v0.12.0 - the architecture map: planning grounded in the code that exists

Planning gets ground truth: a generated architecture map closes the feature-after-feature loop - finish a feature, and the next one's plan is grounded in the code that now exists. Plus a diagrammed, up-to-date README. 16 commits since v0.11.0.

Highlights

• ritual architect - one budgeted headless survey writes .ritual/architecture.md: modules, data flows, conventions, extension seams ("new X plugs in here, copy Y"), and boundaries. The agent writes a candidate (architecture.md.new); ritual validates it (run outcome, real content, required sections) and installs it atomically with rollback - no failure path can damage the live map, and the previous version survives as .bak. Knobs: budget_architect_usd, [models] architect, [architect] enabled / auto_refresh.

• Grounded planning - once the map has real content, the plan stage is told to align with it and route new work through its extension seams (divergence must be justified in the plan), and plan-review receives it as ground truth (RITUAL_ARCHITECTURE_FILE, same rail as the constitution) to flag plans that rebuild what already exists or violate a stated boundary. Code reviews stay map-free - they judge the diff.

• Honest freshness, everywhere advice lives - the map is stamped with a .ritual-scoped tree fingerprint: ritual's own artifacts (plans, findings, the sidecar itself) never stale it; source edits and commits do - advisory only, same semantics as the dual-review staleness marker. Missing/stale surfaces in the TUI sidebar, ritual status, ritual doctor (Warn, never Fail), and the plan stage-detail (i). Unknown is never reported stale (non-git trees, legacy docs).

• The loop closes itself - when ritual complete reaches genuine completion it auto-refreshes the map while the feature's context is hot, so the next feature plans against post-feature reality. Never on --check (the CI gate stays token-free), skipped offline/over budget with a note, and a failed refresh warns without failing completion.

• TUI: palette architect action - live stream on the Live tab, finalization inside the task (the stamp is settled before the result is reported - TUI and CLI share one failure-handling path), x cancels the daemon with the live map untouched, and an external ritual architect clears the sidebar nudge live via the mtime gate.

• README, diagrammed - three mermaid diagrams with one semantic palette (orange = claude, teal = codex, purple = cross-model, amber = artifacts, green = gates/done): the pipeline with the grounding/auto-refresh loop, the daemonized-run + findings data flow, and an ecosystem map of every required/optional integration. The optional-prerequisites list is now complete (pal MCP + Gemini consensus and nvim were missing), the roadmap entries carry their version labels, and the version badge finally moved off 0.10.1.

Hardening (from this release's own dual-review)

• finalize is transactional: an install failure mid-swap rolls the backup back; a stamp failure after a successful install drops the stale sidecar (Unknown never lies) and says the map WAS installed.
• The TUI architect run is cancellable (x kills the daemon; the tail finalizes the cleanup) instead of claiming "no active run".
• ritual status only nudges ritual architect where a .ritual/ actually exists.

Install

cargo install --path . --locked      # or: cargo build --release

Full changelog: v0.11.0...v0.12.0