[Constitution] Alignment principle + CI guardrails (addresses b87992f drift)

[dtzp555-max]

Background

On 2026-04-11, commit b87992f ("fix: use dedicated /api/oauth/usage endpoint for reliable plan data") was merged. The commit message asserted that /api/oauth/usage was "the dedicated usage endpoint that Claude Code CLI uses." This was false — the string does not appear in cli.js at any shipped Claude Code version. The endpoint was fabricated by an LLM-assisted authoring pass that generalized from adjacent OAuth paths without grepping cli.js. A follow-up (cb6c2a8) compounded the error by caching the fabricated responses. The dashboard /usage progress bar was broken for nine days.

This PR is PR A of the remediation. It is governance-only: it establishes the constitution that makes the drift structurally impossible to repeat. It does not modify any runtime code.

Files in this PR (4)

1. ALIGNMENT.md — OCP project constitution.

   • Core principle: OCP is a proxy layer for Claude Code, not an extension layer.
   • Five binding Rules: (1) grep cli.js first, (2) no invention, (3) match the implementation, (4) unalignable features are deleted, (5) commits cite cli.js line numbers.
   • Golden reference paths per machine + annual audit pin slots.
   • Historical Lesson section: the 2026-04-11 drift, recorded in full.
   • Unalignable Policy: deletion, not deprecation.
   • Annual Alignment Audit fixed to 11 April each year (the drift anniversary).

2. CLAUDE.md — project-level session instructions.

   • Flags ALIGNMENT.md as required reading before any code.
   • Three hard requirements for every server.mjs PR: cli.js citation, CI blacklist pass, independent reviewer (Iron Rule 10).
   • References CC 开发铁律 v1.3 Rules 10, 11, 12.

3. .github/PULL_REQUEST_TEMPLATE.md — mandatory alignment-evidence section.

   • Three author checkboxes (cli.js citation, scope justification, commit-message citations).
   • Reviewer checklist requires opening cli.js at cited lines before approval.
   • Blank section = automatic request-changes.

4. .github/workflows/alignment.yml — CI guardrails.

   • Hard fail: grep server.mjs for blacklisted tokens (api/oauth/usage, api/usage). Scan is restricted to server.mjs; ALIGNMENT.md and CLAUDE.md are allowed to quote the tokens as historical references.
   • Soft check: scan PR commit messages for "Claude Code uses X" / "cli.js uses X" assertions lacking a cli.js:NNNN or cli.js vE4 <fn> citation; emits warnings for reviewer enforcement.

Historical Lesson (summary)

Field	Value
Drift commit	b87992f (2026-04-11)
Fabricated token	/api/oauth/usage (not in cli.js)
Compounding commit	cb6c2a8 (cached the 4xx away)
Impact window	9 days, /usage bar broken
Root cause	LLM hallucination accepted without grep cli.js; no CI blacklist; no constitution
Remediation	PR A (this PR) + subsequent code-layer PR(s)

Merge preconditions

• Reviewed by an independent opus reviewer (not the drafter). Iron Rule 10.
• Reviewer confirms the historical record in ALIGNMENT.md matches the git log for b87992f and cb6c2a8.
• Reviewer confirms the CI blacklist scope is correct (scans only server.mjs; does not false-positive on documentation).
• This PR is kept draft until all of the above are satisfied; then converted to ready for merge.

Out of scope (explicitly)

• No changes to server.mjs.
• No changes to package.json version (constitutions do not bump versions).
• Deletion of the fabricated /api/oauth/usage code path in server.mjs is deferred to a follow-up PR (PR B), which will land under the rules this PR establishes.

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com