---
mode: CREATE
adr_id: ADR-0.0.67
branch: main
timestamp: "2026-06-09T02:20:38Z"
agent: claude-code
obpi_id:
session_id:
continues_from: .gzkit/handoffs/20260608T215910Z-549-ruled-593-parked.md
---

<!-- Handoff document for ADR-0.0.67 — created by claude-code at 2026-06-09T02:20:38Z -->

## ⚠️ This handoff ADVISES next moves — it is NOT authorization to execute them

**Read this before anything else.** A handoff records a *proposed* plan and its
context. It is **NOT** a clearance to unilaterally execute that plan. On resume —
at **every** freshness level, Fresh included — you MUST:

1. Present the advised next steps and current state to the operator.
2. **Obtain explicit operator authorization before executing any of them** — no
   file mutation, no `gz` ceremony, no migration until the operator says go.
3. Treat the human-as-final-witness doctrine as binding from the first step: you
   advise; the operator rules; you note variance and stop.

Barreling into execution from this document is the exact failure this handoff
exists to prevent. The plan is the destination; operator authorization is the
ignition.

## Current State Summary

Two threads completed and pushed; HEAD `a3921d9c` on `main`, in sync with origin.

**Thread 1 — GHI #593 FIXED and CLOSED (`d13ad5ba`).** The prior handoff parked
#593 as a "foundation substrate defect" needing an ADR + fingerprint engine.
Primary sources falsified that framing: `artifacts/receipts/` is NOT gitignored
(1231/1875 tracked) and the attested receipt DOES resolve to the ledger. The real
defect was narrower — `_receipt_exists` in
`src/gzkit/governance/trust_audits/closeout_proof_binding.py` checked receipt-FILE
existence, contradicting the attested BEHAVIOR REQ-0.0.63-03-03 ("resolve to a
real ledger event") and a test named `TestLedgerExistenceFloor` that actually
asserted file presence (Invariant 6f defect). Fix: re-rooted resolution at the
ledger (`evidence.run_id` ∪ `evidence.resolved_receipt_ids`); the binding moment
(`gz obpi complete`) precedes the ADR-closeout gate, so the durable record is
present when the validator fires. Landed as a direct-fix (TDD RED→GREEN, 11 module
tests, full suite 5977 pass, coupled consumer `test_ceremony_ln_consumption.py`
updated same commit). #549 left as a one-line recorded principle — fingerprint /
enum / provenance-event all DROPPED as apparatus.

**Thread 2 — governance subtraction "track 2", increment A1 (`1cf860f3` +
coupled-surface fix `a3921d9c`).** Diagnosed the mechanistic-vs-latent guardrail
imbalance: the advisory-rules-audit scorecard is a one-way ratchet (20 promotion
references, 0 demotion; 76 `gz validate` scopes, 37 validator modules, 13
pre-commit hooks, 38 chores vs 22 rules / 62 skills / 6 personas). Operator chose
reading A (housekeeping under the existing "volume follows steering need", no
doctrine amendment). A1 landed: froze the promotion-order backlog and cut 3
wrapper chores (`sync-manpage-docstrings`, `skill-manifest-sync`,
`schema-and-config-drift-audit`) with verified zero enforcement loss. `a3921d9c`
fixed the coupled `src/gzkit/chores/` package surface (sync + orphan deletion)
that A1 missed.

## Important Context

- **Receipt/ledger model (load-bearing for #593 and any future closeout work):**
  ARB emits a receipt FILE per wrapped command (`artifacts/receipts/<id>.json`,
  mostly git-tracked, locally flushable per operator's ARB-flush intent). The
  ledger gets NO per-command receipt event; a receipt-ID enters the ledger only
  when bound at `gz obpi complete` via `evidence.resolved_receipt_ids`
  (`src/gzkit/commands/obpi_complete.py:299`). "Ledger-existence" = run_id ∪
  resolved_receipt_ids. 0/98 brief-cited IDs appear as their own run_id — they
  bind via resolved_receipt_ids.
- **Operator doctrine established this session (binding framing for future agents):**
  (1) the system's purpose is a trustworthy ATTESTATION; evidence detail is the
  agent's externalized memory for cross-context focus, not cryptographic proof;
  (2) reconciliation corroborates STATUS, not EVIDENCE — that gap is what #593
  exposed; (3) gzkit has too many "layers guarding layers"; agents reflexively add
  legible mechanism rather than sharpen judgment; (4) subtraction must NOT itself
  become apparatus (no demotion validator); the rebalance is prose + deletions
  enforced by judgment.
- **The A→B sequence (operator-ruled):** do reading-A housekeeping cuts first,
  MEASURE the residual, only THEN consider reading-B (amending the anti-vibing
  claim "never maintenance burden" so AGGREGATE burden counts as a legitimate
  axis — and if so, narrowly: burden counts when the operator-principal raises it,
  never when an agent does). A1 is the first A increment.
- **Skill-surface-sync gotcha (cost this session a follow-up commit):** chores are
  a canonical surface with a `src/gzkit/chores/` package copy. Deleting a chore
  requires `gz agent sync control-surfaces` AND manual deletion of the orphaned
  `src/gzkit/chores/<slug>/` dir (sync copies, it does not prune). Apply this to
  any future chore removal in one commit.
- **ADR-0.0.67 is still parked at closeout Step 6 (unattested).** Its `ln:`
  bindings were reverted in `aec872f4`, so the opt-in `--closeout-proof-binding`
  validator reports missing-`ln` for its REQs. That is SEPARATE from the #593 fix
  (which corrected file-vs-ledger resolution, not ln-presence). The validator is
  opt-in and not in the default gate, so it does not block the parked attestation.

## Decisions Made

- **Decision:** Fix #593 as a direct-fix, not a foundation ADR; resolve against
  `resolved_receipt_ids` (not per-receipt ledger events, not file existence).
  **Rationale:** primary sources showed the handoff's recipe was wrong (0/98 IDs
  are standalone events) and the framing falsified; the honest fix is small and
  restores the already-attested behavior. **Alternatives rejected:** the parked
  foundation-ADR-with-fingerprint (apparatus for an unobserved REQ-text-drift
  failure mode); branch B "correct claim down to file-existence" (self-defeating
  under the operator's ARB-flush policy — flush and the floor breaks).
- **Decision:** track 2 reading A (housekeeping), not B (doctrine amendment), as
  the first move. **Rationale:** most felt-burden is steering-degradation in
  disguise (misfires, over-fires, layers-guarding-layers) and is removable under
  "volume follows steering need" without amending doctrine; A is reversible, B
  permanently loosens the posture for every future agent. **Alternatives
  rejected:** amend "never maintenance burden" now (premature — do A, measure,
  then decide); a new "demotion discipline" validator (same apparatus sin).
- **Decision:** A1 cuts limited to the 3 wrapper chores; KEEP the 3
  control-surface passes, evidence-integrity-audit, frontmatter-ledger-coherence,
  skill-command-doc-parity. **Rationale:** the Explore survey corrected a
  keyword-based bias — those serve steering (surface real conflicts/gaps; enforce
  ledger-wins; protect attestation). **Alternatives rejected:** cutting by "meta"
  keyword (would have removed steering-serving mechanism).

## Immediate Next Steps

<!-- ADVISORY ONLY — present and await operator authorization before acting. -->

1. **Pause-and-measure (operator's stated lean).** Track 2 A→B discipline says run
   A, then MEASURE whether the felt weight lifted before cutting more or
   considering B. The next cut should be felt-need-driven, not momentum-driven.
   Present this and let the operator decide whether to continue.
2. **(A continue, low-risk) Control-surface-passes follow-up.** Route the 3 passes'
   unharvested findings — notably the Operator-PII-rule-is-prose-only-no-check gap
   — to their destinations (`/ghi-author` or fixes), then archive the 3 completed
   one-shot audits (last run ~2026-05-10).
3. **(A continue, higher-value) Survey the 76 `gz validate` scopes / 13 hooks** for
   misfirers and over-firers with named steering-failure evidence. Known
   candidate: `brief_reconcile_drift_detected` fired 11× in 24h (over-fire
   degrading drift signal). Apply the same evidence-bearing bar A1 used.
4. **(Separate, parked) ADR-0.0.67 closeout.** Decide whether its reverted `ln:`
   bindings should be re-added (then attest) or whether it attests as-is given the
   proof-binding validator is opt-in. This was the original pre-track-2 thread.

## Pending Work / Open Loops

- **GHI #594** (open, blocker) — ARB archive/purge lifecycle (the flush half). The
  11-unbound-historical-receipts finding (below) is tied to this.
- **GHI #595** (open, blocker) — `gz-design`/`gz-adr-create` evaluate-gate errors
  on pool ADRs; direct-fix candidate, logged-not-fixed.
- **GHI #591** (open) — `gz obpi audit` whole-`src` coverage denominator;
  direct-fix candidate.
- **ADR-0.0.41** — stale parked closeout ceremony (Step 6) for a BLOCKED ADR; no
  governed `--abort` path. (Its 4 cited receipts DO resolve via the ledger, so the
  #593 fix does not affect it.)
- **Side-finding (logged to agent-insights):** 11 brief-cited receipts in
  *completed* ADRs (0.0.64, 0.25.0, …) do not resolve to the ledger — out of
  validator scope; routed to the `evidence-integrity-audit` chore + #594.
- **Side-finding (pre-existing):** `.gzkit/chores/owasp-top10-2025-scan/` dir lacks
  a `registry.json` entry — a chore-registry coherence gap predating this session.
- **#549** — remains a one-line recorded principle at
  `docs/design/adr/pool/ADR-pool.attested-record-edit-doctrine.md`; per the
  session's anti-apparatus conclusion, its validator/enum/event are NOT to be
  built unless a specific observed need arises.

## Verification Checklist

- [ ] `git branch --show-current` is `main`; `git rev-parse --short HEAD` is `a3921d9c` (or later if this handoff is committed atop it)
- [ ] `git log --oneline origin/main -3` shows `a3921d9c`, `1cf860f3`, `d13ad5ba` pushed
- [ ] `gh issue view 593` shows CLOSED with the corrected-diagnosis comment
- [ ] `uv run -m unittest tests.governance.test_closeout_proof_binding tests.governance.test_ceremony_ln_consumption` passes (ledger-resolution semantics)
- [ ] `uv run gz validate --advisory-scorecard --documents` is green (the ratchet-freeze prose edit passes the scorecard self-test)
- [ ] `ls .gzkit/chores/ | grep -E 'sync-manpage-docstrings|skill-manifest-sync|schema-and-config-drift-audit'` returns nothing (chores cut); same grep on `src/gzkit/chores/` also empty (package surface synced)
- [ ] `uv run gz chores list` parses and omits the 3 cut chores
- [ ] Working tree: `obpi-audit.jsonl` (M) and the ADR-0.0.67 `ceremony.json` (??) are pre-existing ADR-0.0.67 artifacts, untouched this session (expected)

## Evidence / Artifacts

- `src/gzkit/governance/trust_audits/closeout_proof_binding.py` — the #593 fix: `_ledger_resolved_receipt_ids` + `_receipt_in_ledger` replacing the file-existence check
- `tests/governance/test_closeout_proof_binding.py` — re-derived `TestLedgerExistenceFloor` (file-present-but-unbound fails; ledger-bound-but-no-file passes)
- `tests/governance/test_ceremony_ln_consumption.py` — coupled consumer (closeout gate) updated to bind in the ledger
- `docs/governance/advisory-rules-audit.md` — the track-2 keystone: FROZEN banner on the promotion-order backlog; subtraction granted equal standing
- `.gzkit/chores/registry.json` — 3 wrapper chores removed (canonical); `src/gzkit/chores/registry.json` synced
- `.gzkit/insights/agent-insights.jsonl` — session records: the conceptual-frame course-correction improvement, and the 11-unbound-receipts finding
- `docs/design/adr/pool/ADR-pool.attested-record-edit-doctrine.md` — #549, the recorded one-line principle (unbuilt by design)
- `.gzkit/handoffs/20260608T215910Z-549-ruled-593-parked.md` — predecessor handoff (its #593 framing was falsified this session)

## Environment State

Python 3.13 / uv. Branch `main`, in sync with `origin/main` at HEAD `a3921d9c`
(this handoff commit, if made, lands one ahead). All session commits passed
pre-commit gates. No environment-specific blockers.
