Runbook and standing-record coherence — ledger adjudications contract, two-path land-failed prose, doctrine anchor + locks, manifest envelope, guard deny truth, T2.9 census (0.14.59)

.claude-plugin/marketplace.json

@@ -4,14 +4,14 @@
   "owner": { "name": "Ljferrer", "url": "https://github.com/Ljferrer" },
   "metadata": {
     "description": "WAR — Work·Audit·Refine: Claude-native multi-agent execution of a multi-phase implementation plan.",
-    "version": "0.14.58"
+    "version": "0.14.59"
   },
   "plugins": [
     {
       "name": "work-audit-refine",
       "source": "./",
       "description": "Execute a multi-phase implementation plan with fresh worker agents, independent read-only auditors, and a serial refine/merge queue — phase by phase, gated by you, opening one PR at the end.",
-      "version": "0.14.58",
+      "version": "0.14.59",
       "author": { "name": "Ljferrer" },
       "keywords": ["agent-teams","workflows","orchestration","code-review","merge-queue","multi-agent","gastown"],
       "category": "workflow"

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "work-audit-refine",
   "description": "WAR — Work·Audit·Refine. A Claude-native Agent-Teams + Workflows orchestration skill that executes a detailed multi-phase implementation plan: it breaks phases into GitHub issues, then per phase spins up fresh worker agents in isolated worktrees, independent read-only auditors (severity-gated, unanimous), and a serial refine/merge queue, landing each phase on a working branch and opening one PR to the landing branch at the end.",
-  "version": "0.14.58",
+  "version": "0.14.59",
   "author": { "name": "Ljferrer", "url": "https://github.com/Ljferrer" },
   "license": "MIT",
   "homepage": "https://github.com/Ljferrer/WorkAuditRefine",

CONTEXT.md

@@ -813,7 +813,8 @@ Lead at the decompose gate / an escalation adjudication (scope deltas routed to
 scoring keys on it: version precedence (task instruction > red-team adjudication > plan body literal)
 and the adjudication-match confirmation-note rule.
 _Avoid_: "override", "waiver" — a row records a ruling already made and routed; it never waives a gate,
-floor, or backstop (ADR 0017).
+floor, or backstop (ADR 0017), and a row is **never mined from arbitrary prose** — rows come only from
+the two named producers.
 
 **topology-void**:
 A plan clause anchored on git topology that does not exist under WAR's fast-forward per-task merges (a

README.md

@@ -337,7 +337,7 @@ A version bump **must** update all four version slots across three files togethe
 
 ## Status
 
-**0.14.58** — Standing-record truth for the `land-advance` exit contract, plus the missing precheck-arm test. Every live record of `cmd_land_advance`'s exit codes now states the contract as **0/2/3/6**, matching what the script's own header comment already said: the land-path lesson `docs/learnings/land-advance-push-first-cas-rejected-token.md` prefetched into worker and auditor seats, its portability-stripped twin in the `docs/seed/` corpus that fresh installs receive (re-packed with a regenerated manifest entry), and ADR 0023 — whose amendment sentence is narrowed in place to stop claiming the exit contract is byte-unchanged, and whose decision (B) normal-path bullet now defers to that amendment. Each names exit 6 (wrong-HEAD precheck refusal — nothing pushed, local and origin refs untouched, never a reland) and exit 3's widened unresolvable-`HEAD`/`<new-sha>` triggers; the lesson also gains a `wrong-HEAD precheck` keyword so land-path seats retrieve it. New case **T2.5d** in `skills/war/assets/provision-worktrees.test.sh` gives the previously untested unresolvable-HEAD arm deterministic coverage on an orphan-HEAD fixture — exit exactly 3, a `could not resolve HEAD to a commit` die line, local and origin refs byte-unchanged — refuting the phase-close waiver that had called that arm unfixturable, and the T2.9 route-identity census is rewritten count-free so future exit-3 cases cannot re-stale it. `skills/war/assets/provision-worktrees.sh` is byte-untouched: this release ships corrected records and new test coverage, no behavior change.
+**0.14.59** — Standing records realigned with live behavior: a prose, contract, and guard-text truth sweep across eight drifts between what WAR's runbooks and contracts describe and what its engine actually does. `skills/war/references/schemas.md` now documents the `ledger.json` top-level `adjudications` key (sibling of `phases`/`pr_url?`, accumulating run-long, rows recorded **verbatim as threaded** in either args-contract shape — a preformatted string or `{ adjudicated|value, supersedes }`), so the recovery relaunch's promised full re-thread is lossless by construction; the `Optional adjudications` args paragraph and `skills/war/SKILL.md` step 5 both cite that key. The `held:land-failed` Outcome-handling bullet now states **both** paths by which a gate-time `environment` failure reaches that hold — a primary-land arm whose bounded fresh-env re-land came back `environment`-classified a second time (retry spent; expect a persistent environment and inspect before re-running), and a baseline-proceed arm for which no `environment-proceed` retry is ever dispatched, the two `*-proceed` flavors deliberately never chaining, so the first manual re-run is genuinely the first fresh attempt; the prior sentence asserted the spent-retry case unconditionally. `### Recovery relaunch`'s shared-mechanics list gains a fourth **Adjudication continuity** duty, so both relaunch entry points re-thread the accumulated adjudication set instead of only the held-partial-phase runbook. The run-manifest contract widens by one per-phase `envelope` aggregate (`totalTokens` / `totalToolCalls` / `agentCount`, each number-or-null, whole object nullable) on the MUST-carry list of both binding records, `## Checkpoint` gains a fail-open **Manifest stamp** bullet, and `/war-review` sources totals from that envelope — falling back to transcript mining, the input/output/cache split staying mined-or-`n/a` and labelled best-effort rather than cross-summable — plus a new **unfinalized phase record** friction signal; the manifest stays fail-open telemetry no code reads back, and ADR 0008's git > labels > ledger resume ordering is untouched. The adjudication-provenance doctrine anchor — rows come only from the two named producers — is restored to `CONTEXT.md`'s **Adjudication** glossary term and drift-locked by three new construct-anchored locks in `skills/war/assets/skill-doc-contracts.test.mjs` (the restored anchor; the schemas.md ledger key; the both-arms shape of the land-failed bullet). The auditor `git branch` guard's deny message and header comment drop a blanket read-flag characterization that never described the guard's own two read arms, now naming both in full — value-carrying flags `=`-attached, and the bare read flags enumerated — with every `case` arm, and so every allow/deny outcome, byte-unchanged. The T2.9 route-identity census in `skills/war/assets/provision-worktrees.test.sh` drops a uniqueness overclaim two auditor seats code-traced false: the push-error branch is not the only silent exit-3 route, the post-push origin-readback mismatch is silent too. **No behavior change:** `skills/war/assets/workflow-template.js`, `skills/war/assets/land-decision.mjs`, every merge-path floor, and every guard case arm are byte-untouched — this release ships corrected records, one corrected deny string, and three new doc-contract locks.
 
 ## License
 

docs/learnings/full-gates-green-end-state-soft-without-threaded-gate-log-artifact.md

@@ -5,9 +5,9 @@ metadata:
   node_type: memory
   type: project
   provenance: code-verified
-  promoted: dev/2026-07-24-land-advance-exit-contract-truth@phase-2
+  promoted: dev/2026-07-24-runbook-and-standing-record-coherence@phase-1
   slug: full-gates-green-end-state-soft-without-threaded-gate-log-artifact
-  phase: "red-team-fallback-and-anchor-hygiene/phase-2 (Release, task 2.1) +3 recurrences (latest land-advance-exit-contract-truth/phase-2 Release task 2.1, 2026-07-24)"
+  phase: "red-team-fallback-and-anchor-hygiene/phase-2 (Release, task 2.1) +4 recurrences (latest runbook-and-standing-record-coherence/phase-1-integrated-tip gate-audit, 2026-07-24)"
   keywords:
     - full gates green
     - gate-log artifact
@@ -22,6 +22,10 @@ metadata:
     - mechanical bump
     - version-slots.test.mjs arbiter
     - lock-step equality
+    - integrated-tip gate-audit
+    - self spot-verify
+    - git rev-parse HEAD
+    - pin proof
   tags:
     - audit-pipeline
     - gate-audit
@@ -31,7 +35,7 @@ metadata:
   created: 2026-07-15
   updated: 2026-07-24
   originSessionId: e11422bd-1b49-4d13-9840-37a67306b3f5
-  modified: 2026-07-24T21:37:05.481Z
+  modified: 2026-07-25T07:05:55.757Z
 ---
 
 **Local recurrence copy** of the repo-root lesson at `docs/learnings/full-gates-green-end-state-soft-without-threaded-gate-log-artifact.md`
@@ -133,3 +137,59 @@ directly confirmed, not just audit-log-trusted.
 split continues to be the correct, non-escalating resolution across a fourth distinct
 plan/campaign — no drift in the pattern, no new lesson warranted, only occurrence-count/date
 freshness.
+
+## Recurrence 4 (2026-07-24, plan `2026-07-24-runbook-and-standing-record-coherence`, phase-1-integrated-tip gate-audit)
+
+Same missing-artifact shape, a different seat: not the per-task/version-slot `phase-N-end-state`
+gate-audit, but the **integrated-tip** gate-audit pass (`task: "phase-1-integrated-tip"`,
+`authoritative: true`). The spawn threaded the gate-log artifact path but **no stamped `pin_status`
+token** (none of CONFIRMED / BENIGN-ADVANCE / STALE-MISMATCH / ERROR). Per the standing rule this is
+a SOFT cannot-confirm, never a hold — but this seat did not stop at recording the gap: it ran the
+**optional read-only spot-verify** instead (`git -C <_refinery-worktree> rev-parse HEAD` compared
+against the threaded gate-HEAD SHA, plus `git status` clean, plus the captured gate log's own
+scout-manifest-surface lines independently naming the same absolute `_refinery` path) and used that
+to **fully confirm** — not just SOFT-note — that the tree provably corresponds to the gate-HEAD SHA a
+provably-unrun mapped test would have surfaced as HARD. Verdict: `gate-audit:approve`, `hard:false`,
+recorded as a Nit/`note` for evidence-chain completeness, with a suggested_fix to thread the
+`pin_status` token into the integrated-tip dispatch "the same way the per-task gate-audit seat
+receives it."
+
+**New nuance over Recurrences 1-3:** those were all per-task/version-slot End-state audits with no
+escape hatch beyond "record SOFT and move on." An **integrated-tip** gate-audit seat has one extra
+tool available — it can independently re-derive the pin proof via a read-only `git rev-parse
+HEAD`/`git status` spot-check against the worktree the gate log itself names, converting a
+missing-`pin_status`-token gap from "unconfirmable, SOFT" into "independently confirmed, HARD path
+stayed available." Future integrated-tip gate-audit seats facing the same missing token should
+attempt this spot-verify before defaulting to a bare SOFT note.
+
+**`code-verified`** the `pin_status` concept and its four-value enum are live in this repo at the
+landed tip `3f136c0327713487768aed59f986b665b07f9cb6` — confirmed present in
+`skills/war/assets/workflow-template.js`, `skills/war/assets/workflow-template.test.mjs`,
+`agents/war-refiner.md`, `agents/war-auditor.md`, `CONTEXT.md`, and
+`docs/adr/0024-audit-gate-verdicts-integrated-tip-captured-evidence.md` (read via the `_refinery`
+worktree matching that SHA, gitdir physical path containing this plan's slug —
+`.claude/worktrees/2026-07-24-runbook-and-standing-record-coherence-2026-07-24/_refinery/`).
+
+## Recurrence 5 (2026-07-24/25, plan `2026-07-24-runbook-and-standing-record-coherence`, phase 2 "Release", task 2.1) — back to the per-task/version-slot shape, with self-mitigation spelled out
+
+Fifth occurrence, back to the Recurrences 1-3 per-task/version-slot `phase-N-end-state` shape (not
+the integrated-tip variant of Recurrence 4): End state 10 required all four version slots bumped in
+lock-step to the next free patch (`0.14.59`), `version-slots.test.mjs` named as arbiter. This pass
+carried no stamped `pin_status` token and no captured gate-log artifact path, so the commit body's
+"929/929 pass 0 fail, 26 shell suites" claim is unverified evidence — SOFT, never a hold, per the
+standing rule; verdict stayed `gate-audit:approve`, `hard:false`, `disposition:note`.
+
+**What this occurrence adds:** the auditor's own rationale spelled out its mitigation chain in full
+rather than just citing the rule — confirmed the tip with `git rev-parse`, confirmed
+`git status --porcelain` empty in the `_refinery` worktree, and read all four slots directly from
+the pinned blobs (all `0.14.59` bare semver, `## Releasing` section satisfying both the absence key
+and the presence key). `code-verified` at the landed tip `3444016a48a3d97b5beb21fc9700bd7fa788272d`
+(gitdir physical path containing this plan's slug:
+`.claude/worktrees/2026-07-24-runbook-and-standing-record-coherence-2026-07-24/_refinery/`):
+`.claude-plugin/plugin.json` `version`, `.claude-plugin/marketplace.json` `metadata.version` and
+`plugins[0].version`, and the README `## Status` line all read `0.14.59` at that tip, and
+`skills/war/assets/version-slots.test.mjs` is present.
+
+**Confirms:** the SOFT-never-hold disposition for this exact End-state shape now holds across five
+occurrences and two campaigns; the mechanical-half-confirmable / execution-half-SOFT split is
+stable and needs no further pattern refinement, only occurrence-count freshness.

docs/learnings/plan-enumerated-doctrine-census-homes-list-is-illustrative-not-exhaustive.md

@@ -0,0 +1,78 @@
+---
+name: plan-enumerated-doctrine-census-homes-list-is-illustrative-not-exhaustive
+description: "A plan's End-state clause naming the 'expected homes' of a repo-wide doctrine-phrase census is a convenience reminder, not the ground truth for what counts as 'unexpected' — an independently re-derived hit (e.g. via git log -G) that the list omits is still MET if it classifies to the same ruling class (a planning artifact quoting the doctrine), never a hold"
+metadata: 
+  node_type: memory
+  type: project
+  provenance: code-verified
+  slug: plan-enumerated-doctrine-census-homes-list-is-illustrative-not-exhaustive
+  phase: "runbook-and-standing-record-coherence/Phase 1, Task 1.3 + phase-1-integrated-tip gate-audit"
+  keywords: 
+    - doctrine census
+    - expected homes
+    - never mined from arbitrary prose
+    - git log -G
+    - wrap-tolerant census
+    - classification record
+    - planning artifact leave ruling
+    - red-team report
+    - end state 5
+    - enumerate every hit
+  tags: 
+    - war
+    - audit-pipeline
+    - doc-truth
+    - census
+    - standing-records
+  created: 2026-07-24
+  originSessionId: 4eee3466-8bcc-44f9-a6c2-754d46624537
+  modified: 2026-07-25T06:18:46.979Z
+---
+
+# A plan's enumerated "expected homes" list for a doctrine-phrase census is illustrative, not exhaustive
+
+**What happened (code-verified — landed tip `3f136c0327713487768aed59f986b665b07f9cb6`, read via the
+`_refinery` worktree matching that SHA, gitdir physical path containing this plan's slug —
+`.claude/worktrees/2026-07-24-runbook-and-standing-record-coherence-2026-07-24/_refinery/`):** plan
+`2026-07-24-runbook-and-standing-record-coherence` End state 5 required a wrap-tolerant repo-wide
+census of the restored "never mined from arbitrary prose" doctrine phrase to find it "at exactly the
+expected homes … and nowhere else unexpected," and enumerated six expected homes (CONTEXT.md,
+`skills/war/SKILL.md` step 5, the 2026-07-22 spec's correction note, a learnings lesson, the plan
+itself, and its source spec). `git log -Gmined.from.arbitrary.prose --name-only` over the branch
+turns up a **seventh** file the list never names:
+`docs/red-team/2026-07-24-runbook-and-standing-record-coherence.md` (line 52, confirmed present at
+the landed tip) — this plan's own CLEARED red-team report, which quotes the phrase to specify the
+literal-string requirement for lock (a).
+
+**Why this is not a miss:** the plan's own census *procedure* is "enumerate and classify EVERY hit;
+never match a pre-declared count" — the enumerated list is a reader's convenience reminder of the
+obviously-expected homes, not the exhaustive ground truth the "nowhere else unexpected" clause is
+checked against. The correct ruling for the missing seventh hit is plain by class-analogy: it is a
+**planning artifact quoting the doctrine to specify it**, the identical class the plan already rules
+"leave" for the plan and its source spec. Two independent auditor seats (the task-1.3 review and the
+later `phase-1-integrated-tip` gate-audit, `gateEvidence: true`) both re-derived the full historical
+hit set via `git log -G` and reached the same conclusion: End state 5 is **MET in substance**, and the
+list's omission is a completeness gap in the done report's classification record, never grounds for a
+HARD hold or an "unexpected home" verdict.
+
+**The pattern:** when a plan's End-state condition bundles (a) a literal enumerated list of expected
+homes with (b) an open-ended "and nowhere else unexpected" tail, the list is advisory scaffolding for
+the census-writer, not a closed set to diff against. An audit seat encountering a hit outside the
+list should classify it by the **same ruling class** as the nearest listed analog (here: "planning
+artifact quoting the doctrine — leave") rather than treating the plan's own list as incomplete or the
+extra hit as a violation. Independently re-deriving the census (e.g. `git log -G <phrase>
+--name-only`) rather than trusting only the done report's stated classification is what catches this
+class of gap — the auditor's own tool ceiling (no shell `grep` for an auditor seat; `git log -G` is
+git-verb-allowlisted and available) makes this the practical re-derivation path.
+
+**How to apply:** when authoring a plan's doctrine/phrase-restoration census clause, either (a) drop
+the enumerated "expected homes" list entirely and rely solely on "enumerate and classify every hit,"
+or (b) explicitly caveat the list as non-exhaustive and instruct the classifier to rule any
+unlisted-but-same-class hit (a red-team report, a done report, another plan) the same way as the
+nearest listed analog. When *auditing* such a clause, re-derive the hit set independently before
+ruling "unexpected home" — a `git log -G` walk is cheap and catches same-class stragglers the plan's
+own list missed.
+
+Related: [[plan-survey-token-sweep-misses-untagged-siblings]] (same family — a plan's literal-sweep
+instruction is a floor for the *mechanical* step, not a completeness guarantee; there the miss was a
+differently-worded sibling, here it is a same-worded hit outside a hand-enumerated allowlist).