fix: AR-6 handoff 销毁前置措辞对齐单一真源（红队 #18，ADR-0016）

[randypanding]

ADR-0016（决策 5，解决 agent-registry #18 内核）

问题（内核属实）：本仓 team.schema.yaml handoff 描述与 GOVERNANCE.yaml AR-6 intent 均声明 "handoff 全部完成才允许销毁"。但语义单一真源 agent-registry standards/team-collaboration.yaml PART 2 规定：

handoff:
  team_side:        # 销毁前置只含这些
    - {item: artifacts-pr, by: mechanism:git}
    - {item: trace-archive, by: mechanism:metrics-aggregator}
    - {item: retrospective, by: seat:test_author}
  stewardship_side: [memory-distill, adr-write]   # curator 异步消费，不阻塞
destroy: "after-handoff(team_side) AND (released_behind_flag OR reverted)"

adr-write 是 stewardship 侧项（curator 执行、可能涉 owner）——按本仓措辞它会阻塞销毁，制造红队 #18 描述的"owner 不可用→团队永不归档"死锁。正确语义：只有 team 侧项是销毁前置。

修复：

• team.schema handoff 描述：销毁前置=after-handoff(team_side)，stewardship 侧项异步消费不阻塞（destroy_scope 引用）
• GOVERNANCE AR-6 intent：同对齐
• flows.agent_team_lifecycle step 3/4：step 3 收敛为 team 侧项；step 4 明确 stewardship 侧（memory-distill/adr-write）异步执行

红队建议驳回：handoff_timeout/force_destroy 降级路径与有意设计冲突——incident_cell "TTL 到期绝不 auto-destroy、冻结现场持续升级"是安全优先设计决策（team-collaboration lifecycle 显式声明）；死锁根源是措辞错位而非缺降级机制。issue 内附证据。

本地验证：两 YAML 解析通过。

[coderabbitai]

Warning

Review limit reached

@randypanding, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 28 minutes

Limit details: You’ve used all 3 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 96cefb5f-94f5-48b3-8844-9c1fa117f28d

📥 Commits

Reviewing files that changed from the base of the PR and between 0ffe714 and 3504406.

📒 Files selected for processing (2)

• governance/GOVERNANCE.yaml
• standards/agent/team.schema.yaml

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Align AR-6 destruction gates with team-side handoff semantics

🐞 Bug fix 📝 Documentation ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Limits ephemeral-team destruction prerequisites to completed team-side handoff items.
• Moves memory distillation and ADR writing to asynchronous stewardship processing.
• Aligns governance and schema wording with ADR-0016’s single source of truth.

Diagram

graph TD
  A["Ephemeral Complete"] --> B["Team Handoff"] --> C{"Gate Satisfied?"} -->|Yes| D["Destroy Team"]
  B -->|archives| E["Archived Assets"] -->|async consume| F["Stewardship Handoff"]

Loading

High-Level Assessment

The wording-only alignment is appropriate because team-collaboration remains the lifecycle semantics source of truth. Splitting handoff into new schema fields would duplicate that classification and require declaration migrations, while timeout or force-destroy paths would weaken the intentional incident-preservation policy rather than correct the semantic mismatch.

Files changed (2) +4 / -4

Bug fix (1) +3 / -3

GOVERNANCE.yamlRestrict AR-6 destruction gating to team-side handoff +3/-3

Restrict AR-6 destruction gating to team-side handoff

• Clarifies that only team-side handoff items block ephemeral-team destruction. Updates the lifecycle flow to separate blocking artifact, retrospective, and trace archival from asynchronous stewardship tasks such as memory distillation and ADR writing.

governance/GOVERNANCE.yaml

Documentation (1) +1 / -1

team.schema.yamlClarify blocking and asynchronous handoff semantics +1/-1

Clarify blocking and asynchronous handoff semantics

• Revises the lifecycle handoff description to define 'after-handoff(team_side)' as the destruction prerequisite. Documents that curator-owned stewardship work consumes retained assets asynchronously and does not block destruction.

standards/agent/team.schema.yaml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Missing team-side completion signal ✓ Resolved 🐞 Bug ◔ Observability

Description

Step 4 still audits handoff_done, but that field means all handoff items are complete and cannot
represent team-side completion while asynchronous stewardship work remains pending. The append-only
event stream therefore cannot prove that AR-6's team-side prerequisite was satisfied before
destruction without either leaving the flag false or incorrectly claiming stewardship completion.

Code

governance/GOVERNANCE.yaml[226]

+      - {step: 4, action: "persistent 团队（team:stewardship）消费归档资产异步执行 stewardship 侧 handoff（memory-distill/adr-write）并审核入库；handoff_done 审计", policy: AR-6}

Relevance

●● Moderate

Close history accepts enforceability gaps, but no direct precedent for adding a distinct
asynchronous lifecycle signal.

PR-#13
PR-#19

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The changed flow says only team-side handoff blocks destruction and stewardship work runs
asynchronously, while the sole event field is explicitly defined as whether all handoff is complete.
Because events are append-only and handoff_done belongs to the ephemeral team's run_finished
payload, it cannot independently record the earlier team-side checkpoint and the later stewardship
checkpoint.

governance/GOVERNANCE.yaml[225-226]
standards/agent/event.schema.yaml[1-6]
standards/agent/event.schema.yaml[56-64]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
AR-6 now distinguishes destruction-blocking team-side handoff from asynchronous stewardship-side handoff, but the event schema exposes only `handoff_done`, defined as completion of all handoff items. Add separately auditable completion state for the two sides, or redefine the existing field as team-side completion and add a stewardship completion event or field.

## Issue Context
Events are append-only, so a single boolean written when the ephemeral run finishes cannot accurately record both the destruction prerequisite and later asynchronous stewardship completion. Keep the governance flow and event descriptions aligned with the new lifecycle semantics.

## Fix Focus Areas
- governance/GOVERNANCE.yaml[225-226]
- standards/agent/event.schema.yaml[56-64]
- standards/agent/team.schema.yaml[130-137]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Compliance rules (platform): 7 rules

Review mode: ⚖️ Balanced: This changes lifecycle and schema contract semantics for destruction gating and asynchronous stewardship handoff, so it carries real behavioral and governance risk despite the small diff.

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗