---
mode: CREATE
adr_id: ADR-0.0.67
branch: main
timestamp: "2026-06-07T22:26:26Z"
agent: claude-code
obpi_id: OBPI-0.0.67-02
session_id:
continues_from: .gzkit/handoffs/20260607T200247Z-adr0067-build.md
---

<!-- Handoff document for ADR-0.0.67 — created by claude-code at 2026-06-07T22:26:26Z -->

## ⚠️ This handoff ADVISES next moves — it is NOT authorization to execute them

**Read this before anything else.** A handoff records a *proposed* plan and its
context. It is **NOT** a clearance to unilaterally execute that plan. On resume —
at **every** freshness level, Fresh included — you MUST:

1. Present the advised next steps and current state to the operator.
2. **Obtain explicit operator authorization before executing any of them** — no
   file mutation, no `gz` ceremony, no migration until the operator says go.
3. Treat the human-as-final-witness doctrine as binding from the first step: you
   advise; the operator rules; you note variance and stop.

Barreling into execution from this document is the exact failure this handoff
exists to prevent. The plan is the destination; operator authorization is the
ignition.

## Current State Summary

**OBPI-0.0.67-02 (wire orphan verbs into skills) is COMPLETE and operator-attested.**
It ran the full Heavy pipeline (lock claim → reconcile → pipeline launch → 6 tasks
started/completed → ARB meta-receipt → obpi receipt → lock release) and carries an
operator Gate-5 attestation (Jeffry Babb, 2026-06-07, type `operator-verbatim-conversational`).
Anchor commit `f7c1b58`. All work is committed and **pushed** — `main` is even with
`origin/main` (0/0), working tree clean, HEAD `46601921`.

ADR-0.0.67 now stands at **1/3 OBPIs**, Lifecycle Pending, Lane HEAVY, Status
IN_PROGRESS, checks `O,T,D,B,H`. OBPI-02 done; **OBPI-01 and OBPI-03 remain.**

What landed in OBPI-02:

- **10 orphan CLI verbs wired into 7 skills** (genuine procedural use, not name-drops):
  gz-obpi-reconcile (`obpi audit`, `obpi emit-receipt`, `obpi withdraw`),
  gz-status (`obpi status`), gz-adr-promote (`adr demote`),
  gz-adr-sync (`adr covers-check`), gz-arb (`arb ty`),
  gz-chore-runner (`chores propose-ghi`), gz-skill-router (`skill list`, `skill new`).
- **gz-obpi-reconcile Phase 1 now invokes `gz obpi audit` / `gz obpi audit --adr`**
  as the deterministic evidence step, replacing ad-hoc agent Read/Grep/Bash.
- **10 multi-word stop-gap waivers removed** from `_NO_SKILL_VERBS`.
- New unit coverage: `tests/commands/test_obpi_audit_cmd.py`,
  `tests/commands/test_obpi_withdraw_cmd.py`, `tests/commands/test_skill_alignment_10verbs.py`.
- Evidence: 5958 unittests pass (receipt `arb-step-unittest-a78ed6bc1d644a109858825b5c0fcfc3`);
  ruff/typecheck/mkdocs clean (`arb-ruff-47525216a6ea46ee9d38852309ffce00`,
  `arb-step-typecheck-ac259f85e30d4064bcfb4319a3010b4b`,
  `arb-step-mkdocs-505449bdf3b244099fc950a4d775b113`).

`uv run gz validate --skill-alignment` is **green** across all scopes.

## Important Context

- **VARIANCE FROM PRIOR HANDOFF — the recursion keystone already landed.** The prior
  handoff (`20260607T200247Z-adr0067-build.md`) planned implementation order
  **02 → 03 → 01**, with the recursion (OBPI-01) landing LAST. That did not happen.
  The recursion machinery — `_known_cli_verb_paths()`, `_verb_path_waived()` (with
  top-level group-key cascade), the rewritten `audit_skill_alignment`, and a NEW
  `_waiver_targets_live_verb()` stale-waiver detector — is **committed and live** in
  `src/gzkit/governance/trust_audits/cli.py` (it was the prior session's uncommitted
  head-start; it got committed in `f7c1b58` during the OBPI-02 build). The enumeration
  regression test landed too (`tests/governance/test_promoted_advisory_audits.py`).
  **Consequence:** OBPI-01 is no longer a from-scratch build — its keystone code and
  test are already in the tree. OBPI-01 is now effectively a *ratify-verify-attest*
  exercise (confirm each OBPI-01 REQ has a covering test, govern it through its
  pipeline, attest). The operator should rule on whether to treat OBPI-01 as
  ratification or to re-scope its brief to match what actually shipped.
- **3 deprecated-lock-alias waivers REMAIN — by design, scoped to OBPI-03.**
  `_NO_SKILL_VERBS` still carries `obpi lock-claim`, `obpi lock-release`,
  `obpi lock-status` (`cli.py:73-85`), each tagged "Alias removal is OBPI-0.0.67-03".
  The aliases themselves still exist in `src/gzkit/cli/parser_artifacts.py`
  (lines 1456, 1476, 1494). These are the ONLY 0.0.67-related waivers left; the other
  24 entries in `_NO_SKILL_VERBS` are pre-existing single-token waivers.
- **COUPLED SURFACE for OBPI-03 (critical):** the new `_waiver_targets_live_verb()`
  detector fails-closed on any waiver pointing at a verb that is no longer registered.
  So the moment OBPI-03 deregisters the 3 hyphen aliases in the parser, the 3 matching
  waivers in `_NO_SKILL_VERBS` become *stale* and `--skill-alignment` flips RED. Alias
  deletion and waiver removal MUST land in the SAME commit — they are one coupled change.
- **Receipt count quirk (cosmetic, trackable, no action):** the OBPI-02 completion
  receipt's `value_narrative` says "6 skills" but its own enumeration and the committed
  diff (`46601921`) show **7** skills modified. The wiring is correct; the prose count
  is off by one. The receipt is an immutable ledger fact — do not edit it; this note
  exists so a resuming agent is not confused by the discrepancy.
- **`gz obpi status --adr` does not exist** — `--adr` is unrecognized on that verb.
  Use `uv run gz adr report` (grep `0.0.67`) or read the ledger for OBPI lifecycle.

## Decisions Made

- **Decision:** Author this session-end handoff capturing OBPI-02 completion rather
  than resuming the build directly. **Rationale:** operator requested a handoff to
  capture recent work; OBPI-02 is a clean attested close, a natural checkpoint.
  **Alternatives rejected:** rolling straight into OBPI-03 (would skip the operator
  authorization gate the prior handoff's banner mandates).
- **Decision (SUPERSEDED, recorded for lineage):** The prior handoff's D4 fixed order
  02 → 03 → 01 with recursion last. **This decision was overtaken by events** — the
  recursion head-start was committed alongside OBPI-02, so recursion is already live and
  green. The "recursion last so the audit stays green during wiring" rationale no longer
  applies; the audit is green *with* recursion active because the 10 verbs are wired and
  the 3 aliases are waived. Remaining order is now **03 → 01-as-ratification**, or
  operator's call.

## Immediate Next Steps

> ADVISORY ONLY — present to the operator and obtain authorization before acting.

1. **Build OBPI-0.0.67-03** (delete the 3 deprecated lock aliases). Read
   `docs/design/adr/foundation/ADR-0.0.67-tool-skill-invariant1-enforcement/obpis/OBPI-0.0.67-03-delete-deprecated-lock-aliases.md`.
   In ONE coupled commit: delete the alias block in `src/gzkit/cli/parser_artifacts.py`
   (lines ~1456/1476/1494) AND remove the 3 matching waivers from `_NO_SKILL_VERBS`
   (`src/gzkit/governance/trust_audits/cli.py:73-85`) — the `_waiver_targets_live_verb`
   detector fails-closed if they drift apart. Doc cascade: the 3 affected manpages,
   `config/doc-coverage.json`, `mkdocs.yml` nav, and the behave scenario in
   `features/obpi_lock.feature` (~line 65). Keep `uv run gz cli audit` and
   `uv run mkdocs build --strict` green. Entry: `uv run gz obpi pipeline OBPI-0.0.67-03`.
2. **Resolve OBPI-0.0.67-01 as ratification** (recursion keystone already committed —
   see Important Context variance). Read
   `docs/design/adr/foundation/ADR-0.0.67-tool-skill-invariant1-enforcement/obpis/OBPI-0.0.67-01-recursive-verb-path-enumeration.md`,
   confirm each REQ has a covering passing test (`test_promoted_advisory_audits.py`
   already carries the enumeration regression), then govern/attest. Surface to the
   operator whether to ratify-in-place or re-scope the brief to match shipped reality.
3. **Close out ADR-0.0.67** via the closeout ceremony (Gate 5 human attestation; create
   `ADR-CLOSEOUT-FORM.md` if absent — `gz plan create` did not scaffold it), then close
   GHI #588. Confirm `uv run gz validate --skill-alignment` green with zero 0.0.67-era
   waivers remaining after OBPI-03.
4. **(Optional, deferred — ADR Q&A Phase 2):** sweep the 24 pre-existing single-token
   `_NO_SKILL_VERBS` waivers. `_waiver_targets_live_verb` already proves they all target
   live verbs (validator green), but some may be substantively stale (e.g. `init` is
   waived though gz-init declares `gz_command: init`). Post-ADR-0.0.67 follow-up, not
   blocking closeout.

## Pending Work / Open Loops

- **OBPI-0.0.67-03 not started** — 3 deprecated aliases + 3 coupled waivers + doc
  cascade still pending (see Next Steps #1).
- **OBPI-0.0.67-01 not governed/attested** — keystone code and regression test are in
  the tree (committed `f7c1b58`) but the OBPI has not been run through its pipeline or
  attested; it stands as un-ratified shipped code (see Important Context variance).
- **Closeout form absent** — `ADR-CLOSEOUT-FORM.md` was not scaffolded; create it at
  closeout.
- **Phase 2 waiver sweep** — 24 pre-existing single-token waivers may include
  substantively-stale entries; deferred, non-blocking (Next Steps #4).
- **Parked pre-existing defect (NOT this ADR):** `gz validate --brief-command-shape`
  flags a compound `&&` command in
  `docs/design/adr/foundation/ADR-0.0.37-constitutional-invariant-composition/obpis/OBPI-0.0.37-27-migration-disposition-doctrine-refresh-orientation-index.md`.
  Candidate one-line direct-fix; carried forward from prior handoff, still open.
- **GHI #588 still open** — the anchoring issue closes at ADR-0.0.67 closeout.

## Verification Checklist

- [ ] Branch matches: `git branch --show-current` returns `main`
- [ ] HEAD is `46601921` or a descendant; tree clean (`git status --short` empty)
- [ ] `main` even with `origin/main`: `git rev-list --left-right --count origin/main...HEAD` -> `0  0`
- [ ] OBPI-02 attested: `grep 'obpi_receipt_emitted' .gzkit/ledger.jsonl | grep '0.0.67-02'` shows `attested_completed` + `human_attestation:true`
- [ ] `uv run gz adr report` row for ADR-0.0.67 shows `Pending HEAVY 1/3 IN_PROGRESS`
- [ ] `uv run gz validate --skill-alignment` is green
- [ ] Recursion is live: `_known_cli_verb_paths` and `_verb_path_waived` present in `src/gzkit/governance/trust_audits/cli.py`
- [ ] 3 deprecated aliases still present (OBPI-03 not yet done): `grep -n 'lock-claim\|lock-release\|lock-status' src/gzkit/cli/parser_artifacts.py`

## Evidence / Artifacts

- `docs/design/adr/foundation/ADR-0.0.67-tool-skill-invariant1-enforcement/ADR-0.0.67-tool-skill-invariant1-enforcement.md` — the foundation ADR
- `docs/design/adr/foundation/ADR-0.0.67-tool-skill-invariant1-enforcement/obpis/OBPI-0.0.67-01-recursive-verb-path-enumeration.md` — keystone brief (code already shipped; resolve as ratification)
- `docs/design/adr/foundation/ADR-0.0.67-tool-skill-invariant1-enforcement/obpis/OBPI-0.0.67-02-wire-orphan-verbs-into-skills.md` — COMPLETE + attested
- `docs/design/adr/foundation/ADR-0.0.67-tool-skill-invariant1-enforcement/obpis/OBPI-0.0.67-03-delete-deprecated-lock-aliases.md` — deletion brief (build next)
- `src/gzkit/governance/trust_audits/cli.py` — recursion live (`_known_cli_verb_paths`, `_verb_path_waived`, `_waiver_targets_live_verb`); `_NO_SKILL_VERBS` carries the 3 OBPI-03-scoped alias waivers (lines 73-85)
- `src/gzkit/cli/parser_artifacts.py` — deprecated hyphen-alias block (lines ~1456/1476/1494) OBPI-03 deletes
- `tests/commands/test_obpi_audit_cmd.py` — OBPI-02 unit coverage for the audit engine
- `tests/commands/test_obpi_withdraw_cmd.py` — OBPI-02 unit coverage for withdraw
- `tests/commands/test_skill_alignment_10verbs.py` — OBPI-02 regression: 10 verbs wielded, zero new waivers
- `tests/governance/test_promoted_advisory_audits.py` — recursion enumeration regression (OBPI-01 keystone test, already committed)
- `.gzkit/skills/gz-obpi-reconcile/SKILL.md` — Phase 1 now wields `gz obpi audit`
- `.gzkit/handoffs/20260607T200247Z-adr0067-build.md` — predecessor handoff (this one continues from it)

## Environment State

- Platform: Windows 11, PowerShell + Bash; Python 3.13 via uv.
- All `gz` invocations use `uv run`; never prefix with `PYTHONUTF8=1`.
- Skill edits: edit `.gzkit/` canonical first, bump `skill-version` + `last_reviewed`, then `uv run gz agent sync control-surfaces` (never hand-edit `.claude/`, `.agents/`, `.github/`, `src/gzkit/skills/` mirrors).
