cooldown / probe-drive risks flapping with no data on real failure modes yet — that is a v1 feature. |
-| 4 | Enforcement | **Single point in `POST /launch`**: before driving a tier-1 host, consult health; killed → skip the drive, append `host.error(host-killed)`, degrade to the inbox (same path as a drive failure). Never mutates the detected tier. | One synchronous fallback, not a tier mutation a poller has to observe. |
-| 5 | Surface | CLI (`record` / `status` / `kill` / `reset`) + a `host_killed` flag on the launch response **+ a read-only `GET /api/v1/workspace/drive-health`**. | The GUI needs health data; without the endpoint it would read the JSON file directly and bypass the surface. The endpoint is ~10 lines reading the same data the CLI does. |
-
-**Concurrency:** writes are atomic (temp file + `os.replace`) so a concurrent
-reader never sees a partial file. The read-modify-write increment is best-effort
-under true concurrency (a lost increment is acceptable — the session log is
-canonical); drives are launch-paced in v0, so contention is rare.
-
-## Consequences
-
-- A host that fails 5 drives in a row auto-routes its launches to the Tier-3
-  inbox until an operator runs `reset` — a broken host CLI no longer burns turn
-  after turn.
-- `GET /drive-health` gives the GUI (and an operator) a per-host snapshot
-  without reading the canonical (encrypted) session log.
-- The cache is non-authoritative: deleting `workspace/health/` resets the
-  kill-switch state with no data loss (the session log retains the history).
-
-## Alternatives considered
-
-- **Derive metrics from session records on demand** — rejected as the primary
-  source: O(sessions) encrypted scans on every launch. (It remains the
-  canonical reconciliation source for a future v1 audit.)
-- **Auto-cooldown + probe-drive recovery** — deferred to v1: no data yet on
-  whether hosts flap; manual reset is the conservative v0 choice.
-- **Failure-rate window instead of a streak** — deferred: windowing math is
-  v0 over-engineering; a consecutive-streak is enough to catch a dead CLI.
-- **No HTTP endpoint (CLI only)** — rejected (council): the GUI would read the
-  file directly and bypass the surface; the endpoint is cheap.
-
-## Deferred to v1 (debt)
-
-Auto-cooldown + probe-drive recovery, failure-rate windows, per-error-kind
-weighting (a `bad-envelope` may warrant a faster trip than a transient
-`timeout`), and reconciliation of the cache against the canonical session log.
-
-## References
-
-- [`ADR-070`](ADR-070-tier1-drive-loop.md) / [`ADR-071`](ADR-071-launch-drive-integration.md) / [`ADR-072`](ADR-072-codex-gemini-drive-configs.md) — the drive loop this instruments.
-- [`ADR-064`](ADR-064-append-jsonl-per-record-encryption.md) — the canonical encrypted session store.
-- [`daily-workspace`](../contracts/daily-workspace.md) — workspace surface (lists `/drive-health`).

package/docs/decisions/ADR-074-drive-kill-switch-auto-recovery.md

@@ -1,84 +0,0 @@
----
-adr: 074
-status: accepted
-date: 2026-06-08
-decision: drive-kill-switch-auto-recovery
-supersedes: —
-superseded_by: —
-phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
-type: structural
----
-
-# ADR-074 — Drive kill-switch auto-cooldown recovery (v1)
-
-## Status
-
-**Accepted** · 2026-06-08. Design converged via AI-council (claude-sonnet-4-5 +
-gpt-4o, design mode, 2026-06-08). Implements the auto-recovery that
-[`ADR-073`](ADR-073-drive-health-kill-switch.md) explicitly deferred to v1, and
-**amends** ADR-073's decision 3 ("manual reset only"): an *auto*-tripped host
-now self-recovers via a half-open probe; a *manual* kill stays sticky.
-
-## Context
-
-ADR-073's kill-switch was manual-reset-only — a tripped host stayed inbox-only
-until an operator ran `reset`. That is operator toil once the underlying problem
-clears. This v1 adds a classic circuit-breaker half-open recovery.
-
-## Decision
-
-| # | Question | Verdict | Rationale |
-|---|---|---|---|
-| 1 | State model | **Three-state `gate(host)` → closed / open / half_open** (via `killed_at` + cooldown). Cache miss → `closed` (fail open). | The launch path switches on the gate; the boolean `is_killed` becomes a status read. |
-| 2 | Probe mechanism | **Reuse the next real launch** as the probe. async / synthetic probe = v2. | This is a **local single-user** workspace, not a high-traffic service — the one user paying a probe's latency ~once per cooldown is acceptable; an async probe runner is disproportionate for v1. The council's UX concern is noted and the feature is flag-gated as the escape hatch. |
-| 3 | Success semantics | A success **closes** an *auto*-tripped circuit (un-kills); a *manual* kill is never auto-cleared. Safe because a real drive only runs when closed/half-open. | Auto-recovery without operator toil; manual intent is preserved. |
-| 4 | Probe failure | Re-open, restart the cooldown (**fixed**, no back-off in v1) and `trip_count += 1`. **Flapping guard:** at `MAX_AUTO_TRIPS = 3` the host goes **sticky** (manual reset only). | Bounds a misconfigured host probing forever and burning quota. |
-| 5 | Cooldown | **Env-tunable** `AGENT_CONFIG_DRIVE_COOLDOWN_SEC` (default **600 s**), global; no per-host override. | A wrong default is an env flip (30 s), not a code deploy; per-host is over-engineering. |
-| 6 | Manual kill | **Sticky** (`kill_reason: "manual"`) — never auto-recovers. Only auto-trips (`"auto"`) take the cooldown path. | A manual kill encodes out-of-band knowledge ("broken until I fix it"); auto-healing it would fight the operator. |
-
-**Escape hatch (council: mandatory):** the whole behaviour is behind
-`AGENT_CONFIG_DRIVE_AUTO_RECOVERY` (default on; `0/false/off` → ADR-073 v0
-manual-only). **Concurrency:** a `probe_started_at` time-lease (`PROBE_LEASE_SEC
-= 120`) makes a concurrent launch see `open` instead of firing a second
-simultaneous probe — adequate for launch-paced single-user writes; a full
-compare-and-swap lock is v2. **Observability:** `record(..., is_probe=True)` +
-`last_was_probe` distinguish probe outcomes from normal drives.
-
-## Launch enforcement
-
-`POST /launch` calls `gate(host)` before driving: `open` → skip + inbox
-(`host.error(host-killed)`); `half_open` → drive ONE probe, record with
-`is_probe`, response carries `recovered: true` on a successful probe; `closed`
-→ normal drive. One enforcement point, unchanged from ADR-073.
-
-## Consequences
-
-- An auto-tripped host recovers on its own once the problem clears — no operator
-  toil for transient outages.
-- A genuinely broken host trips → probes → re-trips up to `MAX_AUTO_TRIPS`, then
-  goes sticky so it stops burning probes until an operator intervenes.
-- A manual `kill` behaves exactly as before (sticky); the escape-hatch flag
-  restores full v0 behaviour.
-
-## Alternatives considered
-
-- **Async / synthetic background probe** (council's preferred UX) — deferred to
-  v2: needs a background task runner; disproportionate for a local single-user
-  tool where the probe-latency cost lands on at most one user per cooldown.
-- **Exponential cooldown back-off** — deferred to v2: fixed cooldown + the
-  `MAX_AUTO_TRIPS` sticky guard already bounds flapping.
-- **Auto-recovering manual kills** — rejected: a manual kill is an operator
-  decision that auto-healing would override.
-- **Hard-coded cooldown** — rejected: env-tunability is three lines and turns a
-  wrong default into a 30-second fix.
-
-## Deferred to v2 (debt)
-
-Async / synthetic probe (decouple recovery from a user launch), full
-compare-and-swap probe lock, per-host cooldown override, exponential back-off,
-per-error-kind trip weighting, cache↔session-log reconciliation.
-
-## References
-
-- [`ADR-073`](ADR-073-drive-health-kill-switch.md) — the v0 kill-switch this amends (decision 3).
-- [`ADR-070`](ADR-070-tier1-drive-loop.md) / [`ADR-071`](ADR-071-launch-drive-integration.md) — the drive loop + launch enforcement point.

package/docs/decisions/ADR-075-workspace-gui-drive.md

@@ -1,83 +0,0 @@
----
-adr: 075
-status: accepted
-date: 2026-06-08
-decision: workspace-gui-drive
-supersedes: —
-superseded_by: —
-phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
-type: structural
----
-
-# ADR-075 — WorkspacePage drive integration (GUI v0)
-
-## Status
-
-**Accepted** · 2026-06-08. Design converged via AI-council (claude-sonnet-4-5 +
-gpt-4o, design mode, 2026-06-08) — both members converged firmly on the minimal
-surface. Makes the drive backend (ADR-069..074) usable from the GUI: the
-employee fills a task's inputs, runs it, and sees the host's turn — the
-"external-proof" payoff of the phase.
-
-## Context
-
-`src/ui/pages/WorkspacePage.tsx` (Preact + signals) had a "Start session" button
-that POSTed `/launch {role, task}` with **no inputs** and showed a banner — so
-every real-task launch hit the backend's render-error path. The GUI never
-collected inputs, never showed the driven turn, never surfaced drive health.
-
-## Decision
-
-| # | Question | Verdict | Rationale |
-|---|---|---|---|
-| 1 | Input collection | **Inline expander form** under the task — one field per declared input, required marked, `shape` as placeholder. | Least chrome; fits the existing task list. A modal / rail is more surface for no v0 benefit. |
-| 2 | Input-spec source | **Inline the spec in `GET /roles/:role/tasks`** (each task gains `inputs` + `skill_hint`); **no** dedicated inspect endpoint. | A dedicated lazy endpoint blocks the form on an RTT and adds a second failure mode; the per-task spec is <500 bytes. Parsed in Node (prompts are plaintext) for display; render/drive stays Python-authoritative. |
-| 3 | Result display | Driven turn → assistant **text** inline, **collapsed behind "Show full" past 2000 chars** (+ model/token meta). Each non-driven outcome → a distinct banner. | A 4k-token turn would break the chrome — the collapse is a day-1 guardrail, not post-v0 polish. |
-| 4 | Drive-health UI | **Defer a dedicated health panel.** Reflect `host_killed` / `recovered` from the launch response in the banner only. | `GET /drive-health` exists (ADR-073) for a later panel; a health dashboard is not the v0 critical path. |
-| 5 | Host selection | **Hard-code `host: 'claude-code'`** for v0; no host picker. | The v0 goal is validating the drive flow end-to-end with one host; a picker is UX debt (host ids ≠ model names) + an N×M test matrix for an unrequested feature. |
-
-**Shape-mismatch safety (council blocker check):** the renderer stringifies any
-input value (`str(val)`), so a wrong-typed input never 500s — only a
-missing-required input returns the structured `render-error` the banner shows.
-
-## Surface
-
-- `GET /roles/:role/tasks` now returns, per task, `inputs: [{name, required,
-  shape}]` + `skill_hint` (read-only display data).
-- `WorkspacePage`: selecting a role fetches tasks-with-specs; "Start session"
-  expands the inline `TaskForm`; "Run task" POSTs `/launch {role, task, inputs,
-  host: 'claude-code'}`; `TurnResult` renders the driven turn (collapsible);
-  `bannerFor()` maps every outcome (driven / recovered / host-killed /
-  render-error / no-prompt / handoff) to one banner.
-
-## Consequences
-
-- The full render → drive → turn path is now exercisable by an employee in the
-  browser — the phase's external-proof goal.
-- The tasks endpoint stays one round-trip; no new endpoint, no subprocess
-  fan-out (Node parses the plaintext prompt frontmatter for the display spec).
-- Multi-host selection and a drive-health panel are deferred with the
-  `host: 'claude-code'` default and the `host_killed`/`recovered` banner as the
-  forward hooks.
-
-## Alternatives considered
-
-- **Dedicated `/prompts/:name` inspect endpoint** — rejected: RTT block on form
-  open + a second failure mode; inlining is trivial payload.
-- **Host picker in v0** — rejected (both council members): speculative,
-  UX-confusing (host ids), and an N×M test matrix before any user has asked.
-- **Render the turn raw with no collapse** — rejected: a long turn breaks the
-  layout; the char-collapse is a day-1 guardrail.
-- **Drive-health panel now** — deferred: not the v0 critical path; the endpoint
-  already exists for a later pass.
-
-## Deferred to v1 (debt)
-
-A host picker (claude-code / codex / gemini / inbox), a drive-health panel fed
-by `GET /drive-health`, streaming turn output (v0 is single-turn), and a richer
-input-validation surface (typed fields beyond textarea + `shape` hints).
-
-## References
-
-- [`ADR-069`](ADR-069-prompt-renderer.md) / [`ADR-071`](ADR-071-launch-drive-integration.md) / [`ADR-073`](ADR-073-drive-health-kill-switch.md) / [`ADR-074`](ADR-074-drive-kill-switch-auto-recovery.md) — the drive backend this surfaces.
-- [`daily-workspace`](../contracts/daily-workspace.md) — the workspace surface contract.

package/docs/decisions/ADR-076-workspace-multi-turn.md

@@ -1,92 +0,0 @@
----
-adr: 076
-status: accepted
-date: 2026-06-09
-decision: workspace-multi-turn
-supersedes: —
-superseded_by: —
-phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
-type: structural
----
-
-# ADR-076 — Workspace multi-turn = conversation continuation (v0)
-
-## Status
-
-**Accepted** · 2026-06-09. Design converged via AI-council (claude-sonnet-4-5 +
-gpt-4o, design mode, 2026-06-08) — both members converged firmly on **Reading B
-(conversation continuation)** over Reading A (agentic tool-execution loop).
-Resolves the ADR-070 "multi-turn + tool execution" debt by scoping it correctly.
-
-## Context
-
-The ADR-070 debt was labelled "multi-turn + tool execution," which conflates two
-very different features. The council's framing decision:
-
-- **Reading A — agentic tool-execution loop at our layer.** Parse tool-call
-  requests from the host envelope, *we* execute them, feed results back. This is
-  **largely redundant** — `claude -p` / `codex exec` / `gemini -p` each run their
-  own agent loop + tool execution internally and return the *final* result. It
-  also makes **us** execute model-requested actions — a heavy security surface
-  (`security-sensitive-stop`: threat-model + allowlist + sandbox) for little
-  gain over what the host already does.
-- **Reading B — conversation continuation.** Every launch today is a *fresh*
-  single-turn session with no way to send a **follow-up** to the *same* host
-  session. We reuse the host session id (captured on `host.turn`) to continue
-  (`claude --resume`, `codex exec resume`, `gemini --resume`). The host keeps
-  running its own tools internally each turn; we add no execution surface.
-
-**Decision: Reading B.** It is the real, non-redundant gap and is far
-lower-risk. Reading A is deferred indefinitely (redundant with the host loop).
-
-## Decision (Reading B)
-
-| # | Question | Verdict |
-|---|---|---|
-| 1 | Surface | Dedicated **`POST /workspace/sessions/:id/continue {prompt}`**. |
-| 2 | Per-host resume | `build_resume_args(session_id, prompt)` + `supports_resume` per `HOST_CONFIGS`. All three Tier-1 hosts expose a documented non-interactive resume (verified): claude `--resume <id> -p`, codex `exec resume <id> --json <prompt>`, gemini `--resume <id> -p`. |
-| 3 | session-id source | The **most recent `host.turn`** record's `session_id` (the session log is canonical). **No host turn with a session_id → HTTP 409** ("run at least one turn first"). |
-| 4 | Health interaction | Continuation is a drive → same `gate()` + `recordDriveHealth` as a launch (kill-switch applies). |
-| 5 | First PR | Mechanics only — `build_resume_args` + the session-id lookup + `/continue`. The GUI "Follow up" affordance is a later PR. |
-
-**Failure handling:** a resume drive failure is recorded as `host.error` and
-returned `{driven:false, error_kind}` (same shape as a launch). A host-session-
-expired 410 mapping (distinct from a generic failure) needs per-host stderr
-parsing → deferred to v1. The append-only session log has no per-session
-"status", so there is no "stuck in_progress" state to recover.
-
-## Consequences
-
-- A follow-up turn continues the *same* host conversation (the host carries its
-  own context + ran its own tools on turn 1) — no tool-execution surface at our
-  layer, no threat-model gate tripped.
-- `/continue` reuses the launch drive machinery (`driveHostTurn` gained an
-  optional `resumeSessionId`), so the kill-switch, health recording, and
-  encrypted `host.turn` append all apply unchanged.
-- The 409 guard makes "continue a session that never drove" fail loud.
-
-## Alternatives considered
-
-- **Reading A (agentic tool-exec loop)** — rejected: redundant with the host
-  CLI's own loop + a heavy security surface for no gain.
-- **Fold continuation into a generalised launch** — rejected: a dedicated
-  session-keyed endpoint is clearer and avoids overloading launch's contract.
-- **A separate session-id index** — rejected: the session log already records
-  it on `host.turn`; a second source would drift.
-- **Concurrency lock on `/continue`** — deferred: the drive infra is already
-  sequential-launch-assumed; concurrent continuation is a later hardening
-  concern, documented not solved.
-
-## Deferred to v1 (debt)
-
-A 410 "host session expired" mapping (per-host stderr detection), a session-
-level concurrency lock, and the GUI "Follow up" affordance. Reading A (agentic
-tool execution at our layer) remains deferred indefinitely — redundant with the
-host loop.
-
-## References
-
-- [`ADR-070`](ADR-070-tier1-drive-loop.md) — the drive loop + the "multi-turn" debt this scopes.
-- [`ADR-071`](ADR-071-launch-drive-integration.md) / [`ADR-073`](ADR-073-drive-health-kill-switch.md) — the launch drive + kill-switch `/continue` reuses.
-- [`ADR-023`](ADR-023-host-agent-protocol.md) — the three Tier-1 hosts + their CLIs.
-- [`security-sensitive-stop`](../../dist/agent-src/rules/security-sensitive-stop.md) — why Reading A's execution surface was avoided.

package/docs/decisions/ADR-077-workspace-followup-gui.md

@@ -1,70 +0,0 @@
----
-adr: 077
-status: accepted
-date: 2026-06-09
-decision: workspace-followup-gui
-supersedes: —
-superseded_by: —
-phase: employee-product Phase 8 (road-to-employee-product-and-external-proof)
-type: structural
----
-
-# ADR-077 — WorkspacePage follow-up affordance (GUI for /continue)
-
-## Status
-
-**Accepted** · 2026-06-09. Closes the GUI debt [`ADR-076`](ADR-076-workspace-multi-turn.md)
-explicitly deferred ("the GUI 'Follow up' affordance"). A small, mechanical
-reuse of the ADR-075 GUI patterns over the merged `/continue` endpoint — no
-council needed (no design fork; the only target is the active session).
-
-## Context
-
-ADR-076 shipped `POST /sessions/:id/continue` (resume the same host session) but
-left it unsurfaced — the WorkspacePage could drive a first turn (ADR-075) but
-not send a follow-up. This wires that.
-
-## Decision
-
-- After a **driven** turn, `TurnResult` shows a **"Follow up"** textarea +
-  "Send follow-up" button. Submit calls `continueTurn(launchResult.id, prompt)`
-  → `POST /sessions/:id/continue {prompt}` → replaces the displayed turn with
-  the continuation (reusing `TurnResult` + `bannerFor`).
-- **Target = the active session** (`launchResult.id`). v0 does not add a
-  session-strip "continue any past session" affordance — the natural flow is
-  launch → see turn → follow up. Picking an arbitrary historical session to
-  resume is deferred.
-- The box appears **only when a turn has driven** (`launchResult.driven`); a
-  hand-off / render-error / host-killed outcome shows no follow-up (there is no
-  host session to continue) — matching the `/continue` 409 guard.
-- `followupText` resets on a new launch (a fresh launch starts a fresh
-  conversation); it clears on a landed continuation, and is **kept** on a
-  failed one so the user can retry.
-
-## Consequences
-
-- The end-to-end multi-turn flow is now visible: launch → turn → follow-up →
-  turn, all in the same host session, with the kill-switch + health applying to
-  every turn (server-side, ADR-073/076).
-- Pure additive reuse — no new endpoint, no server change; `bannerFor` /
-  `TurnResult` already handle the continuation response shape (identical to a
-  launch result).
-
-## Alternatives considered
-
-- **Continue any session from the strip** — deferred: the active-session flow
-  is the v0 critical path; arbitrary-session resume needs a session-detail view
-  first.
-- **A dedicated continuation ADR section in ADR-076** — chose a thin ADR-077
-  instead so the deferred-debt closure has its own audit entry.
-
-## Deferred to v1 (debt)
-
-Continue an arbitrary past session from the session strip; a per-turn
-conversation thread view (today the latest turn replaces the prior in the
-result pane — the full thread lives in the session JSONL).
-
-## References
-
-- [`ADR-076`](ADR-076-workspace-multi-turn.md) — the `/continue` endpoint this surfaces (and the debt it closes).
-- [`ADR-075`](ADR-075-workspace-gui-drive.md) — the GUI drive patterns (`TaskForm` / `TurnResult` / `bannerFor`) reused here.