Close CTO architecture brief

.sot/03-PROTOCOLS/CTO-ARCHITECTURE-BRIEF-CLOSEOUT-ISSUES.md

@@ -0,0 +1,62 @@
+---
+name: cto-architecture-brief-closeout-issues
+tier: local
+status: validated
+owner: jp
+source: .sot/03-PROTOCOLS/CTO-ARCHITECTURE-BRIEF-CLOSEOUT-PRD.md
+created: 2026-06-01
+last_reviewed: 2026-06-01
+lifecycle_classification: planning
+core_promotion_status: not-promoted
+description: Child-local issue sequence for closing the original CTO architecture brief.
+---
+
+# CTO Architecture Brief Closeout Issues
+
+Local planning SOT only. Not a Core Protocol. Not active Core authority.
+
+## Issue Sequence
+
+### CTO-WORK-046 - CTO Architecture Brief Closeout PRD
+
+Type: AFK
+
+Status: validated.
+
+Blocked by: CTO-WORK-045
+
+What to build: Define the closeout rules for validating the original architecture brief without changing runtime authority.
+
+Acceptance criteria:
+
+- [x] PRD states `CTO-WORK-001` can close only as child-local planning validation.
+- [x] PRD requires Stage 1 through Stage 6 evidence.
+- [x] PRD requires Hermes Control Surface evidence.
+- [x] PRD forbids Core promotion and Case default activation.
+
+Validator: `python3 tools/validate_cto_child.py`
+
+### CTO-WORK-047 - CTO Architecture Brief Closeout Evidence
+
+Type: AFK
+
+Status: validated.
+
+Blocked by: CTO-WORK-046
+
+What to build: Update the original brief and WORKBOARD so the architecture thesis is closed as validated by later proof artifacts.
+
+Acceptance criteria:
+
+- [x] `CTO-WORK-001` status is `validated`.
+- [x] Original brief status is `validated`.
+- [x] Original brief references Stage 1 through Stage 6 proof gates.
+- [x] Original brief references `CTO-WORK-043`.
+- [x] Original brief references `CTO-WORK-045`.
+- [x] Original brief states Case remains candidate only.
+- [x] Original brief states runtime default activation remains false.
+- [x] Local CTO validator passes.
+
+Validator: `python3 tools/validate_cto_child.py`
+
+Done evidence: this issue artifact, original brief closeout section, WORKBOARD status, local validator JSON, and commit.

.sot/03-PROTOCOLS/CTO-ARCHITECTURE-BRIEF-CLOSEOUT-PRD.md

@@ -0,0 +1,71 @@
+---
+name: cto-architecture-brief-closeout-prd
+tier: local
+status: validated
+owner: jp
+source: WORKBOARD.yaml CTO-WORK-001
+created: 2026-06-01
+last_reviewed: 2026-06-01
+lifecycle_classification: planning
+core_promotion_status: not-promoted
+description: Child-local PRD for closing the original CTO Case backend architecture brief after later proof artifacts validate its planning thesis.
+---
+
+# CTO Architecture Brief Closeout PRD
+
+Local planning SOT only. Not a Core Protocol. Not active Core authority.
+
+## Problem Statement
+
+`CTO-WORK-001` remains `candidate` even though later validated CTO work now proves the architecture thesis as a child-local planning surface: Cortex governs, Hermes controls, CTO routes, Harness proves, Case executes after proof, and Target Repositories stay owned.
+
+Leaving the first brief as candidate makes the WORKBOARD look less true than the actual proof ladder.
+
+## Solution
+
+Close `CTO-WORK-001` as validated by referencing later evidence instead of changing authority.
+
+The closeout must say the brief is validated only as child-local architecture planning. It must not claim Core promotion, Case runtime default activation, or real production delegation readiness.
+
+## Scope
+
+- Mark the original architecture brief as validated.
+- Record the exact evidence chain that validates the brief thesis.
+- Keep Case as candidate-default eligible only, with runtime default activation false.
+- Keep the CTO workspace child-local.
+- Keep Hermes as control and replay surface, not authority.
+
+## Non-Goals
+
+- Do not implement a new backend.
+- Do not activate Case as runtime default.
+- Do not mutate Hermes Runtime, Cortex Core, Case source, vendor source, external developer repositories, or Target Repositories.
+- Do not create a new Core Protocol.
+- Do not reopen provider/model policy.
+
+## Acceptance Criteria
+
+- `CTO-WORK-001` status is `validated`.
+- Closeout evidence references Stage 1 through Stage 6 validation.
+- Closeout evidence references `CTO-WORK-043` Stage 6 candidate-default comparison.
+- Closeout evidence references `CTO-WORK-045` Hermes Control Surface validation.
+- Closeout says Case remains candidate only and runtime default activation remains false.
+- Local CTO validator checks the closeout PRD and issue artifact.
+
+## Validation
+
+Run:
+
+```bash
+python3 tools/validate_cto_child.py
+```
+
+## Risks
+
+- Overclaiming: mitigated by saying this is planning validation only.
+- Authority drift: mitigated by keeping Core promotion status `not-promoted`.
+- Default drift: mitigated by saying runtime default activation remains false.
+
+## Success Definition
+
+The CTO WORKBOARD has no stale candidate architecture item, and the original brief points to the validated proof ladder without granting new authority.

.sot/03-PROTOCOLS/CTO-CASE-BACKEND-BRIEF.md

@@ -1,7 +1,7 @@
 ---
 name: cto-case-backend-brief
 tier: local
-status: draft
+status: validated
 owner: jp
 source: conversation
 created: 2026-05-31
@@ -139,3 +139,21 @@ Candidate Cortex Work Packet is not a promoted Core object class. Until Core pro
 ## Non-Authority Notice
 
 This brief is child-local planning. It does not promote Case, Hermes CTO, or the CTO harness into Core authority.
+
+## Closeout Status
+
+Status: validated by later child-local CTO evidence.
+
+The brief thesis is validated as a planning architecture, not as Core promotion and not as Case runtime default activation.
+
+Evidence:
+
+- Stage 1 through Stage 6 proof gates are recorded as validated in `WORKBOARD.yaml`.
+- `CTO-WORK-043` records Stage 6 candidate-default comparison evidence.
+- `CTO-WORK-045` records Hermes Control Surface evidence for Harness-backed visibility and replay.
+- Hermes commit `3cbd799 Add harness-backed Hermes control summary` exposes the evidence-backed control summary.
+- CTO commit `2d012d0 Record Hermes control summary proof` records the proof path in this child-local workspace.
+
+Remaining limit:
+
+- Case is a leading candidate backend only. Runtime default activation remains false until a later governed route changes it.

README.md

@@ -31,6 +31,8 @@ This workspace is registered as a child-local planning workspace. Registration d
 |   |   `-- CTO-WORKSPACE-INTENT.md
 |   `-- 03-PROTOCOLS/
 |       |-- CTO-CASE-BACKEND-BRIEF.md
+|       |-- CTO-ARCHITECTURE-BRIEF-CLOSEOUT-PRD.md
+|       |-- CTO-ARCHITECTURE-BRIEF-CLOSEOUT-ISSUES.md
 |       |-- CTO-CASE-CANDIDATE-BACKEND-PRD.md
 |       |-- CTO-CASE-CANDIDATE-BACKEND-ISSUES.md
 |       |-- CTO-HARNESS-EVIDENCE-INTERFACE-CONTRACT.md

WORKBOARD.yaml

@@ -1,9 +1,19 @@
 items:
   - id: CTO-WORK-001
     title: CTO Case Backend Architecture Brief
-    status: candidate
+    status: validated
     source: .sot/03-PROTOCOLS/CTO-CASE-BACKEND-BRIEF.md
     owner: jp
+  - id: CTO-WORK-046
+    title: CTO Architecture Brief Closeout PRD
+    status: validated
+    source: .sot/03-PROTOCOLS/CTO-ARCHITECTURE-BRIEF-CLOSEOUT-PRD.md
+    owner: ""
+  - id: CTO-WORK-047
+    title: CTO Architecture Brief Closeout Evidence
+    status: validated
+    source: .sot/03-PROTOCOLS/CTO-ARCHITECTURE-BRIEF-CLOSEOUT-ISSUES.md
+    owner: jp
   - id: CTO-WORK-002
     title: CTO Case Candidate Backend PRD
     status: validated

tools/validate_cto_child.py

@@ -17,6 +17,8 @@ REQUIRED_FILES = [
     "CONTEXT.md",
     ".sot/00-START/CTO-WORKSPACE-INTENT.md",
     ".sot/03-PROTOCOLS/CTO-CASE-BACKEND-BRIEF.md",
+    ".sot/03-PROTOCOLS/CTO-ARCHITECTURE-BRIEF-CLOSEOUT-PRD.md",
+    ".sot/03-PROTOCOLS/CTO-ARCHITECTURE-BRIEF-CLOSEOUT-ISSUES.md",
     ".sot/03-PROTOCOLS/CTO-CASE-CANDIDATE-BACKEND-PRD.md",
     ".sot/03-PROTOCOLS/CTO-CASE-CANDIDATE-BACKEND-ISSUES.md",
     ".sot/03-PROTOCOLS/CTO-HARNESS-EVIDENCE-INTERFACE-CONTRACT.md",
@@ -66,6 +68,26 @@ REQUIRED_BRIEF_PHRASES = [
     "Core promotes only through SOT route.",
     "Case is the candidate CTO execution backend, not the CTO authority layer.",
     "This brief is child-local planning.",
+    "Status: validated by later child-local CTO evidence.",
+    "Stage 1 through Stage 6 proof gates are recorded as validated in `WORKBOARD.yaml`.",
+    "`CTO-WORK-043` records Stage 6 candidate-default comparison evidence.",
+    "`CTO-WORK-045` records Hermes Control Surface evidence for Harness-backed visibility and replay.",
+    "Runtime default activation remains false until a later governed route changes it.",
+]
+
+REQUIRED_ARCHITECTURE_CLOSEOUT_PRD_PHRASES = [
+    "Local planning SOT only. Not a Core Protocol. Not active Core authority.",
+    "`CTO-WORK-001` remains `candidate`",
+    "Close `CTO-WORK-001` as validated by referencing later evidence instead of changing authority.",
+    "Stage 1 through Stage 6 validation",
+    "`CTO-WORK-043` Stage 6 candidate-default comparison",
+    "`CTO-WORK-045` Hermes Control Surface validation",
+    "runtime default activation remains false",
+]
+
+REQUIRED_ARCHITECTURE_CLOSEOUT_ISSUE_IDS = [
+    "CTO-WORK-046",
+    "CTO-WORK-047",
 ]
 
 REQUIRED_PRD_PHRASES = [
@@ -882,10 +904,34 @@ def main() -> int:
     brief = ROOT / ".sot/03-PROTOCOLS/CTO-CASE-BACKEND-BRIEF.md"
     if brief.is_file():
         text = brief.read_text(encoding="utf-8")
+        if "status: validated" not in text:
+            errors.append("brief_missing_validated_frontmatter")
         for phrase in REQUIRED_BRIEF_PHRASES:
             checked.append(f"brief_phrase:{phrase}")
             if phrase not in text:
                 errors.append(f"missing_brief_phrase:{phrase}")
+
+    architecture_closeout_prd = ROOT / ".sot/03-PROTOCOLS/CTO-ARCHITECTURE-BRIEF-CLOSEOUT-PRD.md"
+    if architecture_closeout_prd.is_file():
+        text = architecture_closeout_prd.read_text(encoding="utf-8")
+        if "core_promotion_status: not-promoted" not in text:
+            errors.append("architecture_closeout_prd_missing_not_promoted_frontmatter")
+        for phrase in REQUIRED_ARCHITECTURE_CLOSEOUT_PRD_PHRASES:
+            checked.append(f"architecture_closeout_prd_phrase:{phrase}")
+            if phrase not in text:
+                errors.append(f"missing_architecture_closeout_prd_phrase:{phrase}")
+
+    architecture_closeout_issues = ROOT / ".sot/03-PROTOCOLS/CTO-ARCHITECTURE-BRIEF-CLOSEOUT-ISSUES.md"
+    if architecture_closeout_issues.is_file():
+        text = architecture_closeout_issues.read_text(encoding="utf-8")
+        if "core_promotion_status: not-promoted" not in text:
+            errors.append("architecture_closeout_issues_missing_not_promoted_frontmatter")
+        if "Local planning SOT only. Not a Core Protocol. Not active Core authority." not in text:
+            errors.append("architecture_closeout_issues_missing_local_planning_notice")
+        for issue_id in REQUIRED_ARCHITECTURE_CLOSEOUT_ISSUE_IDS:
+            checked.append(f"architecture_closeout_issue_id:{issue_id}")
+            if issue_id not in text:
+                errors.append(f"missing_architecture_closeout_issue_id:{issue_id}")
         if "core_promotion_status: not-promoted" not in text:
             errors.append("brief_missing_not_promoted_frontmatter")
 
@@ -1394,6 +1440,10 @@ def main() -> int:
             checked.append(f"workboard_id:{issue_id}")
             if issue_id not in text:
                 errors.append(f"missing_workboard_id:{issue_id}")
+        for issue_id in REQUIRED_ARCHITECTURE_CLOSEOUT_ISSUE_IDS:
+            checked.append(f"workboard_id:{issue_id}")
+            if issue_id not in text:
+                errors.append(f"missing_workboard_id:{issue_id}")
         for issue_id in REQUIRED_PROVIDER_ADMISSION_ISSUE_IDS:
             checked.append(f"workboard_id:{issue_id}")
             if issue_id not in text:
@@ -1415,6 +1465,7 @@ def main() -> int:
             if issue_id not in text:
                 errors.append(f"missing_workboard_id:{issue_id}")
         expected_statuses = {
+            "CTO-WORK-001": "validated",
             "CTO-WORK-002": "validated",
             "CTO-WORK-003": "validated",
             "CTO-WORK-004": "validated",
@@ -1456,6 +1507,8 @@ def main() -> int:
             "CTO-WORK-043": "validated",
             "CTO-WORK-044": "validated",
             "CTO-WORK-045": "validated",
+            "CTO-WORK-046": "validated",
+            "CTO-WORK-047": "validated",
         }
         for issue_id, expected in expected_statuses.items():
             checked.append(f"workboard_status:{issue_id}:{expected}")