feat: the kit half of Fix 3 — risk-signoff, and the triage that shaped it

[MCKRUZ]

The kit half. The plugin PR carries the twelve required receipts, the eleven optional ones, the
waiver mechanism and the 1.0.0 release.

Merges before the plugin PR — its generated-copy invariant reads the kit from main.

risk-signoff

The standard has always required a named human to accept the risk on a risk:high change — "a
person, by name, accepting the risk. Not a thumbs-up." It was enforced by nothing: convention in a
PR comment that nothing templated and nothing checked.

Now a required status check fails any risk:high PR with no line of the form:

SIGNED-OFF-BY: Wes Carter — accepted: the carrier retry path is idempotent, verified in spike 0007

The sentence is required. A bare name is exactly the thumbs-up this rung exists to reject.

It is a check rather than a committed receipt on purpose: a file under .sdlc/ would describe a
merge that already happened, and the acceptance has to exist before the merge. Added to
branch-protection.json; existing repos must re-apply the ruleset.

One bug worth reading

The pattern originally used [^—–\n] in a POSIX bracket expression — where \n is a literal
backslash and the letter n, not a newline. It silently excluded every name containing an "n":
Wes Carter passed the gate, Dan Ruiz did not.

Caught by testing eight cases rather than one. grep is line-based, so the newline never needed
excluding in the first place. Now verified against five should-match and three should-not-match
inputs, including a quoted comment, a bullet, lowercase, and both dash forms.

FIX-3-TRIAGE.md

The record of why the 42 were split rather than mechanically converted — and of three things the
triage itself got wrong, caught while building:

• A5 was not a promotion. Phase 3's walking-skeleton-spec.md is the evidence the skeleton
  was built; the ledger item is Phase 2's definition of what to build. Conflating them would have
  left Phase 3's checkpoint with nothing to verify against. It shipped as a new Phase 2 artifact,
  walking-skeleton-definition.md.
• A2 could not be a required directory. Requiring spikes/ would force a spike on engagements
  with no unknowns, and a directory cannot carry a waiver. It shipped as spike-findings.md — a
  file that can honestly say "no unverified assumptions, confirmed by ⟨name⟩", which is what the
  punch list's own worked example proposed in the first place.
• Twelve required files, not eleven — the Phase 7 cold-checkout split in two, and
  runbook-walkthrough.md is required only for service/app, because requiring it of a library
  would have re-created D-3 for the receipt.

Also here

PLUGIN-SYNC.md marks Fix 3 done and records what deliberately remains: the second half of X-7.
Raising cross-reference checks above SHOULD has the same gate-behaviour property, and was held
back rather than bundled — 1.0.0 already asks every mid-flight engagement for twelve new receipts,
and adding newly-blocking consistency failures the same day would make one migration
indistinguishable from the other when something breaks.

docs/build-loop.md documents the new rung where the merge bar is described.

Verification

sync_kit --check in sync at 121 files. The drift check reports 8 required contexts and 8
declared gate jobs, matching — the consistency checker built two sessions ago catching this new
gate's wiring in both directions, which is the first time it has been exercised on genuinely new
work. 531 plugin tests pass; 37 drift-check tests pass.

Approval

Self-approved under the solo-maintainer carve-out, named here per its terms: internal repo, no
client-identifying content, checks green.

🤖 Generated with Claude Code

https://claude.ai/code/session_014aesqvsMqJpzEdpDXDTjvF