---
id: ADR-0.0.59-req-scope-discipline-and-test-shape-doctrine
status: Validated
kind: foundation
semver: 0.0.59
lane: heavy
parent: PRD-GZKIT-1.0.0
date: 2026-05-25
---

# ADR-0.0.59-req-scope-discipline-and-test-shape-doctrine: REQ Scope Discipline and Test Shape Doctrine

## Persona

<!-- Describe the behavioral identity for agents working on this ADR.
     Frame as values and craftsmanship standards, not expertise claims.
     See .gzkit/personas/ for reusable persona definitions. -->

`main-session` — skeptical design partner, governance-aware, whole-file-reasoning, direct. Treats REQ taxonomy as the categorical layer beneath every test-shape decision; refuses to ship doctrine without mechanism; refuses to mechanize a wrong taxonomy because it would propagate the categorical error faster. Treats unit tests as instruments for verifying code behavior — not as a generic governance-evidence surface — and treats every filesystem-shaped assertion against a production doc as a candidate anti-pattern requiring per-instance disposition. Holds the line on the three-kind taxonomy's closed-set discipline: a fourth kind, when it surfaces, triggers an amendment ADR, not an in-place schema edit. Insists every fail-close gate ship with a documented 2am-operator bypass surface so the system cannot become hostage to its own gates.

## Why foundation tier?

**Invariance test:** Yes — without this ADR, the project would still ship and the `@covers` machinery would still fire, but it would lose the property that **unit tests indicate code behavior correctness**, which is what unit tests structurally exist to provide (per the Python `unittest` library's canonical purpose: *"verify that individual parts of your program (like functions or classes) behave exactly as you expect them to under various conditions"*). At 32% project-wide and 42% in tests/governance/ filesystem-shaped operations, gzkit's test surface has been silently mass-producing tautological grep tests under cover of REQ-derived testing — assertions whose only failure mode is human edit of a production doc, with zero regression-detection value. The invariance this ADR names: *the test suite signals what changed in CODE BEHAVIOR; it does not signal what changed in CONTENT.* That invariance is foundational because the alternative is a CI surface that gates merges on the wrong signal class.

**Port-vs-adapter framing:** This ADR authors a **port**. It declares the abstract shape every REQ must satisfy (kind classification + proof-channel pairing) and the abstract contract the parity-gate must honor (per-kind proof-channel resolution). The specific validator mechanics, the chore's per-file disposition heuristic, the grandfathering inference rules, and the brief-authoring scaffold prompts are all adapters behind the port. Per Cockburn's framing as inherited by gzkit (`docs/governance/hexagonal-architecture.md`): ports point to invariance; adapters are features. The three REQ kinds and their three proof channels are the invariance; everything else is implementation-side specialization.

## Intent

gzkit's REQ→@covers parity machinery and Stage 3 Phase 1b enforcement (inherited from airlineops via GHI #113) apply a single mechanical gate — '@covers-decorated test reachable from Allowed Paths' — to every REQ uniformly. The gate was correct for airlineops's REQ profile (predominantly code-behavior REQs against data-warehouse operations; 17% whole-tree filesystem-shaped ratio). It is structurally wrong for gzkit's REQ profile (predominantly governance-content REQs against doctrine artifacts; 42% governance-test ratio of filesystem-shaped ops). The mismatch has produced ~3,404 filesystem-shaped operations across tests/ (32% of the suite) — tests whose only failure mode is a human editing the asserted prose, with zero regression-detection value. Surfaced 2026-05-25 during OBPI-0.0.54-01 (Move 3) when the parity gate fail-closed on a content-only OBPI; the in-flight workaround (authoring a tautological grep test) was itself exemplary of the anti-pattern, prompting operator framing: 'the only REQs worth having are likely the same — the behaviors of the system — docs, data, and structural affordances will need to be handled differently — they SUPPORT behaviors, they are means for behavior, or byproducts… but we are testing CODE behaviors not content/data. Data is only valid in testing when it serves as input or output that validates behavior.' Operator characterization: 'staggering find.' This ADR names the categorical category error and ships the categorical fix: a three-kind REQ taxonomy (BEHAVIOR / SUPPORT / STRUCTURAL-FENCE) keyed to distinct proof channels (@covers test / ledger event + structural validator / parent-ADR integration-state invariant), mechanically enforced at brief-authoring time, at the parity gate, and via a re-runnable decommissioning chore for the existing rot. Foundation tier per the invariance test: without the categorical distinction, gzkit's test suite continues accumulating tautological filesystem-grep tests under cover of REQ-derived testing — the project would still ship but would lose the property that unit tests indicate code behavior correctness, which is what unit tests structurally exist to provide. Supersedes ADR-pool.obpi-req-taxonomy-scope-fence (its Path A/B/C/D analysis rolls into Alternatives Considered). Closes GHI #165 (non-code REQ evidence channels) and GHI #531 (categorical test-shape category error) superseded. Cross-links to GHI #517 (5-alarm structural emergency — this ADR is one of the validation-machine remediations). Authored as Move 6 of the get-out-of-jail recovery plan per the operator-blessed ADR-0.0.59 exception in the plan's anti-temptation table.

## Decision

Canonical statement: every REQ in an OBPI brief's Acceptance Criteria carries exactly one of three kinds — BEHAVIOR, SUPPORT, or STRUCTURAL-FENCE — declared via a bracketed inline tag (REQ-X.Y.Z-NN-NN [kind]: claim text). Each kind has exactly one proof channel: BEHAVIOR is witnessed by a @covers-decorated test in tests/** (existing pattern, unchanged); SUPPORT is witnessed by the conjunction of a ledger artifact_edited (or kin) event citing the asserted artifact path AND a structural validator scope (e.g. gz validate --documents) that admits the artifact's shape; STRUCTURAL-FENCE is witnessed by a parent-ADR § Boundary Invariants entry that audits at the ADR closeout layer (not per-OBPI). Decision items (1:1 with OBPI decomposition): (1) Author the doctrine — update .gzkit/rules/tests.md adding the REQ Scope Discipline subsection (three-kind taxonomy + proof-channel matrix + brief-authoring tag syntax + reconcile GHI #270 contradiction by classifying output-form fixture tests as BEHAVIOR proofs because they test CLI render-code behavior, not file content); author docs/governance/req-scope-discipline.md as the canonical doctrine expansion; supersede ADR-pool.obpi-req-taxonomy-scope-fence; close GHI #165 and GHI #531 superseded. (2) Ship the mechanical surface — extend gz-obpi-specify scaffolds to prompt for REQ kind during authoring; ship gz validate --req-kind-discipline that fail-closes brief-time on missing kind tags AND on per-kind proof-citation gaps (BEHAVIOR REQs require tests/** path in Allowed Paths; SUPPORT REQs require both validator-scope and ledger-event citations; STRUCTURAL-FENCE REQs require parent-ADR invariant anchor); author Pydantic ReqKind/ProofChannel/ReqClassification models per .gzkit/rules/models.md (BaseModel + ConfigDict frozen + extra='forbid'). (3) Extend the parity gate — update gz covers OBPI --json output with per-REQ kind, proof_channel, and proof_status fields; update Stage 3 Phase 1b parity gate logic to consume three proof channels (test reachability for BEHAVIOR, ledger query + validator pass for SUPPORT, parent-ADR invariant resolution for STRUCTURAL-FENCE); author grandfathering cache (data/req_kind_grandfathering.json) with one-shot inference for legacy briefs; STRUCTURAL-FENCE REQs report 'grandfathered' (advisory only) at the OBPI layer with binding audit at parent-ADR closeout. (4) Author the re-runnable decommissioning chore — gz chore decommission-tautological-tests scans tests/** via AST for filesystem-shaped operations co-occurring with assertions, reports per-file disposition proposals (convert / replace-with-ledger / fold-to-validator / keep-as-fixture), is operator-paced per file or batch, emits ledger event chore_decommission_processed per processed item, persists state to data/tautological_test_baseline.json and data/tautological_test_waivers.json; companion gz validate --tautological-test-audit drift gate fail-closes on growth above baseline + waivers; first sweep wave processes the top-5 offenders in tests/governance/ (test_audit_check_covers_backfill.py 49 ops, test_promoted_advisory_audits.py 50 ops, test_distribution_audit.py 26 ops, test_token_block_discipline.py 20 ops, test_brief_path_validity.py 23 ops). Sequencing: OBPI-A is the precondition for the others (doctrine ships first); OBPI-B's validator consumes the doctrine; OBPI-C's parity gate consumes OBPI-B's classifier; OBPI-D's chore is operator-paced after A/B/C and continues indefinitely as re-runnable. Emergency-bypass surface (operator-blessed addition): every fail-close gate in this ADR's mechanism ships with a documented dry-run / preview / single-use bypass mechanism per the 2am-operator forcing function; the bypass emits a ledger bypass_used event with mandatory operator-supplied reason for after-the-fact audit. Lane: heavy (new rule + new doctrine doc + new validator scope + new chore + new schema + brief-format change + behavior change at the per-turn parity gate surface every OBPI passes through). Foundation-kind brief-level Gate 5 attestation per ADR-0.0.36 (universal). Closed-set Pydantic StrEnum for ReqKind is a deliberate one-way door (per Reversibility forcing function); adding a fourth kind in the future requires a follow-up foundation ADR amendment.

## Consequences

### Positive

1. The OpenAI/Karpathy harness-engineering 'unit tests are for code behavior' pattern lands as a foundation invariant for gzkit's test-suite shape — parallel to ADR-0.0.54's map-not-encyclopedia pattern for AGENTS.md shape; both target the same root failure class (structural rot under cover of governance ceremony).
2. Brief-authoring distinguishes content from behavior at scaffold time via mandatory REQ kind classification; new briefs authored after ADR-0.0.59 ships cannot reproduce the GHI #531 anti-pattern (the parity gate fails closed on missing kind, not on content REQs lacking @covers test paths).
3. Per-CI cycle test-execution waste reduces as OBPI-D's chore decommissions tautological tests; the active assertion count drops while regression-detection signal rises (a structurally better signal-to-noise ratio for every test invocation).
4. The doctrine contradiction surfaced by GHI #270 (tests.md § 6f vs tool-skill-runbook-alignment.md § Invariant 3) is mechanically reconciled: output-form fixture tests are BEHAVIOR proofs because they exercise CLI render-code behavior; the apparent contradiction dissolves once REQ kind is named.
5. ADR-pool.obpi-req-taxonomy-scope-fence's prior-art analysis (4 mechanization paths) is preserved by inclusion in Alternatives Considered with credit; the pool ADR retires having served its design-conversation purpose rather than sitting unpromoted indefinitely.
6. GHI #165 (audit-check uses @covers as sole proof channel — no support for non-code REQ evidence) is structurally addressed: the ledger-event and parent-ADR-invariant proof channels are exactly the non-code REQ evidence the GHI named missing.
7. Airlineops upstream parity contribution flows naturally per CLAUDE.md Architectural Boundary 5 once the gzkit mechanism is empirically validated by chore progress; this is a 'gzkit innovation adopted by AirlineOps' shape, the right direction for parity work.
8. Move 4 (typed skill contracts) and Move 5 (closeout on hexagonal spine) of the recovery plan inherit the kind taxonomy at design time; their @covers-parity-gate-consuming surfaces ship the right shape from the start rather than perpetuating the categorical error.
9. The re-runnable chore pattern (per operator directive) becomes a reusable infrastructure surface for other governance-rot decommissioning work; future categorical fixes can pattern-match on the same shape.
10. The bypass mechanism (2am-operator addition) gives every fail-close gate an honest emergency exit, preventing the system from becoming hostage to its own gates under time pressure.

### Negative

1. Bulk-sweep work is multi-session operator-paced — the existing ~3,400 filesystem-shaped operations are not all decommissioned by ADR-0.0.59's authoring; OBPI-D ships the chore + first sweep wave (top-5 offenders), and the long-tail remains as historical rot until the operator runs the chore on cadence. The drift gate prevents NEW rot but does not retire existing rot mechanically.
2. Grandfathering heuristic may misclassify legacy REQs (e.g., a REQ that genuinely asserts behavior but uses content-existence vocabulary will be inferred as SUPPORT). Operator amends data/req_kind_grandfathering.json per-REQ when wrong; the cache is a Pydantic model and amendable, but the work surface is real.
3. REQ-kind taxonomy is closed-set (3 kinds, frozen StrEnum) — the Reversibility forcing function confirmed this is a one-way door. Adding a fourth kind in the future requires a follow-up foundation ADR amendment ceremony, NOT in-place schema edit. The 18-month pre-mortem named 'process-evidence as undiscovered fourth kind' as the most plausible failure mode; the discipline is to acknowledge the closed set and accept the amendment cost when a genuine fourth surfaces.
4. OBPI-D's chore adds new persistent state surfaces (data/tautological_test_baseline.json, data/tautological_test_waivers.json, new ledger event type chore_decommission_processed). These join existing waiver-file surfaces (behave_coverage_waivers.json, surface_weight_waivers.json, etc.); the consolidation is a forced follow-up ADR named in the closing forcing function.
5. Brief-authoring scaffolds get more interactive (operator must classify each REQ at scaffold time). For high-velocity brief authoring this is friction; the mitigation is that the scaffold draws sensible defaults from REQ text (heuristic), and the operator confirms rather than blank-prompts.
6. The parity gate extension (OBPI-C) is the load-bearing mechanical surface; bugs in its proof-channel resolution would silently let uncovered REQs pass. Test discipline for OBPI-C must include adversarial coverage (deliberately-malformed proof citations, missing ledger events, etc.) — a meta-test-discipline requirement for the doctrine that's defining test-discipline.
7. Move 6 placement between Move 3 and Move 4 means Move 4 (typed skill contracts) is delayed by ADR-0.0.59's ceremony cycle. This is a recovery-plan calendar cost the operator explicitly absorbed when blessing the exception, but it pushes Move 5 further out — completion of the get-out-of-jail plan within the 14-day window is now reshape-pressured.
8. The grandfathering cache + chore baseline + drift gate trio adds three CI-time validation surfaces; if any single one fails closed, every commit blocks until resolved. Operational risk amplifies until operators internalize the pattern.
9. ADR-pool.obpi-req-taxonomy-scope-fence retiring without its Path A/B/C/D alternatives shipping intact may feel like wasted prior-art. The mitigation (full credit in Alternatives Considered, explicit doctrinal note that the proof-channel-first framing is chosen OVER not INSTEAD OF) makes the supersession honest but does not eliminate the symbolic cost.
10. The 'every REQ has exactly one proof channel' assumption (surfaced by Assumption Surfacing forcing function) means multi-channel REQs (legitimately requiring both ledger evidence AND test evidence) get classified arbitrarily into one channel; the other channel's evidence is invisible to the parity gate. Operators may work around by splitting one REQ into two REQs of different kinds; this is doctrinally clean but adds REQ count.

## Decomposition Scorecard

<!-- Deterministic OBPI sizing: score each dimension 0/1/2. -->
<!-- Cutoffs are notional defaults and should be calibrated over time from project evidence. -->

- Data/State: 2
- Logic/Engine: 2
- Interface: 2
- Observability: 2
- Lineage: 2
- Dimension Total: 10
- Baseline Range: 5+
- Baseline Selected: 5
- Split Single-Narrative: 0
- Split Surface Boundary: 0
- Split State Anchor: 0
- Split Testability Ceiling: 0
- Split Total: 0
- Final Target OBPI Count: 5

## Checklist

<!-- Each item becomes an OBPI (One Brief Per Item). Sequential numbering, no gaps. -->

- [ ] OBPI-0.0.59-01: Author REQ scope discipline doctrine (.gzkit/rules/tests.md § REQ Scope Discipline + docs/governance/req-scope-discipline.md canonical expansion) + reconcile GHI #270 tests.md § 6f vs tool-skill-runbook-alignment.md § Invariant 3 contradiction (output-form fixture tests are BEHAVIOR proofs) + supersede ADR-pool.obpi-req-taxonomy-scope-fence (its Path A/B/C/D rolls into Alternatives Considered with credit) + close GHI #165 and GHI #531 superseded against this ADR + add advisory-rules-audit.md scorecard entry classifying --req-kind-discipline Mechanical (lite lane: doctrine + scorecard only, no code/schema)
- [ ] OBPI-0.0.59-02: Extend gz-obpi-specify scaffold to prompt for REQ kind during brief authoring + ship gz validate --req-kind-discipline brief-time fail-close validator (BEHAVIOR REQs require tests/** in Allowed Paths; SUPPORT REQs require validator-scope + ledger-event citations; STRUCTURAL-FENCE REQs require parent-ADR § Boundary Invariants anchor) + Pydantic ReqKind/ProofChannel/ReqClassification models per .gzkit/rules/models.md + wire validator into gz check default pipeline + brief-format documentation update (heavy lane: new validator scope, schema change, brief-authoring contract change)
- [ ] OBPI-0.0.59-03: Extend gz covers OBPI --json output schema with per-REQ kind/proof_channel/proof_status/per-channel anchor fields (covering_tests for BEHAVIOR, ledger_event_ids for SUPPORT, parent_adr_anchor for STRUCTURAL-FENCE) + update Stage 3 Phase 1b parity gate (src/gzkit/coverage.py or pipeline-runtime equivalent) to consume three proof channels with per-kind resolution logic + author data/req_kind_grandfathering.json + one-shot inference heuristic for legacy briefs (scope-fence pattern → STRUCTURAL_FENCE; content-existence pattern → SUPPORT; default → BEHAVIOR with operator amend) + ReqCoverageRecord/ReqCoverageSummary Pydantic models + grandfathered-status reporting (advisory, never gates) + emergency --bypass-req-kind-discipline-once flag with ledger bypass_used event (per 2am-operator forcing function) (heavy lane: parity-gate behavior change, runtime-contract change)
- [ ] OBPI-0.0.59-04: Author gz chore decommission-tautological-tests re-runnable chore (AST scan for filesystem-shaped operations co-occurring with assertions, per-file disposition proposals — convert/replace-with-ledger/fold-to-validator/keep-as-fixture — operator-paced per file or batch, ledger event chore_decommission_processed per item, persistent baseline at data/tautological_test_baseline.json + waivers at data/tautological_test_waivers.json with rationale-key indirection like behave_coverage_waivers.json pattern, idempotent on clean state) + gz validate --tautological-test-audit drift gate (fail-closed if current > baseline + waivers; waiver file path hardcoded as self-exemption per 2am-operator circular-dependency analysis) + TautologicalTestOperation/Waiver/Baseline/ProposedDisposition Pydantic models + chore-runner integration per gz-chore-runner skill (heavy lane: new chore surface, new validator scope, new state files, new ledger event type) — ships the infrastructure; first sweep wave lands in OBPI-05
- [ ] OBPI-0.0.59-05: First sweep wave — operator-paced acceptance pass over the top-5 offenders in tests/governance/ via gz chore decommission-tautological-tests (test_audit_check_covers_backfill.py 49 ops, test_promoted_advisory_audits.py 50 ops, test_distribution_audit.py 26 ops, test_token_block_discipline.py 20 ops, test_brief_path_validity.py 23 ops); per-file disposition (convert/replace-with-ledger/fold-to-validator/keep-as-fixture) with operator review; emit chore_decommission_processed ledger event per file; snapshot baseline.json after wave completes; OBPI completion attests the wave's coverage of the named 5 files (heavy lane: bulk content-edit on tests/, may require multiple sessions per file given scope)

### OBPI brief authoring posture (operator-blessed 2026-05-25 — partial deferral, bounded)

OBPI-0.0.59-01 is **substantively authored** at ADR scaffolding time per the operator's directive ("Author OBPI-0.0.59-01 fully now, defer 02-05"). It is lite-lane, ships the doctrine surface, and is the precondition for the others per Move 6 sequencing — it has to be authored-ready for Move 6 to kick off cleanly.

OBPI-0.0.59-02 through -05 are **scaffolded with explicit per-OBPI deferral annotations**; each carries the standard checklist-item objective text as its starting Objective and includes a binding annotation stating that full authoring (substantive Objective, Allowed Paths, Denied Paths, REQs with `[kind]` tags per the new taxonomy, Discovery Checklist, Quality Gates, Verification, Acceptance Criteria) happens at the OBPI's own pipeline Stage 1 — when the OBPI is claimed for implementation. The deferral is bounded: each OBPI's own pipeline catches the unindividualized-scaffold-state defect via `gz obpi validate --authored` before Stage 2 may begin.

This middle-path partial deferral departs from the ADR-0.0.54 / GHI #499 full-deferral precedent in the direction the categorical-fix discipline demands: the doctrine OBPI is fully ready up-front, downstream OBPIs author per pipeline-entry rather than per-ADR-scaffolding. The categorical category error (REQ→@covers parity mass-producing tautological tests) is named in fully-authored doctrine; the mechanical-surface OBPIs author with the doctrine in hand. Per Behavior Rule #11 the deferral pattern itself is logged in `.gzkit/insights/agent-insights.jsonl` at OBPI-01 completion time, citing this annotation as the binding contract.

## Q&A Transcript

<!-- Interview transcript preserved for context -->

*Interview conducted: 2026-05-25T05:50:07.477121*

### Q: What is the ADR identifier? (canonical slug-form: ADR-<semver>-<slug>)

**A:** ADR-0.0.59-req-scope-discipline-and-test-shape-doctrine

### Q: What is the title of this ADR?

**A:** REQ Scope Discipline and Test Shape Doctrine

### Q: What is the semantic version?

**A:** 0.0.59

### Q: Which lane? (lite = internal changes, heavy = external contracts)

**A:** heavy

### Q: What is the parent brief ID?

**A:** PRD-GZKIT-1.0.0

### Q: What problem are we solving? What is the specific goal of this ADR?

**A:** gzkit's REQ→@covers parity machinery and Stage 3 Phase 1b enforcement (inherited from airlineops via GHI #113) apply a single mechanical gate — '@covers-decorated test reachable from Allowed Paths' — to every REQ uniformly. The gate was correct for airlineops's REQ profile (predominantly code-behavior REQs against data-warehouse operations; 17% whole-tree filesystem-shaped ratio). It is structurally wrong for gzkit's REQ profile (predominantly governance-content REQs against doctrine artifacts; 42% governance-test ratio of filesystem-shaped ops). The mismatch has produced ~3,404 filesystem-shaped operations across tests/ (32% of the suite) — tests whose only failure mode is a human editing the asserted prose, with zero regression-detection value. Surfaced 2026-05-25 during OBPI-0.0.54-01 (Move 3) when the parity gate fail-closed on a content-only OBPI; the in-flight workaround (authoring a tautological grep test) was itself exemplary of the anti-pattern, prompting operator framing: 'the only REQs worth having are likely the same — the behaviors of the system — docs, data, and structural affordances will need to be handled differently — they SUPPORT behaviors, they are means for behavior, or byproducts… but we are testing CODE behaviors not content/data. Data is only valid in testing when it serves as input or output that validates behavior.' Operator characterization: 'staggering find.' This ADR names the categorical category error and ships the categorical fix: a three-kind REQ taxonomy (BEHAVIOR / SUPPORT / STRUCTURAL-FENCE) keyed to distinct proof channels (@covers test / ledger event + structural validator / parent-ADR integration-state invariant), mechanically enforced at brief-authoring time, at the parity gate, and via a re-runnable decommissioning chore for the existing rot. Foundation tier per the invariance test: without the categorical distinction, gzkit's test suite continues accumulating tautological filesystem-grep tests under cover of REQ-derived testing — the project would still ship but would lose the property that unit tests indicate code behavior correctness, which is what unit tests structurally exist to provide. Supersedes ADR-pool.obpi-req-taxonomy-scope-fence (its Path A/B/C/D analysis rolls into Alternatives Considered). Closes GHI #165 (non-code REQ evidence channels) and GHI #531 (categorical test-shape category error) superseded. Cross-links to GHI #517 (5-alarm structural emergency — this ADR is one of the validation-machine remediations). Authored as Move 6 of the get-out-of-jail recovery plan per the operator-blessed ADR-0.0.59 exception in the plan's anti-temptation table.

### Q: What did we decide? Be specific about the approach, libraries, patterns.

**A:** Canonical statement: every REQ in an OBPI brief's Acceptance Criteria carries exactly one of three kinds — BEHAVIOR, SUPPORT, or STRUCTURAL-FENCE — declared via a bracketed inline tag (REQ-X.Y.Z-NN-NN [kind]: claim text). Each kind has exactly one proof channel: BEHAVIOR is witnessed by a @covers-decorated test in tests/** (existing pattern, unchanged); SUPPORT is witnessed by the conjunction of a ledger artifact_edited (or kin) event citing the asserted artifact path AND a structural validator scope (e.g. gz validate --documents) that admits the artifact's shape; STRUCTURAL-FENCE is witnessed by a parent-ADR § Boundary Invariants entry that audits at the ADR closeout layer (not per-OBPI). Decision items (1:1 with OBPI decomposition): (1) Author the doctrine — update .gzkit/rules/tests.md adding the REQ Scope Discipline subsection (three-kind taxonomy + proof-channel matrix + brief-authoring tag syntax + reconcile GHI #270 contradiction by classifying output-form fixture tests as BEHAVIOR proofs because they test CLI render-code behavior, not file content); author docs/governance/req-scope-discipline.md as the canonical doctrine expansion; supersede ADR-pool.obpi-req-taxonomy-scope-fence; close GHI #165 and GHI #531 superseded. (2) Ship the mechanical surface — extend gz-obpi-specify scaffolds to prompt for REQ kind during authoring; ship gz validate --req-kind-discipline that fail-closes brief-time on missing kind tags AND on per-kind proof-citation gaps (BEHAVIOR REQs require tests/** path in Allowed Paths; SUPPORT REQs require both validator-scope and ledger-event citations; STRUCTURAL-FENCE REQs require parent-ADR invariant anchor); author Pydantic ReqKind/ProofChannel/ReqClassification models per .gzkit/rules/models.md (BaseModel + ConfigDict frozen + extra='forbid'). (3) Extend the parity gate — update gz covers OBPI --json output with per-REQ kind, proof_channel, and proof_status fields; update Stage 3 Phase 1b parity gate logic to consume three proof channels (test reachability for BEHAVIOR, ledger query + validator pass for SUPPORT, parent-ADR invariant resolution for STRUCTURAL-FENCE); author grandfathering cache (data/req_kind_grandfathering.json) with one-shot inference for legacy briefs; STRUCTURAL-FENCE REQs report 'grandfathered' (advisory only) at the OBPI layer with binding audit at parent-ADR closeout. (4) Author the re-runnable decommissioning chore — gz chore decommission-tautological-tests scans tests/** via AST for filesystem-shaped operations co-occurring with assertions, reports per-file disposition proposals (convert / replace-with-ledger / fold-to-validator / keep-as-fixture), is operator-paced per file or batch, emits ledger event chore_decommission_processed per processed item, persists state to data/tautological_test_baseline.json and data/tautological_test_waivers.json; companion gz validate --tautological-test-audit drift gate fail-closes on growth above baseline + waivers; first sweep wave processes the top-5 offenders in tests/governance/ (test_audit_check_covers_backfill.py 49 ops, test_promoted_advisory_audits.py 50 ops, test_distribution_audit.py 26 ops, test_token_block_discipline.py 20 ops, test_brief_path_validity.py 23 ops). Sequencing: OBPI-A is the precondition for the others (doctrine ships first); OBPI-B's validator consumes the doctrine; OBPI-C's parity gate consumes OBPI-B's classifier; OBPI-D's chore is operator-paced after A/B/C and continues indefinitely as re-runnable. Emergency-bypass surface (operator-blessed addition): every fail-close gate in this ADR's mechanism ships with a documented dry-run / preview / single-use bypass mechanism per the 2am-operator forcing function; the bypass emits a ledger bypass_used event with mandatory operator-supplied reason for after-the-fact audit. Lane: heavy (new rule + new doctrine doc + new validator scope + new chore + new schema + brief-format change + behavior change at the per-turn parity gate surface every OBPI passes through). Foundation-kind brief-level Gate 5 attestation per ADR-0.0.36 (universal). Closed-set Pydantic StrEnum for ReqKind is a deliberate one-way door (per Reversibility forcing function); adding a fourth kind in the future requires a follow-up foundation ADR amendment.

### Q: What good things result from this decision? List benefits.

**A:** 1. The OpenAI/Karpathy harness-engineering 'unit tests are for code behavior' pattern lands as a foundation invariant for gzkit's test-suite shape — parallel to ADR-0.0.54's map-not-encyclopedia pattern for AGENTS.md shape; both target the same root failure class (structural rot under cover of governance ceremony).
2. Brief-authoring distinguishes content from behavior at scaffold time via mandatory REQ kind classification; new briefs authored after ADR-0.0.59 ships cannot reproduce the GHI #531 anti-pattern (the parity gate fails closed on missing kind, not on content REQs lacking @covers test paths).
3. Per-CI cycle test-execution waste reduces as OBPI-D's chore decommissions tautological tests; the active assertion count drops while regression-detection signal rises (a structurally better signal-to-noise ratio for every test invocation).
4. The doctrine contradiction surfaced by GHI #270 (tests.md § 6f vs tool-skill-runbook-alignment.md § Invariant 3) is mechanically reconciled: output-form fixture tests are BEHAVIOR proofs because they exercise CLI render-code behavior; the apparent contradiction dissolves once REQ kind is named.
5. ADR-pool.obpi-req-taxonomy-scope-fence's prior-art analysis (4 mechanization paths) is preserved by inclusion in Alternatives Considered with credit; the pool ADR retires having served its design-conversation purpose rather than sitting unpromoted indefinitely.
6. GHI #165 (audit-check uses @covers as sole proof channel — no support for non-code REQ evidence) is structurally addressed: the ledger-event and parent-ADR-invariant proof channels are exactly the non-code REQ evidence the GHI named missing.
7. Airlineops upstream parity contribution flows naturally per CLAUDE.md Architectural Boundary 5 once the gzkit mechanism is empirically validated by chore progress; this is a 'gzkit innovation adopted by AirlineOps' shape, the right direction for parity work.
8. Move 4 (typed skill contracts) and Move 5 (closeout on hexagonal spine) of the recovery plan inherit the kind taxonomy at design time; their @covers-parity-gate-consuming surfaces ship the right shape from the start rather than perpetuating the categorical error.
9. The re-runnable chore pattern (per operator directive) becomes a reusable infrastructure surface for other governance-rot decommissioning work; future categorical fixes can pattern-match on the same shape.
10. The bypass mechanism (2am-operator addition) gives every fail-close gate an honest emergency exit, preventing the system from becoming hostage to its own gates under time pressure.

### Q: What tradeoffs or downsides come with this decision?

**A:** 1. Bulk-sweep work is multi-session operator-paced — the existing ~3,400 filesystem-shaped operations are not all decommissioned by ADR-0.0.59's authoring; OBPI-D ships the chore + first sweep wave (top-5 offenders), and the long-tail remains as historical rot until the operator runs the chore on cadence. The drift gate prevents NEW rot but does not retire existing rot mechanically.
2. Grandfathering heuristic may misclassify legacy REQs (e.g., a REQ that genuinely asserts behavior but uses content-existence vocabulary will be inferred as SUPPORT). Operator amends data/req_kind_grandfathering.json per-REQ when wrong; the cache is a Pydantic model and amendable, but the work surface is real.
3. REQ-kind taxonomy is closed-set (3 kinds, frozen StrEnum) — the Reversibility forcing function confirmed this is a one-way door. Adding a fourth kind in the future requires a follow-up foundation ADR amendment ceremony, NOT in-place schema edit. The 18-month pre-mortem named 'process-evidence as undiscovered fourth kind' as the most plausible failure mode; the discipline is to acknowledge the closed set and accept the amendment cost when a genuine fourth surfaces.
4. OBPI-D's chore adds new persistent state surfaces (data/tautological_test_baseline.json, data/tautological_test_waivers.json, new ledger event type chore_decommission_processed). These join existing waiver-file surfaces (behave_coverage_waivers.json, surface_weight_waivers.json, etc.); the consolidation is a forced follow-up ADR named in the closing forcing function.
5. Brief-authoring scaffolds get more interactive (operator must classify each REQ at scaffold time). For high-velocity brief authoring this is friction; the mitigation is that the scaffold draws sensible defaults from REQ text (heuristic), and the operator confirms rather than blank-prompts.
6. The parity gate extension (OBPI-C) is the load-bearing mechanical surface; bugs in its proof-channel resolution would silently let uncovered REQs pass. Test discipline for OBPI-C must include adversarial coverage (deliberately-malformed proof citations, missing ledger events, etc.) — a meta-test-discipline requirement for the doctrine that's defining test-discipline.
7. Move 6 placement between Move 3 and Move 4 means Move 4 (typed skill contracts) is delayed by ADR-0.0.59's ceremony cycle. This is a recovery-plan calendar cost the operator explicitly absorbed when blessing the exception, but it pushes Move 5 further out — completion of the get-out-of-jail plan within the 14-day window is now reshape-pressured.
8. The grandfathering cache + chore baseline + drift gate trio adds three CI-time validation surfaces; if any single one fails closed, every commit blocks until resolved. Operational risk amplifies until operators internalize the pattern.
9. ADR-pool.obpi-req-taxonomy-scope-fence retiring without its Path A/B/C/D alternatives shipping intact may feel like wasted prior-art. The mitigation (full credit in Alternatives Considered, explicit doctrinal note that the proof-channel-first framing is chosen OVER not INSTEAD OF) makes the supersession honest but does not eliminate the symbolic cost.
10. The 'every REQ has exactly one proof channel' assumption (surfaced by Assumption Surfacing forcing function) means multi-channel REQs (legitimately requiring both ledger evidence AND test evidence) get classified arbitrarily into one channel; the other channel's evidence is invisible to the parity gate. Operators may work around by splitting one REQ into two REQs of different kinds; this is doctrinally clean but adds REQ count.

### Q: What are the implementation checklist items? Each becomes an OBPI.

**A:** 1. OBPI-0.0.59-01: Author REQ scope discipline doctrine (.gzkit/rules/tests.md § REQ Scope Discipline + docs/governance/req-scope-discipline.md canonical expansion) + reconcile GHI #270 tests.md § 6f vs tool-skill-runbook-alignment.md § Invariant 3 contradiction (output-form fixture tests are BEHAVIOR proofs) + supersede ADR-pool.obpi-req-taxonomy-scope-fence (its Path A/B/C/D rolls into Alternatives Considered with credit) + close GHI #165 and GHI #531 superseded against this ADR + add advisory-rules-audit.md scorecard entry classifying --req-kind-discipline Mechanical (lite lane: doctrine + scorecard only, no code/schema)
2. OBPI-0.0.59-02: Extend gz-obpi-specify scaffold to prompt for REQ kind during brief authoring + ship gz validate --req-kind-discipline brief-time fail-close validator (BEHAVIOR REQs require tests/** in Allowed Paths; SUPPORT REQs require validator-scope + ledger-event citations; STRUCTURAL-FENCE REQs require parent-ADR § Boundary Invariants anchor) + Pydantic ReqKind/ProofChannel/ReqClassification models per .gzkit/rules/models.md + wire validator into gz check default pipeline + brief-format documentation update (heavy lane: new validator scope, schema change, brief-authoring contract change)
3. OBPI-0.0.59-03: Extend gz covers OBPI --json output schema with per-REQ kind/proof_channel/proof_status/per-channel anchor fields (covering_tests for BEHAVIOR, ledger_event_ids for SUPPORT, parent_adr_anchor for STRUCTURAL-FENCE) + update Stage 3 Phase 1b parity gate (src/gzkit/coverage.py or pipeline-runtime equivalent) to consume three proof channels with per-kind resolution logic + author data/req_kind_grandfathering.json + one-shot inference heuristic for legacy briefs (scope-fence pattern → STRUCTURAL_FENCE; content-existence pattern → SUPPORT; default → BEHAVIOR with operator amend) + ReqCoverageRecord/ReqCoverageSummary Pydantic models + grandfathered-status reporting (advisory, never gates) + emergency --bypass-req-kind-discipline-once flag with ledger bypass_used event (per 2am-operator forcing function) (heavy lane: parity-gate behavior change, runtime-contract change)
4. OBPI-0.0.59-04: Author gz chore decommission-tautological-tests re-runnable chore (AST scan for filesystem-shaped operations co-occurring with assertions, per-file disposition proposals — convert/replace-with-ledger/fold-to-validator/keep-as-fixture — operator-paced per file or batch, ledger event chore_decommission_processed per item, persistent baseline at data/tautological_test_baseline.json + waivers at data/tautological_test_waivers.json with rationale-key indirection like behave_coverage_waivers.json pattern, idempotent on clean state) + gz validate --tautological-test-audit drift gate (fail-closed if current > baseline + waivers; waiver file path hardcoded as self-exemption per 2am-operator circular-dependency analysis) + TautologicalTestOperation/Waiver/Baseline/ProposedDisposition Pydantic models + first sweep wave processing the top-5 offenders in tests/governance/ (test_audit_check_covers_backfill.py + test_promoted_advisory_audits.py + test_distribution_audit.py + test_token_block_discipline.py + test_brief_path_validity.py) with per-file operator-paced acceptance + chore-runner integration per gz-chore-runner skill (heavy lane: new chore surface, new validator scope, new state files, new ledger event type)

### Q: What alternatives were considered and why were they rejected?

**A:** Path A (from ADR-pool.obpi-req-taxonomy-scope-fence) — Schema-level REQ kind marker (runtime touch): adds per-REQ structured marker in brief frontmatter or inline; gz adr audit-check honors the marker and exempts scope-boundary REQs from coverage reporting entirely. Strengths: mechanical defense against doctrine drift; audit-check signal cleanliness (0 advisory REQs after migration); matches anti-vibing mantra; composable with .gzkit/rules/adr-audit.md exemptions. Weaknesses: schema migration on every existing OBPI brief is substantive ceremony; marker can drift (operators silencing audit-check); runtime cost non-trivial for 5.8% defect rate at observation time. REJECTED standalone in favor of subsuming under the categorical proof-channel framing; the marker IS preserved in this ADR's [kind] tag syntax but lands in a broader taxonomy rather than as a single scope-fence-only marker.

Path B (from pool ADR) — Doctrine-only authoring guidance (rule touch): rule in .gzkit/rules/obpi.md and decomposition-matrix advising scope-fence REQs be phrased as integration-state properties at parent-ADR level. Strengths: smallest possible diff; no schema migration; matches existing doctrine pattern. Weaknesses: no mechanical defense (operators can ignore); existing shipped ADRs continue reporting advisory uncovered REQs forever; relies on doctrine compliance which is the failure mode operative claim 3 ('doctrine drift is invariant drift') names. REJECTED standalone because the 5:1-governance-is-the-product framing requires the mechanism, not just doctrine.

Path C (from pool ADR) — Compose A + B with phased migration: doctrine first (cheap, reversible); mechanization after N ≥ 3 ADRs authored under doctrine without regression. Strengths: sequenced risk; preserves design-pressure-first principle; matches GHI #466 two-component pattern. Weaknesses: two-phase ceremony; if Path A is right answer it's deferred unnecessarily; 'N ≥ 3 without regression' gate is itself judgment surface that can drift; long-tail ambiguity between phases. REJECTED because the categorical fix dissolves the scope-fence-only framing; phasing within the narrower scope is moot once the broader taxonomy ships.

Path D (from pool ADR) — Promote scope-fence REQs to parent-ADR REQs: scope-fence REQs moved from per-OBPI briefs to parent ADR's invariant set; parent ADR carries 'boundary invariants' section audited at parent layer. Strengths: eliminates REQ-kind ambiguity entirely; aligns with 'boundary invariants are ADR-level property'. Weaknesses: requires re-authoring parent ADR invariant section; loses per-OBPI scope-creep defense; new parent-ADR-section surface that itself needs schema rules. ADOPTED as the STRUCTURAL-FENCE proof channel mechanism — STRUCTURAL-FENCE REQs ARE audited at parent-ADR § Boundary Invariants layer, which IS Path D's proposal at a finer-grained scope (one kind among three, not the only kind). Path D's framing is preserved as the proof channel for that one kind.

Approach B from this session's gz-design conversation — Four kinds preserving operator's verbatim framing (BEHAVIOR, CONTENT, DATA, STRUCTURAL): closer to operator naming but CONTENT and DATA share proof channel (ledger + structural validator), so the distinction is editorial not mechanical. REJECTED in favor of three-kind-by-proof-channel because mechanical parsimony (one kind per channel) is the load-bearing organizing principle; editorial preservation of operator wording does not earn its mechanical weight.

Approach C from this session — Five kinds keeping every source distinct (BEHAVIOR + CONTENT + DATA + STRUCTURAL-FENCE + DECISION-CITED): fully preserves the three GHIs' separate framings. REJECTED because multiplication has authoring cost (5 brief-authoring choices vs 3 means more decisions and more validator scope per kind); the additional distinctions can fold into SUPPORT (decision-cited REQs cite ledger ADR_annotated or decision events under the SUPPORT proof channel).

Doctrine-only ADR with mechanism deferred to ADR-0.0.60 (Approach C from gz-design): ships only OBPI-A (doctrine + supersession + GHI closes). Strengths: smallest ADR; honors recovery-plan tripwire most strictly. Weaknesses: doctrine without mechanism = the 'doctrine drift is invariant drift' failure operative claim 3 warns against; operator would need to bless a SECOND foundation-ADR exception; two-cycle landing for one categorical fix. REJECTED because the categorical fix's whole shape is doctrine+mechanism+chore as one cycle; splitting them is exactly the failure mode the fix exists to address.

'Any-anchor-present' single-kind alternative (from Assumption Surfacing forcing function): one kind of REQ (a claim) with one kind of proof (an evidence anchor) — could be test, ledger event, validator pass, parent-ADR invariant, or operator attestation. Parity gate consumes 'any evidence anchor present' uniformly. ACKNOWLEDGED as the supersession path if classification overhead exceeds operator-economy benefit after 18 months of operation (named in closing forcing function as potential future foundation ADR). NOT chosen for ADR-0.0.59 because the three-kind taxonomy provides operator-economy-of-effort (scaffold asks once, validators specialize by kind) that anchor-discipline doesn't; the trade-off favors per-kind specialization for the current scale.


## Evidence

<!-- Links to tests, documentation, and other artifacts that prove completion -->

- [ ] Tests: `tests/`
- [ ] Docs: `docs/`

## Boundary Invariants

These are the structural fences this ADR establishes, audited at ADR closeout
(STRUCTURAL-FENCE proof channel via `resolve_fence_proof`).

1. **The REQ taxonomy is closed-set: exactly three kinds (BEHAVIOR, SUPPORT,
   STRUCTURAL-FENCE).** Adding a fourth kind requires a follow-up foundation ADR
   amendment — the closed-set is a deliberate one-way door (noted in the Reversibility
   forcing function and the Attestation Block).
2. **STRUCTURAL-FENCE REQs are audited at ADR closeout layer, not per-OBPI.**
   The `grandfathered`/advisory path for STRUCTURAL-FENCE REQs was always a
   transitional placeholder (ADR-0.0.59 OBPI-03 shipped it as "grandfathered,
   advisory, never gates"); the load-bearing anchor is this `## Boundary Invariants`
   section, which ADR-0.0.69 OBPI-02 makes the proof arm actually check.
3. **BEHAVIOR REQs are witnessed exclusively through `@covers`-decorated tests.**
   Filesystem-grep tests or content-checking tests do not constitute valid BEHAVIOR
   proofs; such tests belong in the decommissioning chore's scope (OBPI-0.0.59-04/05).

## Alternatives Considered

Path A (from ADR-pool.obpi-req-taxonomy-scope-fence) — Schema-level REQ kind marker (runtime touch): adds per-REQ structured marker in brief frontmatter or inline; gz adr audit-check honors the marker and exempts scope-boundary REQs from coverage reporting entirely. Strengths: mechanical defense against doctrine drift; audit-check signal cleanliness (0 advisory REQs after migration); matches anti-vibing mantra; composable with .gzkit/rules/adr-audit.md exemptions. Weaknesses: schema migration on every existing OBPI brief is substantive ceremony; marker can drift (operators silencing audit-check); runtime cost non-trivial for 5.8% defect rate at observation time. REJECTED standalone in favor of subsuming under the categorical proof-channel framing; the marker IS preserved in this ADR's [kind] tag syntax but lands in a broader taxonomy rather than as a single scope-fence-only marker.

Path B (from pool ADR) — Doctrine-only authoring guidance (rule touch): rule in .gzkit/rules/obpi.md and decomposition-matrix advising scope-fence REQs be phrased as integration-state properties at parent-ADR level. Strengths: smallest possible diff; no schema migration; matches existing doctrine pattern. Weaknesses: no mechanical defense (operators can ignore); existing shipped ADRs continue reporting advisory uncovered REQs forever; relies on doctrine compliance which is the failure mode operative claim 3 ('doctrine drift is invariant drift') names. REJECTED standalone because the 5:1-governance-is-the-product framing requires the mechanism, not just doctrine.

Path C (from pool ADR) — Compose A + B with phased migration: doctrine first (cheap, reversible); mechanization after N ≥ 3 ADRs authored under doctrine without regression. Strengths: sequenced risk; preserves design-pressure-first principle; matches GHI #466 two-component pattern. Weaknesses: two-phase ceremony; if Path A is right answer it's deferred unnecessarily; 'N ≥ 3 without regression' gate is itself judgment surface that can drift; long-tail ambiguity between phases. REJECTED because the categorical fix dissolves the scope-fence-only framing; phasing within the narrower scope is moot once the broader taxonomy ships.

Path D (from pool ADR) — Promote scope-fence REQs to parent-ADR REQs: scope-fence REQs moved from per-OBPI briefs to parent ADR's invariant set; parent ADR carries 'boundary invariants' section audited at parent layer. Strengths: eliminates REQ-kind ambiguity entirely; aligns with 'boundary invariants are ADR-level property'. Weaknesses: requires re-authoring parent ADR invariant section; loses per-OBPI scope-creep defense; new parent-ADR-section surface that itself needs schema rules. ADOPTED as the STRUCTURAL-FENCE proof channel mechanism — STRUCTURAL-FENCE REQs ARE audited at parent-ADR § Boundary Invariants layer, which IS Path D's proposal at a finer-grained scope (one kind among three, not the only kind). Path D's framing is preserved as the proof channel for that one kind.

Approach B from this session's gz-design conversation — Four kinds preserving operator's verbatim framing (BEHAVIOR, CONTENT, DATA, STRUCTURAL): closer to operator naming but CONTENT and DATA share proof channel (ledger + structural validator), so the distinction is editorial not mechanical. REJECTED in favor of three-kind-by-proof-channel because mechanical parsimony (one kind per channel) is the load-bearing organizing principle; editorial preservation of operator wording does not earn its mechanical weight.

Approach C from this session — Five kinds keeping every source distinct (BEHAVIOR + CONTENT + DATA + STRUCTURAL-FENCE + DECISION-CITED): fully preserves the three GHIs' separate framings. REJECTED because multiplication has authoring cost (5 brief-authoring choices vs 3 means more decisions and more validator scope per kind); the additional distinctions can fold into SUPPORT (decision-cited REQs cite ledger ADR_annotated or decision events under the SUPPORT proof channel).

Doctrine-only ADR with mechanism deferred to ADR-0.0.60 (Approach C from gz-design): ships only OBPI-A (doctrine + supersession + GHI closes). Strengths: smallest ADR; honors recovery-plan tripwire most strictly. Weaknesses: doctrine without mechanism = the 'doctrine drift is invariant drift' failure operative claim 3 warns against; operator would need to bless a SECOND foundation-ADR exception; two-cycle landing for one categorical fix. REJECTED because the categorical fix's whole shape is doctrine+mechanism+chore as one cycle; splitting them is exactly the failure mode the fix exists to address.

'Any-anchor-present' single-kind alternative (from Assumption Surfacing forcing function): one kind of REQ (a claim) with one kind of proof (an evidence anchor) — could be test, ledger event, validator pass, parent-ADR invariant, or operator attestation. Parity gate consumes 'any evidence anchor present' uniformly. ACKNOWLEDGED as the supersession path if classification overhead exceeds operator-economy benefit after 18 months of operation (named in closing forcing function as potential future foundation ADR). NOT chosen for ADR-0.0.59 because the three-kind taxonomy provides operator-economy-of-effort (scaffold asks once, validators specialize by kind) that anchor-discipline doesn't; the trade-off favors per-kind specialization for the current scale.

## Attestation Block

| Term | Status | Attested By | Date | Reason |
|------|--------|-------------|------|--------|
| 0.0.59 | Completed | Jeffry | 2026-05-27 | attest completed — ADR-0.0.59 closeout: 5/5 OBPIs attested_completed; 36 REQs (19 @covers + 17 advisory routed SUPPORT/STRUCTURAL-FENCE); ARB receipts arb-ruff-606059e831ba4244b0044cc0340a03f6, arb-step-typecheck-4400bd085e354a0ea12141361ff2d543, arb-step-unittest-48897982a060478fb616c3da639be17e, arb-step-coverage-ce1430c23a6c463e8dbafaed8f4cde50, arb-step-mkdocs-eca4173bdcfc43e5aa945934d3b74ef3; validators --documents/--req-kind-discipline/--tautological-test-audit/adr audit-check all PASS; walkthrough 37 demos (13 real, 24 brief-side extractor noise); spec-reviewer DO_NOT_ATTEST resolved via OBPI-05 REQ-01/04 BEHAVIOR→SUPPORT retag (4 line edits, validators clean post-edit); quality-reviewer COHERENT with 3 minor non-blocking follow-ups; 6 follow-up GHIs to file; 2 course-correction improvement records appended per Behavior Rule 11; Move 6 of get-out-of-jail recovery plan, one of GHI #517's 5-alarm structural-emergency remediations |
| 0.0.59 | Validated | Jeffry Babb | 2026-05-27 | accept audit — ADR-0.0.59 COMPLETED→VALIDATED audit: ledger L2 proof PASS for all 5 OBPIs (attested_completed); spec-reviewer ATTEST_WITH_RESERVATIONS (17 advisory REQs honestly tagged SUPPORT/STRUCTURAL-FENCE with cited alternate proof channels; no uncovered BEHAVIOR REQs); quality-reviewer COHERENT_WITH_RESERVATIONS (three-surface scaffolding present; SUPPORT/STRUCTURAL-FENCE channel depth weaker than doctrine implies); 5 capabilities demonstrated at operator surface (gz covers --json three-channel introspection, gz validate --req-kind-discipline brief-time fail-close, gz validate --tautological-test-audit drift gate against 765-op baseline, gz chores decommission-tautological-tests heavy-lane chore, gz adr audit-check 17 advisories correctly routed); receipts: arb-ruff-606059e831ba4244b0044cc0340a03f6, arb-step-typecheck-4400bd085e354a0ea12141361ff2d543, arb-step-unittest-48897982a060478fb616c3da639be17e, arb-step-coverage-ce1430c23a6c463e8dbafaed8f4cde50, arb-step-mkdocs-eca4173bdcfc43e5aa945934d3b74ef3; 6 non-blocking follow-up GHIs identified (SUPPORT-channel ledger-query depth, STRUCTURAL-FENCE per-REQ anchor resolution, grandfathering Pydantic model, ReqCoverageRecord field population, bypass asymmetry, REQ-05-04 retag doctrine clarification); audit proofs under docs/design/adr/foundation/ADR-0.0.59-req-scope-discipline-and-test-shape-doctrine/audit/proofs/ |
