foundryside-dev · tachyon-beep · Jun 29, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -20,6 +20,17 @@ rest of Plainweave.
   Accepts a SEI or a dotted locator; preserves the no-silent-clean contract
   (`present`/`absent`/`unavailable` — an identity gap is `unavailable`, never `absent`).
 
+### Added
+- **Frozen degraded-state contract for `weft.plainweave.loomweave_catalog.v1`** — the
+  Loomweave catalog producer's `unavailable`-adapter envelope is now pinned by a structural
+  validator + golden routed through the same oracle as live output (no-silent-clean: an
+  unavailable adapter never returns a clean-empty page). Seam-hardening, no behavior change
+  (PDR-018, production blocker #3).
+- **Contract test for the Filigree seam** — pins `open_linked_work` as reserved-but-never-
+  emitted by the local-only producer (absence is the in-band `linked_work_facts_unavailable`
+  warning), the `filigree_issue` trace opacity + canonical relations, and the dossier's
+  advisory boundary (PDR-018, production blocker #5).
+
 ### Fixed
 - `requirements_enrichment` now drops `rejected` trace links before building the view — a
   reviewed-and-rejected binding no longer reads as requirement coverage (`present`); a
@@ -28,6 +39,10 @@ rest of Plainweave.
 - `plainweave doctor` Wardline-findings remediation is now root-aware (`cd <root> &&
   wardline scan .` when the inspected root is not the cwd). _(Folded in from a sibling
   product's contract work.)_
+- ADR-006 now documents that the preflight producer emits 8 of its 11 fact kinds and why the
+  other three are superseded (dedicated wardline producer) or sibling-gated (Filigree); added
+  the previously-missing behavioral coverage for the `orphaned_entity_link` fact (PDR-018,
+  production blocker #4).
 
 ## [1.1.0] — 2026-06-27
 

diff --git a/docs/architecture/decisions/ADR-006-legis-preflight-fact-envelope.md b/docs/architecture/decisions/ADR-006-legis-preflight-fact-envelope.md
@@ -84,6 +84,26 @@ orphaned_entity_link
 untraced_change
 ```
 
+### Emission status (annotated 2026-06-29, PDR-018 — seam hardening)
+
+The local-only producer emits **8 of the 11** kinds above. Three are deliberately
+**not emitted** by this producer, and their absence is reported in-band as
+`info`/`freshness: unavailable` warnings (`linked_work_facts_unavailable`,
+`finding_facts_unavailable`) — never as an empty-but-ok fact list (no-silent-clean):
+
+- `active_finding_linked`, `waived_finding_linked` — **superseded** by the dedicated
+  `weft.plainweave.wardline_peer_facts.v1` producer (PDR-014), which surfaces the same
+  local `.wardline/*-findings.jsonl` data. Wiring them into the preflight envelope as
+  well is an owner-gated ADR fork, intentionally **not** taken (PDR-018).
+- `open_linked_work` — **sibling-gated**: no in-grant local Filigree source exists
+  (`.filigree/` is a Filigree-owned DB; the live `entity_association` read would break
+  `authority_boundary.live_peer_calls=false`). Handed off as
+  `docs/handoffs/2026-06-29-filigree-linked-work-facts.md`.
+
+Reversal trigger: if a boundary-clean local Filigree facts artifact (mirroring
+`.wardline/*.jsonl`) lands, `open_linked_work` becomes emittable in-grant and this
+fork reopens.
+
 ## Related Decisions
 
 - ADR-001: Plainweave authority boundary.

diff --git a/docs/handoffs/2026-06-29-filigree-linked-work-facts.md b/docs/handoffs/2026-06-29-filigree-linked-work-facts.md
@@ -0,0 +1,56 @@
+# Peer prompt — Filigree: emit a local linked-work facts artifact for Plainweave
+
+**To:** the Filigree maintainer / implementing agent.
+**From:** Plainweave (owner-gated sibling handoff).
+**Date:** 2026-06-29 (PDR-018, seam hardening).
+**Status:** PROPOSED — owner-gated. Do **not** implement on the Plainweave side; this is
+Filigree-side work plus a small Plainweave adapter once the artifact exists.
+
+## Why
+
+Plainweave's Legis preflight producer (`weft.plainweave.preflight_facts.v1`, ADR-006)
+reserves an `open_linked_work` fact kind: "for a scoped requirement/gap, what Filigree
+issues are open and linked?". Plainweave **cannot emit it today** and honestly reports the
+gap in-band as the `linked_work_facts_unavailable` warning (no-silent-clean). It cannot be
+emitted in-grant because:
+
+- Plainweave never calls a sibling live: `authority_boundary.live_peer_calls = false`. The
+  sanctioned `entity_association_list_by_entity` (ADR-029) is a live MCP/HTTP call, so it
+  would break that boundary.
+- `.filigree/` is a Filigree-owned SQLite DB. Direct reads would couple Plainweave to
+  Filigree's internal schema — exactly the coupling the thin-member doctrine forbids.
+
+Unlike Wardline (whose append-only `.wardline/*-findings.jsonl` Plainweave already adapts
+in-grant), Filigree exposes **no local, boundary-clean facts artifact** Plainweave can read.
+
+## The ask (Filigree-side)
+
+Emit a **local, append-only or snapshot facts artifact** — mirroring `.wardline/*.jsonl` —
+that Plainweave can read read-only with no live call. Suggested: `.filigree/linked-work.jsonl`
+(or a documented export command) with, per row, the stable identity Plainweave keys on plus
+the issue's open/closed lifecycle facts. Concretely, enough to answer "for requirement R /
+gap G, which Filigree issues are open and link to it":
+
+- the linked entity/requirement/gap identity (a SEI or the `filigree_issue` / `gap` ids
+  Plainweave already stores as opaque trace refs — see `service.py` canonical relations
+  `('filigree_issue','implements_work_for','requirement_version')` and
+  `('filigree_issue','resolves_gap','gap')`),
+- issue id, status/lifecycle (open vs closed/resolved), and a freshness/observed-at stamp.
+
+Facts only — **no verdicts**. Filigree owns the work lifecycle; Plainweave only surfaces the
+linkage as advisory context. Plainweave will **never** create or move Filigree work from
+this seam (the `gap_create_work` write path stays unimplemented; it would mutate a sibling).
+
+## Then (Plainweave-side, once the artifact exists — a separate owner-gated bid)
+
+A `FiligreeAdapter` reading that artifact in-grant (the Wardline-adapter pattern), wiring real
+`open_linked_work` facts into `preflight_facts.v1`, with the `linked_work_facts_unavailable`
+warning degrading to a `filigree_linked_work_absent` code only when the artifact is genuinely
+absent — and a frozen contract test (mirroring the wardline/warpline/loomweave contract tests
+landed in PDR-018).
+
+## Reversal trigger (recorded in ADR-006)
+
+If this boundary-clean local artifact lands, `open_linked_work` becomes emittable in-grant and
+the ADR-006 emission fork (PDR-018) reopens. Until then, the in-band
+`linked_work_facts_unavailable` warning is the correct honest posture.
diff --git a/docs/product/current-state.md b/docs/product/current-state.md
@@ -1,4 +1,4 @@
-# Plainweave Current State        Checkpoint: 2026-06-28 (PDR-016; prior PDR-015) · (commit recorded below)
+# Plainweave Current State        Checkpoint: 2026-06-29 (PDR-018; prior PDR-016) · (branch feat/seam-hardening-blockers-345)
 
 ## The bet right now
 
@@ -65,6 +65,10 @@ north-star (coverage completeness) unchanged — owner-/sibling-gated.
 **Owner calls on the release escalation** — finalize the `1.2.0` CHANGELOG version/date,
 reconcile/retire the `release/1.2.0` branch against `main`, then the held PyPI publish. Then
 close the two **Lacuna-tour prerequisites** (fix the packaging bug → install plainweave →
-clean-tree `make tour`). Then continue **harden + build** (remaining production blockers:
-Loomweave-owned identity resolution, Legis fact emission, Filigree contract tests) or pivot to
-**coverage-completeness** if the owner wants north-star movement.
+clean-tree `make tour`). All 5 named production blockers are now retired plainweave-side —
+**PDR-018 closed the last three** (#3 Loomweave identity / #4 Legis fact emission / #5
+Filigree contract tests) as test-and-docs-only hardening (390 tests, 91.18% cov; legis
+cross-repo oracle stayed green; zero `src/` changes). The only open seam item is the
+owner-gated Filigree `open_linked_work` handoff
+(`docs/handoffs/2026-06-29-filigree-linked-work-facts.md`). Next: pivot to
+**coverage-completeness** if the owner wants north-star movement, or finalize the release.
diff --git a/docs/product/decisions/PDR-018-seam-hardening-blockers-345.md b/docs/product/decisions/PDR-018-seam-hardening-blockers-345.md
@@ -0,0 +1,78 @@
+# PDR-018: Seam hardening — production blockers #3/#4/#5 retired plainweave-side (contract tests + test-hardening)
+
+Date: 2026-06-29   Status: accepted   Author: agent:claude-product-owner
+Owner sign-off: EXPLICIT (owner set the bid — "do the seam hardening … then get it out the door" — and authorized subagent-driven multi-agent delivery via "ultracode"/"ultrathink")
+Related: PDR-014 (peer facts; retired blockers 1/2 + Warpline/Wardline contract tests), PDR-009 (no-silent-clean / no-vanity-metric), PDR-011 (doctor federation parity), ADR-006 (Legis preflight fact envelope), ADR-005 (Loomweave SEI consumer contract)
+
+## Context
+
+PDR-014 retired 3 of the 5 named production blockers. This bid retires the remaining
+three — (3) Loomweave-owned identity resolution, (4) Legis fact emission, (5) Filigree
+contract tests — under the harden-and-ship posture. A scoping workflow (3 investigators +
+adversarial challenge per blocker + contract-template auditor) established the **honest
+size** of each: the seam BEHAVIOR was already built and tested for #3 and #4; the genuine
+gaps were contract-test/parity artifacts and one zero-coverage fact kind. The adversarial
+pass rejected two unsafe over-scopes (suppressing the Legis `*_unavailable` warnings — a
+silent-clean hole; a dedicated Filigree validator module — Filigree emits no `.v1` payload).
+
+## The call
+
+**Plainweave-side, test-and-docs only — ZERO `src/` production changes** (the seam behavior
+already exists; this freezes and pins it). Delivered via inline TDD with every new test
+proven red-first against a transient producer mutation (anti-decorative), then reverted.
+
+- **#5 Filigree contract tests — RETIRED.** New `tests/contracts/test_filigree_contract.py`
+  pins: `open_linked_work` is never emitted by the local-only producer (absence is the
+  in-band `linked_work_facts_unavailable` warning, never empty-but-ok); the `filigree_issue`
+  `implements_work_for` relation (previously untested) is canonical and stored as an opaque
+  pointer; a non-canonical filigree relation is a VALIDATION error; the dossier introduces no
+  gate/decision/enforcement KEY. The scope-independent presence of `linked_work_facts_unavailable`
+  on an EMPTY scope is pinned by an extension to the existing empty-scope preflight test.
+  (Finding: the peer-facts value-token scanner does NOT apply to the dossier, which
+  legitimately carries lifecycle `"approved"`/`"rejected"` VALUES — the meaningful invariant
+  is the absence of a verdict KEY.)
+- **#4 Legis fact emission — degraded-state already done; test-hardening landed; remaining
+  kinds handed-off / superseded (NOT "all kinds flowing").** The producer's explicit
+  degraded-state (`live_diff_resolution_unavailable`, `freshness: partial`, `requirement_nearby`
+  basis) was already present and tested. Added the missing behavioral coverage for
+  `orphaned_entity_link` (emitted but previously zero-coverage). Of ADR-006's 11 fact kinds the
+  producer emits 8; the three unemitted are now PROVENANCED in ADR-006 (annotation): 
+  `active_finding_linked`/`waived_finding_linked` are **superseded** by the dedicated
+  `weft.plainweave.wardline_peer_facts.v1` producer (PDR-014) — wiring them into the preflight
+  envelope is an owner-gated fork intentionally NOT taken; `open_linked_work` is **sibling-gated**
+  (handed off, below). Fixed a stale doc claim (the Legis consumer now exists).
+- **#3 Loomweave identity resolution — behavior already done+tested; PDR-014-parity contract
+  landed.** The live HTTP resolve + capability probe + closed-vocab degraded codes + SEI §8
+  oracle were already implemented and tested. Added the missing PRODUCER-side contract:
+  `tests/loomweave_contract.py::validate_loomweave_catalog` + a degraded golden
+  (`tests/fixtures/contracts/loomweave/catalog-degraded.json`), routing the committed golden
+  AND live producer output through one validator so they cannot diverge. The cardinal
+  invariant pinned: an `unavailable` adapter never returns a clean-empty page (empty `items`
+  must carry a non-empty `degraded[]`).
+
+## Evidence
+
+`make ci` green: **390 tests** (up from 378), **91.18% coverage** (up from 91.14%), mypy
+--strict + ruff clean. `wardline scan` clean (0 active). Cross-repo: legis's vendored preflight
+oracle stays green (**28 passed**) — additive plainweave-side test/doc changes created no
+legis obligation (legis pins the empty `commit_range` scenario; plainweave pins the populated
+one). Every new test mutation-verified red-before-green. Zero `src/plainweave/*.py` changes.
+
+## Scope explicitly NOT taken (honesty)
+
+- The preflight wire-golden was NOT enriched with `orphaned_entity_link`/`requirement_nearby`;
+  the behavioral test closes the coverage gap, and the wire-golden remains one representative
+  scenario — avoiding a byte-pin re-vendor and any cross-repo churn for no added guarantee.
+- No live Filigree join, no `gap_create_work` write path (would mutate a sibling; spine-prohibited).
+
+## Sibling follow-on (OWNER-GATED — handed off, not done)
+
+`docs/handoffs/2026-06-29-filigree-linked-work-facts.md`: a peer prompt asking Filigree to emit
+a local, boundary-clean linked-work facts artifact (mirroring `.wardline/*.jsonl`) that
+Plainweave could adapt in-grant to emit real `open_linked_work` facts.
+
+## Reversal trigger
+
+If a boundary-clean local Filigree facts artifact lands, `open_linked_work` becomes emittable
+in-grant and the ADR-006 emission fork reopens (a `FiligreeAdapter` + its contract test, a
+separate owner-gated bid). Recorded in ADR-006's emission-status annotation.
diff --git a/tests/contracts/test_contract_fixtures.py b/tests/contracts/test_contract_fixtures.py
@@ -5,6 +5,7 @@
 from typing import Any, cast
 
 from tests.intent_coverage_contract import validate_intent_coverage
+from tests.loomweave_contract import validate_loomweave_catalog
 from tests.preflight_contract import validate_preflight_facts
 from tests.wardline_contract import validate_wardline_peer_facts
 from tests.warpline_contract import validate_requirements_enrichment
@@ -73,6 +74,7 @@
     "intent/intent-coverage.json",
     "loomweave/identity-resolve.json",
     "loomweave/identity-sei.json",
+    "loomweave/catalog-degraded.json",
     "mcp/side-effect-metadata.json",
     "mcp/tool-inventory.json",
     "mcp/resource-inventory.json",
@@ -396,6 +398,16 @@ def test_preflight_facts_fixture_contract() -> None:
     validate_preflight_facts({key: value for key, value in fixture.items() if key != "schema"})
 
 
+def test_loomweave_catalog_degraded_fixture_contract() -> None:
+    fixture = load_fixture("loomweave/catalog-degraded.json")
+
+    assert fixture["schema"] == "weft.plainweave.loomweave_catalog.v1"
+    # The degraded envelope is validated through the SAME structural validator as live
+    # output (test_loomweave_contract.py), so the golden and the running tool cannot
+    # diverge without one test or the other failing.
+    validate_loomweave_catalog({key: value for key, value in fixture.items() if key != "schema"})
+
+
 def test_intent_coverage_fixture_contract() -> None:
     fixture = load_fixture("intent/intent-coverage.json")