fix: finish the 1.0.0 receipt migration the registry alone was enforcing

[MCKRUZ]

Closes #31, closes #33, closes #34, closes #35.

The one root cause behind four issues

1.0.0's "Fix 3" added twelve required receipts to phases/phase-registry.yaml and updated almost none of the prose around them. check_gates.py blocks on artifacts.required and nothing else — so the registry was the only thing telling the truth, and it was telling it to nobody.

FIX-3-TRIAGE.md shows the gaps were known at the time and simply left open: A1 decision-list.md — "Nothing writes it"; A3 threat-model.md — "spec + Step 7 exist as RECOMMENDED"; A11 drill-record.md — "optional; no step runs the drill". Filing them separately made them look like four bugs. They are one unfinished migration.

What changed

Two receipts were required by the gate and described nowhere — no spec, no step, no template. A team meets these as a blocked phase with no instruction anywhere for what the file should contain.

Artifact	Was	Now
drill-record.md (#35)	required; zero mentions in 09-monitoring.md	Step 4: Alert Drill + artifact spec + template. Steps 4–6 renumbered 5–7
go-no-go-record.md (found while fixing #35)	required; no spec anywhere	Spec + template + a line in Step 0 to record the decision as the ceremony happens

The drill is placed after the playbook deliberately — it tests incident-response.md as much as it tests the alert.

docs/phase-lifecycle.md had been skipped entirely by the migration. It was missing eleven of the twelve receipts from its Required Artifacts tables and listed go-no-go-record.md and drill-record.md as optional — the direct contradiction that makes a team skip an artifact and then fail the gate on it.

threat-model.md (#31) was documented RECOMMENDED — required for any system handling auth, payments or PII while the gate blocked on it for every project. The registry is right and the promotion was deliberate: the phase body's own note asked for promotion "on a major version with a migration note", which is exactly what 1.0.0 was. Prose now says REQUIRED, with the WAIVED: escape spelled out.

decision-list.md (#33) is dropped, not built. Six independent sources show the work it named is already done twice over — the phase-spanning .sdlc/decision-log.md (DL-NN, read by track_decisions.py) and a spec's own ## Decision List section (enforced by check_spec.py at Definition of Ready). Three places in the repo already warn against confusing those two; a third file would have been the confusion. The Phase 1 exit gate gains a prose check instead, since the log lives outside the phase's artifact directory where the gate cannot see it — the same pattern the close phase uses for its off-gate receipts.

The runaway fence (#34) in phases/01-requirements.md swallowed 59 lines, rendering three artifact specs and a section heading as sample code. It was this migration's insertion landing inside an existing fence. The fence now wraps only the AQ-NN example it was meant to.

The rail that catches the next one

scripts/tests/test_registry_docs_consistency.py asserts every registry-required artifact:

1. has a ### <name> spec in its phase definition,
2. appears in docs/phase-lifecycle.md's Required Artifacts table,
3. is not simultaneously listed as optional.

Test plan

• Full suite: 537 passed, 6 skipped (was 532/6 — the five new checks)
• Registry parses; Phase 1 required drops to 4 artifacts with 5 prose checks
• Registry-vs-docs drift measured at 0 across all phases
• Mutation-tested — each defect reintroduced in turn, each matching check confirmed to fail, all files verified restored. A guard that has never failed is a configuration, not a control
• WAIVED: escape verified real before documenting it (check_gates.py:81, applied before completeness at :438)
• Human read-through of the two new templates

Notes for review

• Ships as 1.0.1 (confirmed by Matt). plugin.json and marketplace.json are both bumped on this branch and merged forward through the stack. This stack must merge before PR feat: sync the kit — deploy promotion, dependency position, fleet telemetry (1.1.0) #28, which bumps to 1.1.0 from the same 1.0.0 tree — landing feat: sync the kit — deploy promotion, dependency position, fleet telemetry (1.1.0) #28 first would make 1.0.1 a version regression.
• Behaviour change: Phase 1 no longer blocks on decision-list.md (a file nothing produced, so no passing gate regresses). Phases 8 and 9 still block on their receipts — unchanged — but now tell you what to write.
• This closes PLUGIN-SYNC.md punch-list item 9-2, which recorded the drill gap independently.
• docs/phase-9-example.md and docs/companion/phase-9.html in the standard repo still describe drill-record.md as optional. Cross-repo follow-up, tracked separately.
• bug: phase definitions spawn six subagents that don't exist #29, bug: shipped ADR template contains a string its own gate rejects as a placeholder #30, docs: /sdlc-spike and /sdlc-doctor ship but are absent from the command reference #32 and bug: report filenames use three different conventions across phase files, registry and docs #36 are untouched here and remain open.

🤖 Generated with Claude Code