RigelBuild · trunk-io · Sep 13, 2026 · Sep 13, 2026 · Sep 13, 2026 · Sep 13, 2026
@@ -86,11 +86,10 @@ projects:
   stamp-gate: 'tools/stamp-gate'
   # The design-ledger gate: validates the Compass design-decision ledger
   # (docs/designs/DECISIONS.md), the per-record `Status:` headers, and
-  # dangling supersession/Record pointers (RIG-1187). Migrated from the sealed
-  # repo with the corpus it governs (RIG-1794).
+  # dangling supersession/Record pointers (RIG-1187).
   design-ledger-gate: 'tools/design-ledger-gate'
   # The orion-ref-gate boundary gate (RIG-2489): fail-closed scan that the PUBLIC
-  # compass repo carries no reference to the PRIVATE internal monorepo. Mirrors
+  # compass repo carries no out-of-tree reference the managed boundary forbids. Mirrors
   # design-ledger-gate; registered here so its check + typecheck + unit test run
   # in the moon-driven CI sweep — unregistered, moon never discovers it and the
   # boundary re-rots uncaught.
@@ -138,7 +137,7 @@ projects:
   # silently inert (moon discovers projects only from this map) and the config
   # drift it fences ships uncaught.
   renovate: 'tools/renovate'
-  # The Renovate preflight probe (ported from the internal monorepo's preflight probe):
+  # The Renovate preflight probe:
   # checks the minted App token can see the repo before `bunx renovate` runs,
   # failing fast with a named diagnosis instead of Renovate's opaque
   # platform-unknown-error. Registered so its own typecheck + unit test gate.

@@ -5,7 +5,7 @@
 # devenv toolchain on PATH. install/lint/format are inherited (bun tag →
 # root:install; biome + markdownlint are the root whole-repo sweep, which lints
 # the canonical docs/ sources — the generated src/content/docs/ mirror is
-# gitignored and exempt). Public counterpart to sealed/apps/docs: no Cloudflare
+# gitignored and exempt). Unlike the prior art's docs app: no Cloudflare
 # Access gate, no PostHog analytics.
 workspace:
   inheritedTasks:

@@ -5,8 +5,8 @@
 // GitHub Actions workflow (RIG-1765). The engineering docsite lives on
 // Cloudflare Pages under the compass-eng-docs project.
 //
-// Adapted from sealed apps/docs/scripts/deploy.ts — they share the same
-// Cloudflare Pages deploy + PR-preview-comment shape and the three constants
+// Shares the same Cloudflare Pages deploy + PR-preview-comment shape as the
+// prior art, including the three constants
 // below (PROJECT_NAME, COMMENT_MARKER, SITE_LABEL). This docsite build gathers
 // the compass repo's markdown, so its preview comment also deep-links the .md
 // pages a PR changed (changedDocPages + commentBody's "Changed pages" section).

@@ -7,7 +7,7 @@ a form they did not intend to publish.
 
 These five rules are the standing policy for every design record authored here
 going forward. Rules 1-4 match the sanitization the one-shot migration applied
-to the records imported from the private `sealed` repo (new records should be
+to records imported from out of tree (new records should be
 written this way from the start so they need no migration); rule 5 governs what
 happens to a record's inbound links when another record is deleted.
 
@@ -26,8 +26,8 @@ harmless. A dead `linear.app` URL is worse than no URL.
 
 ## 2. No `oss/compass/` path prefixes
 
-The private repo vendored Compass under `oss/compass/`. This repo **is** that
-tree, without the prefix. Cite paths relative to the repo root:
+Some imported records cite Compass paths under an `oss/compass/` prefix. This
+repo **is** that tree, without the prefix. Cite paths relative to the repo root:
 
 - `oss/compass/go/internal/runtime/image.go` → `go/internal/runtime/image.go`
 - `oss/compass/apps/ui/src/stub-data.ts` → `apps/ui/src/stub-data.ts`

@@ -220,7 +220,7 @@ check enforces the mechanical half. Full rationale:
 | DL-210 | Forge integration testing adds two live-contract tiers above the DL-174 hermetic pyramid: (1) a hermetic golden-fixture replay leg (committed `go/internal/forge/testdata/` fixtures replayed through the stub RoundTripper, an untagged Go test riding moon affected-detection on every forge-affected PR + the main/nightly sweep, no `ci.yml` project enumeration) and (2) a `//go:build livegithub` live-credentials oracle (same scenarios against a throwaway `RigelBuild/compass-forge-testbed` + a Linear test team under test-only bot PATs ≠ the `server_only` production secrets), REQUIRED on forge-affected PRs + nightly, covering GitHub and Linear co-equally (the GitHub-only F1 reviewer≠author 422→APPROVE headline; Linear's PR/review family is `ErrUnsupported`, not a scenario). This is a NEW secret-bearing per-PR CI step — a standalone decision, NOT an amendment: D2's full-stack deterministic tier (`compass-dogfood-e2e/design.md:815-830`) stays secret-free and unchanged; a forward pointer next to D2 records the carve-out. Fork-PR secret safety: the same-repo-head-guarded step goes vacuously green on fork heads (GitHub withholds secrets there); accepted, with the push-to-main run + a maintainer same-repo re-push convention as the catch (0 forks today) | Active (Matt, 2026-08-18) | [forge integration testing §Approach](server/compass-forge-integration-testing/design.md#approach) |
 | DL-226 | A message owed to an OFFLINE channel agent member is never silently stranded: the server wakes the member by RESUMING its most recent session (a system-authorized internal sibling of the public resume path, via a new `LatestSessionForAccount` read; fresh start only for a never-started agent; per-agent singleflight + not-live pre-check as cost control — agent-triggered starts are a core product capability, and `StartAgentSession`'s adminOnly PUBLIC door is untouched). Durability split: a mentioned member outside the sweep set (unsubscribed, non-home, non-mandatory) gets a durable owed-mention row `(agent_account_id, message_id)` written at the settle edge before the wake and swept subscription-independently on session start AS A STEER (D5 mention→steer preserved; steer-only precedence intact), cleared on the frozen message_id ack; a subscribed/home/mandatory member gets no owed row — the D2 cursor sweep is its durable backstop and the wake (both the mention arm and the plain-deliver arm) is pure latency. Broadcast mentions (`@everyone`/`@agents`) wake too; N-start amplification accepted. The residual pre-settle window is accepted for MVP (RIG-2490). Amends D5/OQ-3's offline clause by citation | Active (Matt, 2026-08-21); residual pre-settle window closed by DL-240 (RIG-2490, 2026-08-23) | [mention offline redelivery §Decisions](server/compass-mention-offline-redelivery.md#decisions-ruled-by-matt-2026-08-21) |
 | DL-240 | The RIG-1641 OQ-5 residual pre-settle mention-loss window (a mention to an offline out-of-sweep-set member, lost when a crash or bus overrun drops `MessagePosted` before the settle-edge `routeMentions` pass) is closed by a per-message delivery marker, NOT a high-water cursor: a nullable `messages.mentions_routed_at BIGINT` (unix ms) set by the consumer after the settle-edge pass, with a recovery scan at consumer start + the `Lagged()` overrun re-subscribe reading `WHERE mentions_routed_at IS NULL` (skipping message_ids in `c.held`), replaying the ONE shared `routeMentions` body, then marking. The killed cursor could advance past a LOWER in-flight seq (`messages.seq` is `BIGSERIAL` assigned at INSERT but the bus event publishes post-commit, `comms.go:361-375`) whose crash-dropped event then stranded the mention forever — a new silent loss the marker cannot express. Seed-forward on first deploy (no historical backfill; compass pre-live). Extends DL-226's no-loss invariant from the settle edge back to the message-post commit; DL-226's wake+owed-mention mechanism is unchanged | Active (Matt, 2026-08-23) | [mention offline pre-settle closure §Resolved decisions](server/compass-mention-offline-redelivery-pre-settle-closure.md#resolved-decisions) |
-| DL-241 | The agent forge native toolset is ten single-purpose tools, one per `ForgeCallRequest` arm (`forge_get_issue`, `forge_get_pull_request`, `forge_list_issues`, `forge_comment_on_issue`, `forge_comment_on_pull_request`, `forge_submit_review`, `forge_create_issue`, `forge_create_pull_request`, `forge_subscribe`, `forge_unsubscribe`), each a native `AgentTool` over a thin `ForgeBroker` on the `RunnerTransport.forge()` seam; `forge_subscribe`/`forge_unsubscribe` ship the complete surface now but return the server's in-band `unimplemented` until the poll-driver lane lands the `agent_forge_subscriptions` writer (DL-163). Multi-forge is exposed: every tool takes an optional forge selector (`forge_provider` + optional `forge_host`, unset = the configured default GitHub forge, DL-202) so an agent targets Linear (issues-only, `repo` = team key, DL-051; PR/review arms return in-band `unimplemented`) as well as GitHub. Mirrors DL-212's comms-toolset count row; the tool-count claim is load-bearing for future toolset-refresh rows | Active (Matt, 2026-08-24) | [forge tools §Tool set and shape](agent/compass-agent-forge-tools/design.md#tool-set-and-shape--ten-native-tools-one-per-arm) |
+| DL-241 | The agent forge native toolset is twelve single-purpose tools, one per `ForgeCallRequest` arm (`forge_get_issue`, `forge_get_pull_request`, `forge_list_issues`, `forge_comment_on_issue`, `forge_comment_on_pull_request`, `forge_submit_review`, `forge_create_issue`, `forge_create_pull_request`, `forge_transition_issue_state`, `forge_transition_pull_request_state`, `forge_subscribe`, `forge_unsubscribe`), each a native `AgentTool` over a thin `ForgeBroker` on the `RunnerTransport.forge()` seam. Multi-forge is exposed: every tool takes an optional forge selector (`forge_provider` + optional `forge_host`, unset = the configured default GitHub forge, DL-202) so an agent targets Linear (issues-only, `repo` = team key, DL-051; PR/review arms return in-band `unimplemented`) as well as GitHub. Mirrors DL-212's comms-toolset count row; the tool-count claim is load-bearing for future toolset-refresh rows. Amended 2026-09-13: the count was ten at ratification; the transition pair arrived with DL-342 (RIG-3331) and the original row was not refreshed. The ratified caveat that `forge_subscribe`/`forge_unsubscribe` return in-band `unimplemented` until the DL-163 writer lands is also retired — both arms persist (`EnsureAgentForgeSubscription` / `DeleteAgentForgeSubscription`) and `forge_subscribe` returns a real subscription id | Active (Matt, 2026-08-24; amended Matt, 2026-09-13) | [forge tools §Tool set and shape](agent/compass-agent-forge-tools/design.md#tool-set-and-shape--twelve-native-tools-one-per-arm) |
 | DL-291 | Agents and client UIs address channels and topics by NAME, not id — request-input channel/topic fields on the agent tool surface are name-typed, resolved viewer-scoped at the service edge (`ChannelByNameForViewer`: miss ≡ invisible ≡ merged `not_found`; a multi-hit errors `invalid_argument`, never auto-picks); response/stored/event fields stay id-typed. Extends DL-269/DL-270 from accounts to channels + topics. | Active (Matt, 2026-08-30) | [peer-DM §Ledger delta](agent/compass-agent-peer-dm/design.md#ledger-delta) |
 | DL-292 | Steer/deliver control ops denormalize the source channel name + topic name (server-resolved at wrap in `deliverOp`/`steerOp`, the `from_handle` pattern; a name-resolve miss degrades like a handle miss, never blocks delivery); the agent renders `Channel <name> › topic <name>:` and must name both on every post — `comms_post_message` has NO home-channel default and never auto-picks a reply target. The dogfood reply-mis-routing fix (RIG-2956 T0). Proto: `DeliverControl.channel_name = 5`, `SteerControl.topic_name = 4`/`channel_name = 5`. | Active (Matt, 2026-08-30) | [peer-DM §Ledger delta](agent/compass-agent-peer-dm/design.md#ledger-delta) |
 | DL-293 | Creating a topic requires `create_topic: true` on the post, in every channel including DMs (`PostMessageRequest.create_topic = 6`; `TopicRef.Create` gates the store name path) — amends DL-098's topic get-or-create clause (the Zulip threading model stays live; only auto-mint-on-miss is gated). A gated miss errors in-band `not_found`, never mints and never drops the message. Escape hatch (Matt): may revert for DMs only if it proves a blocker. | Active (Matt, 2026-08-30) | [peer-DM §Ledger delta](agent/compass-agent-peer-dm/design.md#ledger-delta) |

@@ -485,7 +485,7 @@ transcript-scoped, not container-scoped.)
 
 ### Spec impact — supersession, by citation
 
-Per the sealed frozen-record convention, merged records are never edited;
+Per the frozen-record convention, merged records are never edited;
 this record supersedes specific claims by citing them, and the **impl PR's
 living-spec update** carries the replacement into
 `docs/specs/product/compass.md`: