# Domain 20: User-Content Authoring & Governance

> Last updated: 2026-04-27

**Pillars served:** governance-axis P4 (primary), P1 (supporting), P5 (supporting), P6 (supporting); content-quality-axis CQ3 Security (supporting), CQ8 Maintainability (supporting).

**Scope:** The `/hatch3r-create` orchestrator and the user-authored artifacts it produces under `<project>/.hatch3r/overrides/` (project-local agents, skills, rules, commands, hooks). Audits both the creation tool (D20.1) and the resulting end-user artifacts (D20.2). NOT re-auditing canonical framework content under `agents/`, `skills/`, etc. — that remains D05.

**Sub-agents:** 2

D20.1 runs in parallel within Tier C; **D20.2 is sequential** — runs after D20.1 because artifact compliance findings depend on the creator-tool baseline established by D20.1.

| SA | Focus | Depends On |
|----|-------|-----------|
| 20.1 | Creation Tool Quality (`/hatch3r-create`, `hatch3r-creator` agent, templates) | None |
| 20.2 | User-Authored Artifact Compliance | D20.1, D05 (charter inheritance), D15 (security baseline) |

> Apply the rigor contract per [../templates/rigor-contract.md](../templates/rigor-contract.md) on every finding.

## Domain Boundary

D05 audits the canonical artifacts shipped by hatch3r. D20 audits the user-authored artifacts a project owner creates via `/hatch3r-create` and stores under `.hatch3r/overrides/`. If an artifact lives in the canonical corpus, it belongs in D05; if it was generated by the creator command into a project's user override directory, it belongs in D20.2.

D10 audits CLI/command UX broadly. D20.1 audits the specific creator-command UX. A finding about creator-command UX belongs in D20.1; a finding about init/sync/config UX belongs in D10.

**Specific source set (D20-targeted):** `commands/hatch3r-create.md`, `agents/hatch3r-creator.md`, `agents/shared/user-content-templates.md`, and any `.hatch3r/overrides/` artifacts present at audit time.

## Audit Checklists

> **Per-finding (Decision 17 / charter directive 18):** every finding declares `impact_horizon: short|medium|long` AND `progress_toward_pillar: <axis>.<pillar_id>+<delta>`; orchestrator DROPS at output time if either missing.

### 20.1 Creation Tool Quality
- [ ] Creator-command UX walkthrough (5 type branches, prompts unambiguous, defaults sensible, no dead-ends)
- [ ] Creator-agent body structure (role, scope boundary, charter inheritance, pillar tags)
- [ ] Template completeness (skeleton exists for all 5 types with required frontmatter slots)
- [ ] Error-message actionability (invalid type, ID collision, malformed inputs all emit corrective messages)
- [ ] Charter-inheritance enforcement at creation time (every generated artifact gets `quality_charter:` frontmatter; absence on any type = Critical)
- [ ] Lean enforcement at creation time (warning/refusal when artifact would exceed thresholds)
- [ ] Earn-existence prompt (creator asks which pillar(s) the artifact serves; refuses if none)
- [ ] Negative-scenario coverage (malformed inputs, missing prerequisites, references to non-existent canonical)

### 20.2 User-Authored Artifact Compliance
- [ ] Frontmatter validity (id, type, description, tags, quality_charter present and well-formed)
- [ ] Security baseline inheritance (user agents reference D15 deny-patterns + tool-allowlist; unbounded tool grants without baseline = Critical)
- [ ] Quality-charter inheritance (`quality_charter:` resolves to canonical or documented project override)
- [ ] Lean compliance (user agent ≤150 lines, user skill SKILL.md ≤200 lines, user rule ≤80 lines)
- [ ] Pillar tagging (every user artifact declares ≥1 of P1–P6 in tags or body)
- [ ] Duplication against canonical (user artifact with ≥50% description-keyword overlap with canonical = Medium with rationale)
- [ ] **Tier-aware user-artifact floor (Decision 4):** verify user-authored artifact does not enforce floor mandates beyond the project's declared maturity tier (`.hatch3r/hatch.json` `maturity` field). Solo tier admits a stripped-down floor; enterprise admits the full floor catalogue.
