Health

• iss-11agent count drift: 01-agents.md declares 16 agents; press-release, 04-scope and 05-prompt-quality still say 15.
• iss-47generated CLI reference with a drift test: generate the verb reference pages from the cobra command tree and wire a go test that fails when the committed pages drift from the tree — replacing the phantom freshness gate that docs/reference/cli/README.md currently claims (see phantom-enforcement-claims). A sibling project runs exactly this shape: generated CLI docs gated by a drift check inside the normal test run. Acceptance corpus: the reference pages that do not exist today; the drift test is proven by regenerating after any verb change.
• iss-58history capture requires a bootstrapped ~/.abcd/history store, so the autonomous run cannot dogfood transcript capture until ahoy install runs on this repo (ahoy doctor: 12 detection gaps). Also the error says 'run abcd install' but the real verb is 'abcd ahoy install' — misleading remediation text.
• iss-69frontmatter canonical consolidation + delimiter bug: internal/core/lint (frontmatterFields) and internal/core/memory (parseFrontmatter/splitFileFrontmatter) each carry their own frontmatter scanner instead of internal/core/frontmatter — migrate both, behaviour-preserving, separate refactor commit (seed1); note memory needs nested-map values (source:) the flat scanner lacks — widen or scope. Bug: the canonical scanner closing-delimiter check compares the CR-trimmed line to exactly triple-dash, so a closing triple-dash with a trailing space/tab is not recognised and body lines leak as fields — TrimRight before both delimiter checks (frontmatter.go:37, C5). Corpus: the two lint/memory copies + the delimiter case.
• iss-71capture ledger concurrency + unvalidated ForceID: transition() (resolve/wontfix) takes no flock (only reservePath does) so two concurrent conflicting transitions on the same iss split-brain it across two status dirs — permanent corruption, findIssue then always ErrDuplicateIssueID (workflow.go:129, C4); reservePath builds a path from and O_EXCL-creates a placeholder for ForceID BEFORE validateStrict checks it against the iss-id regex, a pre-validation filesystem touch/traversal (alloc.go:91, P13). Detector: hold the ledger flock across findIssue+commitTransition; reject a non-matching ForceID before any filesystem op. Corpus: C4, P13.
• iss-106GL002 stripInlineCode restores the whole line on an unpaired trailing backtick (and mishandles double-backtick spans), so a closed code span containing an enforced synonym plus a later stray backtick fires a spurious blocker — fails toward over-flagging, never misses drift; found by burst-5 correctness review, not present in current corpus
• iss-107ahoy install --visibility <v> --yes reports 'already up to date' without applying the explicitly requested visibility on an already-configured repo: skip-if-set beats an explicit flag — stepConfigValues short-circuits when repo.visibility is validly set (internal/core/ahoy/apply.go:196) and ValueOverrides are only consulted on the config-gap path (apply.go:179->220), so the flag silently no-ops; an explicit flag value should either apply as an update or error loudly, never silently skip (maintainer hit this from another repo and hand-edited its config)
• iss-135WalkFiles start-boundary divergence for a non-dot start: a start dir named in the skip set would now be walked and a regular-file start returns nil; unreachable today (both callers pass dot) — flag for any future caller passing a non-dot start
• iss-145receipts gate process integrity, not maintainability: candidate principle surfaced by the 2026-07 software-factories critique (primary observation: RL rewards fast oracles — tests pass in seconds — while bad architecture's cost function is measured in months, so maintainability has no fast oracle and models are not penalised for eroding it). Consequence for abcd: no receipt or deterministic gate can certify design quality; that verdict stays human (verifier-selects-gates-decide), and the maintainer merge on every PR is load-bearing, not ceremony. Candidate homes: a principle file or a brief mental-model line; adoption is the maintainer's call.
• iss-149The positioning check bounds each surface read to 1 MiB but nothing bounds the number of surfaces a committed registry may declare, so one abcd audit run over a hostile repo can be made to hold an unbounded multiple of that cap. Detector: a Config.Validate test that refuses a registry declaring more than a fixed surface count.
• iss-166ahoy install --yes silently skips the optional identity-pin category: the flag is documented as approving every resolvable change category without prompting, and it reports 'already up to date', yet the interactive path still offers the optional pin (.abcd/config/identity.json). Either --yes covers optional categories too, or its help and the completion output must say optional categories are excluded and how to apply them.
• iss-173three-tier-layout's local-artefact placement check matches exact names directly under a committed tier only — residual evasions flagged at review: a nested artefact (a NEXT.md one directory below a tier root), a NEXT.md at the .abcd/ root itself (one directory off the modelled incident), and lowercase name variants on case-sensitive filesystems all pass clean. Widening (depth, roots, case folding) must not start flagging legitimate tier content.
• iss-212The attribution gate merged in PR #217 is dead scaffolding until it is added to the branch's required status checks, and it is not there. Verified 2026-08-11 after the merge: main's required contexts are still check (macos-latest), check (ubuntu-latest), gitleaks, record-lint, smoke, zizmor — no "attribution" — and enforce_admins is false. The workflow runs and reports green on every pull request, so the repo now LOOKS gated while nothing is actually blocked; that is the false green the loud-staging principle refuses, and it fails the "wired or it isn't done" boundary the same way (no dead scaffolding). The gate was built precisely because the maintainer said it must be certain they do not have to check for attribution drift by hand; in its current state that certainty does not exist, and the appearance of it is worse than the previous honest absence.
• iss-214The attribution gate refuses a legitimate, exact model identifier: TRAILER_RE ('^Assisted-by: [A-Za-z][A-Za-z0-9._-]*:[A-Za-z0-9._-]+$', scripts/check-attribution.sh) has no bracket in its character class, so 'Assisted-by: Claude:claude-opus-5[1m]' FAILS while 'Assisted-by: Claude:claude-opus-5' passes. Verified 2026-08-11 by running the script's own body check over seven trailer variants. The bracketed form is not a typo — it is the exact identifier of the 1M-context Opus variant, and 'git log' shows 33 commits in this repo's own history already using it (claude-opus-5[1m] x33, claude-opus-4-8[1m] x5). The convention AGENTS.md:132 and CONTRIBUTING.md:31 state is to name the model VERSION, so an agent that reports its precise identifier is following the prose and failing the gate. Consequence is a PR blocked mid-run for correct disclosure, and the obvious workaround — silently truncating the suffix — degrades the very disclosure the trailer exists to provide, since [1m] distinguishes a materially different model configuration. This will bite an autonomous multi-agent run, where the failure surfaces as a red gate on a PR nobody is watching. Fix direction: widen the version half of TRAILER_RE to admit a bracketed context suffix (e.g. allow a trailing '\[[A-Za-z0-9._-]+\]'), rather than asking contributors to drop it; and add the two historical forms to the script's own test corpus so the regex is proven against identifiers actually in use rather than only against the happy path. NOT a defect, recorded here so it is not re-raised: the gate's rejection of a bare 'Assisted-by: Claude' with no version (9 commits in history) is CORRECT — the convention requires a model version, and those nine commits are non-conformant record rather than gate error. History is not re-checked; the gate runs on pull requests only.
• iss-219ahoy dev-install tests read the host PATH: a stale installed abcd (e.g. the July dev shim in ~/.local/bin) makes the four install-mode tests fail with an unexpected '(shadowed on PATH)' suffix, so make preflight blocks pushes from any machine with abcd installed. The tests should run against an isolated PATH.
• iss-222ahoy install --dev against an existing unowned track-latest wrapper at the target path performs no bin write, reports no symlink/shadow gap, and leaves install_mode empty — a silent no-op where loud staging requires either adopting the equivalent wrapper, refusing with a named gap, or reporting the skip on the result
• iss-224ahoy install --yes returns status=partial with remaining symlink.missing but emits no note explaining the refusal (unwritable /usr/local/bin); declined_categories is null and notes are absent, so the user cannot tell why the symlink was skipped or what to do next
• iss-226ahoy skill doc documents a --bin-dir flag for ahoy install/uninstall, but the binary rejects it (unknown flag); the documented escape hatch for an unwritable default bin dir does not exist
• iss-235The review lenses are scattered as separate agent TYPES (abcd:ruthless-reviewer, abcd:security-reviewer, and the persona-lens as an ad-hoc prompt) rather than a single surface. Consider consolidating them under one verb: bare /abcd:review lists the available lenses; /abcd:review --ruthless / --security / --persona (and future lenses) runs a named one. A single verb is easier to discover, keeps the lens set in one registry, gives cloud routines a stable fallback (the verb hand-loads the lens prompt when the plugin's agent types are unavailable — the 2026-08-16 canary found the abcd:* agent types do not resolve in a routine session), and matches how the other surfaces are shaped as verbs. Half-formed (maintainer thought): naming and whether lenses stay agent-backed under the hood are open.
• iss-242abcd intent --json reports bucket counts and spec links only — no per-intent listing. A planning sweep over drafts/ (which intents are plannable vs seeded-placeholder AC, filed when) required shell-grepping 55 files and git history. The verb wants a list mode with per-intent id, title, bucket, ac_state (seeded|real), and filing date; the seeded placeholder is a stable string, so ac_state is cheap.

Not a fault: the record on the left replaced the one on the right

• adr-22 → itd-47Oracle-Backed Gates Pass Honestly Without A Human In The Loop
• adr-26 → itd-49Flow-State Drift Becomes Visible Before It Compounds
• adr-32 → adr-12`.work/issues.md` stays the live operational ledger; the structured per-issue store is deferred until the native spec layer schedules the migration (historical)
• adr-37 → itd-72Publishing A Release Is One Atomic, Refusable `ship`
• adr-54 → itd-141docs-lint enforces the writing style guide's machine-checkable rules: an em dash inside a list item, a lower-case letter opening a list lead-in after its colon, and a capital letter after a semicolon are flagged as findings, with code spans and fenced blocks masked, so the canonical style guide's machine-enforceable subset is a shipped gate rather than a review habit — and the guide marks a rule machine-enforced only once its lint ships
• adr-2609021016286571 → adr-58A reading is commissioned about something, so the invocation takes a scope
• adr-2609090717039680 → adr-29A native local redacted transcript corpus
• adr-2609091248200336 → adr-2609091014087993A tool never creates directories in user-owned project space; agent and session scratch is machine-scoped
• adr-2609091248201071 → adr-2609090717039680The transcript corpus is a sibling store that creates itself, and the per-repo location is an opt-in pull
• adr-2609151706587280 → adr-46Persisting the hook binary never weakens the verification posture — every promotion re-verifies, and SessionEnd performs no network work
• adr-2609212115255771 → adr-9Phase as a product-reflection layer between brief and intent
• adr-2609292012006845 → adr-2609212115255771Phases and milestones are retired: sequencing is dependencies rendered as status, the checkpoint is the derived release
• adr-2609300107513982 → adr-2609221009491186A provider adapter serves only the models it lists, under a vendor denylist no listing overrides; everything else runs on the host
• adr-2610031751065746 → adr-2609091248200336A tool never creates directories in user-owned project space; the store's location binds now and its verbs bind when the store ships
• adr-2610031751066232 → adr-2609091248201071The transcript corpus is a sibling store that creates itself through the canonical directory primitive
• adr-2610110925465593 → adr-2609151138420062The decisions log is a folder of minted records, not one appended file
• adr-2610290238168123 → adr-2609231028044006Shape claims in the brief's surface chapters are derived, never hand-authored
• adr-2610300908239458 → adr-2610142116480836Ideate verdicts are private or public by the person's choice, and an idea's source is named publicly only when it graduates
• itd-31 → itd-32Every Audit In Abcd Knows What It Audits, By What, And Against What
• itd-48 → itd-31The Brief and Every Intent Stay Consistent — Or Abcd Tells You Why They Don't
• itd-94 → itd-27Domain Experts Get Their Intents Grilled Before Anyone Codes Them
• itd-121 → itd-20`/abcd` Tells You Where You Are
• itd-163 → itd-145An adopted idea cannot ship uncredited: abcd enforces its own acknowledgement convention mechanically, so a record that cites an external source, standard, or tool without a matching ACKNOWLEDGEMENTS entry fails the record gate and names what is missing. 'Credit in the same change that lands it' stops depending on the author remembering. Seeded by a real miss in this repo: the maritime signal-flag standard the livery logo encodes and the NO_COLOR convention the colour ladder implements both shipped before their credit landed, and nothing caught it.
• itd-2609091034175565 → itd-33Multiple Agents Coordinate On Intent And Spec Work Without Duplicating Effort Or Producing Competing Artefacts
• itd-2609201916056194 → itd-2In-Session Subagent Dispatch — the Default Host-Delegated Oracle
• itd-2609201916151817 → itd-29Domain Experts Run A Spec Autonomously And Recover From Anything Without Touching Git
• itd-2609201916151817 → itd-58A Real Reviewer's SHIP Verdict Reaches The Session Gate Through A Channel The Worker Cannot Forge
• itd-2609221009495079 → itd-17Pick the Right Oracle for the Job, Automatically
• itd-2610030810350727 → itd-110The grill interview renders with clear structure and colour instead of a wall of prose: each question visually separated, the decision point, options, and the recommended answer distinctly styled, progress through the design tree visible, so the person being grilled always knows what is being asked and where they are
• itd-2610030810350727 → itd-2609151541116052During the peer-listing planning interview on 2026-09-20, the agent listed the rewritten acceptance criteria in prose and then asked, through the interactive question view, whether the criteria were the product thinker's. The prose was not on screen while the question showed, so the product thinker was asked to confirm text they could not see (iss-2609202058058301). A confirming question has to carry what it confirms.
• itd-2610032150577708 → itd-139Carol's team adopts abcd and gets a readable record the next day, without writing a line of site code
• itd-2610032150577708 → itd-2610032150580455The dashboard from anywhere, through Tailscale
• itd-2610091016262335 → itd-2610052000411162Anyone can open, edit on their own device and submit the brief of a public abcd-managed project on abcdesign.app
• itd-2610091016262335 → itd-2610052000424067A group works on one public project's brief together on abcdesign.app, adds notes, and exports the combined work
• itd-2610170634394993 → itd-2609150819440345Which session holds which worktree, branch or record is coordinated entirely by conversation, so every new session repeats a handshake that nothing records. A session joining work in progress has no way to ask what is already claimed: it messages the peers it can see, waits for replies, and rebuilds a picture that the sessions before it had already built and did not write down. One measured encounter cost four messages and about fifteen minutes before any work began, and the picture it produced is not durable, so the session after that pays again. The convention that a diff you did not make is a peer's work depends on knowing who the peers are and what they hold, which is precisely the thing no artefact carries. The repository already records this gap for the narrow case of detecting a peer session before mutating git state; the wider case is claim rather than presence, and the two want the same substrate. Whatever holds it should be as cheap to write as it is to read, because a coordination record nobody updates is worse than the chat it replaced.
• itd-2610222214476887 → itd-118Merged work leaves no residue: abcd-managed repos delete a PR branch on merge, and abcd tidies the stale local branch, tracking ref, and worktree
• itd-2610261025516272 → itd-115A Ready PR Merges Without Ever Wedging BEHIND
• adr-22 → adr-14not in the tree
• adr-22 → adr-15not in the tree
• adr-22 → adr-17not in the tree
• adr-25 → adr-8not in the tree
• adr-27 → adr-16not in the tree
• adr-28 → adr-18not in the tree
• adr-35 → adr-4not in the tree