---
mode: CREATE
adr_id: ADR-0.0.68
branch: main
timestamp: "2026-06-09T23:25:27Z"
agent: claude-code
obpi_id:
session_id:
continues_from: .gzkit/handoffs/20260609T081650Z-0.0.67-validated-convergence-map.md
---

<!-- Handoff document for ADR-0.0.68 — created by claude-code at 2026-06-09T23:25:27Z -->

## ⚠️ This handoff ADVISES next moves — it is NOT authorization to execute them

**Read this before anything else.** A handoff records a *proposed* plan and its
context. It is **NOT** a clearance to unilaterally execute that plan. On resume —
at **every** freshness level, Fresh included — you MUST:

1. Present the advised next steps and current state to the operator.
2. **Obtain explicit operator authorization before executing any of them** — no
   file mutation, no `gz` ceremony, no migration until the operator says go.
3. Treat the human-as-final-witness doctrine as binding from the first step: you
   advise; the operator rules; you note variance and stop.

Barreling into execution from this document is the exact failure this handoff
exists to prevent. The plan is the destination; operator authorization is the
ignition.

## Current State Summary

This session executed `ultraplan-brief.md` (the restore-health convergence
planning brief). Two operator rulings were obtained up front, then P2 was driven
to completion:

- **ADR-0.0.68 (green-between-sessions-gate) is VALIDATED** — full
  `gz-adr-audit` ceremony: ledger proof PASS, live value demonstration,
  independent spec-reviewer (PASS 6/6 REQs) and quality-reviewer (COHERENT)
  dispatches, operator "accept audit" relayed verbatim into the `validated`
  ledger receipt (attestor Jeffry Babb), `audit-begin`/`audit-end` marker
  hygiene observed, lifecycle confirmed via `uv run gz adr report ADR-0.0.68`.
  Audit package: `docs/design/adr/foundation/ADR-0.0.68-green-between-sessions-gate/audit/`
  (AUDIT_PLAN.md, AUDIT.md, 7 proof files).
- The ceremony opened RED: `gz adr audit-check ADR-0.0.68` exit 3 on a blocking
  covers-backfill finding — diagnosed as a **validator false positive** (`git
  log -L` vs `git blame` cross-attribute content-identical `@covers` lines after
  the GHI #600 fix inserted a twin decorator block). Direct-fixed (RED→GREEN, 4
  new tests) in `5b2a71ed`; re-run PASS exit 0.
- Three direct fixes landed total: `5b2a71ed` (blame re-anchor in
  `src/gzkit/commands/adr_audit_covers_backfill.py`), `7c1bc791` (genuine ty
  `invalid-return-type` error in `tests/content/test_round_trip_agent_contract.py`,
  invisible to the src-only typecheck gate), `423701ea` (local `covers` shadow in
  `tests/test_session_green_gate_validator.py` replaced with canonical
  `gzkit.traceability.covers` — restores import-time REQ-existence guard;
  surfaced by quality-reviewer).
- All synced: `main` clean, 0/0 to `origin/main`. The new pre-push `gz check`
  floor ran and Passed on its own validation push. Last action (plan-progress
  marks in `ultraplan-brief.md` + this handoff) succeeded.
- Quality evidence: full suite **5997 tests OK**
  (`arb-step-unittest-8e08a061a1bb4206958a3d1d7368a820`), ruff
  (`arb-ruff-daa9023bf8594199a9b5243d4abe12db`), typecheck
  (`arb-step-typecheck-3907ff1d59c844f79562bd181ae59b52`), mkdocs --strict
  (`arb-step-mkdocs-fea7e27ecb134429ae79b25c547300f1`), live `gz check` 27/27.

## Important Context

- **`ultraplan-brief.md` at repo root is the live convergence plan.** §3 carries
  the resolved `ln` ruling; §4 P2 is marked DONE; §2/§6 status anchors updated to
  HEAD at session end. Read it before sequencing anything.
- **The covers-backfill heuristic now has a blame re-anchor clause**
  (`compute_backfill_findings` in `src/gzkit/commands/adr_audit_covers_backfill.py`):
  when a finding is about to flag and `git blame` disagrees with the `git log -L`
  intro SHA, the legitimacy ladder re-runs against blame's SHA. The GHI #309
  receipt-coupling triple and GHI #272 cosmetic-backfill detection are preserved
  (pinned by `TestAmbiguousAttributionBlameReanchor`, 4 tests). Audit-check
  failures on other ADRs may now resolve differently than older handoffs assume.
- **The typecheck gate is blind to `tests/`**: `run_typecheck`
  (`src/gzkit/quality.py:338`) runs `uv run ty check src` only. The 4 ty
  warnings in `src/gzkit/complexity/advisor/timeout.py` are *intentional*
  cross-platform suppressions (POSIX-only attrs, documented in-file) — do NOT
  "clean them up".
- ADR-0.0.41 remains **Pending / pre_closeout / BLOCKED at 2/5** — OBPIs 03–05
  are pending drafts with no ledger proof; its closeout is downstream of the
  ln-sunset direction now ratified.
- A concurrent session was active during sync (it appended an insights record
  mid-ceremony, swept in `31b9da92`, and authored
  `docs/drafts/reinstated-not-retired.md`, deliberately left untracked — not
  this session's work; do not commit or delete it without the operator).

## Decisions Made

- **Decision:** `ln` (closeout-proof-binding) surface strategy — **Option A:
  SUNSET** (operator ruling, this session).
  **Rationale:** `gz validate --req-kind-discipline` is the real proof channel;
  `ln` masks the deferred SUPPORT/FENCE req-kind gap (#543) rather than closing
  it; sunset is subtraction of the red-generator and structurally closes #543.
  **Alternatives rejected:** Option B (keep + auto-populate per #599's
  direction) — retains a redundant drift surface and leaves #543 masked. The
  ratification is recorded in `ultraplan-brief.md` §3.
- **Decision:** Session scope = **P2 only** (ADR-0.0.68 → Validated); P0/P1/P4
  deferred (operator selection).
  **Rationale:** low-energy, independent, high-symbolic-value treadmill exit.
  **Alternatives rejected:** advancing P0 #519 or scoping the ln-sunset ADR this
  session.
- **Decision:** Route the audit-check blocking finding as a **direct fix to the
  validator** (blame re-anchor), not a waiver or `# audit-exempt` marker.
  **Rationale:** ground truth showed legitimate authoring on both commits; the
  inline overlay marker's semantics (new REQ claimed on pre-existing test) did
  not match — using it would have been mis-matched silencing; the heuristic's
  attribution was the defect class.
  **Alternatives rejected:** inline `audit-exempt` marker; filing a GHI and
  blocking the ceremony (DIRECT-FIX MORATORIUM applies).
- **Decision:** Track (not fix) the typecheck-gate scope blindness and the
  `gz-foundation-triage/scripts/triage.py` ty errors via
  `.gzkit/insights/agent-insights.jsonl` (2026-06-09T22:55 discovery record).
  **Rationale:** gate-scope expansion is a runtime-contract change (Heavy);
  triage.py is a separate canonical surface needing its own pass + agent-sync.
  **Alternatives rejected:** bundling them into the audit ceremony's commits.

## Immediate Next Steps

1. **P1 — author the ln-sunset foundation ADR** via `/gz-design` or `gz-adr-create`:
   retire the `ln:` surface → derived view over (req-kind channels + ledger);
   complete the deferred SUPPORT/FENCE req-kind channels (closes GHI #543); fold
   the fail-open seam fix at `src/gzkit/governance/trust_audits/cli.py:222-225`
   (surface a `ValidationError` instead of `return []`, plus covering test).
   Contract-bearing → OBPI pipeline route.
2. **P1 — then drive ADR-0.0.41 closeout**: decide whether OBPIs 03–05 (pending
   drafts, no ledger proof) are implemented under the sunset direction, descoped,
   or re-cut — `uv run gz adr report ADR-0.0.41` is the entry point.
3. **P0 — advance #519** (sole emergency): the <15k registry-projected surface
   (GHI #533) + ADR-0.0.37 build-out; requires operator Gate 5 at the end.
4. **Route the two tracked defects** from the 2026-06-09T22:55 insights record:
   (a) decide whether `gz typecheck` should scope `src tests` (Heavy contract
   change); (b) fix `.gzkit/skills/gz-foundation-triage/scripts/triage.py`
   typing then `uv run gz agent sync control-surfaces`.
5. **P4 — run `/ghi-triage`** over the ~38 open GHIs for a rank-ordered pull
   list (steady-state cadence).

## Pending Work / Open Loops

- GHI #599 remains open — its auto-populate direction now **loses** to the
  ratified sunset; close or re-purpose it when the ln-sunset ADR is authored.
- GHI #543 (SUPPORT/FENCE req-kind channels) — structurally closed by the
  ln-sunset ADR when it lands; until then still open.
- ADR-0.0.41: 3 of 5 OBPIs are pending drafts; closeout BLOCKED.
- #519 emergency untouched this session (operator-gated).
- Foundation backlog (~19 Draft + ~8 Proposed) — felt-need-paced, not blocking;
  do NOT restart the retired OBPI-17 density-classification route.
- The orphan OBPI warnings from `gz register-adrs` (OBPI-0.51.0-0x) predate this
  session — untriaged.

## Verification Checklist

- [ ] `git branch --show-current` → `main`; `git status -sb` → clean, 0/0
      (one untracked `docs/drafts/reinstated-not-retired.md` from the concurrent
      session is expected)
- [ ] `uv run gz adr report ADR-0.0.68` → Lifecycle **Validated**, 2/2 OBPIs
- [ ] `uv run gz adr audit-check ADR-0.0.68` → PASS, exit 0 (3 advisory
      support/fence REQs without @covers is correct per ADR-0.0.59)
- [ ] `uv run gz validate --session-green-gate` → exit 0
- [ ] `uv run -m unittest tests.governance.test_audit_check_covers_backfill -q`
      → 62 tests OK
- [ ] `uv run gz adr report ADR-0.0.41` → Pending, pre_closeout, BLOCKED, 2/5
- [ ] `gh issue list --state open --label emergency` → only #519

## Evidence / Artifacts

- `ultraplan-brief.md` — convergence plan: §3 ln-ruling RESOLVED (Option A), §4 P2 marked DONE, anchors updated
- `docs/design/adr/foundation/ADR-0.0.68-green-between-sessions-gate/audit/AUDIT.md` — audit annotation: feature demonstration, execution log, evidence index, remediation record
- `docs/design/adr/foundation/ADR-0.0.68-green-between-sessions-gate/audit/AUDIT_PLAN.md` — planned checks and risk focus
- `docs/design/adr/foundation/ADR-0.0.68-green-between-sessions-gate/audit/proofs/audit-check.txt` — ledger proof PASS exit 0
- `docs/design/adr/foundation/ADR-0.0.68-green-between-sessions-gate/audit/proofs/red-path-library.txt` — 4/4 red paths fail-closed + green fixture
- `docs/design/adr/foundation/ADR-0.0.68-green-between-sessions-gate/audit/proofs/gz-check.txt` — live 27-step `gz check` exit 0
- `docs/design/adr/foundation/ADR-0.0.68-green-between-sessions-gate/audit/proofs/persona-dispatch-verdicts.md` — spec-reviewer PASS + quality-reviewer COHERENT, remediation notes
- `src/gzkit/commands/adr_audit_covers_backfill.py` — blame re-anchor fix (`5b2a71ed`)
- `tests/governance/test_audit_check_covers_backfill.py` — `TestAmbiguousAttributionBlameReanchor` (4 tests)
- `tests/content/test_round_trip_agent_contract.py` — isinstance narrowing fix (`7c1bc791`)
- `tests/test_session_green_gate_validator.py` — canonical covers import (`423701ea`)
- `.gzkit/insights/agent-insights.jsonl` — 2026-06-09T22:55 discovery record (typecheck gate blindness + triage.py ty errors)

## Environment State

Python 3.13 via uv; macOS (darwin 25.5.0). `pre-commit` pre-push hook installed
and verified live (the `gz check (pre-push gate)` hook reported Passed on this
session's pushes). No database state. ARB receipts under `artifacts/receipts/`.
