@tech-leads-club/harness-toolkit 0.2.1

package/docs/decisions/ad-080.md

@@ -0,0 +1,86 @@
+---
+type: Decision
+title: "AD-080 — Every hand-written list of our own rules is now checked, including the one that drifted while writing this"
+description: "Three lists of this project's own checks drifted in one week. The last two unchecked ones are now gated: the defaults concepts.md states, and the gate step list in CONTRIBUTING — which was wrong the moment a sixteenth step shipped. Plus the orphan tool got a documented caller and the seal is verified where the stop reads."
+tags: [decision, docs, gates, integrity]
+timestamp: "2026-08-17"
+---
+
+# AD-080 — Every hand-written list of our own rules is now checked, including the one that drifted while writing this
+
+- **status**: active
+
+## Decision
+
+1. **A default stated in `concepts.md` must match the catalog.** Checked per capability, in a window around its
+   config key.
+2. **`CONTRIBUTING.md` must name every gate tool and state the right count**, one table row per step.
+3. **`eval-skill-triggers` gets a documented caller** rather than removal.
+4. **The seal is verified where the stop reads the handoff**, not only where the session start injects it.
+5. **The `CG-03` intermittent failure is recorded as unreproduced, not fixed.**
+
+## Why
+
+**Three lists drifted in one week, and the fourth drifted while the record about drift was being written.** The
+wizard's narrated half described the comment gate diffing against `HEAD` after a decision replaced it. `concepts.md`
+said the grind lock waits 120 seconds after a decision replaced that too. `secret-access`'s own description in the
+floor catalog still described only files after the metadata-service rule shipped. And then a sixteenth gate step
+landed and `CONTRIBUTING.md` still said fifteen — the contributor-facing list of our own checks, wrong the moment a
+check was added.
+
+Every one was hand-written, and every one was found by looking rather than by failing. That is the pattern, and
+patching instances of it is not the fix ([/decisions/ad-065.md](/decisions/ad-065.md)).
+
+**`concepts.md` cannot be generated, and its checkable half can.** It is prose an operator reads end to end, which
+a generator writes badly ([/decisions/ad-079.md](/decisions/ad-079.md)). But one fact in it has an exact answer
+elsewhere: whether a rail is on by default. Presence was already gated; the default is now too, in a window around
+the config key so a default stated about one rail is not read as another's. Inverting one fails.
+
+**The gate step list is presence, and presence is enough.** The guide names the tool path rather than the internal
+step label, because the path is what a contributor types. So the check is: every `tools/dev/*` the gate runs appears
+in the guide, the stated count matches, and there is one row per step. Deleting a step from the doc fails; writing
+the wrong number fails.
+
+**The orphan tool needed a caller, not a funeral.** `eval-skill-triggers` is invoked by nothing —
+[/decisions/ad-068.md](/decisions/ad-068.md) left open whether it should exist. Our own removal doctrine says a
+tool whose only consumer is its test is a candidate. But it evaluates whether a host routes a request to the init
+skill at all, which is a behaviour change with no test attached, and deleting it would remove the only way to
+check that. The problem was that nothing pointed at it. `CONTRIBUTING.md` now names it as the step before changing
+the skill's description, which is a consumer: a human following a documented workflow.
+
+**The stop reads the handoff to decide, which is a different risk from telling the model.**
+[/decisions/ad-078.md](/decisions/ad-078.md) left that open. A decision taken from planted text is worth the same
+withholding, and withholding there means deciding from the file's absence — which is what a first turn already
+does, so the path is exercised.
+
+## Trade-offs
+
+**`CG-03` is recorded as unreproduced.** It failed once under `TLC_HOME` in a full-suite run, and did not recur in
+eight subsequent runs. Measured against the one hypothesis worth testing: the fixture is three days old, the
+default retention is fourteen days and the narrow case is one, so it is not a boundary race. Inventing a fix for a
+failure that cannot be reproduced would be worse than leaving it named — it would add a change nothing justifies
+and a claim nothing supports.
+
+**The default check reads a 120-character window.** A section that states its default further from its config key
+than that is skipped rather than failed. Widening it would start reading a neighbouring rail's default as this
+one's, which is a false positive in a check whose whole value is precision.
+
+**The count in `CONTRIBUTING` is a word, matched from a closed list.** `Sixteen` is checked; `sixteen point five`
+is not a thing. It is a small vocabulary and the failure names the mismatch, which is cheaper than parsing English
+numbers.
+
+**Keeping the orphan tool costs its tests.** Two of them, and a documented workflow that most contributors will
+never run. The alternative was deleting the only check on whether the skill is reachable at all.
+
+## Not decided here
+
+- **Generating `concepts.md`.** Still the last unrendered view of the rails, and still prose. Two facts in it are
+  now checked; the rest is judgement.
+- **What `doctor` should say about a persistently unsealed file.** Every install starts unsealed and seals on the
+  first write, so a warning would fire on a healthy install
+  ([/decisions/ad-034.md](/decisions/ad-034.md)). Whether a file that stays unsealed across sessions is worth
+  reporting needs a measurement nobody has.
+- **PHP in the supply-chain table.** Blocked by a name collision with a provider identifier, not by a design
+  problem ([/decisions/ad-075.md](/decisions/ad-075.md)). Dodging the word would be worse than the gap.
+- **The release workflow.** It needs an app installed and two secrets added, which nothing in this repository can
+  do.

package/docs/decisions/ad-081.md

@@ -0,0 +1,70 @@
+---
+type: Decision
+title: "AD-081 — The manifest npm publishes is checked here, because the release runner was the only thing reading it"
+description: "package.json declared ./bin/tlc.mjs and npm dropped both executables on publish, so the package would have installed no command at all. A gate step now uses npm's own normaliser as the oracle: any field npm would rewrite fails the build, not just the one spelling that was wrong."
+tags: [decision, release, gates, packaging]
+timestamp: "2026-08-19"
+---
+
+# AD-081 — The manifest npm publishes is checked here, because the release runner was the only thing reading it
+
+- **status**: active
+
+## Decision
+
+1. **A gate step checks the published manifest**, `tools/dev/check-manifest.ts`.
+2. **The oracle is `npm pkg fix` against a copy**, not a rule of ours about which spellings npm dislikes. Any
+   difference fails.
+3. **The gate never edits `package.json`** — the normaliser runs against a copy in a temp directory.
+4. **A `bin` target that does not exist is a separate failure**, because npm checks the shape of the path and never
+   the file.
+5. **`bin` values lose the `./` prefix**: `bin/tlc.mjs`, `bin/tlc-exec.mjs`.
+
+## Why
+
+**The package would have installed no command.** `bin` declared `./bin/tlc.mjs` and `./bin/tlc-exec.mjs`, and npm
+removed both entries on publish — `"bin[tlc]" script name bin/tlc.mjs was invalid and removed`. Measured in a
+fixture: `./bin/x.mjs` removed, `bin/x.mjs` accepted, `./bin/x` removed. So the prefix was the whole cause, and the
+effect was total: `npm i -g` would have installed a package with no `tlc` and no `tlc-exec`.
+
+**Nothing here could see it, and the one thing that could was a warning on a failing build.** The defect surfaced
+in the release runner's log, above an unrelated `E404` that was what everyone looked at. A `--dry-run` locally
+reproduces it in about a second, which means the only reason it shipped is that nothing ran one. That is the same
+shape as every drift this project has gated: a fact with an exact answer somewhere, and no mechanism that reads it
+([/decisions/ad-080.md](/decisions/ad-080.md)).
+
+**The oracle has to be npm's, or the check is a guess about someone else's normaliser.** A rule of the form
+"reject `./` in `bin`" closes the instance. `npm pkg fix` is the command npm's own warning tells you to run, so it
+is the same code that rewrote the manifest — which closes the class. Any field npm would correct fails here, not
+just `bin`, and a future npm that corrects something new fails on the version the contributor is running rather
+than in a release. Measured on the corrected manifest: zero difference, so the check is not noisy.
+
+**Measuring must not fix.** The normaliser writes, so it runs against a copy. A gate that repaired what it measured
+would pass on a repository that is still wrong, and the pass would be one it caused.
+
+**Existence is ours to check because npm does not.** npm validated the *shape* of the path and said nothing about
+whether a file is there. A `bin` pointing at a missing file publishes a command that fails on first run, which is
+worse than one npm removed — a removed bin fails visibly at install, a dangling one fails in the user's terminal.
+
+## Trade-offs
+
+**The gate now shells out to `npm`.** It is the first step that depends on a tool outside the repository's own
+dependencies, and its verdict is that npm's verdict. A contributor on an older npm gets an older opinion — which is
+the correct failure mode, because the version that matters is the one CI publishes with, and CI runs `npm@latest`
+before publishing. The alternative was vendoring a normaliser and inheriting the job of keeping it in step.
+
+**A temp directory per run.** `mkdtemp` and one file copy, and nothing removes it. That is deliberate: a gate that
+deletes paths it computed is the shape the floor refuses for good reason, and the operating system's temp policy is
+better at this than a `rm` in a checker.
+
+**`npm pkg fix` may one day correct something we intended.** Then this fails and the answer is to read the diff and
+decide, which is the point. A field we want that npm rewrites is not a field we can publish.
+
+## Not decided here
+
+- **Whether the gate should run a full `npm publish --dry-run`.** It would also validate the file list and the
+  tarball, and it costs about a second and packs 1.6 MB on every gate run. The manifest was the part that was
+  wrong; the file list is already checked by `check-docs-bundle` and the `files` array is read by nothing else.
+- **The `keywords` array's formatting.** The release bot rewrote it from one line to six and the gate accepted
+  both, so nothing is enforced. It will keep flipping with each release until something cares.
+- **Publishing the first version.** It cannot come from CI ([/decisions/ad-082.md](/decisions/ad-082.md)).

package/docs/decisions/ad-082.md

@@ -0,0 +1,79 @@
+---
+type: Decision
+title: "AD-082 — npm is the documented install, and the first version cannot come from CI"
+description: "The repository is public, so the credentialled bootstrap of the private phase is gone from every document and npm is the single route a user is told about. The first published version has to be pushed by hand: npm only lets a trusted publisher be configured on a package that already exists."
+tags: [decision, install, release, npm]
+timestamp: "2026-08-19"
+---
+
+# AD-082 — npm is the documented install, and the first version cannot come from CI
+
+- **status**: active
+
+## Decision
+
+1. **`npm i -g @tech-leads-club/harness-toolkit` then `tlc harness install` is the documented install**, on every
+   platform. It replaces the `curl | bash` and `irm | iex` one-liners in the README, `CONTRIBUTING.md` and
+   [/diagnose.md](/diagnose.md).
+2. **The credentialled bootstrap is deleted from every document.** `gh api …/contents/install.sh | base64 -d | bash`
+   existed only because an unauthenticated fetch cannot read a private repository, which stopped being true.
+3. **Recovery from a stuck runtime is the package**, not a script fetched from `raw.githubusercontent.com`.
+4. **The first published version is pushed by hand**, once, and every version after it comes from CI.
+5. **The scripts stay in the repository for now** as the contributor install, and the removal is separate work.
+
+## Why
+
+**This is the switch [/decisions/ad-052.md](/decisions/ad-052.md) said would be a visibility change and nothing
+else.** It carried both install routes so that going public would not need a commit nobody would remember to make.
+The routes were labelled with which applied; the private one now applies to nothing, and a document that offers a
+reader two routes when one is dead is worse than one that offers a single working route. Measured after the
+visibility change: `install.sh` and `install.ps1` both answer `HTTP 200` from `raw.githubusercontent.com`, so the
+public route works — and it is still not the one to document, because the package exists.
+
+**The first version cannot come from the pipeline, and this is npm's constraint rather than ours.** The publish
+failed with `404 Not Found - PUT`, which reads as a permissions problem and is not one: npm's UI only offers the
+trusted-publisher setting on a package that already exists, so there is no way to authorise the workflow for a name
+that has never been published ([npm/cli#8544](https://github.com/npm/cli/issues/8544), open). The OIDC exchange
+itself was working — the provenance statement was signed and published to the transparency log before the PUT was
+refused. So the sequence is: publish once by hand, configure the trusted publisher, and every release after that is
+unattended.
+
+**Provenance needed the repository to be public, which it now is.** npm's own words: *"Provenance generation is not
+supported for private repositories, even when publishing public packages."* `publishConfig.provenance` stays `true`
+because the condition it needs is now met — and the by-hand first publish has to turn it off for that one run,
+since provenance is generated from a CI identity that a laptop does not have.
+
+**The rest of the delivery mechanism was already built.** [/decisions/ad-056.md](/decisions/ad-056.md) made the
+package a delivery vehicle, `tlc harness install` materialise the runtime at `~/.tlc/harness`, and `update` bump the
+package rather than run git against it. `doctor` already reports `installed from npm` as healthy. Documenting npm is
+therefore a docs change plus one message class, not a migration.
+
+## Trade-offs
+
+**The documented install names something not yet on the registry.** For the window between this commit and the
+by-hand publish, the README's first command fails. The alternative — documenting `curl | bash` for one more release
+— means writing the private-phase paragraph a third time and removing it again, and this record is what the reader
+who hits that window needs.
+
+**Two scripts stay in the tree while the docs stop mentioning them.** They are not dead: run from a checkout,
+`install.sh` links the runtime at the clone, which is the contributor install and how live edits reach a hook. And
+on Windows `tlc harness update` shells out to `install.ps1` to redo the CLI shim, the skill link and the hooks —
+the POSIX branch does that inline, the Windows branch does not. Deleting them means porting that branch into the
+CLI, and that only proves out in Windows CI. Doing it in the same commit as a publish would mix a platform
+refactor into a release.
+
+**A by-hand publish is a credential on somebody's laptop, once.** That is the thing trusted publishing exists to
+remove, and it cannot be avoided for the first version. Its blast radius is one version of one package, and the
+version published by hand is the one a tag already points at.
+
+## Not decided here
+
+- **Removing `install.sh` and `install.ps1`.** It needs the Windows branch of `update` ported into the CLI first,
+  and a contributor route that replaces "run the script from your checkout".
+- **Whether `dist/` should still be committed.** It is 4.4 MB across 24 tracked files, and it exists for the Node
+  fallback in a cloned runtime. A package built at publish time does not need it in git — but `check-dist-fresh`,
+  `tlc harness build` and the clone route all read it, so it is its own decision.
+- **The `managed` runtime kind.** Nothing creates one once the scripts are gone, but installs and forks that
+  predate this do, and classifying them wrong is worse than a variant that stops being produced.
+- **Publishing from a tag rather than a branch.** The by-hand publish will be of a tag CI created, which is the
+  behaviour wanted; nothing enforces it.

package/docs/decisions/ad-083.md

@@ -0,0 +1,88 @@
+---
+type: Decision
+title: "AD-083 — Going public switched the branch ruleset on, and an unattended release needs the App to bypass it"
+description: "The release PR merged fine while the repository was private and stopped the moment it went public: the ruleset only started applying then. It allows rebase and nothing else, and it asks for an approving review a bot cannot give itself. The App becomes a bypass actor and the merge switches to rebase."
+tags: [decision, release, ci, github]
+timestamp: "2026-08-19"
+---
+
+# AD-083 — Going public switched the branch ruleset on, and an unattended release needs the App to bypass it
+
+- **status**: active
+
+## Decision
+
+1. **The release PR is merged with `--rebase`.** The ruleset sets `allowed_merge_methods: ["rebase"]`, and the
+   repository has squash and merge-commit off.
+2. **The release App is a bypass actor** on the `Default` branch ruleset, as `Integration` with
+   `bypass_mode: always`. The four rules it guards are unchanged.
+3. **A merge that still fails names the review requirement**, rather than exiting on gh's transport-shaped error.
+4. **Auto-merge is enabled on the repository**, and `--auto` is the path. The direct merge is the fallback and it
+   cannot succeed under this ruleset.
+5. **The release PR needs one approving review, and no bot can give it.** A release is unattended up to the
+   approval and attended at it.
+
+## Why
+
+**The same workflow merged release 0.2.0 and refused 0.2.1, and nothing about the workflow changed between them.**
+What changed is that the repository went public in between. Measured on the failing run: `Auto merge is not allowed
+for this repository (enablePullRequestAutoMerge)`, then `Pull request #2 is not mergeable: the base branch policy
+prohibits the merge`. Reading the ruleset explains both — `allowed_merge_methods: ["rebase"]`,
+`required_approving_review_count: 1`, `require_last_push_approval: true`,
+`required_review_thread_resolution: true` — and the repository has `allow_squash_merge: false` with
+`allow_rebase_merge: true`. So the workflow had been asking for a merge method the repository does not offer, and
+had been getting away with it only because the rules were not being applied.
+
+**Auto-merge was half the fix, and this record first said it was none of it.** That claim was written before it was
+tried, and trying it refuted the reasoning: with `allow_auto_merge: false` the `--auto` attempt is refused outright
+(`Auto merge is not allowed for this repository`) and the fallback direct merge is refused by the policy, so the job
+had no path at all. Turning it on gave `--auto` a path — `release PR #2 set to auto-merge` — and the PR then sat
+armed, waiting. What it was waiting for was the review, so the original conclusion was right about *what* blocks and
+wrong about *whether the setting mattered*. Both were needed.
+
+**A bypass actor does not cover an approving review.** The existing bypass list is `OrganizationAdmin` and
+`RepositoryRole: 5` (admin), and an App holds neither — it is not a member and has no repository role, so it
+inherits nothing from the admin entry. Adding it as `Integration` with `bypass_mode: always` was necessary and not
+sufficient: measured with the App on the bypass list, all three CI jobs green and auto-merge armed, the PR still
+read `reviewDecision: REVIEW_REQUIRED` and `mergeStateStatus: BLOCKED`. A bypass lets the bot act; it does not
+manufacture the approval the rule asks for.
+
+**The comparison that settled it was the repository this was supposed to copy.** `agent-skills` has the same
+ruleset — one approval, rebase only, `require_last_push_approval` — and the same App on its bypass list with the
+same mode. It releases unattended because **it opens no release PR at all**: its `release` job runs on the push to
+`main`, commits with the App token and publishes, so the bypass is exercised as a direct write to a protected branch
+and no review is ever requested. Our release is PR-shaped by choice
+([/decisions/ad-054.md](/decisions/ad-054.md), [/decisions/ad-057.md](/decisions/ad-057.md)), and a PR under this
+ruleset needs a human. That is the trade, stated rather than discovered again.
+
+**The failure message earns its place.** `gh pr merge` reports a policy refusal in the shape of a transport error,
+and the first reading of it cost a wrong diagnosis — the run was called a permissions problem twice before the
+ruleset was read. The workflow now says which of the two causes it is, so the next person reads the answer instead
+of re-deriving it.
+
+## Trade-offs
+
+**The bot can now write to `main` without review.** That is a real grant and not a formality. What bounds it is
+that the App token is minted inside `release.yml` and nowhere else, and the content of the PR it merges is
+generated — a version bump and a rendered changelog. It is the same trust already given to any workflow holding
+`contents: write`, made explicit at the ruleset instead of implicit in a token.
+
+**A rebase rewrites the release commit.** The ruleset also requires linear history, so this is the method that
+agrees with the rest of it; but the commit that lands is not byte-identical to the one on the PR branch, and a
+signature on the original would not survive.
+
+**Reading a ruleset is not something the repository can do for itself.** This record is the only place the four
+values are written down, and a change made in the GitHub UI will not update it. That is the same staleness the
+coverage page admits to ([/decisions/ad-079.md](/decisions/ad-079.md)) and there is no mechanism to fix it here.
+
+## Not decided here
+
+- **Whether the approval should be removed for release PRs.** Setting `required_approving_review_count` to `0` makes
+  the release unattended and removes the review requirement from every other pull request too, because the rule is
+  per-ruleset and not per-author. Dropping the PR and writing to `main` the way `agent-skills` does is the other
+  answer, and it discards the thing the PR was chosen for.
+- **Whether CI should be a required check.** With none, `--auto` waits only on the review. The publish job runs the
+  full gate again on the tag before publishing, so nothing unverified reaches the registry — but that ordering is
+  incidental rather than designed.
+- **Narrowing the bypass to a ruleset that only covers release commits.** GitHub scopes bypass per ruleset, not per
+  actor per path, so this would mean a second ruleset and a way to tell release pushes apart.

package/docs/decisions/index.md

@@ -0,0 +1,111 @@
+---
+type: Aggregate
+title: "Decisions index"
+description: "Index of every architectural decision made while building the multi-provider harness, by number. See /log.md for the same records by date."
+tags: [decisions, index]
+timestamp: "2026-07-29"
+---
+
+# Decisions
+
+Each architectural decision (AD) lives in its own file, cross-linked from here. This index replaces the
+`## Decisions` section that used to live in `.specs/STATE.md` — see [/index.md](/index.md) for the rest of
+the documentation bundle. `.specs/STATE.md` (outside this bundle, at the repo root) now keeps only the
+Handoff section and a link back to this index.
+
+| # | Title | Status |
+| --- | --- | --- |
+| [AD-001](/decisions/ad-001.md) | Optional parent-Fast sticky deny for Task spawns | active |
+| [AD-002](/decisions/ad-002.md) | Provider-neutral naming and layout | active |
+| [AD-003](/decisions/ad-003.md) | No backward compatibility | active |
+| [AD-004](/decisions/ad-004.md) | Ports and adapters with an anti-corruption layer per provider | active |
+| [AD-005](/decisions/ad-005.md) | Local test runner is the gate; CI matrix runs on every push | active |
+| [AD-006](/decisions/ad-006.md) | Windows is covered by CI, minus the installer and the editor end | active |
+| [AD-007](/decisions/ad-007.md) | Vendor check applies to core tests; absence checks do not | active |
+| [AD-008](/decisions/ad-008.md) | Biome + TypeScript in the gate; `@types/node` pinned to the declared floor | active |
+| [AD-009](/decisions/ad-009.md) | Event kinds are provider-agnostic; capabilities are data, not flags | active |
+| [AD-010](/decisions/ad-010.md) | Shared vocabulary moves to `src/contracts/` | active |
+| [AD-011](/decisions/ad-011.md) | Vendor-specific data belongs to the provider, not to core | active |
+| [AD-012](/decisions/ad-012.md) | Prefer Bun at runtime, keep `dist/` for the Node fallback, ship no binary | active |
+| [AD-013](/decisions/ad-013.md) | Documentation follows the Open Knowledge Format (OKF v0.1) | active |
+| [AD-014](/decisions/ad-014.md) | Claude Code hook payload field paths, pinned | active |
+| [AD-015](/decisions/ad-015.md) | Wiring handler names are the entrypoint filenames | active |
+| [AD-016](/decisions/ad-016.md) | Field semantics, state writers, and the core export surface | active |
+| [AD-017](/decisions/ad-017.md) | The docs gate delegates to the project's tool, and the catalog is the only source of capability metadata | active |
+| [AD-018](/decisions/ad-018.md) | Three rails adopted from an external review, each off by default and declared rather than inferred | active |
+| [AD-019](/decisions/ad-019.md) | A resource is identified by what it resolves to, and a declared capability must be read where it matters | active |
+| [AD-020](/decisions/ad-020.md) | One resolution for the install path, one source for posture, and a config that only advertises what it reads | active |
+| [AD-021](/decisions/ad-021.md) | A gate command that never resolved is a config fault, and a recipe runner does not receive file arguments | active |
+| [AD-022](/decisions/ad-022.md) | The policy surface is a floor rule, detection sits behind interception, and the operator/agent line is structural | active |
+| [AD-023](/decisions/ad-023.md) | One finding per failure, and lesson relevance is recurrence rather than exposure | active |
+| [AD-024](/decisions/ad-024.md) | The gate tells the truth about its own environment, its own lock, and the cause of a failure | active |
+| [AD-025](/decisions/ad-025.md) | Posture governs surfacing only, and each posture has exactly one name | active |
+| [AD-026](/decisions/ad-026.md) | An interruption is worth what it costs: narrower asks, a deadline on questions, and a rate the operator can see | active |
+| [AD-027](/decisions/ad-027.md) | Evidence is ordered against the code, every rail's firing is recorded, and a checker can run with its rule off | active |
+| [AD-028](/decisions/ad-028.md) | A resolved failure is kept, a session attests to itself, and provider neutrality becomes a proof | active |
+| [AD-029](/decisions/ad-029.md) | A capability the init skill cannot correctly initialise is not shipped | active |
+| [AD-030](/decisions/ad-030.md) | Clearing a policy divergence is one operator command behind four independent locks, and a refusal never points an agent at a door the floor holds shut | active |
+| [AD-031](/decisions/ad-031.md) | The decisions are the changelog, a breaking change carries its own instruction, and looking never changes anything | active |
+| [AD-032](/decisions/ad-032.md) | A hook is healthy when it can run, not when a marker string is present | active |
+| [AD-033](/decisions/ad-033.md) | The gate says what it costs, appendFiles stops promising what it cannot deliver, and a dead capability leaves | active |
+| [AD-034](/decisions/ad-034.md) | A warning that fires on a healthy install is not a warning, and the author reads the operator's output before anyone else does | active |
+| [AD-035](/decisions/ad-035.md) | A lesson learned by reasoning can be written down, and the harness never learns where lessons come from | active |
+| [AD-036](/decisions/ad-036.md) | A lesson names what makes it true, and stops being injected when that is gone | active |
+| [AD-037](/decisions/ad-037.md) | A lesson can be true for a period, and an unparseable bound withholds it | active |
+| [AD-038](/decisions/ad-038.md) | Promotion counts distinct sessions, because one stuck session is one observation | active |
+| [AD-039](/decisions/ad-039.md) | A lesson is graded by the gate it was injected for, and unproven is not a passing reading | active |
+| [AD-040](/decisions/ad-040.md) | Three lesson tiers, and nothing crosses between products by itself | active |
+| [AD-041](/decisions/ad-041.md) | A member something reads and nothing writes fails the gate | active |
+| [AD-042](/decisions/ad-042.md) | The suite gets an empty runtime home, and one renderer renders a lesson | active |
+| [AD-043](/decisions/ad-043.md) | A standing rule is pinned, not ranked, and the budget says what it dropped | active |
+| [AD-044](/decisions/ad-044.md) | Only an injection a gate could grade can be unproven | active |
+| [AD-045](/decisions/ad-045.md) | A gate verdict is reused when the content hash of its inputs did not change | active |
+| [AD-046](/decisions/ad-046.md) | The runtime path is an artifact, and update never touches what it does not own | active |
+| [AD-047](/decisions/ad-047.md) | An instruction is not an affordance, and a refusal names the route that works | active |
+| [AD-048](/decisions/ad-048.md) | A broken updater cannot deliver its own fix, so the installer is the recovery route | active |
+| [AD-049](/decisions/ad-049.md) | An empty synced file says which of four reasons made it empty | active |
+| [AD-050](/decisions/ad-050.md) | Lesson transport is a provider capability, not an operator preference | active |
+| [AD-051](/decisions/ad-051.md) | A warning fails the gate, and a suppression states what breaks without it | active |
+| [AD-052](/decisions/ad-052.md) | The repository moves to the org and the runtime paths do not | active |
+| [AD-053](/decisions/ad-053.md) | The harness ships no model allowlist, and a list that names nothing enforces nothing | active |
+| [AD-054](/decisions/ad-054.md) | npm is the distribution, and a merged release PR is the only thing that publishes | active |
+| [AD-055](/decisions/ad-055.md) | The changelog is rendered from the decision records, and git says which release each landed in | active |
+| [AD-056](/decisions/ad-056.md) | The package delivers the runtime, and the runtime path stays where hooks already point | active |
+| [AD-057](/decisions/ad-057.md) | The release PR is a mechanism, not a gate, and the bot merges it | active |
+| [AD-058](/decisions/ad-058.md) | Gates diff against the turn's base, and language knowledge is one table | active |
+| [AD-059](/decisions/ad-059.md) | A rail never writes a field it reads, and a counter reads the plane its events land on | active |
+| [AD-060](/decisions/ad-060.md) | The gate records the environment it ran under, and names it only once the cheap explanations are spent | active |
+| [AD-061](/decisions/ad-061.md) | A decision that refuses names its rule, and degrading preserves it | active |
+| [AD-062](/decisions/ad-062.md) | One command answers whether the harness did that, and says so plainly when it did not | active |
+| [AD-063](/decisions/ad-063.md) | One palette for human output, and a checker keeping it out of everything else | active |
+| [AD-064](/decisions/ad-064.md) | A snapshot is assigned, never accumulated, and a table does not list what it cannot count | active |
+| [AD-065](/decisions/ad-065.md) | The obs bus has a contract, and the gate checks both sides of it | active |
+| [AD-066](/decisions/ad-066.md) | Uninstall reads the artefact, and the plan is the confirmation | active |
+| [AD-067](/decisions/ad-067.md) | A reserved file that cannot be retired is rendered, and the gate holds it there | active |
+| [AD-068](/decisions/ad-068.md) | A directory decides what ships, and dist is derived from disk in both directions | active |
+| [AD-069](/decisions/ad-069.md) | A decision record declares its shape, and cites by link so a move cannot break it | active |
+| [AD-070](/decisions/ad-070.md) | A comment has to read for somebody who was not in the session | active |
+| [AD-071](/decisions/ad-071.md) | The turn's added lines are checked against the code the project already has | active |
+| [AD-072](/decisions/ad-072.md) | A record can leave the corpus, and removing is a change worth recording | active |
+| [AD-073](/decisions/ad-073.md) | A neighbour mid-gate is not a reason to block a turn | active |
+| [AD-074](/decisions/ad-074.md) | Code the gate cannot read is refused, and a credential is not always a file | active |
+| [AD-075](/decisions/ad-075.md) | A dependency a turn adds outlives the turn, so two mechanical failures are worth a stop | active |
+| [AD-076](/decisions/ad-076.md) | Goal-hijack enforcement needs the tool output, and the host does not deliver it | active |
+| [AD-077](/decisions/ad-077.md) | A command that appears verbatim in fetched content is put to the operator | active |
+| [AD-078](/decisions/ad-078.md) | The two files the harness reads aloud are sealed on write and verified on injection | active |
+| [AD-079](/decisions/ad-079.md) | The coverage claim is a generated page with its gaps in it, not a badge in the README | active |
+| [AD-080](/decisions/ad-080.md) | Every hand-written list of our own rules is now checked, including the one that drifted while writing this | active |
+| [AD-081](/decisions/ad-081.md) | The manifest npm publishes is checked here, because the release runner was the only thing reading it | active |
+| [AD-082](/decisions/ad-082.md) | npm is the documented install, and the first version cannot come from CI | active |
+| [AD-083](/decisions/ad-083.md) | Going public switched the branch ruleset on, and an unattended release needs the App to bypass it | active |
+
+## Archived
+
+A record moves here when its decision is complete and its body would no longer guide a future change. It keeps
+its row in `CHANGELOG.md` and in [/log.md](/log.md), because it shipped; this index is the only view that
+separates the two, because it is the only one that claims to say what currently binds. Value decides, never
+volume — see the archive rule in `CONTRIBUTING.md`.
+
+None yet.
+
+Related: [/architecture.md](/architecture.md), [/concepts.md](/concepts.md), [/providers/index.md](/providers/index.md).