Ruleset Design — Adversarial Review: Lifecycle & State

Design artifact: plans/ruleset-runtime-design.md (repo orchestrata-ultimate, branch architecture/domain-model) · v16.1, sha256 031a6ca3…, 1,408 lines · becomes SPEC-115 at spec-sync. Every version is one commit (ADR-0039/F12). Review evidence: plans/reviews/ruleset/ — 39 committed files: 32 round reports (r1–r16 × 2 lenses) + 7 fold-verify reports (v10–v16) (ADR-0049 proposed the wiki/graph enrichment; the repo home is live).

1. Live state after round 16 (2026-08-29)

1.1 Trajectory — confirmed findings per round

The round-16 rise is localized: F13 — the Mohamed-ratified traceability/approval contract, added outside the loop — took its first adversarial review and yielded four CONFIRMED findings (R16-4 HIGH · R16-7/R16-9/R16-10 MED), the densest defect concentration per line in the artifact. The round's other five HIGHs are engine machinery: the as-of-cursor read path, the C-5/§4.1 currency split, the prove custody scope, the REJECTED lineage field, and PASS-wash. That machinery — the subject of rounds 13–15 (lease chain, silence gate) — kept converging: mostly single-clause residuals, and three long-lived residues — two open since round 7, one since round 8 — retired for good (9th/9th/10th rounds by the lifecycle lens; the best residue round of the series, zero falsely closed).

1.2 Round-16 results in detail

Concurrency lens (ruleset-review-r16-concurrency.md): 5 CONFIRMED · 4 DESIGN-GAP. Worst: R16-1 the as-of-cursor lease fence has no stated read path (the queue owns no stream cursor, lease records carry no stream coordinate, trim can outrun it); R16-2 C-5's designation clause still states the old medium/basis, splitting the "ONE medium" claim; R16-3 kind=retire does not actually close a lease chain (a later grant satisfies every stated rule). Fold audit: 19/24 hold; two v16-verifier passes overturned; §8 = 80 rows.

Lifecycle lens (ruleset-review-r16-lifecycle.md): 10 CONFIRMED · 3 DESIGN-GAP. Worst: R16-4 (HIGH) F13(D)'s ratification interface describes today's CLI doing things it does not do (no amendment id, signs nothing, reject re-enters the stage, no rollback verb) and enumerates a six-field payload that omits seven groups of signed fields (kind, amendment, all four overrides, expiry_change_ack, the narrowing flags, schema_version, withdrawn) → ADR-0050; R16-1 (HIGH) the per-gate-signer fix missed the normative custody bullet (prove still "proofs and composition proofs ONLY"), leaving queue-/A1-gated AdmissionRecords out-of-namespace; R16-3 (HIGH) PASS-wash: resolution is lineage-scoped while verdicts are candidate-scoped, so k submitter-triggered re-runs bury a FAIL; R16-2 (HIGH) the REJECTED schema never gained the lineage field C-2b promises — in a document that refuses unknown fields, readers would refuse Mohamed's no. Also R16-7 (MED): F13(C)'s eight named verification bindings scored 2 accurate · 1 partial · 5 false-or-unbound — check-traces is a net-count pre-commit ratchet (--max 2219), and trace-audit, trace_intel, spec-authority and both factory conformance checks are bound to no failure point today (see §2.2 H). Rule-5 sweep: 3 breaches. Fold audit: 31 arms, 21 closed, 1 unfixed (v16-D4).

1.3 §11 readiness (reviewer-computed, hash-evidenced)

Seven items are byte-identical across all nine snapshots v12→v16.1 on both hash measures. Criterion-2 satisfaction: 9 of 11.

1.4 The decision queue (every decision IS an ADR — ADR-0046/0047)

2. THE LIFECYCLE — every phase, its gates, and the exact commands

2.1 Diagram

2.2 Phase-by-phase, with the exact commands

A. Round dispatch. Two fresh lenses (concurrency/distributed-state; lifecycle/proof-binding/authority/fail-closed). Briefs are data: written to plans/briefs/review-rNN-<lens>-brief.md, committed before dispatch, and the agent's prompt points at the committed file — zero drift between what Mohamed can read and what runs. Reviewers get NO conversation context; "prior rounds are evidence, not authority."

B. Evidence. Each lens writes its full report; on landing: cp <scratchpad>/ruleset-review-rNN-<lens>.md plans/reviews/ruleset/ && git commit — the rule established by ADR-0049 (Proposed). Rounds 1–15 predate it and entered the repo in one rescue commit (3e6eb9c5, 39 files); round 16's lifecycle report is the first committed on landing (50a83a63).

C. Fold → vN. Read both files in full (the round-12 lesson: folding from a summary left 9/24 defects uncorrected — fold from files, never summaries). Apply per-finding edits with grep-verified anchors; run the author sweep (grep for every retired term must return zero live hits); write §12 per-id dispositions (bare "ALL" banned — rule 6); snapshot; git commit (one version = one commit; the RUL-007 attribution gate runs on every commit and must PASS).

D. Verify → vN.1. An auditor re-checks the fold mechanically — 8 checks: citation resolution, §8 row liveness both directions, F6 closure both directions, per-id disposition truth (scenario re-runs), inertness + authority root (rule 8's three clauses), deletion re-grade (rule 5), ledger coherence, count/vocab consistency. Its defects are folded from its file as vN.1; git commit.

E. Record. plans/ruleset-review-status.md + this wiki page updated and committed. Any decision discovered en route is minted per §2.3 — chat is not a home.

F. Mohamed's gates. One decision at a time; the data lives in the ADR before the ask; his ruling is executed the same turn (status flip in all three homes, gate green, shas shown); a conditioned ruling ("pending round 16") is recorded verbatim in the ADR's Provenance. Only Mohamed rules; a ruling-weight fork found mid-work → STOP, mint Proposed, wait.

G. Exit. One full round, two fresh lenses, zero confirmed, fold audit clean. Not met → next round. Current projection: the engine machinery is converging; the remaining fire is concentrated in ratified-text corrections (ADR-0050) and two subsystem clusters.

H. Spec-sync and build (bound by ratified F13). The design becomes SPEC-115 with the REQ-115 decomposition map fixed in advance; implementation dispatches under ADR-0048's waiver (Accepted-ADR-scoped) or a RUL-022 contract; every symbol carries @traces(REQ-115-NNN). F13(C) names eight verification bindings; round 16 (R16-7) found 2 accurate, 1 partial and 5 false or unbound — check-traces is a net-count pre-commit ratchet at --max 2219, and trace-audit, trace_intel, spec-authority and both factory conformance checks are bound to no failure point. Wiring them is open work, tracked by R16-7. The suite runs through scripts/run_tests.py (kernel required, no xdist, no mocks); Mohamed gates every merge.

2.3 The ADR procedure (the decision skill, deployed + word-triggered)

1. Next id, correct register — factory 4-digit (docs/adr/), project ≤3-digit (this wiki): ls docs/adr/ | grep -oE '^[0-9]{4}' | sort | tail -1
2. docs file (# ADR-NNNN: Title · Status · Date · Context · Decision · Alternatives rejected · Consequences · Provenance — directives quoted verbatim)
3. README register row
4. Wiki entry, title byte-identical, append-only (never edit an Accepted body)
5. Graph: uv run python scripts/sync_architecture_to_graph.py --adrs .../knowledge-wiki/projects/orchestrata-ultimate/decisions.md
6. Gate to green: uv run python scripts/check_adr_graph_sync.py → the id reads OK in sync
7. Commit BOTH repos (Mohamed sole author; no AI attribution; never push)

Ruling = status flip (Proposed → Accepted/Rejected/Superseded) in all three homes; supersede, never edit, an Accepted decision. Trigger: any prompt mentioning decision/decide/ADR/ratify/ruling injects the skill (.claude/hooks/ decision-adr-trigger.sh, shipped in the orchestrata plugin).

2.4 Gate inventory — everything that can say NO in this lifecycle

The session honesty gates are cross-cutting — they run on every session turn — and are not drawn in §2.1; plugin currency is drawn in Phase E.

3. Provenance

Round evidence: plans/reviews/ruleset/ (39 files, 27,339 lines). Design versions: 21 commits on architecture/domain-model (v3 → v16.1 — one commit per version). Briefs: plans/briefs/. Status: plans/ruleset-review-status.md. ADRs: docs/adr/0039–0050

• this wiki's decisions page + ArchitectureDecision graph nodes — gate-verified: check_adr_graph_sync.py reads OK across 75 ids (2026-08-29). The graph home for 0047–0050 was missing when this page first published; this page's own adversarial fact-check caught it, and the ADR-0047 register migration closed it the same day.

Amended 2026-08-29 from that fact-check (16 findings: 4 HIGH · 6 MED · 6 LOW; 49 claims verified correct and left untouched).