Root cause behind #41-#44: the framework verifies agent actions continuously and its own declarations never

Start by reading the six proposed changes and their cited entry points: agents/audit/audit.sh:3724, .context/working/.gitignore, the fw init templates, fw termlink dispatch, and fw doctor. The issue describes a broad architectural problem and several possible fixes, not a bounded first change; agree on scope with maintainers before proceeding. Done would mean implementing an agreed change that derives declarations where possible and validates irreducible cases at runtime.

This is the cause behind #41, #42, #43 and #44

Those four were filed as separate defects over one day. They are not four defects. They are
four instances of one, and filing instances instead of the class is itself the mistake this
issue exists to correct.

The asymmetry

AEF gates agent behaviour at runtime, and does it well. P-002 on commands, G-020 on edits,
P-010/P-011 on completion, Tier 0 on destruction. Every action an agent takes passes a hook.

The framework's own output passes nothing. A template's cross-reference, a gitignore rule,
a hardcoded filter regex, a behavioural rule in CLAUDE.md, a deliverable a dispatch asks for,
the Mitigation: line an audit prints — each is asserted once and believed forever.

The agent is presumed unreliable and checked constantly. The framework is presumed correct
and checked never.

Every instance below has the same shape: a statement the framework makes about itself, written
in one context and consumed in another, that nothing re-evaluates at the point of use.

The last row is independent evidence, not ours: it arrived on channel:learnings from project
100-Video-riper-and-translation-app at 2026-09-21T15:03:42Z, while we were diagnosing the
others. There, 18 of 26 audit findings prescribe actions an agent is structurally forbidden
to take (CTL-029 ×15 → task update --status work-completed, refused by the sovereignty
gate; D13 → fw inception sweep, which ticks a Human AC by design). That one is not a false
statement. It is a true statement addressed to somebody who is not reading it — same root,
different branch.

Why the audit cannot catch this

The audit measures compliance with declared rules. It cannot measure whether the declared
rules are true. It reported 14 WARNs, byte-identical across three orchestrated rounds, while
five real defects walked past it.

What actually caught them: an agent, incidentally, while doing something else. #41 because an
operator objected to a Human AC. #42 while tidying git status. #44 because a deliverable file
was absent. Zero were caught by fw doctor, fw audit or fw reviewer.

A stable audit is not evidence of health. It is evidence that the audit is measuring the things
that do not change.

The fix, and the trap in the fix

The obvious response is "add checks that the two artefacts agree". Please do not, or at
least not first — a check is itself a declaration, and it rots the same way. That is the same
defect one level up.

Derive, do not duplicate. Wherever a rule is stated twice, delete one and generate it from
the other. A check that two statements agree is strictly worse than having one statement.

Concretely, in rough order of leverage:

1. _SESSION_STATE_FILTER (agents/audit/audit.sh:3724) should be generated from
   .context/working/.gitignore, not asserted to agree with it. Today two lists of volatile
   paths exist in two languages in two files, must agree, and are never compared — which is why
   the audit filtered the noise while the ignore rule that should have prevented it sat inert.
2. Ship the sections templates point at. fw init should emit
   §AC Classification Guidance into the generated CLAUDE.md, or generate the template's
   pointer from the section that exists. Failing both, one fw doctor line: every
   See CLAUDE.md §X in a shipped template resolves.
3. Make execution context a fact, not an assumption. fw termlink dispatch knows its worker
   is headless; CLAUDE.md cannot know and never will, because one file serves both. Inject the
   context and let rules branch on it. This is #44, and it silently truncated a 3-cycle mandate
   to one cycle at exit_code 0.
4. --expect-artifact <path> on dispatch. A run whose promised deliverable is missing should
   report incomplete, not status: done. This alone would have caught three separate instances
   in our sequence automatically instead of relying on somebody noticing an absent file.
5. Audit mitigations should state the authority they require. Then an agent can tell which
   findings are addressed to it — PL-033's finding, and the cheapest of these to implement.
6. One fw doctor line for the general case: no tracked path matches an ignore rule
   (git ls-files | git check-ignore --stdin --no-index must be empty). That is #42 generalised.

Where derivation is genuinely impossible, the check belongs in fw doctor — never in a
task's Verification block. A task closes and takes its check with it.

Environment

• Framework 1.6.769, shared-tooling mode, project 1409-sprind
• Registered locally as concern G-003 (high, watching) with all six instances
• Instance issues: #41, #42, #43, #44