Propose unattended capture, and what stops it minting instructions

[MongLong0214]

Part of #426. Docs only — one ADR, no source change.

Status: Proposed, not Accepted

It changes SPEC §3 vocabulary, which binds every implementer of the protocol and not just this codebase. ADR-0028 says the thing it declines to build "needs its own ADR and its own approval." This is the first half.

Why now

The product goal is that one install is the last thing a user does. After commitlore init that is already true of injection, validation, trailer application, the notes write, the publish (#416), the collect, the index and its staleness recovery (#406), and concurrent hooks (#420) — verified end to end against a dev build.

One thing still asks: the skill shows verified records and stages only what the user keeps. ADR-0028 is explicit that the core does not require it.

The argument for building the guarantee before it is needed

The expected objection to unattended capture is that it mints instructions nobody read. It does not, today. No installed surface passes --trusted-author, inject defaults it to [], and gradeRecord is fail-closed on that. Measured on a repository whose record was authored by its own committer: 0 lines [directive], 6 lines [claim] (#415).

That safety is accidental — it holds because a feature is missing, and #415 exists to decide whether to add it. The moment trusted authors become configurable, unattended capture starts minting directives, and the guarantee would have to be retrofitted onto records already in history.

What is proposed

1. Capture runs unattended; the skill's step 4 goes.
2. Provenance: drafted marks a record staged without a person reading it, and grading caps it at claim — the treatment reconstructed already gets. Additive: a reader that does not know the value falls to unknown, which also grades claim, so an old implementation is safe rather than wrong.
3. Promotion is a new record that Supersedes: the old, because a commit message is immutable. Never an edit.
4. Promotion is optional and rare. A repository where nobody promotes serves only claim records — which is what every installed CommitLore serves today.
5. An off switch, in the capture policy ADR-0021 §7 already hashes.

Two alternatives that looked right and are not

An approved phase (the shape ADR-0028 sketched): as a gate it stops the record being applied at all, which is the feature; as a flag it stays in .git/ and never reaches the trailers grading reads.

Endorsement through the notes mirror: attractive because a note attaches without rewriting history, and #409 made a notes record graded by its own author. But #409 also grades a multi-source record on every source and keeps the floor — so an endorsement note cannot lift a drafted record under the same Record-Id. The mechanism that closed the forgery closes this too.

The cost the design does not mitigate

With no person in the loop the pipeline decides what is worth recording, and the skill's own guidance is that most commits carry nothing. A record costs a future reader attention; unattended capture spends that budget without asking. Recorded as Unverified: on the commit, because nothing here measures it.

Not before

M5's verdict and the release that follows it. The ADR also defers the injection-legend question (#415) for the same reason: changing injected bytes changes cacheKey and breaks the byte-identity test/inject.test.ts pins, and M5 is mid-flight against a pinned harness.

test/dogfood.test.ts 9 passed · spec/verify.sh 26 fixtures OK.

[github-actions]

CommitLore — record lint

Trailers: clean — 1 commit in origin/dev..25bf6327285835841d174064e3d3327a61b7d148
Active constraints: 2 limits · 3 ruled-out · 1 warnings — from 1 record over 1 changed path

Active constraints for the paths this PR touches

Limits (2)

• r-adr30x 25bf632 — a commit message is immutable without rewriting history, so a record cannot be upgraded in place and promotion has to be a superseding record
• r-adr30x 25bf632 — X- extensions are defined as never interpreted by the core, so the unread signal cannot live in one

Ruled out (3)

• r-adr30x 25bf632 — an approved phase in the pending transaction | as a gate it stops the record being applied at all, which is the feature; as a flag it stays in .git/ and never reaches the trailers grading actually reads
• r-adr30x 25bf632 — endorsing a drafted record with a note written by a trusted human | Notes-sourced records inherit the annotated commit author's trust: anyone who can write refs/notes/commitlore can forge a [directive] #409 grades a multi-source record on every source and keeps the floor, so the endorsement cannot raise it under the same Record-Id
• r-adr30x 25bf632 — removing the prompt and changing nothing else | correct today only because --trusted-author is unreachable, which makes the product's safety depend on the absence of a feature it intends to add

Warnings (1)

• r-adr30x 25bf632 (claim) — unattended capture spends a future reader's attention without asking; the skill's own rule is that most commits carry nothing and an empty answer is the common correct one

_{Trailer violations fail this check. Active constraints are informational — they are what the repository already decided, not a verdict on this PR.}