@windyroad/architect 0.11.0 → 0.12.0

package/.claude-plugin/plugin.json

@@ -123,5 +123,5 @@
     }
   },
   "name": "wr-architect",
-  "version": "0.11.0"
+  "version": "0.12.0"
 }

package/agents/agent.md

@@ -159,12 +159,13 @@ Do NOT emit Needs Direction for the "obvious choice" / only-one-viable-option ca
 
 ### When to flag [Unratified Dependency] (ADR-074 (Confirm a decision's substance before building dependent work) surface 3)
 
-When the change or plan under review **explicitly cites or implements** a specific ADR (e.g. the diff/prose says "per ADR-072", a `Refs: ADR-NNN`, or it is authoring the work the ADR governs), check whether that ADR has been **ratified** before letting the change stand. You have Read/Glob/Grep (no Bash), so perform the **read-only equivalent** of `packages/architect/scripts/is-decision-unconfirmed.sh` — mirror BOTH halves of its "unconfirmed" definition:
+When the change or plan under review **explicitly cites or implements** a specific ADR (e.g. the diff/prose says "per ADR-072", a `Refs: ADR-NNN`, or it is authoring the work the ADR governs), check whether that ADR has been **ratified** before letting the change stand. You have Read/Glob/Grep (no Bash), so perform the **read-only equivalent** of `packages/architect/scripts/is-decision-unconfirmed.sh` — mirror ALL THREE halves of its "unconfirmed" definition:
 
 1. **Frontmatter-scoped marker check.** Read the cited ADR file and inspect ONLY its YAML frontmatter (the block between the leading `---` and the next `---`). The ADR is **ratified** iff that frontmatter contains a line matching `human-oversight: confirmed` — case-insensitive, tolerating trailing whitespace (the canonical predicate greps `-iE '^human-oversight:[[:space:]]*confirmed[[:space:]]*$'`). A body mention of that string does NOT count — it must be in frontmatter.
 2. **Superseded skip.** A `*.superseded.md` ADR is retired — treat it as ratified-equivalent (do NOT flag); a newer ADR replaced it.
+3. **Rejected-pending-supersede skip** (ADR-066 amendment per P316). An ADR whose frontmatter carries BOTH `human-oversight: rejected-pending-supersede` AND `supersede-ticket: P<NNN>` is ratified-equivalent — the user has explicitly rejected the ADR and pinned a supersede in flight. Treat as ratified (do NOT flag). The marker alone (without the `supersede-ticket:` scalar) does NOT skip — it is malformed and surfaces as unratified so the un-tracked case doesn't silently rot.
 
-Emit **ISSUES FOUND / [Unratified Dependency]** only when the cited ADR's frontmatter lacks the marker AND it is not superseded — action: "ratify ADR-NNN via `/wr-architect:review-decisions` before this lands." 
+Emit **ISSUES FOUND / [Unratified Dependency]** only when the cited ADR's frontmatter lacks the `confirmed` marker AND it is not superseded AND it does not carry the rejected-pending-supersede + supersede-ticket pair — action: "ratify ADR-NNN via `/wr-architect:review-decisions` before this lands." 
 
 **Key the flag on the oversight marker, NEVER on `status:`.** `status: proposed`/`accepted` and `human-oversight:` are orthogonal axes (ADR-066). Building on a **ratified** ADR is fine even when its `status` is still `proposed` — do NOT flag it. Only the *unratified* (marker-absent, non-superseded) case flags. In steady state almost every ADR is ratified (born-confirmed via `create-adr` + the review-decisions drain), so this fires on essentially nothing — do not over-scan or flag transitive/ambient dependence on governed code, only an explicit cite/implement of a specific unratified ADR (the inverse-P078 / P132 over-fire guard).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/architect",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Architecture decision enforcement for AI coding agents",
   "bin": {
     "windyroad-architect": "./bin/install.mjs"

package/scripts/detect-unoversighted.sh

@@ -45,7 +45,18 @@ for f in "$DECISIONS_DIR"/*.md "$DECISIONS_DIR"/*/*.md; do
     { print }
   ' "$f")"
 
-  if ! printf '%s\n' "$fm" | grep -qiE '^human-oversight:[[:space:]]*confirmed[[:space:]]*$'; then
-    echo "$f"
+  if printf '%s\n' "$fm" | grep -qiE '^human-oversight:[[:space:]]*confirmed[[:space:]]*$'; then
+    continue
   fi
+
+  # ADR-066 amendment (P316): rejected-pending-supersede is a third oversight
+  # value. Exclude only when BOTH the marker AND a supersede-ticket: P<NNN>
+  # scalar are present in frontmatter — a marker without the ticket is
+  # malformed and still surfaces so the drain catches the un-tracked case.
+  if printf '%s\n' "$fm" | grep -qiE '^human-oversight:[[:space:]]*rejected-pending-supersede[[:space:]]*$' \
+     && printf '%s\n' "$fm" | grep -qiE '^supersede-ticket:[[:space:]]*P[0-9]+[[:space:]]*$'; then
+    continue
+  fi
+
+  echo "$f"
 done | sort

package/scripts/generate-decisions-compendium.sh

@@ -195,7 +195,7 @@ truncate_with_ellipsis() {
 
 emit_entry() {
     local file="$1"
-    local id title status oversight superseded
+    local id title status oversight superseded supersede_ticket
     local chosen drivers confirmation related
 
     id=$(basename "$file" | grep -oE '^[0-9]+')
@@ -203,6 +203,11 @@ emit_entry() {
     status=$(get_frontmatter_field "$file" "status")
     oversight=$(get_frontmatter_field "$file" "human-oversight")
     superseded=$(get_frontmatter_field "$file" "supersedes")
+    # ADR-066 amendment (P316): when the oversight value is
+    # `rejected-pending-supersede`, surface the tracking ticket parenthetically
+    # so the compendium badge shows both the disposition AND the supersede in
+    # flight without a per-ADR body read.
+    supersede_ticket=$(get_frontmatter_field "$file" "supersede-ticket")
 
     # Chosen-option line — truncate to a comfortable summary length.
     chosen=$(get_chosen "$file" | strip_links | oneline)
@@ -229,7 +234,11 @@ emit_entry() {
         # Status / oversight / supersession badges on one compact line.
         local badges="**Status:** ${status:-?}"
         if [ -n "$oversight" ]; then
-            badges="${badges} | **Oversight:** ${oversight}"
+            if [ "$oversight" = "rejected-pending-supersede" ] && [ -n "$supersede_ticket" ]; then
+                badges="${badges} | **Oversight:** ${oversight} (${supersede_ticket})"
+            else
+                badges="${badges} | **Oversight:** ${oversight}"
+            fi
         fi
         if [ -n "$superseded" ] && [ "$superseded" != "[]" ]; then
             badges="${badges} | **Supersedes:** ${superseded}"

package/scripts/is-decision-unconfirmed.sh

@@ -76,6 +76,16 @@ if printf '%s\n' "$fm" | grep -qiE '^human-oversight:[[:space:]]*confirmed[[:spa
   exit 1   # confirmed — OK to build on
 fi
 
+# ADR-066 amendment (P316): rejected-pending-supersede with a tracked
+# supersede-ticket is "ratified-equivalent" for the build-upon guard — the
+# user has explicitly rejected the ADR and pinned a supersede in flight, so
+# the [Unratified Dependency] flag must NOT re-fire on the rejected ADR.
+# Marker without ticket is malformed and still fires (defensive).
+if printf '%s\n' "$fm" | grep -qiE '^human-oversight:[[:space:]]*rejected-pending-supersede[[:space:]]*$' \
+   && printf '%s\n' "$fm" | grep -qiE '^supersede-ticket:[[:space:]]*P[0-9]+[[:space:]]*$'; then
+  exit 1
+fi
+
 # Unconfirmed — the build-upon guard SHOULD fire. Name the file for the guard.
 echo "$file"
 exit 0

package/scripts/test/detect-unoversighted.bats

@@ -97,3 +97,43 @@ mk() { # mk <filename> <frontmatter-extra-lines...>
   [ "$status" -eq 0 ]
   [ -z "$output" ]
 }
+
+# ADR-066 amendment (P316): rejected-pending-supersede is a third oversight
+# value alongside `confirmed` and absent. It exists so the drain stops crying
+# wolf on ADRs the user has explicitly rejected with a tracked supersede
+# ticket (otherwise they re-surface every drain until the supersede ADR
+# lands). Exclusion is conditional on BOTH the marker AND a supersede-ticket
+# scalar being present — a marker without a ticket is malformed and still
+# surfaces (defensive, JTBD-201/202 audit-trail guard).
+
+@test "rejected-pending-supersede WITH supersede-ticket is excluded" {
+  mk "020-rejected-tracked.proposed.md" \
+    "human-oversight: rejected-pending-supersede" \
+    "supersede-ticket: P297"
+  run bash "$SCRIPT" "$DIR/docs/decisions"
+  [ "$status" -eq 0 ]
+  [[ "$output" != *"020-rejected-tracked.proposed.md"* ]]
+}
+
+@test "rejected-pending-supersede WITHOUT supersede-ticket still surfaces (defensive)" {
+  mk "021-rejected-untracked.proposed.md" \
+    "human-oversight: rejected-pending-supersede"
+  run bash "$SCRIPT" "$DIR/docs/decisions"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"021-rejected-untracked.proposed.md"* ]]
+}
+
+@test "supersede-ticket alone (without the rejected marker) does NOT exclude" {
+  mk "022-ticket-only.proposed.md" "supersede-ticket: P297"
+  run bash "$SCRIPT" "$DIR/docs/decisions"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"022-ticket-only.proposed.md"* ]]
+}
+
+@test "rejected-pending-supersede match tolerates trailing whitespace" {
+  mk "023-spacey.proposed.md" \
+    "human-oversight:   rejected-pending-supersede   " \
+    "supersede-ticket:   P297   "
+  run bash "$SCRIPT" "$DIR/docs/decisions"
+  [[ "$output" != *"023-spacey.proposed.md"* ]]
+}

package/scripts/test/is-decision-unconfirmed.bats

@@ -106,3 +106,38 @@ mk() {
   [[ "$detect_out" != *"111-confirmed.proposed.md"* ]]
   run bash "$SCRIPT" "ADR-111" "$DIR/docs/decisions"; [ "$status" -eq 1 ]
 }
+
+# ADR-066 amendment (P316): mirror the rejected-pending-supersede exclusion.
+# The build-upon guard must NOT fire on an ADR the user explicitly rejected
+# with a tracked supersede ticket — otherwise the [Unratified Dependency]
+# verdict re-triggers on every iteration that touches the rejected ADR.
+
+@test "rejected-pending-supersede WITH supersede-ticket does NOT fire the guard (exit 1)" {
+  mk "120-rejected-tracked.proposed.md" "proposed" \
+    "human-oversight: rejected-pending-supersede" \
+    "supersede-ticket: P297"
+  run bash "$SCRIPT" "ADR-120" "$DIR/docs/decisions"
+  [ "$status" -eq 1 ]
+  [ -z "$output" ]
+}
+
+@test "rejected-pending-supersede WITHOUT supersede-ticket DOES fire the guard (exit 0)" {
+  mk "121-rejected-untracked.proposed.md" "proposed" \
+    "human-oversight: rejected-pending-supersede"
+  run bash "$SCRIPT" "ADR-121" "$DIR/docs/decisions"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"121-rejected-untracked.proposed.md"* ]]
+}
+
+@test "agrees with detect-unoversighted on rejected-pending-supersede (sync guard)" {
+  mk "130-rejected.proposed.md" "proposed" \
+    "human-oversight: rejected-pending-supersede" \
+    "supersede-ticket: P298"
+  mk "131-rejected-untracked.proposed.md" "proposed" \
+    "human-oversight: rejected-pending-supersede"
+  detect_out="$(bash "$DETECT" "$DIR/docs/decisions")"
+  [[ "$detect_out" != *"130-rejected.proposed.md"* ]]
+  run bash "$SCRIPT" "ADR-130" "$DIR/docs/decisions"; [ "$status" -eq 1 ]
+  [[ "$detect_out" == *"131-rejected-untracked.proposed.md"* ]]
+  run bash "$SCRIPT" "ADR-131" "$DIR/docs/decisions"; [ "$status" -eq 0 ]
+}

package/skills/review-decisions/SKILL.md

@@ -44,7 +44,7 @@ For each ADR in the ordered queue, surface the decision as an `AskUserQuestion`
 - **Options** (per ADR):
   - **Confirm** — the recorded decision is correct; write the marker.
   - **Amend** — the decision is mostly right but needs a change; capture the change, apply it to the ADR body, then write the marker.
-  - **Reject / supersede** — the auto-made pick is wrong; do NOT write the marker. Note the rework needed (a follow-up `/wr-architect:create-adr` supersede, or a problem ticket).
+  - **Reject / supersede** — the auto-made pick is wrong; capture the supersede ticket (see Step 4) and write the **rejected-pending-supersede** marker so the drain stops re-asking.
   - **Defer** — skip this sitting; leave unoversighted for a later run.
 
 This is a genuine human-decision surface (the whole point of P283) — `AskUserQuestion` is correct here and is NOT over-asking. Do not auto-confirm; do not prose-ask.
@@ -52,7 +52,10 @@ This is a genuine human-decision surface (the whole point of P283) — `AskUserQ
 ### Step 4: Apply the outcome
 
 - **Confirm / Amend**: write `human-oversight: confirmed` + `oversight-date: <today, YYYY-MM-DD>` into the ADR's frontmatter (insert after the `date:` line if absent; never duplicate). For Amend, apply the directed body change first. Both edits go through the standard architect / JTBD edit gate per ADR-014.
-- **Reject / supersede**: leave the marker absent. Record the rework (follow-up create-adr supersede or `/wr-itil:capture-problem`).
+- **Reject / supersede** (ADR-066 amendment per P316):
+  1. Capture the supersede ticket via a follow-up `AskUserQuestion`: "Which problem ticket tracks the supersede?" — options: existing `P<NNN>` IDs surfaced from `docs/problems/`, **Capture a new ticket** (delegate to `/wr-itil:capture-problem`), or **Defer (leave un-tracked for now)**.
+  2. If a ticket ID is captured, write `human-oversight: rejected-pending-supersede` + `supersede-ticket: P<NNN>` into the ADR's frontmatter. The detector excludes ADRs carrying both, so the drain stops re-asking until either the supersede ADR lands (status flips to `superseded`) or the rejection is revisited.
+  3. If the user defers ticket capture, leave the marker absent — the ADR re-surfaces next drain (the un-tracked case is intentionally re-asked so it doesn't silently rot).
 - **Defer**: no write.
 
 ### Step 5: Commit + report
@@ -61,7 +64,7 @@ Commit the confirmed/amended ADRs per ADR-014 (one commit for the sitting's drai
 
 ## Notes
 
-- **Never re-ask** — a confirmed ADR carries the marker permanently and is excluded from future runs (ADR-009 never-re-ask principle). The marker is write-once **except** when an ADR is materially amended after confirmation (the Decision Outcome is rewritten) — a supersede/amend clears it for re-confirmation per ADR-066 Reassessment.
+- **Never re-ask** — a confirmed ADR carries the marker permanently and is excluded from future runs (ADR-009 never-re-ask principle). The same write-once-permanence applies to the `rejected-pending-supersede` value (P316 amendment): once the user rejects with a tracked ticket, the drain stops asking. The marker is write-once **except** when an ADR is materially amended after confirmation (the Decision Outcome is rewritten) — a supersede/amend clears it for re-confirmation per ADR-066 Reassessment. When the supersede ADR eventually lands and the original flips to `*.superseded.md`, the existing superseded-status skip takes over; the `rejected-pending-supersede` lines become historical residue (no active clearance required).
 - **AFK** — this skill is interactive by construction (the confirm IS the human decision). It is not dispatched inside AFK iteration subprocesses; the session-start nudge self-suppresses there (`WR_SUPPRESS_OVERSIGHT_NUDGE=1`) so the drain is never half-run by an absent user.
 - **Born-confirmed going forward** — `/wr-architect:create-adr` writes the marker at its Step 5 confirm, so new ADRs enter the set already oversighted and the unoversighted count only shrinks.