feat: harvest 3 P4 — the github-issues axis, after the draft, decision records, hygiene, what the phases emit (C5–C7, C9, C10)

[j4th]

Summary

Harvest 3, pass 4 — the last of the four PRs the spec docs/superpowers/specs/2026-09-06-cascade-kit-harvest-3-design.md planned. Five clusters, one PR:

• C5 — the github-issues axis, with its bodies. The .github/ starters ship as literal bodies (issue forms applying provenance and holding labels, config.yml, the PR template carrying the empty ## Review gate and ## Triage blocks, CODEOWNERS, a CI stub with its two promotion traps, dependabot.yml with the floor, the .gitattributes counter-line); the label taxonomy is an axis structure scaffold creates in full; the required-checks trap is one symptom with three causes; the ADR lint runs with no trigger filter under a pinned job name; rulesets go over gh api with the check context read off a real run; the two review workflows are blueprint templates with their seven constraints stated at the site and a comment-landed assertion; scaffold's review question names its consequence; the gh shape has one home.
• C6 — after the draft opens. The roadmap (docs/cbk/ROADMAP.md, freely mutable) that blueprint emits, framing appends, rough-in and /finish flip — on the PR's own branch, as the last commit, with the number predicted from the shared sequence; the post-merge checklist in the hand-off; the PR body as the audit surface for the PR's whole life (## Triage — round N via /pr-respond); the backward sweep beside the roll-forward; the measurement variant of a spec with the verdict rule committed before any number exists.
• C7 — decision records, corrections, facts stated more than once. The Extends: grain with its disambiguation test and the four relation slots on the template; docs/adr/corrections.md as an append-only starter in both homes; ## Multi-surface facts stated once with the companion vocabulary (three instances); adr-new defers to the conventions for its sync targets; the frozen-corpus ingestion pattern for consultation with its errata companion, Promotes:, and the enforcement set scaffold registers; handoff notes to later phases in the brief.
• C9 — supply chain, hygiene, the issue-less branch, the licence. Settle-window depth (age necessary not sufficient, toolchain pins by hand, lockfile diffs kept visible with the linguist counter-line), .gitignore anchoring, the issue-less branch <type>/<short-slug> with its PR-body statement and the gate line written as not run, a Licensing section scaffold confirms, MCP configuration in the tooling template, money and agent-run quota named separately.
• C10 — what the producing phases emit. The cascade-events index template scaffold creates and the appenders share (row plus phase note); blueprint's canonical homes and cross-document critic, its Amendments, Retired justifications, PR lifecycle, newcomer traps, source precedence, runbooks and domain-label sections; the framing template's emitted sections; the research phase's verdict-first corpus and spec-verification stage; the built-in LSP tool first-line in tooling; docs-only review not light where the docs are one-way doors.

Closes #17
Closes #18
Closes #19
Closes #20
Closes #21
Closes #22
Closes #23
Closes #24
Closes #26
Closes #27
Closes #28
Closes #29
Closes #31
Closes #32
Closes #35
Closes #36
Closes #37
Closes #38
Closes #39
Closes #46
Closes #47
Closes #50
Closes #51
Closes #52

Basis and declined asks

Decisions D17–D29 from the spec stand; the planning decisions for this pass are D-P4-1 … D-P4-7 in docs/superpowers/plans/2026-09-06-harvest-3-p4-axis-records-hygiene.md § Decisions (starters as one reference file plus the kit's own dependabot example; the review workflows as blueprint templates gated by scaffold's answer; the roadmap on the github-issues and in-repo-markdown axes; corrections.md in both homes; the frozen-corpus pattern as prose plus the ADR hook as exemplar; one MCP-configuration section; #47's spike-record method as the measurement variant). Declined or deviated, with the reason:

• The cascade stops at the draft PR: post-draft deltas, the flip's reviewer round and post-merge have no owner — and /finish's cascade-artifact ban contradicts the roadmap flip #50's /land command — declined per D23; the post-merge checklist in the /finish hand-off is the mechanism.
• scaffold promises .github/ starter templates and cites a file that has never contained them #19's caveat about the review gate — moot: the ## Review gate block landed in P2.
• cascade-depth:rough stays (plan Task 1 said drop it): both issue-template copies and blueprint's commit docs use it consistently for workstream parents, so scaffold creates it instead; the plan's absent grep was not added. A sweep finder raised the mismatch and its verifier refuted it on the same grounds.
• ADR-0000 is not edited (plan Task 6 said edit line 30): the kit's own immutability lint fails any change to an accepted ADR, so the decision-versus-claim sentence lives in docs/adr/README.md step 6 and the register's header; the starter mirror stays byte-identical.
• No License row in scaffold.md's Cascade metadata (plan Task 7): the bootstrap checklist already records that the licence lives in LICENSE and README § License, not in the metadata table; the settled text wins.

Review gate

• /simplify — ran: 4 cleanup agents (mid tier, medium), 23 findings → 17 after dedup, 13 applied as their own commits, 4 declined (2 Surface, 1 Defer, 1 Reject)
• pr-review-toolkit:review-pr — ran: 3 agents (code-reviewer, comment-analyzer, silent-failure-hunter; the test and type dimensions had nothing in scope — no test file or type changed), 8 findings → 5 after dedup, triaged 4/0/0/0/1 (A/AwC/S/D/R)
• review-sweep — ran: 8 finders + 8 verifiers, 6 confirmed / 2 refuted / 11 unverified, dropped coverage: none, bounds 3/8 — plus one direct finder (platform-claim sourcing, mid tier): 7 findings, 7 applied. Planned agents logged before dispatch: 1 roster + 8 finders + up to 8 retries + up to 8 verifiers = at most 25; 17 ran.

A defect in this run's own gate, disclosed: the verification-block runner I used through Tasks 1–9 was a stale extraction, so the P4 pins were never exercised until review; three reviewers independently found the live block red at two lines (8d66e61 fixes both), and the runner is now a live extractor. Every commit after that point ran the block as it is in the tree.

Instruction budget

Always-loaded set at HEAD: 130405 bytes (main: 121,073; 134,167 before the two moves below). The growth is in cbk-conventions.md (+8.5 KB: § Multi-surface facts, the Extends grain, the issue-less branch, the three-cause trap, two mutation rows) and tooling.md (+4 KB: MCP configuration, automated review, LSP first-line — a template the bootstrap disposition pass fills, path-scopes or deletes). § Licensing, the ADR relation grains and the required-checks trap's three causes moved to the reference half (the last two after the operator's continue); the contract keeps a pointer paragraph for each.

Triage

Apply (one finding per commit):

• 5ca58ec: the verdict-first corpus stated once, framing points (simplify: reuse)
• 176e633: the gh shape has one home in rough-in's commit reference; blueprint and framing state deltas and point; the matrices point; verify runs once after the last create (simplify: reuse, altitude ×2, efficiency)
• 414411a: the three commands cite tooling.md for the symbol tool (simplify: altitude)
• ee8f9b3: the docs-only exception stated once in pr-review.md (simplify: altitude)
• 3aa2e8d: the blueprint mutation row names its three append-only sections (simplify: altitude)
• 3397926: the two Quick reference rows are pointers (simplify: simplification)
• e20fab4: the review workflow template states its learned facts once; the "at their sites" claim made true (simplify: simplification ×3)
• 96a36ad, cdf7651, 512c88e: blank lines; the Refine-versus-Extend test in normal word order, both homes; the deliverable trap's converse stated directly (simplify: simplification)
• 9e7dccd: § Licensing to the reference half (simplify: efficiency)
• 84395c6: the dependabot example says what it shares with the starter (simplify: reuse)
• 98fc3f6: one verification assertion per invariant; the Amendments check reads the mutation row (simplify: altitude)
• 8d66e61: the adr-new bullet no longer cites the unemitted section; the rough-in matrix names the README index; the deep-path setting marked as a dated observation (comment-analyzer, code-reviewer, sweep ×3)
• c3d661c: every platform claim the diff added carries its page and date — seven claims (platform-claim finder)
• 190b5d1: the verification pins Tasks 1–5 named (sweep: test-coverage)
• 2cdaaf0: the phase-exit checklists carry the new outputs (sweep, unverified set ×3)
• 4a3bc1f: the backward sweep's test line; consultation's Test 4; framing's test case fixed (sweep, unverified set ×3)
• 939991a: single blank line after the gh-shape subsections (sweep, unverified set)
• 8b4a091: the re-trigger label step reads the PR's labels instead of matching stderr (silent-failure-hunter)
• a26544a: the gh shape stops at the first failed command (silent-failure-hunter)

Apply with care (read these two closely):

• 53ba33b: ADR-0000 reverted to main; the sentence lives in the README and the register (adr-conformance-reviewer via the sweep, confirmed by running the lint's own detection). A deviation from the plan, recorded above.
• 838f7c8: claude-review.yml records its start, runs the action with continue-on-error, and asserts a summary comment from the review app landed after the job started — posting a one-line notice and failing when it did not. Designed-unexercised as of 2026-09-06; the template says so at the site and asks the first project that lands it to restamp.

Surface → applied on continue (each its own commit; drop one with a single revert):

• 0db183d: the ADR relation grains (Refine, clause-scoped supersede, Extend, Promote, the claim register, the reviewer chain rule) move to cbk-conventions-reference.md § ADR relation grains, which loads with docs/adr/**; the contract keeps one pointer paragraph. (simplify: efficiency — "2,983 bytes, paid by every session regardless of whether it ever touches an ADR".)
• 237d527: the required-checks trap's three causes move to cbk-conventions-reference.md § Required-checks trap; the contract keeps the symptom and the one-line fix rule; all seven citations follow. (simplify: efficiency — "troubleshooting detail for a rare symptom … relevant only when authoring/debugging .github/workflows/**".)

Defer:

• simplify: efficiency — the PR-number prediction call in /finish item 8 ("create the PR first, then write the single roadmap-row commit citing the confirmed number … a real trade-off worth a decision"). Settled by D23 and D-P4-3: the row reads done on the branch before gh pr create, and a mismatch is one correcting commit. Reopen only if the mismatch proves routine.

Reject:

• simplify: efficiency — move tooling.md's new sections: it is a template the bootstrap disposition pass fills, path-scopes or deletes (cbk-conventions.md § Rule loading).
• sweep, refuted — cascade-depth:rough contradicts the plan: the recorded deviation above; the verifier refuted it on the same grounds.
• sweep, refuted; code-reviewer — claude.yml lacks write permission for its own comment calls: the sweep's verifier read the action's source — with no github_token input the action authenticates as the review app via OIDC, so the job's permissions: scope only GITHUB_TOKEN; the exercised sibling ran with exactly these permissions.
• sweep, unverified — § .gitignore anchoring needs a pointer heading in the contract: pointer headings are for moved sections; a reference-only section (§ Hook authoring is the precedent) is cited by its full path.
• sweep, unverified — the ADR-0000 edit should have been a Refines ADR: resolved by the revert instead.

Hand-off

• Next action: review the two Apply-with-care commits, then flip to ready. The auto-review workflow is not wired in this repository, so no reviewer round fires on the flip.
• Post-merge checklist: git switch main && git pull --ff-only && git fetch --prune; close nothing by hand (the 24 close markers do it); no roll-forwards were drafted; harvest 3 is complete with this merge.
• Closed from earlier passes (on continue): a8e9bfa — scaffold's detection matrix reads the MCP server's tool list instead of asserting an undated absence (P3 audit flag); 4fbf9d7 — adr-new proposes its inputs from context in one exchange instead of one question at a time (P3 audit flag); 053d011 — the launch-root guard's Timing states what a real dispatch showed: the Bash tool's persisted cd does not move the payload cwd (an agent dispatched after cd docs was allowed, 2026-09-07), so the guard's confirmed trigger is a session launched from a subdirectory (P2's open row).
• Nothing else is open from harvest 3.