---
mode: CREATE
adr_id: ADR-0.0.63
branch: main
timestamp: "2026-05-29T11:12:35Z"
agent: claude-code
obpi_id: OBPI-0.0.63-03
session_id: salvation-phase-i-adr-0.0.63
continues_from: 20260529T091542Z-obpi01-done-obpi03-next.md
---

<!-- Token-block register fields (HandoffFrontmatter forbids them as keys; kept in body per
     token-block-discipline § Register-Entry Minimum-Information Rule "in frontmatter or body"):
     last commit SHA at handoff: 6d043dbd ; branch state: main, synced with origin/main, dirty=False ;
     OBPI-0.0.63-03 lock claimed + released this session. -->

## Current State Summary

**OBPI-0.0.63-03 (evidence-summary-and-proof-binding): COMPLETE — attested, synced.** ADR-0.0.63 is now **4/7** (01, 02, 03, 07 `attested_completed`; 04, 05, 06 `pending`/`draft`).

Ran the full `gz-plan-audit` → `gz-obpi-pipeline` ceremony for OBPI-03 (Decision items 4 & 5 of ADR-0.0.63). Shipped the structured proof-binding surface (`ln`/`ReqEvidence`) and the fail-closed `gz validate --closeout-proof-binding` scope.

- **Operator decision (2026-05-29): "schema-first"** — fold the `ln` field-add into OBPI-03 (M2), since OBPI-03 is its first consumer and OBPI-06 consumes it at runtime. No new OBPI-08; checklist stays 7.
- **Schema + model** (`src/gzkit/governance/brief_structure.py`, `src/gzkit/schemas/obpi_brief_structure.json`): `ReqEvidence` Pydantic model (`{req_id, receipt_ids, file_lines}`) + optional `ln: list[ReqEvidence]` on `BriefStructure` (default `[]`, NOT in `required`; legacy-safe). Schema also gained `tasks`/`req_atomic` properties that were missing. **Canonical field key is `ln`** (model `ReqEvidence`) — 03 (validator) and 06 (runtime) read the SAME key.
- **Validator** (`src/gzkit/governance/trust_audits/closeout_proof_binding.py`, mirrors `advisor_proof_binding.py`): `validate_closeout_proof_binding(project_root) -> list[ValidationError]`. In-scope ADRs = those with a persisted `.gzkit/ceremonies/<ADR>.ceremony.json`. For each, every REQ across its OBPI briefs must have an `ln` entry with non-empty `receipt_ids`, each resolving to a real `artifacts/receipts/<id>.json` (**ledger-existence floor, not string-presence**). Type `closeout_proof_binding` → policy-breach exit 3. **Opt-in scope** (not default `gz check`).
- **CLI wiring**: `parser_maintenance.py` (flag + set_defaults) + `validate_cmd.py` **8 sites** — incl. the easy-to-miss `opt_in_scopes` list (line ~1701) and `_POLICY_BREACH_ERROR_TYPES` frozenset. (The 7-site count in the plan missed `opt_in_scopes`; without it the scope didn't isolate and ran all default scopes instead.)
- **Template** (`.gzkit/skills/gz-adr-closeout-ceremony/SKILL.md` 285-339): REQ Bindings column in §3b + new §3c documenting the `ln:` structured surface. skill-version 7.12.0→7.13.0; `last_reviewed` 2026-05-29; synced via `gz agent sync control-surfaces`.
- **Manpage** (`docs/user/manpages/validate.md`): `--closeout-proof-binding` section + scope-table row; `gz cli audit` green 105/105.
- **Tests**: `tests/governance/test_closeout_proof_binding.py` (11 tests, RED→GREEN). Full suite 5748/5748.
- **Reconciliation edits** (1:1-sync): ADR-0.0.63 Checklist #3 + Target Scope #3 expanded to name the `ln` field-add; `ADR-pool.obpi-authoring-mechanical-floor` Decision item 2 marked **relocated to OBPI-03** (resolves the `req_evidence`→`ln` naming drift). Pool ADR Intent/F10 *finding* text left as historical GHI #517 record.
- **Behave waiver** (`data/behave_coverage_waivers.json`): REQ-01..05 deferred to ADR-0.0.63 closeout (sibling OBPI-01/02 pattern). REQ-05 is SUPPORT-kind, accepted uncovered at completion.
- Completed via `gz obpi pipeline --from=ceremony` then `--from=sync --attestor "Jeffry Babb" --evidence-json …` (the runtime is the authentic marker producer per GHI #412 — hand-written markers are rejected for missing the `pipeline_launched`-witnessed nonce). Two git-syncs; tree clean, synced.

Last action succeeded: `gz git-sync --apply` reported `dirty=False`, ahead=0 behind=0.

## Important Context

- **`ln` field is now LIVE in the brief schema.** OBPI-06 (req-evidence-schema-consumption) is **UNBLOCKED** — the schema blocker noted in prior handoffs is resolved. OBPI-06 wires the *runtime engine* (`closeout_ceremony.py`) to consume `ln`; it reads the same `ln` key 03's validator reads. The `ln`→`req_evidence` naming question is settled: **`ln` wins** (committed in ADR-0.0.63 + OBPI-06 + the relocated pool-ADR item 2).
- **Validator scope is closeout-gated AND structured-brief-only — see GHI #566 (CORRECTION).** `gz validate --closeout-proof-binding` only checks ADRs with a persisted ceremony state file, AND only enumerates REQs from `BriefStructure.reqs` (frontmatter), skipping `LegacyBriefShape`. Repo census: **only 1 of 546 briefs is structured** (the OBPI-0.0.37-04 self-test); all 545 others — including every ADR-0.0.63 brief — are legacy-shaped (REQs in the body `## Acceptance Criteria`). So the validator is **dormant against the real corpus**: at ADR-0.0.63 closeout it will NOT require `ln` on the legacy 0.0.63 briefs (they're skipped). The earlier "dogfooding edge — briefs lack `ln`, closeout will fail" framing was WRONG (legacy briefs are skipped, not failed). The genuine finding: the validator enumerates frontmatter `reqs` instead of body Acceptance Criteria REQs (Decision item 5's surface), so it's vacuous until briefs adopt the structured shape. This is dormant-by-adoption (expected for a brand-new optional `ln` field), not a silent-bypass defect — but the body-REQ enumeration + enforcement-posture (fail-closed-and-migrate vs advisory-until-adopted) is a real decision. **Tracked in GHI #566; recommended to fold into OBPI-06** (which already owns runtime `ln` consumption and reads the same `ln` key). `scan_briefs`/`extract_reqs_from_brief` (triangle.py) already extract body REQs (27 across ADR-0.0.63) — that's the faithful surface OBPI-06 should switch to.
- **CLI runtime owns the marker (GHI #412).** Do NOT hand-write `.pipeline-active-*.json`; `--attestor-present` / `gz obpi complete --accept-uncovered` on heavy/foundation requires a marker whose nonce is witnessed by a `pipeline_launched` ledger event. Launch `gz obpi pipeline <OBPI> --from=ceremony`, then complete with `--from=sync --attestor "Jeffry Babb" --evidence-json '<json>'`. The evidence-json must include `attestation_text` (+ `accept_uncovered`/`accept_uncovered_reason` 1:1 lists for SUPPORT/STRUCTURAL-FENCE REQs).
- **8 wiring sites for a new `gz validate` scope**, not 7: signature (`validate`), `_collect_errors` signature, `explicit_scopes` dict, `_explicit_scope_runners` lambda, **`opt_in_scopes` list in `_resolve_scopes`**, `_POLICY_BREACH_ERROR_TYPES` frozenset (for exit 3), pass-through to `_collect_errors`, final checks dict. Missing `opt_in_scopes` is silent — the scope still "runs" but doesn't isolate.
- **All prior-handoff Important Context still applies** (chained predecessor): handoff-system doctrine conflict UNRESOLVED (`ADR-pool.handoff-system-consolidation`); gz-session-handoff programmatic API is vaporware (only `gzkit.handoff_validation.validate_handoff_document` is real); skill-invocation discipline.

## Decisions Made

- **M2 (fold `ln` into OBPI-03) over M1 (new OBPI-08) / M3 (promote whole pool ADR).** Rationale: producer/first-consumer pattern; 03 already multi-surface; no checklist-count amendment. Operator chose "schema-first"; advisor endorsed M2 ~70/30. M3 rejected (drags in unrelated `gz specify` default-flip + `--ground-truth` validator + new event types).
- **Field key `ln`, model `ReqEvidence`, shape `{req_id, receipt_ids, file_lines}`.** Committed ADR-0.0.63 + OBPI-06 say `ln`; the pool ADR's prose `req_evidence` was loose. The get-out-of-jail `{req, file, anchor, assertion}` shape was rejected — it lacks `receipt_ids`, which Decision item 5 (REQ↔receipt-ID) requires.
- **Validator scope = ceremony-state ADRs; ledger-existence floor; opt-in.** Keeps `ln` optional at authoring, required at closeout (matches relocated pool-ADR item 2). Read-only; does NOT touch runtime (OBPI-06's surface). Mirrors `advisor_proof_binding`'s opt-in posture.

## Immediate Next Steps

1. **OBPI-0.0.63-05 (dual-runtime-collapse — BI-2)** is next in the schema-first ordering (05 → 06 → 04). Collapses the OBPI-01 transitional double-emit: `gz closeout --ceremony --attest` and the Step-7 pipeline must emit byte-identical ledger surfaces; the runtime engine is the single source and `--attest` is an orchestration shortcut, never a parallel emitter. Allowed paths include `closeout_ceremony.py` + `closeout.py` (the dual emitters). Run `/gz-plan-audit OBPI-0.0.63-05` then `gz-obpi-pipeline`. The brief is still a Draft scaffold — author it for real first (REQs with `[kind]` tags, real Allowed Paths/Demo/Verification), same as 01/03.
2. **Then OBPI-06 (req-evidence-schema-consumption)** — NOW UNBLOCKED (`ln` schema exists). Wire `closeout_ceremony.py` runtime to consume `ln` (mechanical proof-binding replaces prose). Brief still scaffold; author for real.
3. **Then OBPI-04 (closeout-skill-reverify-wording-fix)** — pure wording fix in `gz-adr-closeout-ceremony/SKILL.md:60-65` ("Does NOT re-verify" vs spec-reviewer "Independent re-verification"). Lite-ish; no schema dep.
4. **Then `gz-adr-closeout-ceremony` for ADR-0.0.63.** NOTE (corrected): `--closeout-proof-binding` is dormant against ADR-0.0.63's legacy briefs (skipped — see GHI #566), so closeout will NOT be blocked by missing `ln`. No pre-closeout `ln`-authoring is required for the ceremony to pass. The body-REQ enumeration fidelity fix is OBPI-06 / GHI #566 work, not a closeout precondition.
5. **Before each Stage 5:** mint TASKs (`gz task start --req <REQ> --seq 1`); the runtime pipeline owns the commit (subject-suffix `(gz git-sync)` exemption); for heavy/foundation `--accept-uncovered`, launch via `gz obpi pipeline --from=ceremony` then `--from=sync`.

## Pending Work / Open Loops

- **3 OBPIs remain in ADR-0.0.63:** 04, 05, 06.
- **GHI #566 — validator fidelity FIXED in commit `fa15f046` (direct fix this session):** `gz validate --closeout-proof-binding` now enumerates body `## Acceptance Criteria` REQs (via `extract_reqs_from_brief`), reads `ln` from raw frontmatter (covers legacy briefs), and scopes to ADRs with an in-progress closeout ceremony (`completed_at` unset) — not any-ceremony-ever (29 historical ceremony files would otherwise have fired). The earlier "dogfooding edge / closeout will fail for missing `ln`" framing was a false premise (the prior impl skipped legacy briefs); now the validator is correct. **Residual → OBPI-0.0.63-06:** wire the validator into the `gz closeout --ceremony` runtime; author `ln` bindings on ADR-0.0.63's briefs before its closeout (every in-closeout body REQ needs an `ln` entry once OBPI-06 wires the gate); decide kind-aware exemption for SUPPORT/STRUCTURAL-FENCE REQs.
- **Pre-existing repo-wide `gz check` failure (NOT this ADR):** GHI #561 — `ADR-0.0.64` `REQ-0.0.64-05-06` lacks a `gz validate --<scope>` citation → `--req-kind-discipline` fails. Will block ADR-0.0.63 closeout's quality pipeline; needs the 0.0.64 owner. Do NOT blind-fix.
- **GHI #565** — 40 pre-existing brief `## Verification` compound-command violations (OBPI-07 gate surface); precondition for promoting `--brief-command-shape` to default `gz check`.
- **`ADR-pool.obpi-authoring-mechanical-floor`** now has only items 1, 3, 4 active (item 2 relocated). Still pool/unpromoted.
- **GHIs to close at ADR-0.0.63 closeout:** #539, #540 (OBPI-02), #550 (OBPI-07), #516 (per OBPI-01/03), #517 (parent diagnosis).

## Verification Checklist

- [ ] `git branch --show-current` returns `main`; tree clean, synced with origin
- [ ] `uv run gz adr status ADR-0.0.63` shows 01, 02, 03, 07 `attested_completed`; 04, 05, 06 `pending`/`draft` (4/7)
- [ ] `uv run -m unittest tests.governance.test_closeout_proof_binding` → 11 pass
- [ ] `uv run gz validate --closeout-proof-binding` → exit 0, isolates to 1 scope (`closeout_proof_binding`)
- [ ] `uv run gz cli audit` → 105/105 covered (`--closeout-proof-binding` documented)
- [ ] `uv run gz obpi reconcile OBPI-0.0.63-03-evidence-summary-and-proof-binding` → PASS (ATTESTED COMPLETED)
- [ ] `python -c "from gzkit.governance.brief_structure import ReqEvidence"` imports cleanly

## Evidence / Artifacts

- `src/gzkit/governance/brief_structure.py` — `ReqEvidence` model + `BriefStructure` `ln` field
- `src/gzkit/governance/trust_audits/closeout_proof_binding.py` — validator (mirrors `src/gzkit/governance/trust_audits/advisor_proof_binding.py`)
- `src/gzkit/schemas/obpi_brief_structure.json` — `ln` (+ `tasks`/`req_atomic`) properties
- `src/gzkit/cli/parser_maintenance.py`, `src/gzkit/commands/validate_cmd.py` — CLI wiring (8 sites)
- `.gzkit/skills/gz-adr-closeout-ceremony/SKILL.md` — REQ column §3b + §3c (v7.13.0)
- `docs/user/manpages/validate.md` — `--closeout-proof-binding` doc
- `tests/governance/test_closeout_proof_binding.py` — 11 REQ-derived tests
- `data/behave_coverage_waivers.json` — OBPI-0.0.63-03 waiver (REQ-01..05 → ADR closeout)
- `docs/design/adr/pool/ADR-pool.obpi-authoring-mechanical-floor.md` + ADR-0.0.63 — reconciliation edits
- ARB receipts: `arb-step-unittest-7f034b61890243d6841d197e1b990bfa`, `arb-ruff-eaee17ca991a498f96e66c9ecb4cf7b9`, `arb-step-typecheck-bc70e3c50e1747d3bcea15a192751762`, `arb-step-mkdocs-773788e3b0aa45449c285074c9f4d978`
- Commits: `f2787707` (sync #1 — implementation), `6d043dbd` (sync #2 — reconcile + lock release)
- Predecessor: `docs/design/adr/foundation/ADR-0.0.63-closeout-ceremony-runtime-engine-parity/handoffs/20260529T091542Z-obpi01-done-obpi03-next.md`

## Environment State

Python 3.13 / uv. Model: Opus 4.8. No feature branch — work lands on `main` via `gz git-sync`.
