M5 · Product loop (Gate A)

The engine is ahead of the loop a user actually touches. This milestone closes that gap: it makes the default path — install, work normally, have the decision captured and verified, receive it before the next edit — work without the user knowing an internal command name.

AUTHORITY BINDING

• Current dev base: a333e76f59493ec90e100d1d44c833d7d9e5f093
• Planning authority: PR #220 MERGED; canonical head is dev at a333e76f59493ec90e100d1d44c833d7d9e5f093
• Exact set: 25 issues -- #192-#213, #215, #216, #219
• This binding is void if the candidate head moves. Re-derive it before citing it; do not carry
  a number from this description into a document without re-establishing it.
• Historical evidence SHAs recorded inside individual issues are left as recorded and are not
  rewritten to this base.

BASELINE (re-establish before citing; the figures below were measured on an earlier head)

• 45 test files, 1500 passing, 1 skipped; both typechecks exit 0.
• v0.3.0 is published from merge commit 16e2cfdabe22097969d47462d40d4c47425b0b19; post-merge CI and the four-platform release workflow passed, all four assets match SHA256SUMS, and their provenance attestations verify.
• CLI surface: parse, validate, hooks, index, context, limits, ruled-out, warnings, stale, doctor, init, harvest, harvest-verify, squash-preserve, prepare-commit-msg, guard, inject, backfill, mcp. There is no capture, demo, update, or uninstall command.
• MCP exposes three tools, all annotated read-only. There is no write side.
• The default edit-time hook runs inject. guard is in no default path.
• guard measures 44.8% precision (95% Wilson 32.7%-57.5%) and 22.0% recall against the 417-decision corpus; ADR-0019 concluded the current signals cannot separate the classes.
• Write-side capture cost is reported as not instrumented rather than as zero.

TARGET OUTCOME
A repository owner installs once, works through their agent as usual, and gets at most one verified record per commit without being asked to remember a phrase. A later agent receives only the decisions that still apply before it edits that path. Every quality limit a user could mistake for a guarantee is stated on the surface that exposes it.

NON-GOALS (each one is a decision, not an omission)

• No further search for guard weights or thresholds. ADR-0019 recorded that the current signals contain no decision boundary, with a falsification condition and a pinning test. Reopen it with new signals or with evidence, not with a re-weighting.
• No new protocol trailer fields. The vocabulary is sufficient; making it usable is the work.
• No web dashboard, and no hosted memory service. Repository-owned Git authority is the differentiator; a server would weaken it.
• No record on every commit. Structured noise is more dangerous than chat noise because a later agent trusts it more. Most commits must carry nothing.
• No additional benchmark ahead of the product loop. The current score is limited by the default user path, not by missing evidence.
• No blocking guard. Measured, not assumed: bench/GUARD-CANNOT-BLOCK.md.

GATE ORDER

• Gate A (this milestone): stable release hygiene, guard reclassified as experimental advisory with its measured numbers stated, unified capture with a pending transaction and successful-commit finalisation, MCP capture write side, result-oriented init, deterministic demo plus a recording generated from the same fixture, scene-first README.
• Gate B: Windows, musl, package managers, update and uninstall, the user-editable repository policy file, multi-agent end-to-end. Windows and musl extend the existing platform issues rather than new ones, and a musl target must never be justified as the fix for the installer defect — an active record rules that out.
• Gate C: fresh-agent decision-recovery pilot under the already registered protocol, external-repository dogfood, protocol conformance kit.

COMPLETION DEFINITION
Every issue in this milestone is closed, and each closes on evidence a command produced:

• A capture that was drafted and then invalidated by a changed staged diff is discarded, and the commit still succeeds.
• A verification failure never blocks a commit.
• Invalid grammar, unsupported rejection evidence, duplicate ids, and canonical duplicates of active records are discarded; an unavailable active-record source reports incomplete and stages nothing.
• MCP capture is a monotonic nonce transaction. prepare creates it, verify stores the result, and stage accepts only the nonce; no caller can supply records or evidence directly to bypass verification.
• prepare-commit-msg never consumes before success. A failed commit leaves the pending record retriable; post-commit consumes it exactly once only after parent, tree, canonical record block, and record ids match the successful commit.
• Default maximum is one record per commit.
• Every surface that exposes guard states its measured precision and recall, and no surface describes an empty guard result as a verdict.
• demo runs with no network and no model, modifies no user repository, and removes what it created. The README recording is reproducibly generated from that exact fixture/output and contains no private identifier.
• init reports readiness without hiding a warning or a failure.
• Full suite and both typechecks pass at the exact head that is merged, with no regression against the baseline above.

DEPENDENCIES
Capture is the spine: pending transaction, then prepare, then verify, then stage, then prepare-hook application, then post-commit finalisation; the CLI and MCP write side compose those primitives. Guard disclosure, demo, and init are independent of it and can run in parallel. README positioning precedes README section order; the demo recording follows the final demo fixture, command, and README placement. The v0.3.0 tag prerequisite for the install pin is satisfied.

EVIDENCE POLICY
Public surfaces carry commands and their output, file and line references, SHAs, issue and PR numbers. They do not carry private working paths, private input filenames, or tooling and session metadata. A figure is published with its interval or not published. A check that cannot see something says so rather than reporting a clean result.