---
mode: CREATE
adr_id: ADR-0.0.67
branch: main
timestamp: "2026-06-09T07:30:12Z"
agent: claude-code
obpi_id:
session_id:
continues_from: .gzkit/handoffs/20260609T022038Z-593-fixed-track2-a1-landed.md
---

<!-- Handoff document for ADR-0.0.67 — created by claude-code at 2026-06-09T07:30:12Z -->

## ⚠️ This handoff ADVISES next moves — it is NOT authorization to execute them

**Read this before anything else.** A handoff records a *proposed* plan and its
context. It is **NOT** a clearance to unilaterally execute that plan. On resume —
at **every** freshness level, Fresh included — you MUST:

1. Present the advised next steps and current state to the operator.
2. **Obtain explicit operator authorization before executing any of them** — no
   file mutation, no `gz` ceremony, no migration until the operator says go.
3. Treat the human-as-final-witness doctrine as binding from the first step: you
   advise; the operator rules; you note variance and stop.

Barreling into execution from this document is the exact failure this handoff
exists to prevent. The plan is the destination; operator authorization is the
ignition.

## Current State Summary

**ADR-0.0.67 is CLOSED OUT — Completed, human-attested (Jeffry), synced.** HEAD
`52d92cef` on `main`, in sync with `origin/main` (0/0). `gz adr status ADR-0.0.67`
reports Lifecycle Completed, Closeout Phase attested, QC READY. GHI #588 (the
defect this ADR fixed — top-level-only skill-alignment missing 32 multi-word verb
orphans) is CLOSED.

The closeout ceremony was driven through the CLI state machine from its parked
Step 6 (ATTESTATION). It was NOT a rubber-stamp: it surfaced **three hidden
regressions that had left the test suite silently red since last session**, all
fixed in-flight as direct-fixes before attestation could complete:

1. **Gate 2 red** — `.gzkit/insights/agent-insights.jsonl:176` carried
   `type: "finding"`, not in the `InsightRecord` enum
   `{defect, defect-resolution, improvement, discovery}`; `test_insights_shape_ghi_358`
   failed. Fixed: `finding` -> `discovery` (commit `18b34aa8`).
2. **Gate 4 red x2** — `features/chores_distribution.feature` and
   `features/init.feature` still asserted the `skill-manifest-sync` chore that
   last session's A1 cut (`1cf860f3`) DELETED — a Rule 1a coupled-surface miss in
   that cut. Repointed both to the surviving `pool-triage` chore (commit `8c4a9bc0`).
3. **Coupled docs** — three manpages (`obpi-lock-claim/release/list.md`) carried
   `## Deprecated` sections steering toward the hyphen forms 0.0.67 itself deleted.
   Removed (commit `d08c576f`).

Five commits landed and pushed: `18b34aa8` (insights), `d08c576f` (docs),
`8c4a9bc0` (bdd), `52d92cef` (closeout sync — attestation receipt, ADR->Completed,
regenerated ADR index (92 ADRs), ceremony state, closeout form, seam insights
record). Final gates all green: ruff / typecheck / unittest (5977, 0 fail) /
mkdocs --strict / behave; `gz cli audit` 104/104.

## Important Context

- **The `ln` (closeout-proof-binding) surface is slated for SUNSET (operator
  decision this session).** Background: `aec872f4` reverted 0.0.67's `ln:` bindings
  because they pointed at ephemeral/gitignored/prunable receipt FILES (the GHI #593
  substrate defect). This session's #593 fix (`d13ad5ba`) re-rooted resolution at
  the LEDGER, so those same ARB receipt-IDs now resolve durably via each OBPI's
  `resolved_receipt_ids` — proven: all 4 of OBPI-01's IDs are in the 850-entry
  ledger-resolved set. So re-binding was *available and clean*, but the operator
  chose to WITHER the surface, not feed it. Rationale: `gz validate --req-kind-discipline`
  (green) is the real proof channel and SUBSUMES `ln` for BEHAVIOR REQs (fail-closed
  `@covers` + ADR-0.0.25 passing-test gate + ledger completion receipt). For
  SUPPORT/FENCE REQs req-kind currently treats proof as advisory/grandfathered (a
  real gap) — but `ln` binds those to irrelevant whole-suite ARB receipts, which
  MASKS the gap rather than closing it. The honest closure is to COMPLETE the
  SUPPORT/FENCE channels, not retain `ln`.
- **`ln` is opt-in and not in the default `gz check` gate**, but the closeout
  CEREMONY fail-closes on it at the EXECUTE->ATTESTATION edge (`_gate_proof_binding`,
  `closeout_ceremony.py:264`). 0.0.67 attested legitimately because the ceremony was
  parked one step PAST that edge (reached ATTESTATION before the bindings were
  reverted); from ATTESTATION the gate is a no-op, so `--attest` then advance to
  CLOSEOUT succeeds. This "parked past a now-blocking gate" condition was surfaced
  to the operator and accepted, not hidden.
- **Fail-open seam (`src/gzkit/governance/trust_audits/cli.py:222-225`):**
  `audit_skill_alignment` wraps `_known_cli_verb_paths()` in
  a bare `try/except Exception` that returns `[]` — if enumeration ever raised, the
  Invariant-1 audit would pass silently (the exact graceful-degradation
  anti-pattern 0.0.67 exists to kill, inside its own enforcer). Provenance is
  INHERITED, not 0.0.67's: commit `f7c1b58e` (GHI #588) only swapped the inner
  call inside the pre-existing swallow (the `try`/`except` are context lines in
  that diff). Untested; runtime risk low. Operator decision: FOLD the fail-closed
  fix into the `ln`-sunset ADR scope. Recorded durably in
  `.gzkit/insights/agent-insights.jsonl` (the last record, a `defect`).
- **Replacement chore choice:** `pool-triage` was used to replace `skill-manifest-sync`
  in the two BDD features because it is a stable core chore present in both the
  package (`src/gzkit/chores/pool-triage`) and the registry. If a future
  subtraction pass cuts `pool-triage`, those two scenarios must be repointed again
  (coupled-surface duty).
- **Pattern worth carrying:** last session's A1 chore cut had coupled-surface
  misses (BDD assertions on a deleted chore) AND left a malformed insights record.
  Any future chore subtraction must sweep `features/**`, `.gzkit/chores/registry.json`,
  the `src/gzkit/chores/` package copy, AND any test asserting the chore's presence,
  in the same commit.

## Decisions Made

- **Decision:** Attest ADR-0.0.67 `Completed` as-is, leaving the `ln` validator red.
  **Rationale:** `ln` is opt-in/non-blocking; `req-kind-discipline` (the real proof)
  is green; feeding `ln` would re-attach BEHAVIOR REQs to generic QA-pass receipts
  ("status, not evidence"). **Alternatives rejected:** re-bind to the now-ledger-
  resolvable ARB IDs (proven clean post-#593, but feeds a surface being sunset).
- **Decision:** Sunset the `ln`/closeout-proof-binding surface via a separate
  FOUNDATION ADR (not a direct-fix, not bundled into this closeout).
  **Rationale:** removing it touches a CLI validator scope (`--closeout-proof-binding`),
  a schema field (`ln:` in `obpi_brief_structure.json`), a fail-closed ceremony gate
  (`_gate_proof_binding`), tests, the closeout skill, and 17 briefs — contract-bearing
  and multi-surface. **Alternatives rejected:** direct-fix delete (too broad);
  leave indefinitely (keeps a redundant drift surface + the #593 shape).
- **Decision:** Fold the inherited fail-open seam fix into the `ln`-sunset ADR.
  **Rationale:** that ADR already touches this exact enforcement neighborhood; the
  fix is small (surface a `ValidationError` instead of `return []`, + a covering
  test). **Alternatives rejected:** standalone GHI; accept-as-noted.
- **Decision:** Fix the three suite regressions in-flight as direct-fixes (not GHIs).
  **Rationale:** each was a blocking, single-surface, unambiguous defect under the
  DIRECT-FIX MORATORIUM; TDD RED was already demonstrated by the failing gate.
- **Decision:** Close GHI #588 against the 0.0.67 closeout; leave #592/#591/#589 open.
  **Rationale:** only #588 is resolved by this ADR; #592 was already fixed by
  `814099fe` (separate thread, just unclosed).

## Immediate Next Steps

<!-- ADVISORY ONLY — present and await operator authorization before acting. -->

1. **Open the `ln`-sunset foundation ADR via `gz-design`.** Scope carries TWO items:
   (a) retire the `ln`/closeout-proof-binding surface — replace its legitimate
   "green-at-closeout" purpose with a DERIVED VIEW over (req-kind channels + ledger),
   and COMPLETE the deferred SUPPORT/FENCE `req-kind-discipline` channels rather than
   mask them; (b) fold the fail-open seam fix (`cli.py:222-225` -> surfaced
   `ValidationError` + test). Note this ADR also UNBLOCKS ADR-0.0.41.
2. **ADR-0.0.41 closeout.** It is parked at closeout Step 6, red on `ln` (60 errors).
   Once the sunset lands — or decide it attests as-is exactly like 0.0.67 did (its 4
   cited receipts DO resolve via the ledger) — drive its closeout ceremony.
3. **Direct-fix candidates (independent backlog):** #591 (`gz obpi audit` whole-`src`
   coverage denominator), #589 (gz-obpi-pipeline Stage 3 tail-pipe exit-code masking).
   Also CLOSE #592 (already fixed by `814099fe`, just unclosed).
4. **Track-2 pause-and-measure (the original pre-closeout lean).** Still open: measure
   whether last session's A1 cuts lifted the felt weight before any further subtraction
   or considering reading B. The next cut should be felt-need-driven, not momentum-driven.

## Pending Work / Open Loops

- **`ln`-sunset foundation ADR** — not yet created; carries the two scope items above.
- **ADR-0.0.41** — parked closeout Step 6, red on `ln`; coupled to the sunset decision.
- **GHI #594** (open, blocker) — ARB archive/purge lifecycle; tied to the
  11-unbound-historical-receipts discovery now recorded at
  `.gzkit/insights/agent-insights.jsonl:176` (valid `discovery`, routed to the
  `evidence-integrity-audit` chore).
- **GHI #595** (open) — `gz-design`/`gz-adr-create` evaluate-gate errors on pool ADRs;
  direct-fix candidate.
- **GHI #591, #589** (open) — direct-fix candidates above. **GHI #592** — close it.
- **Track-2 A->B measure** — unresolved from the predecessor handoff.
- **`pool-triage` BDD coupling** — if that chore is ever cut, repoint the two
  scenarios again.

## Verification Checklist

- [ ] `git rev-parse --short HEAD` is `52d92cef` (or later); `git branch --show-current` is `main`; `git status -sb` shows no ahead/behind divergence from `origin/main`
- [ ] `uv run gz adr status ADR-0.0.67` shows Lifecycle Completed, Closeout Phase attested
- [ ] `gh issue view 588 --json state` is CLOSED
- [ ] `uv run -m unittest -q` passes (5977, 0 failures) — confirms the insights + BDD fixes held
- [ ] `uv run behave features/chores_distribution.feature features/init.feature` passes (the two repointed scenarios)
- [ ] `uv run gz cli audit` reports 104/104; `uv run gz validate --req-kind-discipline` green
- [ ] `uv run gz validate --closeout-proof-binding` still red for 0.0.41 + 0.0.67 (EXPECTED — `ln` is being sunset, not fed)
- [ ] Last record in `.gzkit/insights/agent-insights.jsonl` is the fail-open-seam `defect` (validates against `InsightRecord`)

## Evidence / Artifacts

- `src/gzkit/governance/trust_audits/cli.py` — the fail-open seam at lines 222-225 (inherited; folded into sunset-ADR scope)
- `.gzkit/insights/agent-insights.jsonl` — line 176 fixed (`finding`->`discovery`); last record is the seam `defect` with `next_action` naming the sunset-ADR route
- `features/chores_distribution.feature` — `skill-manifest-sync` -> `pool-triage` (Gate-4 fix)
- `features/init.feature` — `skill-manifest-sync` -> `pool-triage` (Gate-4 fix)
- `docs/user/manpages/obpi-lock-claim.md` — stale `## Deprecated` section removed (same for `docs/user/manpages/obpi-lock-release.md`, `docs/user/manpages/obpi-lock-list.md`)
- `docs/design/adr/foundation/ADR-0.0.67-tool-skill-invariant1-enforcement/ADR-0.0.67-tool-skill-invariant1-enforcement.md` — status now Completed
- `docs/design/adr/foundation/ADR-0.0.67-tool-skill-invariant1-enforcement/ADR-CLOSEOUT-FORM.md` — closeout form emitted this session
- `.gzkit/ceremonies/ADR-0.0.67-tool-skill-invariant1-enforcement.ceremony.json` — ceremony state, completed
- `src/gzkit/governance/trust_audits/closeout_proof_binding.py` — the `ln` validator (ledger-rooted post-#593); subject of the sunset
- `.gzkit/handoffs/20260609T022038Z-593-fixed-track2-a1-landed.md` — predecessor handoff

## Environment State

Python 3.13 / uv. Branch `main`, in sync with `origin/main` at HEAD `52d92cef`.
All session commits passed pre-commit gates and the `gz git-sync --apply --lint
--test` sync. No environment-specific blockers. Last ADR-0.0.67 lock-claim event
in the ledger: `2026-06-08T02:26:44Z` (lock already released; ADR is Completed).
