striatum RFCs

This directory holds the Striatum RFC index. Engram/incubation references are historical fixtures only; they are not the product decision record for the runner.

RFCs here are for contested or cross-cutting striatum design changes: workflow semantics, review gates, artifact contracts, adapter behavior, and run-state policy. Accepted RFCs should update docs/decisions/decision-log.md and, when behavior changes, docs/reference/spec.md.

Index

RFC	Status	Topic
0001	accepted	Turn the RFC 0014 dogfood fixes into a runner RFC.
0002	accepted	Make reviewer access scope and context policy explicit workflow fields.
0003	accepted	Add support ledgers and evidence-audit jobs for claims made by artifacts.
0004	accepted	Normalize review action items and require resolution checks.
0005	accepted	Use runner events to propose harness improvements, gated by review.
0006	superseded / historical	Forward-only pre-D094 SQLite migrations keyed off PRAGMA user_version; current live state is daemon-owned PostgreSQL and the old migration fixtures are deleted.
0007	accepted	Export workflow graphs for authoring and review.
0008	accepted	Opt-in per-job Git worktree isolation for parallel repo-write jobs.
0009	accepted	Architecture for V2 supervised agent processes that span multiple work packets.
0010	accepted	Add tool-specific harness profiles for native delegation and provider features. V1+V1.5+V2 implemented (D056).
0011	accepted	Explicit session-close CLI plus auto-close of active sessions on run-terminal transitions.
0012	accepted	Local HTTP / Unix-socket API. Historical V1 shipped on top of striatum.api.invoke with SSE for events; current production daemon-mapped reads/mutations route through daemon RPC under RFC 0070.
0013	accepted (V1+step 7)	Static SPA bundled with the runner, served by striatum serve --web. V1 (D059, dogfood-007) shipped read-only views; step 7 (D065, dogfood-013) shipped mutation buttons (verdict, decision, checkpoint resolve continue/cancel, requeue stale review-only) over the existing RFC 0012 mutation gate.
0014	accepted	Post-exit output validation, configurable timeouts, and liveness reconciliation for one-shot adapter run. V1 implemented (D057). Closes #1.
0015	accepted (V1+step 3)	striatum skills install generates a self-contained agent skill bundle for any installed agent CLI. V1 (D061, dogfood-009) shipped Claude Code + generic profiles; step 3 (D063, dogfood-011) shipped Codex + Gemini profiles + --profile all.
0016	accepted (V1+step 3)	Render the run's dependency graph inside striatum dashboard and run graph --format ascii. V1 (D060, dogfood-008) shipped layered/list ASCII + state colors; step 3 (D064, dogfood-012) shipped Unicode fancy style + --graph-orient {tb,lr} left-to-right layout.
0017	accepted (V1)	Slim the README to ~250 lines, split human and coding-agent quick starts, and move behavior-model / sequential-usage / dogfood-history / per-RFC subsections / command reference into dedicated docs/ files. V1 implemented (D062) under dogfood-010.
0018	accepted (V1+step 3)	Declare review-job posture (security, threat_model, devils_advocate, etc.) and per-build required_review_postures so workflows can require focused adversarial coverage. V1 (D069, dogfood-016) shipped steps 1+2: validator + packet exposure + workflow-validation reachability gate (re-cast from runtime gate per V1_ACCEPTANCE). Step 3 (D071, dogfood-018) shipped verdicts.posture column + introspection surfacing across status, run-summary, evidence-export, run-graph json, dashboard, and web UI.
0019	accepted	docs/reference/domain-driven-design.md (D067) documents striatum's DDD framing — bounded context, ubiquitous language, aggregate roots, value objects, domain events, and the daemon method vocabulary as the current write boundary — so readers see why the vocabulary is load-bearing rather than reverse-engineering it.
0020	accepted (V1)	recovery auto one-shot sweeper + recovery_policy workflow block + escalation hooks (marker_file, webhook, shell) + recovery watch foreground scheduler over daemon recovery.sweep. V1 closes after dogfood-014 (steps 1+2, D066) and dogfood-015 (step 3, D068).
0024	accepted (V1+V1.5+later UI slices)	Workflow browser + visual builder. V1: /workflows/ lists every **/workflow.json in the repo with validation status + SVG graph thumbnail; /workflows/<path> detail page with full graph + tabular jobs/lanes/roles/edges. New chat tool list_workflows for the closed set. V1.5: form-driven visual editor with widgets for jobs, edges, lanes, roles, posture fields; save runs workflow validate server-side. Later RFC 0038/0045 slices add the React Flow drag-drop editor, chooser, and phase-aware graph editing.
0023	accepted (V1+V1.5)	Web UI chat + codebase browse: provider-neutral chat client (Anthropic Messages + OpenAI Chat-compatible flavors, configured via env vars), read-only /view/<path> file viewer scoped to --repo, inline Markdown rendering for .md artifacts. V1 (D074, dogfood-021): chat lifecycle + provider client + view endpoint + 3-lane review pattern. V1.5 (D075, dogfood-022): six closed-set read-only chat tools (read_file, list_dir, striatum_status, striatum_why, git_log, git_diff) + system-prompt briefing on chat-session creation + bundled fixes (graph-node click 404, doctor problem list, chat double-render).
0022	accepted (V1)	Web UI redesign: server-rendered Jinja2 multi-page (/, /run/<id>, /run/<id>/job/<id>, /run/<id>/artifact/<id>, /doctor), refreshed visual palette + dark mode (via prefers-color-scheme) + system fonts + 4px spacing scale, layered SVG dependency graph with state-colored nodes and click-navigate. V1 (D073, dogfood-020) added Jinja2 as the project's first runtime dep. RFC 0013 V1's hash-routed SPA is superseded; CSP unchanged; JSON API + SSE feed unchanged. Later web slices added inline Markdown and React islands; SVG zoom/pan remains optional future polish.
0025	accepted (V1)	striatum plugin install emits an agent-CLI plugin bundle (Claude Code .claude-plugin/, Codex .codex-plugin/, Gemini gemini-extension.json) wrapping RFC 0015's skill bodies plus five imperative slash commands, an opt-in hooks stub, and a local marketplace fixture. Promotes gemini to first-class. Self-contained per D020; offline generation; no hosted services. V1 ships the three first-class profiles in three landable steps.
0026	accepted (V1)	Make lane-liveness attestation a derived property of an attached supervised-session binding and downgrade unattested bylines to author: operator. V1 ships migration v12, operator labels, publish/verdict gates for review jobs, and status/evidence surfacing.
0027	superseded by RFC 0127 (D195)	Introduce opt-in sealed patch provenance: protected source writes through Striatum, lane scratch workspaces, immutable patch artifacts, hash-bound reviews, apply gate, signed receipts, and a narrow local signed-commit exception for sealed apply. Current code has provenance-mode guardrails plus RFC 0031 daemon apply receipt schema and fail-closed apply authority helpers; full patch mutation remains capability-gated daemon scope.
0028	superseded V1 foundation	Historical optional registry-backed multi-repository read visibility plus foreground sweep process (striatumd): registry, repo add/list/remove, explicit daemon read mode, global dashboard, resources-only daemon MCP, metadata-only audit, and recovery sweep. D087/D094/D104 supersede this for current production behavior: daemon RPC, daemon-owned PostgreSQL, daemon-required CLI/MCP/web clients, and mutation-capable MCP are the active boundary.
0029	accepted (V1 core)	Add striatum recovery resume --blocker-id <id> [--complete] so operators can close out the RFC 0014 process-adapter blocker family (process_outputs_missing, process_review_verdict_missing, process_exit_nonzero, process_timeout_exceeded, process_lost_with_outputs_missing) on repo-write jobs once remediation is on disk. Closes the loop the diagnostic envelope's recovery_commands field already advertises.
0033	accepted (V2)	Pick PostgreSQL for daemon V2 daemon-owned state (resolves RFC 0028 OQ#3 per D086). Accepts system PostgreSQL supplied by the operator; the daemon owns schema, migrations, roles, and audit semantics but does not manage the Postgres lifecycle. The old V1 SQLite-registry cutover spelling is now a retired compatibility refusal per D113. D094/RFC 0043 later extends PostgreSQL to per-repository workflow state; repo-local .striatum/retired-local-state is no longer production authority.
0030	accepted (V2)	Daemon RPC server foundation, language-agnostic envelope, daemon.hello/daemon.welcome version handshake (resolves RFC 0028 OQ#7), capability-bound method registry, audit + request log helpers on the RFC 0033 substrate, and migration path from V1 direct-registry reads to daemon-mediated routing. Spine of daemon V2; depends on RFC 0033.
0031	accepted (V2 foundation)	Move supervisor ownership metadata into the daemon DB, add transition-era supervisor pointers, declare daemon-mediated supervise.* RPC routes, add apply receipt schema, and keep sealed apply fail-closed unless the daemon has explicit apply authority. D094/RFC 0043 moves current production pointer truth under daemon-owned PostgreSQL. Resolves RFC 0028 OQ#2. Depends on RFC 0030.
0032	accepted (V2 slice)	Cross-repository workflow schema (repositories block), daemon-mediated coordination with best-effort consistency on crash, MCP mutation capability vocabulary (read/write/review/claim/apply/admin/recovery) with default-deny gating. Resolves RFC 0028 OQ#4 and OQ#5. The accepted slice landed schema, daemon DB metadata, method scope modes, capability filtering, and mocked lifecycle helpers; full live cross-repo scheduling remains future product work.
0021	accepted (V1+V1.5)	striatum init --with-ddd-layout scaffolds the seven canonical reader-facing DDD documents (docs/{SPEC,PRD,DECISION_LOG,UBIQUITOUS_LANGUAGE,DDD}.md, docs/rfcs/) into the target repo. Mirrors RFC 0015's --with-skills for agent-facing files. V1 (D070, dogfood-017) shipped opt-in literal-copy scaffold. V1.5 (D072, dogfood-019) shipped --ddd-layout-force (overwrite with prior_sha256 audit) and --ddd-layout-dry-run (preview via would_* status vocabulary).
0034	accepted (V1 + web/chat surfaces shipped later)	Add a first-class workflow generator and local template catalog so operators choose workflow shape, lane set, artifact root, and policy options instead of freestyling workflow.json. V1 ships generator core, package-data catalog, CLI/service surfaces, custom-plan compiler, and workflow init --style rewire; RFC 0038 later ships the web chooser and RFC 0036 ships chat-assisted scaffolding.
0035	accepted (V1)	tests/_harness/MultiRepoHarness fixture that boots a daemon + N registered target repositories with ephemeral Postgres so RFC 0032 cross-repo workflow + MCP capability scope behavior can be exercised end-to-end. Covers prepare/lifecycle/crash-recovery/MCP-capability-scope/per-repo-write-scope. V1 (dogfood-037, v1.27.0) shipped.
0036	accepted (V1)	Agent-facing harness for the daemon V2 mutation surface: new striatum-mcp skill teaching the preview-then-write idiom, capability/token lifecycle, denial-vocabulary recovery, and capability scope semantics; plus the RFC 0034 §10 chat-assisted scaffolding tool (generate_workflow_preview + generate_workflow_write) as closed-set chat tools over the RFC 0023 chat surface with operator confirmation enforced before any write. V1 (dogfood-038, v1.26.0) shipped.
0037	accepted (V1)	Web UI ergonomic polish over the RFC 0013/0022/0023/0024 base: run-list filter + duration column; workflows-index filter + last-modified; doctor problem grouping + terminal-run hide toggle; localtime toggle; graph-node hover tooltips; keyboard shortcuts (g r / g w / g c / g d / ?); app.css dark-mode parity; next-actions panel promotion; empty-state copy. V1 (dogfood-039, v1.28.0) shipped.
0038	accepted (V1 + V1.5 web UI integration gaps landed)	Web UI feature additions over RFC 0037 polish: promote Edit affordance; top-level repo tree browser at /view/; /workflows/new chooser wizard over RFC 0034 V1 endpoints; drag-drop React Flow workflow graph editor with structured per-field widgets; Shiki-based syntax-highlighted code viewer for non-Markdown files. Adopts Vite + React + TypeScript per D092 with bundled output shipped in the Python wheel; operator install stays pip-only, contributor-side gains make ui-install / make ui-build / make ui-dev / make ui-test. Islands architecture (Jinja2 page shells + React islands), not full SPA conversion. V1 implemented under dogfood-041. V1.5 web UI integration gaps landed (dogfood-045): placeholder-plugin removal (F1), /workflows/new chooser prop-contract fix (F2), island-shared double-mount fix (F3), Vite output semantics aligned with package-data layout (F4), plus supply-chain hygiene (lockfile, npm audit baseline, dependency tree review). D099 override applied — codex reject (critical, threat_model) overridden via 2-of-3 cross-lane consensus (claude accept_with_findings medium, gemini accept low); codex findings absorbed into RFC 0038 V1.6 follow-up.
0039	superseded by D107 / D111 / RFC 0068	Historical Go-primary daemon plan from D084. V1/V1.5 landed the Go source tree, RPC/db foundations, authorization/audit hardening, and helper-related tests; D107/RFC 0068 restores Go as the production daemon and D111 retires Python daemon selection.
0040	accepted (V1 + V1.5 daemon-dispatch + watcher landed)	MCP-driven dogfood harness for operator sessions: exposes dogfood-lifecycle RPC verbs (run.prepare/start, register-session, supervise.start, claim-next, ack, publish-artifact, verdict, complete, run.summary, evidence.export) as MCP chat tools so the operator AI calls them via structured tools/call instead of bash CLI with hand-copied IDs. The historical SQLite-bound composite tools dogfood.publish_on_behalf and dogfood.surgical_recovery were later removed from the production daemon contract by D110. Daemon-side supervised-progress lease heartbeat. Per-model harness-profile fragments + workflow upgrade verb. V1 (dogfood-040, v1.29.0) shipped operator-side slice; V1.5 (dogfood-044, v1.33.0) shipped daemon MCP tools/call dispatch through the method registry (F1), historical composite atomicity tests (F2/F3), supervised-progress watcher invocation in the daemon supervisor lifecycle (F4), watcher race/signal hardening (F5), and e2e execution-path tests (F6). Codex needs_revision findings from dogfood-044 absorbed into RFC 0040 V1.6 follow-up (TODO item 20).
0041	superseded by RFC 0044 / 0057 / 0119 (historical)	Historical design-shape proposal for Engram as an OPTIONAL memory augmentation layer for Striatum operators. Subsequent RFC 0044 and RFC 0057 keep the hard augmentation-not-dependency boundary: Striatum exports local corpora and must run with Engram unavailable; any context injection needs an accepted opt-in policy.
0042	implemented (re-scoped to Go SSE UI; D224 / #400)	Run-list workflow identity: the Go SSE dashboard now surfaces a curated workflow_name (folded from workflow_snapshots.workflow_id [@ workflow_version]) on every run row — the selected-run card shows a Workflow: line and the sidebar run list shows + filters on it, fixing the opaque run_id/branch-only triage surface. A clickable per-workflow link remains residual (no stable route yet).
0043	accepted / implemented (D094, narrowed by D113)	Make PostgreSQL the sole Striatum live-state substrate and the daemon a hard prerequisite. Retires direct CLI mode and --no-daemon, moves per-repo workflow state into daemon-owned Postgres under repository_id, leaves .striatum/ as scratch, and no longer exposes writable SQLite import commands to operators. Bare daemon opt-out is retired; the old local-state fixtures have since been deleted.
0044	accepted / implemented (Striatum-side V1; Engram consumer out-of-repo)	RFC 0041 Phase 1 implementation spec: Engram as an optional read-only memory augmentation for Striatum operators. Pull-mode ingestion with Striatum-owned redacted JSONL export, Engram-owned ingest-striatum, standalone engram-mcp-stdio MCP server, four read-only retrieval tools, Engram-local memory.* capabilities, and a hard augmentation-not-dependency boundary. Numbering drifts from RFC 0041's 4-phase roadmap: this is Phase 1 read-only, not Phase 3 write-side. Drafted under dogfood-042 Track B. Striatum-side V1 (corpus export) landed under dogfood-046 (v1.35.0): striatum corpus export --since <ref> --out <dir> + new src/striatum/corpus/ module (enumerator, redactor, JSONL writer, manifest) + nine JSONL files + replay-stable hashes + denylist-based redaction + augmentation boundary pinned by regression test. D100 cycle-exhaustion override applied — codex needs_revision (5th codex/codex anti-pattern instance) + gemini needs_revision (out-of-scope Engram-side) overridden by single accepting verdict (claude accept_with_findings low). Engram-side (ingester, engram-mcp-stdio, retrieval tools) remains a separate ~/git/engram/ follow-up.
0045	accepted (V1 + V1.5 follow-up completed)	First-class multi-phase workflow shape. Bumps workflow.json to striatum.workflow.v1.1 with a new top-level phases array, a phase_synthesis job type that gates phase transitions, and validator rules refusing cross-phase dependencies that bypass the synthesis gate. Generator catalog gains a multi_phase shape; Python and Go workflow.generate --shape multi_phase emit V1.1 phase graphs, and workflow upgrade --add-phases infers phases from existing parallel_group clusters. React Flow editor (RFC 0038) renders phases as color-banded horizontal lanes with cross-phase edges visually distinct. V1 workflows continue to validate and run unchanged. V1.5 follow-up closes the phase-jump validator gap, phase/phase_id compatibility, synthesis-job metadata validation, explicit-phase dropdown bypass, and invalid/missing phase display tolerance (TODO item 27).
0046	accepted / landed	Lane evidence guard at publish-artifact. Closes GH #2 + #5 — model-bylined artifacts now require path-specific supervisor artifact_observed evidence when present, with the legacy clean process_executions fallback for wrappers that have not yet reported paths. --allow-no-process-execution --override-rationale "..." records the override in the audit chain and stores artifacts.attestation_override_rationale via PG migration 0008.
0047	accepted / landed	Decision-record propagation. Closes GH #3 — rejected decisions move runs to compromised, supersede accepting verdicts, and accepted decisions can reopen compromised runs to completed; the daemon/Postgres projection is carried by migration 0007.
0048	accepted / completed (v1.49.0-v1.55.0)	Daemon-side substrate migration. Production mapped verbs are PG-native/fail-closed through daemon RPC, CLI_ROUTES fallback is empty, capability-denial and audit-chain guardrails are in place, and the paired STRIATUM_DAEMON_REQUIRED=0 STRIATUM_TEST_HARNESS=1 escape is limited to named fixtures rather than production fallback.
0049	deprecated — overtaken by RFC 0088	Interactive claude lane via MCP control plane. The economics remain interesting, but the v1.48.1 wrapper-auth fix removed the urgent blocker and the remaining PTY/MCP/billing assumptions require an explicit spike before implementation.
0050	accepted / implemented across v1.46.0-v1.48.0	Operator UI rework and provenance honesty. Shared components, dashboard parity, service payload shaping, template extensions, recovery panel, override modal, and provenance-honesty guardrails landed across the UI rework dogfoods; remaining service cleanup is tracked separately under RFC 0061 / TODO 52.
0051	accepted / implemented (D133 default-on)	Auto-finalize jobs from artifact frontmatter. The daemon dry-run/live handler, CLI route, method registry, explicit artifact.auto_finalized / job.auto_finalized events, workflow opt-in live policy, and status/dashboard/web visibility have landed. Global default-on live auto-finalize shipped per D133 (recovery_auto_finalize.go global_default_mode: "live"); the live sweep auto-finalizes unless a workflow opts out via recovery.auto_finalize.enabled=false.
0052	proposed (unblocked, deferred/unscheduled; D225 / #403)	Committee deliberation workflow with arbitration, panels, and adversarial review. N producer roles deliberate to convergence under a named arbitrator before downstream consumers read their output; debate turns are typed front-mattered artifacts (debate_turn, arbitration_ruling, panel_vote, panel_verdict, debate_synthesis) rather than transcripts. Solves reviewer co-blindness (D095–D102) structurally by lane composition rather than RFC 0018 posture labelling. No longer blocked on RFC 0048; schedule as its own dogfood when committee workflow implementation becomes the next priority.
0053	accepted (core escalation surfaces partially landed)	Human principal as escalation-only role + terminology truing. Doc-side fixes, striatum.escalation.v1 validation/linkage, escalation inbox projections, and escalation list/show/resolve landed. Deferred: workflow/schema vocabulary renames (human_checkpoint, waiting_human), full CLI prompt sweep, and any notification rails.
0054	accepted (Phase A shipped)	Day-zero "How to use Striatum" guide. Phase A added docs/USING_STRIATUM.md as an additive guide alongside GETTING_STARTED.md; future edits should keep it aligned with the AI-operator/human-principal model.
0055	accepted (Phase A shipped)	Marketing-friendly README + system architecture graphics. Phase A rewrote README.md with vision-first framing, a Mermaid architecture diagram, honest RFC 0043/RFC 0053 substrate-and-role language, and a demoted docs-link table. SVG polish remains optional.
0056	accepted (Phase A + Phase B shipped)	Consumer-repo directory-structure opinions. Phase A added docs/reference/consumer-repo-layout.md with the recommended .striatum/ scratch, workflow-file, artifact-root, DDD-doc, and dogfood-record layout. Phase B added init --with-striatum-layout for the directory-only striatum/workflows/ plus striatum/<workflow-slug>/ scaffold; workflow files and artifact-root .gitignore policy remain operator-owned.
0058	implemented	Operator progress surface — a small fixed set of operator artifact kinds (operator_brief, work_plan, progress_note) with V1 front-matter schemas, canonical paths under docs/operator/, a cold-start context budget, supersession + closure semantics, and corpus-export readiness for future retrieval consumers (RFC 0041/0044). Replaces the overlapping docs/reference/roadmap.md "State as of" header, docs/handoffs/, and ad-hoc burndown lists; preserves historical operator_report.v1 per-run records. Target-repo adoption remains per-repo scoped with configurable operator_docs_root for local reads. V1 artifact schemas, corpus metadata, and the in-repo docs/operator/ seed landed; V1.5 promotes context-budget warnings to errors and adds striatum operator current-brief. Optional operator-tree init/rotation is deferred outside this RFC.
0057	resolved / implemented (D126)	Striatum Corpus Contract V2 (renumbered from 0052 on merge to avoid collision with the committee-deliberation RFC). Frames the decision surface for the next bump of striatum corpus export: explicit corpus_contract_version, multi-corpus identity (one Striatum installation, many corpus_id values per target repository), per-row stable IDs and content hashes, instance/repository identity, redaction-tier metadata, incremental-export watermarks, validation rules consumers must perform, V1-to-V2 backward compatibility, augmentation-boundary regression coverage for any new entry point, and an optional workflow-level context-injection policy. Scaffold only — names the open questions and the non-negotiable invariants (no import engram in Striatum source, no memory.* capability in the daemon registry, no run-state transition that fails when Engram is unreachable). Closes the Striatum side of GH #17 doc consistency; downstream Engram-side work in ~/git/engram/ remains separate.
0059	implemented	Production SQLite fallback is closed; daemon-owned PostgreSQL is the live-state authority. The legacy local-state package/facades/fixtures are deleted, and remaining retired-local-state handling is refusal/reporting only.
0060	implemented	Single daemon method contract source: Python registry, generated Go registry metadata, generated method tables, MCP descriptors, and CLI routes all derive from contracts/daemon_methods.json.
0061	implemented (residual: optional polish; D245)	Production web/API routes are behind daemon DTO/RPC boundaries (/v1/invoke RPC routing, go/pkg/webservice/); legacy SQLite service helpers are deleted. The load-bearing boundary shipped; only optional service-modularity polish remains, made moot by the RFC 0078 Python-runtime retirement.
0062	implemented (residual: optional polish; D130 / D245)	Escalation list/show/resolve, striatum inbox, striatum.escalation.v1, the typed striatumd.escalation_inbox table, and artifact linkage shipped; D130 closed artifact-only creation link-only. Only optional schema strictness (tighter blocker-payload shape) remains.
0063	implemented	Hardened PTY/process supervision with the Go helper as a narrow runtime, PG lane-liveness attestation, reattach/lost-state reconciliation, and wrapper fixture coverage.
0064	accepted / implemented (D220 / #397; persistence landed, no further lint polish planned)	Workflow risk lint, review-diversity warnings, strict overrides, and same-model refusal landed; durable accepted-risk persistence shipped (runtime migration 0013 workflow_accepted_risks + workflow.accept_risk RPC/CLI); remaining authoring-helper lint polish is tracked in #397.
0065	implemented	UI packaging cleanup, ui-clean, bundle/wheel size gates, dependency cleanup, and monitor-only chunking policy landed.
0066	implemented (core; augmentation-fetch deferred build-on-demand, D221 / #398)	Local archive/replay/corpus verification foundations landed; Corpus Contract V2 / archive-v2 manifest fields shipped per D126 (archive.create writes a V2 manifest; corpus export carries corpus_contract_version: 2 + watermark); only the optional augmentation-reference fetch surface is deferred, tracked in #398.
0067	blocked on product decision	Optional Git/PR integration remains read-only-local-only until commit authority and hosted-provider boundaries are accepted.
0068	accepted	Go production daemon port: supersede D105, make Go the production/default daemon, retire Python daemon selection (D111), keep Python CLI/web clients where useful, and delete the legacy local-state package/facades/fixtures plus the Python daemon and Python MCP wrapper.
0069	implemented (residual: optional polish; D245)	PostgreSQL-only daemon-global surfaces for startup, health, audit, sweep, dashboard-all, Go status, and daemon MCP resources shipped; MCP resource list/read use PG-backed projections and fail closed without pg_conn. Only the optional contract-generated-diagnostics Open Question remains.
0070	implemented (residual: optional polish; D245)	Daemon client/service boundary completion: daemon-side repo.resolve, /v1/invoke daemon routing for mapped reads/mutations, local API/MCP CLI-alias quarantine, and dogfood-composite disposition shipped. The Python-surface cleanup remainder is resolved by the RFC 0078 retirement; only optional legacy-fixture polish remains.
0071	implemented	Operator diagnostics and cutover evidence: authority report, repository cutover report, daemon-doctor repository mirror, and curated authority-matrix drift tests.
0072	accepted (V1 shipped)	Move per-run artifact bodies (findings, syntheses, ledgers, per-job prompts, BUILD_HANDOFF, RUN_SUMMARY) to S3-compatible blob storage with the artifact reference and sha256 anchor staying in daemon PG. V1 infrastructure landed across commits 154fac4 through 4fc41ae: PG migration 0009, Go blob package, adopt-time bucket provisioning, publish/get_content/list_for_run RPC handlers, daemon doctor blob block, blob-aware web viewer, and bulk-migration script. Operator-side run-book in BLOB_TRANSITION.md.
0073	accepted / implemented (GH #26)	Surface the RFC 0072 blob diagnostics block through striatum daemon doctor. The Go HandleDoctor returns a blob block; the Python CLI's read_doctor_pg calls a different handler and never surfaces it, so operators don't see whether the blob backend is configured or reachable. Discovered when two SCOPE artifacts silently published to repo-path during the GH #22/#23/#24 cluster because the daemon binary predated RFC 0072 step 3.
0074	accepted	Expand RFC 0034 workflow templates from a flat shape/lane-set catalog into graph shapes, role packs, and adversary packs. Phase A catalog metadata and Phase B implementation_panel generator support are landed; RFC 0052 still owns full committee-deliberation semantics and richer chooser UX remains future work.
0075	accepted	Tmux-observable MCP agent sessions: autonomous MCP PTY bootstrap, session.report, daemon-owned protocol liveness deadlines, tmux attach metadata projection, fail-closed tmux opt-in, and no-transcript/no-terminal-authority guardrails. Universal tmux-by-default policy for future live-interactive profiles is deferred to a later explicit decision.
0076	accepted	Define a reusable three-lane code and documentation audit workflow: authority/runtime audit, docs/decision drift audit, and operator/adoption audit converge into evidence-backed synthesis and a remediation plan. First run completed through docs/operator/workflows/rfc-0076-code-doc-audit.json with one operator-recovered Claude lane; follow-up work is scaffolded in docs/operator/plans/rfc-0076-audit-remediation.md.
0077	accepted (V1 shipped)	Persist daemon-owned MCP activity timestamps and classify session liveness deadlines for discovery, await-packet, ack, heartbeat, structured question, and escalation states without making tmux output or transcripts authoritative. V1 ships migration 0012, Go activity recording, status/dashboard/supervise liveness projection, and recovery-sweep liveness transition events.
0078	accepted	Make Go the only Striatum runtime in tracked HEAD by porting or retiring the remaining Python CLI, web, workflow-authoring, packaging, test, and documentation surfaces, then adding guardrails that prevent Python product traces from returning. (Accepted 2026-05-25, D134.)
0079	accepted	Make install and daemon lifecycle a designed, documented surface: striatum daemon install generates a portable systemd user unit, make install places binaries + unit + skills and verifies doctor, and an operator daemon runbook replaces cutover residue (socket naming, deleted Python launch paths, undocumented DSN).
0080	accepted	Close the coverage debt RFC 0078 deferred: a reusable Go PostgreSQL test harness, live-PG tests running in CI, restored load-bearing coverage, race/vet/lint/coverage gates, and a write-scope guard that baseline-diffs instead of flagging pre-existing untracked paths.
0081	accepted	First-class conversation/trajectory observability as a read-model projection over existing daemon events (run_event_seq ordering, dialogue/provenance profiles, trajectory export/watch, tmux monitor, a conversation workflow type) without capturing raw provider transcripts (D028).
0082	accepted	Add an interrogation-session construct: bounded, multi-turn, peer-addressed Q&A bound to a live target worker session, so a reviewer can iteratively interrogate a builder's PRESERVED context (not just its artifact). Targeted delivery via a typed work.await_packet envelope, an awaiting_interrogation context-preservation window on the MCP agent-loop, curated provenance (D028) in the RFC 0081 dialogue trajectory, and a required end-to-end intention test.
0083	accepted	Iterated panel review with interrogation: a reusable design→build workflow shape; each loop is fan-out (3 lanes) → synthesis → interrogating-panel review with a bounded revision cycle, using only existing striatum.workflow.v1 fields (D139).
0084	accepted	Interrogable agent-loop attestation + interrogation-log chat UI: accept an awaiting_interrogation agent-loop target for interrogation.open (D141) and serve a run's interrogation thread as a server-rendered html/template chat (D142).
0085	accepted	Tailnet-identity UI authentication, loopback-preserving: opt-in --web-tailscale serves the web UI over a 0600 web-ui.sock gated by Tailscale-User-Login, read-only via an audited GET route allowlist; tailscale serve only, no funnel (D143).
0086	accepted	Multi-party conversation on the MCP agent-loop: a symmetric N-party live conversation (round-robin floor, shared turn-ordered transcript) generalizing interrogation; conversation.{open,say,close,list,show} with crash-safe floor-derived delivery (D144).
0087	accepted (implemented 2026-06-14; D199; frame layer per RFC 0129)	Add a divergent_ideation generator graph shape (diverge under cognitive frames → score/cluster/trap-detect → deepen survivors → final synthesis) plus a "frame pack" authoring input, sibling to RFC 0074 role/adversary packs. Inspired by the MIT-licensed UditAkhourii/adhd skill; borrows its prompt/graph design, not its code. Compiles to ordinary striatum.workflow.v1.1 jobs/phases with fresh-session branch isolation; no daemon method, no vendor SDK, provider-portable across lanes.
0088	accepted	Retire -p/--print/exec for all lanes: every lane becomes a daemon-owned long-lived interactive PTY session (native interactive mode + --continue/resume), driven by PTY stdin-submit. Owned-PTY sessions earn first-class lane-byline attestation (pid + command-snapshot binding), so removing -p does not regress provenance to author: operator. Completes D140 unconditionally; replaces gemini_cli with agy (Antigravity), and deletes the turn-driver + single_shot capability (F42–F45) since gemini was their only consumer. MCP config generated fresh at launch (F45 made structurally impossible). Phased P1 claude → P2 agy/gemini-removal → P3 codex + wrapper deletion.
0089	accepted	Make RFC 0088 agent-loop lanes tmux-backed and operator-attachable by fixing the helper liveness bug first: replace tmux attach-session as the supervised-process proxy with direct tmux session/pane liveness (has-session, pane id, pane pid, start token). Attach clients become observers only; tmux pane text stays private diagnostics and never becomes workflow state, durable provenance, verdict input, byline input, or export content.
0090	accepted	Hardening local workspace security and attestation parity for the local daemon.
0091	accepted	Collapse lane attestation, liveness, and delivery into one deep go/pkg/lanehealth module: a pure Classify(Facts, now) core behind a thin Checker.Check seam, exposing the orthogonal axes lane-bound / alive / lane-liveness attestation / delivery liveness / stall class. Preserves today's wire semantics (LegacyMap + reason strings); deletes the start_token_unverified rule duplicated across the mutation and read paths; the liveness probe is the one injected port while db.Runner stays unported (pgtest + the pure classifier).
0092	accepted	Supersede D028/D151 to permit ephemeral, real-time Server-Sent Events (SSE) streaming of active supervisor PTY logs and real-time dialogue message queues to the Web UI. Raw stdout/stderr terminal streams remain strictly ephemeral scratch data.
0093	accepted (V1 landed)	Name a family of live-collaboration workflow shapes (falsification gate, fog-of-war review, synaptic prune, cross-examination, scribe) composed from the RFC 0082 interrogation + RFC 0086 conversation primitives, gated by a shared substance-gate: an adjudicator role that reads the RFC 0081 dialogue trajectory and gates the downstream commit on whether the dialog did its epistemic work (a constraint extracted, a challenge landed and rebutted) rather than on turns having occurred — the anti-theater mechanism. The preserved-context sibling to RFC 0087's fresh-session divergence; generalizes the one-off RFC 0083 panel shape; adds one collaboration_ledger.v1 artifact and no new daemon method.
0094	partially implemented (D234 shapes + D240 §5 extras; #402 closed) — post_dialog_hook, work-packet type sequencing, the fog_of_war_review / synaptic_prune shapes (at experimental), the Check-B correspondence rubric, ledger v1.1, and the second-adjudicator-on-disagreement gate all landed; the §5 anti-theater regression corpus + live-fixture dogfood and supported-tier graduation (RFC 0105 fixture) remain	Pick up RFC 0093's deferred set: the post_dialog_hook conversation-fixture field (close-time emit-before-teardown that fixes the synaptic_prune liveness race), generator-level work-packet type sequencing (withhold a proposal-typed job until a gate clears, unblocking fog_of_war_review), the two deferred shapes themselves, and adjudicator-reliability mechanisms — a semantic Check-B challenge↔rebuttal rubric + ledger v1.1 and an opt-in second-adjudicator-on-disagreement gate (OQ2) — plus round-robin floor degraded mode and the serialized parallel-interrogation policy. Additive collaboration_ledger fields, no new daemon method/route, no floor primitive, no economy. The PRD for a 3-lane design→build dogfood.
0095	partially implemented (Phases 1-3 landed; deployed)	Make the workflow runtime coherent under needs_revision re-open and multi-reviewer interrogating panels by making the job attempt first-class — leases, queue messages, published artifacts, and verdicts scoped to (job, attempt), with a widened artifact key so a revision can republish the same logical_name. Fixes two independent dogfoods' worth of faults: the #65 cluster (recovery auto-finalize re-completing a re-opened job from the stale prior artifact; duplicate active job lease; no repo-write requeue path; interrogation window collapsing after the first reviewer's interrogation.close) and the Engram-run cluster #84 (revision can't republish same logical_name), #82 (lease transfer without an attempt bump), #81 (closed-but-alive session reclaims a revision job), #75 (parallel same-(role,lane) jobs can't get distinct sessions). Via attempt-scoped recovery, an atomic reopenJobForAttempt + lease.transfer, a panel-owned interrogation window (RFC 0093 OQ4 / RFC 0094 post_dialog_hook), and a closed-session claim guard. Also folds #57 (write-scope correctness), #58 (idempotent submit-review), #60 (register-session --replace). Phase 1 = local fixes (#57/#58/#60/#75/#81 guard), no schema change; Phase 2 = attempt-scoping core; Phase 3 = panel window. Deployment note: #78 (F2 override landed in source but the running daemon predates it).
0097	superseded by RFC 0116 / 0122 / 0124	Make a prepared run execute itself: a striatum run execute --run-id orchestrator (operator-CLI driver first, daemon policy later) auto-provisions + auto-launches the lanes each ready phase needs, advances on completion, holds the panel-owned interrogation window, drives bounded needs_revision cycles, and pauses only at genuine human-decision gates (checkpoints, accept/override, unrecoverable failures) — replacing the ~15 manual register-session/supervise start calls a 3-lane design→build run takes today. Crash-safe/resumable (daemon PG is authoritative). Hard prerequisites: RFC 0095 (coherent attempt lifecycle) and RFC 0096 (lane sandbox) — automation amplifies their bugs. Answers the dogfood paradox: the runner-fixes can't be dogfooded through the broken runner, so RFC 0095/0096 Phase 1 are bootstrapped via subagents; once they land, full orchestrated runs become the default vehicle and RFC 0097 is itself built by an orchestrated dogfood (self-hosting milestone). Lane launching stays daemon-mediated (D094/D005).
0096	implemented (Phase 1 + V2 lane-user launch landed; host-isolation gate = operator-provisioned hardening via a conditional CI job — D244, #87 closed)	Harden the supervised-lane → control-plane trust boundary after a live incident (#87: an agy lane, blocked by the #84 republish conflict, tried to directly edit the daemon PostgreSQL — delete artifact rows, disable the append-only trigger — with the DSN leaked into its pane). Root: same-OS-user lanes could peer-auth to daemon PostgreSQL and inherited too much daemon environment. Landed slices include the explicit lane env allowlist, session-bound lane token, work-tree hygiene, and daemon launch of supervised lanes/tmux through STRIATUM_LANE_OS_USER with sudo -n -u. D244 resolves the residual host-isolation-gate ambiguity: the green gate (make lane-isolation-check, the RFC 0110 T-LANE-ISOLATION-NEG negative control) is operator-provisioned hardening — it fundamentally needs a dedicated PG-less lane OS user, passwordless sudo, and PostgreSQL reject rules that a stock CI runner cannot have — surfaced via a conditional CI job (make lane-isolation-check-ci) that runs the real gate only when the host advertises provisioning (STRIATUM_LANE_ISOLATION_HOST=1) and otherwise skips loudly so a green CI never falsely implies the gate ran. Complements RFC 0095 (motivation); upholds D094/D009/D010.
0098	implemented (ACE graduated supported; slice-4 deferred, D222 / #399)	Successor to RFC 0093 (#89, from the Engram entity-relationship forum run): promote the adjudicated constraint-extraction loop into a first-class shape, where convergence comes not from agreement but from an adjudicator refusing publication once and compiling the objections into binding constraints. Makes RFC 0093's substance-gate refusal productive: a needs_revision verdict is structurally required to emit a typed, sourced constraints[] table (collaboration_ledger.v1.1); the next revision packet receives prior constraints as first-class inputs and discharges each explicitly; final review is a typecheck that fails closed on any undischarged binding constraint instead of re-running the forum. Preserves each objection's lifecycle (raised→…→final_review_verified). 8-phase shape (survey→convener_synthesis→cross_exam→adjudication→revision_synthesis→constraint_discharge_review→spec_publication→final_review). Slices: 1 = ledger v1.1 + productive-refusal gate (no daemon method, also closes #88/#79 for this shape), 2 = generator shape + fixture (needs #84 cycle-aware names), 3 = discharge-verifying final review; deferred = first-class constraint.* objects + coverage metrics. Depends on RFC 0095 (#84) and #66/#77.
0099	accepted / partially implemented (Phases 1-2)	Constrained operator mode (#92): an opt-in profile that limits the AI operator (distinct principal from RFC 0096's supervised lane) to the Striatum control surface — packets/context/expected-artifacts in, repository mutations through a pre-apply scope-checked write verb (the enforcement counterpart to #91's read-only scope-check), capability-gated shell recorded as evidence (RFC 0046), and explicit audited escape decisions instead of ambient authority. Names the honest limit: Striatum cannot forcibly sandbox a process it did not spawn, so this is a cooperative harness contract plus a Striatum-side mediated surface. D005 made enforceable. Phase 1 landed = scope-check + operator_mode surfacing (no schema, advisory only); Phase 2 exact-content repo.write, patch preview/apply, typed escape-decision records, mediated process.run evidence, first process.run escape enforcement, and constrained-surface fixture slices landed; remaining work is any broader harness-level escape enforcement outside Striatum-mediated surfaces.
0100	partially implemented (Phase 1 landed)	Self-describing artifact contracts (#74/#79/#96/#88): artifact front-matter contracts live in go/pkg/artifactcontracts but their required+allowed shape is invisible at the point of need, so agents finish the work then reverse-engineer the schema from Go source at publish time. Surface the schema in the work packet per expected_artifacts kind; make validation errors enumerate allowed+required keys and enum values (generalizing the contracts.go:315 verdict pattern) and echo submitted-vs-expected identity for submit-review (inferring logical_name/kind from a sole expected artifact); accept a standard optional-metadata allowlist (author/workflow/phase/lane/date/visibility) across kinds; add striatum artifact describe <kind> / publish --explain. Generalizes RFC 0098 slice-1's per-shape legibility across all kinds. Purely legibility, not permissiveness. Phase 1 = enriched errors + allowlist + inference (no schema).
0101	umbrella-of-record (layers→slices mapped; D223 / #401)	Robust autonomous workflow execution — the umbrella that makes a run survive lane failure and run to completion (or fail loudly) without a human babysitter. Frames the recurring dogfood failure taxonomy (silent lane-boundary failures #101/#95/#85/#76; dishonest liveness #80/#83/#67; no autonomous recovery #82/#108/#65/#84; silent stalls #107; contract/scope friction #74/#79/#102/#109/#103/#100) as one property of the whole run, and supplies the connective tissue the slice-RFCs lack via five defense layers: (1) honest liveness — fuse protocol + PTY-output + filesystem progress so the daemon distinguishes working-local / in-tool / quiet / dead and auto-heartbeats the lease while the child produces output (completes RFC 0091, closes #80/#83); (2) adapter conformance + a persistent turn-driver — every adapter passes an end-to-end fixture in CI against the installed CLI so a version bump that breaks bootstrap/turns fails CI not a live run (closes #95/#85/#76/#70, promotes #101 to a contract clause; on RFC 0096); (3) bounded autonomous self-recovery — a crash-safe daemon recovery supervisor that re-spawns/transfers/requeues (same attempt) / closes leaked windows within per-job budgets before any operator (generalizes #82/#108/#65/#84 on RFC 0095's attempt primitives); (4) loud structured escalation — a continuously-checked run-health invariant + a needs_operator state + an escalation artifact, so a run never silently sits running (consumed by RFC 0099; generalizes #107); (5) a fault-injection chaos suite that proves the run self-recovers or escalates under injected lane kills / dropped MCP calls / deadlocks / one-shot exits — the robustness regression gate that lets later changes ship without a live dogfood. The substrate RFC 0097 orchestration needs (automation amplifies every robustness gap); hard deps RFC 0095 + 0096. Acceptance is behavioral (unattended recovery, honest status, loud failure) and culminates in the self-hosting milestone: a runner-fix developed by an orchestrated dogfood through the runner.
0102	proposed (lever-1 realized indirectly; lever-2 attention-view folded, D219 / #396)	Operator attention economy — the operator-side complement to RFC 0101: treat the human/AI operator as a bounded processor whose cognition degrades with the number of surfaces it must watch and the noise it must parse. Grounded in the 2026-05-31 RFC 0101 L2 dogfood post-mortem, where low signal + many control surfaces produced an attention-allocation error class (identifier/result confabulation, repeated known mistakes, premature retracted claims) — NOT a context-capacity failure. Two named levers: (1) narrow the control surface to one (the CLI / daemon MCP; no dropping to tmux/systemctl/psql/hand-rolled driver scripts in the normal loop — the operator-facing half of RFC 0097) and (2) raise the signal (one high-signal attention view naming the blocking frontier + honest reason + one next action; verification cheaper than guessing; fewer identifier spaces — operate in (run, workflow_job_id), not the sess_/sup_/dsup_/lease_/msg_/blk_/pane zoo; trajectories on the one surface). Composes with RFC 0050/0075 (rendering+observability), RFC 0097 (orchestration removes surfaces), RFC 0099 (defines the constrained operator's surface), RFC 0101 (shared honest-signal principle). Consolidation+signal, not new persistence (D094/D005/D028 intact).
0103	accepted	Self-hosting production hardening — the consolidating umbrella for the residual tail between RFC 0097 self-hosting proven once (the 2026-06-01 minimal single-claude-lane document dogfood, 8e9ac86b) and production-grade self-hosting (a real multi-lane, review-gated, fault-surviving build of the runner's own fixes). After the 2026-06-01/02 burn-down closed the tractable mechanical tail (14 issues — #142 schema drift, #133 recovery deadlock, the #127/#132/#140 verdict-semantics cluster/D158) and corrected three over-closes (#131/#134/#133), the 17 remaining issues are architectural and span six slice-RFCs with no single owner for "production-grade self-hosting." Frames them as seven workstreams, each extending a slice-RFC with what-landed / what-remains / a regression-gated acceptance: W1 the lane becomes a real sandbox (#135 session-token reaches the lane, #70 token out of the worktree, #87 PG-less lane user; RFC 0096 V2 — the #87 env-leak half + #135 token mechanism already landed); W2 every adapter holds a multi-turn seat (agy #95/#85/#76/#139; RFC 0096/0088, gated by the RFC 0101 L2 conformance fixture); W3 the lane survives transport/daemon churn (#141 receiver reconnect + supervisor rebind, #125 non-substitutable work.ack; new chaos-suite fault); W4 the interrogation window outlives one reviewer attempt (#131/#134; RFC 0095 #65 tail); W5 artifact contracts legible at the point of need (#126 finding skeleton+severity, #128 write_scope drift; RFC 0100 P2); W6 orchestration honest+coordinated (#115 frozen-snapshot signal, #138 shared-resource gate; RFC 0097); W7 the operator is a bounded, well-served processor (#92 constrained operator mode, #112 tmux-default + trajectories; RFC 0099/0102). Dependency order W1 → (W2/W3/W4) → (W5/W6) → W7; each workstream ships alone. No new persistence/hosted service/transcript capture (D094/D005/D028 intact). Now dogfoodable through the runner (RFC 0097 proven). Replaces the ephemeral operator burn-down plan with a durable, reviewable spine.
0104	accepted (D159)	Retire the lifecycle deadlock class with one per-run advisory lock taken first in every per-run mutation transaction (claim/await, submit-review/verdict/override, lifecycle completion, per-run recovery), generalizing RFC 0101 Phase 0a's lockRunInterrogation. Fixes the verified {sessions, runs} lock-order inversion between HandleClaimNext (sessions→runs→jobs) and recordVerdict→maybeCompleteRun→closeRemainingSessions (jobs→runs→sessions) that withTxRetryOnDeadlock currently only tolerates (#98/#103/#137) — and which only bites multi-lane runs, explaining why single-lane self-hosting passed while panels wedge. Foundation for RFC 0105; from the supabase-postgres-best-practices lock-deadlock-prevention rule.
0105	accepted (D161)	Make "a run completes or fails loudly, unattended" a standing CI gate — the yolo-mission property. Extends the RFC 0101 chaos suite from recovery-only to the full multi-lane revision lifecycle (≥2 lanes + needs_revision cycle) under the RFC 0103 fault matrix (lane death / transport churn / reviewer replacement), asserting self-recover-or-escalate-loud within budget, never a silent wedge. Operationalizes RFC 0103's one-time acceptance into a permanent regression gate and supplies the per-shape fixture RFC 0106 graduates on — the behavioral gate the 20% coverage floor can't provide.
0106	accepted (D162)	Govern the shape catalog instead of pruning it: a support_tier of supported/experimental, an honest workflow.lint warning on experimental-shape runs (no block — yolo opts in knowingly), graduation to supported gated on a green RFC 0105 fixture (guard-tested so the tier can't lie), and a freeze on authoring new shapes until the catalog graduates. Preserves the collaboration/anti-hallucination shapes (the product value) while telling the truth about which survive unattended. Corrects the architecture review's "prune to three" call under the real mission.
0107	accepted (D160)	Make multi-user explicit and bounded: define a principal over the existing capability-token / session-binding (RFC 0096) / per-repo scoping (RFC 0028) substrate, with per-principal audit attribution and cross-principal + cross-repo isolation invariants — for one self-hosted striatumd + PostgreSQL serving multiple repos and humans. Explicitly not SaaS: no hosted control plane, tenant provisioning, external IdP, or telemetry. Sequenced after the RFC 0104/0105 reliability foundation; parallel to RFC 0103 W2/W3/W4.
0108	accepted / implemented (P1–P5, v2.19.0–v2.23.0)	Parallel independent runs on one repo — N operators each drive their own run/feature on one repository at once, with collision prevention and clean integration (not coordinated work-decomposition, not co-driving one run, not lock-free mainline auto-merge). ~70% of the substrate already exists — branch-per-run (branch.confirm), per-job worktree isolation (RFC 0008), no one-run-per-repo constraint, and RFC 0104's lock-free cross-run mutations — so the work is: prove the substrate composes (extend the RFC 0105 harness to multi-run), make worktree+branch isolation the default under concurrency, detect cross-run branch/write-scope collisions at run.start, integrate via serialized gated merge (per-run branches; conflicts surfaced, never auto-resolved; RFC 0067), and a repo-scoped concurrent-runs view. Names the three real walls: the per-repo linear event chain (kept — it's the total audit order), serial git integration, and collision detection vs coordination. Depends on RFC 0104; complements RFC 0107 (identity).
0110	accepted (D164)	Daemon → PostgreSQL authentication + database-enforced write boundary. The live PEER-auth posture conflates the daemon's identity with its OS user, so a same-user lane can open PG directly and bypass the artifact/RPC API + hash-chained audit log (#87); password auth just trades that for a standing file secret. Layered fix, design rule "make a leaked runtime credential uninteresting": L0 ephemeral owner-PEER-bootstrapped, RAM-only striatumd_rw password (re-rotates each restart; STRIATUM_OWNER_DB_URL / systemd-credential for remote PG); L1 PG enforces the write contract — revoke direct DML, writes only via owner-owned SECURITY DEFINER functions + RLS, so a leaked DSN still can't forge artifacts or tamper the audit chain (phased audit_log→artifacts→events, pgtest 42501 gate); L2 dedicated PG-less lane OS user + 0700 socket dir as the hardened default (doctor warning→startup-block behind an upgrade-safety flag), closing #87 structurally; L3 BeforeAcquire SET LOCAL rpc_id/principal_id attribution (closes the RFC 0107 audit-attribution gap, useful standalone today) + daemon_auth_log with doctor owner-fallback read. Future: local self-signed-CA client certs for multi-host. Stock PL/pgSQL only (no C extension, no wire proxy). Sequenced after RFC 0104/0105; supplies the credential/enforcement/isolation/attribution substrate RFC 0107 builds on.
0109	accepted (D163; D177 current seat posture)	Make the agy lane a first-class supervised seat and stop deferring it. P3 (the standing installed-CLI conformance gate, #149) lands alongside P1 (#95/#85/#76/#139): adapterconformance.RunInstalledCLI drives the real agy CLI through a two-turn claim → publish → claim and asserts one attested session across both turns (the harness gained a unix-socket RPC listener so the agent-loop receive loop is driven; RunLive's in-process testagent is immune to #95 by construction). agy graduated degraded → supported (guard-reconciled with InstalledCLISeatFixtures), was briefly demoted by D174/#190, and is supported again under D177 after the direct smoke and TestInstalledCLISeatAgyTwoTurn passed against the current installed CLI. Current supported seats are agy and codex; the gate's role is anti-re-rot (a CLI bump that breaks either seat fails the installed-CLI tier). The stricter TestInstalledCLISeatAgyRestartWhileLeased stress gate remains mixed because agy can stop at a survey prompt before claiming work.
0111	accepted (D165)	In-band failure legibility + self-heal across the MCP boundary. striatum already has the typed envelope (rpc.Error{Code,Message,Details}, envelope.go:15) and a stable code vocabulary (invalid_transition, fresh_session_required, capability_missing, …), but toolResult (mcp/tools.go:106) renders the MCP content text — the channel an agent reads — as the bare method name (fmt.Sprint(name)), so a failed state-changer surfaces a contentless <error>method</error> and the lane must re-run the CLI to learn why (comparison §4.3/§6.1). Three slices: P1 render code+message into content on failure (the bug; a few lines); P2 add a Suggestion/recovery field to rpc.Error (reusing RFC 0029 recovery_commands) so agents self-heal, mirroring cc-fleet's Suggestion; P3 enumerate the codes as a closed, guard-tested catalog in command-authority-matrix.md, mirroring cc-fleet's ErrCode*. Declines the comparison's §6.3 daemon-not-required tier (regresses D094/RFC 0110). Distribution (§6.2) + an architecture map (§6.4) recorded as non-RFC companion chores. Reference design: ethanhq/cc-fleet's classified Result envelope.
0112	accepted / implemented (V1; D171)	Make interrogation-window consumers explicit for phase-gated collaboration shapes. ACE's convener_draft is interrogable, but cross-examiners sit behind convener_synthesis, so direct-dependency inference closes the preserved-context window before cross-exam can open. Accepted design: snapshot-derived interrogation_targets, attempt-aware packet projection, centralized terminal-consumer release through markJobTerminal, advisory V1 required with evidence events, and ACE generator declarations without fake graph edges or stored consumer rows. Shipped V1 (v2.27.0): validateInterrogationTargets, interrogationTargetsForPacket, markJobTerminal; ACE support-tier graduation is tracked under RFC 0098 (#399).
0113	partially implemented (D170)	Runtime read-scope least privilege successor for #164. R0 inventories every daemon-owned table's read class; R1 has started with owner bundle 0005 denying direct runtime reads of clients.token_hash/clients.token_salt and moving them behind daemon-authorized SECURITY DEFINER projections. Other sensitive reads remain broad, so private_read_denial stays false until the remaining sensitive read surfaces are closed.
0114	accepted (D173)	RFC 0113 R1 successor for #164: close the remaining runtime-owned identity surfaces — principals, principal_clients, client_sessions — in owner bundle 0006. Load-bearing decision: these tables are owned by striatumd_rw (not the database owner), so a plain REVOKE SELECT is not a boundary (the owner can self-re-grant); the bundle ALTER TABLE ... OWNER TO CURRENT_USER first, then applies SECURITY DEFINER projections + revokes (Option A). Discovered constraint: principal_clients keeps a column gate (principal_id denied) because a live UPDATE ... WHERE reads client_id/unlinked_at; client_sessions is fully denied (zero Go consumers). Doctor pg_read_scope.posture becomes derived (stamps + privilege/ownership probes) and flips to partial_projection_gated; private_read_denial stays false until R2/R3. Design only; owner bundle is owner-applied out-of-band in a later PR. Produced by a claude+codex design dogfood (verdict accept_with_findings).
0115	proposed — deferred (D226 / #404; depends on dashboard-ingest)	Precise token-usage telemetry for supported supervised agent-loop lanes: define a scrubbed local .striatum/scratch/token-usage.jsonl usage-event contract, use Claude local metrics/OTel or PTY counter scrape fallbacks instead of retired claude --print, treat agy/Gemini structured usage metadata as instrumented when available, and make token-dashboard ingest prefer instrumented records over scraped/estimated events. No tracked wrapper revival, Striatum DB schema, hosted telemetry, billing reconciliation, or raw transcript capture.
0116	accepted (D175; Phase 1 implemented)	Zero-operator-touch sequential DAG execution — for #178 (no daemon-side session auto-spawn: the operator must register-session + supervise start per (role, lane) as the DAG unblocks) and #188's policy half (the fresh-reviewer freshness check refuses while the author session is idle-parked). Central decision argued and recommended: an operator-side striatum run drive verb — a foreground, idempotent, killable loop that watches one run's DAG via daemon reads and performs register-session + supervise start (and supervise stop of completed lanes) as jobs unblock, using only normal lifecycle verbs (no rescue), reaching terminal state or escalating loud (RFC 0105). Boundary insight: the daemon already execs lanes on supervise.start, so run drive changes spawn cadence, not the product boundary — every spawn stays a capability-authenticated RPC from the operator principal. Productizes the proven scripts/dod/driver.py; composes with the refactoring-campaign skill; per-run only (respects RFC 0108). Daemon-side supervision.auto_spawn is analyzed and explicitly deferred behind a three-part evidence trigger (autonomous/unattributed spawn has attestation/run-as/restart costs — RFC 0110/0107). Also fixes the freshness predicate (lifecycle.go:101-118): an active author blocks a fresh reviewer only if it holds a live lease OR its role has remaining pending work — an idle, drained author no longer blocks; --force-non-fresh semantics unchanged. Phase 1 is implemented without a new daemon RPC, persistence, or audit class.
0117	accepted (D176; Phases 1-4 implemented)	Per-job worktree & branch ref-safety — the umbrella for #186 (released per-job worktree leaves the completed job's commit stack dangling, gc-vulnerable — silent data loss), #184 (stage-2 per_job publication needed a manual branch fast-forward and left the operator's primary checkout on the run branch), subsuming the standalone #183 stopgap (worktree create fails invalid reference because confirmed-but-uncreated branch refs don't exist). Core invariant: a completed repo-write job's commit stack is always reachable from a durable git ref before its worktree can be released, and the daemon never moves the operator's primary checkout HEAD. work.complete fast-forwards the run branch when ancestry permits (compare-and-swap update-ref, the RFC 0108 integrate.go pattern) and otherwise pins refs/striatum/<run_id>/<job_id>; non---force worktree.release refuses an unreachable HEAD; stale-lease recovery anchors before abandoning; branch.confirm/worktree create create branch refs with git branch/update-ref (never checkout -b). Fulfills RFC 0008's unimplemented automatic-cleanup/collect-back-to-provenance clause. No new daemon method, no new persistence, no auto-merge to mainline (integration stays RFC 0108's gated run.integrate). Phase 5 doctor / worktree list ref-safety projection remains follow-up.
0118	accepted / implemented (P0+P1)	Gate run completion on attested provenance — umbrella for #240, closing the run_45aa8852 PROCESS_UNRELIABLE incident (a final review verdict recorded by an unattested no-supervisor session, then a hand-published cancel). The per-JOB completion contract already shipped (ensureWorkSessionBackend claim.go:257, enforceReviewProvenancePolicy review.go:1159, attestation-derived bylines artifact.go:599, durable artifacts lifecycle.go:1142 — #228/#234/#238/#239 closed as acceptance checks); the residual gaps sit at the run-completion boundary and around override legibility. maybeCompleteRun (mutations.go:829) gates on job STATES only and never re-asserts required artifacts+verdicts are attested; verdict attestation is a live probe never frozen onto the verdicts row; HandleOverrideVerdict stamps the workflow posture (review.go:266) not posture=override; and finalizeAutoFinalizeCandidate calls recordVerdict(..., recordVerdictOptions{}) (recovery_auto_finalize.go:1051) so the attestation gate never runs — a second ungated write surface for the incident class. P0: freeze a verdict attestation/override stamp (migration 0024); force posture=override on every operator/recovery path incl. closing the auto-finalize bypass; maybeCompleteRun re-verifies every required gate (scoped to provenance-required reviews) and routes failures to needs_operator with a resume path; split the clean terminal into a completion_mode column (lanes_attested vs operator_override). P1: durable run_completion_record at every terminal transition (incl. operator cancel) so retrospectives need no live archaeology; recovery.invalidate_job for one compromised review job. Produced by a claude committee dogfood (gate/recovery/ergonomics design lanes + threat-model/failure-mode/maintainer-readiness reviews); the auto-finalize bypass was found and escalated to P0 by the adversarial reviews.
0119	accepted / implemented (hot tier; D179)	Warm-tier memory boundary and Striatum hot tier: authorize a separate local-first warm-tier adjunct reached only via delivered fornix content, preserve the corpus-export invariants, and accept a Go-native hot tier design (RecallMemory, scaffold-time digest injection, and redacted lane-trajectory export) with C1-C4 discharged. The Go hot tier shipped (RecallMemory, recall.search, recall_digest.go; commit 80dc82e7) with C1-C4 discharged; only the runtime evictor (D193) remains deferred.
0120	accepted (D180; Phase 1 + Phase 2 implemented)	Await-packet idle exit and wake boundary for #248. Phase 1 makes terminal work.await_packet idle envelopes carry idle_behavior=exit_session, stops teaching agents to poll after no_work, and exits the PTY daemon receiver on explicit idle. Phase 2 adds a notify-only wake bus: wake.wait, post-commit wake hints for work/message/turn availability, and run drive wake waits with bounded missed-notification fallback while preserving claim_next as authoritative. Daemon auto-spawn stays deferred to #212.
0121	accepted (D181; implemented)	Lane provider auth preflight gate for #252. supervise.start owns the auto, required, and off provider-auth gate modes for supported Codex agent-loop launches; run drive forwards the mode and stops on a sanitized blocking refusal; an explicit doctor flag exposes the same primitive without making ordinary doctor run provider CLIs. The implementation adds no database migration, durable event, provider SDK, or transcript store.
0122	accepted (D189; implemented, opt-in via STRIATUM_AUTO_SPAWN_SCHEDULER)	Scheduler principal for daemon-side supervision.auto_spawn (#212). Defines run-owner pre-authorization — captured at run start, replayed by the daemon scheduler for that run's DAG — so the daemon can spawn lanes without a contemporaneous operator RPC while preserving RFC 0110 attestation/run-as. Motivated by operator-model token burn and yolo control-surface reduction (least privilege), the two forces the D175 deferral did not weigh. Reuses one reconcile predicate across run drive and the scheduler; ships behind the RFC 0105 gate extended to the spawn path; supersedes the D175 auto_spawn deferral only. Originally a design RFC (no go/ code at acceptance); the daemon scheduler has since landed (go/pkg/mutations/scheduler.go, spawn_grant.go, run-owner spawn-authorization grants in migration 0027) behind the opt-in STRIATUM_AUTO_SPAWN_SCHEDULER flag (default-off — daemon-initiated spawn is per-deployment opt-in, on top of the per-lane auto_spawn opt-in). The operator-side auto-drive shim is split to RFC 0124 (D191, implemented).
0123	accepted (D190; implemented)	Blob-routed lane exhaust and git publication specs. Replaces RFC 0072's kind-based target boundary with an explicit artifact-placement contract: ordinary lane outputs route to blob storage as blob_exhaust, while synthesis/build specs, accepted decisions, source-like records, and compact pointer manifests stay in git as reviewable publication provenance. Narrows the #217 artifact-anchor check to git-retained artifacts and adds blob/pointer integrity checks for lane exhaust.
0124	accepted (D191)	Auto-drive on run start (#212): the operator-side shim toward RFC 0122. run start launches a detached run drive for the started run in a transient systemd user unit (idempotent, best-effort, --no-drive / STRIATUM_RUN_DRIVE_AUTO=0 opt-out), removing the operator model from the mechanical loop while spawn authority still rides the operator principal. Gives the default-on behavior change its own design record: default-on-vs-opt-in (landed on on), background-driver lifecycle/security, co-driving, and a mid-run-pause hold (C5 — run drive now holds a paused run, discharged before acceptance). Ratifies the shipped code.
0125	accepted (D192)	Durable gate artifact provenance (#284 / #270–#283): closes the gap where a run finalizes completed while a required gate artifact body is unreconstructable (row + size_bytes survive but the body is gone). Daemon-as-porter does the last-mile commit by git plumbing (no checked-out branch, ignores .gitignore, never touches the lane-unreadable worktree); a body-reconstructability completion gate re-reads + hash-verifies every required body per placement (orthogonal to RFC 0118's verdict path); a content-addressed RUN_LEDGER makes a run reconstructable offline; and same-attempt recovery.reseal remediates without attempt inflation.
0126	accepted (D194)	Multi-reviewer revision coherence (#282 follow-up): replaces DELETE-on-revision of reviewer verdicts with a build-owned monotonic review_generation stamped on every verdict and enforced at the write boundary; finalization asserts every required reviewer has a current-generation accepting verdict (stale verdicts become structurally invisible, no manual invalidation, history preserved).
0127	accepted (D195)	Retire the lane git identity (RFC 0125 P2-2 end-state): the per-job workspace becomes a plain daemon-owned directory, not a git worktree; the lane is a pure byte producer, the daemon owns all git (base staging, daemon-side diff for write-scope, porter commit, anchoring). Dissolves the detached-HEAD/gitignore/lane-ACL/hook-injection failure classes; opt-in, reversible migration.
0128	accepted (D196)	Cross-repo run boundary (#280 product decision): keep the single-repo run as the invariant; ship a fail-fast guardrail (refuse cross-repo reach at validate/dispatch instead of silently narrowing) + read-only artifact federation; achieve cross-repo outcomes by decomposition (coordinator + single-repo satellites under a campaign id); decline first-class multi-repo atomic writes, recording the manifest + per-repo-consent + saga design as a deferred option.
0129	accepted / implemented (D199)	Cognitive frame library — the frame-layer companion/successor to RFC 0087: supplies the real frame data model (frame_kind persona/operation + distortion-axis dimensions), a curated categorized library (keeps the 15 personas, adds three missing categories — operation/transform, temporal-forensic, risk-pricing — surfaced by a live multi-model divergent run of the method on itself), a transform-then-generate path with a checkable intermediate for operation frames, an anti-redundancy selection policy (reject frame pairs sharing ≥2 distortion axes — the generative analog of RFC 0064's same-model review refusal) + a min-structure gate, and a first-class multi-model convergence signal (cross-family agreement as confidence, the signal ADHD's Claude-only loop can't produce) with a diversity-regression test operationalizing ADHD's deferred frame-quality evaluation. Generator + catalog only; no daemon method, no vendor import.
0130	accepted (native MCP slices implemented)	Native Go daemon HTTP/SSE MCP and agent loop (formerly numbered 0050-mcp; renumbered to resolve the 0050 collision — #320). striatumd serves /mcp plus /mcp/sse, tools/list / tools/call route through daemon RPC authorization, the fake MCP agent proves the packet loop, agent-loop is now a PTY bootstrapper, the Python mcp.py wrapper is deleted, and the RFC 0130/RFC 0075 final cutover closed live workflow-control parity. Surviving CLI verbs are daemon-backed compatibility clients unless a later deprecation/release decision hides or removes them.
0131	accepted (D211; Layer 1 / 131-A #334 IMPLEMENTED; OQ3 resolved D230 / #348 — confidence model, PTY-shim alt tracked)	Transport-aware liveness confidence + escalation gating (#311 P1 graduation; composes with D209's P0 quarantine). The liveness classifier becomes transport-aware: Classify() emits TransportType + a typed probe_basis (pty_confirmed_dead vs deadline_elapsed_only); a deadline_elapsed_only stall on a pipe lane with no confirmed-dead oracle is confidence-gated (compounding misfire_evidence_score, two-sweep debounce, free cross-lane corroboration from the cohort recoverStuckJobs already holds) before it may escalate the run. Load-bearing invariant: a finite escape-valve cap keyed off forgery-resistant sealed-work progress, not raw output (a #324-spinner can forge chatter, not progress), so a genuinely-hung pipe lane is escalatable in bounded time and never un-escalatable. Runtime migration only.
0132	accepted / implemented (D212; via RFC 0135 P4; OQs resolved D228 / #340 + D229 / #343)	Gating/advisory reviews + quorum with dissent protection (#311 P2 graduation). Per-reviewer panel_role: gating | advisory; a panel finalizes on a quorum of gating seats over a frozen declared-seat denominator (quorum = a ceiling on tolerated silence, not a floor on accepts). Dissent is forward-written to an append-only dissent_ledger keyed on the stable workflow_job_id (recovery churns job_id/session_id, so the disposition's backward verdicts query was fragile). Attestation axiom: the daemon may only assert "seat unfilled", never fabricate a vote — so quorum may skip a provably-dead seat, never a live-but-silent one ("silence is not consent"). Advisory votes are non-binding but never silent (loud unanimous-reject + mandatory minority-report artifact). Optional dissent_quarantine run-state form needs the next available owner bundle.
0133	accepted / implemented (D213; folded into RFC 0135 P1/P2; fan-in barrier live by default with STRIATUM_BARRIER_FANIN=0 kill switch, D269/#527/#354)	Fan-in deferred join barrier + join manifest (#319 graduation of the shipped D206 per-completion merge — not a bug fix). Freeze the run-branch tip at fan-out, stage each sibling to an attempt-addressed refs/striatum/staged/<run>/<job>/<attempt> ref, and fire a DAG barrier whose predicate JOINs staging.attempt = jobs.attempt (the live attempt) — never counts refs per job, so a requeued attempt's stale ref is structurally invisible (synthesis trap #1 killed). One deterministic assembly in workflow_job_id order off the frozen base; assembly runs through the two-phase barrier_state journal before the downstream join queues, with the explicit barrier_assembly dispatcher retained as a compatibility surface; N=1 routes through the same path (the "delete fast-forward" wildcard → one code path, one doctor invariant). Manifest slice can land first. Open scoping question: a general attempt-sealed barrier primitive shared with RFC 0132 / RFC 0095 / RFC 0108? RFC 0135 (D216) answers yes and generalizes/re-scopes this from fan-in-only to the shared primitive; 0133 stays the authoritative fan-in design.
0134	accepted-with-revisions / implemented (D227 accept; verified-and-graduated D237; both halves shipped, #394/#395 closed; validate-not-execute)	Executable verification gate + claim status-provenance (cam-analyzer dogfood: lane docs outran code — D013 marked accepted/implemented, absent from the build; a fabricated model attribution the retrospective caught but never patched). The lane's gates adjudicate prose, not ground truth, so an LLM adjudicator can be talked into "looks implemented" like the producer was. Shipped per D227's validate-not-execute revision (the daemon NEVER executes a check): a VERIFIED > ASSERTED > DESIGNED claim lattice on a monotonic, append-only claim_ledger artifact with a provenance lint (VERIFIED requires a bound, sealed receipt) and VERIFIED→ASSERTED auto-decay on input drift; a verify job type (owner bundle 0016) claimed by a disposable sandboxed verifier LANE (striatum verifier run) that resolves a content-addressed, operator-curated allowlist, runs the check twice under the strictest available envelope (bubblewrap→systemd-run→unshare→none), and mints a tamper-evident receipt.v1; and a pure-read run-completion gate that records the effective claim status (two-signal sealed receipt → VERIFIED, else ASSERTED) and NEVER blocks completion on engine liveness. The interim today-primitives realization stays in examples/verification-gate-flow/ (striatum workflow validate → valid).
0135	accepted / implemented (D216; P0-P6 shipped v2.34.0; P1/P2 fan-in live by default with STRIATUM_BARRIER_FANIN=0 kill switch, D269; P4 quorum + P6 run.integrate live, P5 revision live)	The sealed expectation barrier primitive — one (entity, seal) barrier shared by fan-in / 0132-quorum / 0095-revision / 0108-integrate (#354, the cross-cutting answer to RFC 0133 OQ3 / RFC 0132 OQ2). Key the barrier on a stable entity id + a monotonic SEAL counter, NOT raw attempt: attempt (fan-in/0132), review_generation (0095/0126), and run-completion (0108) are PROJECTIONS of the same (entity, seal) abstraction. Readiness JOINs each in-edge's staged contribution against the entity's LIVE seal (staging.seal = entity.live_seal), never counts refs per entity — RFC 0133's synthesis-trap-#1 killer, generalized to every seal (one named predicate, one doctor check, one static-guard against COUNT(*)-of-refs, one chaos suite). A monotonic seal does not churn under recovery, so RFC 0095/0126 folds in WITHOUT regressing off review_generation (review_generation BECOMES the seal); RFC 0108 folds in with entity=run (generic over entity ∈ {job, run}; job barriers compose into a run barrier). D214 ratifies RFC 0132 strictly (verdict-less seat-holding stub + skip-only-provably-dead-seat + k_of_n deferred to lint); D215 ratifies the per-object schema split (barrier_assembly CHECK => owner bundle 0013, freeze/staging/barrier_state => runtime no-FK tables with explicit GRANTs, join_manifest.v1 => no DDL). Honest risk: the mechanism is NOT natively shared — the four-way fold is a design bet on the seal-not-attempt keying, ratified by the maintainer with that finding in hand. Re-casts #344–#347 as the primitive's first callers; #338–#343 consume the same predicate.
0136	proposed	Range-partition events and audit_log by created_at (#387; draft-now-implement-later). The structural fix for the latent seq-scan / VACUUM / retention cliff on the two unbounded append-only logs (events ~13.5M rows on proximal), of which the already-shipped #386 FK-covering indexes (owner bundle 0015) are interim insurance. The hard constraint: declarative range partitioning requires the partition key to join every PK and UNIQUE constraint, so events.PRIMARY KEY reshapes to (repository_id, event_id, created_at) and audit_log reshapes BOTH PRIMARY KEY → (audit_id, ts) AND UNIQUE → (row_hash, ts) — a key reshape on two owner-held SD-write-only tables. The sharp edge: repo_event_chain_heads' DEFERRABLE SQL FK into the events PK can no longer be declared (the FK-to-owner-table trap reached from the partition side), so its RI moves into the append_event_row transaction in Go (D215 pattern). The in-DB event/audit hash chains stay invariant (partitioning changes no hash input); retention drops a partition only after the chain segment is sealed and its boundary hashes recorded — aligned to the existing audit_segments model, generalized to events. Ships as owner bundle 0016 (capability-parity gated, coordinated backfill via attach-legacy-heap-as-historical-partition) per D187/D215. Partition DETACH/DROP does no child-RI scan and never trips the *_no_delete triggers — the clean subsumption of #386's delete-time-scan rationale. Phased: P0 policy knobs → P1 event chain-segment sealing → P2/P3 the reshape → P4 retention executor + doctor → P5 index tuning. P0 policy knobs RESOLVED (D241, 2026-06-19) against measured prod velocity: granularity = WEEKLY; retention = events 3 months / audit_log ∞ (partitioned-but-never-dropped); Q3=(a) sole-writer, Q4=sibling slices, Q5=generalize segment abstraction. P1+ implementation stays ready-for-human.
0137	implemented (D247)	striatumd Prometheus exporter (local-first daemon observability; explored via /adhd). Implemented A→D (dogfooded via four Striatum code_change runs; go/pkg/metrics + /metrics wiring; builtin:go-build verifier + CI green; not yet deployed). Three pillars: (1) a lock-disjoint reconcile-tick snapshot — /metrics is a pure reader on an atomic.Pointer[MetricsSnapshot] published from the resident sweep tick (startRecoveryScheduler, default 60s) and mounted in the existing newDaemonHTTPHandler (web_service.go:57), so scrape cost is O(1) with zero PG queries and zero shared mutex (the naive query-on-scrape handler would be the next #417 reconcile-contention storm); (2) cardinality+privacy as an executable contract — Classification-tagged families (Operational/Provenance/Forbidden), enumerated labels only (never a raw ID; salted repo_id surrogate), per-family LRU series budget → cardinality_clipped_total, a boot-time allowlist-hash abort, and a golden-file/forbidden-regex redaction CI test that fails closed on leaked paths/shas/branches/prompts/bylines; (3) a failure-mode-shaped taxonomy with an origin enum (the #417 storm = a flood of origin="supervisor" series), an apoptosis vs necrosis split (intended self-termination vs uncontrolled death, tagged at the lifecycle-termination site), run_wedge_age_seconds, liveness_deadline_margin_seconds, lease_transitions_total, and doctor-as-collector (doctor_problems{class} makes a red doctor alertable). Default localhost; capability-scoped (RFC 0043) when exposed; opt-in per-repo consent for Provenance families. Honors the no-telemetry product boundary (pull-only, nothing pushed); this RFC is the explicit product decision it requests. Phased A (read-path + redaction harness, TDD) → B (taxonomy) → C (contract enforcement + doctor collector) → D (multi-tenant + consent + alert rules). Design gate answered via a falsification_gate run (run_04db6534…): doctor_problems{class} pinned to static problem_records[*].check codes (never dynamic ids — F-A8) and liveness_deadline_missed excluded from the necrosis domain as reversible (F-A6); both verified against source + a sealed verifier run receipt.
0138	implemented (D240)	A finite terminal-gap recovery exit for a STRICT fan-in barrier with a permanently-unrecoverable required seat (#453; failure-mode audit FMA-003). A panel quorum (RFC 0132/D214) degrades via the abstention budget — up to max_gating_abstentions provably-dead seats become terminal gaps and the barrier fires degraded. A strict fan-in (RFC 0133, all siblings required) has no such budget: the only is_terminal_gap source is an operator quarantine marker, and recovery.quarantine_lane refuses non-terminal runs — so a permanently-dead required sibling parks the run in needs_operator with no automatic exit. Safety tension: auto-sealing a required seat lets the run complete while MISSING a contribution the barrier declared required — that is the whole point of "required", so a seal must never silently forge completeness. Options: (A) keep operator-gated by design + legibility (sharper needs_operator message + a strict_fanin_required_seat_unrecoverable doctor reason); (B, recommended) an opt-in per-barrier fanin_tolerates_sealed_gap that fires degraded ONLY for a provably-dead seat (reusing the quorum supervisedAgentConfirmedDead oracle), bounded by a max_sealed_gaps budget, emitting a structured terminal_gap manifest edge + a durable degraded-run signal a downstream gate can REFUSE — completeness never silently forged; (C) B plus a timed operator-decision window with a declared default. Composes with RFC 0135's is_terminal_gap predicate disjunct (no predicate fork; TestBarrierPredicateHasNoRefCount stays green) and the shared-primitive direction in #354.
0139	implemented (D240)	Supervisor reconcile/heartbeat loop write-amplification (#421). The daemon's reconcile loop is its dominant write source (~2.7M passes / 16 h, ~8.1M single-column timestamp writes) and bloats process_supervisor_pointers — the slowest write (2.13 ms) and the bloat hotspot (79.9 % HOT vs ~92 % on siblings, ~20 % new-page updates that only pg_repack reclaims). Verified mechanism: updated_at/heartbeat_at are in no index so refreshSupervisorHeartbeat's per-event bumps are HOT-eligible, but state is in two of the three indexes (idx_process_supervisor_pointers_run + the partial-unique …_per_session), so every updateSupervisorState transition is non-HOT (new heap tuple + 2 index entries) — that is the ~746k ≈ ~692k new-page churn. Analyzes the issue's three directions (coalesce/throttle the timestamp bumps; drop state from the non-partial run index; split the hot timestamps into a narrow side table) against the #417 phantom-supervisor stabilization (keep the partial-unique + state column + reap DML 0033 untouched) and the #198/#355 lock-contention story (add no statement inside the lockRun advisory-lock transaction). Recommends Directions 1+2 as one runtime migration 0038: a Go write-skip coalesce floor (~30 s, STRIATUM_SUPERVISOR_HEARTBEAT_COALESCE) computed from the already-read row, plus dropping state from the non-partial run index (gated on a read audit); Direction 3 (side table) held in reserve. Measurable acceptance: ≥ 80 % fewer timestamp writes, new-page ratio 20 % → ≤ 5 %, HOT 79.9 % → ≥ 92 %, ≤ 25 % of the bloat plateau, no #417/#198/#355 regression. Index-only DDL on runtime-owned tables clears the floor-27 owner-DDL guard.
0140	implemented (D240)	Attestation for honest long local work — separate "alive but tool-call-silent" from "wedged/dead" (#457; failure-mode audit FMA-009). A lane that issued ≥1 tool call then does 10+ min of silent local work (a test suite, a repo scan) is reclassified wedged_no_tool_progress → attestation drops → artifact.publish refuses the role byline mid-work. Verified seam: lanehealth.Classify runs the active PID probe FIRST (sets h.Alive), then ANY non-empty stall class — including wedged_no_tool_progress — returns Attested = false REGARDLESS of h.Alive, so the same demotion fires for a confirmed-dead PID and a PID-alive-but-tool-silent lane. The fix is narrowly scoped: a wedged_no_tool_progress stall may drop attestation only when NOT contradicted by a live, identity-matched PID (the same oracle recovery uses to confirm death) — preserving the RFC 0026 / D080 forgery guard (a dead/hijacked/closed-session lane still publishes author: operator and is still reaped). Options: (A) client-side agent-issued keepalive that advances the tool-progress base (minimal, cooperative-client-reliant); (B) liveness-truthful classifier — a PID-alive tool-silent lane becomes an attestation-preserving alive_but_silent protocol state, decaying attestation only on TRUE liveness loss (server-side, fixes all clients); (C) publish-time grace under a distinct recorded alive_silent attestation tier (must not ship alone). Recommend A + B (A removes the common case, B is the PID-keyed backstop), C optional as the provenance record. Pipe transport stays degrade-safe (no PID oracle → no exemption). RFC 0091 / RFC 0131 refinement; no code lands with the proposal.
0152	implemented (D249/D255)	Recovery budget policy for agent_exited_unsealed reviewer lanes (#478). Implemented per D255: a read-only reviewer lane recovers on the larger maxReviewerUnsealedRequeues while a stateful repo-write lane keeps the tight maxUnsealedRequeues default; the salvage leg (#530) is D256. The agent_exited_unsealed class recovers on a deliberately smaller requeue budget (max_unsealed_requeues default 1, clamped <= max_requeues default 2) and — because a pty_confirmed_dead basis skips the RFC 0131 confidence-gate debounce — escalates the whole run to needs_operator after a single respawn. D198 ratified that smaller budget on the rationale that a systematic unsealed exit rarely self-heals; #478 supplies the counter-case D198's own revisit trigger anticipated — a stateless claude_code reviewer lane's transient unsealed exit re-reviews fine on fresh-session re-drive, so escalate-after-one maximizes operator interruptions for the most common committee-run needs_operator cause, and it recurs on a stable daemon (not purely infra-transient). Raising the global default reverses D198 and breaks the pinned defaultMaxUnsealedRequeues < defaultMaxRequeues invariant (dx_289_test.go), so this is a product decision, not a triage edit. Surfaces five options (keep / raise global / differentiate by lane-kind or job-type / auto-grant one fresh-attempt / detect complete-but-unsealed deliverable — last is out of D198 scope as it borders attestation forgery); interim mitigation is the existing per-workflow recovery_policy.max_unsealed_requeues override. No code lands with the proposal.
0141	implemented (D243; graduated experimental→supported)	A generatable verification_gate workflow shape (#473; RFC 0134 follow-up). Graduated experimental→supported (D243, #482): gate-side daemon-authoritative attestation enforcement (migration 0041 verifier_attestations PG store + operator-token verifier.attest RPC that refuses session-bound tokens; the run-completion gate now refuses VERIFIED for an external claim lacking an un-revoked attestation row, fail-closed to ASSERTED; the repo-file sidecar is now a cache) and mandatory mutation-of negative-control rigor. Originally implemented at experimental (D239): the two-layer intent/pins allowlist + verifier pin/attest verbs, the self-pinned builtin library capped at ASSERTED, the unfilled-template hard-block + negative-control void, and the registered shape + catalog. Doctor drift classes (#483) remain a follow-up. RFC 0134/D227 shipped the executable verification gate but the only realization is one hand-authored today-primitives example — there is no striatum workflow generate --shape verification_gate. The obstacle is structural: a runnable allowlist can't be a committed fixture because binary_sha256 content-addresses host/distro-specific bytes. Resolves it on three pillars: (1) split the allowlist into a committed, hashless, reviewable intent layer (in forbidden_paths — the lane can't sanction its own checks) and a gitignored per-host pins layer the operator never types by hand (a verifier pin --host-here lane observes the sha; a separate operator-token-gated verifier attest promotes PINNED→VERIFIED, since the trust signal must come from a principal the lane cannot impersonate); a three-valued claim status (NAMED-but-unpinned / PINNED-but-unattested / VERIFIED) keeps "we ran a check" from collapsing into "a human stood behind the bytes". (2) A built-in, Striatum-pinned check library (builtin:go-test/vet/build) so the generated shape is runnable out of the box for the 80% case — but capped honestly at ASSERTED (the striatum self-pin proves who invoked the tool, not which tool ran), and the generator refuses a VERIFIED-threshold gate composed only of builtins. (3) The gate cannot lie green — a typed unfilled-sentinel hard-blocks at validate/run start with a named fix command, and a mandatory negative_control (plus a thymic all-red graduation dry-run) voids a vacuous check. Ships at experimental; keeps the interim example until graduation. No code lands with the proposal.
0142	accepted (D258, accepted_with_follow_up)	Safe-by-construction database-change deployment (#442/D248; the two-role 42501 crash-loop class). Five layered defenses, accepted after a falsification_gate design committee hardened it into five build-bearing constraints: L1a/P0 a two-role pgtest fixture that runs the migration suite as a privilege-constrained striatumd_rw against the real owner/runtime ownership topology so an illegal owner-table touch reds the PR (the executable 42501 oracle — implemented + deployed, PR #553); L1b/P1 an ownership pre-flight lint (refuse a runtime migration that ALTERs/FK-references an owner-held relation at parse time) + Layer 0 a RESERVATIONS.toml ordinal ledger + CI collision/gap guard; L2/P2 the daemon declares requires_owner_bundle >= N and on a watermark shortfall HALTS CLEAN (typed awaiting_owner_ddl, DB untouched) instead of crash-looping; L3/P3–P4 decouple apply-from-serve — a schema_fingerprint drift gate (refuse-to-serve, mutate-nothing) then a one-shot striatum daemon deploy (both-role coordinator, resumable cursor, deploy receipt; serving role loses DDL); L4/P5 a rehearse step on an ephemeral two-role clone emitting a plan-hash-bound, fidelity-tiered rehearsal_receipt.v1 the prod apply refuses-without, plus expand/contract for irreversible reshapes (unblocks RFC 0136 P2/P3). P0 done; P1–P2 land as direct runner-fix PRs; P3–P5 tracked as sliced issues.
0143	accepted (D261, split: Slice A ships now / Slice B blocked on RFC 0168)	Lane credential survival across a daemon boot-epoch rotation (#512; security/authz). A striatum-lane lane cannot reseal already-completed work after striatumd restarts mid-run: the RPC endpoint rotates and the lane's credential-resolution chain falls through to the daemon's owner-only (halbritt 0600) runtime client-token, which it cannot read — so it exits unsealed despite a complete deliverable on disk. The intended credential is the env-baked session-bound token (STRIATUM_MCP_TOKEN, {claim,write,read,review}, RFC 0096 V2 / #135 / #296) which does not rotate; the bug is the fallback reaching the daemon bootstrap admin token ({admin,read,write,claim,review,apply,recovery,surgical_recovery}). The issue's literal fix (group-read the client-token) widens who can read the full-authority admin token to every lane and dissolves the session-binding trust model → categorically RFC, not FIX. The trust-model-preserving alternative (mint a durable lane-readable session-scoped reseal token) is a new credential-distribution mechanism (ownership/mode, a boot-epoch-survival authority class, lifecycle/revocation) → also a decision, not a triage edit. HOT dims security_or_authz + cross_team_contract force RFC. Options: (1) status quo + operator requeue; (2) durable lane-owned 0600 session-scoped reseal token; (3) re-mint+re-inject the session token on rotation so the admin token is never reached; (4) narrow the fallback so a non-owner lane fails legibly instead of silently unsealed. No token code lands with the proposal.
0154	implemented (D250 accept; D257 impl)	Debounce multi-reviewer final-review fan-in before revision-cycle routing (#476). IMPLEMENTED (D257) as the opt-in cycles[].debounce_cohort field (all or a positive integer; absent = today's first-dissent route) — daemon-side debounce in applyVerdict over the frozen gating-seat cohort (gatingCohortDebounceSatisfied), no DDL. On a multi-reviewer final-review panel (e.g. prompt-committee: 3 parallel final reviewers → author + bounded revision cycle), the daemon routes the author revision cycle on the first seat's needs_revision verdict (go/pkg/mutations/review.go applyVerdict case "needs_revision" → routeRevisionCycle), with no sibling-seat / quorum check. This is the present intended behavior, not a predicate oversight: the accept path already debounces over the frozen gating-seat denominator (panelQuorumSatisfied, RFC 0132/0135 D214/D216), and barrier_quorum.go's staleSealTrap doc explicitly carves revision-routing out of the barrier — so accept waits for the whole panel while dissent short-circuits. The friction (#476): an in-flight straggler reviews a soon-to-be-stale artifact, and a second straggler needs_revision can consume a second max_iterations slot (default budget 2) → premature escalation. The operator playbook ("don't route to author until all verdicts land") is currently a load-bearing human heuristic, not a test-enforced invariant — so there is no PRE-FIX failing proof and a direct patch would have to invent policy: cohort identity, all-N vs quorum vs dissent-threshold wait shape, gating-vs-advisory handling, one-slot bounded-cycle composition, and late-straggler supersession (composing with RFC 0126/D194 generation non-currency). Forced to RFC by wire_format (a new cycles[] schema field) + cross_team_contract (revision-routing timing the dissent ledger #339, the quorum barrier D214, and the cycle budget all coordinate on). Options: (A) status-quo + legibility (surface "N-1 reviewers still in flight"); (B, #476's suggestion) opt-in all-N/quorum debounce reusing the existing gating-seat denominator, default = today's first-dissent behavior; (C) B + a dissent-threshold early route. No code, schema field, or migration in the stub; next free decision D249.
0157	accepted (D251)	Canonical run/job state projection across operator read surfaces (#481; DX/legibility). The three primary operator reads expose the same run/job state in three structurally different shapes: run.summary → .run.state (object) + .jobs[] (per-job list); dashboard --once → .jobs_by_state{} (map) with no top-level run state at all (despite the spec prose promising "run state and branch"); status --json → .runs[].state (list) + .jobs{} (state→count map). A script/AFK agent must special-case each verb to read (run_state, per-job states). A direct FIX is rejected because the issue's own remedy — a shared {run_state, jobs:[{id,state}]} block — introduces a new additive cross-surface read contract (hot dims: public_api, cross_team_contract) that AFK agents/scripts will hard-depend on; that requires ratifying the canonical shape (or wontfix if the divergence is intentional — a maintainer judgment the issue explicitly invites), not a unilateral worker patch. The narrow defensible sub-fix (add the dashboard's missing top-level run state the spec already promises) is folded into the decision so the shape is chosen once. No code lands with the proposal.
0158	accepted (D252)	Verifier self-pin / pin-drift doctor classes and version-skew resweep (#483; RFC 0141 follow-up). Frames the four RFC 0141 child-ideas as a recorded decision before implementation: a builtin_selfpin_drift doctor check (recompute verifier.selfSHA() vs the build that authored existing builtin receipts — catches make install-without-restart skew), verifier_pin_drifted / verifier_check_unpinned doctor classes (a "this run would degrade N VERIFIED claims on this host" pre-flight, paired with verifier pin --diff-only), a verified_stale staleness rung + verifier resweep --builtins (treat a Striatum version bump as a bounded re-verification sweep, not a mass VERIFIED→ASSERTED failure), and generalizing the intent/pins "commit the policy, observe the bytes per host" split. HOT dims (security_or_authz, product_safety_claim) force RFC over direct FIX: a verified_stale rung redefines what VERIFIED means across a version bump. Preserves D227 (the daemon executes nothing) and D243 / #482 (gate-side daemon-authoritative attestation, fixed on origin/main via #502 — not re-litigated here). No code/schema/migration lands with the proposal.
0161	accepted (D253)	code_change revision-cycle policy (#506; RFC 0137/D247 dogfood signal). Accepted cheapest-first: calibrate reviewer posture before any graph change; add a bounded asymmetric concession-only author-rebuttal alternative; keep the max_revision_cycles default at 1 (RFC 0034 V1). part-b operator-readable blob_exhaust findings already shipped (PR #525, artifact get-content).
0162	accepted	Lane auth silent-failure observability (#569; RFC 0137 metric surface). Accepted D259 — MVP implemented + verified + banked to main @ 418bd1d6 (falsification_gate design committee; cycle-2 over-claim findings F1/F2 folded; 8 metric families + fail-closed resolver + Layer-1 expiry sampler + codex-scoped Layer-3 heartbeat; 6 alerts vendored to halbritt/proximal @ 87458e9). Layer 2 active prober + the live game-day fire test are follow-up. A lane's provider-auth preflight (laneproviderauth, DefaultTimeout 45s, lane_provider_preflight_timeout) can time out and go unnoticed — #556/#567 (@ bb77ed75) fixed the behavior but there is no alert; failure only surfaces at point-of-use (supervise.start / run drive), so a quiet lane's dead credential is silent for hours. Root reframe: we alert on the presence of errors, never on the absence of success — the credential-dimension sibling of RFC 0091/0131 session liveness. Proposes a 3-layer defense-in-depth: (1) expiry & renewal-health telemetry ⭐ (per-lane seconds_to_expiry gauge + flat-trend signal catching a dead renewer days early); (2) cross-lane differential probe + a negative probe (assert the lane still rejects a bad credential = live fail-open regression test), paging only on divergence-from-sibling-quorum so shared outages stay quiet; (3) per-lane freshness dead-man's switch (auth_last_success staleness + absence-of-series census). Plus a signed auth-registry/roster backbone. Rejects fever-throttling, synchronized short TTLs, and sacrificial canaries as traps; threads the shared-fate "who watches the watcher" risk + a mandatory game-day fire test through every layer. Metric surface lands here (RFC 0137 exporter); alert rules land in halbritt/proximal/observability (separate PR).
0163	proposal	Staged-not-adopted offline consolidation + attested noise-robust gate (promoted from showerthoughts/prior-art-skillopt.md; SkillOpt-Sleep genotype). Nightly self-improvement that cannot self-adopt: capability-typed propose-only packets lacking the merge token; two-key adopt (operator sig + fresh adopt-time --assert-improves replay); signed verdict-receipts chained into provenance + a gate-was-real challenge; a noise-robust accept gate; and a safe-unattended envelope (signed canary self-test, blast-radius token bucket, reverse-diff reversibility, staleness lease, check-set drift tripwire). Designed via /adhd. No code lands with the proposal.
0164	proposed	Untrusted-substrate read-side git neutralization (promoted from showerthoughts/prior-art-recall.md; recall genotype — same hostile-clone threat model). The commit path is hardened (-c core.hooksPath= at git_commit_apply.go:342) but read-side git runs bare, inheriting the untrusted repo's .git/config → live core.pager/diff.external/merge.tool/fsmonitor/url.insteadOf/alias code-exec gadgets under the daemon identity. Decision (allowlist posture as layered severance): (1) a CleanRepoFor() chokepoint serving an objects-only minted clean.git so the untrusted config is never parsed; (2) a born-neutralized gitEnv() that omits the GIT_CONFIG_COUNT family (env-config overrides -c) + a bounded subcommand allowlist, applied to the spawned lane env so the agent's own bare git is born-neutralized; (3) gate-evidence + a two-state recovery contract split by clearer-of-record — machine-decay gate.read_gadget_detected for recognized-and-neutralized gadgets vs the existing human-cleared recovery.quarantine_lane for unknown/failed; red-team corpus green-hash as the allowlist's completeness certificate. Explicitly SKIPs write-confinement (already solved by ValidateSandboxJail) and a repo-config validator (no attack surface; RFC 0127). Designed via /adhd. No code lands with the proposal.
0165	accepted (D277; build in RFC 0173)	Claude provider credential freshness and spawn-time projection (#583; RFC 0121/RFC 0162/RFC 0143 boundary). Claude lanes currently consume a frozen ~striatum-lane/.claude/.credentials.json copy; Claude rotating refresh tokens make that copy stale mid-dogfood, causing agent_mcp_discovery_stall and recovery exhaustion. The v5 design gate accepted an access-token-only projection model, launch credential binding for recovery freshness, projection-off fail-closed handling for missing/unknown/unmodeled Claude credential kind, and credential-domain-before-same-user precedence. Source build is delegated to RFC 0173 and the successor rfc-0165-build workflow with explicit source/SQL/generated contract or authority-map/product-doc scope.
0167	accepted (D260; design to build directed)	Operator identity and run attribution. Defines leased, memorable operator handles over immutable principals, write-once run attribution, custody history, and read surfaces such as striatum whose <run-id> so concurrent operators can identify which session owns a run without trusting terminal titles or scrollback.
0168	accepted (D272 accepted_with_follow_up; P0 build v3 integrated)	Per-lane OS user as the lane security principal (RFC 0143 Slice-B prerequisite). The shared striatum-lane uid is the root that made RFC 0143's authenticated reseal channel unsolvable across seven design cycles (BC1-W1-ORACLE: a same-uid sibling can respawn-pane-replace the daemon-launched pane against the same-uid-mutable tmux oracle; a 0600 reseal file is the same replay surface). Adopts a per-lane OS uid (pre-provisioned pool), leased per lane, as the only structural, host-independent fix that survives a daemon restart and dissolves the whole same-uid class — under which RFC 0143 option 2 reduces to a safe lane-uid-owned 0600 reseal token. P0 build v3 adds the lease table, owner bundle, generation-bound supervisor attestation/control, private supervisor scratch bearer files, provider credential selector refusal, workspace ACL grants, and doctor/recovery visibility.
0169	proposed	Provider-agnostic lane credential readiness (#583; generalizes RFC 0165; RFC 0121/0162 boundary). A code audit finds the #583 stale-copy failure is Claude-specific: codex is lane-owned + self-refreshing (RFC 0121-gated), agy has no provider OAuth (daemon mints an ephemeral token per launch), so agy already runs the daemon-as-custodian model RFC 0165 reaches for. Proposes three layers over a (provider, lane_user, generation) key (the primitive 0162 and 0165 both defer): (1) a Provider Readiness Contract — one ValidateReadiness adapter interface + CredentialAssuranceClass registry replacing ~5 hardcoded switch sites, refuse-closed, unregistered-provider quarantined, subsuming RFC 0121 (codex predicate), RFC 0162 (resolver/expiry feed), and RFC 0165 (the OAUTH_COPIED class); (2) ephemeral fresh-per-spawn placement ★ — a CredentialPlacer that converges Claude onto agy's model so a stale copy is structurally impossible; (3) daemon-owned secret-free custody + bad-generation immune memory + tamper-proof breaker folding repeated stale-cred stalls into one reseed_required. Cross-cutting: admission-freshness ≠ runtime-freshness → a re-admission heartbeat / cleanup-as-lease-boundary closes mid-run expiry. Rejects killing the credential file (infeasible against third-party CLIs), timer-as-correctness-boundary, and reimplementing vendor OAuth refresh. Designed via /adhd. No code lands with the proposal.
0170	proposed / P0 implemented (D271; runtime schema 45)	Self-culling repository — a CULL workflow class (answers the 2026-06-24 deep-architecture-review finding: machine-speed accretion with no brake — +85.5K/−2.8K Go LOC in 13 days, 41 stranded design branches, dead subsystems surviving ~4 reviews). The observe-only P0 tracer is on main: runtime migration 0045 adds the cullable_entity candidacy ledger and the read-only DecayTickSweep nominates/withdraws Tier-1 supersession candidates off the recovery scheduler without deletion, paging, doctor state, or run-admission effects. P1+ carries the remaining CULL shape: reversible tombstone→reap with absence-of-use verifier receipts, counterforce/throttle design, and the open questions on cull-as-peer vs build phase, soak length, amber-only vs hard block, and coupling-vs-LOC meter.
0171	accepted (D273; partially implemented)	Operator records blob dockets and virtual records. Moves generated operator/run record bodies toward daemon-indexed blob storage while keeping git reviewable through small dockets and pointer manifests. Shipped slices include the generated-record index, deterministic docket/Merkle model, records docket, blob-required publish posture, generator defaults, historical inventory dry-run, import/materialize/verify proofing for safe generated records, generated-record doctor integrity checks, generated-record-backed artifact-anchor doctor handling, check-docs URI/hygiene support, hygiene guard, a five-file dogfood operator-report deletion pilot, and a 1,755-file operator artifact/workflow Markdown deletion pilot. Broad historical deletion remains blocked pending separately authorized follow-up deletion pilots.
0172	accepted (D275)	Proof-only multi-campaign supervision. Promotes the falsification-cleared MULTI_CAMPAIGN_SUPERVISION shortlist into an RFC direction: campaign arcs, authority receipts, fresh-context replay, deferral quarantine/scope-drift refusal, cross-surface contradiction reports, and a read-only portfolio status surface. V1 is proof-only/recommendation-only unless a later accepted decision defines exact daemon authority for a transition; tracker rows and dashboard rows remain provenance and stop pressure, not permission.
0173	proposed	Claude provider credential projection build. Build RFC for accepted RFC 0165: generated projection contract, pure pre-spawn planner/refusal witness, access-token-only Claude projection, immutable launch credential bindings, provider-auth debt recovery classification, redacted operator surfaces, and TTL-spanning dogfood proof.

Template

Use this shape for new RFCs:

# RFC NNNN: Title

Status: proposed | accepted | deferred | rejected | superseded
Date: YYYY-MM-DD
Context: links
Superseded by: successor decision/RFC links, when status is superseded

## Problem
## Goals
## Non-Goals
## Proposal
## Acceptance Criteria
## Open Questions
## Domain Modeling

When an RFC is fully replaced, update both the RFC header and this index to superseded; keep the file as provenance and name the successor artifact. When only part of an RFC is replaced, keep the live status and add a current status note that names the superseded clause and successor.

The optional ## Domain Modeling section identifies which DDD pattern the new concept fits (aggregate root, value object, domain event, or boundary clarification) and cites docs/reference/domain-driven-design.md § "Adding to the model". RFC 0019 is the precedent.