---
mode: CREATE
adr_id: ADR-0.0.67
branch: main
timestamp: "2026-06-08T21:59:10Z"
agent: claude-code
obpi_id:
session_id:
continues_from: .gzkit/handoffs/20260608T211256Z-arb-593-design-cluster.md
---

<!-- Handoff document for ADR-0.0.67 — created by claude-code at 2026-06-08T21:59:10Z -->

## ⚠️ This handoff ADVISES next moves — it is NOT authorization to execute them

**Read this before anything else.** A handoff records a *proposed* plan and its
context. It is **NOT** a clearance to unilaterally execute that plan. On resume —
at **every** freshness level, Fresh included — you MUST:

1. Present the advised next steps and current state to the operator.
2. **Obtain explicit operator authorization before executing any of them** — no
   file mutation, no `gz` ceremony, no migration until the operator says go.
3. Treat the human-as-final-witness doctrine as binding from the first step: you
   advise; the operator rules; you note variance and stop.

Barreling into execution from this document is the exact failure this handoff
exists to prevent. The plan is the destination; operator authorization is the
ignition.

## Current State Summary

Continues from `20260608T211256Z-arb-593-design-cluster.md`. That handoff deferred
the #549 + #593 + rename design cluster to a fresh session; this session, under
operator authorization, **completed the #549 half** and left #593 parked.

**Landed & pushed this session (all on `origin/main`, HEAD `e55ede53`):**

- `aec872f4` — `revert(obpi)`: dropped ADR-0.0.67's `ln:` bindings (defect #593 in
  miniature; briefs restored to ledger-attested state). `gz validate --documents`
  green post-revert.
- `01e98875` + `715b2189` — the design-cluster handoff and its validation stamp.
- `e55ede53` — **`docs(adr)`: booked `ADR-pool.attested-record-edit-doctrine`
  (GHI #549).** The #549 doctrine, ruled via `gz-design` and committed.

**GHIs filed this session:**

- **#594** (open, blocker) — `arb: no archive/purge half — 1875 receipts
  accumulate unbounded`; sibling-cross-linked to #585.
- **#595** (open, blocker) — `gz-design/gz-adr-create: evaluate gate errors on
  pool ADRs`; direct-fix candidate, logged-not-fixed per operator.

**Operator rulings this session:**

- ADR-0.0.67 → keep held at closeout Step 6 (unattested).
- #549 scope → **separate doctrine pool ADR** (over extending `adr-layer-coherence`).
- #549 proof-binding fork → **strict** (over lenient): any evidence-binding edit,
  including `@covers` backfill, requires re-attestation.
- #595 → log, do not fix this session.

**Parked (the remaining cluster half):** #593's foundation-ADR substrate fix, and
ADR-0.0.67's attestation that depends on it.

## Important Context

- **#549 is now RULED and committed**, not just drafted. The doctrine lives in
  `docs/design/adr/pool/ADR-pool.attested-record-edit-doctrine.md`:
  - **Principle:** an edit to an attested record is admissible without
    re-attestation iff it changes only how a fact is *rendered or pointed at*,
    never (1) what REQs require, (2) what proves them, (3) whether they're done.
  - **CLOSED 3-bucket enumeration:** Admit (pointer updates, pure key-renames like
    `ln:`→`req_evidence:`, non-REQ typos, schema-conformance headings) /
    Re-attest (REQ/AC text changes; ANY evidence-binding change incl. `@covers`
    backfill + ceremony-trailer additions) / Forbid (silent proof re-pointing).
  - **Coherence anchor:** generalizes the existing covers-backfill heuristic
    (`.gzkit/rules/adr-audit.md`; GHI #272/#309/#382/#466) which already requires
    an operator-attestation marker for `@covers` overlays.
  - **Authorizes #593's `ln:`→`req_evidence:` rename** (a pure key-rename = Admit).
  - Open surface decisions deferred to promotion: validator scope; admit-list
    encoding; whether admit-bucket edits emit a provenance ledger event.
- **#549 is a POOL stub.** Its evaluate gate + OBPI decomposition fire at
  *promotion* (`gz-adr-promote`), not now. `gz adr evaluate` cannot score a pool
  flat-file (that's defect #595). It likely promotes to **foundation** kind,
  possibly *alongside* #593's fix since #593 depends on the rename it authorizes.
- **#593 (still the substrate defect, unchanged):** `_receipt_exists`
  (`src/gzkit/governance/trust_audits/closeout_proof_binding.py:134-136`) checks a
  gitignored, ledger-absent `artifacts/receipts/<id>.json` file. OBPI-0.0.63-03's
  brief specified a ledger-existence floor; the implementation regressed to file
  existence. The fix re-roots proof-binding at committed proof, per-REQ kind-aware
  (ADR-0.0.59: BEHAVIOR→`@covers`; SUPPORT→ledger `artifact_edited`;
  STRUCTURAL-FENCE→parent-ADR `## Boundary Invariants`), and folds in the rename
  #549 now authorizes. Amends ADR-0.0.63 + `AGENTS.md` § Attestation + ARB's
  stated identity. NOT a direct-fix; constrained-mode design.
- **17 attested briefs repo-wide still carry `ln:` blocks** (`grep -rl '^ln:'
  docs/design/adr --include='*.md'` → 17; 0 use `req_evidence:`). These are #593's
  rename scope, now sanctioned by #549's doctrine.
- **META (still binding):** #593 must be designed in constrained mode (tight scope,
  ground truth per step, adversarial check per move). The #549 design honored this
  — overlap check caught that `adr-layer-coherence` owns adjacent amend machinery
  before any file was created; two forks went to operator ruling rather than agent
  default.

## Decisions Made

- **Decision:** #549 scoped as a separate doctrine pool ADR (operator ruling).
  **Rationale:** keeps the admissibility *doctrine* crisp and schedulable, distinct
  from `adr-layer-coherence`'s amend *mechanism*; they compose by reference.
  **Alternatives rejected:** extend `adr-layer-coherence` (couples doctrine to a
  drift validator); fold into `obpi-state-machine` (buries a shippable ruling in an
  unscheduled ~30-audit rewrite).

- **Decision:** strict-on-proof-binding (operator ruling).
  **Rationale:** the attestation IS a statement that the proof, as it stood, was
  sufficient; any evidence-binding edit reopens it. A backfilled `@covers` pointing
  at a non-covering test must not slip past the human witness.
  **Alternatives rejected:** lenient/omission-repair — blurs strengthen-vs-change.

- **Decision:** keep ADR-0.0.67 held; #595 logged-not-fixed.
  **Rationale:** ADR-0.0.67 unblocks only when #593 lands; #595 is out-of-scope of
  the #549 design and the operator chose not to expand mid-task.

- **Decision:** #594 and #595 left open-with-blocker, not routed to destinations.
  **Rationale:** #594 needs an operator retention-policy conversation (possibly
  unified with #585); #595 is a direct-fix candidate deferred by operator choice.

## Immediate Next Steps

<!-- ADVISORY ONLY — present and await operator authorization before acting. -->

1. **Design #593's fix in constrained mode** (the remaining cluster half; likely
   `gz-design`). Foundation ADR amending ADR-0.0.63 (proof-binding) + `AGENTS.md`
   § Attestation + ARB's stated identity. Re-root `_receipt_exists` from
   file-existence to per-REQ kind-aware committed-proof resolution. Fold in the
   `ln:`→`req_evidence:` rename across the 17 briefs — now authorized by #549's
   doctrine (`ADR-pool.attested-record-edit-doctrine`, Admit bucket).
2. **Decide #549's promotion timing** with the operator: promote
   `ADR-pool.attested-record-edit-doctrine` to foundation standalone, or bundle it
   into #593's ADR (since #593 consumes its rename authorization). Resolve its 3
   open surface decisions at promotion.
3. **After #593's substrate fix lands,** resume ADR-0.0.67's closeout ceremony from
   Step 6 and attest.
4. **Route #594** (ARB lifecycle): operator decides whether ARB-receipt retention
   and handoff retention (#585) share one pool ADR; author destination, close #594.
5. **Fix #595** (direct-fix candidate): add pool-ADR carve-out to gz-design Step 6
   and gz-adr-create Step 12 (edit canonical `.gzkit/skills/`, bump
   skill-version + last_reviewed, `gz agent sync control-surfaces`), close `fixed`.

## Pending Work / Open Loops

- **GHI #593** (open) — the foundation substrate defect. The remaining design.
  Blocks ADR-0.0.67 attestation. Consumes #549's rename authorization.
- **GHI #549** (open) — **doctrine ruled**, homed at
  `ADR-pool.attested-record-edit-doctrine`. Closes `superseded` against that ADR on
  promotion (with #532).
- **GHI #594** (open, blocker) — ARB archive/purge lifecycle; sibling of #585.
- **GHI #595** (open, blocker) — evaluate-errors-on-pool-ADR skill drift; direct-fix candidate.
- **GHI #591** (open) — `gz obpi audit` whole-`src` coverage denominator; direct-fix candidate.
- **GHI #592** (open) — gate-scope fix landed (`814099fe`); two sub-defects remain.
- **ADR-0.0.41** — stale parked ceremony at Step 6 for a BLOCKED ADR; no governed
  `--abort` path.

## Verification Checklist

- [ ] `git branch --show-current` is `main`; `git rev-parse --short HEAD` is `e55ede53` (or later if this handoff is committed atop it — see self-reference caveat)
- [ ] `git log --oneline origin/main -1` shows `e55ede53` pushed (local ↔ origin in sync at handoff time)
- [ ] `ls docs/design/adr/pool/ADR-pool.attested-record-edit-doctrine.md` exists; `uv run gz adr report | grep attested-record` lists it
- [ ] `uv run gz validate --documents` is green (the pool ADR passes schema)
- [ ] `grep -rl '^ln:' docs/design/adr --include='*.md' | wc -l` is 17 (the #593 rename scope, authorized by #549)
- [ ] `uv run gz adr status ADR-0.0.67` shows 3/3 `attested_completed`, closeout READY, QC PENDING (human attestation)
- [ ] `.gzkit/ceremonies/ADR-0.0.67-tool-skill-invariant1-enforcement.ceremony.json` shows `current_step: 6`, `attestation: null`, `paused_at` set
- [ ] `gh issue view 549 594 595` open; #549 has its doctrine home; #594/#595 carry blocker comments
- [ ] Working tree: `obpi-audit.jsonl` (M) and the ceremony JSON (??) are uncommitted ceremony artifacts (expected)

## Evidence / Artifacts

- `docs/design/adr/pool/ADR-pool.attested-record-edit-doctrine.md` — the #549 doctrine (principle, CLOSED 3-bucket enumeration, 4 rejected alternatives, relationships, open surface decisions). Committed `e55ede53`.
- `src/gzkit/governance/trust_audits/closeout_proof_binding.py` — `_receipt_exists` (file-existence floor, the #593 locus) and `adr_id`-scoped `validate_closeout_proof_binding` (the #592 fix)
- `src/gzkit/governance/brief_structure.py` — the `ReqEvidence` model + `ln` frontmatter field (the rename target, 17 briefs)
- `.gzkit/rules/adr-audit.md` — the covers-backfill heuristic the #549 doctrine generalizes (GHI #272/#309/#382/#466)
- `docs/design/adr/pool/ADR-pool.adr-layer-coherence.md` — owns the amend mechanism #549 consumes for the ADR-metadata surface
- `.gzkit/ceremonies/ADR-0.0.67-tool-skill-invariant1-enforcement.ceremony.json` — paused ceremony state (Step 6, unattested)
- `.gzkit/handoffs/20260608T211256Z-arb-593-design-cluster.md` — predecessor handoff (deferred the cluster this session half-completed)

## Environment State

Python 3.13 / uv. Branch `main`, in sync with `origin/main` at HEAD `e55ede53`
(this handoff commit, if made, lands one ahead). Pre-commit gates green on all
session commits. `gz validate --documents` green. No environment-specific blockers.
