…a state (D009)

Stands up a generalized plan/delegate/verify/ship orchestrator as the
umbrella operating mode for multi-agent work in this repo. Ratified by
Joe this session via two decisions (D009.1 generalize&reuse; D009.2
separate ORCHESTRATOR.md).

Design principle — generalize & reuse, no duplication. An inventory
found Hanna already implements ~70% of the framework: D002 MoE roles
map 1:1 to planner/worker/critic/integrator; DECISIONS/ROADMAP/NEXT
map to decisions/plan/checkpoint. The generic state names are aliases
for those existing files (documented in ORCHESTRATOR.md §7); only the
two genuinely-new artifacts are created.

Files created (7):
- ORCHESTRATOR.md — the operating manual verbatim (§1 Roles, §2
  Delegation Contract, §3 State, §4 Termination, §5 Context Budget,
  §6 Invariants) + three Hanna-adapter sections: §7 State Adapter
  (the alias mapping + checkpoint field crosswalk; no duplicate
  standing files), §8 Relationship to /hanna-dispatch-next (the slash
  command is one workflow under the orchestrator — it expresses
  planner->worker(s)->critic[verify]->integrator->commit per lane),
  §9 hard-constraint inheritance (Rules 34/35/36/37, canonical trailer,
  D003/D004 hygiene, no-deps-without-a-decision).
- state/beliefs.md — durable, single-writer belief layer (9-column
  supersession-tracked table). Seeded with 5 claims. c003 deliberately
  carries 0.7 (below the 0.8 threshold): "a worker's done warrants only
  moderate confidence until critic[verify] confirms" — the encoded
  lesson of the 2026-05-22 session, where CodeRabbit round-3 found 4
  latent bugs after this thread self-declared L3b/L4a done.
- state/open_questions.md — leverage-ranked q-IDs. Seeded with 3 from
  NEXT.md parked items (q002 LockoutResponse = high, gates L6; q001
  Octavius envelope = med; q003 SESSION_01 §G staleness = low). §C.3
  (closed by L3b) and §C.6 (voided by D008.1) intentionally not seeded.
- .claude/agents/{planner,worker,critic,integrator}.md — the D002
  roles formalized as Claude Code subagent primitives. YAML frontmatter
  (name/description/tools); planner+critic read-only, worker+integrator
  read-write. critic defines all three modes (verify/red_team/evaluate).
  Each carries the inherited hard constraints and the single-writer
  belief rule (propose deltas in summary; never write beliefs.md).

Files edited (2):
- CLAUDE.md — Orchestration pointer block after "Read edges"; one
  "not a duplicate of ORCHESTRATOR.md" line under "What this file is
  not". Existing sections untouched.
- docs/DECISIONS.md — D009 entry (the substrate-level ratification of
  the adoption, with rejected alternatives: replace&migrate, coexist,
  merge-into-CLAUDE, global ~/.claude). Footer bumped to D010. This is
  both Hanna's canonical ratification mechanism and the decisions.md
  the orchestrator itself requires — the adoption is self-consistent.

Verified:
- ls -> all 7 files present; state/ holds exactly beliefs.md +
  open_questions.md (no forbidden decisions.md/plan.md/checkpoint.md/
  parked.md duplicates).
- All 4 agent files open with --- YAML frontmatter; critic.md has 3
  MODE headers.
- beliefs.md c003 confidence = 0.7 (< 0.8 threshold, as intended).
- python3 -m pytest tests/ -q -> 74 passed (no code/test files
  touched; pure docs + scaffold).
- grep "Cloned from Harlo|claude-opus" across new files -> 0 (all
  fresh Hanna authoring, no Harlo ancestor per D003/D004 Clause B;
  no model-id in any artifact).

Out of scope (deferred): running a live GOAL (first = L4b, separate
invocation); token-tracking field in NEXT.md (run-time concern); any
change to /hanna-dispatch-next internals (referenced, not modified).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…uts in flight

Orchestrator hygiene per ORCHESTRATOR.md Invariants 1-2 (plan before
execute; state on disk). This commit lands the GOAL scaffold for the
in-flight scout phase; no scout findings yet (scouts still running).
NOT implementation — Joe gates implementation on "go" after the
scout phase completes and the PRD is presented.

state/plan.md: GOAL = review Hanna from first principles; produce a
PRD identifying opportunities + areas for improvement; surface to
Joe for "go" before implementation. EXIT_CRITERIA: 7 scout findings
delivered, PRD authored, beliefs/open_questions updated, Joe
presented with explicit ask, implementation BLOCKED until "go".
Task graph: 7 parallel critic[red_team] scouts (architecture,
code-quality, tests, docs, ops, security-rules, lanes-schemas),
orchestrator synthesis, report, wait. CONFIDENCE_THRESHOLD 0.8.

state/checkpoint.md: scout phase in-flight; 7 task IDs registered;
per-criterion EXIT_STATUS pending; budget tracking; phase = SCOUT.

Out of scope for this commit: any scout findings (not landed yet),
any belief-delta writes (orchestrator writes after scouts return),
any PRD content (synthesized after scouts return), any
implementation actions whatsoever (gated on Joe's "go").

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…dings (2/7)

Orchestrator hygiene per ORCHESTRATOR.md Invariant 2 (state on disk).
Scout phase still in flight; 5 scouts remain in-flight; no synthesis
yet (waits for all 7); no implementation actions taken (gated on
Joe's "go" after PRD presentation).

scout-architecture: 0 BLOCKER, 4 MAJOR. Key catch — the live GOAL
(this run) violates ORCHESTRATOR.md §7's "only beliefs.md +
open_questions.md are standing files in state/" rule by carrying
state/plan.md as a standing file. (The GOAL block should live in
the NEXT.md adapter slot.) Other MAJORs: D006 macOS coupling
unresolved as L4b approaches; "brief composition" boundary
undefined; DECISIONS.md template inconsistency on Rejected-
alternatives blocks.

scout-code-quality: 0 BLOCKER, 1 MAJOR. ProductFile.parse() has
6 silent-coercion/drop gaps (quoted YAML, duplicate keys, unknown
section headers, empty bullet lines, asymmetric ISO-datetime
fallback, no Unicode normalization) — violates Rule 36's faithful-
surface posture because the composer silently drops mismatched
products. Notably: confirms the round-3 frame-coalescing patch is
correctly synchronized — _recv_buffer is only mutated inside
self._lock-held call sites (no race introduced by the static-to-
instance method conversion).

Belief deltas (9 proposed across 2 scouts) will be validated and
written to state/beliefs.md by the orchestrator AFTER all 7 scouts
return.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

… (4/7)

Orchestrator hygiene per Invariant 2. 3 scouts remain in-flight
(scout-docs, scout-ops, scout-lanes-schemas). No synthesis yet
(waits for all 7); no implementation actions taken (gated on Joe's
"go" after PRD presentation).

scout-security-rules: 2 BLOCKER, 3 MAJOR, 4 MINOR.
- B-0: RULES.md compliance recipes target python/hanna/ + crates/,
  neither of which exists in the repo. The CI greps run against
  paths that don't exist — green light means nothing.
- B-1: RULES.md asserts 3-layer lockout verification + the test
  file tests/test_integration/test_lockout.py that doesn't exist.
  Only layer 1 (compute_producer_phase) is tested; override_token
  is openly spec-only.
- M-1: Rule 35 grep is name-anchored and trivially defeated by
  rename (harlo.commit/.persist would slip through); real defense
  is the enumerated bridge surface.
- M-2: Rules 1-17/19-33 carry no per-rule "Not yet load-bearing"
  annotation despite D008.7 promising it.
- M-3: SQLite write path uses default sqlite3.connect() — no
  journal_mode=WAL, no timeout, no PRAGMA hardening; will break
  on second-writer race.
- Confirms lock discipline on production _rpc path is sound;
  _recv_buffer only mutated under self._lock; no race introduced
  by the round-3 static-to-instance method conversion.

scout-tests: 3 BLOCKER, 9 MAJOR, 12 MINOR.
- B1: zero regression test for the round-3 frame-coalescing patch
  (grep "recv_buffer" tests/ returns nothing despite the variable
  being wired through 3 sites in src/harlo_bridge.py).
- B2: scripts/first_hanna_brief.py is 75% untested — only
  _portfolio_line has coverage. _state_line, _compose_brief,
  _persist, _extract_burnout, _read_harlo, _read_product_files,
  main() (incl. FAMILY_LOCKOUT early exit) have zero coverage;
  no integration test stitches them end-to-end.
- B3: compute_producer_phase has 21 tests but misses its own
  MONTHLY-beats-WEEKLY precedence collisions (Jun 1 2026 returns
  MONTHLY, not WEEKLY_MONDAY — empirically verified, undocumented,
  untested) and exercises zero non-default keyword arguments.
- Suggests raising belief c003 confidence 0.7 -> 0.8: empirically
  confirmed since the specific round-3 fix the c003 caution
  predicts has no regression test.

Combined: 5 BLOCKERs across these 2 scouts. PRD will need to
prioritize these for any "go" decision.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…6/7)

Orchestrator hygiene per Invariant 2. 1 scout remains in-flight
(scout-ops). No synthesis yet; no implementation actions (gated on
Joe's "go").

scout-docs: 3 BLOCKER, 8 MAJOR, 6 MINOR.
- B1: RULES.md §34 still describes 3-layer lockout with HdProducer
  as layer 2, contradicting RULES.md's own line-15 applicability
  note (post-L1) and every other propagated surface (README,
  BLUEPRINT, NEXT, UI_UX_MAP, ORCHESTRATOR §9).
- B2: README.md "Repository layout" is a one-third-true filesystem
  map — omits ORCHESTRATOR.md, docs/DECISIONS.md, docs/ROADMAP.md,
  docs/REVIEW_2026-05-22.md, docs/PRODUCER_LENS.md, docs/UI_UX_MAP.md,
  docs/SPIKE_HARLO_EDGE_2026-05-20.md, state/, scripts/, src/,
  tests/, data/; references nonexistent web/README.md; stamps
  BLUEPRINT as v0.1.0-draft when file self-stamps v0.2.0-audit.
- B3: SESSION_01_RECON.md §G still claims "RULES.md does not exist
  in Harlo, synthesize from distributed sources" — directly
  contradicted by RULES.md:7 ("Extracted verbatim from Harlo/
  CLAUDE.md lines 37-194"). The NEXT.md "staleness flag" carried
  this across sessions without resolution.
- M-noteworthy: REVIEW_2026-05-22.md carries the model-id string
  CLAUDE.md explicitly disallows. ORCHESTRATOR §7 adapter is
  partly aspirational and missing state/plan.md — independently
  cross-verifies scout-architecture's same finding.

scout-lanes-schemas: 3 BLOCKER, 8 MAJOR, 7 MINOR.
- B1: osascript path is macOS-only but CI runs ubuntu-latest;
  lane needs HannaCalendarNotAvailable + platform gate. NEXT.md
  names this exception, ROADMAP §4 does not (drift between
  source docs).
- B2: rhythm-anchor contradiction. BriefPayload.composed_at_iso
  is a UTC compose-moment timestamp by construction at
  scripts/first_hanna_brief.py:138, but D006 promises rhythm-time
  anchor events at e.g. 09:00 ET. ROADMAP §4 hardcodes the
  compose-moment as the event start, so the first morning brief
  would land at random compose time (e.g. 07:42 ET) defeating
  D006's "context the day carries" posture rationale.
- B3: publish-now CLI subcommand cited by both ROADMAP §4 and
  NEXT.md has zero specification — no argparse contract, no
  source-of-brief, no error semantics.
- Forward-path observation: L4b is the only ship-able lane from
  current HEAD. Reaching "Hanna is real" requires q004
  (rhythm-anchor) resolved before L4b dispatch.

Cumulative across 6 scouts: 11 BLOCKER, 33 MAJOR, 33 MINOR.
PRD will need clear prioritization.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…iting Joe's "go"

Orchestrator first-principles review GOAL reached the synthesis-and-
report milestone. 7 critic[red_team] scouts dispatched, all returned;
9 belief deltas validated and written to state/beliefs.md (c006-c014);
10 open questions promoted to state/open_questions.md (q004-q013);
PRD authored at state/tasks/prd/PRD.md with prioritized recommendations.

No implementation taken — gated on Joe's "go" per the GOAL spec.

scout-ops (this commit completes the 7/7):
- 2 BLOCKER: (B-OPS-001) "always-on" claim unbacked — no scheduler/
  cron/launchd; bin/hanna-brief.command opens a static HTML mockup
  and does not invoke Python; (B-OPS-002) BriefPayload has no
  idempotency token; briefs SQLite has AUTOINCREMENT id with no
  UNIQUE — L4b publish() would produce duplicate Joe-visible
  calendar events on every retry.
- 5 MAJOR: zero `import logging` in src/; HarloBridge silent state-
  blind degradation; override_token spec-only; no health probe;
  undefended SQLite durability/retention.
- 5 MINOR; 5 belief deltas; 3 open questions; trailer hygiene clean.

Cumulative across 7 scouts: 13 BLOCKER, 38 MAJOR, ~38 MINOR.

PRD §"Recommended first implementation cycle": Phase 0 (orchestrator
self-fix per c009/q013) + Phase 1 (pre-L4b unblockers — D010 rhythm-
anchor / D011 cross-platform / D012 idempotency + publish-now CLI
spec + round-3 frame-coalescing regression test per c007) + Phase 4
partial (highest-impact doc drift — RULES §34, README layout,
SESSION_01 §G). Estimated 6-8 agent dispatches out of 13 remaining
in Joe's 20-cap.

Notable cross-scout findings:
- c003 ("done warrants critic[verify]") empirically vindicated by
  c007 (round-3 frame-coalescing patch has zero regression test
  despite being the exact bug class c003 predicts).
- ORCHESTRATOR.md §7 self-violation (state/plan.md is a standing
  file despite the §7 adapter rule) cross-verified by scout-
  architecture AND scout-docs independently — strong signal.
- L3b round-3 patch is correctly synchronized (scout-code-quality
  + scout-security-rules cross-verify); the BUG was the missing
  test, not the code.

Belief layer state: 14 active claims; 13 open questions across
3 leverage tiers. State on disk per ORCHESTRATOR.md Invariant 2.

The ask is in PRD §"The ask": go / no-go / redirect on the
recommended first cycle. No orchestrator action permitted before
Joe's confirmation.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

ORCHESTRATOR.md §7 amended to distinguish at-rest state (durable
cross-GOAL: beliefs.md + open_questions.md only) from during-GOAL
runtime state (plan.md, checkpoint.md, tasks/<id>/, gate.md).
Closes belief c009 (orchestrator self-violation cross-verified by
scout-architecture + scout-docs); ratified as belief c015. Closes
open question q013.

This is Phase 0 of Joe's "go on everything" directive on the PRD's
6-phase implementation cycle. Subsequent phases continue in this
session: Phase 1 (pre-L4b unblockers: D010/D011/D012 + idempotency
code + frame-coalescing regression test), Phase 2 (test integrity),
Phase 3 (CI/compliance integrity), Phase 4 (doc drift sweep),
Phase 5 (operational substrate), Phase 6 (data hygiene).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

… gate + D012 idempotency + frame-coalescing regression test

PRD Phase 1 of 6. Three ratified D-entries + the implementation that
satisfies them + the missing regression test belief c003 predicted.
Phase 1 critic[verify] PASS on 20/20 acceptance criteria.

D010 (rhythm-anchor): BriefPayload gains phase_anchor_iso (ET-anchored
ISO 8601 per phase: MORNING=09:00 / MIDDAY=12:00 / EVENING=17:00 /
WEEKLY_MONDAY=09:30 / WEEKLY_FRIDAY=16:00 / MONTHLY=09:00 first
weekday). compute_phase_anchor_iso(phase, compose_date) helper. Closes
q004 → belief c016 (0.9; ET timezone handling verified for both EDT
and EST).

D011 (cross-platform): macOS-only L4b stance with explicit
HannaCalendarNotAvailable exception on non-macOS. Phase 1 lands the
lazy ImportError → local stub fallback in scripts/first_hanna_brief.py
and the try/except wrapper around the (placeholder) publish call.
Full publish() body lands with L4b. Closes q005 conditionally → belief
c018 (0.7; pending L4b end-to-end exercise).

D012 (idempotency): BriefPayload gains brief_id = SHA256[:16] of
(phase + anchor_date + sorted products). briefs SQLite schema gains
brief_id TEXT UNIQUE + phase_anchor_iso TEXT columns. _persist switches
to INSERT OR IGNORE — re-running same composition is idempotent on disk.
Closes q006 → belief c017 (0.92; double-_persist verified to yield
COUNT(*)=1; supersedes c012).

Frame-coalescing regression test (the missing test belief c007 named):
TestFrameCoalescing in tests/test_harlo_bridge.py with 3 cases —
two-frames-in-one-read both decoded; partial second frame buffered in
_recv_buffer between calls; _recv_buffer cleared on close(). Closes
c007 → belief c019 (0.95; supersedes c007 from active to superseded).

MoE dispatch per D002 + ORCHESTRATOR.md §1:
- 2 workers in parallel (phase1-idempotency + phase1-frame-coalescing-
  test); each cold-read, self-contained briefs per Delegation Contract.
- 1 critic[verify] for Phase 1 acceptance audit: PASS 20/20.
- Decisions D010/D011/D012 author-by-main-thread per D002.

Verified:
- python3 -m pytest tests/ -q → 83 passed in 0.45s (was 74; +6
  idempotency tests + 3 frame-coalescing tests).
- PYTHONPATH=. python3 scripts/first_hanna_brief.py → exits 0
  ("Hanna paused: FAMILY_LOCKOUT" — 2026-05-30 is Saturday, expected).
- Rule 35/36/37 clean; D003/D004 trailer hygiene preserved
  (scripts/first_hanna_brief.py keeps Harlo trailer; new test code in
  fresh-seed test files carry no trailer); no model-id in artifacts.

State updates (per ORCHESTRATOR.md Invariant 2):
- state/beliefs.md: c007 superseded by c019; c012 superseded by c017;
  c009 superseded by c015 (from Phase 0); c015–c019 added.
- state/open_questions.md: q004 (c016), q005 (c018), q006 (c017),
  q013 (c015 from Phase 0) all closed.

Budget posture: Phase 1 spent 3 agents (2 workers + 1 critic[verify])
of the 13-remaining cap. 10 agents remain for Phases 2, 3, 5, 6.

Next: Phase 2 (test integrity — integration test for PoC; sub-render
coverage; MONTHLY-beats-WEEKLY precedence test + D013).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…+ MONTHLY precedence (D013)

PRD Phase 2 of 6. Closes belief c006 (PoC 75% untested) and c008
(MONTHLY precedence undocumented). Phase 2 critic[verify] PASS on
13/13 acceptance criteria.

PoC integration (TestMainIntegration × 3):
- test_main_state_blind_path_produces_brief_and_persists: HarloUnreachable
  branch; exit-0; stdout brief; SQLite row with harlo_reachable=0 +
  populated brief_id + phase_anchor_iso; D012 idempotency on re-invoke.
- test_main_family_lockout_path_exits_cleanly: FAMILY_LOCKOUT early-exit;
  exit-0; lockout stdout; no SQLite row created.
- test_main_harlo_timeout_routes_to_state_blind: HarloTimeout degrades
  to state-blind (not crash); exit-0; state-blind brief.
All use tmp_path-scoped SQLite; never touch real data/hanna.sqlite.

Sub-render coverage (18 cases across 4 classes):
- TestStateLine (5): state-blind; reachable+non-RED; reachable+RED;
  fallback paths. Each asserts Rule 36 voice cleanliness via the
  _assert_no_directives() helper that scans for "you should/must",
  "I recommend", etc.
- TestApproachingLine (5): no FFs; single FF; sort-by-date; cap-at-3
  (the actual production heuristic — c022 ratifies this clarification
  over the earlier "within-5-days" framing); missing-product graceful.
- TestBlockersLine (5): no blockers; single product; two products;
  multiple blockers on one; missing-product graceful.
- TestComposeBrief (3): state-blind MORNING end-to-end (asserts
  D010 09:00 ET anchor + D012 16-char brief_id + correct
  referenced_products); FAMILY_LOCKOUT (empty anchor + brief_id);
  reachable-empty-payload MIDDAY fallback.

MONTHLY-beats-WEEKLY precedence (TestPhasePrecedence × 3 + D013):
- D013 ratifies the existing branch order MONTHLY > WEEKLY_MONDAY >
  WEEKLY_FRIDAY > daily phases as intentional precedence (preserves
  monthly cadence; first-Monday/Friday-of-month emits MONTHLY).
  Rejected alternatives: prev_phase tracking, merging slots, raise
  on collision (Rule 36 violation). Footer bumped to D014.
- 3 regression tests: 2026-06-01 (Mon + day-1) → MONTHLY; 2026-05-01
  (Fri + day-1) → MONTHLY; 2026-06-08 (non-day-1 Mon) → WEEKLY_MONDAY.

MoE dispatch per D002 + ORCHESTRATOR.md §1:
- 3 workers in parallel: phase2-poc-integration + phase2-sub-render-
  coverage + phase2-monthly-precedence. Each cold-read, self-contained
  briefs. Disjoint test classes (no merge conflicts).
- 1 critic[verify] for Phase 2 acceptance audit: PASS 13/13.

Verified:
- python3 -m pytest tests/ -q → 107 passed (was 83; +24 tests:
  TestMainIntegration 3 + TestStateLine 5 + TestApproachingLine 5 +
  TestBlockersLine 5 + TestComposeBrief 3 + TestPhasePrecedence 3).
- Rule 36 voice: _assert_no_directives operationalized as a real
  assertion (not a comment) — 14 uses across sub-render tests.
- Trailer hygiene: test files (fresh seeds) carry no trailer; D013
  preserves DECISIONS.md format; no model-id in artifacts.
- No production code modified — tests + DECISIONS.md D013 only.

State updates:
- state/beliefs.md: c006 superseded by c020; c008 superseded by c021;
  c020/c021/c022 added (c022 ratifies the cap-at-3 heuristic clarity).

Budget posture: Phase 2 spent 4 agents (3 workers + 1 critic) of the
10 remaining post-Phase-1. 6 agents remain for Phases 3, 5, 6.

Next: Phase 3 (CI/compliance integrity — repoint RULES.md greps;
tighten Rule 35; annotate non-load-bearing rules per D008.7).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

PRD Phase 3 of 6. Closes belief c013 (CI greps targeted nonexistent
python/hanna/ + crates/ paths; green light meaningless). Phase 3
critic[verify] PASS on 11/11 acceptance criteria.

RULES.md compliance recipes now target only existing paths (src/,
scripts/, tests/, docs/); no more "No such file or directory" from
the §"Compliance Checks" recipes. (Prior session had already
repointed these; Phase 3 verified.)

.github/workflows/ci.yml — three substantive changes:

1. Rule 35 name-anchored grep extended from {write,store,author,mutate}
   to {write,store,author,mutate,commit,persist,save,update} (the four
   bypass verbs scout-security-rules M-1 flagged). Adds matching
   octavius. grep for symmetry.

2. NEW step "Rule 35 — enumerated bridge surface (authoritative
   allowlist per D001)" — inline python3 block parses
   `self._call_tool("X"` invocations in src/harlo_bridge.py and asserts
   X ⊆ {status, coach, recall, query_past_experience, patterns}. Fails
   CI on any non-allowlisted name AND fails if zero sites found
   (catches a broken regex). This is the AUTHORITATIVE check; the
   name-anchored grep is now the first line of defense, the allowlist
   is the gate. Verbatim output today:
   `Rule 35 allowlist OK: found tools ['coach', 'patterns',
   'query_past_experience', 'recall', 'status']` — exactly D001.

3. Rule 37 grep extended from {src/, scripts/, tests/} to
   {src/, scripts/, tests/, docs/}. NEW step "Rule 37 — no patent
   topics in commit messages (last 50)" runs `git log -50 --format=%B`
   with a documented exemption pipeline for rule-discussion language
   (Rule 37, grep recipes, patent-topic literal, patent-section,
   "no patent"). Requires `git fetch --deepen=50` first since
   actions/checkout defaults to depth=1.

RULES.md — added the per-rule annotation
`*Not yet load-bearing per [D008.7](docs/DECISIONS.md) — applies on
the session that lands the constrained component.*` to each of
rules 7-17 and 19-33. Rules 1-6 already had it (prior session).
Rules 18, 34, 35, 36, 37 deliberately UNANNOTATED (load-bearing per
RULES.md line 15). Total: 32 annotations now present; fulfills
D008.7's selective-re-adoption promise.

MoE dispatch per D002:
- 1 worker (phase3-ci-rules-hardening; cold-read self-contained brief).
- 1 critic[verify] PASS 11/11.

Verified:
- python3 -m pytest tests/ -q → 107 passed (unchanged).
- YAML parse of .github/workflows/ci.yml → valid.
- Rule 35 allowlist check empirically returns D001's 5 tools, no extras.
- Rule 37 grep against docs/ + commit messages: clean (with exemptions).
- 32 D008.7 annotations counted; load-bearing rules unannotated.
- No model-id strings in modified files; no production code changes.

State updates:
- state/beliefs.md: c013 superseded by c023; c024 added (D008.7
  selective-re-adoption complete).

Budget posture: Phase 3 spent 2 agents (1 worker + 1 critic) of the
6 remaining post-Phase-2. 4 agents remain for Phases 5 + 6 (Phase 4
is main-thread doc cleanup).

Next: Phase 4 (doc-drift sweep — RULES.md §34 to 2-layer, README
Repository layout regenerated, SESSION_01 §G resolved, REVIEW
2026-05-22 model-id removed). Main-thread; 0 agents.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…generated, SESSION_01 §G historical stamp (closes q003/q009/q010)

PRD Phase 4 of 6. Main-thread doc cleanup; 0 agents. Phase 4
addresses the highest-impact drift contradictions surfaced by
scout-docs that survive the prior reconciliations (2e68877 +
8e83296). Closes beliefs c003/c009/c010 conditional gaps + q003 +
q009 + q010.

RULES.md §34 (lines 211-219): rewrites "Enforced at three layers"
to "Enforced at two active layers (Layer 2 was Cut per D008.1;
layer numbering preserved for backward reference)". Layer 2 row
strikethrough'd with a one-line note that the layer collapses into
Layer 3. Layer 3 annotated as "Currently deferred to the L6
mcp_tools lane". Closing sentence updated: "Tests verify the two
active layers; the layer-3 test scaffold lands with L6. Bypassing
any active layer fails CI." Resolves the self-contradiction
scout-docs B1 named (line 15 said 2 active; §34 still said 3).

README.md "Repository layout" (lines ~159-188): regenerated against
the actual filesystem. Now includes ORCHESTRATOR.md, state/ (with
during-GOAL note per ORCHESTRATOR §7), src/ (schemas, harlo_bridge,
computations), scripts/, tests/, .claude/ (agents + commands),
.github/workflows/ci.yml, and the full docs/ listing (DECISIONS,
ROADMAP, PRODUCER_LENS, UI_UX_MAP, REVIEW_2026-05-22,
SPIKE_HARLO_EDGE, SESSION_01_RECON). BLUEPRINT version stamp
corrected from v0.1.0-draft to v0.2.0-audit (matches the file's
self-stamp). Nonexistent web/README.md reference dropped per
scout-docs B2.

SESSION_01_RECON.md §G: added a `> Historical note (2026-05-25,
Phase 4 doc-drift sweep)` block at the top of §G explaining that
the recon-time premise was wrong — the 33 rules existed verbatim
in Harlo/CLAUDE.md lines 37–194 throughout Session 01, and Session
01.5 extracted them directly. The recon-time prose stays unedited
below as a session-stamped historical artifact (per q003's default
recommendation: stamp, don't rewrite).

NEXT.md: staleness flag (lines 92-94) reframed from "carry forward"
to "resolved 2026-05-25" pointing at the SESSION_01 §G historical
note.

REVIEW_2026-05-22.md:4: model-id string removed.
"main-thread (Claude Opus 4.7, 1M context)" → "main-thread".
CLAUDE.md prohibits model-id in committed artifacts; Phase 3 CI
grep on docs/ now enforces this — scout-docs MAJOR closed.

Verified:
- python3 -m pytest tests/ -q → 107 passed (no test files touched).
- grep -rE "claude-opus|Claude Opus 4\." across docs/ src/ scripts/
  tests/ + all root .md → 0 hits (q010 default closed by c026).
- grep -c "Not yet load-bearing per \[D008.7\]" RULES.md = 32
  (Phase 3's annotations preserved).
- No production code modified.

State updates:
- state/beliefs.md: c025 (Phase 4 sweep ratified); c026 (model-id
  rule scope answered).
- state/open_questions.md: q003, q009, q010 closed by c025/c026.

Budget posture: Phase 4 spent 0 agents (main-thread). 4 remain
for Phases 5 + 6.

Next: Phase 5 (operational substrate — logging, scheduler,
SQLite PRAGMA, last_stderr surfacing, bin/hanna-brief Python
invocation; 3 agents).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…SQLite PRAGMA (closes c011)

PRD Phase 5 of 6. Backs the README "always-on" claim operationally.
Phase 5 critic[verify] PASS on 16/16 acceptance criteria; 112/112
tests pass (was 107; +5 across TestApplyPragmas + tests/test_log.py).

Worker A — observability bundle:
- NEW src/_log.py — stdlib `get_logger(name)` with UTC ISO timestamps
  (%(asctime)s.%(msecs)03dZ %(levelname)s %(name)s: %(message)s),
  HANNA_LOG_LEVEL env support, idempotent root configuration. No deps.
- NEW src/__main__.py — `python3 -m src status` subcommand emits JSON
  to stdout (hanna/harlo_reachable/harlo_burnout/ts/phase/
  next_phase_boundary_eta_minutes) with logs to stderr; exit 0
  regardless of harlo_reachable (state-blind is operational, not
  failure).
- src/harlo_bridge.py — `get_logger("hanna.bridge")` at module top;
  WARNING on every HarloUnreachable/HarloTimeout raise site (4
  timeout + 2 EOF + others; 6 total in the new path);
  `_log_stderr_tail(where)` helper surfaces the last 10 lines of
  the previously-unread `_stderr_ring` at 12 lane-boundary failure
  sites (the c011-named "diagnostic data no production caller
  reads" — now read AND logged).
- scripts/first_hanna_brief.py — `get_logger("hanna.brief")` + INFO
  at _phase_now/_read_harlo/_compose_brief/_persist/main exit;
  WARNING + bridge.last_stderr() tail loop in both HarloUnreachable
  and HarloTimeout branches of _read_harlo. NO logging in
  src/computations/* (preserves pure-function discipline per Rule 36).
- NEW tests/test_log.py — 3 tests (get_logger format; status
  subprocess JSON contract; _read_harlo logs WARNING with stderr
  tail on Unreachable via caplog).

Worker B — durability + scheduling bundle:
- scripts/first_hanna_brief.py — NEW `_apply_pragmas(conn)` helper
  (lines 59-69) executing journal_mode=WAL + synchronous=NORMAL +
  busy_timeout=5000 + foreign_keys=ON; called at top of _persist()
  immediately after sqlite3.connect. SCHEMA constant untouched;
  idempotent re-application; second-writer race no longer immediate
  SQLITE_BUSY (closes scout-security-rules M-3 + c028).
- bin/hanna-brief.command — Phase-2 swap: body now invokes
  `python3 scripts/first_hanna_brief.py` from $REPO_ROOT with
  PYTHONPATH set, tees output to ~/Library/Logs/hanna-brief.log
  (macOS) or data/hanna-brief.log (Linux), propagates Python exit
  code via PIPESTATUS. Comment header updated to mark Phase-2 as
  current (Phase-1 static-HTML mockup preserved as historical).
- NEW bin/com.hanna.brief.morning.plist — launchd agent demonstrating
  the MORNING schedule (Mon-Fri 09:00, RunAtLoad=false, Label
  com.hanna.brief.morning, StandardOut/ErrorPath to
  ~/Library/Logs/hanna-brief.{stdout,stderr}.log). Valid XML;
  parses cleanly via plistlib. XML-comment header documents
  install/load/verify/unload commands. MIDDAY/EVENING/WEEKLY_MONDAY/
  WEEKLY_FRIDAY/MONTHLY siblings are catalogued follow-ons.
- NEW bin/README.md — 31 lines; install/load/verify flow for the
  launchd agent + manual launcher test + D011 macOS-only note;
  Rule-36 voice (descriptive, not directive).
- TestApplyPragmas × 2 — disk DB round-trips journal_mode='wal'
  after _persist; monkeypatch counts _apply_pragmas call.

MoE dispatch per D002:
- 2 workers in parallel (phase5a-observability + phase5b-durability-
  scheduling) with strict file-ownership demarcation (Worker A:
  src/_log.py + src/__main__.py + src/harlo_bridge.py logging +
  scripts/first_hanna_brief.py logging hooks; Worker B: scripts/
  first_hanna_brief.py _apply_pragmas + bin/). Zero scope collision
  verified by critic[verify] criterion 16 (`grep -c "import logging
  |get_logger|logger\." src/harlo_bridge.py` = 13, all Worker A;
  bin/ + _apply_pragmas have no logging additions, all Worker B).
- 1 critic[verify] PASS 16/16.

Verified:
- python3 -m pytest tests/ -q → 112 passed in 0.63s.
- PYTHONPATH=. python3 scripts/first_hanna_brief.py → exit 0;
  FAMILY_LOCKOUT path (Saturday 2026-05-30, expected).
- PYTHONPATH=. python3 -m src status → valid JSON, exit 0.
- xmllint --noout bin/com.hanna.brief.morning.plist → exit 0.
- Rule 35 enumerated bridge-surface allowlist still passes
  (Phase-3 CI check); the D001 5-tool set preserved.
- Trailer hygiene clean; no model-id; stdlib only (no new deps).
- Rule 36 voice in log messages: surface, don't decide.

State updates:
- state/beliefs.md: c011 superseded by c027 (always-on now
  operationally backed); c028 added (SQLite PRAGMA hardening
  closes scout-security-rules M-3).

Budget posture: Phase 5 spent 3 agents (2 workers + 1 critic) of
the 4 remaining post-Phase-4. 1 agent remains for Phase 6.

Next: Phase 6 (data hygiene — ProductFile.parse validation
tightening per scout-code-quality M1; sub-render contract docs;
SQLite retention/cleanup policy outline). Single worker; main-thread
verify.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…e + sub-render contract + retention outline

PRD Phase 6 of 6 — the cycle's final implementation phase + EXIT
gate. Closes scout-code-quality M1 (ProductFile.parse silent-
coercion gaps); strengthens c022 from empirical-only to documented;
117/117 tests pass.

ProductFile.parse() — Rule-36 faithful-surface per c029:
- Unknown `## X` section headers now emit a `hanna.schemas` WARNING
  via src/_log.get_logger (skip behavior preserved; drop made
  visible).
- Duplicate frontmatter keys raise ValueError (was: second silently
  overwrote first).
- Empty-content bullets (`-` or `- `) are explicitly dropped (was:
  included as empty strings).
- 64KB input cap raises ValueError on oversized input (matches the
  stderr-ring 64-line discipline; product files aren't expected
  large).

Sub-render contract — c030 documents what c022 named:
- scripts/first_hanna_brief.py module docstring §"Sub-render contract"
  states: each helper carries its own trailing punctuation; composer
  joins with single space; empty-signal returns "" so the space-join
  collapses cleanly. Future composer extensions can cite the contract
  rather than reverse-engineer it.

Data retention outline — bin/README.md gains §"Data retention":
- briefs table is append-only by design; D012 idempotency prevents
  duplicate rows.
- Joe's expected volume: ~10 briefs/week × ~2KB body = ~1MB/year;
  no active retention for first 5 years.
- Future retention hook: `python3 -m src vacuum --keep-days N`
  catalogued for L6+ (not implemented).
- Backup posture: data/hanna.sqlite is gitignored; iCloud Drive /
  Time Machine if Joe wants backups (Hanna doesn't manage backup).
- No SQLite encryption / TDE; corpus is non-sensitive.

Tests added — 5 new in tests/test_schemas.py TestProductFile:
- test_parse_unknown_section_logs_warning
- test_parse_duplicate_frontmatter_key_raises
- test_parse_skips_empty_bullets
- test_parse_input_size_cap_raises
- test_parse_input_just_under_cap_succeeds

MoE dispatch per D002:
- 1 worker (phase6-data-hygiene); orchestrator verifies main-thread
  (budget-exhausted; per-phase critic verify pattern preserved as
  workflow; pytest 117/117 + grep audits substitute for the spawn).

Verified:
- python3 -m pytest tests/ -q → 117 passed in 0.64s (was 112; +5).
- grep verifies: 4 new validation primitives in src/schemas.py;
  "Sub-render contract" present in scripts/first_hanna_brief.py:8;
  "Data retention" present in bin/README.md.
- Trailer hygiene clean; no model-id; stdlib only.

State updates:
- state/beliefs.md: c029 added (ProductFile.parse faithful-surface);
  c030 added (sub-render contract documented).

EXIT GATE WRITTEN — state/gate.md:
- TERMINATION: exit (positive — GOAL satisfied)
- All EXIT_CRITERIA met: 7 scout findings, PRD authored, beliefs +
  open_questions populated, Joe presented + "go" confirmed,
  Phase 0–6 implementation complete, budget 13/13 spent of 20-cap,
  117/117 tests green, all critic[verify] PASS where dispatched.
- FINAL_BELIEFS: c015–c030 list (15 active claims from this cycle).
- OPEN_RESIDUAL: q001 (Octavius IPC; L7), q002 (LockoutResponse;
  high, gates L6), q007 (composition boundary; high, gates L6),
  q008 (scheduler beyond MORNING; medium), q011 (DECISIONS template;
  low), q012 (L5 schema split; medium).

This commit closes the orchestrator's first live GOAL: scout (7
agents) → PRD → "go" → 6-phase implementation (13 agents total) →
critic[verify] PASS at every phase → final EXIT gate.

Next session entry point: L4b dispatch — now unblocked by Phase 1's
D010/D011/D012 ratifications + Phase 2's frame-coalescing regression
test + Phase 5's operational substrate.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…4 sibling launchd .plists + tests

Cycle-1 Line A delivery from the harness PLAN.md. Worker dispatched
per the FORUM-survived proposal (rating 4/5; R1–R5 mitigations baked
in). Critic[verify] is a separate dispatch (next).

Created:
- src/channels/__init__.py — package init.
- src/channels/calendar.py — D006 Calendar channel implementation.
    publish(brief: BriefPayload, calendar_name="Hanna") -> CalendarEventId | None
        Honors D010 (uses brief.phase_anchor_iso as event start),
        D011 (HannaCalendarNotAvailable on non-mac), D012 (idempotent
        lookup by brief_id), D014 (returns None on FAMILY_LOCKOUT).
        AppleScript via osascript with R1 mitigation: body written to
        tempfile + read via `do shell script "cat " & quoted form`
        (escape-safe). R2 mitigation: HannaCalendarPermissionRequired
        raised on osascript -1743 with grant instructions in message.
        R3 mitigation: calendar_name parameterized with "Hanna"
        default; duplicate detection via summary-contains query.
        R5 mitigation: archive() raises HannaCalendarNotFound cleanly
        on missing "Hanna · Archive".
    archive(event_id, archive_calendar_name="Hanna · Archive") -> None
    Exception hierarchy: HannaCalendarError + 4 subclasses.
    `python3 -m src.channels.calendar publish-now` entry point per
        ROADMAP §4 L4b Phase-2 swap target.
    Logging: src._log.get_logger("hanna.calendar") wired at start +
        success (INFO) + failure (WARNING) + idempotency hit (DEBUG).
- bin/com.hanna.brief.midday.plist — Mon-Fri 12:00 ET (D010 anchor).
- bin/com.hanna.brief.evening.plist — Mon-Fri 17:00 ET.
- bin/com.hanna.brief.weekly_monday.plist — Mon 09:30 ET.
- bin/com.hanna.brief.weekly_friday.plist — Fri 16:00 ET.
- tests/test_calendar.py — mocked-subprocess tests covering each
    publish/archive branch + the 4 exception classes.
- tests/test_reconciliation.py — property tests on the
    `calendar_event_uid XOR unpublished_reason` invariant + the 3
    unpublished_reason path tests.

Modified:
- src/schemas.py — CalendarEventId NewType added at line 19 per
    D006/D012 contract.
- scripts/first_hanna_brief.py — SCHEMA gains `calendar_event_uid TEXT`
    + `unpublished_reason TEXT` columns; _persist now applies ALTER
    TABLE migration idempotently (try/except sqlite3.OperationalError
    for the column-already-exists case); main() wires publish() after
    _persist with try/except HannaCalendarNotAvailable + generic
    HannaCalendarError branches; updates the SQLite row with
    calendar_event_uid on success or unpublished_reason on graceful
    failure ("non_macos" / "publish_failed" / "family_lockout").
- bin/README.md — documents the Calendar.app permissions grant path
    (System Settings → Privacy & Security → Automation), the manual
    creation of "Hanna" and "Hanna · Archive" iCloud calendars
    (NOT auto-created per D011), and the 4 sibling .plist install
    commands (launchctl load).

CONTRACT served (per PLAN.md Line A):
- P2 (calendar publish at anchor + idempotency end-to-end on Joe's
    Mac): mocked-subprocess L1 + L2 verifiers pass; L3+L4 require
    Joe's Mac (stochastic per SPEC).
- P6 (reconciliation invariant): briefs row gains the two columns;
    invariant test passes in tests/test_reconciliation.py.
- P9 partial (launchd-side restart survival): 4 sibling .plists
    authored matching D010's full anchor table.

Verifier results (L0+L1+L2 — L3/L4 deferred to Joe's Mac):
- python3 -m pytest tests/ -q → 139 passed in 0.89s
    (117 baseline + 22 new across test_calendar + test_reconciliation
    + Line A's incremental coverage of existing modules).
- L0: src/channels imports clean; all .plist files parse as XML.
- L1: mocked-subprocess tests cover every publish/archive branch +
    each exception class.
- L2: idempotency property holds; reconciliation XOR-invariant holds.

DEADENDS check pre-build: none touched.
LEDGER consultation: `moe-dispatch-d002` (this IS a worker dispatch);
    `pytest-as-l1` (used as L1 verifier).

Trailer hygiene clean: all new files are fresh seeds (no Harlo
ancestor) → no attribution trailer. Existing files keep their state.
No model-id strings. Stdlib-only.

State updates pending (deferred to critic[verify] cycle):
- CHAMPION.md: predicate-score delta (P2: 0.80→0.95, P6: 0.75→0.80,
    P9: 0.65→0.70) — write after critic[verify] PASS confirms.
- LOG.md: cycle-1 Line A row with the delivery summary.
- TRACE.md: branch-decision + verifier-result events.

Next dispatch: critic[verify] on Line A against the FORUM-rated
acceptance criteria; on PASS, champion promotes from 0.27 to
~0.42 (5 predicate-fractions advanced).

Q016 (Octavius reachability) still awaiting Joe's answer — does not
gate this commit.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…s seed-2118024 → arc-cycle1-line-A-a2d64cd (0.27 → 0.435); D016 ratified (Octavius exists on GH, not local); q016 closed, q017 opens

Per harness cycle 1 EXECUTE phase (Builder leads; Critic on call):

1. Line A delivery (commit a2d64cd) verified PASS 36/36 by critic[verify]
   against FORUM-rated acceptance criteria. All R1–R5 mitigations
   visibly present in code; 139/139 tests; L0+L1+L2 verifiers green;
   L3+L4 require Joe's Mac (stochastic per SPEC).

2. CHAMPION promoted per OP6 promotion rule (strict increase ≥1
   predicate; no regression):
   - P2 (calendar publish + idempotency): 0.40 → 0.85 (publish+archive
     lands; mocked-subprocess tests cover every branch + exception)
   - P5 (LockoutResponse on lockout): 0.20 → 0.50 (D014 ratifies shape)
   - P6 (reconciliation invariant): 0.10 → 0.70 (columns + XOR test
     pass at L2)
   - P7 (≥200 tests): 0.59 → 0.70 (139/200)
   - P9 (restart survival): 0.30 → 0.50 (4 sibling .plists land)
   - Champion score: 0.27 → 0.435.

3. Joe's direct reply to q016 — "It exists on GitHub not locally yet" —
   closes q016. F3 (Octavius doesn't exist) is FALSE; L7 IS buildable
   in principle, but two preconditions:
   (a) Joe installs Octavius locally for L7's runtime verifier (P4).
   (b) Hanna learns Octavius's IPC contract — raised as q017 with three
       paths: (i) Joe pastes the contract verbatim; (ii) widen
       mcp__github__* scope to include Octavius; (iii) Joe installs +
       runs once + shares the API shape from real traffic.

4. D016 ratified main-thread per D002 (decisions author-by-main-thread):
   - L7 `src/octavius_bridge.py` lands as a NotImplementedError stub
     until q017 closes; FormationRequest/Output schemas defer.
   - L6's `hanna_formation_request` returns a LockoutResponse-equivalent
     `{ "octavius_installed": false, ... }` JSON until Joe's local
     install completes.
   - Arc CAN terminate at "Hanna is real with Octavius stubbed" if q017
     stays open at SHIP; documented bounded weakness, not a showstopper.
   - DEADENDS-c033 class extends (c035): Linux-sandbox + restricted GH
     MCP scope can't reach external resources outside that scope.

5. State updates (per ORCHESTRATOR.md Invariant 2):
   - state/beliefs.md: c034 (Octavius exists on GH, not local), c035
     (DEADENDS class extension).
   - state/open_questions.md: q016 closed by c034; q017 (contract
     surfacing path) opens.
   - docs/DECISIONS.md: D016 ratified; footer D016 → D017.

6. Harness artifacts updated:
   - state/tasks/hanna-real-arc/CHAMPION.md: full rewrite at the
     post-promotion state; predicate-by-predicate score delta;
     reproduction recipe; gap-to-"Hanna is real" summary.
   - state/tasks/hanna-real-arc/LOG.md: cycle 1 Line A PROMOTE row +
     Line B substrate-decision PROMOTE + Line C-replacement INFORMATION.
   - state/tasks/hanna-real-arc/TRACE.md: 5 cycle-1 EXECUTE events
     (external-call to Joe; D016 branch-decision; 2 verifier-results;
     RECOMMENDED-CHANGES park).
   - state/tasks/hanna-real-arc/DEADENDS.md: c035 class generalization.

3 RECOMMENDED-CHANGES from critic[verify] parked (cosmetic):
- json import scope in src/channels/calendar.py (cosmetic).
- AppleScript date constructor locale dependency (English-only %A/%B
  in _format_applescript_date).
- _RECONCILIATION_MIGRATIONS runs on every _persist call (silently
  absorbs duplicate-column OperationalError; cheap, but a PRAGMA
  table_info precheck would be tidier).

Budget posture: cycle 1 spent ~3 agent dispatches (Line A worker +
Line A critic[verify] + the dead Line C spike replaced by free
AskUserQuestion). 47 agents remain in 50-cap arc budget.

Cycle 2 entering: REORGANIZE — re-derive lines from CHAMPION state.
Candidates:
- Line B Phase 2: JoeStateSnapshot schema authoring (deferred from
  cycle 1).
- Line D opens (was held): L6 mcp_tools partial — author the 5
  read-shaped tools (status / morning / midday / evening / weekly_*)
  that don't depend on Octavius; defer hanna_formation_request.
- New Line F: L7 octavius_bridge.py stub authoring per D016.
- q017 resolution: AskUserQuestion to Joe re contract-surfacing path
  (free info; no agent cost).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>

…ion; Lines B-cont/D/F open

Per harness REORGANIZE phase at cycle boundary:

q017 closed by Joe's reply (c) "install + share traffic":
- closed-pending-action state — Joe's manual install is async; Hanna
  proceeds on lines that don't depend on Octavius's actual contract.
- belief c036 records the path choice and the gating relationship.

Cycle 1 receipts:
- Line A: DELIVERED + PROMOTED (champion arc-cycle1-line-A-a2d64cd;
  critic[verify] PASS 36/36; champion score 0.27 → 0.435).
- Line B: PARTIAL — D014 + D015 ratified (q002 + q007 closed);
  JoeStateSnapshot deferred to cycle 2; Override + Formation deferred
  farther pending q014 + q017.
- Line C: CLOSED — died on FORUM, replaced by Joe's free-info reply
  via AskUserQuestion → D016 ratified; q016 closed; q017 raised then
  closed-pending-action.
- belief c037 records cycle 1 closure.

Cycle 2 line structure (PLAN.md updated):
- Line B-cont: JoeStateSnapshot schema authoring (deferred from
  cycle 1; light worker; rating 3/5).
- Line D (OPENED — was held): L6 mcp_tools partial — 9 of 10
  hanna_* tools that don't depend on Octavius;
  hanna_formation_request returns a D014-shaped
  `{available: false, reason: "OCTAVIUS_NOT_INSTALLED", ...}` stub
  until q017's pending-action completes (rating 5/5).
- Line F (NEW): L7 octavius_bridge.py stub authoring per D016 —
  OctaviusNotInstalled exception (NOT bare NotImplementedError) +
  mocked-subprocess tests against the BLUEPRINT §9 stub shape
  (rating 2/5).
- Line G (CONSIDERED, DEFERRED): q014 secret-storage substrate
  D-entry for OverrideToken — high-leverage but not arc-terminal;
  defer to cycle 3 unless a forcing function surfaces.
- Lines A, C: RETIRED.
- Line E (INTEGRATE+STRESS+SHIP): still held — gates on D ship +
  Joe's install step.

Cycle 2 critique-before-build (FORUM):
- Line D: R1 (composer-extraction refactor risk), R2 (composition
  state leak on tool error), R3 (formation_request stub renders as
  error — F6-class), R4 (APPEND-ONLY race with Joe's editor). All
  mitigations folded into the upcoming worker brief.
- Line B-cont: cycle-1 critique stands; `extra` field for
  forward-compat.
- Line F: R1 (use OctaviusNotInstalled, not bare NotImplementedError),
  R2 (BLUEPRINT §9 as stub source-of-truth; real-shape lands
  post-q017).

Mode re-derived: ORCHESTRATED TEAM preserved (BREADTH=3,
INDEPENDENCE=medium, HORIZON=long, REWORK COST=high,
VERIFIER COST=medium). HYSTERESIS rule honored.

Suggested cycle 2 dispatch ordering: B-cont + F in parallel (small,
disjoint files); D as the largest single dispatch; critic[verify]
over all three at the end. Budget estimate: ~7 agents
(3 workers + 1 critic[verify] x 3 with possible integrator if
parallel writes conflict).

Budget posture: cycle 1 spent ~3 agents (Line A worker + Line A
critic[verify] + the dead Line C spike replaced by free
AskUserQuestion + main-thread D014/D015/D016 ratifications). 47
agents remain in 50-cap arc budget; cycle 2 estimate keeps 40+
in reserve.

State updates:
- state/beliefs.md: c036 (q017 closed-pending-action), c037
  (cycle 1 closed).
- state/open_questions.md: q017 status → closed-pending-action.
- state/tasks/hanna-real-arc/PLAN.md: cycle 2 reorganization;
  3 lines open + 1 considered+deferred; per-line ranked queues;
  REORGANIZE triggers carried.
- state/tasks/hanna-real-arc/LOG.md: cycle 1 close row + cycle 2
  open row.
- state/tasks/hanna-real-arc/TRACE.md: 6 cycle-boundary events.

Cycle 2 enters DELIBERATE-complete → EXECUTE-ready state. Awaiting
go-or-redirect signal to dispatch the 3 worker briefs (B-cont, D, F).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>