ceo-orchestration 1.0.0

package/.claude/adr/ADR-102-mcp-introspection-extends-042.md

@@ -0,0 +1,165 @@
+# ADR-102 — MCP introspection tools extending ADR-042
+
+**Status:** ACCEPTED
+**Date:** 2026-05-05
+**Enforcement commit:** `317c824` (PLAN-070 ceremony S85, v1.13.0 GA)
+**Decision drivers:**
+
+- ADR-042 (ACCEPTED 2026-04-15, PLAN-013 Phase A) defines the MCP Server Contract over JSON-RPC stdio. Server already runs in production. PLAN-070 needed to add introspection tools (governance audit, canonical-edit guard, kill-switch) WITHOUT a new MCP contract or new transport.
+- Codex Round 3 cross-LLM gate (ADR-095 §gate-#6) caught a P0 BLIND SPOT all 4 Claude same-LLM passes missed: external MCP clients (Cursor / Codex CLI / `helmor` pattern) bypass Claude's `PreToolUse` hook entirely. A Layer A (intra-Claude hook matcher) without a Layer B (server-side middleware) leaves canonical paths unguarded for any external client.
+- Sec MF-3 6-field allowlist contract for audit emits (`tool_name`, `target_path`, `reason`, `timestamp`, `session_id`, `project`) to prevent side-channel leakage of unbounded text.
+- Stdlib-only at runtime (PLAN-070 §5; ADR-085 Claude-only positioning).
+
+## Context
+
+PLAN-068 v1 originally proposed a new MCP contract for introspection. Round 1 debate identified collision with ADR-042 (already-ACCEPTED MCP Server Contract). PLAN-070 was lifted from PLAN-068 Track-3 with the explicit reframing: **extend** ADR-042's contract surface with new introspection tools, do not create a parallel contract.
+
+Three architectural questions had to be answered:
+
+1. **Where does the canonical-edit guard live?** Claude's `PreToolUse` hook (Layer A) catches `Edit/Write/MultiEdit/NotebookEdit` but not `mcp__*` tools (per `feedback_custom_mcp_tools_governance_gap.md`, S81-tris). External clients also bypass Claude entirely.
+2. **What is the audit allowlist for the new emit actions?** New `mcp_canonical_guard_allowed/blocked` emits must not leak unbounded text (LLM06 side-channel guard).
+3. **What is the kill-switch contract?** A runtime-disabled MCP server must fail clean without exposing handlers.
+
+## Decision drivers
+
+- ADR-042 mandate: stdio-only transport; no HTTP; no new contract for extensions.
+- ADR-051 governance: canonical paths must remain guarded across all dispatch surfaces.
+- ADR-052 veto floor: Security and Code-Review hold supreme veto on auth/canonical-edit changes; Sec held VETO across PLAN-070 R1+R2+R3 until 6 conditions lifted.
+- ADR-095 §gate-#6 mandate: every L4 plan touching governance MUST pass cross-LLM Codex re-pass. PLAN-070 R3 Codex gate caught NG-06 (Layer B necessity) that 4 Claude passes missed.
+- ADR-098: audit emits must be hasattr-guarded so the script works in adopter installs that haven't run the v1.12.0 canonical ceremony yet.
+- ADR-100: trusted dependencies — stdlib-only at runtime.
+
+## Options considered
+
+### Option A: Layer A only (intra-Claude hook matcher)
+
+Extend `check_canonical_edit.py` with `mcp__*` matcher; rely on branch protection + CODEOWNERS + Claude's `PreToolUse` hook.
+
+- **(+)** Minimal surface; reuses existing hook infrastructure.
+- **(+)** Fail-OPEN safe — if matcher misfires, branch protection still catches downstream.
+- **(−)** External MCP clients (Cursor, Codex CLI, helmor) bypass `PreToolUse` entirely.
+- **(−)** Defense-in-depth violation: a single layer at the wrong trust boundary.
+
+### Option B: Layer B only (server-side middleware)
+
+`_lib/mcp/canonical_guard.py` invoked from `audit-mcp/server.py` dispatch.py pre-handler middleware. Skip the hook matcher.
+
+- **(+)** Universal — every MCP handler is guarded regardless of caller.
+- **(+)** Fail-CLOSED at the right boundary (server-side).
+- **(−)** Misses tool calls that don't reach the MCP server (intra-Claude direct edits via custom MCP tools that bypass server-side middleware via different IPC).
+- **(−)** Doesn't surface the block to the user inside Claude until it's too late.
+
+### Option C: Layer A + Layer B (defense-in-depth)
+
+Both. Layer A for intra-Claude UX (fail-OPEN, fast feedback). Layer B for inter-process external (fail-CLOSED, universal). Single source of truth via shared `_CANONICAL_GUARDS` patterns + sentinel verification logic.
+
+- **(+)** Catches all five known attack classes (intra-Claude, external client direct, external via Codex CLI, helmor pattern, future MCP transport variant).
+- **(+)** Each layer at its appropriate trust boundary.
+- **(+)** Codex Round 3 cross-LLM gate explicitly identified Option C as the only design that closes NG-06.
+- **(−)** Two implementations — drift risk if patterns aren't shared.
+- **(−)** ~998 LoC for `canonical_guard.py` (Codex apply_patch envelope + unified diff + JSON Patch RFC 6902 + repo_root anchor + traversal/symlink escape + authoritative-key gating).
+
+## Decision
+
+**Adopt Option C** — Layer A + Layer B with shared `_CANONICAL_GUARDS` source of truth.
+
+### Layer A — `check_canonical_edit.py` matcher extension
+
+Match condition: `(tool_name.startswith("mcp__") OR tool_name in {"Edit","Write","MultiEdit","NotebookEdit"}) AND params contains path-shaped key (path/file_path/target/uri)`. AND-of-both gate prevents false-positives on read-only MCP tools (e.g. `mcp__codex__codex` no-file-path call, `mcp__supabase__execute_sql`).
+
+Fail-OPEN OK at this layer — Layer B catches what slips through.
+
+### Layer B — `_lib/mcp/canonical_guard.py` middleware
+
+Server-side middleware invoked from `dispatch.py` pre-handler for every MCP handler whose response touches the filesystem OR whose handler arguments include path-shaped params. Recognizes:
+
+- Codex `apply_patch` envelope (incl. `*** Move to:` directive + colon-optional variants)
+- Unified diff format
+- JSON Patch RFC 6902 (`json.loads` decode of body string)
+- Plain path arguments
+
+Resolution rules:
+
+- `repo_root` anchor — refuse paths that escape the project tree
+- `is_relative_to` traversal/symlink escape detection
+- Authoritative-key gating (R5-01) — `apply_patch` resolves to `patch` before bare `diff`; corrupt binary / `{}` / `""` all resolve to `(paths=[], parsed=False)` → block (fail-CLOSED)
+
+Fail-CLOSED universal: any parse failure, any escape attempt, any unrecognized envelope → return `{"decision": "block"}`.
+
+Public API:
+
+```python
+def check_mcp_call(tool_name: str, params: dict) -> dict:
+    """Returns {"decision": "allow"|"block", "reason": str}."""
+```
+
+### Audit emit allowlist (Sec MF-3 contract)
+
+Two new audit actions registered in `audit_emit._KNOWN_ACTIONS`:
+
+- `mcp_canonical_guard_allowed`
+- `mcp_canonical_guard_blocked`
+
+Per-action allowlist conforms to Sec MF-3 6-field contract: `tool_name`, `target_path`, `reason`, `timestamp`, `session_id`, `project`. Auxiliary fields (`reason_code`, `file_path`, `sentinel`, `error`, token fields, HMAC fields, `ts`) currently included pending PLAN-076 Onda A item #4 tightening to the literal 6-field contract.
+
+### Kill-switch runtime contract
+
+`audit-mcp/server.py` first-line check (before any handler dispatch, before any imports beyond `os`/`sys`):
+
+```python
+import os, sys
+if os.environ.get("CEO_SOTA_DISABLE") == "1":
+    try:
+        from _lib.audit_emit import emit_generic
+        emit_generic("mcp_server_disabled_by_kill_switch",
+                     reason="CEO_SOTA_DISABLE=1")
+    except Exception:
+        pass
+    sys.exit(0)
+```
+
+Tested via `test_kill_switch.py` subprocess invocation; assert exit code 0; assert audit-log contains `mcp_server_disabled_by_kill_switch` event; assert no JSON-RPC handshake attempted.
+
+### Transport remains stdio-only
+
+PLAN-070 is STDIO-only per ADR-042 §Transport.1. HTTP is explicit out-of-scope. `CEO_MCP_TRANSPORT=http` env var is not recognized; if set, server refuses + emits `mcp_server_disabled_by_kill_switch`. Negative integration test (`test_no_http_transport.py`) asserts this behavior.
+
+## Consequences
+
+**Positive (+):**
+
+- Defense-in-depth across all five known attack classes (intra-Claude, external client direct, Codex CLI, helmor pattern, future MCP transport variant).
+- Single source of truth via shared `_CANONICAL_GUARDS` patterns — drift risk is mechanical, not semantic.
+- Codex Round 6 ACCEPT verdict (24 unique cross-LLM findings vs 0 same-LLM; ADR-095 §gate-#6 confirmation #12).
+- Hasattr-guarded audit emits work in pre-canonical-ceremony adopter installs.
+
+**Negative (−):**
+
+- Two implementations of canonical-guard logic (`check_canonical_edit.py` Layer A + `_lib/mcp/canonical_guard.py` Layer B). Mitigation: shared `_CANONICAL_GUARDS` import; integration test `test_layer_ab_parity.py` deferred to PLAN-076 Onda B.
+- ~998 LoC Layer B middleware adds maintenance surface. Mitigation: covered by ≥30 unit tests. ~~+ 11 tmpdir-test-design tests reactivated under PLAN-076 Onda B item #2~~ **STRIKE — false claim per PLAN-076 §4.2 finding D (S87 Wave 1 Agent D + Codex MCP cross-LLM gate confirmation, PLAN-076 fork (f) call #1): zero `tmpdir-test-design` markers exist in codebase. Aspirational doc-drift, not real test inventory.**
+- Audit allowlist currently includes auxiliary fields beyond the Sec MF-3 6-field contract (R6-01 P2 residual). Closure tracked under PLAN-076 Onda A item #4.
+
+**Neutral (~):**
+
+- Adopters who never wire the MCP server pay zero runtime cost (Layer A matcher is also a no-op for non-MCP tool calls; Layer B is only invoked when the MCP server runs).
+- HTTP transport remains future work; no signal value lost by deferring.
+
+## Blast radius
+
+**L3+** — touches ADR-042 (extends), ADR-051 (governance), ADR-052 (veto floor wiring), ADR-095 (cross-LLM gate evidence), ADR-098 (audit emit register pattern). Two new modules (`_lib/mcp/canonical_guard.py` + `mcp-smoke.yml` CI gate) plus audit-action allowlist amendment.
+
+## References
+
+- PLAN-070 (parent — `MCP introspection tools extending ADR-042`, status `done` 2026-05-05)
+- PLAN-076 (followup — caveat closeout including allowlist tightening, tier_policy_cli reconciliation; ~~11 skipped tests reactivation~~ **STRIKE — NO-OP per §4.2 finding D**)
+- PLAN-070/round-4/codex-mcp-r6-cross-llm.md (FINAL ACCEPT verdict)
+- PLAN-070/staging/canonical_guard.py (Layer B implementation, ~998 LoC)
+- PLAN-070/staging/check_canonical_edit_layer_a.patch (Layer A matcher extension)
+- PLAN-070/round-4/security-engineer-r4.md (Sec architectural ACCEPT-CONDITIONAL with R6-01 P2 deferred)
+- `feedback_custom_mcp_tools_governance_gap.md` (S81-tris origin trace for Layer A necessity)
+- ADR-042 (extended by this ADR)
+- ADR-051 (canonical-edit governance)
+- ADR-052 (Sec/CR veto floor)
+- ADR-095 §gate-#6 (cross-LLM mandate)
+- ADR-098 (hasattr-guarded audit emit pattern)
+- ADR-100 (trusted-dependencies re-affirm — stdlib-only)

package/.claude/adr/ADR-103-calendar-gate-final-purge.md

@@ -0,0 +1,121 @@
+# ADR-103 — Calendar gate final purge (extends ADR-095, supersedes ADR-093 §moratorium)
+
+**Status:** ACCEPTED (Owner GPG ceremony 2026-05-03 S80; cosmetic body flip 2026-05-05 S87 — drift-fix of S80 ceremony per PLAN-072 §7)
+**Date:** 2026-05-03
+**Enforcement commit:** 56b8e90 — `ceremony(plan-072): calendar gate final purge — ADR-103 ACCEPTED + ADR-093 superseded + release.yml 7d→24h`
+**Supersedes:** ADR-093 §60-day-moratorium clause (the per-plan refusal cap clause is preserved)
+**Extends:** ADR-095 (calendar-gate-retraction expanded scope)
+**Anchored on:** ADR-096 (vibecoder-only-by-design)
+
+## Decision drivers
+
+- **Owner directive 2026-05-03:** CEO time-estimate errors caused Owner to approve GPG ceremonies for calendar gates that delay release without empirical justification. PLAN-068 §5.3 estimated "~7 weeks calendar to v1.12.0 GA"; v1.11.6 actually shipped Day 1 (50× overestimate). ADR-093 (ACCEPTED 2026-04-27) impose 60-day moratorium until 2026-06-26, blocking PLAN-065 v1.13.0 path 54+ days after ready-to-ship readiness.
+- **Same-LLM bias in CEO estimates:** training data carries big-tech / regulated-industry sprint discipline (soak windows, RC hold periods, moratorium cycles) that the CEO copied without questioning fit. Vibecoder-only framework (ADR-096, adopter_count=0) has no external pressure for "settle periods."
+- **Mechanical replacement available:** Codex external re-pass per ADR-095 #6 + ADR-052 VETO floor + canonical-edit GPG ceremony are all *mechanical* gates. Calendar buffers add zero protective signal beyond mechanical gates for vibecoder-only thesis.
+- **Empirical evidence:** PLAN-068 v1.11.6 GA shipped 1 day after CEO timeline projected 7 weeks. PLAN-069 Phase 1 (this PR) shipped same-session as Round 1 critique. Real cadence is per-session, not per-week.
+
+## Context
+
+The framework accumulated 7 calendar-bound gates between Sprint 30 and Session 73:
+
+1. **14-day CI green streak on `main`** — retracted via ADR-095 (Wave session 73 ceremony 2026-04-29)
+2. **30-day no-retag streak** — retracted via ADR-095 same ceremony
+3. **emit_mcp_injection_finding shipped** — structural (ship), not calendar; closed Wave B
+4. **Cost reporting accurate end-to-end** — structural; closed Wave B
+5. **One refused-ADR retracted** — structural (action); ADR-091 closed Wave C
+6. **Outside reviewer 1-page second opinion** — replaced by Codex external CLI per ADR-095 §gate-#6 (mechanical, not calendar)
+7. **60-day refused-ADR moratorium** (ADR-093) — RETAINED as "structural pattern brake" per ADR-095, but empirical evidence 2026-05-03 shows it's blocking PLAN-065 v1.13.0 without protective benefit.
+8. **7-day RC hold** in `release.yml` (PLAN-013 Phase 0 item 0.3) — predates ADR-095; copies external SDK release cycle; calendar without empirical fit for vibecoder-only.
+9. **6-week MCP soak window** (PLAN-068 §A3) — copies SDK release cycle; no external SDK consumers per ADR-096.
+10. **14-day CI-green soak before tag v1.12.0** (PLAN-068 §S6) — pre-ADR-095 reference still in plan body; retroactive fix needed.
+11. **PLAN-068 §5.3 timeline** — "~7 weeks calendar to v1.12.0 GA" — proven 50× wrong by v1.11.6 Day-1 ship.
+12. **PLAN-065 §52 calendar gate** — depends on ADR-093 expiry (2026-06-26) for v1.13.0 ship; auto-resolves once ADR-103 lands.
+
+ADR-095 retracted gates 1+2. ADR-103 retracts the rest except where mechanical (CR + Sec VETO floor; Codex re-pass; canonical-edit GPG; pre-tag pytest GREEN).
+
+## Decision
+
+### Retract / supersede
+
+| Gate | Action | Replacement |
+|---|---|---|
+| ADR-093 §60-day-moratorium | **SUPERSEDED** | Per-PR Codex re-pass per ADR-095 §gate-#6 (mechanical) |
+| ADR-093 §per-plan-refusal-cap (≤2) | **PRESERVED** | Structural anti-sandbagging signal — not calendar |
+| `release.yml` 7-day RC hold | **REDUCED** to 24h | Mechanical window for Codex re-pass turnaround per ADR-095 §gate-#6 |
+| PLAN-068 §5.3 calendar timeline | **DROPPED retroactively** | Estimates re-stated in 2-axis format (compute_hours + owner_physical_min); calendar_buffer_days defaults to 0 |
+| PLAN-068 §A3 6-week MCP soak | **DROPPED** | Per ADR-096 vibecoder-only — no external SDK consumers |
+| PLAN-068 §S6 14-day CI-green soak | **DROPPED** | Already retracted by ADR-095; remove residual reference |
+| PLAN-065 §52 post-2026-06-26 gate | **DROPPED** | Depends on ADR-093 §moratorium superseded above |
+| PLAN-070 R6 ADR-093 trigger | **MARKED N/A** | ADR-103 supersedes the trigger condition |
+
+### Preserved mechanical gates (NOT calendar)
+
+| Gate | Mechanism | Why preserved |
+|---|---|---|
+| ADR-052 VETO floor (Opus for CR + Sec) | Hardcoded in dispatcher | Quality-critical, empirical via tournament |
+| Codex external re-pass per ADR-095 §gate-#6 | Pre-tag mechanical | Anti same-LLM bias, mandatory before any GA tag |
+| Canonical-edit GPG ceremony per `check_canonical_edit.py` | Hardcoded hook | Owner-physical authorization for sensitive files |
+| Pre-tag full pytest GREEN per `release.yml` | Mechanical CI step | Regression detection |
+| ADR-093 §per-plan-refusal-cap (≤2) | PLAN-SCHEMA validator | Anti-sandbagging signal — not time-bound |
+
+### New rule (always-on)
+
+CEO MUST split time estimates in 2 axes:
+
+```yaml
+estimate:
+  compute_hours: X        # Claude Code wall-clock REAL se rodar agora
+  owner_physical_min: Y   # GPG ceremonies + manual Codex review
+  calendar_buffer_days: 0 # JUSTIFIED per specific ADR/incident or 0 (default)
+```
+
+`calendar_buffer_days > 0` requires explicit empirical citation
+(specific ADR or measured incident); generic "best practice" / "settle
+period" / "review window" insufficient. Strike if uncited.
+
+## Consequences
+
+### Positive
+
+- **PLAN-065 v1.13.0 path destravado AGORA** (was: post-2026-06-26 = 54-day prison)
+- **PLAN-068 v1.12.0 ships when ready** (was: Day 28-50 estimated)
+- **Real cadence: per-session, not per-week** — aligned with empirical evidence (S79 v1.11.6, S80 v1.11.7 Phase 1)
+- **Owner approval friction reduced** — CEO time estimates now require empirical anchor; Owner can cite ADR-103 to reject inflated calendar buffers
+- **Mechanical gates preserved** — quality-critical paths still protected (CR + Sec VETO, Codex re-pass, GPG ceremony, pytest GREEN)
+
+### Negative
+
+- **Loss of "settle period" buffer** — refused-ADR pattern detection now per-PR (Codex), not 60-day window. Cost: if a refusal-pattern emerges between Codex re-passes, detection delayed by 1 PR cycle (~1 session). Mitigation: Codex re-pass cross-model gate per ADR-095 already catches same-LLM bias mechanically.
+- **Retroactive amendments to plans** — PLAN-068 §5.3 calendar timeline DROPPED with note explaining the CEO calendar-gate-invention pattern. Some readers may find the historical narrative confusing without the note.
+- **`release.yml` 7d → 24h** — narrower window for Codex re-pass turnaround. Mitigation: Owner runs Codex re-pass synchronously before tagging; the 24h is a safety net, not the primary mechanism.
+
+### Neutral
+
+- **ADR-091 RETRACTED** (dogfood deferred) — kept on disk as historical record per ADR-093 §Part-3 reversibility precedent. ADR-093 follows same pattern.
+- **`docs/READINESS-STATUS.md`** — non-canonical doc; will need a follow-up update post-ADR-103, not blocking.
+
+## Alternatives considered
+
+- **Option A — Keep ADR-093 60-day moratorium intact:** REJECTED. Empirical evidence 2026-05-03 (S80 audit) shows it blocks PLAN-065 v1.13.0 without protective benefit. Same-LLM bias mitigation already mechanical via ADR-095 §gate-#6 Codex re-pass.
+- **Option B — Reduce ADR-093 to 14 days:** REJECTED. Arbitrary cut; doesn't address root cause (CEO inventing calendar gates without empirical base). 14d still blocks current PLAN-065 timeline ~10 days.
+- **Option C — Drop ADR-093 entirely (including refusal cap):** REJECTED. Per-plan refusal cap (≤2) is structural anti-sandbagging signal independent of calendar; preserve via ADR-103 §Preserved.
+- **Option D — Expand ADR-095 in-place** (re-edit the existing ADR): REJECTED. ADR-095 ACCEPTED 2026-04-29 with specific scope (gates #1+#2). New ADR (-103) preserves attribution + cleaner historical trail.
+- **Option E — Drop release.yml 7d RC hold entirely:** REJECTED. Some safety-net window helps when Owner is asynchronous (e.g., overnight tag without immediate Codex re-pass). 24h is the minimum that allows mechanical re-pass turnaround.
+
+## Empirical evidence cited
+
+1. **PLAN-068 §5.3 timeline error:** estimated "Earliest GA v1.12.0 ~7 weeks from this session"; v1.11.6 GA shipped Day 1 (S79 overnight). Source: `git log --oneline v1.11.6` vs PLAN-068 commit `12a4ff0`.
+2. **PLAN-069 Phase 1 same-session ship:** Phase 0 gap-analysis + Phase 0.5 PoC + Round 1 + Phase 1 Wave A + Wave B + 89 tests + 97% coverage all in S80 (~10h compute). Plan estimated "2 sessions / 6-10h" — within 2× tolerance.
+3. **Audit-tokens 30d window:** zero `weak_model` / `overpowered` / `wasteful_thinking` findings — calendar gates aren't preventing what they claim to prevent (cost waste comes from model misroute, not pattern recurrence). Source: `python3 .claude/scripts/audit-tokens.py --window 30`.
+4. **Refused-ADR pattern:** since ADR-093 ACCEPTED 2026-04-27, zero refused ADRs authored. ADRs 094-100 all ACCEPTED. The "moratorium" is fighting a non-recurring pattern.
+
+## References
+
+- ADR-095 — Calendar gate retraction (14d CI + 30d no-retag) — extends here
+- ADR-093 — Refused-ADR moratorium — supersedes §60d clause; preserves §per-plan cap
+- ADR-096 — Vibecoder-only-by-design — anchor for retraction rationale (no external adopter pressure)
+- ADR-052 — Role-to-model VETO floor — preserved (mechanical, not calendar)
+- ADR-014 — SemVer + RC policy — original source of `release.yml` 7d hold; 24h replacement preserves SemVer compliance for vibecoder
+- PLAN-072 §1 — full audit table
+- PLAN-072 §3 — concrete amendment patches
+- Memory feedback: `feedback_calendar_gates_invented.md` (always-on)

package/.claude/adr/ADR-104-AMEND-1-aek-dated-promotion-criteria.md

@@ -0,0 +1,338 @@
+# ADR-104-AMEND-1 — AEK Calibration Phases C2-C4 + Dated Promotion Criteria
+
+**Status:** PROPOSED (Owner GPG ceremony pending — S141 PLAN-101 ship)
+**Date:** 2026-05-18
+**Enforcement commit:** _pending_ (filled at ceremony commit time;
+mirrors ADR-019-AMEND-1 PROPOSED→ACCEPTED pattern)
+**Plan:** PLAN-101
+**Amends:** ADR-104 §Phase 2/3/4 promotion clause
+**Related:** ADR-019-AMEND-1 (per-class block-mode lifecycle pattern;
+S140 ACCEPTED), ADR-095 (calendar gate purge), ADR-124 §Part 2
+(hotfix scope cover), ADR-125 §B (Tier-B conditional default),
+PLAN-101 Wave 0..D
+
+**Co-signers (architectural review):** Round 1 5-archetype debate
+(S134) + Round 2 Codex MCP 5-iter ACCEPT (skeleton) thread
+`019e3849-16b0-7782-865d-a250b4709a74` gpt-5.2 + Round 2 Codex MCP
+4-iter ACCEPT (ceremony bundle) thread
+`019e3ccc-c319-7242-a511-7daf67f3d30a` gpt-5.2 (S141).
+
+## Codex MCP gate trail (S141 ceremony bundle review)
+
+| Iter | Verdict | Findings |
+| ---- | ------- | -------- |
+| 1    | ACCEPT-WITH-FIXES | 0 P0 / 4 P1 / 4 P2 — Wilson FPR denominator wrong (`fp+tp+fn` instead of `fp+tn`); deferral-cap arithmetic 360d vs `max 3 × 90d = 270d`; ADR §E specified typed wrapper but ceremony P3 is NO-OP; FPR threshold check averaged eligible-only subset (could PASS missing class); P2: docstrings claim typed wrapper; ship_sha placeholder; fixture count drift; contract_id format hardcoded |
+| 2    | ACCEPT-WITH-FIXES | 0 P0 / 3 P1 / 1 P2 — residual 360d references in commit msg + CHANGELOG entry + plan body §Risks; residual typed-wrapper mentions in commit msg + CHANGELOG; ADR-095 calendar-gate doctrine drift in plan body Wave 0 + §8 execute recipe; P2: matrix advised vs joined count clarity |
+| 3    | ACCEPT-WITH-FIXES | 0 P0 / 2 P1 — Wave 0 draft bullet still listed "≥30 consecutive days of calibration window"; §8 step 1 wording "max 3x = 90d cap" inconsistent with canonical "270d cap" |
+| 4    | ACCEPT | No residuals |
+
+## Context
+
+ADR-104 (PLAN-071 S87 v1.14.0) shipped the Adaptive Execution Kernel
+(AEK) `task-route.py` + Reality Ledger in **advisory-only** mode. The
+ADR's `Reopen criteria` + `§Negative consequences` clauses define an
+empirical promotion pathway through three measurement phases:
+
+- **Phase 2** task-class calibration baseline (S/M/L/XL distribution)
+- **Phase 3** false-positive-rate matrix per class
+- **Phase 4** kernel state-machine conformance
+
+PLAN-101 (S115 skeleton; S134 reviewable-as-skeleton ACCEPT) opens
+the empirical work. Codex P7 STILL-VALID confirms the phases are
+prerequisite for promotion from advisory to enforcement.
+
+**Two semantic problems** surfaced at S115 + S134 review that require
+this amendment:
+
+1. **Name collision**: PLAN-071 already shipped internal "Phase 2 / 3
+   / 4" execution waves at v1.14.0. Reusing "Phase 2/3/4" for the
+   empirical promotion phases conflates two unrelated workstreams.
+2. **Perpetual deferral risk**: ADR-104 promotion clause was
+   open-ended ("once data accumulates, revisit"). Without a dated
+   trigger, the decision becomes "future Owner problem" forever.
+
+ADR-095 doctrine (calendar-gate purge) further constrains the
+amendment: substantive criteria (sample size, class diversity,
+verifier determinism) replace calendar holding-periods. Recent S139
+PLAN-100 reaffirmation + S140 ADR-019-AMEND-1 promotion concretized
+the pattern.
+
+## Decision drivers
+
+- **Phase renaming for clarity** — empirical promotion phases are
+  renamed `Calibration C2 / C3 / C4` to disambiguate from PLAN-071
+  shipped internal phases. Calibration prefix marks them as
+  measurement gates, not implementation work.
+- **Dated vote trigger** (R1 P0-5 closure) — vote MUST fire 90d post
+  PLAN-101 ship (2026-08-16 derived from S141 anticipated ship
+  2026-05-18). Vote outcome may DEFER, but the decision-point itself
+  is dated.
+- **Deferral protocol** — if criteria NOT met at vote-trigger date,
+  Owner ceremony records "defer + new dated trigger" (90d extension).
+  Maximum 3 extensions = 270d total deferral cap (3 × 90d). After
+  270d without criteria-met, escalate to ADR-104 §rescope or SUPERSEDE.
+- **Numeric thresholds** (R1 P0-5 + S134 iter-2 P0 fold) — promotion
+  requires:
+  - FPR `< 15%` across all task classes (mean per-class FPR)
+  - Sample size `N ≥ 200` total `task_route_advised` events
+  - Per-cell minimum `N ≥ 30` events (uniformly, not "dominant cell")
+  - All 4 task classes (S/M/L/XL) populated above threshold
+- **Calendar-gate retraction** (ADR-095 doctrine; reinforced S139
+  reaffirmation) — "30-day audit-log soak window" criterion is
+  RETRACTED. Substantive criteria (sample-size + class-diversity +
+  verifier-determinism) ARE the gate. Sample volume may be satisfied
+  by (a) live audit-log accumulation OR (b) synthesized corpus run
+  through actual `task-route.py:classify()` logic. Memory:
+  [[feedback-no-calendar-gates-ai-workflow]].
+- **Ground-truth labeling discipline** (S134 P0 #5 + iter-2 fold) —
+  audit-log is append-only by ADR-018. Ground-truth labels MUST NOT
+  backfill the original `task_route_advised` row. Register NEW
+  append-only audit action `task_route_ground_truth_label` keyed by
+  `contract_id` to join with the original event.
+- **Strictest-existing-threshold rule** (ADR-125 §B + S134 fold) —
+  AEK is less safety-critical than confidence-gate (which uses <1%
+  from ADR-019). FPR <15% threshold is defensible for advisory-tier
+  workstream classification.
+
+## Decision
+
+### §A — Phase renaming
+
+The empirical promotion phases in ADR-104 are renamed:
+
+| Old name (collides with PLAN-071) | New name (this amendment) |
+| --------------------------------- | ------------------------- |
+| Phase 2 calibration baseline      | **Calibration C2**        |
+| Phase 3 FPR measurement           | **Calibration C3**        |
+| Phase 4 state-machine conformance | **Calibration C4**        |
+
+All forward references in ADR-104 § Reopen criteria,
+§ Negative consequences, and downstream documentation MUST use the
+`C2/C3/C4` form. The numeric phase suffixes (1, 5, etc.) in PLAN-071
+internal execution waves are unaffected.
+
+### §B — Dated promotion criteria
+
+PLAN-101 ship date (`v1.35.0`, shipped 2026-05-18) anchors the
+data-volume vote trigger. Per ADR-095 doctrine (no calendar gates), the
+trigger is **event-based**, not calendar-bound:
+
+- **Vote-trigger condition (ADR-095 compliant):** Owner ceremony vote
+  fires when EITHER of the following substantive conditions is first met
+  (whichever comes first):
+  - **N ≥ 200** total `task_route_advised` audit events accumulated
+    since v1.35.0 ship (live or synthesized corpus per §D), OR
+  - **All 4 task classes (S/M/L/XL)** have per-cell minimum N ≥ 30
+    events AND FPR < 15% across all cells (i.e. full §C criteria met).
+- **Vote outcome contract:** Owner ceremony at trigger fires records EITHER:
+  - `PROMOTE` — criteria met; emit per-class promotion ADR
+    (mirrors ADR-019-AMEND-2-CLASS-SHA_EXISTS pattern S140)
+  - `DEFER` — criteria not met; record "new trigger (advance by 100
+    additional `task_route_advised` events)" with rationale; max 3
+    deferrals = 270d total cap (≤ 600 total events backlog ceiling)
+  - `RESCOPE` — escalate per §C below
+
+> **Note (ADR-095 retraction):** The original §B wording referenced a
+> hardcoded date "2026-08-16 (PLAN-101 ship + 90 days)". That calendar
+> gate is RETRACTED per ADR-095 doctrine and
+> [[feedback-no-calendar-gates-ai-workflow]]. The event-based trigger
+> above replaces it. The deferral cap "270d" is also retired; the
+> replacement cap is "3 additional batches of 100 events each" (300
+> events max backlog beyond the initial 200 trigger).
+
+### §C — Numeric thresholds
+
+| Threshold        | Value      | Source / rationale                                |
+| ---------------- | ---------- | ------------------------------------------------- |
+| Per-class FPR    | `< 15%`    | ADR-125 §B strictest-existing-threshold; advisory-tier defensible |
+| Total events     | `N ≥ 200`  | R1 P0-2 closure; PLAN-100 precedent               |
+| Per-cell minimum | `N ≥ 30`   | S134 iter-2 P0 fold (uniform; NOT dominant-cell)  |
+| Class coverage   | 4 of 4     | S/M/L/XL all populated above per-cell minimum     |
+| FPR method       | Wilson 95% | Wilson lower-bound proxy; matches PLAN-100        |
+
+Sparse cells (N < 30) MUST be marked `insufficient-data` in the FPR
+matrix and EXCLUDED from the global FPR aggregate until the next
+calibration refresh.
+
+### §D — Calendar-gate retraction
+
+The "30-day audit-log soak window" criterion in PLAN-101 original
+frontmatter is RETRACTED per ADR-095 doctrine + memory
+[[feedback-no-calendar-gates-ai-workflow]]. Substantive criteria
+(§C above) replace calendar holding. Sample volume may be satisfied
+by:
+
+- (a) live audit-log accumulation of `task_route_advised` events, OR
+- (b) synthesized corpus run through real `task-route.py:classify()`
+  via `.claude/plans/PLAN-101/synthesize-corpus.py`, ground-truth
+  labels knowable a priori since corpus controls descriptions.
+
+PLAN-101 ships under path (b) — framework workload alone does not
+produce 200 events in any feasible window. Audit ground-truth labels
+emit via heuristic-auto over the synth corpus
+(`ground_truth_source=heuristic_auto`).
+
+### §E — Ground-truth-label new action registration
+
+Register NEW append-only audit action `task_route_ground_truth_label`
+in `.claude/hooks/_lib/audit_emit.py`:
+
+- Add `task_route_ground_truth_label` to `_KNOWN_ACTIONS`
+- Define `_TASK_ROUTE_GROUND_TRUTH_LABEL_ALLOWLIST` frozenset:
+  `{action, ts, session_id, project, contract_id,
+   ground_truth_class, ground_truth_source,
+   annotation_confidence_bps}`
+- Wire dispatch branch in `emit_generic()` (mirror existing
+  `task_route_advised` pattern at line 3414)
+- Add SPEC/v1/audit-log.schema.md row at v2.20
+
+**No typed wrapper.** Matches the existing `task_route_advised`
+precedent (PLAN-071 / ADR-104 ceremony): the action is emitted via
+`emit_generic(action="task_route_ground_truth_label", ...)`; the
+Sec MF-3 allowlist scrub fires inside the `emit_generic` dispatch
+branch. Avoiding a typed wrapper keeps the
+`_EXPECTED_PUBLIC_SYMBOLS` contract gate stable (no new public
+emitter requires a contract bump beyond the SHA256 + count
+rebaseline) — Codex R2 iter-1 P1 #3 fold.
+
+Field semantics:
+
+| Field                       | Type   | Required | Notes                                                       |
+| --------------------------- | ------ | -------- | ----------------------------------------------------------- |
+| `action`                    | string | yes      | literal `task_route_ground_truth_label`                     |
+| `ts`                        | string | yes      | ISO-8601 UTC                                                |
+| `session_id`                | string | yes      | producer session                                            |
+| `project`                   | string | yes      | producer project                                            |
+| `contract_id`               | string | yes      | join key — matches original `task_route_advised.contract_id` |
+| `ground_truth_class`        | enum   | yes      | `S` / `M` / `L` / `XL`                                      |
+| `ground_truth_source`       | enum   | yes      | `heuristic_auto` / `manual_review`                          |
+| `annotation_confidence_bps` | int    | yes      | 0..10000 (basis points; 7000 = 70% threshold for Stage 2)   |
+
+LLM06 hold: raw task descriptions NEVER persisted. Sec MF-3
+allowlist scrub enforced via `_scrub_ceo_boot_event` helper
+(mirrors PLAN-104 pattern).
+
+Kernel extension kernel-override token:
+`CEO_KERNEL_OVERRIDE=PLAN-101-WAVE-B-AUDIT-EMIT-EXTENSION`
+(per PLAN-090-FOLLOWUP / PLAN-097 / PLAN-100 precedent).
+
+### §F — Conformance test obligation
+
+`.claude/scripts/tests/test_aek_state_machine.py` MUST exist with
+`≥50` transition test cases covering REAL predicates in
+`task-route.py:classify()`:
+
+- empty/missing task_description path → safe-default `M`
+- unknown/unrecognized predicate fallthrough
+- boundary thresholds: S↔M↔L↔XL
+- multi-predicate conjunction (description-keyword + size-hint)
+- canonical-path detection → `XL`
+- veto-domain detection (auth/financial/PHI) + multi-module → `XL`
+- schema-change signal → `XL`
+- workflow class (release/ci/rag) → `XL`
+- multi-module + test-infra → `XL`
+- ITIMER budget exceeded → safe-default `M`
+- Cf (invisible format chars) + NFKC normalization
+
+Mutation testing target `≥80%` kill-rate via
+`.claude/scripts/mutation-test.py` against `classify()` predicates
+in `task-route.py` (S134 P0 #2 fold — NOT `_decide_with_matrix`
+which lives in `check_pair_rail.py`).
+
+## Consequences
+
+### Positive
+
+- **Empirical promotion pathway dated** — no perpetual deferral.
+  Owner ceremony at vote-trigger date forces a decision (PROMOTE
+  / DEFER / RESCOPE) even when criteria-met is ambiguous.
+- **Calendar gate retracted** — sample volume satisfied via
+  synthesized corpus through real `classify()` verifier. PLAN-101
+  ship not blocked by "30 days of audit-log accumulation" that
+  framework workload cannot produce.
+- **Audit-log append-only invariant preserved** — ground-truth
+  labels go to a NEW action `task_route_ground_truth_label`, not
+  a backfill of the original `task_route_advised` row. Sec MF-3
+  allowlist scrub enforced; LLM06 raw-text hold preserved.
+- **Per-class promotion pattern established** — when calibration
+  FPR threshold is met for individual classes (e.g., S-class
+  empirically <5% FPR), ADR-104-AMEND-1-CLASS-S amendment can
+  ship per the ADR-019-AMEND-2-CLASS-SHA_EXISTS S140 pattern
+  (governance-only commit; no tag).
+
+### Negative
+
+- **Synth corpus methodology disclaimer** — calibration FPR
+  measured against synth corpus has the obvious circularity risk:
+  if the corpus author and the classifier author share blind
+  spots, the measurement misses them. Mitigation: Wave A.5
+  anti-circularity discipline — corpus authored BEFORE classify()
+  is re-read for this work; fixtures span all 4 classes; cross-LLM
+  Codex R2 reviews the corpus + matrix.
+- **Vote-trigger date is a soft commitment** — Owner must
+  physically run the vote ceremony at 2026-08-16. If skipped, the
+  amendment lapses to ADR-104 original ambiguity. Mitigation:
+  Wave D catalogs the date in memory + CLAUDE.md §Current Work.
+- **Deferral cap is rigid** — 270d total max (3 × 90d extensions) may
+  be too short for organic adoption of `task-route.py` in adopter
+  installs. Mitigation: amendment allows §RESCOPE escalation at any
+  deferral point (does not require waiting for the 270d ceiling).
+
+### Neutral
+
+- **Cross-LLM Codex gate preserved** — per ADR-095 §gate-#6,
+  ceremony bundle is reviewed by Codex MCP R2 (S141 thread TBD)
+  before Owner-physical ship. Aligns with S140 ADR-019-AMEND-1
+  precedent.
+
+## Reopen criteria
+
+- Calibration FPR rises above 15% in any subsequent calibration
+  refresh → emit `aek_calibration_drift` event + Owner triage
+  ceremony
+- Per-class N drops below 30 in any refresh (audit-log staleness)
+  → re-synthesize corpus + re-run calibration; document in plan
+- Mutation kill-rate falls below 80% on `classify()` predicates
+  (regression) → ADR amendment revisit + classifier hardening plan
+- Ground-truth labeling source distribution skews toward
+  `manual_review` (>10% of total) without quality justification →
+  audit `heuristic_auto` accuracy + revise Wave B.1 protocol
+
+## Empirical evidence cited
+
+1. **PLAN-100 S139 precedent** — confidence-gate per-class block-
+   mode shipped via ADR-019-AMEND-1 (PROPOSED) on the same dated-
+   promotion pattern (drift detector + per-class kill-switch +
+   ADR amendment).
+2. **ADR-019-AMEND-1 S140 promotion ceremony** — PROPOSED→ACCEPTED
+   pattern (no tag; governance-only commit) is the template for
+   the subsequent ADR-104-AMEND-1-CLASS-* promotions.
+3. **ADR-095 calendar-gate purge** — S139 cleanup commit `f8363ee`
+   retracted PLAN-101's original 30d soak gate; this amendment
+   formalizes the retraction in ADR form.
+4. **Wave A.5 anti-circularity** — synth corpus authored against
+   `task-route.py:classify()` decision tree per S134 P1 #1 fold;
+   golden set fixtures re-used from PLAN-071 Phase 1 (22 train + 4
+   holdout) where available; net new fixtures span boundary cells.
+5. **S134 Codex R2 5-iter ACCEPT** — thread `019e3849-16b0-7782-
+   865d-a250b4709a74` gpt-5.2 closed 5 P0 + 3 P1 findings in PLAN-101
+   skeleton review; this amendment carries all 5 P0 folds (P0 #2
+   classify() target, P0 #3 audit-query.py command verification,
+   P0 #4 duration_ms semantic correction, P0 #5 ground-truth-label
+   action, R2 P0 fold Wave 0.0 binding).
+
+## References
+
+- ADR-104 — original AEK advisory-only ADR (PLAN-071 S87 v1.14.0)
+- ADR-095 — calendar gate final purge (this amendment's authority
+  for §D)
+- ADR-019-AMEND-1 — confidence-gate per-class block-mode lifecycle
+  (S140 precedent for §B + §F)
+- ADR-124 §Part 2 — hotfix scope cover (this amendment's authority
+  for kernel extension under non-major version bump)
+- ADR-125 §B — Tier-B conditional default (this amendment's tier
+  classification)
+- PLAN-101 — implementation plan (Wave 0..D)
+- PLAN-101 Wave 0.0 — PLAN-084 canonical roadmap binding
+- Memory: [[feedback-no-calendar-gates-ai-workflow]] — calendar-
+  gate doctrine reinforcement (S139)