runward 0.7.0 → 0.9.0

package/README.md

@@ -1,5 +1,7 @@
 # Runward
 
+![Runward — the working frame for your agent, from idea to production](assets/og-image-en.jpg)
+
 [![npm](https://img.shields.io/npm/v/runward?style=for-the-badge&color=0a0a0a&label=npm)](https://www.npmjs.com/package/runward) [![License: MIT](https://img.shields.io/badge/License-MIT-0a0a0a?style=for-the-badge)](LICENSE) [![Doctrine: CC BY-ND 4.0](https://img.shields.io/badge/Doctrine-CC%20BY--ND%204.0-C9A45C?style=for-the-badge)](https://github.com/stranxik/designing-and-running-agentic-systems) [![Support via Ko-fi](https://img.shields.io/badge/%E2%98%95%20Support%20via%20Ko--fi-orange?style=for-the-badge)](https://ko-fi.com/stranxik)
 
 **From business need to a system that holds in production.**
@@ -8,7 +10,7 @@ Your agent builds fast. Runward frames what it builds — six gated phases your
 
 Runward is a delivery framework for agentic systems. It covers the entire mission, from framing to handover — it opens before any spec in greenfield, or picks up where the spec tools stop, and carries through to the run and the handover either way. Three ways in: day one of a new project (Frame is the first gate, before any spec exists), from an existing spec (Spec Kit, OpenSpec or in-house — it becomes the input of framing), or from an existing prototype (brownfield: characterize before touching anything). Then: floor first (the floor: the smallest *running* system that proves value on real traffic), evolution on evidence, governance from day zero, and a handover that makes your team autonomous.
 
-> Spec Kit, OpenSpec and BMAD stop at authoring: specs, plans, implementation. Runward pilots the whole mission — and picks up their output if you use them. What none of them *structures* is the run: governed memory, resilience, execution security, continuous evaluation, transmission.
+> Spec Kit, OpenSpec and BMAD take you to tested, sometimes merged code. Runward pilots the whole mission — and picks up their output if you use them. What none of them *structures* is the run: governed memory, resilience, execution security, continuous evaluation, transmission.
 
 ## Why
 
@@ -18,7 +20,7 @@ Spec-driven frameworks answered the first half of that problem: write the right
 
 Agentic systems break four assumptions of classical distributed engineering. The core component is **non-deterministic**: same input, different output, by design. **Input is indistinguishable from instruction**: anything the model reads can try to command it, so prompt injection is structural, not a bug to patch. **Forgetting becomes an engineering problem**: memory that only grows drowns the signal, so decay, invalidation and consolidation have to be designed, not hoped for. And the **blast radius is unprecedented**: an agent with tools acts on the world, so a bad output is no longer just a bad answer.
 
-Runward's answer opens with a founding inversion — the **LLM Boundary Principle**: the architecture constrains the model, never the other way around. That opening posture unfolds into five gestures: boundaries before the stack; start simple, isolate by contract, grow on evidence; keep the deterministic out of the model; explicit state and governed memory; govern, trace and evaluate from day zero. The full base is the method itself: six gated phases (a gate: a checkpoint you cross on evidence, never on assertion), each with a Definition of Ready and a Definition of Done, a 22-arbitration decision matrix, and 51 craft rules. The inversion opens the method; the phases, gestures and rules are what carry it.
+Runward's answer opens with a founding inversion — the **LLM Boundary Principle**: the architecture constrains the model, never the other way around. That opening posture unfolds into five gestures: boundaries before the stack; start simple, isolate by contract, grow on evidence; keep the deterministic out of the model; explicit state and governed memory; govern, trace and evaluate from day zero. The full base is the method itself: six gated phases (a gate: a checkpoint you cross on evidence, never on assertion), each with a Definition of Ready and a Definition of Done, a 22-arbitration decision matrix, and 54 craft rules. The inversion opens the method; the phases, gestures and rules are what carry it.
 
 ## Who it's for — and when
 
@@ -60,6 +62,8 @@ New here? Follow [your first mission in 15 minutes](docs/first-mission.md).
 
 Global flags: `--yes`, `--dry-run`, `--verbose`, `--no-color`. Exit codes: 0 success, 1 gaps/warnings, 2 missing prerequisite.
 
+The gate's exit code is a **port**: `runward/adapters/` ships inert sample wiring — a git `pre-commit` hook, a CI job, a Claude Code `Stop`-hook — so the gate runs at each harness's natural moment (commit, merge, agent turn-end). You copy an adapter in; runward never installs or runs one for you.
+
 `init` creates:
 
 ```
@@ -74,13 +78,14 @@ your-project/
 │   ├── shared-bricks.md         # bricks beyond the app: placement families, brick matrix, sovereignty by data class
 │   ├── floor.md                 # the smallest system that proves value on real traffic
 │   ├── adr/                     # one ADR per structural decision, with re-evaluation trigger
-│   ├── rules/                   # 51 craft rules your agent applies while building
+│   ├── rules/                   # 54 craft rules your agent applies while building
 │   ├── governance/
 │   │   ├── threat-model.md      # lethal trifecta, 2-of-3 rule on the context window
 │   │   ├── evaluation-rubric.md # test the deterministic, evaluate the non-deterministic
 │   │   └── observability-schema.md
 │   ├── contracts/               # port contracts (versioned, additive, tolerant reader)
 │   ├── runbook.md               # recovery runbook for the team that inherits the system
+│   ├── adapters/                # inert samples that run the gate at each harness seam (git, CI, Claude Code)
 │   └── workflows/               # the method, executable by your agent
 └── .claude/ | .cursor/          # tool profiles (--tools)
 ```
@@ -105,7 +110,7 @@ Phase 5 is transverse: it starts at day zero, not after the incident.
 - **Floor, not MVP deck.** The floor is the smallest *running* system that proves value on real traffic. A presentation is not a floor.
 - **Evolution on evidence.** Multi-agent, long-term memory, microservices, a bigger model: each has a sober default and an explicit trigger. No trigger, no complexity. Every switch is an ADR.
 - **Security by architecture, not detection.** Prompt injection is constrained structurally (lethal trifecta, 2-of-3 rule), not filtered heuristically.
-- **Craft rules, not vibes.** 51 engineering craft rules ship with the mission (memory scoring, tiered retrieval, event sourcing, request-id propagation, multi-provider fallback, cost routing, post-turn pipelines, prompt-injection defenses…) — your agent applies them, `runward check` will not invent them. Code examples follow the reference-stack default (a single language in the core — TypeScript by default, an adapter decision like any other: see the decision matrix). The patterns are the contract; the language is the adapter.
+- **Craft rules, not vibes.** 54 engineering craft rules ship with the mission (memory scoring, tiered retrieval, event sourcing, request-id propagation, multi-provider fallback, cost routing, post-turn pipelines, prompt-injection defenses…) — your agent applies them, `runward check` will not invent them. Code examples follow the reference-stack default (a single language in the core — TypeScript by default, an adapter decision like any other: see the decision matrix). The patterns are the contract; the language is the adapter.
 - **One accountable operator, not a simulated team.** One human owns every gate while the agent executes the workflows — see [the operator role](docs/operator-role.md).
 - **Handover as a deliverable.** The mission ends when the receiving team is autonomous, with proof.
 

package/dist/cli.js

@@ -58,6 +58,7 @@ program
     .description("can I cross the gate — gate audit, exit 1 on gaps (CI-friendly)")
     .option("-p, --path <path>", "project directory")
     .option("--strict", "also verify the floor rule-conformance manifest (deterministic)")
+    .option("--hooks", "run operator hooks from runward/hooks.json around the audit (opt-in)")
     .action(checkCommand);
 program
     .command("status")

package/dist/commands/check.js

@@ -1,6 +1,7 @@
 import { join } from "node:path";
 import { analyze, findMissionRoot } from "../lib/mission.js";
-import { conformance } from "../lib/conformance.js";
+import { conformance, driftReport } from "../lib/conformance.js";
+import { runHooks } from "../lib/hooks.js";
 import { c, createHeader, section, status } from "../lib/styles.js";
 import { VERSION } from "../lib/paths.js";
 /**
@@ -21,6 +22,15 @@ export async function checkCommand(opts) {
     const mission = join(root, "runward");
     const report = analyze(mission);
     console.log(createHeader(`Runward v${VERSION} — gate audit`, root));
+    let hookFailed = 0;
+    if (opts.hooks) {
+        const before = runHooks(mission, "before", root);
+        if (before.ran > 0) {
+            console.log(section("Hooks · before"));
+            console.log("  " + (before.failed.length ? status.error(`${before.failed.length}/${before.ran} failed`) : status.success(`${before.ran} ok`)));
+            hookFailed += before.failed.length;
+        }
+    }
     const glyph = {
         "filled": c.success("✓"),
         "in-progress": c.warning("◐"),
@@ -51,7 +61,10 @@ export async function checkCommand(opts) {
         ];
         console.log(section("Rule conformance (--strict)"));
         let checked = 0;
+        const drift = [];
         for (const { phase, deliverable, label } of CONFORMANCE) {
+            for (const d of driftReport(mission, deliverable))
+                drift.push(`${label} · ${d.rule} — ${d.problem}`);
             const { expected, violations } = conformance(mission, phase, deliverable);
             if (expected.length === 0)
                 continue;
@@ -67,11 +80,25 @@ export async function checkCommand(opts) {
         }
         if (checked === 0)
             console.log("  " + c.darkGray("no CRITICAL/HIGH rules mapped to a build phase"));
+        if (drift.length > 0) {
+            console.log(section("Drift (advisory)"));
+            for (const d of drift)
+                console.log(`  ${c.warning("◑")} ${c.white(d)}`);
+            console.log("  " + c.darkGray("advisory — an applied pointer no longer resolves; verify it. Does not fail the gate."));
+        }
+    }
+    if (opts.hooks) {
+        const after = runHooks(mission, "after", root);
+        if (after.ran > 0) {
+            console.log(section("Hooks · after"));
+            console.log("  " + (after.failed.length ? status.error(`${after.failed.length}/${after.ran} failed`) : status.success(`${after.ran} ok`)));
+            hookFailed += after.failed.length;
+        }
     }
     console.log(section("Summary"));
     console.log(`  ${c.primaryBold("Current gate")}  ${c.white(report.currentPhase)}`);
     console.log(`  ${c.primaryBold("ADRs")}          ${c.white(String(report.adrCount))}${report.adrCount === 0 ? c.warning("  — no structural decision locked yet") : ""}`);
-    if (gaps === 0 && strictGaps === 0) {
+    if (gaps === 0 && strictGaps === 0 && hookFailed === 0) {
         console.log("\n" + status.success("All expected deliverables are filled. Cross gates on evidence, not on paperwork."));
     }
     else {
@@ -80,6 +107,8 @@ export async function checkCommand(opts) {
             parts.push(`${gaps} deliverable(s) not filled`);
         if (strictGaps)
             parts.push(`${strictGaps} floor rule-conformance gap(s)`);
+        if (hookFailed)
+            parts.push(`${hookFailed} hook(s) failed`);
         console.log("\n" + status.warning(`${parts.join(" · ")}. No phase closes without its artifact — and, under --strict, without its CRITICAL/HIGH rules accounted for.`));
         process.exitCode = 1;
     }

package/dist/commands/doctor.js

@@ -2,7 +2,8 @@ import { execFileSync } from "node:child_process";
 import { existsSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { TEMPLATES, MISSION_LAYOUT, VERSION, WORKFLOWS } from "../lib/paths.js";
-import { EXPECTED_RULES } from "../lib/constants.js";
+import { EXPECTED_RULES, EXPECTED_MAPPED, EXPECTED_ADAPTERS } from "../lib/constants.js";
+import { expectedRules } from "../lib/conformance.js";
 import { findMissionRoot } from "../lib/mission.js";
 import { createHeader, section, status } from "../lib/styles.js";
 /**
@@ -34,6 +35,14 @@ export async function doctorCommand() {
     const rulesDir = join(TEMPLATES, "rules");
     const ruleCount = existsSync(rulesDir) ? readdirSync(rulesDir).filter((f) => f.endsWith(".md")).length : 0;
     ruleCount === EXPECTED_RULES ? ok(`${ruleCount} craft rules`) : fail(`craft rules mismatch: ${ruleCount}/${EXPECTED_RULES}`);
+    const adaptersDir = join(TEMPLATES, "adapters");
+    const adapterCount = existsSync(adaptersDir) ? readdirSync(adaptersDir).length : 0;
+    adapterCount === EXPECTED_ADAPTERS ? ok(`${adapterCount} gate adapters`) : fail(`gate adapters mismatch: ${adapterCount}/${EXPECTED_ADAPTERS}`);
+    // Routed-count floor (ADR-0002): the phases: mapping must not be stripped below its pinned minimum.
+    const belowFloor = Object.entries(EXPECTED_MAPPED).filter(([phase, floor]) => expectedRules(TEMPLATES, phase).length < floor);
+    belowFloor.length === 0
+        ? ok(`rule mapping floors met (${Object.entries(EXPECTED_MAPPED).map(([p, f]) => `${p}≥${f}`).join(", ")})`)
+        : fail(`rule mapping below floor: ${belowFloor.map(([p, f]) => `${p} ${expectedRules(TEMPLATES, p).length}/${f}`).join(", ")}`);
     console.log(section("Current directory"));
     const root = findMissionRoot(process.cwd());
     if (!root) {

package/dist/commands/init.js

@@ -71,6 +71,10 @@ export async function initCommand(opts) {
     for (const r of rules) {
         w.copy(join(TEMPLATES, "rules", r), join(mission, "rules", r));
     }
+    console.log(section("Gate adapters"));
+    for (const a of readdirSync(join(TEMPLATES, "adapters"))) {
+        w.copy(join(TEMPLATES, "adapters", a), join(mission, "adapters", a));
+    }
     console.log(section("Agent charter"));
     w.copy(join(TEMPLATES, "targets", "AGENTS.md"), join(root, "AGENTS.md"));
     for (const profile of TOOL_PROFILES.filter((p) => tools.includes(p.id))) {

package/dist/commands/update.js

@@ -19,8 +19,9 @@ export async function updateCommand(opts) {
     console.log(createHeader(`Runward v${VERSION} — update workflows & rules`, root));
     let same = 0, drifted = 0, added = 0;
     const w = makeWriter({ force: true, dryRun, root });
-    for (const dir of ["workflows", "rules"]) {
-        console.log(section(dir === "workflows" ? "Workflows" : "Craft rules"));
+    const LABELS = { workflows: "Workflows", rules: "Craft rules", adapters: "Gate adapters" };
+    for (const dir of ["workflows", "rules", "adapters"]) {
+        console.log(section(LABELS[dir]));
         const dest = join(root, "runward", dir);
         for (const file of readdirSync(join(TEMPLATES, dir))) {
             const src = readFileSync(join(TEMPLATES, dir, file), "utf8");

package/dist/lib/conformance.js

@@ -1,8 +1,15 @@
 import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+import { join, dirname } from "node:path";
 import { TEMPLATES } from "./paths.js";
+import { EXPECTED_MAPPED } from "./constants.js";
+import { RULE_MIGRATIONS } from "./rule-migrations.js";
 const FRONTMATTER = /^---\n([\s\S]*?)\n---/;
 const VALID_STATUS = new Set(["applied", "deviated", "n/a"]);
+/** An n/a reason must be more than a placeholder: real length, not a bracketed template token. */
+function trivialReason(s) {
+    const t = s.trim();
+    return t.length < 8 || /^\[.*\]$/.test(t);
+}
 function parseRuleMeta(content) {
     const fm = content.match(FRONTMATTER)?.[1] ?? "";
     const impact = (fm.match(/^impact:\s*(.+)$/m)?.[1] ?? "").trim();
@@ -28,6 +35,14 @@ export function expectedRules(missionDir, phaseId) {
         .map((f) => f.replace(/\.md$/, ""))
         .sort();
 }
+/** Every rule slug in the set (mission's own, else the package) — the universe a manifest row must belong to. */
+export function allRules(missionDir) {
+    const missionRules = join(missionDir, "rules");
+    const dir = existsSync(missionRules) ? missionRules : join(TEMPLATES, "rules");
+    if (!existsSync(dir))
+        return [];
+    return readdirSync(dir).filter((f) => f.endsWith(".md")).map((f) => f.replace(/\.md$/, ""));
+}
 /** Parse the "## Rule conformance" markdown table from a deliverable. */
 export function parseManifest(content) {
     const lines = content.split("\n");
@@ -58,19 +73,65 @@ function adrExists(missionDir, evidence) {
     const dir = join(missionDir, "adr");
     return existsSync(dir) && readdirSync(dir).some((f) => f.toUpperCase().startsWith(id));
 }
+// A path token: a file with a known code/doc extension (excludes version numbers like v1.0, "§2").
+const PATH_TOKEN = /[\w./-]+\.(?:ts|tsx|js|jsx|mjs|cjs|py|md|json|ya?ml|toml|go|rs|java|rb|php|sql|sh|css|scss|html|txt)\b/g;
+/** Advisory drift (ADR-0004): applied pointers whose file path no longer resolves. Existence only. */
+export function driftReport(missionDir, deliverable) {
+    const path = join(missionDir, deliverable);
+    if (!existsSync(path))
+        return [];
+    const bases = [dirname(missionDir), missionDir, dirname(path)];
+    const out = [];
+    for (const row of parseManifest(readFileSync(path, "utf8"))) {
+        if (row.status !== "applied")
+            continue;
+        const tokens = row.evidence.match(PATH_TOKEN) ?? [];
+        if (tokens.length === 0)
+            continue; // pure prose reference — the operator's judgment
+        const resolves = tokens.some((t) => bases.some((b) => existsSync(join(b, t))));
+        if (!resolves)
+            out.push({ rule: row.rule, problem: `applied pointer does not resolve (drift?): ${row.evidence} — update the pointer or remove the row` });
+    }
+    return out;
+}
 /** Verify a build phase's conformance manifest against its expected rule set. */
 export function conformance(missionDir, phaseId, deliverable) {
     const expected = expectedRules(missionDir, phaseId);
     const violations = [];
+    // Non-vacuity (ADR-0002): the mapping cannot be stripped below its pinned floor.
+    const floor = EXPECTED_MAPPED[phaseId];
+    if (floor !== undefined && expected.length < floor) {
+        violations.push({ rule: "(mapping)", problem: `only ${expected.length} CRITICAL/HIGH rules mapped to '${phaseId}', floor is ${floor} — the mapping may have been stripped; restore the phases: [...] frontmatter on this phase's rules` });
+    }
     const path = join(missionDir, deliverable);
     if (!existsSync(path)) {
         return { expected, violations: expected.map((rule) => ({ rule, problem: `${deliverable} missing` })) };
     }
-    const byRule = new Map(parseManifest(readFileSync(path, "utf8")).map((r) => [r.rule, r]));
+    const rows = parseManifest(readFileSync(path, "utf8"));
+    // Form-lint (ADR-0003): well-formedness before the semantic check. Skip template placeholder tokens.
+    const known = new Set(allRules(missionDir));
+    const counts = new Map();
+    for (const r of rows) {
+        if (/^\[.*\]$/.test(r.rule))
+            continue;
+        counts.set(r.rule, (counts.get(r.rule) ?? 0) + 1);
+    }
+    for (const [rule, n] of counts) {
+        if (!known.has(rule)) {
+            const m = RULE_MIGRATIONS[rule];
+            const hint = m
+                ? (m.to ? ` — renamed to '${m.to}' in ${m.since} (${m.reason})` : ` — removed in ${m.since} (${m.reason})`)
+                : " (typo? not in runward/rules/)";
+            violations.push({ rule, problem: `unknown rule${hint}` });
+        }
+        if (n > 1)
+            violations.push({ rule, problem: `listed ${n} times in the manifest — keep a single row per rule` });
+    }
+    const byRule = new Map(rows.map((r) => [r.rule, r]));
     for (const rule of expected) {
         const row = byRule.get(rule);
         if (!row) {
-            violations.push({ rule, problem: "not accounted for in the Rule conformance manifest" });
+            violations.push({ rule, problem: "not accounted for in the Rule conformance manifest — add a row: applied with a file:line/test, deviated with an ADR, or n/a with a reason" });
             continue;
         }
         if (!VALID_STATUS.has(row.status)) {
@@ -78,11 +139,11 @@ export function conformance(missionDir, phaseId, deliverable) {
             continue;
         }
         if (row.status === "applied" && !row.evidence)
-            violations.push({ rule, problem: "applied without an evidence pointer" });
+            violations.push({ rule, problem: "applied without an evidence pointer — put a file:line or a test in the Evidence column" });
         if (row.status === "deviated" && !adrExists(missionDir, row.evidence))
-            violations.push({ rule, problem: "deviated but no matching ADR in runward/adr/" });
-        if (row.status === "n/a" && !row.evidence)
-            violations.push({ rule, problem: "n/a without a reason" });
+            violations.push({ rule, problem: "deviated but no matching ADR in runward/adr/ — reference an ADR that exists there" });
+        if (row.status === "n/a" && trivialReason(row.evidence))
+            violations.push({ rule, problem: "n/a with an empty or placeholder reason — give a real one-line reason why it does not apply here" });
     }
     return { expected, violations };
 }

package/dist/lib/constants.js

@@ -1,2 +1,8 @@
 /** Total number of craft rules shipped under templates/rules/. */
-export const EXPECTED_RULES = 51;
+export const EXPECTED_RULES = 54;
+/** Gate adapters shipped under templates/adapters/ (ADR-0012): one per harness seam, plus the port-contract README. */
+export const EXPECTED_ADAPTERS = 4;
+/** Routed-count floor: minimum CRITICAL/HIGH rules mapped to each build phase (ADR-0002).
+ *  Lowering a floor is a deliberate, tracked edit — the `phases:` mapping cannot be silently
+ *  stripped to make `check --strict` pass vacuously. */
+export const EXPECTED_MAPPED = { architect: 6, floor: 10, govern: 10 };

package/dist/lib/hooks.js

@@ -0,0 +1,26 @@
+import { execSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+export function runHooks(missionDir, phase, cwd) {
+    const result = { ran: 0, failed: [] };
+    const path = join(missionDir, "hooks.json");
+    if (!existsSync(path))
+        return result;
+    let cfg;
+    try {
+        cfg = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return result;
+    }
+    for (const cmd of cfg[phase] ?? []) {
+        result.ran++;
+        try {
+            execSync(cmd, { cwd, stdio: "inherit" });
+        }
+        catch {
+            result.failed.push(cmd);
+        }
+    }
+    return result;
+}

package/dist/lib/paths.js

@@ -24,5 +24,5 @@ export const MISSION_LAYOUT = {
 };
 export const WORKFLOWS = [
     "method", "frame", "architect", "floor", "iterate",
-    "govern", "handover", "brownfield", "review", "decision-loop",
+    "govern", "handover", "brownfield", "review", "decision-loop", "verify",
 ];

package/dist/lib/rule-migrations.js

@@ -0,0 +1,7 @@
+export const RULE_MIGRATIONS = {
+    "hexa-llm-boundary-principle": {
+        to: "hexa-move-deterministic-out",
+        reason: "the name is reserved for the founding inversion",
+        since: "v0.7.0",
+    },
+};

package/package.json

@@ -1,17 +1,39 @@
 {
   "name": "runward",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "After the spec: ship and run. A delivery framework for agentic systems — floor first, evolution on evidence, governance from day zero, handover with proof.",
-  "keywords": ["agentic", "ai-agents", "spec-driven", "delivery", "governance", "llm", "architecture"],
+  "keywords": [
+    "agentic",
+    "ai-agents",
+    "spec-driven",
+    "delivery",
+    "governance",
+    "llm",
+    "architecture"
+  ],
   "author": "Thibault Souris",
   "license": "MIT",
-  "repository": { "type": "git", "url": "git+https://github.com/stranxik/runward.git" },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/stranxik/runward.git"
+  },
   "homepage": "https://runward.dev",
-  "bugs": { "url": "https://github.com/stranxik/runward/issues" },
+  "bugs": {
+    "url": "https://github.com/stranxik/runward/issues"
+  },
   "type": "module",
-  "bin": { "runward": "dist/cli.js" },
-  "files": ["dist", "templates", "README.md", "NOTICE.md"],
-  "engines": { "node": ">=20" },
+  "bin": {
+    "runward": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "templates",
+    "README.md",
+    "NOTICE.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
   "scripts": {
     "build": "tsc",
     "test": "npm run build && node test/smoke.js",

package/templates/adapters/README.md

@@ -0,0 +1,48 @@
+# Gate adapters
+
+The runward gate is a **port**. Its whole contract is an exit code:
+
+| Exit | Meaning |
+|------|---------|
+| `0`  | current gate clean — every expected deliverable is filled (and, under `--strict`, every CRITICAL/HIGH rule mapped to a build phase is accounted for) |
+| `1`  | gaps — a deliverable is not filled, a `--strict` rule-conformance gap remains, or an enabled hook failed |
+| `2`  | no `runward/` mission found here or above |
+
+A human reads that verdict by typing `runward check`. These adapters let a **harness** read the same verdict at the moment it matters — a commit, a CI run, an agent finishing a turn — without runward running, watching, or installing anything.
+
+> **runward never wires these for you.** Each file below is an inert sample. Nothing here executes on `init`, on clone, or on `check`. You copy it into your harness, in a repo you trust. This is the same opt-in posture as the `--hooks` seam (ADR-0008), one step stronger: runward does not even run these — it hands them over.
+
+The command inside every adapter is runward's own deterministic, zero-LLM gate — not arbitrary shell. Choose `runward check` for the deliverable audit, or `runward check --strict` to also enforce the floor rule-conformance manifest.
+
+---
+
+## `pre-commit` — block a commit on an open gate
+
+Copy it into your repo's git hooks and make it executable:
+
+```sh
+cp runward/adapters/pre-commit .git/hooks/pre-commit
+chmod +x .git/hooks/pre-commit
+```
+
+Or keep hooks in-tree and point git at them:
+
+```sh
+mkdir -p .githooks && cp runward/adapters/pre-commit .githooks/pre-commit
+chmod +x .githooks/pre-commit
+git config core.hooksPath .githooks
+```
+
+A non-zero exit aborts the commit. Bypass a single commit with `git commit --no-verify` when you have a reason.
+
+## `github-actions.yml` — the gate as a required check
+
+Copy the job into a workflow under `.github/workflows/` (or merge it into an existing one). Make it a required status check on your protected branch so no gap merges. This is the audit-evidence seam for a regulated pipeline: a dated, versioned record that the gate passed on every merge.
+
+## `claude-code-settings.json` — run the gate when the agent stops
+
+Merge the `hooks` block into your `.claude/settings.json` (or `.claude/settings.local.json`). The `Stop` hook runs the gate when the agent finishes a turn and surfaces the verdict in the loop — so an agent can no longer close out with the gate never run.
+
+---
+
+Adapters are runward-owned templates: `runward update` refreshes them, `runward doctor` verifies them. They are never mission state. Add a new harness by dropping a new sample here — the port contract above does not change.

package/templates/adapters/claude-code-settings.json

@@ -0,0 +1,15 @@
+{
+  "//": "runward gate — Claude Code adapter (sample). Inert until you install it: see runward/adapters/README.md. Merge the hooks block below into .claude/settings.json (or settings.local.json). The Stop hook runs the gate when the agent finishes a turn and surfaces the verdict in the loop. Exit codes (the port contract): 0 clean, 1 gaps, 2 no mission found. Use 'runward check --strict' to also enforce the floor rule-conformance manifest; drop --strict for the deliverable audit only.",
+  "hooks": {
+    "Stop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "runward check --strict 2>&1 || true"
+          }
+        ]
+      }
+    ]
+  }
+}

package/templates/adapters/github-actions.yml

@@ -0,0 +1,26 @@
+# runward gate — CI adapter (sample).
+# Inert until you install it: see runward/adapters/README.md.
+# Copy this job into a workflow under .github/workflows/, then make it a
+# required status check on your protected branch so no gap merges.
+#
+# The gate is deterministic and zero-LLM: no secrets, no model key needed.
+# Exit codes (the port contract): 0 clean · 1 gaps · 2 no mission found.
+name: runward gate
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      # Use --strict to also enforce the floor rule-conformance manifest.
+      # Drop --strict for the deliverable audit only.
+      - name: runward check
+        run: npx --yes runward check --strict

package/templates/adapters/pre-commit

@@ -0,0 +1,18 @@
+#!/bin/sh
+# runward gate — git pre-commit adapter (sample).
+# Inert until you install it: see runward/adapters/README.md.
+#   cp runward/adapters/pre-commit .git/hooks/pre-commit && chmod +x .git/hooks/pre-commit
+#
+# Blocks the commit if the runward gate is not clean.
+# Exit codes (the port contract): 0 clean · 1 gaps · 2 no mission found.
+# Bypass one commit with:  git commit --no-verify
+
+set -e
+
+# Use --strict to also enforce the floor rule-conformance manifest.
+# Drop --strict for the deliverable audit only.
+if command -v runward >/dev/null 2>&1; then
+  runward check --strict
+else
+  npx --yes runward check --strict
+fi

package/templates/mission/decision-matrix.md

@@ -12,7 +12,7 @@ How to use this file: every structural decision below carries **one sober defaul
 | Number of agents | One agent, one loop | The task decomposes into parallelizable subtasks of real complexity, or context isolation is required — several agents under a single orchestrator |
 | Model abstraction | Every model call goes through a single port, one default model | Measured cost or quality spread justifies tiered routing behind the same port; bypassing the port for a direct SDK call requires an ADR of its own |
 | State | Stateless reducer: state in, decision out, nothing hidden inside the process | Audit, replay, or debugging needs history — immutable journal of events plus derived views |
-| Crossing the process boundary | In-process function calls behind ports | A consumer moves to another process — promote the port contract to a versioned network API; nothing else changes |
+| Crossing the process boundary | In-process function calls behind ports | A consumer moves to another process — promote the port contract to a versioned network API (MCP for tool/capability providers, A2A for agent-to-agent federation), pinned by version; nothing else changes |
 | Contract evolution | Versioned contracts, additive changes only, consumers read tolerantly (unknown fields ignored) | A breaking change is unavoidable — expand-then-contract: serve both shapes, migrate every consumer, then retire the old one |
 | Memory & forgetting | Score each memory for value and decay; invalidate rather than delete, so nothing silently disappears | Memory grows past useful recall — consolidate into summaries that keep pointers back to their sources |
 | Evaluation | Deterministic tests for deterministic code, plus a guarded continuous evaluation loop for model behavior | The loop is stable and trusted — allow bounded auto-tuning: parameters only, inside hard limits, owned by a human |
@@ -23,7 +23,7 @@ How to use this file: every structural decision below carries **one sober defaul
 | Non-critical vs sensitive | Non-critical dependencies fail open: the feature degrades, the system continues | The action touches money, private data leaving the system, or anything irreversible — fail closed: no guard response, no action |
 | Delegation autonomy | Bounded autonomy: the agent acts within templates, budgets, and pre-approved action lists | Evidence of consistent reliability on a class of actions — widen the bounds for that class, one ADR at a time |
 | Untrusted input | Least privilege everywhere, human approval on consequential actions, and never all three of: private data, untrusted content, external egress (2-of-3 rule) | A workflow claims to need all three — re-architect to break the triad: isolate, sanitize, or gate the exfiltration channel |
-| Agent identity | Each agent runs as its own principal, with its own permissions and audit trail | The agent must act on behalf of a user — explicit, bounded, revocable delegation; never shared credentials |
+| Agent identity | Each agent runs as its own principal — one scoped identity, short-lived least-privilege credentials, explicit ownership and audit trail (OAuth 2.1/PKCE, SPIFFE, Entra Agent ID) | The agent must act on behalf of a user — explicit, bounded, revocable delegation; never shared credentials |
 | Execution secrets | The agent holds only a proxy token; real keys are injected at the network boundary, outside the model's reach | A target system cannot sit behind the proxy — isolate that call in a dedicated adapter the agent cannot introspect |
 | Shared brick | Consumed through a port; discovered through an index — and the index stays an index, not a brain | A brick gains multiple consumers — version its contract and run it as a product, still behind the port |
 

package/templates/mission/reference-stack.md

@@ -2,7 +2,7 @@
 
 This note is a **kit of default adapters**: enough to ship a first increment fast, without reopening every arbitration from scratch. Read it for what it is — and for what it is not.
 
-> **Framing warning.** These choices are **reversible adapter decisions**, not dogma. The boundary is the domain ports and the inter-process tool protocol; behind it, an adapter's language and a store's technology are implementation details you replace without touching the business. A default holds until an objective trigger commands a change. The transverse rule is constant: start simple, isolate by contract, add complexity only on evidence.
+> **Framing warning.** These choices are **reversible adapter decisions**, not dogma. The boundary is the domain ports and the inter-process tool protocol; behind it, an adapter's language and a store's technology are implementation details you replace without touching the business. A default holds until an objective trigger commands a change. The transverse rule is constant: start simple, isolate by contract, add complexity only on evidence. When a port's contract is a public standard — the tool protocol, the telemetry convention, the identity scheme — name the standard as the default and **pin its version in an ADR**: these specs revise on their own cadence, so isolate them behind the port and re-test on each revision. runward references and pins the standard; it never implements it, exports the telemetry, or ships the runtime.
 
 The runnable implementation of these defaults lives in the reference floor (`floor-ts/` in this repo). This note decides; the floor shows.
 
@@ -13,11 +13,12 @@ The runnable implementation of these defaults lives in the reference floor (`flo
 | Layer | Recommended default | Evolution trigger |
 |---|---|---|
 | Core language | One typed language for orchestration and interface (e.g. TypeScript) | Never without a technical reason; polyglot goes through a sidecar or a service, never a mix inside the core. |
-| Specialized capability | Sidecar in the library's language, exposed through the tool protocol | As soon as a capability depends on a mature ecosystem in another language (browser automation, scientific computing, specialized models). |
+| Specialized capability | Sidecar in the library's language, exposed through the tool protocol (**MCP** by default, version-pinned; a consumed server pinned by version + hash) | As soon as a capability depends on a mature ecosystem in another language (browser automation, scientific computing, specialized models). |
 | Hot-path component | Stay in the core; compiled service behind a contract only on evidence | Latency or throughput proven insufficient on the hot path. |
 | Model gateway | Single port, direct SDK, three tiers (fast / balanced / deep), governance and routing centralized | Never a heavy chain framework by default; refine routing when a task's measured quality demands it. |
 | Persistence | Local first, in-memory single-instance state, immutable journal plus derived working view | Shared store as soon as a multi-instance trigger appears (load, availability, state shared across processes). |
-| Observability | Structured logs, cycle events, per-call metrics, propagated request id | Active from the first increment; it gets completed, never retrofitted. |
+| Observability | Structured logs, cycle events, per-call metrics, propagated request id; **OpenTelemetry GenAI** semantic conventions as the span/metric contract | Active from the first increment; it gets completed, never retrofitted. |
+| Identity & delegation | One scoped identity per agent, short-lived credentials, explicit ownership and lifecycle (**OAuth 2.1/PKCE, SPIFFE, Entra Agent ID**) | Harden on an objective trigger (privilege boundary, non-human-identity sprawl, regulated audit), locked in an ADR. |
 | Tests & evaluation | Pyramid: unit without network, schema contract, integration through the DI container, behavioral evaluation at the top, as a continuous loop | Re-run the evaluation bench on any change touching memory, prompt or routing. |
 
 ---
@@ -30,7 +31,7 @@ One typed language for the agentic core (orchestrator, tool registry, use cases)
 
 ### Specialized capability
 
-When a capability depends on a mature ecosystem elsewhere, isolate it in its own process, consumed by the core as a tool provider through the tool protocol. The cross-language boundary stays sharp and stable. **Trigger:** a mature library lives in another ecosystem and no acceptable equivalent exists in the core language.
+When a capability depends on a mature ecosystem elsewhere, isolate it in its own process, consumed by the core as a tool provider through the tool protocol. The default protocol is **MCP**, pinned to a spec version behind the port, with a consumed server pinned by version and hash (see the `security-mcp-server-pinning` rule) — the spec revises on its own cadence, so it lives behind the port and is re-tested on each revision. The cross-language boundary stays sharp and stable. Cross-**agent** federation, when a single agent no longer suffices, speaks **A2A** — a deferred default crossed on a distributed-topology trigger, never a starting choice. **Trigger:** a mature library lives in another ecosystem and no acceptable equivalent exists in the core language.
 
 ### Hot-path component
 
@@ -50,7 +51,11 @@ The agent is a stateless reducer; **state lives outside, in three layers**: an i
 
 ### Observability
 
-Structured logs, cycle events, per-model-call metrics, and a request id propagated everywhere, including to sub-agents through parent/child lineage. **The same trace feeds the dashboard, the continuous behavioral evaluation, and provenance.** Explicit cost caps per root task, stop-and-synthesize on overrun. **Trigger:** observability gets completed, never retrofitted; unfolding a consolidated memory back to its raw facts becomes necessary as soon as a regulated audit demands it.
+Structured logs, cycle events, per-model-call metrics, and a request id propagated everywhere, including to sub-agents through parent/child lineage. **The same trace feeds the dashboard, the continuous behavioral evaluation, and provenance.** The span and metric shape follows the **OpenTelemetry GenAI** semantic conventions (`invoke_agent`, `execute_tool`), pinned while the spec is experimental: runward prescribes the port and the span contract; the operator plugs the backend (a managed GenAI observability, an open collector) as an adapter — runward exports nothing itself. Explicit cost caps per root task, stop-and-synthesize on overrun. **Trigger:** observability gets completed, never retrofitted; unfolding a consolidated memory back to its raw facts becomes necessary as soon as a regulated audit demands it.
+
+### Identity & delegation
+
+Agents are non-human identities, soon far outnumbering the humans that run them; treating them with legacy IAM is where privilege abuse begins. Default: **one scoped identity per agent**, short-lived least-privilege credentials, an explicit owner and lifecycle — no shared secrets, no standing broad grants. The contract follows the converging neutral standards (**OAuth 2.1/PKCE** for delegated access, **SPIFFE** or **Entra Agent ID** for workload identity, the IETF `agent_assertion` draft for agent-to-service claims), named as the default and pinned in an ADR. runward references the standard; it never becomes an identity broker. **Trigger:** harden the scheme on an objective signal (a new privilege boundary, non-human-identity sprawl, a regulated audit), locked in an ADR — never built in on day one.
 
 ### Tests & evaluation
 

package/templates/rules/async-job-guardrails.md

@@ -1,6 +1,7 @@
 ---
 title: Background Job Guardrails (Retry, Idempotency, Bounded Concurrency, Job Observability)
 impact: HIGH
+asi: [ASI08]
 phases: [govern]
 impactDescription: The four non-negotiables of any background job — bounded retry per step, idempotency under concurrency, capped and partitioned concurrency, and queue lag plus failure rate as first-class metrics
 tags: [async, jobs, idempotency, concurrency, retry, observability]

package/templates/rules/checklist-pre-production-resilience.md

@@ -1,6 +1,7 @@
 ---
 title: Pre-Production Resilience Checklist
 impact: CRITICAL
+asi: [ASI08]
 impactDescription: Ensures application handles failures gracefully in production
 tags: [checklist, resilience, production, deployment]
 ---

package/templates/rules/checklist-pre-production-security.md

@@ -1,6 +1,7 @@
 ---
 title: Pre-Production Security Checklist
 impact: CRITICAL
+asi: [ASI02, ASI03, ASI06]
 impactDescription: Ensures security requirements are met before production deployment
 tags: [checklist, security, production, deployment]
 ---

package/templates/rules/config-secrets-boundary.md

@@ -1,6 +1,7 @@
 ---
 title: Secrets at the Network Boundary, Never in the Model
 impact: CRITICAL
+asi: [ASI03, ASI10]
 phases: [floor, govern]
 impactDescription: Makes secret disclosure structurally impossible by keeping the real key out of the model and the domain
 tags: [security, secrets, configuration, boundary]

package/templates/rules/contracts-governance.md

@@ -1,6 +1,7 @@
 ---
 title: Contract Governance (Versioned, Additive, Expand-then-Contract)
 impact: CRITICAL
+asi: [ASI04, ASI07]
 phases: [architect]
 impactDescription: Lets the system evolve without breaking consumers, by governing the contract at the boundary rather than the implementation behind it
 tags: [architecture, contracts, ports, versioning, compatibility]

package/templates/rules/data-memory-provenance.md

@@ -0,0 +1,27 @@
+---
+title: Memory Carries Provenance; an Untrusted Write Cannot Act Unreviewed
+impact: HIGH
+asi: [ASI06]
+phases: [govern]
+impactDescription: Every stored memory item carries its origin and trust tier; a memory written from untrusted content is quarantined and cannot influence a privileged action without human review
+tags: [security, memory, provenance, poisoning]
+---
+
+# Memory carries provenance; an untrusted write cannot act unreviewed
+
+> Prompt-injection defense guards the context window at read time. Memory poisoning is the same attack shifted in time: hostile content is written to memory now and replayed as trusted instruction later, long after the injection is out of the window. The write path needs its own guard.
+
+**The rule.** Every stored memory item carries provenance: its origin, its trust tier (trusted / derived / untrusted), and its write time. An item written from untrusted content (a retrieved page, a tool output, a user message) is stored **quarantined** — usable as *data* for recall, never promotable to instruction, and never load-bearing for a privileged action without human review. Trust is a property of the write, recorded once and never silently upgraded on read.
+
+```
+memory.write(item, source):
+  item.provenance = { origin: source.id, trust: source.trust, at: now }
+  store(item)
+
+memory.recall(query) -> items            # returns data; provenance travels with each item
+guardPrivilegedAction(item):
+  if item.provenance.trust != "trusted":
+    require(humanReview)                  # a quarantined memory cannot act alone
+```
+
+**Boundary.** Deterministic provenance tagging plus a fail-closed guard on the action path — no model judgment of trust. Complements `security-prompt-injection` (read-time), `data-memory-invalidation` (revocation) and `state-event-sourcing` (traceability). Maps to OWASP Agentic ASI06 (memory & context poisoning).

package/templates/rules/eval-loop.md

@@ -1,6 +1,7 @@
 ---
 title: Evaluation Loop (Test + Evaluate, Hold-out, Anchored Judge)
 impact: CRITICAL
+asi: [ASI08]
 phases: [govern]
 impactDescription: Gives a non-deterministic system a trustworthy way to detect behavioural regressions without letting it optimise its own grader
 tags: [evaluation, testing, llm, quality, governance]

package/templates/rules/frontier-deterministic-boundary.md

@@ -1,6 +1,7 @@
 ---
 title: Deterministic Boundary of the Model
 impact: CRITICAL
+asi: [ASI01]
 phases: [floor]
 impactDescription: Keeps every fact, figure and decision that can be checked out of the model, so the system is verifiable and cannot hallucinate load-bearing values
 tags: [architecture, llm, frontier, grounding, safety, determinism]

package/templates/rules/hexa-move-deterministic-out.md

@@ -1,6 +1,7 @@
 ---
 title: Move the Deterministic out of the Model
 impact: CRITICAL
+asi: [ASI01, ASI02]
 phases: [floor]
 impactDescription: Reduces LLM costs and latency by moving deterministic logic out of LLM calls
 tags: [architecture, llm, cost-optimization, performance]

package/templates/rules/patterns-memory-router-tiered.md

@@ -1,6 +1,7 @@
 ---
 title: Tiered Memory Router
 impact: HIGH
+asi: [ASI06]
 impactDescription: Order-of-magnitude latency cut on simple queries by fetching only the memory tier the query needs, measured on a reference system — recalibrate on your traffic
 tags: [patterns, memory, performance, architecture]
 ---

package/templates/rules/resilience-fail-open.md

@@ -1,6 +1,7 @@
 ---
 title: Fail-Open for the Non-Critical, Fail-Closed for the Sensitive
 impact: CRITICAL
+asi: [ASI02, ASI08]
 phases: [govern]
 impactDescription: Degrades gracefully where safe and denies safely where it matters, instead of applying one failure policy everywhere
 tags: [resilience, error-handling, availability, safety]

package/templates/rules/resilience-multi-provider-fallback.md

@@ -1,6 +1,7 @@
 ---
 title: Multi-Provider Fallback
 impact: HIGH
+asi: [ASI04, ASI08]
 phases: [govern]
 impactDescription: Ensures LLM availability by falling back to alternative providers
 tags: [resilience, llm, providers, availability]

package/templates/rules/resilience-retry-backoff.md

@@ -1,6 +1,7 @@
 ---
 title: LLM Retry with Exponential Backoff
 impact: HIGH
+asi: [ASI08]
 phases: [govern]
 impactDescription: Handles transient LLM failures gracefully without overwhelming the API
 tags: [resilience, llm, retry, error-handling]

package/templates/rules/scaling-distributed-rate-limiting.md

@@ -1,6 +1,7 @@
 ---
 title: Distributed Rate Limiting
 impact: HIGH
+asi: [ASI08, ASI10]
 impactDescription: Enables consistent rate limiting across multiple instances
 tags: [scaling, rate-limiting, redis, architecture]
 ---

package/templates/rules/security-mcp-server-pinning.md

@@ -0,0 +1,26 @@
+---
+title: Pin Every Consumed Tool/MCP Server by Version and Hash
+impact: CRITICAL
+asi: [ASI04, ASI10]
+phases: [architect, govern]
+impactDescription: A consumed tool or MCP server is pinned by version and content hash, so a supply-chain swap or rug-pull cannot silently change what the agent may call
+tags: [security, supply-chain, mcp, tools, integrity]
+---
+
+# Pin every consumed tool/MCP server by version and hash
+
+> Everything the agent calls is part of your attack surface. A server you trusted at approval time can change its tool set after the fact (a "rug-pull"): a tool that summarized yesterday exfiltrates today. Trust the version you reviewed, not the endpoint.
+
+**The rule.** Every external tool provider — an MCP server, a plugin, a remote tool endpoint — is pinned to a specific version **and** a content hash of its declared tool set (names, schemas, descriptions, permissions). The pin is recorded in the mission, versioned with the code. On connect, the agent verifies the live tool set against the pinned hash. A mismatch **fails closed**: the tools are not exposed to the model until the change is re-reviewed and the pin is updated on purpose (see `security-tool-change-reapproval`).
+
+**Why structured trust is not enough.** A schema tells you a tool is well-formed, not that it is the tool you approved. Only a pinned hash of the declared surface catches a silent redefinition.
+
+```
+onConnect(server):
+  live = hash(server.declaredTools)      # names + schemas + descriptions + permissions
+  if live != pinned[server].hash:
+    reject(server)                       # fail closed — do NOT expose to the model
+    raise ToolSurfaceChanged(server, pinned[server].version)
+```
+
+**Boundary.** This is a deterministic integrity check on the tool surface, not a judgment of the tool's behavior. It belongs at the integration boundary (architect) and is enforced at run (govern). It maps to OWASP Agentic ASI04 (supply-chain) and ASI10 (rogue resources).

package/templates/rules/security-prompt-injection.md

@@ -1,6 +1,7 @@
 ---
 title: Untrusted Input, Prompt Injection and the Lethal Trifecta
 impact: CRITICAL
+asi: [ASI01, ASI06]
 phases: [floor, govern]
 impactDescription: Treats prompt injection as a first-rank, structural threat constrained by architecture rather than detected by heuristics
 tags: [security, llm, injection, trifecta, untrusted-input]

package/templates/rules/security-tool-change-reapproval.md

@@ -0,0 +1,25 @@
+---
+title: Re-approve a Tool on Any Change to Its Signed Definition
+impact: HIGH
+asi: [ASI02, ASI04]
+phases: [govern]
+impactDescription: A change to a registered tool's definition (name, schema, description, permissions) forces re-approval before the agent may call it, closing the rug-pull window
+tags: [security, tools, approval, supply-chain]
+---
+
+# Re-approve a tool on any change to its signed definition
+
+> Approval is not a one-time event. A tool approved once and never re-checked is a standing invitation to a rug-pull: change the description or widen the permissions after approval, and the agent keeps calling it.
+
+**The rule.** The tool registry records, per tool, a signature over its full definition (name, input/output schema, description, declared permissions). Any change to that signature **revokes the prior approval**: the tool moves to a pending state and the agent may not call it until an operator re-approves the new definition. Re-approval is deterministic and human-owned — the registry gates the call, never the model's discretion.
+
+```
+registry.resolve(toolCall):
+  tool = registry[toolCall.name]
+  if sign(tool.definition) != tool.approvedSignature:
+    tool.state = "pending-reapproval"
+    deny(toolCall)                       # gated by infrastructure, not by the model
+    notifyOperator(tool, diff(tool.definition, tool.approvedDefinition))
+```
+
+**Boundary.** Deterministic, infrastructure-enforced, operator-owned — it never asks the model to judge whether a change is safe. Pairs with `security-mcp-server-pinning` (pin the surface) and `tools-registry-pattern` (filter by role). Maps to OWASP Agentic ASI02 (tool misuse) and ASI04 (supply-chain).

package/templates/rules/state-event-sourcing.md

@@ -1,6 +1,7 @@
 ---
 title: State as an Immutable Journal (Event Sourcing, Replay, Provenance)
 impact: HIGH
+asi: [ASI06]
 phases: [floor]
 impactDescription: Makes the agent a stateless reducer over an external, replayable journal, so truth, audit and recovery are structural rather than bolted on
 tags: [state, event-sourcing, replay, provenance, memory]

package/templates/rules/tools-registry-pattern.md

@@ -1,6 +1,7 @@
 ---
 title: Tool Registry Pattern
 impact: HIGH
+asi: [ASI02, ASI03]
 impactDescription: Replaces giant switch statements with maintainable, extensible tool management
 tags: [tools, architecture, patterns, maintainability]
 ---

package/templates/rules/tools-scope-atomicity.md

@@ -1,6 +1,7 @@
 ---
 title: Tool Scope and Atomicity
 impact: HIGH
+asi: [ASI02]
 phases: [floor]
 impactDescription: Reduces token usage and improves LLM tool selection accuracy
 tags: [tools, llm, architecture, cost-optimization]

package/templates/workflows/handover.md

@@ -19,13 +19,14 @@ Use this workflow when a delivery approaches its end or a team must become self-
 
 **Enforce the entry rule.** You transfer autonomy, not documents. Handover is not a folder delivered; it is proven by the team repeating a task alone. Until that proof exists, this phase is open.
 
-**Assemble the handover kit.** Five components:
+**Assemble the handover kit.** Six components:
 
 1. **Reusable assets.** The populated scaffold, the adapters, the versioned contract schemas, the evaluation sets. Things that replay and get reused, not just things that get read.
 2. **The architecture note.** Boundaries, ports, integration protocol, the named target, and the default topology with its triggers. The map that says why the system is shaped this way.
 3. **The ADR journal.** Every structuring decision locked in Context / Decision / Consequences form, with the discarded alternative and the reevaluation trigger. The team learns not only what was decided, but under which signal to reopen it.
 4. **The operations runbook.** How to start, observe, debug, resume from a checkpoint, switch a model provider, rerun the evaluation bench, process a suspended approval. Operating gestures, not theory. Use `mission/runbook.md`.
 5. **Proof in the code.** Unit and contract tests, evaluation scenarios, replayable traces — the demonstration that the principles are not speculative; they live in the code.
+6. **The agent charter (`AGENTS.md`), finalized as the leave-behind.** The `AGENTS.md` written at `init` becomes the receiving team's charter, in the standard format every harness already reads (Codex, Copilot, Cursor, Gemini, Amp, and Claude Code via `@AGENTS.md`): the craft rules that govern the system, the **judgment boundaries** (what the operator decides versus what an agent may do), the verification commands (including `runward check --strict`), and the never/PR rules. Finalize it so any harness the team later adopts is productive from day one — the leave-behind is portable, not tied to your tool.
 
 **Run the transfer, don't just deliver it.**
 
@@ -39,7 +40,7 @@ Use this workflow when a delivery approaches its end or a team must become self-
 
 ## Definition of Done
 
-- Handover kit complete: assets, architecture note, ADR journal, runbook, proof in code.
+- Handover kit complete: assets, architecture note, ADR journal, runbook, proof in code, and the finalized `AGENTS.md` charter (the harness-neutral leave-behind).
 - Transfer sessions held with the team operating, not observing.
 - The team has repeated at least one real task end to end, alone — demonstrated, witnessed, recorded.
 - Recurring patterns escalated and fed back into the framework's templates.

package/templates/workflows/verify.md

@@ -0,0 +1,33 @@
+# Verify — Advisory Cite-vs-Apply Review (above the gate, never in it)
+
+## When to use
+
+Use this **after** `runward check --strict` is green, and before you cross the gate as the operator. The deterministic gate proves a decision was *traced* for every CRITICAL/HIGH rule (applied with a pointer, deviated with an ADR, n/a with a reason). It cannot prove the code an `applied` row points at **actually applies** the rule rather than merely citing it — that is a semantic judgment. This workflow makes that judgment, adversarially, to inform yours.
+
+It is **advisory**. It produces findings, never a verdict that gates. `runward check --strict` stays the load-bearing decision; you cross it. See [ADR-0007].
+
+## Inputs
+
+- The `Rule conformance` manifests (`floor.md`, `architecture.md`, `governance/threat-model.md`).
+- The code each `applied` row points at.
+
+## Procedure
+
+**Challenge each `applied` claim, adversarially.** For every `applied` row, open its evidence (the `file:line` or test) and default to skepticism: *does this code actually apply the rule it names, or does it only cite it?* Judge through distinct lenses — correctness, does-it-reproduce, security-relevance — and, where you can, run this pass on a **different model** than the one that built the floor, so it does not agree with itself.
+
+**Return a finding per row**: `confirmed` (the code applies the rule), `cited-not-applied` (the row claims applied but the code does not carry the rule), or `uncertain` (needs a human look). Deduplicate overlapping findings; group them by severity.
+
+**Hand the findings to the operator.** They are input to the operator's gate decision, not a gate of their own. A `cited-not-applied` finding is a prompt to fix the code (or downgrade the row to `deviated`/`n/a`) and re-run `check --strict` — never a silent override of the deterministic gate.
+
+## Definition of Done
+
+- Every `applied` row reviewed, with a confirmed / cited-not-applied / uncertain finding.
+- Findings handed to the operator; no exit code produced, no gate blocked.
+- Any `cited-not-applied` finding routed back to the code and re-checked deterministically.
+
+## Anti-patterns
+
+- Treating a clean `verify` pass as "the gate passed" — it is advisory; the deterministic `check --strict` is the gate.
+- Wiring `verify` into CI as a blocking step, or into an exit code — it never blocks.
+- Running `verify` **instead of** `check --strict` — it sits above the deterministic gate, it does not replace it.
+- Running it on the same model that wrote the code and trusting the agreement — use a different lens, ideally a different model.