simt-dev 0.0.0-stage → 0.1.1

package/docs/decisions/ADR-005-file-length.md

@@ -0,0 +1,42 @@
+# ADR-005 — File length is two tiers: 400 review trigger, 1000 hard ceiling
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+- `simt-social` / `simt-social-api`: "**Split any file once it exceeds 1000 lines**; extract
+  along the nearest cohesive boundary instead of growing the file further."
+- `simt-garmin`: "**File length: 400 lines is a smell threshold, not a hard gate.**" Generated
+  `.mc` files are exempt, with a named exception for a 408-line template.
+- Several repos: no file-length rule stated at all.
+
+The two numbers are not in conflict — they measure different things. 400 is where a human
+should start asking questions; 1000 is where the file must already have been split.
+
+## Ruling
+
+Two tiers, both advisory in wording but checkable in `simt-dev check`:
+
+- **400 lines — review trigger.** Crossing it requires a stated reason to keep the file whole.
+- **1000 lines — hard ceiling.** `simt-dev check` fails. Extract along the nearest cohesive
+  boundary.
+- **Generated files are exempt**, declared per repo in `simt-dev.json`. The hook must name the
+  generator.
+
+Per-repo overrides are permitted via `limits.fileLines` in `simt-dev.json`.
+
+## Consequences
+
+- The Social repos' hard 1000 gate and garmin's soft 400 both survive unchanged in force.
+- The generated-file exemption that garmin had to state in prose becomes a declared property,
+  so the hook can honour it without hardcoding `.mc`.
+- `simt-social`'s pre-commit file-size check (currently inlined as 1000 lines of shell, and
+  duplicating `scripts/check-file-sizes.ts`) becomes one implementation in the shared
+  dispatcher.
+
+## Rejected
+
+- **One number org-wide.** Either it is too tight for legitimately long declarative files or
+  too loose to prompt a human at 400.
+- **No rule.** The Social repos' pre-commit check exists precisely because a rule was missing,
+  and it is now implemented twice.

package/docs/decisions/ADR-006-coverage-bar.md

@@ -0,0 +1,59 @@
+# ADR-006 — Evidence discipline is central; the numeric bar is per-repo
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+The coverage bar is the one concept that is mutually incompatible *in kind* across the estate:
+
+| Repo | Bar |
+|---|---|
+| Repos with a declared numeric bar (outside this estate) | Quantitative. `fail_under = 100`, branch coverage, "a behavioural coverage gate, not a line-count scoreboard" |
+| `simt-garmin` | Quantitative, but a different quantity. Memory: 64 KB app / 24 KB Glance against a 32 KB ceiling, plus 12 named lint scripts |
+| `simt-social`, `simt-social-api`, `simt-social-media` | Qualitative. No number anywhere. Evidence discipline: named commands, 100 % pass, no unjustified skips, behavioural test delta |
+| `simt-api` | Neither. Three verification commands. |
+
+You cannot average these. 100 % line coverage is unreachable for Kotlin/Compose UI code and for
+Monkey C memory budgets; a memory ceiling is not a coverage proxy; "no number" is not a weaker
+version of 100 %, it is a different instrument.
+
+## Ruling
+
+**The central rule mandates evidence discipline. The numeric threshold is a declared,
+per-repo constant.**
+
+Central, mandatory, portable — for every repo regardless of stack:
+
+1. Name the exact commands and the exact test files.
+2. Those commands must exit 0 with **all** selected tests passing. Partial pass is a hard
+   blocker; "6/8 pass" is the canonical worked example of a blocked state.
+3. No test is skipped without a pre-existing written justification.
+4. Every executable change carries a test delta: new or extended test for new behaviour, a
+   regression test reproducing the failure mode for a bugfix, or a stated reason existing tests
+   fully prove the invariant.
+5. Never claim a test you did not run. Never cite a partial suite as evidence.
+6. Approval by budget never converts a known failure into an approval.
+
+Per-repo, declared in `simt-dev.json` under `limits`: the numeric gate, if any — coverage
+percentage, memory budget, size ceiling. The central rule specifies *how to declare it*, never
+the value.
+
+## Consequences
+
+- A repo that declares `coverage: 100` keeps it and its "untested paths are typed holes"
+  framing intact; the ruling constrains only what a new repo declares.
+- garmin declares its memory budgets in the same slot, and its "layer-conditional 5a–5m matrix"
+  becomes a declared gate list rather than 12 prose sentences.
+- The three social repos declare no number and keep their evidence discipline verbatim — which
+  is now shared rather than independently re-invented in each.
+- A new repo inherits a real policy from `simt-dev init` with no configuration, and can opt into a
+  number later without changing the rule.
+
+## Rejected
+
+- **Hard 100 % coverage org-wide.** Unreachable in Kotlin/Compose and meaningless for Monkey C;
+  would push repos to delete the rule rather than meet it.
+- **No number anywhere.** Leaves a genuinely strong gate unenforced org-wide and invites
+  every new repo to skip the question.
+- **One number for coverage and a separate slot for memory.** Two slots invite a repo to declare
+  only the one it likes.

package/docs/decisions/ADR-007-section-skeleton.md

@@ -0,0 +1,54 @@
+# ADR-007 — One canonical section skeleton
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+Six `AGENTS.md` files use the same conceptual sections under three different headings:
+
+| File | Authority | Invariants |
+|---|---|---|
+| `simt-api`, `simt-social-media` | "Authority and Scope" | "Non-Negotiable Invariants" |
+| `simt-garmin`, `simt-social` | "Authority and scope" | "Non-negotiable invariants" |
+| `simt-social-api` | "Authority and **ownership**" | "Non-negotiable invariants" |
+
+At least one repo outside this estate uses a numbered 12-part layout with no equivalent
+sections at all.
+
+The deeper difference is in what "non-negotiable" means. Garmin's are **platform physics**
+("breaking any of these produces a product that is wrong, crashes, or cannot be shipped"); the
+Social pair's are **product and privacy policy**; api/media's are **data and schema
+invariants**. Those are three different kinds of claim wearing one heading, which is why the
+naming drifted — nobody could tell whether the sections were meant to align.
+
+## Ruling
+
+One canonical skeleton, sentence case:
+
+```
+## Authority and ownership
+## Non-negotiable invariants
+## Engineering conventions
+## Workflow and validation
+```
+
+Repos may add sections after these; they may not rename them. A repo that arrives with its
+own numbered layout keeps it during adoption and maps each part onto a canonical section in
+`simt-dev.json`, so both structures remain navigable while it migrates.
+
+Each invariant states **which kind of claim it is** — platform, policy, or data — so a reader
+knows immediately what breaking it costs and who may change it.
+
+## Consequences
+
+- Cross-repo reading becomes possible: section N means the same class of thing everywhere.
+- A future grep for "what are the invariants" returns a comparable list across all 16 repos.
+- "Ownership" is kept in the heading because `simt-social-api` earned it by being the only
+  file that enumerates ownership explicitly.
+
+## Rejected
+
+- **Standardise on Title Case** (`simt-api`'s variant). Capitalisation in headings is noise;
+  three repos already use sentence case.
+- **Normalise a differently-shaped layout immediately.** A mechanical conversion of 12
+  numbered parts would produce a worse document than a mapping.

package/docs/decisions/ADR-008-verdict-vocabulary.md

@@ -0,0 +1,59 @@
+# ADR-008 — One review verdict vocabulary: three values
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+The estate has two incompatible verdict vocabularies.
+
+`.cursor/rules/test-gate.mdc` — used by all three Social repos — allows one outcome:
+
+> Return `BLOCK` when: any test fails, is skipped without pre-existing justification, or is
+> unrun; the executable diff has no test delta without explicit justification; the coordinator
+> cites partial suite results or defers failing tests.
+
+`principal-milestone-reviewer.agent.md` — the final pre-commit gate — uses three:
+
+> `APPROVE` / `APPROVE WITH RESIDUAL RISK` / `BLOCK`
+
+With only two values, a reviewer who finds no blocker but did not finish has no honest answer
+and is pushed toward `APPROVE` by omission or toward `BLOCK` by exaggeration. With three, the
+budget mechanism works: "Use one focused pass, normally no more than 5 minutes or 8 targeted
+tool calls… If the budget is reached without a concrete blocker, stop and return `APPROVE WITH
+RESIDUAL RISK`. List what was not reviewed."
+
+The agent also re-embeds the `.mdc` text verbatim as its checklist item 1, so the vocabulary
+mismatch propagates from the rule into the gate.
+
+## Ruling
+
+Adopt the three-value vocabulary everywhere:
+
+| Verdict | Meaning |
+|---|---|
+| `BLOCK` | A concrete defect, missing mandatory gate, partial test pass, or missing test delta. Always paired with a file:line or command reference. |
+| `APPROVE WITH RESIDUAL RISK` | No blocker found within the review budget. **Must** list what was not reviewed. |
+| `APPROVE` | Fully reviewed, no blocker. |
+
+`APPROVE WITH RESIDUAL RISK` never converts a known failure into an approval — that constraint
+travels with the verdict, verbatim from the review agent.
+
+The `.mdc` files are updated to the three-value vocabulary. `BLOCK` remains the only value that
+stops work; the other two do not weaken the block conditions, which are stated identically in
+all three rules.
+
+## Consequences
+
+- A reviewer who runs out of budget has a correct answer, so the budget stops being a reason to
+  over-search.
+- Rule text and agent text stop diverging, because they now share a vocabulary and the agent no
+  longer has to paraphrase the rule.
+- Output format is uniform across the 15 agent files: severity-ordered findings, clickable
+  file:line references, a verdict, and — when not fully reviewed — the unreviewed list.
+
+## Rejected
+
+- **`BLOCK` only.** Loses the honest "I did not finish" answer and makes the strict review
+  budget unusable as written.
+- **Four values** (adding `NEEDS WORK`). Three already distinguishes blocked from
+  budget-limited; a fourth would be chosen on judgement and collapse back into two.

package/docs/decisions/ADR-009-skill-layout.md

@@ -0,0 +1,48 @@
+# ADR-009 — Skills are `<name>/SKILL.md` with mandatory frontmatter
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+All 37 skill entries in the estate use `<name>/SKILL.md`. A wider audit that included repos
+now out of scope found exactly one entry that did not: a flat 7 266-byte file that also omitted
+the `name` frontmatter key. The layout ruling exists because that defect class is real, not
+because this estate still has it.
+
+Frontmatter field usage across the wider audit's 46 entries: `name` 45, `description` 46,
+`argument-hint` 14, `disable-model-invocation` 2, `references` 1, `compatibility` 1, and
+**`globs` zero**. No skill in any audited repo scopes itself by file pattern.
+
+That last point matters for discovery. A skill that could declare `globs: "migrations/**"`
+would let the resolver select it from the diff alone. Since none do, path-based resolution has
+to come from the graph registry instead — which is why `paths` lives in
+`graph/skills.graph.json` (plan 0002 §3.2) rather than in frontmatter.
+
+## Ruling
+
+- A skill is a directory `<name>/` containing `SKILL.md`.
+- `name` and `description` are **mandatory** in frontmatter.
+- `argument-hint` is recommended for any skill invoked by hand, and is optional otherwise —
+  simt-app's 7 skills omit it legitimately, since they are task-shaped rather than
+  user-invoked.
+- Body size and reference-file count are declared in `graph/skills.graph.json`, not in
+  frontmatter, so the registry stays the single source of truth for resolution metadata.
+
+The one flat file found in the wider audit was wrapped into `coverage-hunt/SKILL.md` with
+its `name` added. This estate has no such entry left to migrate.
+
+## Consequences
+
+- Every skill becomes addressable by one stable name across all 16 repos, which is a
+  precondition for `simt-dev skills find/show/install` and for `variant-of` edges.
+- The registry in `graph/skills.graph.json` becomes the one place resolution metadata lives,
+  instead of metadata split across frontmatter, prose and directory size.
+- `simt-dev skills eval` can key on skill names, because every skill has one.
+
+## Rejected
+
+- **Require `globs` in frontmatter.** Attractive, but it would put resolution metadata in two
+  places and drift from the graph — the exact failure mode that produced the 8 divergent
+  `.mdc` files. Recorded as considered and rejected.
+- **Keep flat `.md` as an accepted form.** Two layouts means two resolver paths and two sets of
+  conventions to police.

package/docs/decisions/ADR-010-runner-invocation.md

@@ -0,0 +1,56 @@
+# ADR-010 — Invoke tools through the repo's own runner, never a package runner
+
+Status: **accepted** · 2026-10-05 · affects all repos
+
+## Context
+
+Four repos independently arrived at the same rule, in two ecosystems, with the same rationale.
+
+- `simt-social` / `simt-social-api`: "Run tests and quality checks through repository `npm run
+  ...` scripts… **Do not invoke local package binaries through `npx` or `npm exec`** unless no
+  repository script supports the required operation."
+- A Python repo outside this estate, in the same form: "**Do not use `uv run pytest`**; the
+  console entrypoint can miss the `uv` import path and fail to import dependencies." Its
+  contributor guide states the same rule with a stronger failure description: it "can
+  **silently** run against the wrong environment."
+
+The failure mode is identical: a package runner resolves a binary outside the project's
+configured environment, so the tool runs, the import path is wrong, and the result is either an
+obvious import error or — worse — a pass against the wrong interpreter.
+
+Note the severity disagreement on that last point: "fail to import" versus "silently run
+against the wrong environment." The second is far worse and is treated as canonical below.
+
+## Ruling
+
+Invoke tools through the repository's own declared runner, in every ecosystem:
+
+- Node: `npm run <script>`. Never `npx` or `npm exec` for a binary that is a declared
+  dependency.
+- Python: the module form, `uv run -m pytest`, or the repo's own wrapper. Never the bare
+  console entrypoint.
+- Gradle: `./gradlew`, never a system `gradle`.
+- Any other ecosystem: the repo's declared entrypoint, never a bare global binary.
+
+**Read the actual runner manifest before running anything.** A command that does not exist in
+`package.json` is not a command. This is stated because it is the other half of the failure:
+guessing a script name is how an agent concludes a check "passed" when it never ran.
+
+Exception: a tool that is genuinely not a project dependency (a one-off inspector, a global
+formatter) may be invoked directly, provided its version is pinned.
+
+## Consequences
+
+- The estates' two ecosystems converge on one rule, so an agent moving between a Python repo
+  and a TypeScript repo does not have to learn the rule twice.
+- The stronger failure description is canonical: silently running against the wrong environment
+  is worse than failing, and the rule exists to prevent it.
+- Repos with no declared scripts get them from the tooling baseline (plan 0001 §3.1), so this
+  ruling is always actionable.
+
+## Rejected
+
+- **Adopt only the npm half.** Leaves the identical failure unguarded in Python, Gradle and
+  every future ecosystem.
+- **Permit `npx` for convenience.** `npx` will fetch a package that is not the project's
+  version, which reintroduces exactly the environment drift the rule prevents.

package/docs/decisions/ADR-011-windows-support.md

@@ -0,0 +1,52 @@
+# ADR-011 — Windows is supported from v1
+
+Status: **superseded by [ADR-012](ADR-012-drop-windows-support.md)** · 2026-10-05
+Affects: the `simt-dev` CLI
+
+> Superseded the same day. The cost table below is retained because it is what ADR-012's
+> reasoning turns on: three of the five obligations are permanent tax on the hook dispatcher
+> and the projection injector, not one-off work. See ADR-012 for the weighing.
+
+## Context
+
+No Windows developer currently appears in the estate, and the cheap alternative was
+`"os": ["darwin", "linux"]` in `package.json`, which makes npm refuse to install on Windows
+with a clear message instead of failing obscurely inside a git hook.
+
+That option was put to you and declined in favour of full v1 support.
+
+The cost is real and is recorded here so it is paid deliberately rather than discovered:
+
+| Obligation | Why |
+|---|---|
+| Hook scripts must not assume POSIX | `core.hooksPath` hooks run under Git for Windows' bundled sh, which does exist — but the dispatcher cannot assume a POSIX `#!/bin/sh` shebang alone is sufficient. Hook entrypoints are `.cmd`-aware or invoked through `node` explicitly. |
+| The projection injector must normalise line endings | The audit found **10 of 16 repos have no `.editorconfig`**, so a generated region written with the host's EOL would produce a whole-file diff on Windows checkouts. The injector writes the canonical EOL from `.gitattributes` (`* text=auto eol=lf`), defaulting to LF. |
+| Path handling must not assume `/` | Resolver globs, `paths` matching and every emitted file reference must normalise separators. |
+| npm bin shim | The published package must rely on npm's generated shim rather than a hand-written launcher. |
+| CI must actually run it | A macOS-only CI run cannot verify a Windows claim. GitHub Actions gains a `windows-latest` job for the CLI itself — not for the repos it serves, which stay macOS/Linux as their own tooling dictates. |
+
+## Ruling
+
+Windows is a supported v1 platform for the `simt-dev` CLI itself. `package.json` declares no
+`os` restriction, and CI verifies on `windows-latest`.
+
+Scope is deliberately limited: this covers the CLI running *on* Windows. It does not imply that
+any repo's own toolchain is Windows-ready — Python packaging, Monkey C, and Android Gradle
+builds are governed by their own repos.
+
+## Consequences
+
+- The shared hook dispatcher ships with a Windows-safe entrypoint from day one. Retrofitting
+  this after 16 repos have installed the dispatcher is far more expensive than building it now.
+- The EOL normalisation in the projection injector becomes a correctness requirement rather
+  than a nicety — which is worth doing regardless, given 10 repos lack `.editorconfig`.
+- `windows-latest` CI costs minutes per run and buys an install story that does not break on the
+  first non-Mac contributor.
+
+## Rejected
+
+- **`os: ["darwin", "linux"]`.** Cheapest, and a defensible engineering call on estate
+  evidence — declined because the hook dispatcher's Windows-safety is substantially harder to
+  retrofit across 16 installed repos than to build.
+- **Windows via WSL only.** Avoids the native path work but leaves a Windows contributor
+  needing a Linux environment, which is the failure this ruling exists to prevent.

package/docs/decisions/ADR-012-drop-windows-support.md

@@ -0,0 +1,59 @@
+# ADR-012 — Windows support is dropped; POSIX only
+
+Status: **accepted** · 2026-10-05 · supersedes [ADR-011](ADR-011-windows-support.md)
+Affects: the `simt-dev` CLI
+
+## Context
+
+ADR-011 committed to supporting Windows in the CLI from v1, against the recommendation to
+declare `"os": ["darwin", "linux"]` and let npm refuse the install elsewhere. The reasoning
+for that decision was sound but the weighing was wrong.
+
+ADR-011's own cost table listed five obligations, three of which are permanent tax on
+every future change to the hook dispatcher and the projection injector rather than one-off
+work:
+
+1. Hook entrypoints must be `.cmd`-aware instead of relying on a POSIX shebang.
+2. The projection injector must normalise line endings on every write.
+3. Glob matching and every emitted path reference must normalise separators.
+4. npm's generated bin shim must be relied on rather than a hand-written launcher.
+5. CI must carry a permanent `windows-latest` job.
+
+Against that: **no Windows developer appears anywhere in the repos**, and no repo's own
+toolchain is Windows-ready either — `simt-garmin` drives the Monkey C toolchain, and
+`simt-app`/`wakt-app`/`app-ui` drive Gradle and Android tooling. So the CLI would have been the
+*only* Windows-ready artefact in the estate, serving nobody.
+
+The deciding argument is not the cost, it is the shape: obligations 1–3 are correctness
+constraints that every contributor must keep satisfying forever. Adopting them to serve a
+population of zero is how a codebase accumulates permanent complexity nobody can evaluate.
+
+## Ruling
+
+**POSIX only: macOS and Linux.** `package.json` declares `"os": ["darwin", "linux"]`, so npm
+refuses to install on Windows with a clear message instead of failing obscurely inside a git
+hook. CI verifies on `macos-latest` and `ubuntu-latest` only.
+
+The code obligations of ADR-011 are withdrawn, with one exception that stands on its own
+merits rather than on Windows: **the projection injector still normalises line endings to the
+canonical EOL.** 10 of 16 repos have no `.editorconfig`, so a generated region written with
+whatever the host produced would cause whole-file diffs on checkouts whose
+`core.autocrlf` differs. That is a cross-platform problem among POSIX hosts and has nothing
+to do with Windows.
+
+## Consequences
+
+- `bin/simt-dev.mjs` keeps its shebang as a plain POSIX entrypoint; no `.cmd` shim handling.
+- Glob matching and emitted paths assume `/`. The existing forward-slash normalisation in
+  `fingerprint.mjs` is retained as cheap insurance, not as a Windows requirement.
+- The permanent `windows-latest` CI job is not added.
+- Revisit only when a Windows developer joins the estate — at which point the deciding
+  argument is gone and the cost table in ADR-011 becomes the deciding one.
+
+## Rejected
+
+- **Keeping Windows v1 (ADR-011).** Permanent correctness constraints in the dispatcher and
+  injector, serving zero users, in the only part of the estate that would have been
+  Windows-ready.
+- **Deferring rather than dropping.** A deferred platform is an unbounded promise; the
+  obligations would still shape the code.

package/docs/decisions/ADR-013-genericity-by-facts-and-local-profiles.md

@@ -0,0 +1,114 @@
+# ADR-013 — Genericity comes from emitted facts and repo-local profiles, not from a bigger hardcoded tag table
+
+Status: **accepted** · 2026-10-05
+Affects: the `simt-dev` CLI (fingerprint, profile selection, registry validation)
+
+## Context
+
+The engine is already only loosely coupled to SIMT. Measured, not asserted: `src/argv.mjs`,
+`src/resolve/resolve.mjs` and `src/graph/load.mjs` contain **zero** non-comment,
+non-string references to SIMT. Everywhere else, "SIMT" appears as ADR citations in comments
+documenting *why*, plus one hardcoded npm scope in the hook shim. The project is named SIMT;
+the mechanisms are not.
+
+The coupling that does exist is in the **vocabulary**, not the code. `fingerprint()` emits 17
+tags from three hardcoded tables (`MARKERS`, `EXTENSION_TAGS`, `DEP_TAGS`) plus a literal
+`'wear-os'`, and those tables are keyed by *curated product* names: `connectiq`,
+`maplibre`, `hono`, `react-router`. That has three consequences, and only the first is
+obvious:
+
+1. **A new ecosystem needs a code change.** Detecting Django is one line in `MARKERS`; the
+   engine then hands a Django repo the generic `node` fallback profile, which is wrong advice,
+   and there is nowhere to put the correct profile because `rules/stacks/` is central-only.
+2. **The tag names encode opinions that age badly.** `hono` and `maplibre` are libraries, not
+   stacks. A profile that selects on a library breaks the day the library is swapped.
+3. **Detection is untestable in the abstract.** There is no way to ask "what did the tool
+   actually observe?" other than reading three tables.
+
+There is also an unresolved question from the design review: a **hosted MCP service** would
+make the tool more capable, but it was not clear whether it would make it more *generic*, more
+*accurate*, or merely more available.
+
+## Ruling
+
+### 1. Detection emits facts; profiles select on facts
+
+`fingerprint()` gains a second, orthogonal output: **`facts`** — observable, ecosystem-neutral
+properties of the working tree, named `has-*` (`has-pyproject`, `has-go-mod`,
+`has-cargo-toml`, `has-migrations-dir`, `has-dockerfile`, …). Facts are derived from evidence,
+never from a product taxonomy, so there is no table to grow when a new ecosystem arrives: the
+fact was already being observed.
+
+The existing product tags remain, because a profile that genuinely wants "this is a Cloudflare
+Worker" should say so in words that mean something to a reader. But a profile may now select
+on **either**, and new profiles are expected to prefer facts where a fact will do:
+
+- `applies: [has-cargo-toml]` — honest, survives the framework being replaced
+- `applies: [cloudflare-workers]` — precise, dies with the platform
+
+Selection is the union of both sets. A profile therefore needs **no engine change** to be
+usable by an ecosystem nobody has heard of.
+
+### 2. Profiles are content, and content may live in the repo
+
+`simt-dev init` prints where local profiles live and the manifest gains a `profiles` array
+naming profile ids. The directory needs no creation — the first file in it creates it, and
+an empty directory would not survive git anyway. Central profiles ship in `rules/stacks/`; **repo-local profiles are read from
+`.simt-dev/profiles/*.md`**, use the same frontmatter contract (ADR-009), and are selected
+with the same matcher. A local profile may declare `fallback: true`.
+
+A repo that ships its own profile has made a decision about its own conventions. It does not
+need a central contribution, a release, or a maintainer's permission — and when it is wrong,
+the fix is a one-file PR in the repo that is wrong, which is the correct blast radius
+(ADR-002).
+
+Local profiles are **additive and shadowing**: a local `id` replaces a central one with the
+same id, and otherwise both are considered. Central content is never silently overridden in
+place — it is superseded by an explicit, reviewable file.
+
+### 3. A hosted service may serve authoring; it may never serve resolution
+
+These are different products and must not be conflated.
+
+| | Authoring | Resolution |
+|---|---|---|
+| Hosted MCP is useful | yes — discovering profiles, learning an ecosystem, publishing findings | **no** |
+| Non-determinism | tolerable: a human reviews the output | fatal: "did the agent follow the rules?" becomes unanswerable |
+| Offline | irrelevant | required: a hook and a gate must not depend on a network call |
+| Diffable in a PR | partially | required: `simt-dev check` output is the gate's whole product |
+| Fails | loudly, at authoring time | must fail **closed** with a remedy |
+
+A hosted resolver would make every gate in the estate depend on a network round trip and a
+model's ranking, and would make CI results unreproducible. That is a worse tool, not a more
+capable one.
+
+**Community extensibility therefore ships as a registry of portable profile files** in a git
+repository, fetched and pinned by the same single-SHA mechanism (ruling 4) that already pins
+rules. Same trust model, no hosted runtime, and the diff a reviewer sees is the diff of a
+profile file.
+
+## Consequences
+
+- `fingerprint()` returns `{stack, facts, evidence, manifest, error}`. `evidence` gains the
+  file that proved each fact, so `simt-dev doctor` can answer "why did you think that?" without a
+  human re-deriving it.
+- Every tag a profile may name is still emitted by the engine. The existing test — *tags used
+  by content but not emitted by the engine is the empty set* — now covers facts too, and the
+  registry validator and the profile loader share one derived vocabulary so they cannot
+  desynchronise.
+- `graph lint` validates against the same derived vocabulary, so a profile naming a fact the
+  engine cannot emit fails at lint time rather than selecting nothing at runtime.
+- Step 11 of the implementation sequence is genericity; it lands **before** `compare`, because
+  it changes the tag vocabulary and every later step is cheaper once it is settled.
+
+## Rejected
+
+- **A larger hardcoded tag table.** Moves the wall, does not remove it. Every new ecosystem
+  would still need a maintainer, a code change and a release, and the names would still encode
+  today's libraries rather than the repo's actual properties.
+- **Community profiles in a hosted registry served at runtime.** See the table above.
+- **Semantic or embedding search as the mechanism for choosing rules.** Already rejected in
+  plan 0002 §3, and this ruling reinforces it: it is a resolution mechanism, so it inherits
+  every constraint in row two of the table above.
+- **Fingerprinting on library names alone.** Precise today, and silently wrong the day a
+  dependency is replaced.