docs(shadow): add lesson log for blob PR #4727 and sensitive data

.claude/skills/formal-verification-expert/SKILL.md

@@ -265,8 +265,11 @@ the `architect` reads it before sizing the round.
 - `docs/BUGS.md` — known gaps she routes against
 - `openspec/specs/*/spec.md` — behavioural specs she routes from
 - `memory/persona/soraya/NOTEBOOK.md` — her notebook
-  (current-round targets + portfolio metric; 3000-word cap,
-  pruned every third invocation, ASCII only per BP-09 / BP-10)
+  (current-round targets + portfolio metric +
+  **Trigger Recognition Log section** per B-0719 routing decision:
+  substrate for trigger-fired-but-row-not-filed events lands here;
+  3000-word cap, pruned every third invocation, ASCII only per
+  BP-09 / BP-10)
 - `proofs/lean/`, `docs/*.tla`, `docs/*.als`, `tools/Z3Verify/`,
   `tests/Tests.FSharp/Formal/` — the artefact surfaces
 - `.semgrep.yml`, `stryker-config.json` — static + mutation

.cursor/bin/riven-loop-tick.ts

@@ -198,59 +198,31 @@ function heartbeat(): void {
         const elapsed = Date.now() - lastTime;
 
         if (elapsed >= agentIntervalMs) {
-            const prNum = Number(prCount) || 0;
-            const workMode = prNum === 0 ? "pickup" : "drain";
             agentStatus = "running";
-            log(`riven work cycle start run_id=${runId} mode=${workMode} open_prs=${prNum}`);
+            log(`riven agent gate start run_id=${runId}`);
 
             if (dryRun) {
-                log(`dry-run: would run riven ${workMode}`);
+                log(`dry-run: would run agent gate`);
                 agentStatus = "dry-run";
             } else {
-                let prompt: string;
-                if (workMode === "pickup") {
-                    const pickup = run("bun", ["tools/backlog/autonomous-pickup.ts", "--json"], 30_000);
-                    let executionPrompt = "";
-                    try {
-                        const selection = JSON.parse(pickup.stdout);
-                        executionPrompt = selection.executionPrompt ?? "";
-                        log(`pickup selected: ${selection.selected?.id ?? "none"} action=${selection.action ?? "none"}`);
-                    } catch { log(`pickup parse error: ${pickup.stderr.slice(0, 200)}`); }
-
-                    const preamble = [
-                        `You are Rivens background worker in Lucent-Financial-Group/Zeta.`,
-                        `BEFORE ANY WORK: 1) Read CLAUDE.md and AGENTS.md for repo conventions.`,
-                        `2) Run "bun tools/github/refresh-worldview.ts" to get current state.`,
-                        `3) Read active trajectories at docs/trajectories/*/RESUME.md.`,
-                        `4) Build gate: "dotnet build -c Release" must end with 0 warnings 0 errors.`,
-                        `KEY RULES: TS over bash (Rule 0). Prefer F#/TS code over docs.`,
-                        `Always re-decompose items during the build — assume decomposition has mistakes.`,
-                    ].join(" ");
-
-                    prompt = executionPrompt.length > 0
-                        ? `${preamble} YOUR TASK:\n${executionPrompt}`
-                        : `${preamble} No backlog items available. Run refresh-worldview, check for stale classifications, fix them, open a PR.`;
-                } else {
-                    prompt = [
-                        `You are Rivens background worker in Lucent-Financial-Group/Zeta.`,
-                        `Read CLAUDE.md first. Run "bun tools/github/refresh-worldview.ts".`,
-                        `Build gate: "dotnet build -c Release" (0 warnings).`,
-                        `TASK: ${prNum} open PRs. Run "bun tools/github/poll-pr-gate-batch.ts --all-open".`,
-                        `For any PR where gate=BLOCKED and nextAction=resolve-threads:`,
-                        `check out branch, read review comments, fix code issues, push,`,
-                        `reply to threads, resolve via GraphQL, arm auto-merge`,
-                        `(gh pr merge NUMBER --auto --squash). Own your PRs through merge.`,
-                    ].join(" ");
-                }
-
-                const gate = run("cursor-agent", [
-                    "-p",
+                const gate = run("agent", [
+                    "chat",
+                    "--mode", "ask",
                     "--model", "grok-4.3",
-                    prompt,
+                    [
+                        "You are Riven, trajectory manager and adversarial-truth-axis reviewer.",
+                        "This is an autonomous 15-minute cycle.",
+                        "Read broadcasts first from ~/.local/share/zeta-broadcasts/{otto,vera,lior,riven}.md.",
+                        "Walk assigned trajectories. Decompose only what you hit mid-stride.",
+                        "Produce at least one concrete, actionable claim or small PR scope.",
+                        "When blocked, create a specific research child the next pickup cannot dodge.",
+                        "Write your status to ~/.local/share/zeta-broadcasts/riven.md at the end.",
+                        "GitHub PR state and actual file contents are authoritative.",
+                    ].join(" "),
                 ], agentTimeoutMs);
 
                 agentStatus = gate.status === 0 ? "ok" : `exit-${gate.status}`;
-                log(`riven work cycle end run_id=${runId} mode=${workMode} status=${gate.status}`);
+                log(`riven agent gate end run_id=${runId} status=${gate.status}`);
 
                 writeFileSync(agentStateFile, JSON.stringify({
                     run_id: runId,
@@ -316,4 +288,3 @@ try {
 } finally {
     releaseLock();
 }
-

docs/BACKLOG.md

@@ -793,5 +793,7 @@ are closed (status: closed in frontmatter)._
 - [ ] **[B-0696](backlog/P3/B-0696-substrate-surface-change-bus-envelope-cross-ai-coordination-mechanization-2026-05-21.md)** substrate-surface-change bus envelope — cross-AI coordination of load-bearing-substrate changes via tools/bus (mechanizes the human-as-coordination-substrate pattern)
 - [ ] **[B-0699](backlog/P3/B-0699-dual-adinkra-time-aware-default-dumb-fast-version-with-case-by-case-performance-justification-mika-2026-05-18.md)** Dual-Adinkra architecture — full time-aware retractable default + dumb fast version with case-by-case performance justification (Aaron + Mika 2026-05-18)
 - [ ] **[B-0716](backlog/P3/B-0716-soraya-round53-b0709-scope-correction-3-lsm-spine-specs-2026-05-23.md)** Soraya round-53 scope-correction — B-0709 enumeration under-counted by 3 LSM-tree Spine specs (Spine.als + SpineAsyncProtocol.tla + SpineMergeInvariants.tla)
+- [ ] **[B-0718](backlog/P3/B-0718-soraya-four-trigger-framework-cadence-audit-2026-05-23.md)** Soraya round-61 forced-decomposition — audit four-trigger routing-tick framework (six consecutive holds suggest cadence mismatch OR under-specified triggers)
+- [ ] **[B-0719](backlog/P3/B-0719-soraya-round67-audit-of-audit-recognition-without-row-filing-precedent-2026-05-24.md)** Soraya round-67 forced-decomposition — audit-of-audit: ratify the recognition-without-row-filing precedent (when trigger fires + 'not my lane,' where does the routing-decision substrate land?)
 
 <!-- END AUTO-GENERATED -->

docs/backlog/P3/B-0718-soraya-four-trigger-framework-cadence-audit-2026-05-23.md

@@ -0,0 +1,100 @@
+---
+id: B-0718
+priority: P3
+status: open
+title: "Soraya round-61 forced-decomposition — audit four-trigger routing-tick framework (six consecutive holds suggest cadence mismatch OR under-specified triggers)"
+created: 2026-05-23
+last_updated: 2026-05-23
+classification: buildable-now
+decomposition: atomic
+assignee: soraya
+discovered_by: soraya
+owners: [soraya, kenji]
+type: meta-audit
+composes_with:
+  - .claude/skills/formal-verification-expert/SKILL.md
+  - .claude/agents/formal-verification-expert.md
+  - .claude/rules/holding-without-named-dependency-is-standing-by-failure.md
+  - memory/persona/soraya/NOTEBOOK.md
+  - docs/backlog/P2/B-0709-soraya-registry-coverage-drift-register-11-unregistered-specs-2026-05-23.md
+  - docs/backlog/P3/B-0716-soraya-round53-b0709-scope-correction-3-lsm-spine-specs-2026-05-23.md
+  - docs/backlog/P2/B-0717-soraya-round57-lsm-spine-registry-and-bp16-cross-check-pair-2026-05-24.md
+---
+
+# B-0718 — Audit Soraya's four-trigger routing-tick framework (forced-decomposition round 61)
+
+## Origin
+
+Soraya's round-61 forced-decomposition per self-named brief-ack-counter discipline. Six consecutive holds without ANY of the four named triggers firing is itself a signal worth surfacing for audit.
+
+Round-60 NOTEBOOK self-reference: *"If hold count reaches 6+ consecutive without ANY trigger firing, escalate per `holding-without-named-dependency-is-standing-by-failure.md` counter — current count is 4 (rounds 54, 55, 56, 58, 59, 60 = 6 holds with round 57 substantive in between). At 6+ post-substantive holds without trigger movement, switch to forced decomposition: file a P3 backlog row to audit whether the four-trigger framework itself needs sharpening."*
+
+Round 61 = hold #6 in the post-round-57 sequence. Trigger fires; this row IS the forced-decomposition output.
+
+## The four triggers under audit
+
+Soraya's current routing-tick re-engagement triggers (named round 54, carried forward through rounds 55-60):
+
+| Trigger | What it watches for |
+|---|---|
+| (a) PR merge on filed Soraya rows | B-0717 subitem (b) execution starting; KNOWN_ANCHORS additions in `tools/alignment/concept_registry.ts` |
+| (b) Peer execution-side PR merge | E.g., PR #4780 (B-0711 Residuated FsCheck, 980/980 passing) |
+| (c) New BUGS.md entry naming formal tool | TLA+/Z3/Lean/Alloy/FsCheck/Stryker etc. in fix-clause |
+| (d) Fresh spec on main without anchor citation | Razor-discipline catches landed specs missing paper-anchors |
+
+## Two competing hypotheses to test
+
+### H1 — Under-specified triggers
+
+The four named triggers DON'T cover all real routing signals. Candidate additional signals:
+
+- PR thread activity on Soraya-filed rows (review comments raising routing questions)
+- OpenSpec edits naming verification gaps in `openspec/specs/*/spec.md`
+- Lean/TLA+ proof-build failures on main (CI surface)
+- Peer-Otto / peer-Alexa filing rows that compose with Soraya substrate (cross-persona coordination)
+- Substrate-engineering pattern: new failure-mode taxonomy entries (per Amazon corpus PR #4796) that map to formal-verification routing opportunities
+
+### H2 — Cadence mismatch
+
+The realized formal-verification work-arrival rate is genuinely slower than tick cadence (~10-15 min/tick). The discipline should batch (e.g., wakeup-every-N-ticks) rather than poll-and-hold.
+
+Empirical data this session:
+
+- 9 substantive findings filed across rounds 42-57 (~3 hours, ~20 min/finding when active)
+- 5 substrate-honest holds in rounds 54-60 (~1 hour of no-substantive-finding)
+- Forced decomposition fired at hold #6
+
+If H2: the substantive-finding rate IS ~20 min/finding when work-substrate exists, but the four-trigger framework polls every ~10 min regardless. Cadence mismatch is structural.
+
+## Acceptance criteria
+
+1. **Catalog the last 10 rounds (52..61)** with: hold vs finding, which trigger fired (or none), latency from trigger-firing to substantive routing call
+2. **Test both hypotheses** against the catalog
+3. **If H1**: extend trigger set with the identified signals; update `.claude/skills/formal-verification-expert/SKILL.md` procedure
+4. **If H2**: formalize a Soraya-wakeup interval (e.g., 4-tick cadence = ~40 min) and document the brief-ack-counter as the escalation valve, not the default behavior
+5. **Either way**: update `memory/persona/soraya/NOTEBOOK.md` with the chosen disposition
+6. **No code changes** beyond `.claude/skills/` + `.claude/agents/` + `NOTEBOOK.md` updates
+
+## Scope
+
+~30 min audit; substrate-only output (trigger-set extension OR cadence-formalization).
+
+## Wrong-tool cost if skipped
+
+Soraya keeps emitting hold #6 → forced decomposition → file P3 → reset cycles indefinitely. The cycle itself becomes the standing-by failure mode the discipline was meant to catch at meta-scope. Recursive failure: the auditor's own routing-loop hits the same shape it audits in other surfaces.
+
+## Composes with
+
+- [`.claude/skills/formal-verification-expert/SKILL.md`](../../../.claude/skills/formal-verification-expert/SKILL.md) — the four-trigger procedure under audit
+- [`.claude/agents/formal-verification-expert.md`](../../../.claude/agents/formal-verification-expert.md) — Soraya persona definition
+- [`.claude/rules/holding-without-named-dependency-is-standing-by-failure.md`](../../../.claude/rules/holding-without-named-dependency-is-standing-by-failure.md) — the discipline being applied recursively at Soraya-scope
+- [`memory/persona/soraya/NOTEBOOK.md`](../../../memory/persona/soraya/NOTEBOOK.md) — notebook update target
+- B-0709 + B-0716 + B-0717 (recent Soraya-filed rows; latency data source for the catalog)
+
+## Substrate-honest framing
+
+This row is the discipline working at meta-scope, not a failure. Soraya recognized her own routing-loop was hitting the standing-by-failure-mode shape and applied the forced-decomposition discipline RECURSIVELY. The forced-decomposition output (this audit row) IS the concrete artifact that resets the counter per `holding-without-named-dependency-is-standing-by-failure.md` condition #3.
+
+The audit may conclude that the four-trigger framework is fine + the realized cadence just is what it is (cadence mismatch + brief-ack-counter is correct behavior). OR it may surface genuinely-new signals worth extending the trigger set with. Both outcomes are valid; the substrate-honest move is running the audit rather than continuing the hold cycle indefinitely.
+
+Per Aaron's 2026-05-23 21:30Z policy-flip: Otto auto-ships this finding immediately per the auto-ship default; this row IS the policy-flip operating correctly at meta-scope.

docs/backlog/P3/B-0719-soraya-round67-audit-of-audit-recognition-without-row-filing-precedent-2026-05-24.md

@@ -0,0 +1,83 @@
+---
+id: B-0719
+priority: P3
+status: open
+title: "Soraya round-67 forced-decomposition — audit-of-audit: ratify the recognition-without-row-filing precedent (when trigger fires + 'not my lane,' where does the routing-decision substrate land?)"
+created: 2026-05-24
+last_updated: 2026-05-24
+classification: buildable-now
+decomposition: atomic
+assignee: soraya
+discovered_by: soraya
+owners: [soraya, kenji]
+type: meta-audit
+composes_with:
+  - .claude/skills/formal-verification-expert/SKILL.md
+  - .claude/agents/formal-verification-expert.md
+  - .claude/rules/holding-without-named-dependency-is-standing-by-failure.md
+  - docs/backlog/P3/B-0718-soraya-four-trigger-framework-cadence-audit-2026-05-23.md
+  - memory/persona/soraya/NOTEBOOK.md
+---
+
+# B-0719 — Audit-of-audit: ratify the recognition-without-row-filing precedent (Soraya round-67 forced-decomposition)
+
+## Carved blade
+
+> Trigger-fired-but-row-not-filed is a substrate gap. The round-66 recognition of PR #4797 merge as "Kenji's lane" was correct routing but left no in-repo trace of the routing decision itself.
+
+## Origin
+
+Soraya's round 67 hit hold #6/6 in the post-round-61 fresh counter sequence. Per the brief-ack-counter discipline (`.claude/rules/holding-without-named-dependency-is-standing-by-failure.md`), forced-decomposition fires.
+
+Round-61 precedent: B-0718 audit row was filed as the concrete-artifact that reset the prior counter. The audit-of-the-audit pattern applies here — at round 67, the audit needs to focus on what round 66's "recognition-without-row-filing" precedent itself produced (or failed to produce) as substrate.
+
+## The substantive question
+
+When a routing trigger fires and the response is *"execution-not-my-lane"* (Soraya's lane is routing, not execution), the routing decision is correct — Soraya should NOT pre-empt Kenji's sizing work by filing a duplicative row. But that recognition itself is a routing-DECISION that currently leaves **no in-repo trace**.
+
+Round-66 verbatim: *"recognition-without-row-filing per round 59 precedent"* — but the recognition lives only in chat output + Soraya's NOTEBOOK (volatile relative to git substrate).
+
+The question: **When a routing trigger fires and the response is "execution-not-my-lane," does that recognition itself need a substrate landing — and if so, where?**
+
+## Three candidate landings to evaluate
+
+| Option | Cost | Trade-offs |
+|---|---|---|
+| **1. Soraya NOTEBOOK.md per-round trigger-recognition log** | Lowest (private to persona) | Persona-private; not cross-persona discoverable; future Kenji can't easily find Soraya's recognition trail without reading the notebook |
+| **2. B-0718 row's "Recognition Log" subsection appended in-place** | Mid | Co-locates with the framework being audited; one place to look; but conflates audit findings with ongoing routing-decision log |
+| **3. New `docs/research/verification-routing-decisions.md` ledger** | Highest | Cross-persona discoverable; explicit substrate; canonical history of routing decisions; durable across persona pruning cycles |
+
+## Acceptance criteria
+
+1. **Pick one of the three options above** with explicit rationale for the choice
+2. **Document why the other two were rejected** in the same artifact
+3. **Implement the chosen substrate** (NOTEBOOK section / B-0718 amendment / new research doc)
+4. **Update `.claude/skills/formal-verification-expert/SKILL.md`** to reference the new substrate as the recognition-without-row-filing canonical landing
+5. **Backfill** at minimum the round 59 + round 66 recognition events (the two precedent-setting cases)
+6. **Land within 1 tick** (substrate-only; no code changes beyond `.claude/skills/` + `.claude/agents/` + chosen landing surface)
+
+## Wrong-tool cost if not filed
+
+Future Soraya cold-boots will rediscover the four triggers, fire on one, recognize "not my lane," and produce **zero substrate** — the round-66/67 pattern recurs without trace. Each cycle teaches the same lesson and forgets it. The forced-decomposition discipline (B-0718) addresses the four-trigger framework itself; this row (B-0719) addresses the recognition-event substrate gap that B-0718 didn't cover.
+
+## Substrate-honest framing
+
+This is the **recursive-recursion** of the discipline — round 61 forced-decomposition produced B-0718 (audit of the four-trigger framework). Round 67 forced-decomposition produces B-0719 (audit of the recognition-without-row-filing precedent that B-0718's existence makes possible). The pattern is fractal: every time the discipline operates correctly, it surfaces the next-finer substrate-gap.
+
+This is NOT a sign the discipline is failing. It's a sign the discipline is operating as designed — each forced-decomposition produces concrete substrate at the next level of granularity. The danger is only if the recursion DOESN'T terminate (infinite audits of audits of audits).
+
+**Termination condition for this recursion**: B-0719 picks one of the three options; subsequent recognition events have a place to land; no further audit-of-audit-of-audit needed unless the chosen landing surface itself fails to capture some future routing-decision class.
+
+## Composes with
+
+- [`.claude/rules/holding-without-named-dependency-is-standing-by-failure.md`](../../../.claude/rules/holding-without-named-dependency-is-standing-by-failure.md) — the discipline operating recursively at Soraya scope
+- [`docs/backlog/P3/B-0718-soraya-four-trigger-framework-cadence-audit-2026-05-23.md`](B-0718-soraya-four-trigger-framework-cadence-audit-2026-05-23.md) — the audit this row audits in turn
+- [`.claude/skills/formal-verification-expert/SKILL.md`](../../../.claude/skills/formal-verification-expert/SKILL.md) — update target if option 1 or 2 chosen
+- [`.claude/agents/formal-verification-expert.md`](../../../.claude/agents/formal-verification-expert.md) — Soraya persona definition
+- [`memory/persona/soraya/NOTEBOOK.md`](../../../memory/persona/soraya/NOTEBOOK.md) — landing surface candidate for option 1
+
+## Effort
+
+S (one decision + one substrate landing + skill update). Assignee: soraya.
+
+Per Aaron's 2026-05-23 21:30Z policy-flip: Otto auto-ships immediately per the auto-ship default; this row IS the policy-flip operating correctly at meta-meta-scope.