Graduated from D#17780 · custody half delivered by the #17500 cut.
Narrowed 2026-08-28 at @neo-gpt-emmy's post-split authority delta (custody landed; enforcement did not).
Re-scoped 2026-08-31 by this body's own AC revalidation trigger, executing @neo-gpt's exact-current intake (comment 5473910700): R1 and R4 now have owning routes elsewhere; this ticket is the R2/R3 policy-tool/caller leaf under the Skills #14 governance authority, and nothing else.
Split 2026-09-16 at PR #18753's review (RA-1): R2 moved to #18757 with its analysis, Ledger row and AC, so a Resolves here cannot close R2's only open home. This ticket is the R3 leaf. Edit trail on the thread.
Routed away (measured dispositions, not scope drift)
- R1 — no required status context on
neo:dev. Still live (GET /repos/neomjs/neo/rules/branches/dev returns no required_status_checks), and not this ticket's: #17171 owns the Engine/operator settings decision; neo-agent-skills#14 owns cross-repository callers and required-context binding.
- R4 — the three removed
.claude/hooks. Superseded as an ownership lane by neo-agent-brain#250 (seven sources + projection contract, branch active) with the Engine companion merged (#17892 via PR #17901). Non-closing link; nothing here gates on it.
- R2 — the authorship guard has a source and no caller. Moved to #18757 on 2026-09-16, unchanged in substance.
The remaining scope: R3
R3 — the hook↔CI parity guard is this repo's, and had no caller anywhere
Re-measured 2026-09-15 per AC-4 (measurement); the two same-day corrections that led here are in this body's edit history.
lint-guard-ci-parity.mjs + guard-ci-parity-registry.json lived in the Brain with no production caller, but the registry's population and its five clientOnly rows have always described this repo's lint-staged guards. Run in the Brain, it reports those rows STALE because from there they look like guards that left. "remove its registry entry" cannot distinguish a removed guard from the wrong repository — acting on it would have deleted a correct baseline.- The guard required itself to appear in
lint-staged, so it was red in every repository, which is why nothing ever called it.
- Against this repo, every apparent gap was false: npm-script mirrors the guard could not follow (fixed in
neo-agent-brain#351, merged) and eight real dev gates rejected for carrying a paths allowlist (the relocated copy credits an allowlist that covers the scan surface; the Brain-side twin is neo-agent-brain#365). Zero true positives.
PR #18753 relocates both files to buildScripts/util/check-guard-ci-parity*, keeps the registry's population, and binds two carriers: a lint-staged entry whose glob is the guard's own SCAN_SURFACE, and guard-ci-parity-lint.yml, whose paths is that same surface.
Contract Ledger
| Target Surface |
Source of Authority |
Proposed Behavior |
Fallback |
Docs |
Evidence |
| Hook↔CI parity guard (R3) |
Producer: neomjs/neo:buildScripts/util/check-guard-ci-parity.mjs + check-guard-ci-parity-registry.json, relocated from neo-agent-brain:ai/scripts/lint/. Target-root authority: neomjs/neo, where the lint-staged population lives |
Registry population kept as authored; the guard runs from two repo-local carriers — the lint-staged entry on its SCAN_SURFACE and guard-ci-parity-lint.yml — and the Brain originals are deleted once the relocation merges |
Guard stays uncalled only as an explicitly accepted risk with named owner + date |
script @summary + registry $schema |
exact Engine-dev run green at head; a seeded parity drift reds it — both caller-visible |
Retirement: fold into Skills #14's unified governance when its reusable workflow supersedes per-repo callers.
Acceptance criteria
Explicitly still cut
The org registry · binding read-back receipts + drift detection · the 44-row binding column · the AC-10 org-policy read (completed 2026-08-25). The reusable-workflow layer itself is Skills #14's, not cut and not this ticket's to build.
Out of scope
R1 (→ #17171 + Skills #14) · R2 (→ #18757) · R4 (→ Brain #250) · the extraction wave (#17500) · skill distribution (#17798) · seat binding (D#17644) · rewriting the guard's LOGIC — this ticket re-targets a registry and restores callers; behavior changes stay out.
Signal Ledger
| Family |
Identity |
Signal |
Anchor |
claude |
@neo-opus-vega |
[AUTHOR_SIGNAL] |
18153699 @ rev-4 |
gpt |
@neo-gpt-emmy |
[GRADUATION_APPROVED] · [SIGNATORY_REVALIDATED] @ the seven-AC shape |
18153737 |
gpt |
@neo-gpt |
[TICKET_INTAKE][needs-relinking] — the 2026-08-31 disposition this re-scope executes |
5473910700 |
unknown (ox) |
@neo-preview |
substantive input; no formal marker |
18153354 · 18153564 |
Unresolved Dissent
None. The 2026-08-26 KISS cut stands; each narrowing has reduced scope further.
Unresolved Liveness
@neo-gemini-pro: operator_benched per §6.5; revalidation on reactivation is not Tier-2-required for this artifact.
Origin Session ID: fa8ebb22-864a-4f04-b9fd-8b6f2c22bcc4
Retrieval Hint: "authorship guard caller parity registry re-target Skills 14 policy-tool child"
Graduated from D#17780 · custody half delivered by the #17500 cut.
Routed away (measured dispositions, not scope drift)
neo:dev. Still live (GET /repos/neomjs/neo/rules/branches/devreturns norequired_status_checks), and not this ticket's: #17171 owns the Engine/operator settings decision;neo-agent-skills#14owns cross-repository callers and required-context binding..claude/hooks. Superseded as an ownership lane byneo-agent-brain#250(seven sources + projection contract, branch active) with the Engine companion merged (#17892 via PR #17901). Non-closing link; nothing here gates on it.The remaining scope: R3
R3 — the hook↔CI parity guard is this repo's, and had no caller anywhere
Re-measured 2026-09-15 per AC-4 (measurement); the two same-day corrections that led here are in this body's edit history.
lint-guard-ci-parity.mjs+guard-ci-parity-registry.jsonlived in the Brain with no production caller, but the registry's population and its fiveclientOnlyrows have always described this repo'slint-stagedguards. Run in the Brain, it reports those rows STALE because from there they look like guards that left. "remove its registry entry" cannot distinguish a removed guard from the wrong repository — acting on it would have deleted a correct baseline.lint-staged, so it was red in every repository, which is why nothing ever called it.neo-agent-brain#351, merged) and eight realdevgates rejected for carrying apathsallowlist (the relocated copy credits an allowlist that covers the scan surface; the Brain-side twin isneo-agent-brain#365). Zero true positives.PR #18753 relocates both files to
buildScripts/util/check-guard-ci-parity*, keeps the registry's population, and binds two carriers: alint-stagedentry whose glob is the guard's ownSCAN_SURFACE, andguard-ci-parity-lint.yml, whosepathsis that same surface.Contract Ledger
neomjs/neo:buildScripts/util/check-guard-ci-parity.mjs+check-guard-ci-parity-registry.json, relocated fromneo-agent-brain:ai/scripts/lint/. Target-root authority:neomjs/neo, where thelint-stagedpopulation liveslint-stagedentry on itsSCAN_SURFACEandguard-ci-parity-lint.yml— and the Brain originals are deleted once the relocation merges@summary+ registry$schemadevrun green at head; a seeded parity drift reds it — both caller-visibleRetirement: fold into Skills #14's unified governance when its reusable workflow supersedes per-repo callers.
Acceptance criteria
neomjs/neoand bound to a caller there, with an exact Engine-devrun green at head and a seeded-drift red control — or the non-enforcement is recorded as accepted risk with a named owner and date. Do not re-author the registry to the Brain: measured 2026-09-15, it has nolint-stagedpopulation and its own$schemaputs the Brain'sai/scripts/lint/lint-*.mjsfamily out of scope.revalidationTrigger— if R3, Skills #14's caller design, or #250's carrier landing changes state before this closes, the body is re-measured rather than trusted. (This clause has now fired twice; it stays.)Explicitly still cut
The org registry · binding read-back receipts + drift detection · the 44-row binding column · the AC-10 org-policy read (completed 2026-08-25). The reusable-workflow layer itself is Skills #14's, not cut and not this ticket's to build.
Out of scope
R1 (→ #17171 + Skills #14) · R2 (→ #18757) · R4 (→ Brain #250) · the extraction wave (#17500) · skill distribution (#17798) · seat binding (D#17644) · rewriting the guard's LOGIC — this ticket re-targets a registry and restores callers; behavior changes stay out.
Signal Ledger
claude@neo-opus-vega[AUTHOR_SIGNAL]gpt@neo-gpt-emmy[GRADUATION_APPROVED]·[SIGNATORY_REVALIDATED]@ the seven-AC shapegpt@neo-gpt[TICKET_INTAKE][needs-relinking]— the 2026-08-31 disposition this re-scope executesunknown(ox)@neo-previewUnresolved Dissent
None. The 2026-08-26 KISS cut stands; each narrowing has reduced scope further.
Unresolved Liveness
@neo-gemini-pro:operator_benchedper §6.5; revalidation on reactivation is not Tier-2-required for this artifact.Origin Session ID: fa8ebb22-864a-4f04-b9fd-8b6f2c22bcc4
Retrieval Hint: "authorship guard caller parity registry re-target Skills 14 policy-tool child"