runward 0.15.0 → 0.17.0

package/README.md

@@ -22,7 +22,7 @@ Spec-driven frameworks answered the first half of that problem: write the right
 
 Agentic systems break four assumptions of classical distributed engineering. The core component is **non-deterministic**: same input, different output, by design. **Input is indistinguishable from instruction**: anything the model reads can try to command it, so prompt injection is structural, not a bug to patch. **Forgetting becomes an engineering problem**: memory that only grows drowns the signal, so decay, invalidation and consolidation have to be designed, not hoped for. And the **blast radius is unprecedented**: an agent with tools acts on the world, so a bad output is no longer just a bad answer.
 
-Runward is the **FDE method** made executable. Its guiding principle: the architecture frames the model, never the other way around — the model and the infrastructure are adapter decisions, taken behind stable contracts. From there, five architecture gestures: boundaries before the stack; start simple, isolate by contract, grow on evidence; keep the deterministic out of the model; explicit state and governed memory; govern, trace and evaluate from day zero. And a delivery spine: six gated phases (a gate: a checkpoint you cross on evidence, never on assertion), each with a Definition of Ready and a Definition of Done, a 22-arbitration decision matrix, and 60 craft rules. The phases, gestures and rules are what carry it.
+Runward is the **FDE method** made executable. Its guiding principle: the architecture frames the model, never the other way around — the model and the infrastructure are adapter decisions, taken behind stable contracts. From there, five architecture gestures: boundaries before the stack; start simple, isolate by contract, grow on evidence; keep the deterministic out of the model; explicit state and governed memory; govern, trace and evaluate from day zero. And a delivery spine: six gated phases (a gate: a checkpoint you cross on evidence, never on assertion), each with a Definition of Ready and a Definition of Done, a 22-arbitration decision matrix, and 64 craft rules. The phases, gestures and rules are what carry it.
 
 ## Who it's for — and when
 
@@ -63,14 +63,14 @@ New here? Follow [your first mission in 15 minutes](docs/first-mission.md).
 | `runward check` | **Gate audit**: which deliverable, expected at which phase, is missing, started, or filled — exit code 1 on gaps |
 | `runward check --strict` | **Conformance gate**: verifies each phase's rule-conformance manifest — every CRITICAL/HIGH craft rule mapped to the phase is accounted for (applied with evidence, deviated with an ADR, or reasoned `n/a`) — **and verifies the evidence itself**: typed pointers (`file:PATH[:LINE][#SYMBOL]`, `test:PATH[::NAME]`, `adr:NNNN`) must resolve to real, non-empty content; a signed rule's evidence must match the rule's `signature:`; a stale pointer (drift) fails the gate. **Deterministic and zero-LLM**: it proves a decision was traced and points at something real, never the code's quality, and cannot be jailbroken by injection — rerun it and get the same verdict |
 | `runward check --freeze` | **Seal a green gate**: hashes every resolvable evidence file into `runward/evidence-lock.json` (SHA-256, committed). A sealed file that later changes or disappears fails `check --strict` until you re-verify and re-seal — silent post-merge erosion becomes loud. Refuses to seal a red gate |
-| `runward manifest` | **Conformance-table plumbing**: overview of the four gated manifests; `--sync` scaffolds the *form* — missing rows appended with an empty status (the gate refuses them until you decide), renamed rules migrated in place — and never touches the *content*: no status set, no evidence written, no row deleted |
+| `runward manifest` | **Conformance-table plumbing**: overview of the five gated manifests; `--sync` scaffolds the *form* — missing rows appended with an empty status (the gate refuses them until you decide), renamed rules migrated in place — and never touches the *content*: no status set, no evidence written, no row deleted |
 | `runward rules` | **The rule set as data**: the effective set (your mission's copy, else the package's) with impact, phases, OWASP ASI and signatures; `--json` is a stable, versioned machine contract for dashboards, editor extensions and CI annotations |
 | `runward explain <rule>` | **The why, inline**: a rule's contract (impact, phases, ASI, signature, rationale) and its full text — no doctrine excavation; renamed slugs answer with their migration |
 | `runward status` | Mission snapshot: current gate, decision journal (ADRs), workflows |
 | `runward doctor` | Environment and installation checks |
 | `runward update` | Refresh `runward/workflows/` from the package — mission state never touched, local edits preserved unless `--force` |
 | `runward characterize` | **Read-only inventory** of an existing codebase (brownfield / retro-documentation) → `runward/characterization.md`: dependencies and lockfiles, entrypoints, CI, tests, git-log shape. Deterministic and zero-LLM; it parses artifacts at rest and never runs, builds, or writes to your code. Facts, not decisions — reconstructing the *why* stays yours |
-| `runward compliance <regime>` | **Assemble a regime-framed evidence pack** (`iso-42001`, `nist-ai-rmf`, `eu-ai-act`) from the mission's artifacts → `runward/compliance/…`: a human readiness *draft* (OWASP ASI coverage, rule-conformance status, ADR journal, with the operator-only sections flagged) **and a machine-readable OSCAL** component-definition to feed your GRC/auditor tool. Deterministic, read-only, zero-LLM — supporting evidence, never a compliance claim. The regime mapping is **versioned data** (`--regime-version` pins the lens; the pack stamps which version produced it) |
+| `runward compliance <regime>` | **Assemble a regime-framed evidence pack** (`iso-42001`, `nist-ai-rmf`, `eu-ai-act`) from the mission's artifacts → `runward/compliance/…`: a human readiness *draft* (OWASP ASI coverage, rule-conformance status, ADR journal, with the operator-only sections flagged) **and a machine-readable OSCAL** component-definition to feed your GRC/auditor tool. Deterministic, read-only, zero-LLM — supporting evidence, never a compliance claim. The regime mapping is **versioned data** (`--regime-version` pins the lens; the pack stamps which version produced it). The mapping itself is a published, citable mini-spec: [docs/spec/runward-oscal-mapping.md](docs/spec/runward-oscal-mapping.md) |
 
 Global flags: `--yes`, `--dry-run`, `--verbose`, `--no-color`. Exit codes: 0 success, 1 gaps/warnings, 2 missing prerequisite.
 
@@ -85,19 +85,21 @@ your-project/
 │   ├── framing.md               # problem, value, observable success criterion, floor vs target
 │   ├── mission-contract.md      # one-page steering contract: engagements, DoD, gates
 │   ├── architecture.md          # boundaries, ports, integration protocol — stack stays open
+│   ├── execution-topology.md    # per-port placement: location family, data class, sovereignty (gated)
 │   ├── decision-matrix.md       # 22 arbitrations: one sober default + one explicit trigger each
 │   ├── reference-stack.md       # default adapter kit per layer, with evolution triggers
 │   ├── shared-bricks.md         # bricks beyond the app: placement families, brick matrix, sovereignty by data class
 │   ├── floor.md                 # the smallest system that proves value on real traffic
+│   ├── handover.md              # the succession, proven: kit index, redone-task proof, named owner
 │   ├── adr/                     # one ADR per structural decision, with re-evaluation trigger
-│   ├── rules/                   # 60 craft rules your agent applies while building
+│   ├── rules/                   # 64 craft rules your agent applies while building
 │   ├── governance/
 │   │   ├── threat-model.md      # lethal trifecta, 2-of-3 rule on the context window
 │   │   ├── evaluation-rubric.md # test the deterministic, evaluate the non-deterministic
 │   │   └── observability-schema.md
 │   ├── contracts/               # port contracts (versioned, additive, tolerant reader)
 │   ├── runbook.md               # recovery runbook for the team that inherits the system
-│   ├── adapters/                # inert samples that run the gate at each harness seam (git, GitHub/GitLab CI, Claude Code)
+│   ├── adapters/                # inert samples that run the gate at each harness seam (git, GitHub/GitLab CI, Claude Code, Kiro, BMAD)
 │   └── workflows/               # the method, executable by your agent
 └── .claude/ | .cursor/          # tool profiles (--tools)
 ```
@@ -145,7 +147,7 @@ Read the doctrine: [Concevoir et exécuter des systèmes agentiques (FR)](https:
 
 Two vendor-neutral files are **always written**, so the method works on any agent with no profile at all: `AGENTS.md` (the standard charter read by Codex, Cursor, Copilot, Windsurf, Cline, Zed, Amp, opencode, Junie, Warp and more), and the **phase skills** at `.agents/skills/runward-<phase>/SKILL.md` — the converged `SKILL.md` seam read by 14+ harnesses, which surface each build phase's craft rules *by relevance* at the point of action (subordinate to the gate: a skill loaded but not applied still fails `check --strict`).
 
-Tool profiles (`--tools`) add harness-specific wiring on top: **Claude Code** (`/rw-*` commands + `.claude/skills/`), **Cursor**, **GitHub Copilot**, **Gemini CLI**, **Windsurf** (charter files), **Continue.dev** (`.continue/rules/`), **JetBrains Junie** and **Trae** (`.<harness>/skills/`). The mission structure itself is plain markdown in your repo. More profiles welcome (see [ROADMAP.md](ROADMAP.md)).
+Tool profiles (`--tools`) add harness-specific wiring on top: **Claude Code** (`/rw-*` commands + `.claude/skills/`), **Cursor**, **GitHub Copilot**, **Gemini CLI**, **Windsurf** (charter files), **Continue.dev** (`.continue/rules/`), **JetBrains Junie** and **Trae** (`.<harness>/skills/`), and **Kiro** (`.kiro/steering/`, relevance-loaded). The mission structure itself is plain markdown in your repo. More profiles welcome (see [ROADMAP.md](ROADMAP.md)).
 
 ## License
 

package/dist/commands/characterize.js

@@ -2,7 +2,7 @@ import { existsSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { buildInventory, renderCharacterization, mineDrafts, renderDraft } from "../lib/characterize.js";
 import { makeWriter } from "../lib/write.js";
-import { c, createHeader, isNonInteractive, section, status } from "../lib/styles.js";
+import { c, createHeader, generationDate, section, status } from "../lib/styles.js";
 import { VERSION } from "../lib/paths.js";
 /**
  * Characterize an existing codebase (ADR-0014) — read-only, deterministic, zero-LLM.
@@ -22,7 +22,7 @@ export async function characterizeCommand(opts) {
     console.log(section("Reading (read-only)"));
     const inv = buildInventory(root);
     const dryRun = process.env.RUNWARD_DRY_RUN === "1";
-    const generatedAt = isNonInteractive() && process.env.RUNWARD_NOW ? process.env.RUNWARD_NOW : new Date().toISOString().slice(0, 10);
+    const generatedAt = generationDate();
     const md = renderCharacterization(inv, generatedAt);
     // Generated artifact, not mission state: always refresh it (idempotent).
     const w = makeWriter({ force: true, dryRun, root });

package/dist/commands/check.js

@@ -6,7 +6,7 @@ import { evidenceReport, verifyEvidenceLock, renderEvidenceLock, EVIDENCE_LOCK }
 import { behavioralProof } from "../lib/behavioral-proof.js";
 import { verifyFindings, VERIFY_FINDINGS } from "../lib/verify-findings.js";
 import { runHooks } from "../lib/hooks.js";
-import { c, createHeader, isNonInteractive, section, status } from "../lib/styles.js";
+import { c, createHeader, generationDate, section, status } from "../lib/styles.js";
 import { VERSION } from "../lib/paths.js";
 /**
  * Gate audit — the gap analysis: which deliverable, expected at which
@@ -195,7 +195,7 @@ export async function checkCommand(opts) {
             console.log("  " + status.error("refusing to seal a red gate — a seal certifies a crossing, not a hope. Close the gaps above, then re-run `runward check --freeze`."));
         }
         else {
-            const sealedAt = isNonInteractive() && process.env.RUNWARD_NOW ? process.env.RUNWARD_NOW : new Date().toISOString().slice(0, 10);
+            const sealedAt = generationDate();
             const content = renderEvidenceLock(mission, sealedAt);
             const count = Object.keys(JSON.parse(content).files).length;
             if (process.env.RUNWARD_DRY_RUN === "1") {

package/dist/commands/compliance.js

@@ -3,7 +3,7 @@ import { findMissionRoot } from "../lib/mission.js";
 import { gatherComplianceInputs, renderIso42001Readiness, renderNistAiRmf, renderEuAiAct, renderOscal } from "../lib/compliance.js";
 import { loadRegime, regimeLensId } from "../lib/regimes.js";
 import { makeWriter } from "../lib/write.js";
-import { c, createHeader, isNonInteractive, section, status } from "../lib/styles.js";
+import { c, createHeader, generationDate, section, status } from "../lib/styles.js";
 import { VERSION } from "../lib/paths.js";
 /**
  * Assemble a regime-framed compliance evidence pack (ADR-0016) — deterministic, read-only, zero-LLM,
@@ -44,7 +44,7 @@ export async function complianceCommand(regime, opts) {
     }
     const mission = join(root, "runward");
     const dryRun = process.env.RUNWARD_DRY_RUN === "1";
-    const generatedAt = isNonInteractive() && process.env.RUNWARD_NOW ? process.env.RUNWARD_NOW : new Date().toISOString().slice(0, 10);
+    const generatedAt = generationDate();
     console.log(section("Assembling (read-only, deterministic)"));
     const inputs = gatherComplianceInputs(mission);
     const md = spec.render(inputs, generatedAt, lens);

package/dist/commands/doctor.js

@@ -36,7 +36,8 @@ export async function doctorCommand() {
     const ruleCount = existsSync(rulesDir) ? readdirSync(rulesDir).filter((f) => f.endsWith(".md")).length : 0;
     ruleCount === EXPECTED_RULES ? ok(`${ruleCount} craft rules`) : fail(`craft rules mismatch: ${ruleCount}/${EXPECTED_RULES}`);
     const adaptersDir = join(TEMPLATES, "adapters");
-    const adapterCount = existsSync(adaptersDir) ? readdirSync(adaptersDir).length : 0;
+    // Count real adapters, not the README — else substituting an adapter for a stray file passes.
+    const adapterCount = existsSync(adaptersDir) ? readdirSync(adaptersDir).filter((f) => f !== "README.md").length : 0;
     adapterCount === EXPECTED_ADAPTERS ? ok(`${adapterCount} gate adapters`) : fail(`gate adapters mismatch: ${adapterCount}/${EXPECTED_ADAPTERS}`);
     // Routed-count floor (ADR-0002): the phases: mapping must not be stripped below its pinned minimum.
     const belowFloor = Object.entries(EXPECTED_MAPPED).filter(([phase, floor]) => expectedRules(TEMPLATES, phase).length < floor);

package/dist/commands/init.js

@@ -71,6 +71,11 @@ export async function initCommand(opts) {
         // floor with them, so the gate is green because the evidence resolves — not unchecked.
         if (existsSync(EXAMPLE_CODE))
             copyTree(w, EXAMPLE_CODE, join(root, "code"));
+        // The reference ships its FINALIZED charter (ADR-0026): laid down first, so the scaffold
+        // write below skips it — the example demonstrates the leave-behind, not the starting text.
+        const exampleCharter = join(EXAMPLE_CODE, "..", "AGENTS.md");
+        if (existsSync(exampleCharter))
+            w.copy(exampleCharter, join(root, "AGENTS.md"));
         // The reference omits the three non-gated scaffolding notes; add them as blank templates so the scaffold stays complete.
         for (const extra of ["reference-stack.md", "shared-bricks.md", "gap-analysis.md"]) {
             w.copy(join(TEMPLATES, "mission", extra), join(mission, extra));

package/dist/lib/compliance.js

@@ -34,7 +34,9 @@ function readRules(missionDir) {
     if (!existsSync(dir))
         return [];
     const out = [];
-    for (const f of readdirSync(dir)) {
+    // Sorted: the ASI coverage lists and the OSCAL derive from this order, so it must be deterministic
+    // across filesystems (readdirSync order is not guaranteed) for the byte-identity invariant to hold.
+    for (const f of readdirSync(dir).sort()) {
         if (!f.endsWith(".md"))
             continue;
         let fm = "";
@@ -324,9 +326,15 @@ const ASI_CATALOG = "https://genai.owasp.org/resource/owasp-top-10-for-agentic-a
  */
 export function renderOscal(inputs, missionName, generatedAt, lensId) {
     const ns = missionName || "mission";
+    // The link points at the readiness draft co-generated with this pack — the one whose lens framed it.
+    const regime = lensId ? lensId.split("@")[0] : "iso-42001";
+    const readinessHref = `./${regime}-readiness.md`;
     const irs = Object.keys(ASI_LABELS).map((id) => {
         const slugs = inputs.asiCoverage.get(id) ?? [];
-        const statuses = slugs.map((s) => inputs.conformance.find((c) => c.rule === s)?.status).filter(Boolean);
+        // Aggregate EVERY manifest row of EVERY rule mapping this ASI, across all gated deliverables —
+        // a rule can appear in more than one manifest (spec §3). `find` (first row) made the status depend
+        // on deliverable order and could report `implemented` where a later `deviated` row means `partial`.
+        const statuses = slugs.flatMap((s) => inputs.conformance.filter((c) => c.rule === s).map((c) => c.status));
         let impl;
         if (slugs.length === 0)
             impl = "planned"; // no rule maps this risk — a gap
@@ -339,7 +347,7 @@ export function renderOscal(inputs, missionName, generatedAt, lensId) {
             "control-id": `asi-${id.slice(3)}`,
             description: `${id} ${ASI_LABELS[id]}. ${slugs.length ? "Addressed by rules: " + slugs.join(", ") + "." : "No rule mapped — gap to assess."}`,
             props: [{ name: "implementation-status", value: impl }],
-            links: [{ href: "./iso-42001-readiness.md", rel: "reference", text: "runward assessment-readiness draft" }],
+            links: [{ href: readinessHref, rel: "reference", text: "runward assessment-readiness draft" }],
         };
     });
     const doc = {

package/dist/lib/conformance.js

@@ -10,6 +10,7 @@ export const GATED_DELIVERABLES = [
     { phase: "topology", deliverable: "execution-topology.md", label: "Topology" },
     { phase: "floor", deliverable: "floor.md", label: "Floor" },
     { phase: "govern", deliverable: "governance/threat-model.md", label: "Govern" },
+    { phase: "handover", deliverable: "handover.md", label: "Handover" },
 ];
 const FRONTMATTER = /^---\n([\s\S]*?)\n---/;
 const VALID_STATUS = new Set(["applied", "deviated", "n/a"]);

package/dist/lib/constants.js

@@ -1,8 +1,11 @@
 /** Total number of craft rules shipped under templates/rules/. */
-export const EXPECTED_RULES = 60;
-/** Gate adapters shipped under templates/adapters/ (ADR-0012): one per harness seam, plus the port-contract README. */
-export const EXPECTED_ADAPTERS = 5;
+export const EXPECTED_RULES = 64;
+/** Gate adapters shipped under templates/adapters/ (ADR-0012): one per harness seam. Counts the real
+ *  adapters only — the port-contract README.md is excluded, so swapping an adapter for a stray file
+ *  cannot pass the count. pre-commit, github-actions, gitlab-ci, claude-code-settings, kiro-hooks,
+ *  bmad-review-layer. */
+export const EXPECTED_ADAPTERS = 6;
 /** Routed-count floor: minimum CRITICAL/HIGH rules mapped to each build phase (ADR-0002).
  *  Lowering a floor is a deliberate, tracked edit — the `phases:` mapping cannot be silently
  *  stripped to make `check --strict` pass vacuously. */
-export const EXPECTED_MAPPED = { architect: 6, topology: 4, floor: 10, govern: 12 };
+export const EXPECTED_MAPPED = { architect: 6, topology: 4, floor: 10, govern: 12, handover: 4 };

package/dist/lib/evidence.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, statSync } from "node:fs";
-import { dirname, isAbsolute, join, relative } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { parseManifest, evidencePathTokens, adrIdExists, GATED_DELIVERABLES } from "./conformance.js";
 const POINTER_PREFIX = /\b(file|test|adr):(\S.*)$/;
 /** Parse the typed pointers out of an Evidence cell. One pointer per `;`-separated segment. */
@@ -53,16 +53,33 @@ export function parseEvidencePointers(evidence) {
 function clean(token) {
     return token.replace(/[),.:]+$/, "");
 }
+/**
+ * A rule signature is operator-authored data the gate compiles into a RegExp and runs against file
+ * content — so a catastrophic-backtracking pattern (nested quantifiers like `(a+)+`) could hang the
+ * gate on adversarial input (a self-inflicted DoS in CI). Reject the known-dangerous shape up front,
+ * deterministically: a quantifier applied to a group that itself contains a quantifier. This is a
+ * conservative screen (it may reject a rare safe pattern — the operator rewrites it), never a promise
+ * to catch every pathological regex. Signatures are simple token alternations in practice. See ADR-0020.
+ */
+export function unsafeSignature(source) {
+    // group whose body holds a quantifier, immediately followed by another quantifier: (…+…)+ (…*…)* etc.
+    return /\((?![?])[^()]*[+*}][^()]*\)[+*{]/.test(source);
+}
 /** The same three resolution bases as the drift pass (ADR-0004). */
 export function resolutionBases(missionDir, deliverable) {
     return [dirname(missionDir), missionDir, dirname(join(missionDir, deliverable))];
 }
+/** Resolve a pointer strictly WITHIN one of the three project bases (ADR-0019): an absolute
+ *  path, or a `../` that climbs out of every base, is not "evidence in your project" — it is
+ *  rejected, not resolved. `resolve` normalizes `..`; the containment check is a prefix test on
+ *  the normalized path (with a separator, so `/a/project-evil` never counts as under `/a/project`). */
 function resolveFile(p, bases) {
     if (isAbsolute(p))
-        return existsSync(p) ? p : null;
+        return null; // an absolute evidence path escapes the project — never valid
     for (const b of bases) {
-        const abs = join(b, p);
-        if (existsSync(abs))
+        const baseAbs = resolve(b);
+        const abs = resolve(baseAbs, p);
+        if ((abs === baseAbs || abs.startsWith(baseAbs + sep)) && existsSync(abs))
             return abs;
     }
     return null;
@@ -139,6 +156,10 @@ export function evidenceReport(missionDir, deliverable, signatures) {
         // Signature (ADR-0020): a signed rule's applied evidence must contain the rule's shape.
         const sig = signatures[row.rule];
         if (sig) {
+            if (unsafeSignature(sig)) {
+                out.push({ rule: row.rule, problem: `unsafe signature regex (nested quantifiers risk catastrophic backtracking): /${sig}/ — simplify it in runward/rules/${row.rule}.md` });
+                continue;
+            }
             let re;
             try {
                 re = new RegExp(sig, "i");

package/dist/lib/mission.js

@@ -33,7 +33,10 @@ export const PHASES = [
     },
     {
         id: "handover", label: "6 · Hand over",
-        artifacts: [{ label: "Recovery runbook", relPath: "runbook.md", templateKey: "runbook.md" }],
+        artifacts: [
+            { label: "Recovery runbook", relPath: "runbook.md", templateKey: "runbook.md" },
+            { label: "Hand-over note (the kit, proven)", relPath: "handover.md", templateKey: "handover.md" },
+        ],
     },
 ];
 export function findMissionRoot(cwd) {

package/dist/lib/paths.js

@@ -27,6 +27,7 @@ export const MISSION_LAYOUT = {
     "observability-schema.md": "governance/observability-schema.md",
     "port-contract.md": "contracts/port-contract.md",
     "runbook.md": "runbook.md",
+    "handover.md": "handover.md",
 };
 export const WORKFLOWS = [
     "method", "frame", "architect", "floor", "iterate",

package/dist/lib/styles.js

@@ -54,6 +54,19 @@ export function section(title) {
 export function isNonInteractive() {
     return process.env.RUNWARD_YES === "1" || !process.stdout.isTTY;
 }
+/** Today (UTC, YYYY-MM-DD), or the RUNWARD_NOW override in non-interactive runs. The override is
+ *  VALIDATED as a real YYYY-MM-DD date: an unvalidated value flowed straight into the OSCAL and the
+ *  seal, so a malformed env var produced schema-invalid output. A bad value falls back to today. */
+export function generationDate() {
+    const today = new Date().toISOString().slice(0, 10);
+    const override = process.env.RUNWARD_NOW;
+    if (!isNonInteractive() || !override)
+        return today;
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(override))
+        return today;
+    const d = new Date(override + "T00:00:00Z");
+    return !isNaN(d.getTime()) && d.toISOString().slice(0, 10) === override ? override : today;
+}
 function stripAnsi(s) {
     // eslint-disable-next-line no-control-regex
     return s.replace(/\[[0-9;]*m/g, "");

package/dist/lib/tools.js

@@ -34,6 +34,10 @@ const PHASE_SKILLS = [
         phase: "govern", label: "governance",
         when: "governing an agentic system: the threat model, prompt-injection defense, evaluation, observability, resilience, or any sensitive-action approval",
     },
+    {
+        phase: "handover", label: "hand-over",
+        when: "preparing or executing a succession: the recovery runbook, finalizing the agent charter as a leave-behind, the redone-task proof, or naming the owner who inherits the system",
+    },
 ];
 /** The shared body — identical guidance across harnesses; only the packaging frontmatter differs. */
 const skillBody = (s) => [
@@ -128,6 +132,17 @@ export const TOOL_PROFILES = [
         label: "Trae (.trae/skills/)",
         files: (root) => skillsAt(root, ".trae", "skills"),
     },
+    {
+        id: "kiro",
+        label: "Kiro (.kiro/steering/runward-*)",
+        // Kiro reads AGENTS.md natively (the charter is already covered); this mirrors the phase
+        // skills as steering files. `inclusion: auto` + name + description is Kiro's idiom for
+        // relevance-loaded guidance — the same semantics as the SKILL.md description trigger.
+        files: (root) => PHASE_SKILLS.map((s) => ({
+            path: join(root, ".kiro", "steering", `runward-${s.phase}.md`),
+            content: ["---", "inclusion: auto", `name: runward-${s.phase}`, `description: ${yamlStr(`Runward ${s.label} craft rules. Use when ${s.when}.`)}`, "---", "", skillBody(s)].join("\n"),
+        })),
+    },
 ];
 export const TOOL_IDS = TOOL_PROFILES.map((t) => t.id);
 /** The gated build phases that get a relevance-loaded phase skill (ADR-0018). */

package/examples/request-triage/AGENTS.md

@@ -0,0 +1,33 @@
+# Agent charter — Inbound Request Triage (finalized leave-behind)
+
+**Finalized at hand-over, 2026-07-03** — this is no longer the scaffolded charter: it carries what this mission learned. Any agent working on this system follows it; the receiving team owns the gate. Names and dates are illustrative, like the rest of the reference mission.
+
+## Non-negotiable boundaries (mission-specific)
+
+1. **No model-proposed value ever acts.** Every action-bearing field is recomputed or verified deterministically before RoutingPort (ADR-0002). The provenance marker is the law: `model-proposed` never routes, fail-closed.
+2. **The account registry is read-only for agents.** It is the deterministic source the guard checks against; an agent that writes to it is falsifying its own verifier.
+3. **Compliance-flagged records are always approval-gated.** No change may route them without human approval — the framing note's attached condition, not a default to optimize away.
+4. **The TriageRecord contract changes only through governance.** Category vocabulary, fields, provenance markers: versioned, additive, one PR with its ADR — never widened ad hoc because the review queue grows (runbook §4).
+5. **Traces stay in-app.** No third-party trace export without its own decision naming recipient, data class and retention (ADR-0003; execution-topology.md).
+
+## How work is verified here
+
+- `cd code && npm test` — the behavioral proof (domain, guard, contracts).
+- `npx runward check --strict` — the conformance gate; the sole authority on the manifests.
+- `cd code && npm run demo` — the guard's climax, reproducible: the fabricated account reference (`ACC-7777`) is refused fail-closed and escalated.
+- Before crossing any green gate: the `verify` workflow (`runward/workflows/verify.md`), findings recorded in `runward/governance/verify-findings.md`.
+
+## Never / PR rules
+
+- **Never**: route on an unverified field; approve a compliance record programmatically; delete or rewrite the triage log (append-only); disable the guard "temporarily".
+- **Always via a reviewed PR with its ADR**: contract or schema changes, category vocabulary changes, a new placement (execution-topology row), any new capability (decision matrix first — no trigger, no change).
+
+## Mission state
+
+| File | What it holds |
+|---|---|
+| `runward/framing.md` · `runward/floor.md` | The criterion, and the measured proof against it |
+| `runward/architecture.md` · `runward/execution-topology.md` | Ports, placements, sovereignty |
+| `runward/adr/` | The decision journal — read the re-evaluation triggers before reopening anything |
+| `runward/runbook.md` | The operating gestures (start, observe, recover, swap, approve) |
+| `runward/handover.md` | The succession record: the kit, the redone-task proof, the named owner |

package/examples/request-triage/runward/handover.md

@@ -0,0 +1,47 @@
+# Hand-over Note — Request Triage
+
+**Date**: 2026-07-03 · **Departing builder**: the mission operator · **Receiving side**: operations team (triage product owner) · All names and dates **illustrative**, like the rest of the reference mission.
+
+## 1. The kit
+
+| Artifact | Where | State | Exercised by the receiving side? |
+|---|---|---|---|
+| Recovery runbook | `runbook.md` | ready | 2026-06-30 — ops engineer ran the recovery replay (§3) during the drill |
+| Agent charter (finalized) | `AGENTS.md` (project root) | finalized at hand-over | read and countersigned at the second transfer session |
+| Architecture note + decision journal | `architecture.md` · `adr/` (3 ADRs, triggers dated) | current | walked through, hands on keyboard |
+| Evaluation bench | `cd code && npm test` + the replay set (floor.md §2) | ready | 2026-07-02 — re-run alone (see §2) |
+| Evidence pack | `compliance/` — regenerate with `runward compliance <regime>` | regenerable on demand | generated once by the ops engineer during the drill |
+
+## 2. The redone task (the proof)
+
+- **Task**: after the illustrative provider incident of 2026-06-29 (gateway timeouts, fallback classifier engaged — runbook §4 first row), re-run the full behavioral proof and the demo, then process the suspended compliance approval that had queued during the incident — end to end, from the leave-behinds alone.
+- **Date / doer**: 2026-07-02, the operations engineer of the receiving team; the builder unavailable by agreement (out of the loop for the day).
+- **Evidence**: file:code/test/triage.test.ts; file:runward/runbook.md#Recovery — the proof re-ran green, the replay recovered the queued state, the suspended approval was released through the approval path (ADR-0002 provenance rules held).
+- **Gaps found**: two, both folded back the same day — the runbook did not name where the review queue persists (added to §3), and the demo's expected output was undocumented (added to the code README).
+
+## 3. Succession
+
+- **Owner after departure**: the triage product owner (operations) — incidents, cost, credentials, and the three open ADR re-evaluation triggers.
+- **Escalation path**: compliance officer for category/vocabulary questions; the sponsor (Head of Operations) for scope; provider support through the gateway contract.
+- **Review cadence**: the usage registry and the ADR triggers are re-read at the weekly observability review (the guard-escalation rate of ADR-0002 is already on its agenda); the evidence seal is re-taken at each gate crossing.
+- **Credentials boundary**: ticketing and gateway credentials live in the ops vault, injected at the network boundary; the builder's accesses were revoked on 2026-07-03 as part of this note.
+
+## 4. Provider-swap drill
+
+2026-06-27 — swapped the model adapter from the approved gateway deployment to the deterministic keyword fallback and back (the adapter switch of architecture.md §2), then re-ran the bench: accuracy on the replay set within the expected fallback envelope, provenance rules unaffected. The port held; the domain never noticed. Next drill on the shared-gateway trigger (ADR-0003).
+
+## Rule conformance
+
+| Rule | Status | Evidence |
+|---|---|---|
+| handover-redone-task-proof | applied | §2 — 2026-07-02, ops engineer, incident-recovery task end to end without the builder; file:code/test/triage.test.ts; file:runward/runbook.md#Recovery |
+| handover-runbook-executable | applied | file:runward/runbook.md#Recovery — the seven gestures carry commands/paths (start §1, observe §1, debug §4, resume §3, swap §2+§4, bench: cd code && npm test, approvals §3); exercised during the 2026-07-02 task |
+| handover-agents-charter-final | applied | file:AGENTS.md#Never — finalized at hand-over: mission-specific boundaries (registry read-only, compliance always approval-gated), exact verification commands, never/PR rules |
+| handover-succession-named | applied | §3 — named owner (triage product owner), escalation path, weekly review cadence, builder's accesses revoked 2026-07-03 |
+
+## Cross-references
+
+- `workflows/handover.md` — the phase this note closes.
+- `runbook.md` — the operational half of the kit.
+- `AGENTS.md` — the charter the next agent inherits.
+- `adr/` — the open re-evaluation triggers the owner now watches.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runward",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "After the spec: ship and run. A delivery framework for agentic systems \u2014 floor first, evolution on evidence, governance from day zero, handover with proof.",
   "keywords": [
     "agentic",
@@ -32,6 +32,7 @@
     "dist",
     "templates",
     "regimes",
+    "examples/request-triage/AGENTS.md",
     "examples/request-triage/runward",
     "examples/request-triage/code/src",
     "examples/request-triage/code/test",

package/regimes/eu-ai-act@2024-1689.json

@@ -3,10 +3,10 @@
   "regime": "eu-ai-act",
   "label": "EU AI Act (Annex IV)",
   "version": "2024-1689",
-  "notes": "Mapped 2026-07 against Regulation (EU) 2024/1689 (OJ L, 12 July 2024). High-risk (Annex III) obligations bind from 2 August 2026. Annex IV wording moves — confirm against the Official Journal before filing.",
+  "notes": "Mapped against Regulation (EU) 2024/1689 (OJ L, 12 July 2024), as amended by the Digital Omnibus on AI (Council final green light 29 June 2026), which postponed the Annex III high-risk obligations to 2 December 2027 (Annex I to 2 August 2028). The 2 August 2026 milestone remains real for other obligations (Article 50 transparency for systems placed on the market after that date, governance, GPAI enforcement) but is NOT the high-risk / Annex IV deadline. Annex IV wording moves — confirm against the Official Journal before filing.",
   "highRisk": {
-    "bindFrom": "2 August 2026",
-    "scope": "Annex III"
+    "bindFrom": "2 December 2027",
+    "scope": "Annex III, as postponed by the Digital Omnibus on AI (June 2026)"
   },
   "articles": {
     "runtimeLogging": "art. 12"

package/templates/adapters/README.md

@@ -49,6 +49,14 @@ Merge the `hooks` block into your `.claude/settings.json` (or `.claude/settings.
 
 This is **one example** of a per-harness turn-end hook, not a privileged one — Claude Code just happens to expose a clean, documented seam. Any agent harness that can run a command at turn-end (Codex, and others as they add the capability) wires the *same* one line: `runward check --strict`. And where a harness offers no such seam, the `pre-commit` and CI adapters above already gate the code **whatever agent produced it** — the port is the exit code, not the agent.
 
+## `kiro-hooks.json` — the same turn-end gate, Kiro flavor
+
+Copy the file into `.kiro/hooks/` in your workspace. The `Stop` trigger runs `runward check --strict` when the agent finishes, and surfaces the verdict in the session — the same one line as the Claude Code hook, another non-privileged example of a per-harness turn-end seam. Kiro also reads `AGENTS.md` natively, and `runward init --tools kiro` mirrors the phase skills as steering files (`.kiro/steering/`, relevance-loaded) — the traced decisions inform the session; the gate stays the only authority.
+
+## `bmad-review-layer.toml` — the gate as a review layer BMAD calls
+
+Copy the `[[workflow.review_layers]]` block into the customize.toml of BMAD's `bmad-code-review` skill. It adds runward's deterministic gate as one review layer beside BMAD's adversarial LLM reviewers (their extension point explicitly allows "an external reviewer via bash"): they judge the code's craft, runward verifies the traced decisions and their evidence. A complement running on BMAD's flow, not a competitor to it — same inert posture, same exit-code port (ADR-0027).
+
 ---
 
 Adapters are runward-owned templates: `runward update` refreshes them, `runward doctor` verifies them. They are never mission state. Add a new harness by dropping a new sample here — the port contract above does not change.

package/templates/adapters/bmad-review-layer.toml

@@ -0,0 +1,32 @@
+# runward gate — BMAD review-layer adapter (sample).
+# Inert until you install it: see runward/adapters/README.md.
+#
+# BMAD's bmad-code-review skill exposes a review-layers extension point whose
+# `instruction` may "run anything (e.g. an external reviewer via bash)". This
+# adds runward's deterministic, zero-LLM gate as one review layer BESIDE BMAD's
+# LLM reviewers — a complement, not a replacement: BMAD's subagents judge the
+# code's craft; runward verifies, deterministically, that every CRITICAL/HIGH
+# rule mapped to the phase is accounted for with real, resolving evidence.
+#
+# To install: copy this [[workflow.review_layers]] block into the customize.toml
+# of BMAD's bmad-code-review skill (src/bmm-skills/4-implementation/bmad-code-review/).
+# runward writes nothing into BMAD and runs nothing on its own — you wire it (ADR-0012).
+#
+# Exit codes (the port contract): 0 clean · 1 gaps · 2 no mission found.
+
+[[workflow.review_layers]]
+id = "runward-gate"
+name = "runward deterministic gate"
+# `when` (optional) could gate this layer on a runward/ mission being present.
+instruction = """
+Run the runward deterministic conformance gate as an external reviewer, via bash:
+
+    npx --yes runward check --strict
+
+Report its exit code and output verbatim as this layer's finding:
+- exit 0 → the conformance manifests are complete and their evidence resolves (a PASS finding, no severity).
+- exit 1 → report each printed gap as a finding the operator must close before merge (a traced rule is unaccounted for, or an evidence pointer is hollow/stale). Do NOT paraphrase or soften: the gate is deterministic and its verdict is not a matter of judgment.
+- exit 2 → no runward/ mission here; skip this layer (it does not apply to this repo).
+
+This layer verifies traced decisions and their evidence; it never judges code quality — that stays the other review layers' job and the operator's at the gate.
+"""

package/templates/adapters/kiro-hooks.json

@@ -0,0 +1,12 @@
+{
+  "version": "v1",
+  "hooks": [
+    {
+      "name": "runward-gate",
+      "trigger": "Stop",
+      "action": { "type": "command", "command": "npx --yes runward check --strict" },
+      "timeout": 120,
+      "enabled": true
+    }
+  ]
+}

package/templates/mission/handover.md

@@ -0,0 +1,52 @@
+# Hand-over Note
+
+> **Usage.** Fill this note in phase 6 (`workflows/handover.md`), as the succession happens — not after. It is the kit made legible in one place: what is handed over, the proof that the receiving side can operate alone, and who owns the system now. `runward check --strict` verifies its conformance manifest; you transfer autonomy, not documents.
+
+## 1. The kit
+
+One row per leave-behind. State is honest: a document nobody has exercised is `untested`, not `ready`.
+
+| Artifact | Where | State | Exercised by the receiving side? |
+|---|---|---|---|
+| Recovery runbook | `runbook.md` | [ready \| untested] | [when / by whom, or not yet] |
+| Agent charter (finalized) | `AGENTS.md` | [finalized at hand-over \| still the scaffold] | [—] |
+| Architecture note + decision journal | `architecture.md` · `adr/` | [current \| stale] | [—] |
+| Evaluation bench | [where it runs] | [ready \| untested] | [—] |
+| Evidence pack | `compliance/` (regenerate on demand) | [—] | [—] |
+
+## 2. The redone task (the proof)
+
+The hand-over is proven by a real task redone end to end **without the departing builder**. Record it here; point the manifest at this section.
+
+- **Task**: [a real one from the mission's backlog — which change, run, fix or evaluation]
+- **Date / doer**: [when, and who — explicitly without the builder in the loop]
+- **Evidence**: [the artifact produced — a merged change, a report, a closed approval; a pointer the gate can verify]
+- **Gaps found**: [every step the doer had to guess — each folded back into the runbook or charter before the gate is crossed]
+
+## 3. Succession
+
+- **Owner after departure**: [named person or standing role — incidents, cost, keys, open ADR triggers]
+- **Escalation path**: [who is called when the owner is not enough — security contact, sponsor, provider support]
+- **Review cadence**: [when the usage registry, the ADR triggers and the evidence seal are re-read, and in which forum]
+- **Credentials boundary**: [where the keys live, who rotates them; the builder's accesses revoked on — date]
+
+## 4. Provider-swap drill
+
+The model is a replaceable adapter behind a port — proven, not assumed. Record the last drill: [date, from → to, what was re-run afterwards (the bench), result]. If never drilled, say so here and name the trigger that will force it.
+
+## Rule conformance
+
+> Account for every CRITICAL/HIGH craft rule mapped to the handover phase (`runward/rules/`, frontmatter `phases: [handover]`). `applied` needs a pointer; `deviated` needs an ADR; `n/a` needs a reason. `runward check --strict` verifies this table is complete — it checks a traced succession, not whether the hand-over went well.
+>
+> Evidence can be **typed**, and typed pointers are verified deterministically at the gate: `file:PATH[:LINE][#SYMBOL]` · `test:PATH[::NAME]` · `adr:NNNN` — several per cell, separated by `;`. The gate checks resolution, non-emptiness, line count, symbol/test-name presence, and the rule's `signature:` when it declares one (ADR-0019/0020). Free prose stays valid — it is your judgment; a path it cites must simply not point at an empty file.
+
+| Rule | Status | Evidence |
+|---|---|---|
+| [rule-slug] | applied \| deviated \| n/a | [pointer, ADR-id, or reason] |
+
+## Cross-references
+
+- `workflows/handover.md` — the phase this note closes.
+- `runbook.md` — the operational half of the kit; this note indexes, the runbook operates.
+- `AGENTS.md` — the charter the next agent inherits.
+- `adr/` — the open re-evaluation triggers the new owner now watches.

package/templates/rules/handover-agents-charter-final.md

@@ -0,0 +1,45 @@
+---
+title: The Agent Charter Is Finalized as the Leave-Behind
+impact: HIGH
+asi: [ASI10]
+phases: [handover]
+impactDescription: AGENTS.md leaves the mission as the standing constraint on every future agent — verification commands, judgment boundaries, never/PR rules — so the next agent inherits the discipline, not just the code
+tags: [handover, agents-md, charter, governance, succession]
+---
+
+## The Agent Charter Is Finalized as the Leave-Behind
+
+> **The next agent was not in the room.**
+> Everything the mission learned about where agents must stop, ask, or prove is worthless if it leaves with the builder. `AGENTS.md` is where that judgment survives the succession — finalized, specific, and pointing at the gate.
+
+During the mission, the charter accumulated defaults. At hand-over it must be **rewritten as the leave-behind**: the document a receiving team's agent reads on day one, with no builder nearby to fill the gaps. An inherited agent operating without a finalized charter is the quiet path to a rogue one (ASI10) — not through malice, but through inherited ambiguity: nothing says what it may touch, what proves its work, or when it must stop and ask a human.
+
+**What "finalized" means, concretely:**
+
+- **Verification commands, exact.** The charter names how work is proven here — `runward check --strict` at minimum, the behavioral proof command, the evaluation bench. An agent that cannot verify will assert.
+- **Judgment boundaries, mission-specific.** Not the scaffold's generic five: the boundaries this mission actually discovered — which data classes are untouchable, which actions are approval-gated, which files no agent edits.
+- **Never / PR rules.** What is never done autonomously, and what always goes through a reviewed change — stated as rules, not anecdotes.
+- **The pointers resolve.** The workflows, rules and deliverables the charter cites still exist where it says — typed evidence in the manifest lets the gate verify that.
+
+**Incorrect:**
+
+```markdown
+| handover-agents-charter-final | applied | AGENTS.md exists since init |
+```
+
+Existing since `init` is the opposite of the point: the scaffold is the starting text, the leave-behind is the mission's learned judgment.
+
+**Correct:**
+
+```markdown
+| handover-agents-charter-final | applied | file:AGENTS.md#Non-negotiable — finalized at hand-over: verification commands (check --strict + npm test + bench), the two mission-specific boundaries (registry data read-only; compliance-flagged routing always approval-gated), never/PR rules |
+```
+
+**Checklist:**
+
+- [ ] The charter was re-edited at hand-over, not merely left as scaffolded.
+- [ ] Verification commands are exact and were run by the receiving side (see the redone task).
+- [ ] Mission-specific boundaries and never/PR rules are present and dated.
+- [ ] Every path the charter cites resolves — the manifest points at the charter with typed evidence.
+
+**Where this sits in the Runward method:** ADR-0010 made `AGENTS.md` a first-class hand-over deliverable; ADR-0026 makes its finalization a gated fact. The charter is how the mission's judgment outlives the mission.

package/templates/rules/handover-redone-task-proof.md

@@ -0,0 +1,46 @@
+---
+title: The Redone-Task Proof
+impact: CRITICAL
+asi: [ASI09]
+phases: [handover]
+impactDescription: A hand-over is proven by a real task redone end to end without the departing builder — recorded, dated, pointed at — so autonomy is a fact, not a farewell promise
+tags: [handover, succession, autonomy, proof, transmission]
+---
+
+## The Redone-Task Proof
+
+> **You transfer autonomy, not documents.**
+> The hand-over is proven the day the receiving side redoes a real task, end to end, without the person who built the system. Until that has happened and been recorded, the succession is a hope with a runbook attached.
+
+A kit can be complete and dead: every document present, nobody able to act. The only observable that distinguishes a live succession from a paper one is the **redone task** — a real change, run, fix or evaluation executed by the receiving team alone, from the leave-behinds, with the builder unavailable by agreement.
+
+**What the record must carry** (in `handover.md`, the proof record):
+
+- **The task** — a real one from the mission's actual work, not a rehearsed demo. Fixing a routing rule, re-running the evaluation bench after a model swap, processing a suspended approval, resuming from a checkpoint: something that exercises the runbook, the code and a decision.
+- **The date and the doer** — who redid it, when, explicitly without the builder in the loop.
+- **The evidence** — a pointer the gate can verify (`file:`, `test:`, or the artifact the task produced). "It went fine" is not evidence; the merged change, the produced report, the closed approval is.
+- **What broke, honestly** — every step where the doer had to guess is a defect in the kit. Route each one back into the runbook or the charter before the gate is crossed.
+
+**Incorrect:**
+
+```markdown
+| handover-redone-task-proof | applied | the team is confident and has been walked through everything twice |
+```
+
+A walkthrough is the builder performing; the proof is the builder absent.
+
+**Correct:**
+
+```markdown
+| handover-redone-task-proof | applied | file:runward/handover.md#Redone-task — 2026-06-28, ops engineer re-ran the eval bench after the provider swap, alone, from runbook §4; report at code/eval/reports/2026-06-28.md; two runbook gaps found and fixed |
+```
+
+**Checklist:**
+
+- [ ] The task was real mission work, chosen from the backlog, not staged.
+- [ ] The builder was genuinely out of the loop (agreed beforehand, verifiable).
+- [ ] The record names task, date, doer, and points at the produced artifact.
+- [ ] Every gap the doer hit was folded back into the runbook or charter.
+- [ ] The record lives in `handover.md` where `runward check --strict` reads it.
+
+**Where this sits in the Runward method:** phase 6 is where every other scaffold has already stopped. This rule is the difference between handing over a repository and handing over a running responsibility — and it is why the hand-over claim is gated, not narrated (ADR-0026).

package/templates/rules/handover-runbook-executable.md

@@ -0,0 +1,50 @@
+---
+title: The Runbook Is Executable, Not Descriptive
+impact: HIGH
+asi: [ASI08]
+phases: [handover]
+impactDescription: The recovery runbook carries real commands for the gestures that matter at 3 a.m. — start, observe, debug, resume, swap the provider, rerun the bench, process a suspended approval — so an incident meets procedures, not prose
+tags: [handover, runbook, operations, recovery, resilience]
+---
+
+## The Runbook Is Executable, Not Descriptive
+
+> **A runbook is judged at 3 a.m., by someone who was not there when the system was built.**
+> Every gesture it promises must be a command that runs, a path that exists, a signal that can actually be read — not a paragraph explaining that such things are possible.
+
+Agentic systems fail in cascades (ASI08): a provider degrades, a queue backs up, an approval hangs, and the operator's margin is measured in minutes. The runbook is the artifact that converts a cascade into a sequence of known gestures. A descriptive runbook — "the system can be restarted; logs are available" — is a cascade accelerant: it costs the reader the minutes it pretends to save.
+
+**The seven gestures the runbook must carry, each with its real command or path:**
+
+1. **Start / stop** — the exact commands, including the safe-stop that drains instead of kills.
+2. **Observe** — where the structured logs and metrics are, and the one query that answers "is it healthy?".
+3. **Debug a trajectory** — how to reconstruct a full run from one request ID.
+4. **Resume from a checkpoint** — where suspended state lives and the command that rehydrates it.
+5. **Swap the model provider** — the adapter switch, the config to change, and what to re-run afterwards.
+6. **Rerun the evaluation bench** — the command, and where the report lands.
+7. **Process a suspended approval** — where it queues, who may approve, the command or UI path that releases it.
+
+**Incorrect:**
+
+```markdown
+## Recovery
+The system is resilient and can be restarted. Observability is in place.
+```
+
+**Correct:**
+
+```markdown
+## 4. Resume from a checkpoint
+Suspended runs live in var/journal/ (one file per request ID).
+    npm run resume -- --request <id>
+Verify: the trajectory for <id> continues in the structured log within 30 s.
+```
+
+**Checklist:**
+
+- [ ] All seven gestures present, each with a command or concrete path — no gesture "described" without one.
+- [ ] Commands were executed at least once by someone other than their author (the redone task is the natural occasion).
+- [ ] The runbook names its own verification: how the reader confirms each gesture worked.
+- [ ] Paths and commands are pointed at from the manifest with typed evidence, so the gate catches drift when they move.
+
+**Where this sits in the Runward method:** the runbook is scaffolded at `init` and demanded by the hand-over workflow since day one; this rule makes its *executability* a gated fact (ADR-0026) instead of a review opinion.

package/templates/rules/handover-succession-named.md

@@ -0,0 +1,46 @@
+---
+title: The Succession Is Named
+impact: HIGH
+asi: []
+phases: [handover]
+impactDescription: The system leaves the mission with a named owner, an escalation path and a review cadence — an unowned agentic system in production is an incident with a start date
+tags: [handover, ownership, succession, governance, operations]
+---
+
+## The Succession Is Named
+
+> **Systems do not stay owned by default; they become orphans by default.**
+> The day the builder leaves, either a named person owns the system — its budget, its keys, its incidents, its re-evaluation triggers — or nobody does, and every ADR trigger, every drift signal, every suspended approval now fires into a void.
+
+runward's whole discipline rests on someone reading the signals: re-evaluation triggers are *watched*, drift is *re-verified*, approvals are *processed*, the usage registry is *reviewed*. Those are verbs with a subject. Hand-over is the moment the subject changes — and the moment it silently becomes no one, unless the succession is written down where the gate can see it.
+
+**What the record must carry** (in `handover.md`):
+
+- **The owner** — a named person or standing role (not "the team") who owns the system after the departure: incidents, cost, keys, and the decision journal's open triggers.
+- **The escalation path** — who is called when the owner is not enough: security contact, sponsor, provider support entry points.
+- **The review cadence** — when the usage registry, the ADR triggers and the evidence seal are re-read (the iterate-gate rhythm surviving the builder), and in which forum.
+- **The credentials boundary** — where the keys live and who may rotate them; the departing builder's accesses are revoked as part of the hand-over, and the record says so.
+
+**Incorrect:**
+
+```markdown
+| handover-succession-named | applied | the team owns it going forward |
+```
+
+A team is not a subject; "going forward" is not a cadence.
+
+**Correct:**
+
+```markdown
+| handover-succession-named | applied | file:runward/handover.md#Succession — owner: ops lead (named); escalation: security officer, then sponsor; registry + ADR triggers reviewed monthly in the ops review; builder's accesses revoked 2026-06-30 |
+```
+
+**Checklist:**
+
+- [ ] One named owner (person or standing role) — for incidents, cost, keys and open ADR triggers.
+- [ ] An escalation path with real names or roles, reachable.
+- [ ] A written cadence for re-reading the registry, the triggers and the seal.
+- [ ] The builder's credentials revoked, and the revocation recorded.
+- [ ] The record lives in `handover.md`, verified by `runward check --strict`.
+
+**Where this sits in the Runward method:** governance from day zero only matters if it survives day last. This rule is the difference between transmitting a system and abandoning it politely (ADR-0026).

package/templates/targets/AGENTS.md

@@ -31,3 +31,4 @@ This project is delivered with the Runward method: floor first, evolution on evi
 | `runward/adr/` | Decision journal |
 | `runward/governance/` | Threat model, evaluation rubric, observability schema |
 | `runward/runbook.md` | Recovery runbook for the receiving team |
+| `runward/handover.md` | The succession record: kit index, redone-task proof, named owner — gated at phase 6 |

package/templates/workflows/handover.md

@@ -8,12 +8,13 @@ Use this workflow when a delivery approaches its end or a team must become self-
 
 - The artifacts of prior phases: architecture note, floor, ADR journal, threat model, evaluation rubric, observability schema.
 - A receiving team with time allocated for transfer sessions.
-- The `mission/runbook.md` template.
+- The `mission/runbook.md` and `mission/handover.md` templates.
 
 ## Outputs
 
 - A handover kit (below).
 - A demonstrated proof of autonomy.
+- The hand-over note (`mission/handover.md`): the kit indexed, the redone-task proof recorded, the succession named, the provider-swap drill logged — the gated deliverable of this phase.
 
 ## Procedure
 
@@ -36,11 +37,15 @@ Use this workflow when a delivery approaches its end or a team must become self-
 
 **Capitalize upward.** What repeats deserves standardizing. Escalate recurring patterns to whoever can industrialize them: an evolution trigger observed several times, an adapter rewritten identically across missions, a recurring guardrail. Feed proven arbitrations back into the decision matrix and the workflow files — the corpus hardens mission after mission. What gets capitalized is never the prototype (replaceable); it is the architecture and the method (owned).
 
-**Verify the Definition of Done explicitly.** The phase is done when the receiving team redoes a task alone, end to end, demonstrated — a sign-off or a training session does not count. The team, without you: starts the system, observes it, debugs an incident, adds an evaluation scenario, and decides a switch by leaning on the ADRs. All of it demonstrated, not promised.
+**Record the succession in the hand-over note.** Fill `mission/handover.md` as the succession happens: the kit index with honest states, the redone-task proof (task, date, doer, evidence, gaps folded back), the named owner with escalation path and review cadence, the provider-swap drill. Confront the CRITICAL/HIGH rules mapped to the handover phase (`runward/rules/`, `phases: [handover]`) and account for each in the note's `Rule conformance` manifest — `runward check --strict` verifies it, down to the typed evidence pointers.
+
+**Verify the Definition of Done explicitly.** The phase is done when the receiving team redoes a task alone, end to end, demonstrated — a sign-off or a training session does not count. The team, without you: starts the system, observes it, debugs an incident, adds an evaluation scenario, and decides a switch by leaning on the ADRs. All of it demonstrated, not promised — and recorded in the hand-over note, where the gate reads it.
 
 ## Definition of Done
 
 - Handover kit complete: assets, architecture note, ADR journal, runbook, proof in code, and the finalized `AGENTS.md` charter (the harness-neutral leave-behind).
+- Hand-over note produced (`mission/handover.md`): kit indexed, redone-task proof recorded, succession named, provider-swap drill logged.
+- Every handover CRITICAL/HIGH rule accounted for in the note's conformance manifest (`runward check --strict`).
 - Transfer sessions held with the team operating, not observing.
 - The team has repeated at least one real task end to end, alone — demonstrated, witnessed, recorded.
 - Recurring patterns escalated and fed back into the framework's templates.