Planning Backlog (Cross-ADR)

Structure-preserving compressed backlog. Every active row is atomic: stable PLN-xxxx ID, Imp×Debt priority, status, owner/layer, dependency, source ADR, source pointer, and done evidence. Closed/merged rows stay recoverable but do not compete with active work.

Imp×Debt key: P0 = load-bearing architecture debt that shapes downstream work; P1 = proof, guardrail, or implementation for already load-bearing architecture; P2 = cleanup/supporting work; Trigger = future optional work activated only by named evidence; Closed = merged, superseded, or stale. Priority is not effort or calendar time.

Order of attack: P0 active spec/ADR questions, P0 implementation prerequisites, P1 proof/guardrails, P2 cleanup, Trigger rows only when their trigger appears. A backlog row must explain what to do, why it matters, and what proves done without relying on surrounding conversation.

Reading guide for active clusters

Workflow consolidation (owner-decided 2026-04-25). 27 → 6 WOS schemas: one author-time core (wos-spec/schemas/wos-workflow.schema.json) with 7 embedded blocks (governance, agents, aiOversight, signature, custody, advanced, assurance), 2 sidecars (wos-delivery, wos-ontology-alignment), 2 runtime artifacts (wos-case-instance, wos-provenance-log), 1 tooling schema (wos-tooling). Single $wosWorkflow top-level version marker; specs do NOT physically merge — kernel/spec.md, governance/spec.md, ai/ai-integration.md, advanced/spec.md retain filenames and §-numbering. Forms+ tier (~30-line workflows) delivered via Formspec native IntakeHandoff emission per ADR 0079. Active rows span four non-contiguous ranges:

PLN-0176..0207 — kernel/spec.md absorption pass (Companions + Lifecycle Detail + Integration Profile content into kernel + governance/ai/advanced spec docs); §-numbering preserved across all four spec files.
PLN-0213..0218 — wos-spec/CLAUDE.md / README.md / COMPATIBILITY-MATRIX.md rewrite to embedded-block + sidecar shape and single-marker form.
PLN-0314..0330 — schema sketch promotion (PLN-0314), spec-merge closure (PLN-0315), sidecar split (PLN-0316), lint rules (PLN-0317, PLN-0326, PLN-0327), runtime-artifact rename and relocation (PLN-0318), tooling consolidation (PLN-0319, PLN-0328), example validation (PLN-0320), compatibility shim (PLN-0321), decision-driven follow-ups (PLN-0322 custody migration, PLN-0323 Formspec native emission, PLN-0324 T4 alignment, PLN-0325 shared coercion library, PLN-0329 claims-map paragraph, PLN-0330 anchor-stability gate).
PLN-0358..0364 — content-addressing sub-cluster (ADR 0081 ratification + downstream propagation): JCS-then-SHA-256 hash binding for definition-class artifacts. Pins the workflow definitions the consolidated schema family describes. PLN-0358 (ADR 0081 ratification), PLN-0359 (three-segment *Ref syntax), PLN-0360 (Trellis custody integration), PLN-0361 (shared JCS canonicalization library), PLN-0362 (definitionContentHash provenance field), PLN-0363 (WOS-CONTENT-HASH-001 lint), PLN-0364 (conformance fixtures).

Entry-point ADRs:

ADR 0076 (product-tier consolidation) — schema family, embedded blocks, version marker, spec-non-merge decision; closes Q1–Q4 + Q11 in Decisions made.
ADR 0080 (governed output-commit pipeline) — six-surface pipeline shape, shared coercion, quarantine precedence; closes Q5–Q7.
ADR 0079 (Formspec native IntakeHandoff emission) — cross-spec rule that delivers Forms+ tier; defines targetWorkflow declaration in Formspec.

Related invariants (no rewrites in this cluster, but cited throughout):

ADR 0075 (rejection register) — 12 invariants (I-1..I-12), 15 rejection rows.
ADR 0077 (canonical kernel extension seams) — six canonical seams.
ADR 0078 (foreach topology) — fifth state.type kind.

Reference workflows (in submodule wos-spec/):

wos-spec/examples/timeoff.workflow.json — Forms+ tier (~30 lines, no embedded blocks beyond spine).
wos-spec/examples/nda.workflow.json — DocuSign tier (~85 lines, embedded signature load-bearing).
wos-spec/examples/benefits-adjudication.workflow.json — case-management tier (~600 lines, every embedded block populated).

Branch: workflow-consolidation (replaces previous kernel-restructure). Submodule note: wos-spec/ is a submodule; schema sketch + examples + wos-spec/CLAUDE.md updates committed there (439d494); ADR rewrites + PLANNING.md updates committed in parent (d9b6e59b, e43f8518).

Cluster prioritization under (Importance + User Value) × Future Tech Debt — the column-level Imp×Debt P0/P1/P2 marker is the coarse priority; within the cluster's 36 P0s, the four tiers below sharpen ordering. Within each tier, dependency ordering still applies (named below).

Tier 1 — Critical path (TOP score; all three axes HIGH). Lead with these; everything else compounds without them.

PLN-0314 — promote wos-workflow.schema.json from sketch to full normative schema. Gates every downstream code change; sketch debt compounds.
PLN-0323 — Formspec native IntakeHandoff emission per ADR 0079. The Forms+ tier "~30 lines" promise is gated here; deferral leaves Forms+ aspirational and every Forms+ workflow author writing explicit envelope wiring is undoable debt.
PLN-0317 — register WOS-AGENT-XREF-001 (every actor with type=='agent' has matching agents[].id) + WOS-SIG-COVER-001 (signature-gated transitions covered by signature.signers[]). Cross-reference rules are beyond JSON Schema expressivity; without these, every workflow shipped that violates them adds linearly to a future support burden.

Tier 2 — High priority (HIGH score; gates Tier 1 quality or large downstream work).

PLN-0330 (P1) — anchor-stability CI gate. MUST land before PLN-0176..0207 begins; otherwise §-numbering drift breaks every external "Kernel §10.3"-style citation that Q1's specs-don't-physically-merge decision was designed to preserve.
PLN-0325 — shared fel-core::coerce library across all six output-commit surfaces. This is the bug class consolidation prevents; per-surface coercion drift compounds with every new surface and is harder to pull apart later.
PLN-0322 — custody from sidecar to embedded custody block; delete wos-custody-hook-encoding.schema.json. Closes Q4 decision; standalone schema is dead weight if not migrated now.
PLN-0176..0207 — kernel/spec.md + governance/spec.md + ai/ai-integration.md + advanced/spec.md absorb Companions + Lifecycle Detail + Integration Profile content. §-numbering preserved. Gated by PLN-0330.

Tier 3 — Medium priority (MEDIUM score; landing improves the system but deferral is bounded).

PLN-0316 (delivery sidecar merge), PLN-0318 (provenance schema rename + relocate), PLN-0319 (tooling consolidation) — schema family cleanup.
PLN-0320 (validate three reference examples against full schema; depends on PLN-0314), PLN-0328 (P1 — tooling-schema $views; depends on PLN-0319).
PLN-0324 (T4 conformance suite alignment), PLN-0329 (RELEASE-STREAMS.md claims-map paragraph).
PLN-0326 (WOS-QUARANTINE-PRECEDENCE-001 lint), PLN-0327 (WOS-VER-LEVEL-002 lint) — decision-driven lints; lower future-debt than Tier 1's cross-reference lints because they catch policy choices, not invariant violations.
PLN-0213..0218 (P2 — wos-spec/CLAUDE.md / README.md / COMPATIBILITY-MATRIX.md sweep).

Tier 4 — Low priority / reconsider.

PLN-0321 (compatibility shim for old document markers) — per the "Nothing is released" memory, no production users running old markers, so the shim has no actual users to support. Reclassify as Trigger ("Land if a real migration target appears") or close. Currently P0 in the row; this prioritization downgrades it pending owner confirmation.

Critical path: Tier 1 in parallel (PLN-0314 / PLN-0323 / PLN-0317 are independent). Tier 2 gates Tier 3 in places (PLN-0330 → PLN-0176..0207; PLN-0314 → PLN-0320). The Forms+ tier "~30 lines" promise is gated by PLN-0323 alone; any deferral leaves Forms+ aspirational.

MVP foundation cluster (owner-decided 2026-04-27). Smallest architecturally-correct base that ships PROD-MVP for the dual-adopter posture (single-tenant SBA-pilot deployment + multi-tenant public-SaaS deployment — VISION.md §II Q1; configuration + trust posture + isolation topology are the three orthogonal architectural axes per VISION §IV (isolation topology was the "tenancy" axis under prior framing); customer wedges (per STACK §Positioning lead wedge: mid-market regulated CTO with active AI audit finding) sit on top of the matrix) and supports immediate feature work afterward.

Stack-wide rollup: TODO-STACK.md carries the cross-spec coordination view. Execution home for adapter cluster: wos-spec/crates/wos-server/TODO.md WS-084..094 + Phase 1–6 dependency-ordered sequence. PLANNING.md rows below are coordination handles citing wos-server WS-* IDs in the Source pointer column; dependency ordering and execution detail live in wos-server/TODO.md.

PLANNING.md surface for this cluster:

PLN-0331..0341 + PLN-0345 + PLN-0365..0367 — wos-server crate cluster coordination handles. Each row points at its wos-server WS-execution home (where one exists). Adapters without a current WS- counterpart (authz-openfga, identity-{webauthn,oidc}, kms-cloud, processing-audited, blobstore-s3, CRYPTO_OWNER fence) flag the gap — wos-server author to add the WS-* row when the adapter sequence reaches it. PLN-0365/0366 are the single-tenant + multi-tenant OpenFGA policy bundles consumed by PLN-0334 (authz-openfga adapter); PLN-0367 is the per-posture × per-tenancy Cargo feature bundle composition consumed by PLN-0339 (composition root).
PLN-0342..0344 — Formspec spec opt-in stubs (accessControl item property, Privacy Profile sidecar minimum shape, Access-Class Registry minimum shape) per ADR-0074 §1, §3, §10. Source-of-truth is parent ADR-0074; execution home is parent schemas/, specs/privacy/, specs/registry/.
PLN-0346 — Dual-adopter coherence guarantee (flat Response default; bucketed Response opt-in via Profile presence; conformance fixture proves empty Profile equivalent to no Profile).
PLN-0368..0370 — Architectural-decision rows surfaced by reviews: cross-submodule Cargo path-dep resolution (PLN-0368), per-tenant DB scaling decision (PLN-0369), marketing-claim reframe (PLN-0370).

Stack closure cluster (synthesis-merge 2026-04-27). VISION/STACK absorbed the 2026-04-27 brainstorm synthesis (archived at thoughts/archive/specs/2026-04-27-architecture-synthesis-corrected.md). Closes 4 of 14 VISION §V center commitments via existing rows (statutory clocks, amendment, failure, migration pin); 9 gaps + 1 misalignment surfaced as PLN-0379..0398:

PLN-0379..0385 — open-contract closure work: Trellis ADR 0010 user-content Attestation primitive (PLN-0379), WOS Signature Profile §1.3 scope reopen + URI registry + signer-authority claim (PLN-0380), identity attestation stack ADR (PLN-0381; supersedes PLN-0310), external recipient lifecycle stack ADR (PLN-0382), AEAD nonce determinism Trellis Core §9.4 amendment (PLN-0383), WOS event-type taxonomy ratification (PLN-0384), custody-hook-encoding.md companion v1.0 status (PLN-0385).
PLN-0386..0389 — engineering scaffolds: formspec-server reference backend cluster (PLN-0386), wos-server-eventstore-embedded sibling adapter (PLN-0387), agent-sdk peer crate + CRYPTO_OWNER fence extension (PLN-0388), three-app frontend split ADR (PLN-0389).
PLN-0390..0391 — drift-prevention guards: Respondent Ledger §10 cross-plane referential integrity (PLN-0390), IntakeHandoff transport-orthogonal guard (PLN-0391).
PLN-0392..0398 — profile-specific extensions and procurement-blocking triggers: tenant-scope Trellis export shape (PLN-0392), WCAG 2.2 AA + VPAT per app (PLN-0393), SOC 2 controls inventory (PLN-0394, precursor to PLN-0356), pricing model (PLN-0395), subprocessor list (PLN-0396), incident response and breach-notification commitments (PLN-0397), DocuSign 100% admin surface (PLN-0398).
Existing-row amendments: PLN-0367 (two-axis → three-axis bundles), PLN-0369 (axis renamed "isolation topology"), PLN-0370 (DocuSign reframe link to PLN-0380 + PLN-0398). PLN-0310 closed-by-supersession (PLN-0381 carries the work).
Cross-cluster composition: PLN-0381 (identity attestation contract) is the spec MVP-cluster identity adapters PLN-0335 (identity-webauthn for respondents) + PLN-0336 (identity-oidc for staff) render. The contract lands first; adapter rendering follows.

Critical path:

Batch 1 (parallel; unblock downstream): PLN-0384 (event taxonomy ratification — highest leverage; gates wos.signing.* / wos.identity.* / wos.governance.access-* namespace citations downstream), PLN-0379 (Trellis ADR 0010), PLN-0386 (formspec-server cluster scaffold), PLN-0383 (AEAD nonce determinism — independent gap, land while taxonomy settles), PLN-0385 (custody-hook-encoding.md companion v1.0).
Batch 2 (after Batch 1): PLN-0380 (signature.md extensions), PLN-0381 (identity attestation ADR; closes PLN-0310), PLN-0382 (external-recipient lifecycle ADR).
Batch 3 (engineering cascade after Batch 2): PLN-0387 (embedded EventStore), PLN-0388 (agent-sdk + fence), PLN-0389 (three-app frontend split), PLN-0390 (RL §10 cross-plane), PLN-0391 (IntakeHandoff transport-orthogonal lint).
Triggers (PLN-0392..0398): activate per stated conditions.

Operating lean (inline, decision-register convention). Bucketed Response wire shape and Phase-5 emission projector are deferred to Trigger (activate: SBA security review demands per-class encryption OR Federal RFP arrives; abandon: SBA pilot accepts flat Response + audited decryption AND no Federal RFP by 2027-04). The spec authority for accessControl + Privacy Profile + Access-Class Registry lands now (cheap, opt-in); the runtime cost is paid only when adopter pull justifies migration commitment. PLN-0346 defends the lean.

Cross-cluster gates:

Shares fence-policy editorial bottleneck with workflow-consolidation cluster (Rust workspace dep-fence in wos-spec/scripts/, npm fence in parent scripts/check-dep-fences.mjs).
PLN-0323 (Formspec native IntakeHandoff emission per ADR 0079 in workflow-consolidation cluster) carries Response payload; if bucketed Response Trigger activates before PLN-0323 freezes, IntakeHandoff emission rule must accommodate both flat and bucketed shapes. Currently MVP ships flat-only; Trigger activation is a future migration event.

Explicitly deferred to Trigger or future cluster:

All bucketed Response wire impl + Phase-5 projector (Trigger; conditions above).
Other wos-server adapters not in MVP: sqlite, blobstore-{azure,gcs,fs}, authz-{spicedb,mock}, identity-mock, kms-{vault,local}, processing-{tee,fhe,mpc}, otel, trellis-export. (Most have WS-* in wos-server/TODO.md as Trigger or follow-on; PLANNING.md doesn't enumerate.)
Four wos-server-specific invariant tests (Privacy Profile rebuild; deontic prohibition post-wrap; KMS unavailability; TEE attestation mid-batch). Defer to post-MVP hardening.
Lint rules (flClassCompatibility, every-field-classified, lawfulBasis-not-per-recipient, Mapping reclassification). Defer until Privacy Profile sees real authoring use.
Recipient-revocation event taxonomy — now active under stack closure cluster: PLN-0384 authors wos-spec/specs/audit/wos-event-types.md; PLN-0382 ratifies wos.governance.access-granted / access-revoked events.
ADR-0074 sub-ADR splits (Privacy Profile and Access-Class Registry as separate normative ADRs). Known cardinality-mismatch debt; revisit when sub-spec authoring effort surfaces.
Procurement-narrative drift to STACK.md; public-SaaS infra rows (billing, multi-tenant onboarding, SaaS-tier admin OIDC).
Confidential-compute adapter sequencing — see PLN-0357 Trigger row.
ATO / FedRAMP / contracting / ESIGN / SOC 2 prerequisites — see PLN-0350..0356 Triggers (adopter-pull-activated; abandon-conditions stated per row).

Active Spec/ADR Questions

ID	Imp×Debt	Status	Owner/layer	Question / semantic decision	Depends on	Source ADR	Source pointer	Evidence required for done
PLN-0004	P0	Open	Stack, ADR/spec	Decide the canonical tenant identifier grammar so every Formspec/WOS/Trellis artifact validates and routes tenant scope the same way.	Update the source ADR/spec before or with implementation.	ADR 0068	ADR 0068 Open Question #1. Merged duplicate row: PLN-0090.	ADR 0068 records one tenant identifier grammar; schemas and runtime validators reject malformed tenant values.
PLN-0005	P0	Open	Stack, CI, ADR/spec	Decide whether `payload.tenant` or a TypeID prefix is the authoritative tenant source, and define hard-fail behavior when both appear and disagree.	Update the source ADR/spec before or with implementation.	ADR 0068	ADR 0068 D-1/D-4 (proposed clarification).	ADR 0068 states the tenant authority rule; schemas/runtime tests prove tenant mismatch fails closed.
PLN-0011	P0	Open	Stack, CI, ADR/spec	Lead value: the records clerk in 2031 looking up "case #12345" knows whether that number is unique across the whole stack or scoped per tenant. Pick wrong and storage shelves, APIs, and verifiers each look in different places for the same case. Detail: decide whether case IDs are globally unique in practice or normatively scoped by `(tenant, ledger)`.	Update the source ADR/spec before or with implementation.	ADR 0068, ADR 0061	ADR 0068 D-4 + ADR 0061 TypeID posture. Merged duplicate row: PLN-0093.	ADR text states the case ID scope rule; storage/API/verifier keys follow the same rule.
PLN-0012	P0	Open	Trellis, CI, ADR/spec	Decide supersession scope-bundle carry-forward semantics: which tenant/scope/ledger fields stay fixed, which fields rebind, and which validators enforce the tuple.	Update the source ADR/spec before or with implementation.	ADR 0068, ADR 0066	ADR 0068 Open Question #3 + ADR 0066 linkage. Merged duplicate row: PLN-0092.	ADR 0068/0066 state the supersession tuple rule; validators reject invalid carry-forward or rebind combinations.
PLN-0013	P0	Open	Stack, ADR/spec	Decide the actor-across-tenants identity model: one global identity with per-tenant authority, or mapped per-tenant identities with explicit proofing boundaries.	Update the source ADR/spec before or with implementation.	ADR 0068	ADR 0068 D-3 + Open Question #2. Merged duplicate row: PLN-0091.	ADR 0068 states the actor identity model and proves grants do not transfer across tenants.
PLN-0015	P0	Open	Stack, ADR/spec	Resolve the ADR 0068 vs ADR 0071 conflict by separating immutable case identity (`tenant` + stable scope identity) from mutable version pins governed by `MigrationPinChanged`.	Update the source ADR/spec before or with implementation.	ADR 0068, ADR 0071	ADR 0068 D-2 + ADR 0071 D-4. Merged rubric-check row: PLN-0094.	Both ADRs use the same identity/pin split; no text implies migration pins mutate immutable tenant/scope identity.
PLN-0019	P0	Open	CI, ADR/spec	Choose the authoritative wire home for `CaseOpenPin` so the first anchored ledger event, canonical response, and other surfaces are projections of one source.	Update the source ADR/spec before or with implementation.	ADR 0071	ADR 0071 implementation plan + Open Question #1.	ADR 0071 names the authoritative `CaseOpenPin` wire location; all other surfaces are documented projections and conformance fixtures assert consistency.
PLN-0022	P0	Open	WOS, Trellis, Stack, ADR/spec	Clarify WOS `instanceVersioning` as a projection or implementation surface of stack-level cross-layer pinning, not a second authoritative version contract.	Update the source ADR/spec before or with implementation.	ADR 0071	ADR 0071 D-1/D-2 (integration clarification).	WOS and stack docs point to one version/pin contract; no WOS field can bypass `CaseOpenPin` or `MigrationPinChanged` governance.
PLN-0035	P0	Open	WOS, Trellis, Stack, CI, ADR/spec	Lead value: when the system fails to write to the audit log, every team — runtime, ledger, auditor — agrees on whether the write actually happened. The operator sees one truthful "stalled, please recover" instead of three contradictory status pages. Detail: settle the ADR 0070 failure contract — Trellis local append receipt (`canonical_event_hash`) is the commit point, `stalled` is the operator-visible recovery state, `CommitAttemptFailure` is Facts-tier evidence, runtime saga compensation is removed or scoped as non-governance recovery.	Update the source ADR/spec before or with implementation.	ADR 0070, ADR 0066	ADR 0070 D-1..D-6 + implementation plan. Merged duplicate row: PLN-0099.	Stack/WOS/Trellis docs, runtime behavior, and shared fixtures all express the same failure contract; no artifact implies a second commit boundary or governance saga rollback.
PLN-0042	P0	Open	CI, ADR/spec	Define the default recovery posture after append failure: explicit operator recovery vs automatic retry/recovery, with `stalled` modeled as the operator-visible lifecycle state.	Update the source ADR/spec before or with implementation.	ADR 0070	ADR 0070 Open Question #2 + D-4. Merged related row: PLN-0101.	Runtime config/docs state the default recovery path; workflows that can stall expose an operator-accessible recovery transition.
PLN-0043	P0	Open	Stack, CI, ADR/spec	Specify minimum tenant isolation guarantees for append-path outages so "cross-tenant failure isolation" is either normative or explicitly deployment-conditional.	Update the source ADR/spec before or with implementation.	ADR 0070, ADR 0068	ADR 0070 Open Question #3 + ADR 0068.	ADR/tracker text records the decision, removes conflicting language, and names execution evidence.
PLN-0047	P0	Open	WOS, CI, ADR/spec	Lead value: silent provenance drift — ADR 0070 D-5 declares no runtime saga compensation, but the existing WOS compensation surface (`compensable`, `compensatingAction`, compensation logs, `$compensation.complete`) still emits as if reversal were a governance act. Until one wins, the same case can produce two contradictory provenance shapes for the same reversal, and audit replay has no rule to pick between them. Detail: reconcile ADR 0070 D-5 ("no runtime saga compensation") with existing WOS compensation surface (`compensable`, `compensatingAction`, compensation logs, `$compensation.complete`) — deprecate the runtime constructs OR explicitly scope them as non-governance operational semantics.	Update ADR/WOS source text before or with the schema/runtime change.	ADR 0070, ADR 0066	ADR 0070 D-5 + current WOS model/schema. Merged duplicate row: PLN-0103.	ADR/WOS text either deprecates runtime compensation constructs or scopes them as non-governance operational recovery without contradicting ADR 0070.
PLN-0073	P0	Open	CI, ADR/spec	Lead value: the 2045 auditor reading a 2026 timestamp gets the same answer for "when did this happen?" as the 2026 caseworker did. Without one rule, three different systems write three different timestamps for the same moment, and the audit chain breaks. Detail: settle the ADR 0069 time contract — UTC wire format, precision classes, timestamp ordering, leap-second parsing, clock-source attestation, FEL timezone determinism.	Update the source ADR/spec before or with implementation.	ADR 0069	ADR 0069 status + implementation planning.	ADR 0069, schemas, parsers, and fixtures enforce the same time contract across Formspec/WOS/Trellis; no row remains whose only work is status promotion.
PLN-0104	P0	Open	CI, ADR/spec	Resolve ADR 0066 rescission semantics: whether rescission is terminal with no amendment-after-rescission, or whether rescission-of-rescission is modeled as an amendment.	Update the source ADR/spec before or with implementation.	ADR 0066	ADR 0066 D-3 + Open Question #1 (premise review).	ADR 0066 D-3 and Open Question #1 no longer conflict; verifier tests enforce the chosen terminality or reversal model.
PLN-0106	P0	Open	CI, ADR/spec	Decide whether rejected amendment/correction/rescission attempts are intentionally unrecorded or produce constrained denial records for due-process traceability.	Update the source ADR/spec before or with implementation.	ADR 0066	ADR 0066 D-5 + premise review.	ADR 0066 and ADR 0070 agree on rejected-governance auditability; fixtures prove rejected effects are not applied and any denial record follows the chosen rule.
PLN-0114	P0	Open	CI, ADR/spec	Decide whether ADR 0069 millisecond-minimum precision applies to all wire timestamps or only ordering-sensitive/clock-bearing timestamp profiles.	Update the source ADR/spec before or with implementation.	ADR 0069	ADR 0069 D-2 rationale + premise review.	ADR 0069 precision policy names affected field classes; fixtures prove accepted/rejected precision for each class.
PLN-0115	P0	Open	CI, ADR/spec	Decide leap-second policy: normative UTC-SLS behavior vs lexical rejection/parser-safe normalization for `23:59:60`.	Update the source ADR/spec before or with implementation.	ADR 0069	ADR 0069 D-4 + premise review. Merged duplicate row: PLN-0078.	ADR 0069 states the leap-second rule; parser/verifier tests prove deterministic behavior for `23:59:60` and day-boundary cases.
PLN-0117	P0	Open	Formspec, CI, ADR/spec	Decide FEL timezone rollout: immediate hard-fail for `today()`/`now()` without explicit timezone context vs staged lint/warn/policy-gate enforcement.	Update the source ADR/spec before or with implementation.	ADR 0069	ADR 0069 D-6 + consequences + premise review.	ADR 0069 names the rollout path; FEL tests prove deterministic multi-timezone replay and the chosen migration behavior.
PLN-0150	P0	Open	WOS, Trellis, CI, ADR/spec	Lead value: when a statute says "you have 30 days to file an appeal," the form, the workflow engine, and the audit ledger all count those 30 days the same way. The applicant doesn't lose her appeal rights because two systems disagreed on day 30. Detail: settle the cross-layer statutory-clock contract — Formspec emits statute-trigger evidence; WOS emits and resolves operational clock records; Trellis exports/verifies open-clock state — without adapter-specific reinterpretation.	Update the source ADR/spec before or with implementation.	ADR 0067	ADR 0067 status + WOS/Trellis TODO gate notes.	ADR 0067, WOS/Trellis/Formspec TODOs, schemas, and fixtures point to one clock contract; implementation rows can proceed without a separate status ceremony.
PLN-0153	P0	Open	WOS, ADR/spec	Define the `Clock` wire shape and payload fields (`clock_kind`, `duration`, `calendar_ref`, `statute_reference`, `computed_deadline`, resolution fields, origin hash linkage, `x-*` posture) so clock evidence is portable and verifier-readable.	Update the source ADR/spec before or with schema/runtime work.	ADR 0067	ADR 0067 D-1 + implementation plan.	ADR 0067 and schema agree on the `Clock` shape; WOS/Trellis/Formspec fixtures exchange the same payload without adapter-specific reinterpretation; v1 clock-kind boundaries/non-goals and `x-*` extension criteria are explicit.
PLN-0166	P0	Open	CI, ADR/spec	Resolve timestamp granularity for statutory-clock envelope fields by aligning ADR 0067 clock precision with ADR 0069 timestamp profiles.	Update the source ADR/spec before or with implementation.	ADR 0067, ADR 0069	ADR 0067 Open Question #1 + ADR 0069 linkage. Split from umbrella row PLN-0151.	ADR 0067 and ADR 0069 share one precision rule for statutory/SLA clocks; fixtures prove accepted and rejected precision cases.
PLN-0167	P0	Open	Trellis, CI, ADR/spec	Decide post-hoc elapsed clock closure: auto-emit synthetic `ClockResolved(elapsed)` at next authoritative touch, or allow permanently open clocks with verifier advisory only.	Update the source ADR/spec before or with implementation.	ADR 0067	ADR 0067 Open Question #2. Split from umbrella row PLN-0151.	ADR 0067 states whether expired unresolved clocks auto-close on next authoritative touch or remain open with verifier advisory.
PLN-0168	P0	Open	CI, ADR/spec	Decide multi-jurisdiction same-trigger behavior: emit parallel clocks for all governing jurisdictions, or require one governing jurisdiction at case open.	Update the source ADR/spec before or with implementation.	ADR 0067	ADR 0067 Open Question #3. Split from umbrella row PLN-0151.	ADR 0067 states whether one trigger emits parallel jurisdictional clocks or requires one governing jurisdiction at case open.
PLN-0170	P0	Open	Trellis, CI, ADR/spec	Decide whether expired-unresolved clock diagnostics remain advisory globally or may escalate by profile/policy for rights-impacting workflows.	Update the source ADR/spec before or with implementation.	ADR 0067	ADR 0067 D-3 + premise review uncertainty.	ADR 0067 states the base severity and any profile escalation rule; verifier tests prove severity under baseline and stricter profile settings.
PLN-0064	P1	Open	Trellis, CI, ADR/spec	Decide whether verifier plaintext re-hash remains baseline `SHOULD` or becomes profile-level `MUST` for defined assurance classes.	Update the source ADR/spec before or with implementation.	ADR 0072	ADR 0072 D-6 + premise review hardening.	ADR 0072/profile text states verifier strictness tiers; fixtures distinguish readable plaintext, unavailable plaintext, and profile-required re-hash cases.
PLN-0095	P1	Open	CI, ADR/spec	Decide `CaseOpenPin` wire encoding: inline pin object vs registry URI reference, so validators and portable bundles know what must be present offline.	Update the source ADR/spec before or with implementation.	ADR 0071	ADR 0071 Open Question #1.	ADR 0071 fixes the pin representation; schema and verifier fixtures accept the chosen form and reject the other unless explicitly profiled.
PLN-0096	P1	Open	CI, ADR/spec	Decide historical semantics distribution: embed required semantic libraries in replay/export bundles or resolve them through a runtime registry lookup.	Update the source ADR/spec before or with implementation.	ADR 0071	ADR 0071 Open Question #2.	ADR 0071 states how historical semantics remain available for deterministic replay; verifier tests prove offline or registry-backed behavior as chosen.
PLN-0097	P1	Open	Trellis, CI, ADR/spec	Decide the default `CaseOpenPin` behavior for ADR 0066 supersession: inherit predecessor pins, start fresh pins, or require an explicit choice.	Update the source ADR/spec before or with implementation.	ADR 0071, ADR 0066	ADR 0071 Open Question #3 + ADR 0066.	ADR 0071/0066 state the supersession pin default; fixtures cover inherited, fresh, and invalid implicit pin transitions.
PLN-0098	P1	Open	CI, Conformance, ADR/spec	Decide conformance-class downgrade policy when a case pin is narrower than runtime capability, so newer runtimes cannot silently replay under broader semantics.	Update the source ADR/spec before or with implementation.	ADR 0071	ADR 0071 Open Question #4.	ADR 0071 states downgrade/compatibility behavior; conformance tests prove pinned cases replay under archived semantics despite broader runtime capability.
PLN-0110	P1	Open	CI, ADR/spec	Decide anonymous `publicIntake` default posture: allow pending-case creation before identity proofing, or require identity-first gating.	Update the source ADR/spec before or with implementation.	ADR 0073	ADR 0073 Open Question #1.	ADR 0073/profile policy states the default; fixtures prove accepted and rejected public-intake flows under that policy.
PLN-0113	P1	Open	CI, ADR/spec	Decide the mandatory `publicIntake` acceptance floor so deployments cannot weaken portable intake semantics through profile-specific omissions.	Update the source ADR/spec before or with implementation.	ADR 0073	ADR 0073 D-7 + premise review.	ADR 0073 lists mandatory acceptance checks; shared fixtures fail when a deployment omits those checks.
PLN-0125	P1	Open	ADR/spec	Publish the `MigrationPinChanged` transition matrix: allowed/forbidden upgrades, downgrades, rollback semantics, and required authorizations.	Update the source ADR/spec before or with implementation.	ADR 0071	ADR 0071 D-4 + Open Questions (proposed hardening).	ADR 0071 publishes an allowed/forbidden transition matrix; tests cover upgrade, downgrade, rollback, and missing-authorization cases.
PLN-0131	P1	Open	Trellis, ADR/spec	Clarify timestamp-order verifier failure class so temporal-order violations do not ambiguously overlap with hash/signature integrity failures.	Update the source ADR/spec before or with implementation.	ADR 0069	ADR 0069 D-3 + premise review hardening. Merged duplicate row: PLN-0116.	Verifier reporting classifies timestamp-order violations separately from hash/signature integrity failures.
PLN-0134	P1	Open	Conformance, ADR/spec	Define clock-source attestation tiers: optional baseline, required for rights-impacting clocks, and stricter profile-level requirements.	Update the source ADR/spec before or with implementation.	ADR 0069	ADR 0069 D-5 + Open Question #1 + premise review hardening. Merged duplicate rows: PLN-0079, PLN-0118.	Clock-source attestation tiers state baseline optionality and the profiles/assurance classes where attestation is required.
PLN-0342	P0	Open	Formspec, ADR/spec	Decide minimum-shape `accessControl` normative item property on Formspec Definition `field` and `group` items: nested `{ class, audience?, lawfulBasis?, cardinalityRationale? }` per ADR-0074 §1, with `display` items rejected at lint time. MVP ships the schema add only; full lint surface (`every-field-classified`, `lawfulBasis`-not-per-recipient, etc.) deferred.	No unresolved dependency named.	ADR-0074	ADR-0074 §1 + §12 (schema-omitted vs explicit `unclassified` distinction).	`schemas/definition.schema.json` accepts `accessControl` on `field`/`group` items with the four nested keys; rejects on `display` items; existing definitions without `accessControl` validate unchanged (opt-in).
PLN-0343	P0	Open	Formspec, ADR/spec	Author Privacy Profile sidecar minimum shape at `specs/privacy/privacy-profile.md`: audience lists per class, `lawfulBasis` declarations (per-class only), `flClassCompatibility` declarations (deferred to MVP), class overrides. Empty Profile is conformant per PLN-0345. SaaS deploys without a Profile; SBA deploys with one when security review demands.	No unresolved dependency named; PLN-0344 may inform registered class names but does not gate Profile shape.	ADR-0074	ADR-0074 §3 (Privacy Profile sidecar) + §5 (audience-subset sensitivity ordering).	`specs/privacy/privacy-profile.md` exists with a minimum normative schema; example empty Profile validates; example SBA Profile (single class with audience list) validates; conformance fixture proves no-Profile deployment behaves identically to pre-version-bump Formspec.
PLN-0344	P0	Open	Formspec, ADR/spec	Author Access-Class Registry minimum shape at `specs/registry/access-class-registry.md`: registered namespaces (`wos.`, `hipaa.`, `ferpa.`, `itar.`), opaque-class-token rule, registry-tier infrastructure framing. Class tokens are opaque to Core; presence of a token activates routing only.	No unresolved dependency named.	ADR-0074	ADR-0074 §10 (Access-Class Registry companion) + §1 (class names opaque to Core).	`specs/registry/access-class-registry.md` exists with namespace registration rules; pre-allocated `wos.`/`hipaa.`/`ferpa.`/`itar.` namespaces named; example class tokens in each namespace validate; cross-class FEL rule wired (deferred lint will fire).

Outstanding Implementation Tasks

ID	Imp×Debt	Status	Owner/layer	Work item	Depends on	Source ADR	Source pointer	Evidence required for done
PLN-0001	P0	Open	Formspec, Stack	Require top-level `tenant` in Formspec artifacts (`respondent-ledger`, canonical response, intake handoff if in scope).	No unresolved dependency named.	ADR 0068	ADR 0068 D-1 + implementation plan.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0002	P0	Open	Trellis, Stack	Add required `tenant` to Trellis envelope header and bundle-level export metadata.	No unresolved dependency named.	ADR 0068	ADR 0068 implementation plan.	Exporter/verifier output proves the path, including required negative/tamper case.
PLN-0003	P0	Open	WOS, Stack	Add required `tenant: String` to WOS `CaseInstance` and persistence model.	No unresolved dependency named.	ADR 0068	ADR 0068 implementation plan.	Runtime/API path implements contract and passes integration fixtures.
PLN-0006	P0	Open	WOS, Stack	Thread tenant context through the entire `DurableRuntime` API surface and all implementations/callers.	No unresolved dependency named.	ADR 0068	ADR 0068 implementation plan.	Runtime/API path implements contract and passes integration fixtures.
PLN-0007	P0	Open	Stack	Enforce runtime rejection for cross-tenant reads/writes and tenant-mismatch submissions.	No unresolved dependency named.	ADR 0068	ADR 0068 D-1 + implementation plan.	Runtime/API path implements contract and passes integration fixtures.
PLN-0009	P0	Open	Trellis, Stack	Define verifier refusal behavior when expected tenant scope does not match chain/bundle tenant.	No unresolved dependency named.	ADR 0068	ADR 0068 implementation plan.	Exporter/verifier output proves the path, including required negative/tamper case.
PLN-0018	P0	Open	CI	Define and freeze canonical `CaseOpenPin` shape (all six dimensions), nullability rules, and per-dimension version-string constraints.	No unresolved dependency named.	ADR 0071	ADR 0071 D-1.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0021	P0	Open	WOS, Trellis	Add WOS `MigrationPinChanged` shape/kind and runtime acceptance path (`CaseInstance::create` with `pin`, then context propagation).	No unresolved dependency named.	ADR 0071	ADR 0071 D-4 + implementation plan.	Runtime/API path implements contract and passes integration fixtures.
PLN-0023	P0	Open	Trellis	Add Trellis envelope/verifier obligations: required initial `pin`, pin immutability unless `MigrationPinChanged` anchors a transition, phase-lineage compatibility across prior envelope phases.	No unresolved dependency named.	ADR 0071	ADR 0071 D-2/D-3/D-4 + implementation plan.	Exporter/verifier output proves the path, including required negative/tamper case.
PLN-0038	P0	Open	WOS	Add `stalled` to WOS reserved lifecycle/status vocabulary and add `stalled_since` to `CaseInstance`.	No unresolved dependency named.	ADR 0070	ADR 0070 implementation plan.	Runtime/API path implements contract and passes integration fixtures.
PLN-0039	P0	Open	WOS, Trellis	Extend `DurableRuntime` custody append contract with typed outcomes for retryable, budget-exhausted, and terminal failures.	No unresolved dependency named.	ADR 0070	ADR 0070 implementation plan (`append_to_custody` typed error requirement).	Runtime/API path implements contract and passes integration fixtures.
PLN-0040	P0	Open	Runtime Reliability, Retry, and Stalled Recovery (ADR 0070)	Implement bounded retry with ADR-0061 idempotency tuple `(caseId, recordId)` and guarantee single canonical commit on eventual success.	No unresolved dependency named.	ADR 0061, ADR 0070	ADR 0070 D-4 + ADR 0061.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0041	P0	Open	CI	On retry-budget exhaustion, transition to `stalled`, emit operator-facing telemetry, and require explicit recovery path.	No unresolved dependency named.	ADR 0070	ADR 0070 D-4 + implementation plan.	Automated gate exists and fails on the named regression.
PLN-0044	P0	Open	Trellis	Add `ProvenanceKind::CommitAttemptFailure` (Facts tier) with schema and runtime emitters.	No unresolved dependency named.	ADR 0070	ADR 0070 D-6 + implementation plan.	Schema/prose updated; generated docs/checks pass.
PLN-0045	P0	Open	Trellis	Wire Trellis verifier reporting for `CommitAttemptFailure` and add optional `failures.json` export summary.	No unresolved dependency named.	ADR 0070	ADR 0070 implementation plan.	Exporter/verifier output proves the path, including required negative/tamper case.
PLN-0050	P0	Open	Formspec, Trellis, CI	Add Formspec Respondent Ledger `ResponseCorrection` event shape with prior-event hash linkage (`ResponseSubmitted.canonical_event_hash`) and strict declared-subset correction semantics.	No unresolved dependency named.	ADR 0066	ADR 0066 D-1 + implementation plan (Formspec).	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0051	P0	Open	Formspec, Trellis, CI	Add supersession-start linkage shape for the superseding respondent ledger (`supersedes_chain: { chain_id, checkpoint_hash }`) and assert no in-place mutation semantics.	No unresolved dependency named.	ADR 0066	ADR 0066 D-1 (Supersession) + Context premise.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0052	P0	Open	WOS, CI, Conformance	Add WOS provenance and schema support for all six ADR 0066 kinds: `CorrectionAuthorized`, `AmendmentAuthorized`, `DeterminationAmended`, `RescissionAuthorized`, `DeterminationRescinded`, and `AuthorizationAttestation`.	No unresolved dependency named.	ADR 0066	ADR 0066 Consequences + implementation plan (WOS).	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0053	P0	Open	WOS, CI	Add WOS Workflow Governance policy surfaces for revisit authorization (`amendmentPolicy`, `rescissionPolicy`, and corresponding mode gates) and enforce assurance-floor policy for rights-impacting cases.	No unresolved dependency named.	ADR 0066	ADR 0066 D-2 + implementation plan (WOS).	Automated gate exists and fails on the named regression.
PLN-0055	P0	Open	Trellis, CI, Conformance	Complete Trellis Phase-1 ADR 0066 scope: register `supersedes_chain_id` in Core §6.7 (row absent at Trellis HEAD today), land vectors `append/011-correction`, `append/012-amendment`, `append/013-rescission`, and add verifier checks for correction-preservation + rescission-terminality.	No unresolved dependency named.	ADR 0066	ADR 0066 D-3 + implementation plan (Trellis) + `trellis/TODO.md` item #10 (ADR 0066 execution).	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0056	P0	Open	Trellis, CI	Complete Trellis Phase-4 ADR 0066 scope: activate supersession runtime, specify/emit `supersession-graph.json`, add chain-linkage verification against predecessor checkpoint hash, and enforce cycle detection.	No unresolved dependency named.	ADR 0066	ADR 0066 D-3/D-4 + implementation plan (Trellis).	Automated gate exists and fails on the named regression.
PLN-0075	P0	Open	CI	Pin canonical UTC wire rules (D-1) in all outward-facing schemas/examples and remove contradictory offset examples.	No unresolved dependency named.	ADR 0069	ADR 0069 D-1 + implementation plan + status audit contradiction.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0076	P0	Open	CI	Implement and centralize timestamp precision policy (D-2) with explicit field-class scoping (`ordering-sensitive` vs informational) to avoid unnecessary universal breakage.	No unresolved dependency named.	ADR 0069	ADR 0069 D-2 + rationale + premise review hardening.	Automated gate exists and fails on the named regression.
PLN-0077	P0	Open	Trellis, CI	Add chain timestamp-order verification (D-3) with explicit failure taxonomy distinct from hash/signature integrity failures.	No unresolved dependency named.	ADR 0069	ADR 0069 D-3 + implementation plan + premise review.	Automated gate exists and fails on the named regression.
PLN-0080	P0	Open	Formspec, CI, Conformance	Enforce explicit timezone context for FEL `today()`/`now()` (D-6), with staged migration path (lint/warn -> policy gate -> hard fail).	No unresolved dependency named.	ADR 0069	ADR 0069 D-6 + implementation plan + premise review.	Automated gate exists and fails on the named regression.
PLN-0081	P0	Open	Formspec, WOS	Align WOS runtime/time APIs and Formspec FEL evaluation context so timezone selection composes cleanly with WOS jurisdiction/business-calendar rules.	No unresolved dependency named.	ADR 0069	ADR 0069 D-6 + WOS Kernel §7 linkage.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0152	P0	Open	WOS	Add `ClockStarted` and `ClockResolved` as Facts-tier provenance kinds in WOS core (`ProvenanceKind`) with schema/export parity.	No unresolved dependency named.	ADR 0067	ADR 0067 implementation plan (WOS).	Schema/prose updated; generated docs/checks pass.
PLN-0154	P0	Open	WOS, CI	Wire required clock emissions in WOS transition paths: AppealClock on adverse decision notice path, ProcessingSLA on intake-accepted/intake-complete path, GrantExpiry on award-issued path.	No unresolved dependency named.	ADR 0067	ADR 0067 D-2 + implementation plan (merged scope).	Automated gate exists and fails on the named regression.
PLN-0157	P0	Open	Formspec	Implement StatuteClock origination on respondent-triggered acts via the existing Respondent Ledger emit path, including required statute reference URI.	No unresolved dependency named.	ADR 0067	ADR 0067 D-2 + implementation plan (Formspec).	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0159	P0	Open	Trellis	Add `open-clocks.json` to export-bundle spec and exporter output.	No unresolved dependency named.	ADR 0067	ADR 0067 D-3 + Trellis TODO #18.	Exporter/verifier output proves the path, including required negative/tamper case.
PLN-0160	P0	Open	Trellis, ADR/spec	Implement ADR 0067 expired-unresolved clock diagnostics in Trellis verifier while preserving the chosen advisory/profile-escalation severity policy.	Severity row PLN-0170 and source clock contract are settled enough to freeze diagnostics.	ADR 0067	ADR 0067 D-3 + Trellis TODO #18.	Verifier reports expired unresolved clocks using the agreed severity class; tests cover unresolved, resolved, and expired cases.
PLN-0161	P0	Open	Trellis, ADR/spec	Implement ADR 0067 pause/resume verifier composition: `paused` resolution plus resumed `ClockStarted` with deterministic residual-duration calculation.	Pause/resume source prose is settled enough to freeze verifier behavior.	ADR 0067	ADR 0067 D-4.	Verifier tests prove residual duration, rounding/canonicalization, and replay determinism for paused/resumed clocks.
PLN-0176	P0	Open	WOS, Conformance	Relocate existing Kernel §11 (Contract Validation) -> §6 (adjacent to Case State §5; contract validation governs case-data writes). Sweep cross-references in spec, schemas, lint rules, conformance fixtures, downstream documents.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0177	P0	Open	WOS, CI	Relocate existing Kernel §12 (Separation Principles) -> §2 (foundational meta-spec discipline; belongs early). Same cross-reference sweep.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Automated gate exists and fails on the named regression.
PLN-0178	P0	Open	WOS, Conformance	Move existing Kernel §13 (Conformance Fixtures) out of normative spec to `crates/wos-conformance/README.md` (or `meta/conformance-fixtures.md`). Conformance fixtures are tooling artifacts, not normative kernel prose.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0179	P0	Open	WOS	New Kernel §11 Runtime Serialization (was Runtime Companion §3 - CaseInstance serialization).	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Runtime/API path implements contract and passes integration fixtures.
PLN-0180	P0	Open	WOS	New Kernel §12 Evaluation Modes (was Runtime Companion §10 - evaluation modes including 100-cycle convergence cap; observable-outcome runtime state, top-level chapter not §4 subsection).	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Runtime/API path implements contract and passes integration fixtures.
PLN-0181	P0	Open	Formspec, WOS	New Kernel §13 Formspec Coprocessor (was Runtime Companion §15 - 15-step Formspec coprocessor protocol; ADR 0073 already pins Formspec at the `contractHook` seam).	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0073, ADR 0076	ADR 0076 step 3.	Runtime/API path implements contract and passes integration fixtures.
PLN-0182	P0	Open	WOS	Lifecycle Detail §2 (transition evaluation pseudocode) -> Kernel §4.6/§4.7 as normative algorithm.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0183	P0	Open	WOS	Lifecycle Detail §3 (history states, shallow + deep) -> Kernel §4.14.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0184	P0	Open	WOS	Lifecycle Detail §4 (advanced parallel execution: region activation, event routing, join semantics per `cancellationPolicy`, region cancellation, nested parallelism) -> Kernel §4.8.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0185	P0	Open	WOS	Lifecycle Detail §5 (compensation algorithm: pivot step, reverse ordering, forward vs backward recovery) -> Kernel §9.5.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0186	P0	Open	WOS	Lifecycle Detail §6 (timer lifecycle: reset-on-reentry, parallel-region scoping) -> Kernel §9.7.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0188	P0	Open	WOS	Runtime §4 (event delivery contract) -> Kernel §4.2/§4.9 expansion.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Runtime/API path implements contract and passes integration fixtures.
PLN-0189	P0	Open	WOS	Runtime §5 (action execution model, including §5.4 service invocation execution semantics) -> Kernel §9.2 expansion. Resolves the schema-target reference in ADR 0080 D-3 service-response row.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0080, ADR 0076	ADR 0076 step 3 + ADR 0080 D-3.	Schema/prose updated; generated docs/checks pass.
PLN-0190	P0	Open	WOS	Runtime §6 (durability guarantees G1–G5) -> Kernel §9.1 expansion.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Runtime/API path implements contract and passes integration fixtures.
PLN-0191	P0	Open	WOS, CI	Runtime §7 (timer precision) -> Kernel §9.7 expansion (alongside Lifecycle Detail §6).	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Automated gate exists and fails on the named regression.
PLN-0192	P0	Open	WOS	Runtime §8 split: §8.2 scoping -> Kernel §4.12. §8.3 deontic enforcement ordering -> AI Integration §4. §8.4 delegation verification -> Governance §11.4. §8.5 hold management -> Governance §12.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Runtime/API path implements contract and passes integration fixtures.
PLN-0193	P0	Open	WOS, CI	Runtime §9 (explanation assembly) -> Governance §3 (due process, where adverse-decision originates).	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Automated gate exists and fails on the named regression.
PLN-0194	P0	Open	WOS	Runtime §11 (multi-version coexistence) -> Kernel §9.6 expansion.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0197	P0	Open	WOS	Runtime §14 -> Kernel §5.5 expansion of relationship-metadata model and triggered-event routing semantics. Cascade-depth cap (`maxRelationshipEventDepth` default 3) already lives in Kernel §4.10; that portion does not move.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Runtime/API path implements contract and passes integration fixtures.
PLN-0198	P0	Open	WOS	Delete `specs/companions/` and `schemas/companions/`. Move `wos-case-instance` schema under `schemas/kernel/`.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 8.	Schema/prose updated; generated docs/checks pass.
PLN-0199	P0	Open	WOS	Delete `specs/profiles/integration.md` and `schemas/profiles/wos-integration-profile.schema.json` (after Integration Profile split lands).	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 7.	Schema/prose updated; generated docs/checks pass.
PLN-0200	P0	Open	WOS, Conformance	Integration Profile normative patterns -> Kernel §9.2 (`invokeService` binding surface): §3 binding types, §3.3 common properties, §3.3.1 outputBinding JSONPath subset (incl. lint rule I-001), §3.4/§3.5/§3.6 structural shape, §3.8 retry policy, §4 contract validation, §7 idempotency, §9 execution ordering.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0201	P0	Open	WOS, CI	Integration §5 (CloudEvents extension attributes - `wosinstanceid`, `wosdefid`, `wosdefversion`, `wosstate`, `wostaskid`, `woscorrelationkey`, `woscausationeventid`) + §6 (correlation rules referencing those attributes) -> Kernel §9.2 as normative. Both must live in the same normative document.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0203	P0	Open	WOS	Integration §8.4 (deny-overrides-permit deontic-override rule: external policy engines are more restrictive, never more permissive) -> AI Integration §4 (Deontic Constraints) as normative.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0206	P0	Open	WOS	Add open binding-type extension point on Kernel §9.2 (`binding.type` closed enum with `x-` prefix for extensions) so adapter documents register binding types via `x-` without requiring a profile document.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Schema/prose updated; generated docs/checks pass.
PLN-0207	P0	Open	WOS, CI	Move `specs/profiles/semantic.md` -> `specs/sidecars/ontology-alignment.md`. Rename document marker `$wosSemanticProfile` -> `$wosOntologyAlignment`. Rename schema `schemas/profiles/wos-semantic-profile.schema.json` -> `schemas/sidecars/wos-ontology-alignment.schema.json`. Narrow scope explicitly to ontology alignment (JSON-LD `@context`, SHACL shape library, PROV-O export, XES/OCEL export); remove framing suggesting it owns transition-tag vocabulary. Update Kernel §4.12 to state transition-tag vocabulary is kernel-owned.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 4.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0208	P0	Open	WOS, Conformance	Absorb `specs/profiles/signature.md` content into the core spec's `signature` embedded-block prose; absorb its schema into `wos-workflow.schema.json` `$defs/Signature`. Drop `$wosSignatureProfile` marker (single `$wosWorkflow` envelope per Q2). T4 conformance suite stays a separate bundle per Q11; conformance command remains `cargo nextest run -p wos-conformance --test signature` reading the workflow envelope at the claimed version. Delete `specs/profiles/signature.md` and the standalone signature schema.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 D-2 + step 7 + Q11 decision.	Signature spec/schema content lives in core; T4 suite still passes against envelope; standalone signature artifacts deleted.
PLN-0209	P0	Open	WOS	Promote `FactsTierRecord`, `MutationSource`, `VerificationLevel`, `CaseFileSnapshot`, `CapabilityInvocationRecord` `$defs` into the merged `wos-workflow.schema.json` core. Runtime log schema `wos-provenance-log.schema.json` imports them via `$ref`. Delete the standalone `wos-provenance-record.schema.json`. Resolves the schema-target confusion that drove ADR 0080's earlier errors.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0080, ADR 0076	ADR 0076 D-4 + step 5 + ADR 0080 D-4.	Schema/prose updated; generated docs/checks pass.
PLN-0210	P0	Open	WOS	Higher-tier provenance records (Reasoning, Counterfactual, Narrative tiers) attach via `provenanceLayer` seam (ADR 0077 §10.3) and live alongside whichever embedded block emits them in `wos-workflow.schema.json` ($defs co-located with `governance` for Reasoning/Counterfactual, with `aiOversight.narrativeTier` for Narrative). The runtime log `wos-provenance-log.schema.json` imports tier `$defs` via `$ref`.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 D-4 + D-2.	Schema/prose updated; generated docs/checks pass.
PLN-0314	P0	Open	WOS	Lead value: until this lands, every downstream code change waits and the sketch debt compounds. The schema sketch is what every workflow author validates against; sketches let bugs through that the full schema would catch. Detail: promote `wos-spec/schemas/wos-workflow.schema.json` from sketch (landed alongside ADR 0076) to full normative schema — complete `$defs` for all embedded blocks (Governance, AgentDeclaration, AIOversight, Signature, Advanced, Assurance), `x-lm.critical` annotations on load-bearing nodes, conditional rules formalized.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 D-1 + step 2.	Schema validates all three reference examples (timeoff, nda, benefits-adjudication) plus negative cases per conditional rule.
PLN-0315	P0	Done	WOS	Closed: per Q1 owner decision 2026-04-25, spec documents do not physically merge. `kernel/spec.md`, `governance/spec.md`, `ai/ai-integration.md`, `advanced/spec.md` retain their filenames and §-numbering; only schema references update to `wos-workflow.schema.json`. Spec-absorption work (Companions/Lifecycle Detail content into kernel/spec.md, etc.) tracked in PLN-0176..0207 and ADR 0076 step 3.	No active implementation in this row.	ADR 0076	ADR 0076 D-8 + Q1 decision.	Closed row is not active; spec-absorption rows carry remaining work.
PLN-0316	P0	Open	WOS	Land `wos-spec/schemas/wos-delivery.schema.json` merging `wos-business-calendar`, `wos-notification-template`, `wos-correspondence-metadata`. Single sidecar joins core via `targetWorkflow` URI. Delete the three predecessor schemas.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 D-3 + step 4.	One delivery sidecar schema exists; predecessor schemas deleted; existing fixtures migrated.
PLN-0317	P0	Open	WOS, CI, Conformance	Register lint rules `WOS-AGENT-XREF-001` (every actor with `type=='agent'` has matching `agents[].id`) and `WOS-SIG-COVER-001` (signature-gated transitions covered by `signature.signers[]` actor ids). Cross-reference rules beyond JSON Schema expressivity.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 D-2 lint rule callouts.	Rules registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0318	P0	Open	WOS	Rename `wos-provenance-record.schema.json` → `wos-provenance-log.schema.json`. Move it and `wos-case-instance.schema.json` from `schemas/companions/` to `schemas/`. Update `$ref` pointers and tooling.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 D-4 + step 5.	Schema/prose updated; generated docs/checks pass; old paths and names absent.
PLN-0319	P0	Open	WOS	Land `wos-spec/schemas/wos-tooling.schema.json` absorbing `wos-lint-diagnostic`, `conformance-trace`, `wos-synth-trace`, `wos-mcp-tools`, `wos-extension-registry`. Single tooling schema. Delete predecessor files.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 D-5 + step 6.	One tooling schema exists; predecessor schemas deleted; tooling consumers updated.
PLN-0320	P0	Open	WOS	Validate the three reference examples (`wos-spec/examples/timeoff.workflow.json`, `nda.workflow.json`, `benefits-adjudication.workflow.json`) against the full merged schema. Forms+ tier ~30 lines, DocuSign tier ~85 lines, case-management tier ~600 lines. Examples are conformance proof for the tier ladder (ADR 0076 D-9).	`workflow-consolidation` branch / ADR 0076 sequencing; PLN-0314 must close first.	ADR 0076	ADR 0076 D-9.	All three examples validate; CI gate exercises tier-ladder examples on every schema change.
PLN-0321	P0	Done	WOS	Closed: owner chose no compatibility shim in-tree (`marker_shim` removed; see `TODO-STACK.md`). Legacy document markers (`$wosKernel`, `$wosWorkflowGovernance`, etc.) are not accepted at runtime; author-time is `$wosWorkflow` only per ADR 0076. (Historical Q2 row text described an optional shim path that was not implemented.)	No active implementation in this row.	ADR 0076	ADR 0076 step 11 + D-7.	Conformance + fixtures validate `$wosWorkflow` envelope; no shim crate module.
PLN-0322	P0	Open	WOS	Promote custody from sidecar to embedded `custody` block in `wos-workflow.schema.json` `$defs/Custody`: trust profile binding, per-transition/per-signature anchor requirements, export-bundle ref. Delete `wos-custody-hook-encoding.schema.json`. Update PLN-0316/PLN-0214/CLAUDE.md sidecar lists to two sidecars (delivery + ontology-alignment).	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 D-2 + D-3 + step 4 + Q4 decision.	Custody embedded block present; standalone schema deleted; sidecar lists updated to 2.
PLN-0323	P0	Open	Formspec, WOS, Stack, ADR/spec	Cross-spec change: Formspec emits `IntakeHandoff` natively when targeting a WOS workflow URL (Q10 owner decision). Formalized as ADR 0079. Implementation: (1) Formspec spec amendment adding top-level `targetWorkflow` declaration per ADR 0079 D-3; (2) Formspec runtime envelope emission per D-1; (3) cross-spec lint rules `FORMSPEC-WOS-XREF-001` / `WOS-INTAKE-XREF-001` / `FORMSPEC-WOS-VERSION-001` / `FORMSPEC-WOS-MODE-001` per D-8; (4) end-to-end conformance fixtures for both modes.	Cross-spec coordination required between Formspec and WOS spec authors.	ADR 0079, ADR 0073, ADR 0076	ADR 0079 D-1..D-9 + Implementation plan.	Formspec runtime emits envelope on submit-targeting-WOS; Forms+ example workflow validates end-to-end without explicit envelope wiring; cross-spec lint rules registered.
PLN-0324	P0	Open	WOS, Conformance	Align T4 signature conformance suite with single-marker workflow envelope (Q11 decision): T4 reads `wos-workflow.schema.json` at claimed `$wosWorkflow@X.Y` version, asserts signature-block invariants. Suite stays operationally separate (own bundle, own roadmap), but pins schema shape to envelope version. Document the relationship in `T4-TODO.md` and `RELEASE-STREAMS.md`.	No unresolved dependency named.	ADR 0076	ADR 0076 D-7 + Q11 decision.	T4 conformance suite passes against the workflow envelope; T4-TODO.md states the schema-shape pin.
PLN-0325	P0	Open	WOS, Formspec	Lead value: one library decides how to coerce types across all six places where data crosses a boundary. Today every place does it slightly differently — exactly the bug class consolidation prevents; per-surface coercion drift compounds with every new surface and is harder to pull apart later. Detail: refactor `commit_external_output(...)` in `wos-runtime` + `wos-formspec-binding` to use shared `fel-core::coerce` library across all six surfaces (Q5 decision). Per-surface coercion strictness expressed via the contract (output schema), not the coercion function. Add cross-surface parity fixtures asserting reserved-type coercion equivalence.	No unresolved dependency named.	ADR 0080	ADR 0080 step 6 + Q5 decision.	One coercion library used; parity fixtures pass; no per-surface coercion divergence on reserved types.
PLN-0326	P0	Open	WOS, CI, Conformance	Register lint rule `WOS-QUARANTINE-PRECEDENCE-001` (Q7 decision): warns when both `governance.delegation.quarantineReset` and any `agents[*].resetAuthority` declare reset authorities. Governance overrides; lint surfaces the conflict so precedence is explicit, not silent.	No unresolved dependency named.	ADR 0080	ADR 0080 D-5 + step 11a + Q7 decision.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0327	P0	Open	WOS, CI, Conformance	Register lint rule `WOS-VER-LEVEL-002` (Q6 decision): warns when a capability declares `fallbackChain` without `verificationLevel`. Author must explicitly set the level (`corroborated` if the chain corroborates, `attested` if it merely escalates) — no silent default.	No unresolved dependency named.	ADR 0080	ADR 0080 step 10 + Q6 decision.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0328	P1	Open	WOS	Add `$views` declarations to `wos-tooling.schema.json` (Q3 decision): named sub-views like `governanceAuthor`, `agentAuthor`, `formsPlusAuthor` for studio-style authoring tools. Core schema does NOT carry `$views`; tooling schema does. Studio + MCP server + CLI all consume tooling-schema view definitions.	`workflow-consolidation` branch / ADR 0076 sequencing; PLN-0319 must close first.	ADR 0076	ADR 0076 step 6 + Q3 decision.	`$views` definitions land in tooling schema; Studio + MCP + CLI consume them; new tools extend tooling sidecar.
PLN-0329	P0	Open	WOS	Author the single `$wosWorkflow` claims-map paragraph in `RELEASE-STREAMS.md` enumerating which embedded blocks are exercised at each version (Q2 decision). Replaces multi-stream version listings (`wos-kernel@X + wos-governance@Y`) with single-marker form (`$wosWorkflow@X` + claims-map).	`workflow-consolidation` branch / ADR 0076 sequencing; depends on PLN-0314 (full schema) for first version pin.	ADR 0076	ADR 0076 D-7 + step 9 + Q2 decision.	`RELEASE-STREAMS.md` carries claims-map paragraph; procurement narrative collapses to one number.
PLN-0330	P1	Open	WOS, ADR/spec	Verify spec-absorption pass (PLN-0176..0207) preserves existing §-numbering across `kernel/spec.md`, `governance/spec.md`, `ai/ai-integration.md`, `advanced/spec.md` (Q1 decision). External citations like "Kernel §10.3 contract validation" must remain valid at v1.0. CI gate: anchor-stability check on each spec file across the consolidation pass.	No unresolved dependency named.	ADR 0076	ADR 0076 D-8 + Q1 decision.	Anchor-stability gate passes; no §-numbering drift in any of the four spec docs across the consolidation.
PLN-0222	P0	Open	WOS, CI	Per-surface defaults table in Kernel §5.4 normative prose. Cite `mutationSource` and `verificationLevel` as already-OPTIONAL fields on `FactsTierRecord` (`wos-provenance-record.schema.json`, merging into `wos-kernel.schema.json` per ADR 0076 D-8). Restate open-enum semantics (`oneOf [reserved literals \| x- pattern]`). Point at AI Integration §3.3, Kernel §9.2 (with cross-reference to Runtime §5.4 until §5.4 absorbs into kernel), Kernel §9.4 + §9.7, Runtime §15 (-> Kernel §13 after restructure), Kernel §4.4 for per-surface defaults. No schema field is added.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076, ADR 0080	ADR 0080 D-4 #1 + Implementation plan.	Schema/prose updated; generated docs/checks pass.
PLN-0223	P0	Open	WOS	Reserve `recordKind` literals `capabilityQuarantined` (capability invocation held for authorized-actor reset after non-retryable validation failure) and `capabilityOutputInvalidated` (previously-committed capability output superseded by later evidence) in Kernel §5.4 / §8 prose. Reservation is normative-prose (no enum constraint on the open `recordKind` discriminator).	No unresolved dependency named.	ADR 0080	ADR 0080 D-4 #2 + Implementation plan.	Schema/prose updated; generated docs/checks pass.
PLN-0224	P0	Open	WOS	Kernel §10 seam prose update: `contractHook`, `provenanceLayer`, `lifecycleHook` together carry the output-commit pipeline; no new seam declared. Reference ADR 0077.	No unresolved dependency named.	ADR 0077, ADR 0080	ADR 0080 Implementation plan.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0225	P0	Open	WOS	`outputBindings` + `inputBindings` on `CapabilityDeclaration` (AI Integration §3.3). Default `mutationSource: agent-extracted`.	No unresolved dependency named.	ADR 0080	ADR 0080 D-3.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0226	P0	Open	WOS	`eventContract` + `retryPolicy` on `invokeService` (Kernel §9.2 declaration; Runtime §5.4 execution -> Kernel §9.2 under ADR 0076). Default `mutationSource: system-fetched`.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076, ADR 0080	ADR 0080 D-3 + ADR 0076 step 3.	Runtime/API path implements contract and passes integration fixtures.
PLN-0227	P0	Open	WOS	`eventContract` + `eventOutputBindings` on signal/message wait substates routed by `correlationKey` (Kernel §9.4) with `signalTimeout` (Kernel §9.7). Default `mutationSource: system-fetched`.	No unresolved dependency named.	ADR 0080	ADR 0080 D-3.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0228	P0	Open	Formspec, WOS	`taskActions` on Runtime Companion §15 Formspec coprocessor surface (-> Kernel §13 after restructure). Generalizes `responseMappingRef` to non-Formspec respondent inputs. Default `mutationSource: human-entered` (or `human-corrected` on overrides).	No unresolved dependency named.	ADR 0080	ADR 0080 D-3.	Runtime/API path implements contract and passes integration fixtures.
PLN-0229	P0	Open	WOS	`mergeStrategy` + `collectPath` on parallel-state join (Kernel §4.4). Default `mutationSource: computed`.	No unresolved dependency named.	ADR 0080	ADR 0080 D-3.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0230	P0	Open	WOS	Processor semantics for `capabilityQuarantined` and `capabilityOutputInvalidated` under AI Integration §8: MUST NOT auto-retry; resume requires authorized-actor reset (provenance-recorded).	No unresolved dependency named.	ADR 0080	ADR 0080 Implementation plan.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0231	P0	Open	Conformance	Write-scope-violation rule per surface: `outputBindings` target paths MUST fall within capability's registered write scope; `taskActions` fields MUST fall within task's editable surface; event/service bindings MUST fall within declared projection scope; parallel `collectPath` MUST fall within parallel region's declared merge scope. Out-of-scope writes fail at authoring time (lint) and at runtime (processor rejection).	No unresolved dependency named.	ADR 0080	ADR 0080 Implementation plan.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0234	P0	Open	Formspec, WOS, Conformance	Single `commit_external_output` function in `wos-runtime` + `wos-formspec-binding` taking the six pipeline inputs and returning validated mutations + Facts-tier provenance records. Replaces five per-surface commit implementations.	No unresolved dependency named.	ADR 0080	ADR 0080 Implementation plan.	Runtime/API path implements contract and passes integration fixtures.
PLN-0282	P0	Open	WOS, CI, ADR/spec	Reconcile WOS custody/assurance governance claim drift against current artifacts: verify Governance §2.9 schema upgrade, §4.9 quorum delegation, §7.15 legal hold, Assurance §6 legal-sufficiency cross-ref, and Invariant 6 dedupe. Current `wos-spec/TODO.md` says the gap is open, while current spec/schema files appear to contain most claimed content; the backlog must not carry both stories.	No unresolved dependency named.	WOS audit 2026-04-24	audit verdict 17 (`2026-04-15-wos-custody-and-assurance.md`) + `wos-spec/TODO.md` Do next #2 + `WOS-FEATURE-MATRIX.md` rows 2.9/4.9/7.15/8.12/14.5.	A source-linked reconciliation note names which claims are already landed, updates stale TODO/audit/matrix text, and creates separate implementation rows only for any remaining unsupported feature-matrix claim.
PLN-0306	P0	Open	WOS, CI, Conformance	Run a WOS provenance-emission completeness audit: every normative WOS MUST that implies an audit/provenance event must map to a concrete `ProvenanceKind`, schema shape, runtime emission path, and fixture or explicit non-emission rationale. This closes the gap between "rule has evidence" and "normative event actually emits."	No unresolved dependency named.	WOS verifiability closure	`wos-spec/TODO.md` Do next #3 + `wos-spec/TODO.md` Verifiability closure "Provenance emission completeness audit."	MUST-to-record map exists; tested emissions pass; non-emitting MUSTs are explicitly downgraded, reworded, or recorded as separate implementation gaps.
PLN-0010	P1	Open	WOS, Stack, Conformance	Implement lint rule for cross-tenant relationship rejection (`K-C-010` proposed) and wire into kernel validation.	No unresolved dependency named.	ADR 0068	ADR 0068 implementation plan.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0016	P1	Open	ADR/spec	Scope ADR 0068 lifetime immutability wording to identity fields only, so tenant/scope identity stays fixed while ADR 0071 version pins remain mutable through `MigrationPinChanged`.	No unresolved dependency named.	ADR 0068	ADR 0068 D-2 (proposed wording fix).	ADR 0068 wording no longer freezes version pins; ADR 0071 pin-change tests still pass.
PLN-0020	P1	Open	Stack, CI	Add stack-level `pins.md` reference documenting pin dimensions, ownership, and normative version-format links.	No unresolved dependency named.	ADR 0071	ADR 0071 implementation plan.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0024	P1	Open	Formspec, Trellis	Add Formspec-side pin capture and migration-policy documentation so active-case auto-migration is not implied.	No unresolved dependency named.	ADR 0071	ADR 0071 implementation plan.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0025	P1	Open	WOS, Trellis	Align WOS migration-routing backlog (`#3`) with ADR 0071 transition semantics so routing cannot bypass pin-change governance.	No unresolved dependency named.	ADR 0071	ADR 0071 implementation plan + WOS backlog dependency.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0026	P1	Open	Conformance	Add cross-version replay conformance fixtures asserting archived-semantics replay determinism (byte-identical where required).	No unresolved dependency named.	ADR 0071	ADR 0071 D-2 + implementation plan.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0027	P1	Open	Trellis, Conformance	Add rollout/ops guardrails for pin transitions (feature flags, migration-attempt telemetry, verifier mismatch observability).	No unresolved dependency named.	ADR 0071	ADR 0071 consequences + proposed implementation hardening.	Exporter/verifier output proves the path, including required negative/tamper case.
PLN-0028	P1	Open	Stack, Conformance	Add negative tests for missing tenant, malformed tenant, and tenant mismatch across all touched schemas/APIs.	No unresolved dependency named.	ADR 0068	ADR 0068 implementation plan.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0029	P1	Open	WOS, Stack, Conformance	Add integration tests for tenant-scoped lifecycle operations (`create/load/enqueue`) in WOS runtime.	No unresolved dependency named.	ADR 0068	ADR 0068 implementation plan.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0030	P1	Open	Trellis, Stack, Conformance	Add verifier tests for tenant mismatch refusal and accepted same-tenant chains/bundles.	No unresolved dependency named.	ADR 0068	ADR 0068 implementation plan.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0031	P1	Open	Stack, Conformance	Add regression tests for `payload.tenant` and TypeID-prefix consistency checks.	No unresolved dependency named.	ADR 0068	ADR 0068 D-1/D-4 (proposed hardening).	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0054	P1	Open	WOS, CI	Wire WOS exporter coverage so all ADR 0066 records emit as distinct event types in PROV-O / OCEL / XES.	No unresolved dependency named.	ADR 0066	ADR 0066 implementation plan (WOS exporters).	Exporter/verifier output proves the path, including required negative/tamper case.
PLN-0057	P1	Open	Formspec, WOS, Trellis, Stack, CI, Conformance	Add cross-repo conformance fixtures proving all four revisit modes across Formspec -> WOS -> Trellis seams, including required negative cases for invalid supersession linkage and post-rescission determination attempts.	No unresolved dependency named.	ADR 0066	ADR 0066 Consequences (new fixture set required) + implementation plan.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0061	P1	Open	Stack, Conformance	Add/retain cross-repo conformance checks proving `EvidenceAttachmentBinding` invariants for add/replace/remove lifecycle semantics and `prior_binding_hash` lineage integrity.	No unresolved dependency named.	ADR 0072	ADR 0072 D-1/D-2/D-6.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0062	P1	Open	CI, Conformance	Ensure offline export/verify coverage remains mandatory in regression runs (vectors landed; keep CI enforcement explicit) for: attachment manifest digest mismatch, missing inline attachment body, unresolved or cyclic binding lineage.	No unresolved dependency named.	ADR 0072	ADR 0072 D-5/D-6 + fixture plan.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0065	P1	Open	Evidence Integrity and Attachment Binding (ADR 0072)	Define slot identity stability strategy across schema/form evolution (stable slot id and/or canonicalized slot path rules) to prevent semantic drift.	No unresolved dependency named.	ADR 0072	ADR 0072 D-1 (`slot_path`) + premise review hardening.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0067	P1	Open	Formspec, WOS, Trellis, Stack, CI, Conformance	Build shared stack fixture bundles for the remaining cross-seam proof path: `workflowInitiated` attach-to-existing-case, `publicIntake` accept-then-create-case, WOS-T4 signature-complete bundle `001`, and deterministic expected outputs across Formspec canonical response -> WOS semantic evidence -> Trellis custody/export/verify plus ADR 0007 certificate-of-completion presentation.	No unresolved dependency named.	ADR 0073, Trellis ADR 0007	ADR 0073 implementation plan (Stack-level) + implementation status ("Still open") + root `TODO.md` ADR 0073 and WOS-T4 shared fixture bundle + `wos-spec/TODO.md` WOS-T4 closeout + `trellis/TODO.md` #8 (WOS-T4 residue) + #9 (ADR 0073 handoff residue) + #4 (cert-of-completion ADR 0007).	Passing positive/negative fixtures prove canonical response, handoff, WOS provenance, Trellis export/verify, and certificate-of-completion composition agree; CI/conformance gate covers the bundle.
PLN-0068	P1	Open	Trellis, Stack, Conformance	Add at least one required negative shared fixture (response-hash mismatch) in the stack bundle so end-to-end verify failure is asserted at the seam, not only in repo-local vectors.	No unresolved dependency named.	ADR 0073, Shared fixture design	ADR 0073 implementation plan (Stack-level/Trellis) + implementation status ("Still open") + premise review + `wos-spec/TODO.md` WOS-T4 closeout + `trellis/TODO.md` #8 + #9 (shared-fixture residue).	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0069	P1	Open	Trellis, Stack, CI, Conformance	Add CI/conformance gate for shared fixture bundles and required negative cases so stack-integration regressions fail at integration time.	No unresolved dependency named.	ADR 0073, Shared fixture design	ADR 0073 implementation plan (Stack-level) + proposed execution hardening + root `TODO.md` ADR 0073 still-open shared fixture bundle + `wos-spec/TODO.md` WOS-T4 closeout + `trellis/TODO.md` #8 + #9 (shared-fixture residue).	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0082	P1	Open	Stack, CI, Conformance, ADR/spec	Move ADR 0069 timestamp proof work out of questions: add cross-repo fixtures for UTC wire format, precision acceptance/rejection, and fractional-zero canonicalization.	ADR 0069 precision/profile question rows must close before fixtures freeze.	ADR 0069	ADR 0069 D-1/D-2 + Open Question #3.	Fixture bundle proves the chosen timestamp contract across Formspec/WOS/Trellis positive and negative cases.
PLN-0083	P1	Open	Trellis, Conformance	Add verifier tests for D-3 timestamp ordering (accept non-decreasing, reject backwards) including edge cases where hash chain is valid but temporal order fails.	No unresolved dependency named.	ADR 0069	ADR 0069 D-3 + implementation plan.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0084	P1	Open	Conformance	Add leap-second test vectors asserting selected D-4 policy (`23:59:60` rejected or normalized per final policy) and deterministic behavior at day boundaries.	No unresolved dependency named.	ADR 0069	ADR 0069 D-4 + implementation plan.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0085	P1	Open	Formspec, Conformance	Add FEL tests proving timezone-required semantics for `today()`/`now()` and deterministic multi-timezone replay.	No unresolved dependency named.	ADR 0069	ADR 0069 D-6 + consequences + implementation plan.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0086	P1	Open	CI, Conformance	Add migration/regression fixtures for existing second-precision timestamps to enforce explicit transition behavior.	No unresolved dependency named.	ADR 0069	ADR 0069 D-2 consequences + implementation planning.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0087	P1	Open	WOS, CI, Conformance	Add lint rule `K-F-010`: workflows that can enter `stalled` MUST provide an operator-accessible recovery transition.	No unresolved dependency named.	ADR 0070	ADR 0070 implementation plan.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0088	P1	Open	Conformance	Add schema/lint diagnostics for missing stalled-recovery paths and missing/invalid retry policy wiring.	No unresolved dependency named.	ADR 0070	ADR 0070 implementation plan (expanded validation scope).	Schema/prose updated; generated docs/checks pass.
PLN-0089	P1	Open	WOS, Trellis, Stack, Conformance	Add cross-repo fixture bundle coverage for: append success, retry then success with no duplicate commit, budget exhaustion to `stalled`, operator recovery from `stalled`, governance rejection recorded without applying rejected effects.	No unresolved dependency named.	ADR 0070, Shared fixture design	ADR 0070 D-2/D-3/D-4/D-6 + shared fixture strategy.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0119	P1	Open	CI, ADR/spec	Add a normative compatibility rubric for ADR 0071 D-4 vs D-5 classification ("compatible migration" vs "breaking semantics requiring ADR 0066 supersession"), including decision authority and required evidence.	No unresolved dependency named.	ADR 0071, ADR 0066	ADR 0071 D-4/D-5 + ADR 0066 (premise review).	Automated gate exists and fails on the named regression.
PLN-0126	P1	Open	Trellis, ADR/spec	After PLN-0063/0064/0065 settle, publish one ADR 0072 attachment-profile taxonomy covering filename disclosure, slot identity stability, and verifier strictness tiers.	Depends on ADR 0072 metadata, plaintext re-hash, and slot-identity decisions.	ADR 0072	ADR 0072 premise review hardening + D-1 + D-6.	Attachment-profile taxonomy binds confidentiality, slot stability, and verifier strictness without re-bundling unresolved decisions.
PLN-0135	P1	Open	WOS	Close handoff hygiene item §4.1 uniformly across all WOS schemas: permit vendor `x-` extensions via `patternProperties` where intended, enforce unknown-key rejection, and ensure rule coverage includes both extension-allow and reserved-namespace rejection paths.	No unresolved dependency named.	ADR 0064	ADR 0064 Consequences (inherits handoff §4) + `wos-spec/thoughts/archive/reviews/2026-04-16-architecture-review-handoff.md` §4.1.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0140	P1	Open	WOS, CI, Conformance	Lead value: root CI excludes `wos-spec`, so every wos-spec lint/conformance/runtime regression rides into `main` unblocked and stacks into the next PR's bisection set — the inheriting PR pays the bisection cost for breakage it didn't introduce. Detail: add explicit WOS workspace CI gate(s) so `wos-spec` lint/conformance/runtime checks are exercised in automated workflows, not only by local/manual runs (root workspace CI currently excludes `wos-spec`).	No unresolved dependency named.	ADR 0064	ADR 0064 D-1 methodology dependency (`spec -> schema -> lint -> conformance -> runtime`) + execution hardening.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0155	P1	Open	WOS	Extend/align Task SLA authoring surface with the ADR 0067 clock contract where durations overlap.	No unresolved dependency named.	ADR 0067	ADR 0067 implementation plan + WOS TODO ADR-0067 item.	Document/tracker/archive diff points to canonical source and removes stale signal.
PLN-0156	P1	Open	WOS, Trellis, CI	Reopen and align WOS #51 statutory deadline chains against the now-explicit event-pair contract and calendar semantics.	No unresolved dependency named.	ADR 0067	ADR 0067 related note + WOS TODO #51 linkage.	Automated gate exists and fails on the named regression.
PLN-0162	P1	Open	Trellis, Conformance	Land Trellis vectors: `append/014-clock-started`, `append/015-clock-satisfied`, `append/016-clock-elapsed`, `append/017-clock-paused-resumed`.	No unresolved dependency named.	ADR 0067	ADR 0067 implementation plan + Trellis TODO #18.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0163	P1	Open	Stack, Conformance	Integrate ADR 0067 semantics into ADR 0066 amendment policy composition (`may this still be amended?` depends on statute clock state).	No unresolved dependency named.	ADR 0067, ADR 0066	ADR 0067 D-5 + ADR 0066 D-5 relationship.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0164	P1	Open	Formspec, WOS, Trellis, Stack, Conformance	Add shared stack fixture coverage for statutory clock composition (`006-statutory-clock-fires`) once ADR execution lands in WOS/Trellis/Formspec.	Named prerequisite in action/source must land first.	ADR 0067, Shared fixture design	shared fixture design doc + ADR 0067 execution dependency.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0311	P1	Open	Formspec, Trellis, ADR/spec	Specify Respondent Ledger offline-authoring profile semantics: pending-local state, authored-time preservation under delayed submit, buffered event-chain construction, and `eventHash` / `priorEventHash` obligations when Trellis wraps the ledger. This protects Trellis `priorEventHash` / `prev_hash` chain semantics from producer-side improvisation.	No unresolved dependency named.	Respondent Ledger companion, Trellis ADR 0001	root `TODO.md` "Offline authoring profile in Respondent Ledger companion" + `trellis/TODO.md` #11 (was #16 pre-Wave-15-renumber) + `trellis/specs/archive/cross-reference-map-coverage-analysis.md` offline-authoring gap + ULCOMP-R-210..212 migration guidance residue.	Companion text, schema/examples, and Trellis mapping notes define offline chain semantics; if current Formspec §6.2 already requires the hash fields for Trellis-wrapped ledgers, Trellis TODO #11 closes as tracker drift instead of spawning a duplicate task.
PLN-0312	P1	Done	Trellis, Conformance, ADR/spec	Land Trellis foundational crypto execution bundle: ADR 0006 key-class taxonomy, Rust HPKE wrap/unwrap, post-HPKE duplicate-ephemeral lint, and ADR 0005 crypto-erasure verifier/vector closure. Closed 2026-04-28. All four sub-rows landed: Wave 16 Rust HPKE wrap/unwrap (`trellis-hpke` sibling crate, byte-matches `append/004`); Wave 17 ADR 0006 key-class taxonomy fully closed including vector corpus (`append/031..035` + `tamper/023..025`, commits `e28b07e`/`4bc9a8c`/`f9644f2`/`4cd5f85`) plus HPKE duplicate-ephemeral lint R17; Wave 21 ADR 0005 Stages 2-5 fully closed in a 9-commit train (`c13282f`..`1b00a9a`) — Rust verifier extension (chain-walk step 8 + export-catalog cross-check), Python parity, tamper vectors `append/017..019`, export bundle `export/009-erasure-evidence-inline` + 432-line generator, CLI `erase-key` Phase-1 stub, Companion §27.1 prose, matrix promotion TR-OP-105 + TR-OP-107 prose → `test-vector`. Slot collision (`export/009-erasure-evidence-inline` vs prior `export/009-intake-handoffs-public-create-empty-outputs`) resolved per lean (b) — intake-handoffs renumbered to `export/013-...` (preserves Trellis item #4's `export/010` cert-of-completion reservation per ADR 0007 Fixture plan); R16 lifecycle marker is a deprecated tombstone manifest at slot 009.	All four sub-rows landed.	Trellis ADR 0005, Trellis ADR 0006	`trellis/COMPLETED.md` Wave 16 + 17 + 21 entries.	All sub-row done-criteria met; full corpus byte-replays under `cargo nextest run -p trellis-conformance` (Rust) and `python3 -m trellis_py.conformance` (G-5 stranger gate, 84/0/0 — 85 manifests minus 1 deprecated tombstone).
PLN-0195	P1	Open	WOS, CI	Runtime §12 (host interfaces - nine traits like `InstanceStore`, `EventQueue`, `TaskPresenter`) -> `specs/kernel/appendix-host-interfaces.md` (non-normative, adapter-facing).	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Automated gate exists and fails on the named regression.
PLN-0196	P1	Open	WOS	Runtime §13 (security model, engine-isolation) -> `specs/kernel/appendix-security.md` (non-normative).	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Runtime/API path implements contract and passes integration fixtures.
PLN-0219	P1	Open	Formspec, WOS, Conformance	After ADR 0076 path moves, reanchor WOS `LINT-MATRIX.md` rule I-001 to Kernel §9.2 and preserve `I-` prefix for fixture continuity.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 12.	Lint matrix points to the post-restructure section and existing fixtures still resolve rule I-001.
PLN-0221	P1	Open	WOS, CI, Conformance	After ADR 0076 path moves, update conformance fixture markers away from removed runtime/lifecycle/integration/semantic profile markers.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 11.	Fixtures reference current kernel/sidecar markers or omit markers where content folded into kernel.
PLN-0232	P1	Open	CI, Conformance	`mutationSource` default rule per surface: lint warns when a surface emits a `mutationSource` outside the D-3 default set without a `rationaleRef` (e.g. a capability emitting `human-corrected` requires explicit rationale).	No unresolved dependency named.	ADR 0080	ADR 0080 Implementation plan.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0233	P1	Open	WOS, Conformance	`verificationLevel` rule on rights-impacting transitions: governance profile lint MAY require minimum `verificationLevel` on mutations from `determination`-tagged transitions when `impactLevel` is `rightsImpacting`.	No unresolved dependency named.	ADR 0080	ADR 0080 Implementation plan.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0235	P1	Open	Conformance	Conformance fixtures: at least one positive + one negative per surface. Negative fixtures prove write-scope gate rejects out-of-scope projection.	No unresolved dependency named.	ADR 0080	ADR 0080 Implementation plan.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0236	P1	Open	WOS, Conformance	Conformance fixtures: at least one per `mutationSource` reserved literal proving round-trip through Facts-tier mutation record + at least one for `x-vendor-*` extension value round-trip.	No unresolved dependency named.	ADR 0080	ADR 0080 Implementation plan.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0237	P1	Open	Conformance	Three-way agreement: spec + in-memory reference adapter + production adapter (Restate) MUST all pass the same fixture set.	No unresolved dependency named.	ADR 0080	ADR 0080 Implementation plan.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0238	P1	Open	WOS	Extend `$defs/State.type` enum in `wos-kernel.schema.json` to include `foreach`.	No unresolved dependency named.	ADR 0078	ADR 0078 D-1 + Implementation plan step 5.	Schema/prose updated; generated docs/checks pass.
PLN-0239	P1	Open	Schema Additions	Add sixth conditional `allOf` block requiring `collection` and `body` when `type === "foreach"`; forbid `initialState`, `states`, `regions`, `cancellationPolicy`, `historyState` on foreach states.	No unresolved dependency named.	ADR 0078	ADR 0078 D-1 + Implementation plan step 5.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0240	P1	Open	Formspec, CI	Add foreach-specific State properties: `collection` (FEL string, REQUIRED), `itemVariable` (default `$item`), `indexVariable` (default `$index`), `concurrency` (integer or null, default null), `breakCondition` (FEL string, OPTIONAL), `outputPath` (REQUIRED when `mergeStrategy` set), `mergeStrategy` (`shallow` / `deep` / `collect`, OPTIONAL), `body` (State, REQUIRED).	No unresolved dependency named.	ADR 0078	ADR 0078 D-1.	Schema/prose updated; generated docs/checks pass.
PLN-0241	P1	Open	Schema Additions	`x-lm.critical` annotations on `collection` and `body` properties.	No unresolved dependency named.	ADR 0078	ADR 0078 Implementation plan step 5.	Schema/prose updated; generated docs/checks pass.
PLN-0242	P1	Open	Schema Additions	Reserve `iterationStarted`, `iterationCompleted`, `iterationFailed`, `iterationSkipped` literals on `recordKind` discriminator (consistent with ADR 0080 reservation pattern: normative prose, no enum extension on open discriminator).	No unresolved dependency named.	ADR 0080, ADR 0078	ADR 0078 D-3 + Implementation plan step 6.	Schema/prose updated; generated docs/checks pass.
PLN-0243	P1	Open	WOS, ADR/spec	Implement ADR 0078 foreach topology prose in Kernel §4.3: fifth topology kind, entry-time `collection` evaluation, item/index defaults, concurrency semantics, and `breakCondition` order.	ADR 0078 accepted implementation path.	ADR 0078	ADR 0078 Implementation plan step 1.	Kernel prose, schema, lint, and conformance fixtures agree on foreach topology semantics.
PLN-0245	P1	Open	WOS	Kernel §4.8 fork/join: cross-reference noting foreach uses `mergeStrategy` for output aggregation, distinct from parallel-state region join (which uses synthetic `$join` event).	No unresolved dependency named.	ADR 0078	ADR 0078 Implementation plan step 3.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0247	P1	Open	WOS	Define iteration-record-kind shape constraints in Kernel §8 prose alongside existing kernel record kinds. `iterationStarted` / `iterationCompleted` MUST be paired per iteration; emitting start without completion is a processor invariant violation.	No unresolved dependency named.	ADR 0078	ADR 0078 D-3 + Implementation plan step 6.	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0248	P1	Open	Formspec, WOS, Conformance	L-foreach-001: `foreach.collection` MUST evaluate to a statically-analyzable bounded array. Unbounded or unanalyzable expressions fail. Conformance class: Kernel Complete (FEL semantic interpretation required).	No unresolved dependency named.	ADR 0078	ADR 0078 D-7.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0249	P1	Open	WOS, Conformance	L-foreach-002: `outputPath` set requires `mergeStrategy` set. Conformance class: Kernel Structural (schema-checkable conditional).	No unresolved dependency named.	ADR 0078	ADR 0078 D-7.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0250	P1	Open	WOS, Conformance	L-foreach-003: iteration body writes MUST fall within `outputPath` scope plus governance-permitted paths. Conformance class: Kernel Complete (binding-target analysis). Consistent with ADR 0080 §D-1.4 write-scope rule.	No unresolved dependency named.	ADR 0080, ADR 0078	ADR 0078 D-7.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0251	P1	Open	WOS, Conformance	L-foreach-004: `concurrency` MUST be `null` or positive integer. Conformance class: Kernel Structural.	No unresolved dependency named.	ADR 0078	ADR 0078 D-7.	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0252	P1	Open	Conformance	Lead value: the workflow author who writes a `foreach` state can trust that every shape behaves as the spec promises (sequential, parallel, empty, nested, every merge strategy). Detail: foreach conformance fixture suite covering all behavioral cases per ADR 0078 D-8: (a) sequential over static array (`concurrency: null`); (b) parallel with `concurrency: 3` cap; (c) `breakCondition` early termination + `iterationSkipped` provenance for unrun iterations; (d) empty collection — zero iterations, empty result under each `mergeStrategy`; (e) per-iteration provenance pairing (`iterationStarted` / `iterationCompleted` / `iterationFailed` on body error); (f) foreach inside compound state — nested topology composes; (g) aggregation under each `mergeStrategy` (`shallow` / `deep` / `collect`); (h) at least one negative fixture per L-foreach-001..004 lint rule; (i) three-way agreement — in-memory adapter + production adapter (Restate) MUST both pass the suite.	No unresolved dependency named.	ADR 0078	ADR 0078 D-8 + Implementation plan steps 8 + 9.	All nine fixture cases pass on both runtime adapters; CI/conformance gate covers the suite.
PLN-0253	P1	Done	Conformance	Merged into PLN-0252: parallel foreach with `concurrency: 3` cap is a fixture case in the umbrella foreach suite.	No active implementation remains in this row.	ADR 0078	PLN-0252.	Closed row is not in the active implementation queue; canonical row PLN-0252 carries the work.
PLN-0254	P1	Done	Conformance	Merged into PLN-0252: `breakCondition` early termination is a fixture case in the umbrella foreach suite.	No active implementation remains in this row.	ADR 0078	PLN-0252.	Closed row is not in the active implementation queue; canonical row PLN-0252 carries the work.
PLN-0255	P1	Done	Conformance	Merged into PLN-0252: empty collection behavior is a fixture case in the umbrella foreach suite.	No active implementation remains in this row.	ADR 0078	PLN-0252.	Closed row is not in the active implementation queue; canonical row PLN-0252 carries the work.
PLN-0256	P1	Done	Conformance	Merged into PLN-0252: per-iteration provenance pairing is a fixture case in the umbrella foreach suite.	No active implementation remains in this row.	ADR 0078	PLN-0252.	Closed row is not in the active implementation queue; canonical row PLN-0252 carries the work.
PLN-0257	P1	Done	Conformance	Merged into PLN-0252: foreach inside compound state is a fixture case in the umbrella foreach suite.	No active implementation remains in this row.	ADR 0078	PLN-0252.	Closed row is not in the active implementation queue; canonical row PLN-0252 carries the work.
PLN-0258	P1	Done	Conformance	Merged into PLN-0252: aggregation per merge strategy is a fixture case in the umbrella foreach suite.	No active implementation remains in this row.	ADR 0078	PLN-0252.	Closed row is not in the active implementation queue; canonical row PLN-0252 carries the work.
PLN-0259	P1	Done	Conformance	Merged into PLN-0252: negative fixtures per lint rule are a fixture case in the umbrella foreach suite.	No active implementation remains in this row.	ADR 0078	PLN-0252.	Closed row is not in the active implementation queue; canonical row PLN-0252 carries the work.
PLN-0260	P1	Done	Conformance	Merged into PLN-0252: three-way runtime agreement is a fixture-suite obligation in the umbrella foreach row.	No active implementation remains in this row.	ADR 0078	PLN-0252.	Closed row is not in the active implementation queue; canonical row PLN-0252 carries the work.
PLN-0347	P1	Open	WOS, ADR/spec	Author ADR scoping `escalationLevels` shape on Governance §10 review-protocol surface (FlowSpec disposition Wave 3 ADAPT, X34). Distinguishes from existing `escalationChain` (SLA-breach ladder on `BreachPolicy.action: escalate`): `escalationLevels` is human-task-driven entry/progression with form-visibility deltas. Scope: entry-time `entryConditions` + `defaultEntry` (FEL-gated risk-based skip-to-level), per-level `additional{FormSections,ReadOnlyFields,EditableFields}` for graduated form visibility, `levelHistory[]` execution-state record (level id, assignedTo, startedAt/completedAt, result), `escalation_advanced` provenance record-kind reservation under ADR 0080's open-discriminator pattern. Both surfaces coexist on the same task. ADR 0077:101 already cites `escalationLevels` as extending Governance §10 without a new kernel seam — this row pins the shape.	ADR 0077 (kernel-seam invariant), ADR 0080 (output-commit pipeline reuses `taskActions` per level via PLN-0228).	ADR 0077, ADR 0080	`wos-spec/counter-proposal-disposition.md` §3.4 ADAPT rows; `wos-spec/counter-proposal.md` §3.4.2; ADR 0077:101 forward reference.	ADR ratified; Governance schema declares `escalationLevels` extension; lint enforces `escalationChain` / `escalationLevels` composition rule; conformance fixture proves entry-condition routing + level-progression provenance.
PLN-0348	P1	Open	Conformance	`escalationLevels` conformance fixtures (gated by PLN-0347): (a) `entryConditions` skip-to-manager on high-risk; (b) timeout-driven level advance from level N to N+1; (c) explicit-action escalation; (d) last-level timeout falling through to standard `stateTimeout` routing; (e) `levelHistory[]` audit completeness; (f) three-way agreement (in-memory + Restate adapter + spec).	PLN-0347 ratified shape.	ADR 0077, ADR 0080	`wos-spec/counter-proposal-disposition.md` §3.4 ADAPT rows.	Passing positive/negative fixtures; three-way agreement holds.
PLN-0349	P1	Open	WOS, CI	JSON Schema 2020-12 discriminator publication pass (FlowSpec disposition Wave 1 meta-ADOPT, X32). 2020-12 is already declared (`kernel/spec.md:738`); this row is the audit + tighten step. Scan oneOf-by-`type` patterns in published schemas (`wos-workflow.schema.json` post-PLN-0314, runtime artifacts, tooling) and apply 2020-12 `discriminator` keyword where it improves validator error specificity. Anchor pattern: `TransitionEvent` five-kind union in `wos-kernel.schema.json:1561+` (currently oneOf without discriminator). Not a normative behavior change — publication tighten only.	PLN-0314 (schema sketch promotion) for the merged workflow shape; discriminator audit applies post-merge.	ADR 0076	`wos-spec/counter-proposal-disposition.md` X32 row + Wave 1 publication-pass note.	Audit checklist closed; before/after sample validator output captured for each touched union; CI gate proves no validation-shape regression.
PLN-0358	P0	Open	Stack, WOS, Formspec, Trellis, ADR/spec	Author + ratify ADR 0081 (content-addressed artifact identity) — JCS-then-SHA-256 hash binding for all definition-class artifacts. Subsumes FlowSpec §2.1 immutability rule (counter-proposal-disposition H4) — verifiable hashing replaces unenforceable "MUST NOT change" label rule. Extends existing JCS+SHA-256 precedent (`wos-spec/specs/kernel/spec.md:444` `caseFileSnapshot.jcsCanonical` + `sha256`) from determination evidence to definition identity. No separate H4 row opened — it's closed-by-subsumption here.	None — stack-wide architectural ADR; downstream rows (PLN-0359..0364) gate on ratification.	ADR 0081	`thoughts/adr/0081-content-addressed-artifact-identity.md`.	ADR ratified; D-1..D-6 decisions stable; downstream rows reference D-clauses for scope.
PLN-0359	P0	Open	WOS, Schema Additions	Three-segment `*Ref` syntax (`{url}\|{version}\|sha256:{hex}`) in `wos-workflow.schema.json` and sidecar schemas. Hash segment OPTIONAL at L0, MUST at rights-impacting per ADR 0081 D-5 tiering table. Reference parser in `crates/wos-formspec-binding` parses the third segment. Backward-compatible — existing two-segment refs remain valid.	PLN-0358.	ADR 0081	ADR 0081 Implementation plan steps 1 + 4.	Schema/prose updated; parser handles three-segment form; backward-compatibility fixture (two-segment refs still valid) passes.
PLN-0360	P0	Open	Stack, WOS, Trellis	Trellis custody integration: workflow definition content hash flows through `custodyHook` for anchoring per ADR 0072 evidence-binding precedent. Coordinate with Trellis side to add definition-hash event type. WOS emits; Trellis anchors. No new Trellis primitive — existing evidence-anchoring pattern handles it.	PLN-0358, PLN-0359; Trellis-side coordination on event-type addition.	ADR 0081, ADR 0072	ADR 0081 D-6 + Implementation plan step 7.	Trellis adds definition-hash event type; WOS emits it on `caseCreated` and `determination` records; round-trip anchoring fixture passes; cross-stack three-way agreement (WOS spec + Trellis verifier + reference adapter).
PLN-0361	P1	Open	WOS	Lift JCS canonicalization from `wos-spec/crates/wos-core/src/snapshot.rs` into a shared library surface (`wos-canonical` crate or `wos-core::canonicalize` re-export). Same algorithm across `caseFileSnapshot.jcsCanonical`, definition hashing (PLN-0359), and any future content-addressed surface. Avoids per-artifact reimplementation drift.	PLN-0358.	ADR 0081	ADR 0081 Implementation plan step 2.	Library exposes `canonicalize(value: &Value) -> Vec<u8>` + `hash(value: &Value) -> Sha256Hash`; existing `caseFileSnapshot` callers migrate to the shared surface; no behavior change.
PLN-0362	P1	Open	WOS, Schema Additions	Add `definitionContentHash` field to `FactsTierRecord` $defs in `wos-provenance-record.schema.json`. Recorded when a record names a definition artifact (`caseCreated` workflow definition, `determination` workflow definition, `capabilityInvocation` capability declaration, `signatureAffirmation` signature block, service invocation service interface). OPTIONAL initially; REQUIRED when the named artifact's ref carries a hash segment.	PLN-0358, PLN-0359.	ADR 0081	ADR 0081 D-3 + Implementation plan step 3.	Schema/prose updated; positive fixture (hash recorded) + negative fixture (hash mismatch detected at verifier) pass.
PLN-0363	P1	Open	WOS, CI, Conformance	Lint `WOS-CONTENT-HASH-001`: rights-impacting (`impactLevel: rightsImpacting` or `safetyImpacting`) workflows MUST hash-pin all `*Ref` fields per ADR 0081 D-5 tiering table. Warning at non-rights-impacting tier; lint failure at rights-impacting. Conformance class: Kernel Structural (schema-checkable when paired with `impactLevel`).	PLN-0358, PLN-0359.	ADR 0081	ADR 0081 Implementation plan step 5.	Rule registered, matrix updated, fixtures prove accept (hash present at rights-impacting) / reject (hash absent at rights-impacting) / warn (hash absent at non-rights-impacting).
PLN-0364	P1	Open	Conformance	Content-addressing conformance fixtures (gated by PLN-0358..0363): (a) hash matches, mutation produces identical hash; (b) hash mismatch caught at definition load time; (c) JCS canonicalization invariance — reformatted definition produces identical hash; (d) functional change flips hash; (e) provenance round-trip (record → recompute → compare); (f) backward-compatibility (two-segment ref still valid). Three-way agreement: spec + in-memory adapter + Restate adapter.	PLN-0358..0363 ratified shape.	ADR 0081	ADR 0081 Implementation plan step 6.	Passing positive/negative fixtures; three-way agreement holds; CI/conformance gate covers the named path.
PLN-0371	P1	Open	WOS, CI, Conformance	H1 coherence lint between human-task `formSections` (PLN-0373) and ADR-0074 access-class audiences. Every field referenced in a task's `formSections` MUST have at least one access class whose audience (per the deployment's Privacy Profile) includes the assignee role. Lint at authoring (catches task definitions whose visibility promises exceed access-class audiences); runtime gate (catches deployment-time Privacy Profile changes that broke a previously-valid task). Profile-less posture (per ADR-0074 §2 L87 "Conformance without Privacy Profile" precedent): when no Privacy Profile is loaded, the lint is vacuously satisfied; emits an `info` diagnostic noting "no Profile loaded; H1 coherence not enforced." NOT a new role-authorization primitive — derives entirely from ADR-0074's class+audience mapping.	PLN-0373 (task-shape `$defs` for `formSections`); ADR-0074 ratified `accessControl` + Privacy Profile.	ADR-0074, FlowSpec disposition H1	`wos-spec/counter-proposal-disposition.md` §3.4 / §7.2 H1; `thoughts/adr/0074-formspec-native-field-level-transparency.md` §1, §2 (L87 "Conformance without Privacy Profile"), §3.	Lint registered; positive fixture (audience reaches assignee role); negative fixture (task references field whose classes' audiences exclude assignee role — fails); Profile-less posture fixture (info diagnostic emitted, lint passes).
PLN-0372	P1	Open	WOS, Schema Additions	Add `id?` (OPTIONAL string, pattern `^[a-zA-Z][a-zA-Z0-9_-]*$`) to `Transition` $def in `wos-kernel.schema.json`. Make `id` REQUIRED on transitions carrying `tags: ["determination"]`. Mirrors `EscalationStep.id` precedent (`workflow-governance.md:514`). NOT for audit — `caseFileSnapshot` (Kernel §5.4 L444) binds determinations by transition-firing-timestamp + canonical state hash. NOT for routine governance binding — tags are the default attachment surface (`workflow-governance.md:51,186`); transition `id` is the fallback override per Kernel §10.4 L600 ("when tag-based governance is not specific enough"). FOR: tooling stable references (visualizers, lint diagnostics, debugger anchors), author ergonomics, L3 cross-document anchors that exceed tag-set granularity, ADR 0081 hash-pinned (id, version, hash) tuple resolvability down to specific transitions. Greenfield enforcement at `determination` tier converts author goodwill into schema invariant.	None.	FlowSpec disposition S2 + wos-scout reframing 2026-04-27	`wos-spec/counter-proposal-disposition.md` §3.6 S2 row; conversation 2026-04-27 wos-scout findings.	Schema/prose updated; pattern matches `EscalationStep.id`; `additionalProperties: false` discipline preserved; positive fixture (determination with `id`) + negative fixture (determination without `id` rejected) + neutral fixture (non-determination without `id` accepted) all pass.
PLN-0373	P0	Open	WOS, Schema Additions	Pin task-shape `$defs` for surfaces ADR-0080 D-3 names but doesn't schematize: `formSections`, `readOnlyFields` / `editableFields`, structured `actions[]` with `fieldBinding`/`fieldValue`/`confirm`, reveal-on-action `additionalFormSections` + `requiredFields`. Tier: kernel `lifecycle.states[]` task substates (Kernel §5), NOT `TaskPattern` in Governance §9 — task surfaces live in kernel state shape per ADR 0080 D-3:75. Scope:* human task substates only — agent capability surface (`agents[].capabilities[]`) is parallel and bound separately under deontic constraints (`ai-integration.md:154-159, 199-269`). Authoring model: these `$defs` are the canonical authoring path; the processor expands them to underlying Formspec binds at runtime. Authors do not see two paths. Lowering rules: (a) `readOnlyFields` is a task-scoped overlay over Formspec `readonly` bind (Core §369); (b) reveal-on-action `additionalFormSections` is lowered to a `relevant` bind on a task-scoped state variable (Core §367); (c) `editableFields` is the author-side input deriving ADR-0080 `writeScope` (D-6 L110 — `writeScope` is the surface-specific write-scope rule, not the D-3 attachment-points table); (d) `formSections` is a slice/projection over Formspec items by item path, not a parallel grouping primitive; (e) `confirm` is workflow-scoped (no Formspec analog). Interactions: must compose with `assistive` autonomy (which MUST create a confirm-task per `ai-integration.md:342` — declare what populates that confirm-task's surface); compose with `independentFirst` review protocol (`ai-integration.md:536` — agent output MUST be hidden until reviewer assessment recorded; new lint candidate); declare actions ≠ deontic gates (deontic prohibitions fire post-output, not at action invocation, per `ai-integration.md:199-269`). Runtime carriage: extend `wos-core/traits/mod.rs` `TaskPresenter` trait + `FormspecTaskContext` with a `formSections` field so wos-server can emit it via Socket.IO `task:assigned` payload (`wos-server/runtime/presenter.rs:46-53`).	None — defines the substrate that PLN-0371 layers on.	FlowSpec disposition G1 (synthesized from §3.4 ADOPT cluster); ADR 0080 D-3; cross-stack-scout findings 2026-04-27	`wos-spec/counter-proposal-disposition.md` §3.4 ADOPT cluster; `thoughts/adr/0080-governed-output-commit-pipeline.md` D-3 (schema-attachment-points table, L67-83) + D-6 (`writeScope` write-scope rule, L107-115).	Schema/prose updated on kernel state task substate $defs; five lowering-rule clauses present in normative prose; `TaskPresenter` trait + `FormspecTaskContext` carry `formSections`; positive fixtures for each surface; negative fixture for human-only scope (agent capability rejected if it tries the human surface); negative fixture for `independentFirst` ordering violation; negative fixture for action-as-deontic-gate misuse.
PLN-0374	P0	Open	WOS, ADR/spec, Schema	Token-space refactor (greenfield): rename across the spec so each token has exactly one meaning. (1) `BreachPolicy.action: "escalate"` → `"advanceChain"` (`workflow-governance.md:500`); (2) `EscalationStep.onExhaustion: "escalate"` → `"advanceChain"` (`workflow-governance.md:514`); (3) AI fallback + (4) deontic-violation enforcement `escalateToHuman` → `createHumanTask` across `ai-integration.md` (known sites L211, L223, L259, L313, L314, L443, L493, L500 — but rename every literal occurrence; discovery rule is authoritative, not the line list); (5) hold `timeoutAction: "escalate"` → `"advanceChain"` (`workflow-governance.md:623`); (6) reserve task-action `id: "escalate"` for user-initiated chain advance — single canonical home (bare-name namespace per `workflow-governance.md:452`, NOT `$`-prefixed kernel-event namespace). After refactor: `escalate` = exactly one meaning (user-initiated chain advance via task action); `advanceChain` = chain-advance triggered by SLA breach / exhaustion / hold timeout (three triggers, one action); `createHumanTask` = fallback / deontic outcome that creates a new task (two triggers, one action). PLN-0347 fold-in H6 — when NOT to use escalation: authoring guidance prose. Substantively different form sections / actions / routing across reviewer levels → use separate human nodes, not a collapsed `escalationLevels` chain. PLN-0347 fold-in S5 — conditional `transitionTags` (option C): routine SLA-driven escalation carries `transitionTags: ["escalation"]` only — NOT a determination, no delegation enforcement on the new `assignTo`. Cross-assurance-level escalation (assignee crosses an `assurance` boundary, e.g., caseworker → supervisor with stronger attestation per `assurance.md:107`) carries `transitionTags: ["determination", "escalation"]` — delegation enforcement applies (`workflow-governance.md:575,577`), assurance attestation chain step required. Boundary check is lint-decidable from document-level `assurance` block config — no runtime actor lookup needed. Tier scope statement: `escalationLevels` (task-routing presentation-shape) is distinct from Governance §11 delegation (legal-authority statutory transfer); the two compose but are not the same primitive. Provenance shape: S5 reuses existing `stateTransition` recordKind with the conditional tags above + `data: { fromLevel, toLevel, reason }`. NOT a new `recordKind` reservation. Rust internal rename (discovery-rule, not line-list — line numbers drift): rename every `requires_escalation` identifier → `requires_human_task` and every `EscalateToHuman` enum variant → `CreateHumanTask` across `wos-spec/crates/wos-core/src/` (known surfaces span at least `confidence.rs`, `event_handler.rs`, `proxy.rs`, `model/ai.rs`, `deontic.rs` — but treat the grep below as authoritative). Done-evidence check: `grep -rn 'requires_escalation\|EscalateToHuman' wos-spec/crates/wos-core/src/` MUST return zero post-migration.	PLN-0347 (parent escalationLevels ADR); ADR 0080 D-5 reservation pattern; `assurance.md:107` attestation contract.	FlowSpec disposition X34, H6, H7, S5 + wos-scout findings 2026-04-27 + greenfield refactor permission	`wos-spec/counter-proposal-disposition.md` §3.4 ADAPT rows; `wos-spec/counter-proposal.md` §3.4.2; `wos-spec/counter-proposal-extra.md` X34.	All five enum literals renamed in `wos-workflow-governance.schema.json`, `wos-ai-integration.schema.json`, `wos-kernel.schema.json` (hold timeoutAction); spec-prose rename verified by `grep -rn 'escalateToHuman' wos-spec/specs/` returning zero post-migration; Rust `FallbackAction::EscalateToHuman` → `CreateHumanTask` migration verified by `grep -rn 'requires_escalation\|EscalateToHuman' wos-spec/crates/wos-core/src/` returning zero; lint matrix migrated; `requestEscalation` / `escalate` reserved id documented; conditional-tag rule encoded in conformance fixture (one routine-escalation case + one cross-assurance-level case, asserting delegation enforcement fires only on the latter); cross-assurance-level rung pinned in normative prose.
PLN-0375	P0	Open	Formspec, WOS, Schema Additions	Extend `schemas/intake-handoff.schema.json` `definitionRef` shape from `{url, version}` to optionally carry `sha256` (per ADR-0081 D-2 three-segment alignment). Without this, PLN-0371's H1 coherence lint resolves `formSections` against unpinned definitions — defeating ADR 0081's verifiability claim. ADR 0073 D-5 already references `responseHash` but no definition hash; this row closes the parallel gap. Optional at L0; MUST when the source workflow's `impactLevel` is `rightsImpacting`. Cross-stack: Formspec emits the hash when the IntakeHandoff is generated; WOS validates on receipt.	PLN-0359 (three-segment `*Ref` syntax in `wos-workflow.schema.json`); ADR 0073 IntakeHandoff path.	cross-stack-scout findings 2026-04-27; ADR 0081 D-2	`schemas/intake-handoff.schema.json:105`; `thoughts/adr/0073-stack-case-initiation-and-intake-handoff.md:84-97`; `thoughts/adr/0081-content-addressed-artifact-identity.md:80-84`.	Schema updated; positive fixture (rights-impacting workflow with hash-pinned `definitionRef` round-trips); negative fixture (rights-impacting workflow without hash rejected); backward-compatibility fixture (non-rights-impacting two-segment ref still valid).
PLN-0376	P0	Open	Stack, WOS, Trellis, ADR/spec	Register definition-hash carriage event type in Trellis. ADR 0081 D-6 says definition hashes flow through `custodyHook` "per ADR 0072's evidence integrity pattern" — but ADR 0072's `EvidenceAttachmentBinding` is per-attachment with `attachment_sha256` + `payload_content_hash` dual; definition-hash anchoring is a different shape. Decision: either reuse `EvidenceAttachmentBinding` semantics with a definition-class binding (single shape, broader scope) OR register `trellis.definition-hash-binding.v1` as a separate Trellis event type (cleaner type discrimination, more code). Lean: separate event type — definitions and evidence are semantically distinct artifact classes. Coordinate with Trellis-side team to add the registration; without this, ADR 0081 D-6 anchoring is paper-only and the audit-trail integrity claim is unimplementable at the Trellis boundary.	PLN-0358 (ADR 0081 ratified); PLN-0360 (Trellis custody integration coordination row); Trellis-side coordination on event-type registration.	cross-stack-scout findings 2026-04-27; ADR 0081 D-6; ADR 0072 evidence pattern	`thoughts/adr/0081-content-addressed-artifact-identity.md:80-84`; `thoughts/adr/0072-stack-evidence-integrity-and-attachment-binding.md:188-202`; `trellis/specs/` (event-type registration site).	Trellis event type registered (whichever choice); WOS emits definition-hash binding event on `caseCreated` and `determination` records; round-trip anchoring fixture passes; cross-stack three-way agreement (WOS spec + Trellis verifier + reference adapter) holds.
PLN-0377	P0	Open	WOS, ADR/spec, Schema	Kernel as property graph + node-vs-edge reification rule. Two FlowSpec rejects (flat node-graph topology; X33 conditional-routing heuristic) currently sit in `wos-spec/counter-proposal-disposition.md`. Both collapse into one ADR that accepts the underlying instinct — the kernel IS a property graph; hierarchy is one presentation of an underlying triple set — and adds what FlowSpec lacked: a rule for when a relationship promotes to a node. §1 Substrate. Kernel statechart is a property graph. Hierarchical JSON is a JSON-LD frame projection. JSON-LD `@graph` is the canonical wire form. Existing `wos-ontology-alignment` sidecar's `@context` collapses upward into kernel core; SHACL / PROV-O / XES / OCEL export logic stays in the sidecar. §2 Round-trip canonicalization. Byte-stable hierarchical JSON ↔ JSON-LD `@graph` ↔ hierarchical JSON. URDNA2015 for blank-node naming. `@list` containers preserve ordered action sequences (entry / exit / transition). Deterministic IRI minting from authored state names. Canonical frame document published in `wos-spec/specs/kernel/` for unambiguous reverse projection. §3 Reification rule. Promote a relationship to a node when it carries typed properties beyond the relationship itself. Three applied examples: (a) routing branches (X33 collapses here): branch with multiple typed properties differing from siblings — per-branch governance tags, assurance level, deontic constraints, escalation policy, lifecycle hooks — reify as compound substate; branch differing only by guard predicate plus single tag — keep as guarded transition. (b) actors: multi-attribute actor (role + deontic constraints + autonomy cap + identity verification) — typed node; edge participant only — edge property. (c) evidence attachments: attachment with verification metadata — typed node; opaque payload — edge property. §4 Ambiguous-frame negative cases. Frames that cannot deterministically resolve hierarchy from triples produce lint errors with stable diagnostics, not silent re-pickings. NOT a rewrite of kernel §4 prose — additive ADR. Existing §-numbered citations stay valid. Hierarchical view remains the human-reading default; the property-graph form is the machine-reasoning surface (free SHACL validation, SPARQL queryability, OWL entailment over governance-tag inheritance). Replaces: flat-graph reject + X33 reject in `wos-spec/counter-proposal-disposition.md` (rows annotated superseded by ADR-NNNN); SCXML/Harel-derived JSON statechart lineage in `thoughts/adr/0075-rejection-register.md:31` reframes around dual projection (lineage retained, framing reopened).	ADR 0078 (foreach state — must round-trip cleanly in property-graph form); existing `wos-ontology-alignment` sidecar (`@context` absorbs upward); PLN-0373 (task-shape `$defs` must reify cleanly under §3 rule).	conversation 2026-04-27 cross-stack design pass on flat-graph + X33 reframing	`wos-spec/counter-proposal-disposition.md` flat-graph rows (architectural-posture section) + §3.6 X33 row; `wos-spec/wos-ontology-alignment.schema.json`; `thoughts/adr/0075-rejection-register.md:31`.	ADR ratified covering §1 substrate + §2 canonicalization + §3 reification rule with three applied examples + §4 ambiguous-frame discipline; canonical `@context` and frame documents published under `wos-spec/specs/kernel/`; three-way conformance fixture proves byte-stable round-trip on at least three workflow shapes (atomic-only, compound + guards, parallel + foreach + history); negative fixtures for ambiguous frames produce stable lint diagnostics; ADR 0075 reject register entry rewritten to point at the new ADR for flat-graph and X33 disposition; disposition §3.x flat-graph rows + §3.6 X33 row annotated superseded by ADR-NNNN with backreference; SHACL shape exists for at least one governance invariant currently expressed only as English-prose-plus-lint, demonstrating the machine-verification win.
PLN-0268	P1	Open	WOS, Trellis, CI, Conformance	WOS-lint backlog candidate: reject any WOS specification prose or schema comment naming a seam identifier other than the canonical six (`actorExtension`, `contractHook`, `provenanceLayer`, `lifecycleHook`, `custodyHook`, `extensions`). Scope: `wos-spec/specs/` markdown + `$comment` / `description` text in `wos-spec/schemas/`.	No unresolved dependency named.	ADR 0077	ADR 0077 Lint rule candidate.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0275	P1	Open	WOS, CI, Conformance	Dedicated `wos-schema-regression` (or equivalent) GitHub Actions job with path filters for `pytest tests/schemas`. No workflow under `wos-spec/.github` today; parent-repo workflows do not exercise the WOS schema regression suite.	No unresolved dependency named.	WOS audit 2026-04-24	audit verdict 5 (`2026-04-17-wos-schema-regression-tests.md`).	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0277	P1	Open	WOS, CI	Release trains Tasks 4-5: Changesets `fixed` groups, `scripts/wos-publish.mjs`, `.github/workflows/wos-release.yml`, README "Versioning" section. Tasks 1-3 (RELEASE-STREAMS.md, per-stream changelogs, COMPATIBILITY-MATRIX.md) landed.	No unresolved dependency named.	WOS audit 2026-04-24	audit verdict 14 (`2026-04-16-wos-release-trains.md`) + `wos-spec/TODO.md` §4.4.	Automated gate exists and fails on the named regression.
PLN-0279	P1	Open	WOS, Conformance	Promote `K-DET-001` (determination transitions require `caseFileSnapshot`) with evidence map + conformance fixtures. Schema + Rust + runtime + pytest landed; rule + fixture migration not found.	No unresolved dependency named.	WOS audit 2026-04-24	audit verdict 3 (`2026-04-18-wos-facts-tier-input-snapshot.md`).	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0281	P1	Open	WOS, Conformance	`SCHEMA-DOC-001` triage pass: offender list doc, per-tier description backfills, promotion past `draft` with linked fixtures. `schema_doc.rs` + draft rule landed; triage markdown / tier backfills / fixture-linked promotion open.	No unresolved dependency named.	WOS audit 2026-04-24	audit verdict 12 (`2026-04-16-wos-schema-description-audit.md`).	Passing positive/negative fixtures or tests; CI/conformance gate covers the named path.
PLN-0286	P1	Open	WOS	Production `ToolContext` wiring; retire `DirectToolContext` stopgap. Synth crate split + Task 7 schema landed; `DirectToolContext` documented as stopgap.	No unresolved dependency named.	WOS audit 2026-04-24	audit verdict 10 (`2026-04-16-wos-synth-crate.md`).	Schema/prose updated; generated docs/checks pass.
PLN-0287	P1	Open	WOS, CI	Authoring crate helpers: nested-state setters, transition metadata setters, case-field / correspondence APIs per plan. ~27 helpers vs planned 28 with different names; nested-state and some transition-metadata helpers explicitly open.	No unresolved dependency named.	WOS audit 2026-04-24	audit verdict 7 (`2026-04-17-wos-authoring-crate.md`).	Automated gate exists and fails on the named regression.
PLN-0291	P1	Open	WOS	First remaining candidate: `schemas/kernel/wos-correspondence-metadata.schema.json` `templateRef` (lines 117, 175) - resolves to the metadata's own `id`, so this is intra-document `*Id`, not URI. Taxonomy violation.	No unresolved dependency named.	ADR 0060, WOS audit 2026-04-24	audit verdict 22 + cross-ref delta.	Schema/prose updated; generated docs/checks pass.
PLN-0307	P1	Open	WOS, Runtime, CI, Conformance	Close Runtime Companion §15 / Phase 11 processor parity drift in `wos-runtime`: typed rejection surfaces, agent submitter semantics, `ledgerEvidenceMissing` enforcement placement, post-mapping `contractHook` ordering, abandon/skip lifecycle semantics, amendment-task linkage, and conformance matrix. Published MUSTs already describe the behavior; runtime, HTTP, and fixtures must agree.	No unresolved dependency named.	Runtime Companion §15, ADR 0073	`wos-spec/TODO.md` Runtime Companion §15 #66/#66a-#66g + `wos-spec/crates/wos-server/TODO.md` WS-011/WS-075.	Runtime behavior, HTTP surface, conformance fixtures, replay semantics, and parity table converge on the published §15 MUST semantics.
PLN-0276	P1	Open	WOS, CI, Conformance	Land the seeded LoadBearing promotion batch, Kernel-Basic conformance profile LoadBearing declaration, and WOS rule-coverage CI ratchet (`wos-coverage` workflow plus `ratchet-check`). Promotion without a CI gate is unverified; a CI gate without promotions is silent; a profile declaration without wiring is only prose.	No unresolved dependency named.	WOS audit 2026-04-24	audit verdict 13 (`2026-04-16-wos-rule-coverage-conformance.md`) + `wos-spec/TODO.md` Verifiability closure + Kernel-Basic profile LoadBearing declaration.	Promotion set, Kernel-Basic profile declaration, and CI gate all live; promoting or disabling rules without fixture-backed evidence fails CI.
PLN-0187	P2	Open	WOS	Lifecycle Detail §7 (informative SCXML interoperability mapping) -> `specs/kernel/appendix-scxml-mapping.md` (informative).	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0202	P2	Open	WOS	CloudEvents envelope encoding per CloudEvents v1.0.2 -> `docs/adapters/cloudevents.md` (non-normative implementation reference).	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 3.	Document/tracker/archive diff points to canonical source and removes stale signal.
PLN-0204	P2	Open	WOS, CI	Integration §8.1–§8.3, §8.5 (XACML / OPA / Cedar vendor specifics) -> `docs/adapters/policy-engine-bridge.md` (non-normative).	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 7.	Automated gate exists and fails on the named regression.
PLN-0205	P2	Open	WOS	Integration §3.5 (Arazzo sequence), §3.6 (CWL-informed tool) -> `docs/adapters/arazzo.md`, `docs/adapters/cwl-tools.md` (non-normative).	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076	ADR 0076 step 7.	Rule registered, matrix updated, fixtures prove accept/reject behavior.
PLN-0211	P2	Open	WOS	Synchronize WOS kernel abstract seam count from five to six after ADR 0077; no broader kernel prose rewrite.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0077, ADR 0076	ADR 0076 step 9 + ADR 0077 D-5 #4.	`wos-spec/specs/kernel/spec.md` abstract names six canonical seams.
PLN-0212	P2	Open	WOS	Synchronize `wos-kernel.schema.json` description seam count from five to six after ADR 0077; no schema behavior change.	`workflow-consolidation` branch / ADR 0076 sequencing.	ADR 0076, ADR 0077	ADR 0076 step 9 + ADR 0077 D-5 #4.	Schema description names six canonical seams and generated checks pass.
PLN-0262	P2	Open	WOS	Shorten WOS standards-absorption `Do Not Integrate` section to a pointer at ADR 0075 while retaining live absorption-plan sections.	No unresolved dependency named.	ADR 0075	ADR 0075 Implementation plan.	Gap analysis delegates rejection list maintenance to ADR 0075 and keeps only gaps/refactor/priority content locally.
PLN-0278	P2	Open	WOS, CI, Conformance	Build full WOS synthesis benchmark (`wos-bench` crate, leaderboard, multi-problem fixture set) and include the 10-workflow convergence completion criterion.	No unresolved dependency named.	WOS audit 2026-04-24	audit verdict 9 (`2026-04-16-wos-synthesis-benchmark.md`).	Benchmark suite runs multiple workflow problems and reports convergence metrics instead of a single spike problem.
PLN-0285	P2	Open	WOS	Empirical iteration counts via live Anthropic runs (Q-V0-1..4). Spike crate + retrospective + benchmark problem landed; live-API metrics still follow-up.	No unresolved dependency named.	WOS audit 2026-04-24	audit verdict 4 (`2026-04-17-wos-synth-v0-spike.md`).	Named artifact updated; source ADR acceptance criteria remain recoverable from row source.
PLN-0308	P2	Open	Stack, Docs/Governance	Publish a stack-level security disclosure policy now that Trellis has a landed reference implementation and `STACK.md` says disclosure policy is load-bearing. Without a clear intake channel and scope, security reports will route through private conversation instead of a durable governance path.	No unresolved dependency named.	Stack governance	root `TODO.md` "Security disclosure policy" + `STACK.md` security disclosure statement.	Policy location, intake channel, response expectations, scope, and stack-doc links are explicit.
PLN-0309	P2	Open	Stack, CI	Add mechanical lint for seam-touching stack ADRs: ADRs that change Formspec/WOS/Trellis seams must cross-reference counterpart ADRs or explicitly state why no counterpart exists. This prevents one spec from silently redefining a shared seam.	No unresolved dependency named.	Stack governance	root `TODO.md` "Stack-level ADR cross-check lint."	CI check exists and fails on a missing required cross-ADR reference in a seam-touching ADR fixture or test case.
PLN-0331	P0	Open	WOS, Stack	`wos-server-ports` trait crate. Foundation crate declaring `EventStore`, `BlobStore`, `ProcessingService`, `AuthProvider`, `KmsAdapter`, `AuthzService`, `RuntimeOps`, `SeamAccess`, `TimerCoord` traits. No concrete implementations; pure interface. Composes Trellis abstractions where appropriate (`EventStore` consumes `trellis-core` types).	No unresolved dependency named.	wos-server VISION §IV / §VI	`wos-spec/crates/wos-server/VISION.md` Story 2 (ports) + Crate Structure. Execution home: `wos-spec/crates/wos-server/TODO.md` WS-084 (`wos-server-ports` trait crate); WS-088 (layered runtime traits `RuntimeOps` + `SeamAccess` + `TimerCoord`).	Trait crate compiles standalone (`cargo check -p wos-server-ports`); every port has a published trait signature; no concrete adapter imported.
PLN-0332	P0	Partial	WOS, Stack	`wos-server-eventstore-postgres` adapter. Composes `trellis-store-postgres` (canonical events table, hash-chained, signed COSE_Sign1 envelopes per Trellis Phase-1 invariants) plus an in-database `projections` schema (mutable metadata views, rebuildable from events by replay). Plaintext content NEVER lives in projections. Cross-submodule path-dep blocker: see PLN-0368. Trellis-side production hardening landed Wave 16 (2026-04-27): TLS wiring (`postgres-native-tls`, refuses non-loopback DSNs without TLS), transaction-composition surface (`append_event_in_tx(&mut Transaction, ...)` enables single-tx-per-write per VISION.md §VIII), idempotency-key Postgres uniqueness (partial unique index), versioned migrations (advisory-lock-bracketed), parity tests + Postgres CI, `r2d2_postgres` connection pool. Remaining is wos-server-side composition: Cargo path-dep resolution (PLN-0368), CRYPTO_OWNER fence (PLN-0340), then the actual `wos-server-eventstore-postgres` adapter wiring + projection schema + outbox drain. Architectural-correction handle: `wos-spec/crates/wos-server/TODO.md` rows WS-020 + WS-090 currently encode a two-port `Storage` + `AuditSink` split that VISION.md §VIII rejects ("Trellis IS the database; one EventStore port covers both"); reconcile to a single `EventStore` port composing `trellis-store-postgres` for canonical events + an in-DB projections schema, single transaction per write. The Trellis-side seam (`pub fn append_event_in_tx(&mut Transaction, &StoredEvent, Option<&[u8]>)`) is in place; wos-server consumes it.	PLN-0331 (ports trait); PLN-0340 (CRYPTO_OWNER fence); PLN-0368 (path-dep resolution).	wos-server VISION §IV Story 1 + §VI	`wos-spec/crates/wos-server/VISION.md` lines 90–95 + line 116; Trellis Wave 16 in `trellis/COMPLETED.md`. Execution home: `wos-spec/crates/wos-server/TODO.md` WS-020 + WS-090 (reconciliation owed) + WS-093 (Trellis exporter consuming the audit outbox).	Adapter compiles + integration test against running Postgres; round-trip Trellis envelope through canonical schema; projection rebuild from events produces metadata-only view; verifier-independence test (Trellis Core §16) passes; WS-020/WS-090 collapsed to one `EventStore` port.
PLN-0333	P0	Open	WOS, Stack	`wos-server-runtime-restate` adapter. Production runtime implementing `RuntimeOps` + `SeamAccess` + `TimerCoord` layered ports against Restate's durable execution semantics.	PLN-0331 (ports trait).	wos-server VISION §IV Story 2 + ADR 0070 (failure contract)	`wos-spec/crates/wos-server/VISION.md` line 118 + ADR 0070 D-1..D-6. Execution home: `wos-spec/crates/wos-server/TODO.md` WS-094 (Restate `RuntimeAdapter` impl); the in-memory conformance oracle is WS-088 (`wos-server-runtime-local`).	Adapter compiles; integration fixture exercises retry, stall, recovery; conformance fixture passes against in-memory `runtime-local` (WS-088) AND production `runtime-restate` (this row) — three-way agreement (spec + reference + production).
PLN-0334	P0	Open	WOS, Stack	Lead value: wos-server gets a real authorization adapter so the composition root can refuse cross-customer reads at runtime (defends PLN-0007). Detail: `wos-server-authz-openfga` adapter implementing `AuthzService` trait against OpenFGA (Zanzibar-style ReBAC). Adapter is policy-agnostic; single-tenant + multi-tenant policy artifacts ship as separate rows (PLN-0365, PLN-0366).	PLN-0331 (ports trait).	wos-server VISION §IV Story 1 + §VI	`wos-spec/crates/wos-server/VISION.md` lines 99–104 + line 119. Execution home: no current WS-counterpart; flag for wos-server author to add WS- when authz-adapter sequence reaches this work.	Adapter compiles + integration test against running OpenFGA; trait surface stable; adapter accepts policy artifacts loaded from PLN-0365 + PLN-0366 fixtures.
PLN-0365	P0	Open	WOS, Stack	Lead value: the deployer running a single-customer pilot gets a working OpenFGA authorization model out of the box without inventing one. Detail: single-tenant OpenFGA policy bundle — `case`/`task`/`evidence`/`attachment` entities; `applicant`/`caseworker`/`supervisor`/`auditor` user types; no tenant scoping. Reference policy ships in-tree.	PLN-0334 (adapter must accept policy load).	wos-server VISION §IV Story 1	`wos-spec/crates/wos-server/VISION.md` lines 99–104.	Policy bundle ships; integration fixture proves grant/deny matrix for the four user types; example single-tenant deployment loads the bundle.
PLN-0366	P0	Open	WOS, Stack	Lead value: the deployer running a multi-tenant SaaS gets a working multi-tenant authorization model that cannot leak across tenants by accident. Detail: multi-tenant OpenFGA policy bundle — per-tenant scope on every relation; `can_list`/`can_decrypt_class:<class>` relations; depends on tenant-context threading per ADR 0068 + PLN-0001..0009.	PLN-0334 (adapter); PLN-0001..0009 (ADR 0068 tenant context must thread end-to-end at runtime).	ADR 0068 + wos-server VISION §IV Story 1	ADR 0068 + `wos-spec/crates/wos-server/VISION.md` lines 99–104.	Policy bundle ships; integration fixture proves cross-tenant write fails closed (ADR 0068 invariant); two-tenant smoke test proves per-tenant isolation.
PLN-0335	P0	Open	WOS, Stack	`wos-server-identity-webauthn` adapter. Respondent identity via WebAuthn PRF + DID. Used by single-tenant SBA pilot (applicant authentication) and multi-tenant SaaS public-intake (respondent self-service). PRF derivation is crypto-touching → CRYPTO_OWNER fenced.	PLN-0331 (ports trait); PLN-0340 (CRYPTO_OWNER fence).	wos-server VISION §VII (browser-driven reads) + §IV Story 1 (clients decrypt)	`wos-spec/crates/wos-server/VISION.md` line 120 + line 229. Execution home: no current WS-counterpart in `wos-spec/crates/wos-server/TODO.md`; flag for wos-server author to add WS- when identity-adapter sequence reaches this work. (Today's wos-server has bespoke JWT auth at WS-086, not WebAuthn.)	Adapter compiles; WebAuthn registration + PRF-derived key wrap fixture passes; round-trip with `eventstore-postgres` proves wrapped-DEK release path works.
PLN-0336	P0	Open	WOS, Stack	`wos-server-identity-oidc` adapter. Staff identity via OIDC + Verifiable Credentials, multi-provider (e.g., Login.gov for federal-mode caseworker; Auth0/Okta/Google for commercial-mode admin). Supports IAL2/IAL3 per NIST SP 800-63 when provider asserts it.	PLN-0331 (ports trait).	wos-server VISION §VII (CLI / staff identity) + §IV Story 1	`wos-spec/crates/wos-server/VISION.md` line 120 + line 230. Execution home: no current WS-counterpart in `wos-spec/crates/wos-server/TODO.md`; closest is WS-086* (`wos-server-auth-jwt` — bespoke JWT, not OIDC). Flag for wos-server author to add WS-* when identity-adapter sequence reaches OIDC.	Adapter compiles; multi-provider test (mock federal-style + mock commercial-style providers); identity attestation lands in expected normalized shape (per ADR-0072 / future identity attestation contract).
PLN-0337	P0	Open	WOS, Stack	Lead value: an AWS-GovCloud deployment links only the AWS SDK — not Azure, not GCP — keeping the ATO dependency-vuln scope to one cloud's code (4× scope reduction; DevOps review finding). Detail: `wos-server-kms-cloud` adapter implementing `KmsAdapter` with per-cloud Cargo features mutually exclusive (`features = ["aws"]` / `["gcp"]` / `["azure"]`). Wraps DEKs; releases via OpenFGA-authorized server brokerage; KMS-audits every release.	PLN-0331 (ports trait); PLN-0340 (CRYPTO_OWNER fence).	wos-server VISION §IV Story 1 + §VI	`wos-spec/crates/wos-server/VISION.md` line 121 + line 138. Execution home: no current WS-counterpart; flag for wos-server author to add WS- with per-cloud feature isolation as a load-bearing row note.	Adapter compiles per-cloud feature; mock-KMS + one live cloud target gated by env var prove wrap/unwrap round-trip; mutually-exclusive features asserted by build matrix; KMS audit log captures release event with purpose label.
PLN-0338	P0	Open	WOS, Stack	`wos-server-processing-audited` adapter. SBA-mode `ProcessingService` reference implementation: explicit server-side decryption with KMS authorization and ledgered purpose. Returns explicit `kms.unavailable` on KMS outage; never falls back to plaintext path. Default for both single-tenant federal-mode pilots and multi-tenant commercial-mode SaaS deployments (audited-decryption is the SaaS default; stronger postures `processing-tee/fhe/mpc` Trigger via PLN-0356).	PLN-0331 (ports trait); PLN-0337 (kms-cloud); PLN-0340 (CRYPTO_OWNER fence).	wos-server VISION §III (SBA posture) + §IV Story 3 (KMS unavailability invariant)	`wos-spec/crates/wos-server/VISION.md` lines 70 + 122 + 140. Execution home: no current WS-counterpart in `wos-spec/crates/wos-server/TODO.md`; flag for wos-server author to add WS- when ProcessingService-adapter sequence reaches this work.	Adapter compiles; integration fixture exercises authorized-purpose decryption with KMS audit; KMS-unavailability fixture proves explicit error returned, no plaintext fallback, attempt ledgered.
PLN-0339	P0	Open	WOS, Stack, CI	Lead value: `wos-server` becomes an actual deployable binary instead of a workspace of unwired crates. Detail: composition root crate — Axum HTTP, services, ServerConfig wiring, dependency injection that binds adapters to ports at startup. Adapter selection is a feature-flag concern (handled by PLN-0367).	PLN-0331 through PLN-0338, PLN-0345 (adapters + policies must exist before composition can wire them; PLN-0334 transitively covers PLN-0365/0366).	wos-server VISION §VI	`wos-spec/crates/wos-server/VISION.md` line 218 (composition root). Execution home: `wos-spec/crates/wos-server/TODO.md` WS-089 (Cargo feature gating + composition-root tightening).	Composition root crate compiles; smoke test boots with a default adapter set; HTTP routes resolve.
PLN-0367	P0	Open	WOS, Stack, CI	Lead value: the deployer picks one feature flag per axis and gets a working binary tuned to their deployment posture — no manual Cargo edits. Detail: per-configuration × per-posture × per-tenancy Cargo feature bundles in the composition root (three orthogonal axes per VISION §IV: configuration {forms-only / signature-profile-only / adjudication} × trust posture {SBA-audited / Federal-TEE / Federal-FHE / Federal-MPC / Sovereign} × tenancy {shared+RLS / DB-per-tenant / cluster-per-tenant}). Customer wedges (mid-market regulated / SBA pilot / consumer SaaS) sit on top of the matrix per STACK §Positioning.	PLN-0339 (composition root); PLN-0357 (confidential-compute adapter Triggers gate the TEE/FHE/MPC features); PLN-0386 (formspec-server cluster) for configuration-axis features.	wos-server VISION §VI (feature bundles) + VISION §IV three orthogonal axes	`wos-spec/crates/wos-server/VISION.md` lines 211–213; `/VISION.md` §IV. Execution home: `wos-spec/crates/wos-server/TODO.md` WS-089 covers existing adapter features; full three-axis matrix needs a WS-* note when added.	Build matrix proves every advertised combination compiles; runtime smoke test per shipped combination; deployment guide enumerates the supported feature bundles across all three axes.
PLN-0340	P0	Open	WOS, Stack, CI	`CRYPTO_OWNER` dep-fence for the wos-server Rust workspace. Mirrors ADR-0074's `formspec-bucketing` precedent (also pending). Only `eventstore-postgres`, all `kms-`, `processing-audited`, `identity-webauthn` may import crypto libraries. HTTP handlers, services, runtime adapters, and composition root MUST NOT import crypto directly. The dep graph is the security boundary. Lives in `wos-spec/scripts/`* (not parent `scripts/check-dep-fences.mjs`, which is npm-only). Precondition: a Rust workspace dep-fence checker tool must exist (parent's npm fence script can't analyze Cargo workspaces) — flag for wos-server author.	No unresolved dependency named; gates PLN-0332/0335/0337/0338.	wos-server VISION §IV Story 3 (Crypto is fenced)	`wos-spec/crates/wos-server/VISION.md` line 132. Execution home: no current WS-counterpart in `wos-spec/crates/wos-server/TODO.md`; flag for wos-server author to add TWO WS- rows: (a) Rust workspace dep-fence checker tool, (b) CRYPTO_OWNER fence rules registered against (a).	Fence checker tool exists in `wos-spec/scripts/`; CRYPTO_OWNER rule registered; CI check fails when a non-allow-listed crate imports a crypto library; deliberately-introduced violation in a non-CRYPTO_OWNER crate fails CI.
PLN-0341	P0	Open	WOS, Stack, CI	CI ratchet: `cargo check -p wos-server --no-default-features` proves the composition root needs no concrete adapter to compile (only ports). Establishes that adapter selection is a pure feature-flag concern; no hidden adapter dep leaks into the composition root.	PLN-0331 (ports trait); PLN-0339 (composition root must exist).	wos-server VISION §VI (CI ratchets)	`wos-spec/crates/wos-server/VISION.md` line 217. Execution home: `wos-spec/crates/wos-server/TODO.md` WS-089 (Cargo feature gating + composition-root tightening — covers the `--no-default-features` ratchet).	CI gate exists; deletion of any adapter dep from `wos-server` Cargo.toml leaves `--no-default-features` build green; addition of any adapter dep without feature flag fails the gate.
PLN-0345	P0	Open	WOS, Stack	`wos-server-blobstore-s3` adapter. S3-compatible blob storage for evidence attachments + content-addressed blobs (covers AWS S3, MinIO, AWS GovCloud S3 via region/partition config). Required by both single-tenant federal-mode pilots (rights-impacting evidence: pay stubs, ID photos) and multi-tenant commercial-mode SaaS (form file-upload fields). Azure Gov / Oracle Gov are not S3-compatible at protocol level — defer to per-platform adapter rows when those deployment targets surface.	PLN-0331 (ports trait).	wos-server VISION §IV Story 2 + ADR 0072 (evidence integrity)	`wos-spec/crates/wos-server/VISION.md` line 117 + ADR 0072. Execution home: no current WS-counterpart in `wos-spec/crates/wos-server/TODO.md`; flag for wos-server author to add WS- when blobstore-adapter sequence reaches this work.	Adapter compiles; round-trip blob upload/download test against MinIO test instance; content-addressed hash binding integrates with `eventstore-postgres` evidence-attachment events per ADR 0072; AWS GovCloud region/partition test passes.
PLN-0346	P0	Open	Formspec, ADR/spec	Dual-adopter coherence guarantee: empty/`unclassified`-default Privacy Profile is conformant; flat Response is the default wire shape; bucketed Response is opt-in via Profile presence. Defends the dual-adopter promise so commercial-mode (SaaS) users don't pay federal-mode (Privacy Profile + bucketing) tax (ADR-0074 §VI binding). MVP ships flat-only; bucketed wire is Trigger-gated per cluster lean.	PLN-0343 (Privacy Profile spec stub).	ADR-0074	ADR-0074 §3 (Privacy Profile optional) + §6 (Phase-5 emission no-op when no Profile loaded) + cluster header lean statement.	Conformance fixture: deployment with no Profile loaded produces flat Response identical to pre-version-bump Formspec; deployment with empty Profile is equivalent; only deployment with non-empty Profile triggers bucketed shape (Trigger-gated, not in MVP scope).
PLN-0368	P0	Open	Stack, WOS, Trellis	Cross-submodule Cargo path-dep resolution: decide whether `trellis-*` crates publish to a registry (e.g., crates.io with `0.x` series) OR are vendored into wos-spec OR are consumed via relative `path = "../../trellis/crates/..."` (current implicit assumption). Stack-level decision; affects every wos-server adapter that composes Trellis crates (PLN-0332 et al.). Relative paths across submodules break when wos-spec is checked out independently of formspec; current MVP architecture (VISION.md §III "Trellis is our work") silently assumes composition works.	No unresolved dependency named; gates PLN-0332 and any wos-server crate composing Trellis.	VISION.md §III; ADR 0064 (granularity)	`/VISION.md` §III "Trellis is our work — we ship it"; `wos-spec/crates/wos-server/VISION.md` §VI (composition note). Execution home: decision authoring is parent-stack work (PLANNING.md row); adoption rolls into `wos-spec/crates/wos-server/TODO.md` WS-020/WS-090/WS-093 once the pattern is fixed.	One of three options selected and documented in VISION.md or stack ADR; all wos-server adapter crates use the chosen pattern; standalone-checkout-of-wos-spec build instructions reflect the choice.
PLN-0369	P0	Open	Stack, WOS, ADR/spec	"Isolation topology" axis decision (renamed per VISION §IV: shared+RLS / DB-per-tenant / cluster-per-tenant). Independent from configuration and trust-posture axes. Per-tenant Postgres vs schema-per-tenant for multi-tenant deployments. VISION.md commits to a per-tenant DB default — operationally tractable at hundreds of tenants; at 1,000+ either RDS-cost-prohibitive or violates the per-DB commitment. Resolve in VISION.md before storage rows freeze: amend to permit schema-per-tenant on shared DB for commercial-mode multi-tenant deployments (with explicit tradeoff statement) OR cap multi-tenant tenant count and Trigger-gate larger deployments. Cross-references ADR 0068 tenant-context threading.	No unresolved dependency named; affects PLN-0332 (eventstore-postgres) and PLN-0334 (multi-tenant authz policy).	ADR 0068, VISION.md §IV three orthogonal axes	`/VISION.md` §IV (isolation topology axis); `wos-spec/crates/wos-server/VISION.md` Story 1. Execution home: decision authoring is parent-stack work (PLANNING.md row + VISION.md amendment); EventStore impl reflects choice in `wos-spec/crates/wos-server/TODO.md` WS-020.	VISION.md amended with explicit isolation-topology choice + tradeoff statement; PLN-0332 and PLN-0334 reflect the chosen pattern; conformance fixture asserts cross-tenant isolation under the chosen pattern.
PLN-0370	P0	Open	Stack, Marketing	Marketing-claim reframe: "Free DocuSign via our ledger" (VISION.md §II Q1, STACK.md §II) → "cryptographically-verifiable signature ledger." First framing is claim-ahead-of-compliance — ESIGN/UETA compliance gate (PLN-0355 Trigger) hasn't landed; FTC §5 deception risk if marketed as DocuSign equivalent without certificate-of-completion + consumer-consent flow + record-retention UX. Second framing is true and defensible without the ESIGN gate. ESIGN gate stays Trigger when actual signature flows ship. Path back to original DocuSign-100%-parity framing once landed: PLN-0380 (signature.md spec extension — URI registry + signer-authority + §1.3 reopen) + PLN-0398 (admin surface). Reframe holds the line until both close + counsel review (PLN-0355) clears.	No unresolved dependency named; PLN-0355 (ESIGN Trigger), PLN-0380 (signature.md extension), PLN-0398 (admin surface) track the compliance + spec work that would re-enable the original claim.	gov-OSS-SaaS review 2026-04-27	STACK.md §Open contracts (signature attestation; certificate-of-completion is open work); `/VISION.md` §II Q1 + §X DocuSign 100% parity bar. Execution home: parent-stack doc edits (VISION.md + STACK.md).	VISION.md §II Q1 reads "cryptographically-verifiable signature ledger" (not "free DocuSign"); STACK.md §II reads same; no other public doc carries the original framing; reverse path documented to lift reframe when PLN-0380 + PLN-0398 + PLN-0355 close.
PLN-0379	P0	In-Progress	Trellis, Stack, ADR/spec	Trellis ADR 0010 — user-content Attestation primitive. ADR Accepted 2026-04-28 (trellis SHA `b1b23ce`); implementation train in flight. CDDL §28 entry; new §9.8 domain-separation tag `trellis-user-content-attestation-v1`; chain-position binding to host event; IdentityAttestation reference; `signing_intent` as URI (Trellis owns bytes, WOS owns meaning per PLN-0380). Distinct from Companion §A.5 operator-actor Attestation. Mirrors ADR 0007 precedent: ~265 lines, 11 fixture vectors, 9-step verifier obligations.	Composes with PLN-0380 (URI registry, WOS-side); coordinates with G-5 stranger gate.	Trellis ADR 0010 Accepted; impl train in flight	`/VISION.md` §V center commitments. Execution home: `trellis/thoughts/adr/0010-*.md` + `trellis/specs/trellis-core.md` + `trellis/crates/trellis-verify/`.	ADR Accepted ✓; CDDL + tag + 11 fixture vectors land; G-5 stranger gate extension passes; verifier-obligation update merged.
PLN-0380	P0	Open	WOS, ADR/spec, Schema	Extend `wos-spec/specs/profiles/signature.md` with three additions: (1) signing-intent URI registry (URI populates Formspec `authoredSignatures` field per Core S2.1.6 — does NOT replace it); (2) signer-authority claim shape (capacity-to-bind, distinct from §2.6 authentication-method); (3) reopen §1.3 scope carve-out for ESIGN/UETA/eIDAS posture mapping (explicit prose edit + ratification, not a pending confirmation). Composes with PLN-0379 — WOS owns meaning, Trellis owns URI bytes.	PLN-0379 (Trellis side); PLN-0384 (taxonomy ratification of `wos.signing.*`).	WOS Signature Profile (signature.md §1.3, §2.5, §2.6)	`/VISION.md` §X "DocuSign 100% parity bar"; STACK §Open contracts.	§1.3 reopened; URI registry added; signer-authority claim shape specified; cross-stack fixture covers URI propagation Formspec→WOS→Trellis.
PLN-0381	P0	Open	Stack, WOS, Formspec, Trellis, ADR/spec	Author parent-repo stack ADR for identity attestation (pick next free number — check `ls thoughts/adr/`). `IdentityAttestation` shape; proposed `wos.identity.` event taxonomy ratification (gates on PLN-0384); claim graph distinguishing authentication-method strength from signer-authority claim (per PLN-0380); composes with existing Respondent Ledger §6.6 per-event identity-attestation shape. Closes the third event-shape gap in STACK §Open contracts. Supersedes PLN-0310* (synthesis upgrades from Trigger to center commitment).	PLN-0384 (event taxonomy); coordinates with PLN-0380 (claim shape).	New parent-repo stack ADR	STACK §Open contracts / Identity attestation shape; `/VISION.md` §V "Open contracts decompose"; §VI three planes.	ADR ratified; schema lands; cross-stack fixtures (Formspec → WOS provenance → Trellis envelope) prove identity claim composes; PLN-0310 closed-by-supersession with backreference.
PLN-0382	P0	Open	Stack, WOS, Formspec, Trellis, ADR/spec	Author parent-repo stack ADR for external-recipient lifecycle. Privacy Profile registers external systems as per-class recipients; ledgered `wos.governance.access-granted` / `wos.governance.access-revoked` events; recipient-rotation rule (per-event scope: past events keep existing key_bag immutably; future events scoped to current recipients). Companion clarification: explicit matrix entry over Core §6.4 + §9.4 + §25.6 + §8.6 `LedgerServiceWrapEntry` re-wrap semantics. Closes "External recipient lifecycle" center commitment in VISION §V.	PLN-0384 (event taxonomy ratification); ADR-0074 cluster.	New parent-repo stack ADR	`/VISION.md` §V/§VI "Recipient rotation"; STACK §Open contracts.	ADR ratified; Privacy Profile schema accepts recipient registration; cross-stack fixture proves rotation across two events.
PLN-0383	P0	Open	Trellis, ADR/spec, CI	AEAD nonce determinism on retry — Trellis Core §9.4 + §17 prose addition + fixture. Pin nonce derivation rule (e.g., `nonce = HKDF(authored_event_bytes \|\| idempotency_key)`) so same-key + same-authored-bytes retry yields byte-identical canonical event. Without this, Core §17 `IdempotencyKeyPayloadMismatch` fires for what is structurally the same authored fact. Either deterministic nonce derivation (preferred) or explicit operator obligation to memoize ciphertext per `idempotency_key`. Real spec gap; not absorption.	None blocking.	Trellis Core §9.4, §17 amendment	`/VISION.md` §XI active uncertainty "AEAD nonce determinism on retry".	Core §9.4 prose pinned; fixture vector `append/0XX-aead-retry-determinism` proves byte-identity on retry; Rust + Python parity holds; G-5 verifier accepts.
PLN-0384	P0	Open	WOS, ADR/spec, Schema, Conformance	Author `wos-spec/specs/audit/wos-event-types.md` ratifying namespace taxonomy. Existing namespaces (`wos.kernel.`, `wos.governance.`, `wos.ai.`, `wos.assurance.` per `custody-hook-encoding.md:315`) plus proposed additions: `wos.signing.`, `wos.identity.`, `wos.governance.access-granted`, `wos.governance.access-revoked`, `wos.governance.legal-hold-applied`. None currently in spec as named. Companion §25.1 OC-115 ("Grants and Revocations Are Canonical") + Trellis Core §23.4 disjoint-namespace rule constrain placement. Single highest-leverage row in stack closure cluster — gates PLN-0380/0381/0382 namespace citations.	None blocking; gates downstream rows.	New WOS spec doc	`/VISION.md` §VI "Case Ledger composition + WOS event taxonomy"; §V Lifecycle table.	`wos-event-types.md` published; each family normatively defined with payload schema; namespace-disjoint property tested by conformance fixture; lint blocks unregistered `wos..` event types in fixtures; Trellis Core §23.4 rule enforced.
PLN-0385	P0	Done	WOS, Trellis, Stack, ADR/spec	Closed Wave 27 (2026-04-29, wos-spec SHA `3497a1b` + trellis SHA `4e4b3ee`). Pinned `wos-spec/specs/kernel/custody-hook-encoding.md` as normative companion at v1.0 status (was `1.0.0-draft.1`/`draft`, now `1.0.0`/`accepted`). Four-field append wire surface per ADR-0061 §2.3: `caseId` / `recordId` / `eventType` / `record` (NOT the original PLN-0385 prose `tag` / `payload` / `prior_event_hash` / `producer_signature` — `producer_signature` is a phantom field appearing in zero specs / crates / schemas / fixtures; envelope-level `prior_event_hash` is Trellis Core §10.2 and producer signing is COSE_Sign1 around the envelope, both at the layer above the WOS-authored-record surface, conflated by the original prose). TypeID rules + JSON→dCBOR conversion + cross-stack ingestion fixture (`append/010-wos-custody-hook-state-transition`) + verifier round-trip (`cargo nextest run -p trellis-conformance`) all bound in companion §3.4 / §3.5.	None blocking.	Existing companion document → v1.0 status	`/VISION.md` §V "custody-hook-encoding.md (Kernel §10.5 companion)"; §VI Custody seam.	Companion at v1.0 status ✓; cited from Kernel §10.5 + Trellis Core §22 (RL composition); cross-stack fixture corpus (`append/010` + siblings `019-022`) bound in §3.4.
PLN-0386	P0	Open	Stack, Formspec, ADR/spec	Establish `formspec-server` reference backend Rust crate cluster. Six ports per VISION §III: authoring / runtime / intake / ledger emission / signature-capture / send-for-signature / auth (eight with composition root). Mirrors `wos-server` pattern: ports trait crate + adapter crates + composition root + per-deployment-config Cargo features. Listed ports are product/operational concerns of the reference backend, NOT Formspec center semantics — same Formspec center can be hosted by other backends (Django reference, embedded engines).	PLN-0368 (path-dep); coordinate with `wos-server` cluster (PLN-0331..0341, 0367) for shared adapter patterns.	New crate cluster	`/VISION.md` §III "Server topology — formspec-server". Execution home: new `formspec-server/TODO.md` (to be created).	`formspec-server/TODO.md` authored as first deliverable (mirrors `wos-spec/crates/wos-server/TODO.md` WS-* sequencing pattern); ports trait crate compiles; one adapter per port lands in dependency-ordered sequence; `forms-only` and `signature-profile-only` deployment configurations boot end-to-end; intake port emits IntakeHandoff per ADR 0073.
PLN-0387	P0	Open	WOS, Stack	`wos-server-eventstore-embedded` adapter — sibling to `trellis-store-postgres` and `trellis-store-memory`; lives in `wos-spec/crates/`, NOT in `trellis/`. Single-process EventStore for `signature-profile-only` and `forms-only` deployments where wos-server collocates with formspec-server. Composes Trellis envelope semantics without requiring Postgres backend at embedded posture. Cross-stack-scout's recommendation replacing the dropped `wos-signature-emit` synthesis proposal.	PLN-0331 (ports trait); PLN-0368 (path-dep); coordinate Trellis byte authority.	wos-server VISION (sibling adapter)	`/VISION.md` §III "Crate clusters" — `wos-server-eventstore-embedded` sibling. Execution home: `wos-spec/crates/wos-server/TODO.md` (add WS-* under EventStore-adapter sequence).	Adapter compiles; round-trip Trellis envelope through embedded backing; fixtures match `eventstore-postgres` byte output for same authored event; build matrix proves both adapters wire under PLN-0367.
PLN-0388	P0	Open	Stack, Formspec, ADR/spec, CI	`agent-sdk` peer crate. Provider routing (Claude, Bedrock, OpenAI, local), conversation state, tool-use protocol. Consumes class-aware policy (Privacy Profile + recipient-class allowlists per ADR-0074 §4 + §6 MIP-context) but MUST NOT hold DEKs or perform decryption — receives plaintext only after calling code has decrypted in client or declared `ProcessingService` boundary. Default no-training/no-retention configuration on every provider; every AI feature declares degradation mode (per "core workflow integrity outranks AI convenience" principle). Includes CRYPTO_OWNER fence extension (mirrors PLN-0340 for wos-server): agent-sdk MUST NOT import crypto libraries (`aws-lc-rs`, `ring`, `chacha20poly1305`, `hpke`, `cose`); CI fails if it does.	PLN-0386 (formspec-server cluster — agent-sdk peer to it); PLN-0331 (`ProcessingService` port shape).	New crate cluster	`/VISION.md` §III "agent-sdk (peer crate)"; §VI "agent-sdk structural boundary".	Crate compiles; provider-routing tests per provider; class-aware policy consumption fixture proves recipient-class allowlist enforcement; CRYPTO_OWNER fence rejects deliberate crypto import (negative test); structural test proves agent-sdk has no path to DEK access.
PLN-0389	P0	Open	Stack, SaaS Platform, ADR/spec	Ratify three-app frontend split for 1.0: Studio (staff form authoring + AI-assist + response browser, all configurations) + Caseworker (review queue, independent-first protocol UI, decision surfaces; adjudication-only) + Admin (tenant ops, key/KMS config, posture, audit log; enterprise deployments). Replaces previous single-app assumption. Trade: more deployment surface; less per-app feature-flag burden. Independent-first protocol UI structurally requires UX separation per WOS Governance §4.1 `independentFirst` — interface mustn't reveal AI output until human commits independent judgment.	PLN-0386 (formspec-server cluster — frontends consume its ports).	New ADR or VISION-pinned reference	`/VISION.md` §III "Frontend surfaces".	ADR ratified or VISION amendment merged; three app skeletons exist with distinct dependency manifests; cross-app shared component library named; Caseworker app has structural test proving AI output cannot render before independent-judgment commit.
PLN-0390	P1	Open	Formspec, Trellis, Stack, ADR/spec	Add Respondent Ledger §10 (or new "cross-plane references" section) defining referential-integrity contract for `subjectRef` / `eventHash` / `attestation_id` / `ledgerHeadRef` / `responseId` shared across Response ⊥ Audit ⊥ Identity planes. RL §6.7/§6.8/§2.2/§6.6A keep three concerns decoupled but no spec section normatively defines integrity contract for shared keys. Cross-stack fixture proves verifier rejects mismatched cross-plane references. Drift-prevention guard per synthesis soft-spot #6.	None blocking.	Respondent Ledger spec amendment	`/VISION.md` §VI "Three planes"; synthesis soft-spot #6 archived at `thoughts/archive/specs/2026-04-27-architecture-synthesis-corrected.md`.	RL §10 (or new section) Draft → Stable; cross-stack fixture in shared bundle rejects cross-plane reference mismatch.
PLN-0391	P2	Open	Stack, ADR/spec, CI	IntakeHandoff transport-orthogonal guard. Amend ADR 0073 with explicit prose: "IntakeHandoff is a typed artifact (schema-backed); transport (gRPC over wire / in-process Rust trait / HTTP) is orthogonal to seam shape." Conformance fixture: same artifact crosses two transports, byte-identical. Lint rule rejects transport-as-seam reframing (e.g., gRPC contract treated as authoritative over `intake-handoff.schema.json`). Drift-prevention guard preserving the artifact-vs-transport distinction.	None blocking.	ADR 0073 amendment	`/VISION.md` §III "API surface — Inter-server"; synthesis r3 fix (i) archived at `thoughts/archive/specs/2026-04-27-architecture-synthesis-corrected.md`.	ADR 0073 amended; lint rule registered; cross-transport fixture in shared bundle proves byte-identity.

Semantic Spec/ADR Edits and Review Cleanup

ID	Imp×Debt	Status	Owner/layer	Work item	Depends on	Source ADR	Source pointer	Evidence required for done
PLN-0008	P2	Open	Stack, ADR/spec	Define tenant isolation as a mandatory substrate boundary across store/query/cache/queue/export paths, and publish non-transferable authorization invariants proving grants cannot cross tenant boundaries.	Relevant Spec/ADR question rows must be answered first when the edit encodes disputed semantics.	ADR 0068	ADR 0068 D-1 ("substrate boundary") + D-3 (authorization invariants hardening).	Spec/ADR/review artifact reflects answered semantics and preserves source-linked rationale.
PLN-0014	P2	Done	Stack, ADR/spec	Merged into PLN-0008: tenant boundary hardening and non-transferable authorization invariants are tracked as one canonical ADR 0068 semantic edit row.	No active decision remains; retained only as closed-history context.	ADR 0068	ADR 0068 D-1 + D-3 hardening.	Closed row is not in the active semantic queue; canonical row or source ADR carries remaining work.
PLN-0066	P2	Done	ADR/spec	No-op closure: duplicate of PLN-0127. Keep one canonical ADR 0072 D-2 normalized-removal hardening row to avoid split ownership.	Superseded by canonical duplicate resolution; no unresolved dependency named.	ADR 0072	ADR 0072 D-2 premise review hardening; canonical work tracked in PLN-0127.	Duplicate row is explicitly closed as superseded so it does not recur as false-open semantic work.
PLN-0071	P2	Open	Formspec, ADR/spec	Remove dual naming drift at the seam (`CaseInitiationRequest` alias) and keep `IntakeHandoff` as the single canonical contract term.	Relevant Spec/ADR question rows must be answered first when the edit encodes disputed semantics.	ADR 0073	ADR 0073 D-3 + premise review proposed change.	Spec/ADR/review artifact reflects answered semantics and preserves source-linked rationale.
PLN-0120	P2	Open	WOS, Trellis, Formspec, ADR/spec	ADR 0066 follow-up edit pass (umbrella). Bundle of three small text edits to ADR 0066 to harden its premises: (a) publish a compact mode-to-layer ownership matrix for `reason`, `authorization`, and hash-reference locus, distinguishing respondent-visible vs governance-only acts (was PLN-0120); (b) tighten verifier-boundary wording so Trellis correction-preservation is reporting/projection semantics, not Formspec mutation authority (was PLN-0121); (c) add phase-closure checklist with fixture/verifier evidence requirements for Phase 1 and Phase 4 before status advancement (was PLN-0122). Avoid broader doctrine rewrite.	Relevant ADR 0066 Spec/ADR question rows must be answered first when an edit encodes disputed semantics.	ADR 0066	ADR 0066 D-1/D-2/D-3 + implementation plan + premise review hardening.	ADR 0066 text incorporates the three edits; ownership matrix, verifier-boundary distinction, and phase-closure checklist all present.
PLN-0121	P2	Done	Formspec, Trellis, CI, ADR/spec	Merged into PLN-0120: tighten ADR 0066 verifier-boundary wording is item (b) in the umbrella ADR 0066 follow-up edit pass.	No active implementation remains in this row.	ADR 0066	PLN-0120.	Closed row is not in the active queue; canonical row PLN-0120 carries the work.
PLN-0122	P2	Done	WOS, Trellis, CI, Conformance, ADR/spec	Merged into PLN-0120: ADR 0066 phase-closure checklist is item (c) in the umbrella ADR 0066 follow-up edit pass.	No active implementation remains in this row.	ADR 0066	PLN-0120.	Closed row is not in the active queue; canonical row PLN-0120 carries the work.
PLN-0123	P2	Open	ADR/spec	ADR 0071 follow-up edit pass (umbrella). Bundle of two small text edits to ADR 0071 to harden replay determinism: (a) define a minimum viable semantics-library lifecycle policy for the current release horizon — retention floor, signing/provenance requirement, security deprecation handling — with explicit deferment of full long-horizon policy until post-landing evidence (was PLN-0123); (b) expand the determinism contract beyond version strings by identifying and pinning or sealing non-version inputs that can alter replay outcomes — policy packs, reference data, locale/ruleset inputs, feature flags (was PLN-0124).	Relevant ADR 0071 Spec/ADR question rows must be answered first when an edit encodes disputed semantics.	ADR 0071	ADR 0071 D-2/D-3 + replay guarantee premise hardening.	ADR 0071 text incorporates the two edits; semantics-library lifecycle policy and expanded determinism input list both present.
PLN-0124	P2	Done	ADR/spec	Merged into PLN-0123: expand determinism contract beyond version strings is item (b) in the umbrella ADR 0071 follow-up edit pass.	No active implementation remains in this row.	ADR 0071	PLN-0123.	Closed row is not in the active queue; canonical row PLN-0123 carries the work.
PLN-0127	P2	Open	ADR/spec	ADR 0072: consider a minimal normalized removal reference contract to improve cross-origin audit tooling without centralizing origin lifecycle types.	Relevant Spec/ADR question rows must be answered first when the edit encodes disputed semantics.	ADR 0072	ADR 0072 D-2 premise review hardening.	Spec/ADR/review artifact reflects answered semantics and preserves source-linked rationale.
PLN-0129	P2	Done	CI, ADR/spec	No-op closure: ADR 0073 contract-authority vs closure semantics are already documented; active work remains evidence execution only.	No active decision remains; retained only as closed-history context.	ADR 0073	ADR 0073 Context/Decision + implementation status.	Closed row is not in the active semantic queue; canonical row or source ADR carries remaining work.
PLN-0145	P2	Open	WOS, CI, Conformance, ADR/spec	ADR 0064 follow-up edit pass (umbrella). Bundle of five small text edits to ADR 0064 (architecture-review handoff): (a) declare schema counts illustrative; make method-centric language normative; add count-drift policy (was PLN-0145); (b) add Revisit Rubric mapping each D-* decision to trigger evidence, decision owner, and update path (was PLN-0146); (c) for D-3, state extension posture as "named first-class sidecars + typed extension path" — avoid false binary (was PLN-0147); (d) D-4 post-decision: encode chosen drift-surveillance posture as required/optional language when companion-drift evidence makes the choice useful (was PLN-0148; trigger-conditional on PLN-0144); (e) define ADR 0064 closure evidence across docs, lint matrix, fixtures, CI gates (was PLN-0149).	(d) is gated by PLN-0144; otherwise none.	ADR 0064	ADR 0064 D-1/D-3/D-4/Consequences + governance hardening + premise review.	ADR 0064 text incorporates all five edits; closure evidence cross-referenced from trackers without duplication.
PLN-0146	P2	Done	WOS, CI, ADR/spec	Merged into PLN-0145: Revisit Rubric is item (b) in the umbrella ADR 0064 follow-up edit pass.	No active implementation remains in this row.	ADR 0064	PLN-0145.	Closed row is not in the active queue; canonical row PLN-0145 carries the work.
PLN-0147	P2	Done	WOS, CI, ADR/spec	Merged into PLN-0145: D-3 extension posture is item (c) in the umbrella ADR 0064 follow-up edit pass.	No active implementation remains in this row.	ADR 0064	PLN-0145.	Closed row is not in the active queue; canonical row PLN-0145 carries the work.
PLN-0148	P2	Done	WOS, CI, ADR/spec	Merged into PLN-0145: D-4 drift-surveillance posture is item (d) in the umbrella ADR 0064 follow-up edit pass (trigger-conditional on PLN-0144).	No active implementation remains in this row.	ADR 0064	PLN-0145.	Closed row is not in the active queue; canonical row PLN-0145 carries the work.
PLN-0149	P2	Done	WOS, CI, Conformance, ADR/spec	Merged into PLN-0145: ADR 0064 closure evidence is item (e) in the umbrella ADR 0064 follow-up edit pass.	No active implementation remains in this row.	ADR 0064	PLN-0145.	Closed row is not in the active queue; canonical row PLN-0145 carries the work.
PLN-0171	P2	Open	WOS, Trellis, CI, ADR/spec	ADR 0067 follow-up edit pass (umbrella). Bundle of four small text edits to ADR 0067 (statutory clocks): (a) separate immutable core contract ("deadline semantics are center, timers are adapters") from profile-adjustable policy defaults (was PLN-0171); (b) explicit ownership/arbitration rule for dual-origin StatuteClock emission so one legal trigger cannot create ambiguous parallel authorities (was PLN-0172); (c) define residual-duration calculation and rounding/canonicalization rules for pause/resume segments (was PLN-0173); (d) explicit governance-reaction matrix for expired-unresolved advisories with baseline required reaction + optional escalation tiers (was PLN-0174).	PLN-0151 + ADR 0067 open-question rows (PLN-0166, PLN-0167, PLN-0168) must close first.	ADR 0067	ADR 0067 D-2/D-3/D-4 + premise review hardening.	ADR 0067 text incorporates all four edits; replay determinism, dual-origin arbitration, residual-duration math, and reaction matrix all present.
PLN-0172	P2	Done	CI, ADR/spec	Merged into PLN-0171: dual-origin StatuteClock arbitration is item (b) in the umbrella ADR 0067 follow-up edit pass.	No active implementation remains in this row.	ADR 0067	PLN-0171.	Closed row is not in the active queue; canonical row PLN-0171 carries the work.
PLN-0173	P2	Done	ADR/spec	Merged into PLN-0171: pause/resume residual-duration math is item (c) in the umbrella ADR 0067 follow-up edit pass.	No active implementation remains in this row.	ADR 0067	PLN-0171.	Closed row is not in the active queue; canonical row PLN-0171 carries the work.
PLN-0174	P2	Done	WOS, Trellis, ADR/spec	Merged into PLN-0171: governance-reaction matrix for expired-unresolved advisories is item (d) in the umbrella ADR 0067 follow-up edit pass.	No active implementation remains in this row.	ADR 0067	PLN-0171.	Closed row is not in the active queue; canonical row PLN-0171 carries the work.
PLN-0175	P2	Done	CI, ADR/spec	No-op closure: standalone taxonomy-boundary hardening absorbed into PLN-0153 acceptance criteria (`Clock` schema + `x-*` extension posture).	No active decision remains; retained only as closed-history context.	ADR 0067	ADR 0067 Decision section hardening.	Closed row is not in the active semantic queue; canonical row or source ADR carries remaining work.

Safe Clerical Edits and Review Cleanup

ID	Imp×Debt	Status	Owner/layer	Work item	Depends on	Source ADR	Source pointer	Evidence required for done
PLN-0017	P2	Open	Stack, CI, ADR/spec	Collapse ADR 0071 dependency bookkeeping into the source ADR so `CaseOpenPin`, historical semantics, supersession pins, downgrade policy, and migration-transition rows carry the actual contract work.	No unresolved dependency named; clerical queue placement only.	ADR 0071	ADR 0071 context/implementation plan + stack sequencing notes.	Planning no longer carries a standalone process gate for ADR 0071; concrete pin/version rows name the dependency they actually need.
PLN-0032	P2	Open	Stack	Add ADR 0068 to TypeID/stack-contract reference wiring so tenant and scope rules are discoverable from the TypeID registration surface.	No unresolved dependency named; reference wiring follows ADR 0068 tenant decisions.	ADR 0068, ADR 0061	ADR 0068 stack-level implementation item + ADR 0061 relationship.	Reference docs link ADR 0068 where TypeID registration and stack contracts define tenant/scope semantics.
PLN-0033	P2	Open	ADR/spec	Move ADR 0068 status promotion out of active questions; acceptance depends on closing tenant-format, actor-identity, supersession, and ID-scope rows.	No unresolved dependency named; clerical queue placement only.	ADR 0068	ADR 0068 status + open questions.	ADR 0068 status changes only after its named open-question rows are closed or merged.
PLN-0034	P2	Open	WOS, Trellis, Stack, CI, Conformance, ADR/spec	Reframe tracker hygiene to one canonical status source + explicit proof gates (tests/verifier obligations); avoid parallel prose rewrites across root/WOS/Trellis TODOs.	No unresolved dependency named.	ADR 0068	ADR 0068 implementation plan (execution hygiene) + canonical-source posture in `STACK.md`.	Stale tracker/doc/review signal is removed or redirected to the canonical source without changing semantics.
PLN-0036	P2	Open	WOS, Trellis, Formspec, Stack, CI, ADR/spec	ADR/spec normative-doc reconciliation sweep (umbrella, normative-doc half; counter-proposal-artifact half in PLN-0378). Bundle of cross-doc wording fixes that make text consistent across normative ADRs/specs after underlying decisions land — no semantic change: (a) ADR 0070/WOS — Trellis local append is stack commit point, WOS DurableRuntime is orchestration, no competing commit boundary (was PLN-0036; gated by PLN-0035); (b) ADR 0066 — strip process-gate noise from planning; concrete rows carry the contract work (was PLN-0049); (c) ADR 0073 — examples/docs/product wording stop implying Formspec creates governed cases (`case.created` is WOS-owned per D-1) (was PLN-0070); (d) ADR 0066 phase wording — Phase 1 reserves supersession linkage; Phase 4 activates runtime; remove "deferred away" language (was PLN-0105); (e) ADR 0067 Formspec ledger observation as implementation notes — StatuteClock uses existing emit path, no new authoring surface (was PLN-0158).	(a) gated by PLN-0035; PLN-0378 (sibling counter-proposal-artifact sweep — share lineage).	ADR 0066, ADR 0067, ADR 0070, ADR 0073	Cross-ADR consistency review per ADR D-* premise hardening.	All five normative-doc edits land; cross-doc wording consistent; no doc implies a second durability center, a Formspec-created governed case, or stale phase/ledger framing.
PLN-0378	P2	Open	WOS, ADR/spec	Counter-proposal artifact reconciliation sweep (umbrella, sibling to PLN-0036's normative-doc half). Bundle of edits to `wos-spec/counter-proposal*.md` + `wos-spec/README.md` after ADR 0075/0076/0077 absorbed the canonical material — no semantic change: (f) `wos-spec/counter-proposal-disposition.md` artifact-taxonomy + seam-vocabulary sections become one-line pointers to ADR 0076 + ADR 0077 (was PLN-0220); (g) `wos-spec/README.md` rejection-list framing keeps thesis local but centralizes lists in ADR 0075 (was PLN-0261); (h) counter-proposal red-flags + REJECT-bucket sections shorten to ADR 0075 pointers (was PLN-0263); (i) counter-proposal row E1 — narrow factual correction citing canonical six seams; drop stale "five seams" caveat (was PLN-0265); (j) counter-proposal row E9 — fix seam-name reference: `x-` extensions on case-file fields, not named `caseFieldExtension` seam (was PLN-0266).	PLN-0036 (sibling normative-doc sweep — share lineage); (i)/(j) implicitly gated by ADR-0076/0077 sequencing.	ADR 0075, ADR 0076, ADR 0077	Counter-proposal artifact set (`wos-spec/counter-proposal*.md`, `wos-spec/README.md`) reconciled against ADR 0075/0076/0077 absorption per same Cross-ADR consistency review feeding PLN-0036.	All five counter-proposal-artifact edits land; no stale "five seams" caveat, `caseFieldExtension` reference, or independently-maintained rejection-list survives outside ADR 0075.
PLN-0049	P2	Done	Formspec, WOS, Trellis, Stack, CI, ADR/spec	Merged into PLN-0036: ADR 0066 process-gate cleanup is item (b) in the umbrella ADR/spec text reconciliation sweep.	No active implementation remains in this row.	ADR 0066	PLN-0036.	Closed row is not in the active queue; canonical row PLN-0036 carries the work.
PLN-0058	P2	Open	Formspec, Trellis, Stack, ADR/spec	Reconcile ADR 0072 attachment-binding tracker status for `061-attachments.cbor` and `trellis.export.attachments.v1`: either point root TODO to canonical active coverage rows (`PLN-0061` / `PLN-0062`) or update TODO/ADR text if Trellis export/verify/tamper coverage has already landed.	No unresolved dependency named.	ADR 0072	`thoughts/adr/0072-stack-evidence-integrity-and-attachment-binding.md` implementation-status text + root `TODO.md` Trellis wording.	Root TODO, ADR 0072, and PLANNING agree on whether attachment coverage is open or landed; no row assumes tracker drift without source evidence.
PLN-0070	P2	Done	Formspec, WOS, Stack, ADR/spec	Merged into PLN-0036: ADR 0073 governed-case wording is item (c) in the umbrella ADR/spec text reconciliation sweep.	No active implementation remains in this row.	ADR 0073	PLN-0036.	Closed row is not in the active queue; canonical row PLN-0036 carries the work.
PLN-0072	P2	Open	Trellis, Stack, CI, Conformance, ADR/spec	Minimize ADR 0073 status churn: keep one concise status pointer that separates landed Trellis vectors from still-open shared fixture bundle and CI evidence.	No unresolved dependency named.	ADR 0073, shared fixture design (`thoughts/specs/2026-04-24-shared-cross-seam-fixture-bundle-design.md`)	`thoughts/adr/0073-stack-case-initiation-and-intake-handoff.md` implementation-status section + shared fixture bundle design doc.	Stale tracker/doc/review signal is removed or redirected to the canonical source without changing semantics.
PLN-0105	P2	Done	CI, ADR/spec	Merged into PLN-0036: ADR 0066 phase wording cleanup is item (d) in the umbrella ADR/spec text reconciliation sweep.	No active implementation remains in this row.	ADR 0066	PLN-0036.	Closed row is not in the active queue; canonical row PLN-0036 carries the work.
PLN-0158	P2	Done	Formspec, CI, ADR/spec	Merged into PLN-0036: ADR 0067 Formspec ledger note is item (e) in the umbrella ADR/spec text reconciliation sweep.	No active implementation remains in this row.	ADR 0067	PLN-0036.	Closed row is not in the active queue; canonical row PLN-0036 carries the work.
PLN-0165	P2	Open	WOS, Trellis, Stack, Conformance, ADR/spec	Trigger-gated cleanup only after ADR 0067 landing evidence exists: move status/docs/TODOs from open-contract prose to implementation-backed claim, without speculative pre-landing edits.	No unresolved dependency named.	ADR 0067	STACK.md open-contract posture + root/WOS/Trellis TODO tracking hygiene.	Stale tracker/doc/review signal is removed or redirected to the canonical source without changing semantics.
PLN-0213	P2	Done	WOS, CI, ADR/spec	Closed: `wos-spec/CLAUDE.md` Layer structure section already replaced with embedded-block + sidecar list per ADR 0076 D-1/D-3 (renamed to "Schema structure").	No active implementation remains in this row.	ADR 0076	`thoughts/adr/0076-product-tier-consolidation.md` D-1, D-3, D-7 + step 9.	Closed row is not active; canonical row or source ADR carries any remaining work.
PLN-0214	P2	Open	WOS, CI, ADR/spec	WOS-spec README + COMPATIBILITY-MATRIX sweep (umbrella). Bundle of five edits to bring `wos-spec/README.md` and `COMPATIBILITY-MATRIX.md` into alignment with the post-ADR-0076 schema family + version-marker model: (a) `wos-spec/README.md` "Specification inventory" — restructure around one author-time core + three sidecars + two runtime artifacts + one tooling schema; retire Profile/Companion/four-stream rows; replace stale paths (was PLN-0214); (b) "How the layers work" section becomes "How the workflow document scales" — describe Forms+ / DocuSign / case-management tiers, drop "Cross-cutting profiles" and "Companions" subsections (was PLN-0215); (c) "What to adopt" table replaces layer→spec mapping with tier→behavior mapping; each row points at a representative example (was PLN-0216); (d) release-stream paragraph/link block reconciles to the `$wosWorkflow` + optional `$wos` marker model; replace stale `specs/companions/` / `specs/profiles/*` paths (was PLN-0217); (e) `COMPATIBILITY-MATRIX.md` updates per-file streams (`wos-kernel@X`) to version-marker pairs (`$wosWorkflow@X` with `$wosGovernance@Y` semantics) (was PLN-0218).	ADR 0076 sequencing (all five edits gate on schema family being in place).	ADR 0076	`thoughts/adr/0076-product-tier-consolidation.md` D-2/D-6/D-7/D-9 + step 9.	All five edits land; README and COMPATIBILITY-MATRIX read against the post-ADR-0076 model; no stale `companions/` or `profiles/` paths remain.
PLN-0215	P2	Done	WOS, ADR/spec	Merged into PLN-0214: README "How the layers work" rewrite is item (b) in the umbrella WOS-spec README + matrix sweep.	No active implementation remains in this row.	ADR 0076	PLN-0214.	Closed row is not in the active queue; canonical row PLN-0214 carries the work.
PLN-0216	P2	Done	WOS, ADR/spec	Merged into PLN-0214: README "What to adopt" table rewrite is item (c) in the umbrella WOS-spec README + matrix sweep.	No active implementation remains in this row.	ADR 0076	PLN-0214.	Closed row is not in the active queue; canonical row PLN-0214 carries the work.
PLN-0217	P2	Done	WOS, ADR/spec	Merged into PLN-0214: README release-stream paragraph reconciliation is item (d) in the umbrella WOS-spec README + matrix sweep.	No active implementation remains in this row.	ADR 0076	PLN-0214.	Closed row is not in the active queue; canonical row PLN-0214 carries the work.
PLN-0218	P2	Done	WOS, ADR/spec	Merged into PLN-0214: COMPATIBILITY-MATRIX version-marker reconciliation is item (e) in the umbrella WOS-spec README + matrix sweep.	No active implementation remains in this row.	ADR 0076	PLN-0214.	Closed row is not in the active queue; canonical row PLN-0214 carries the work.
PLN-0220	P2	Done	WOS, ADR/spec	Merged into PLN-0036: counter-proposal artifact-taxonomy + seam-vocabulary pointer cleanup is item (f) in the umbrella ADR/spec text reconciliation sweep.	No active implementation remains in this row.	ADR 0076, ADR 0077	PLN-0036.	Closed row is not in the active queue; canonical row PLN-0036 carries the work.
PLN-0261	P2	Done	WOS, ADR/spec	Merged into PLN-0036: README rejection-list centralization is item (g) in the umbrella ADR/spec text reconciliation sweep.	No active implementation remains in this row.	ADR 0075	PLN-0036.	Closed row is not in the active queue; canonical row PLN-0036 carries the work.
PLN-0263	P2	Done	WOS, CI, ADR/spec	Merged into PLN-0036: counter-proposal red-flags + REJECT-bucket pointer cleanup is item (h) in the umbrella ADR/spec text reconciliation sweep.	No active implementation remains in this row.	ADR 0075	PLN-0036.	Closed row is not in the active queue; canonical row PLN-0036 carries the work.
PLN-0265	P2	Done	WOS, ADR/spec	Merged into PLN-0036: counter-proposal row E1 canonical-seams correction is item (i) in the umbrella ADR/spec text reconciliation sweep.	No active implementation remains in this row.	ADR 0076, ADR 0077	PLN-0036.	Closed row is not in the active queue; canonical row PLN-0036 carries the work.
PLN-0266	P2	Done	WOS, ADR/spec	Merged into PLN-0036: counter-proposal row E9 seam-name fix is item (j) in the umbrella ADR/spec text reconciliation sweep.	No active implementation remains in this row.	ADR 0077	PLN-0036.	Closed row is not in the active queue; canonical row PLN-0036 carries the work.
PLN-0267	P2	Done	CI, ADR/spec	Close the gap-analysis citation check: ADR 0077 already confirms `contractHook`, `provenanceLayer`, and `lifecycleHook` citations; no separate edit is needed.	Superseded by ADR 0077 D-5 #3.	ADR 0077	ADR 0077 D-5 #3.	Row is closed as no-op; future gap-analysis edits can rely on ADR 0077 seam names.
PLN-0293	P2	Open	WOS, CI, Conformance, ADR/spec	Resolve dead `P11-BL-050` drift by defaulting to retirement unless a concrete unmet invariant requires implementation; keep the decision explicit in audit/status docs.	No unresolved dependency named.	WOS audit 2026-04-24, Phase 11 master	audit verdict 24 §6.10 item 7.	Stale tracker/doc/review signal is removed or redirected to the canonical source without changing semantics.
PLN-0294	P2	Done	WOS, ADR/spec	No-op closure: do not spend additional churn deleting Phase 11 master §10 "Subagent / tooling note"; treat as superseded by parent `CLAUDE.md` skill registration structure.	Superseded by parent guidance; no unresolved dependency named.	WOS audit 2026-04-24, Phase 11 master	audit verdict 24 + parent `CLAUDE.md` skill registration contract.	Item is explicitly closed as superseded/no-op so it does not recur as false-open clerical work.
PLN-0295	P2	Open	Formspec, WOS, ADR/spec	Fix Phase 11 master §6.10 reference to `thoughts/plans/2026-04-11-phase11-coprocessor-open-backlog.md` - points at the parent Formspec repo, not the WOS submodule. Cold readers grep the submodule and find nothing.	No unresolved dependency named.	WOS audit 2026-04-24, Phase 11 master	audit verdict 24.	Stale tracker/doc/review signal is removed or redirected to the canonical source without changing semantics.
PLN-0297	P2	Open	WOS, Formspec, Conformance, ADR/spec	Status-flip + archive-move sweep (umbrella). Bundle of seven small ADR/plan/spec hygiene edits driven by the WOS audit 2026-04-24: (a) flip `wos-spec/thoughts/adr/0059-continuous-mode-post-mutation-rescan.md` Proposed→Accepted (all five §6 tasks landed across `2d890d3`/`a683c03`/`bdf7063`/`f03ca40`) (was PLN-0297); (b) record WOS plan 0059 §4.2 back-compat shim as intentional-deviation note before archive (was PLN-0298); (c) clarify WOS ADR 0061 wording — `serde_json_canonicalizer` superseded for custody seam, valid for JCS case-file snapshots (was PLN-0299); (d) flip `wos-spec/thoughts/specs/2026-04-11-formspec-wos-phase11-integration-master.md` proposed→accepted (body already declares Landed/Resolved) (was PLN-0300); (e) `git mv` 9 fully-resolved plans + 2 accepted ADRs (0060, 0061) into `wos-spec/thoughts/archive/{plans,adr}/`; create archive plans/ if missing (was PLN-0303); (f) archive stale ADR 0059 + Phase 11 master after status flips (was PLN-0304); (g) checkbox-hygiene pass with archive-first policy — only edit checkboxes in artifacts intentionally kept unarchived (was PLN-0305).	(b) and (f) gated by (a) and (d) status flips.	WOS audit 2026-04-24, ADR 0061	`wos-spec/thoughts/audit-2026-04-24-wos-spec-thoughts-plans.md` verdicts 21, 23, 24 + recommendations 1, 5.	All seven edits land; status frontmatter matches body; archive folder contains the 11 landed artifacts; no stale "Proposed" status for landed work.
PLN-0298	P2	Done	WOS, ADR/spec	Merged into PLN-0297: WOS plan 0059 back-compat shim note is item (b) in the umbrella status-flip + archive-move sweep.	No active implementation remains in this row.	WOS audit 2026-04-24	PLN-0297.	Closed row is not in the active queue; canonical row PLN-0297 carries the work.
PLN-0299	P2	Done	WOS, CI, ADR/spec	Merged into PLN-0297: ADR 0061 `serde_json_canonicalizer` clarification is item (c) in the umbrella status-flip + archive-move sweep.	No active implementation remains in this row.	ADR 0061	PLN-0297.	Closed row is not in the active queue; canonical row PLN-0297 carries the work.
PLN-0300	P2	Done	Formspec, WOS, ADR/spec	Merged into PLN-0297: Phase 11 integration master status flip is item (d) in the umbrella status-flip + archive-move sweep.	No active implementation remains in this row.	WOS audit 2026-04-24	PLN-0297.	Closed row is not in the active queue; canonical row PLN-0297 carries the work.
PLN-0301	P2	Done	WOS, ADR/spec	No-op closure: skip optional supersession narration churn in the Phase 11 master; archive placement + canonical ADR links already communicate supersession.	Superseded by archive placement and canonical ADR references; no unresolved dependency named.	`thoughts/adr/0073-stack-case-initiation-and-intake-handoff.md`, `thoughts/archive/adr/0061-current-state-authoring-runtime.md`, WOS audit 2026-04-24, Phase 11 master	`wos-spec/thoughts/audit-2026-04-24-wos-spec-thoughts-plans.md` verdict 24.	Item is explicitly closed as superseded/no-op so it does not recur as false-open clerical work.
PLN-0302	P2	Done	WOS, CI, ADR/spec	Close `COMPLETED.md` narrative drift by treating later landing lines as superseding earlier drafted/ready text for ADR-0059 F3b.	Superseded by later `COMPLETED.md` landing record.	ADR 0059, WOS audit 2026-04-24	audit cross-ref delta.	Row is closed as stale narrative drift; no active decision remains.
PLN-0303	P2	Done	WOS, Conformance, ADR/spec	Merged into PLN-0297: archive-move of 9 plans + 2 ADRs is item (e) in the umbrella status-flip + archive-move sweep.	No active implementation remains in this row.	WOS audit 2026-04-24	PLN-0297.	Closed row is not in the active queue; canonical row PLN-0297 carries the work.
PLN-0304	P2	Done	Formspec, WOS	Merged into PLN-0297: archive-move of stale ADR 0059 + Phase 11 master is item (f) in the umbrella status-flip + archive-move sweep.	No active implementation remains in this row.	WOS audit 2026-04-24	PLN-0297.	Closed row is not in the active queue; canonical row PLN-0297 carries the work.
PLN-0305	P2	Done	WOS, ADR/spec	Merged into PLN-0297: archive-first checkbox-hygiene pass is item (g) in the umbrella status-flip + archive-move sweep.	No active implementation remains in this row.	WOS audit 2026-04-24	PLN-0297.	Closed row is not in the active queue; canonical row PLN-0297 carries the work.

Future Optional / Trigger-Gated Work

ID	Imp×Debt	Status	Owner/layer	Future / trigger-gated item	Depends on	Source ADR	Source pointer	Evidence required for done
PLN-0048	Trigger	Open	WOS, Conformance	Trigger-gated compensation migration: after PLN-0047 decides deprecate-vs-scope, publish migration/deprecation guidance and conformance fixture updates for WOS compensation constructs.	Trigger: PLN-0047 compensation-scope decision is closed.	ADR 0070, ADR 0066	ADR 0070 D-5 + ADR 0066 linkage.	When triggered, WOS compensation docs and fixtures reflect the chosen ADR 0070/0066 compatibility path.
PLN-0060	Trigger	Open	WOS, Trellis, CI	Trigger-gated WOS evidence origination: define WOS evidence-intake/reference shape only when a profile needs post-intake evidence that cites Formspec binding events by `canonical_event_hash`.	Trigger: a WOS profile requires post-intake evidence origination; merged with PLN-0109.	ADR 0072	ADR 0072 implementation plan (WOS).	When triggered, WOS schema/runtime can originate evidence references tied to prior `EvidenceAttachmentBinding` events; until then ADR 0072 MAY remains intentionally unimplemented.
PLN-0109	Trigger	Done	WOS, CI, ADR/spec	Merged into PLN-0060: WOS optional evidence origination is a trigger-gated follow-on, not a second active implementation row.	No active implementation remains in this row.	ADR 0072	ADR 0072 D-4 + implementation status. Merged rollout row: PLN-0059.	PLN-0060 carries the future WOS evidence-origination trigger and done criteria.
PLN-0132	Trigger	Open	CI, Conformance, ADR/spec	Trigger-gated ADR 0069 leap-second implementation fork: after PLN-0115 closes, split D-4 into parser contract and optional runtime clock-discipline guidance if UTC-SLS is not verifiable.	Trigger: PLN-0115 leap-second policy decision is closed.	ADR 0069	ADR 0069 D-4 + premise review hardening.	When triggered, ADR 0069 separates normative parser behavior from optional runtime clock discipline without ambiguity.
PLN-0144	Trigger	Open	WOS, CI, ADR/spec	Future optional: decide whether companion-drift detection (`COMP-001`) becomes required governance control for ADR 0064 D-4, or remains optional trigger-gated backlog.	Future optional; answer only if companion-drift evidence makes `COMP-001` load-bearing.	ADR 0064	ADR 0064 Alternatives Considered #3 + handoff §4.3.	If triggered, ADR 0064 or WOS TODO states whether companion-drift detection is required governance control or optional backlog.
PLN-0264	Trigger	Open	CI, Conformance	Future CI lint candidate: any new spec doc citing "we rejected" content without pointer to ADR 0075 fails promotion gate. Implement only if rejection-register discipline becomes a recurring maintenance problem.	Trigger: repeated drift in rejected-option prose after ADR 0075 is used in practice.	ADR 0075	ADR 0075 Implementation plan.	Automated gate exists and fails on the named regression.
PLN-0272	Trigger	Open	CI, ADR/spec	Future optional placement decision for boundary-event authoring sugar after ADR 0076 removes the Runtime Companion axis; decide where interrupting timeout, notification, error, message, and compensation-trigger sugar belongs only if authoring pressure appears.	Future optional; answer only when implementation pressure or repeated contributor demand makes boundary-event authoring sugar load-bearing.	ADR 0075, ADR 0080	ADR 0075 Open Question #1.	If triggered, the chosen post-ADR-0076 home is named and no longer references the removed Runtime Companion taxonomy.
PLN-0273	Trigger	Open	CI, ADR/spec	Future optional: define a governed discretionary work model for unplanned caseworker work without permitting unconstrained runtime statechart mutation.	Future optional; answer only when implementation pressure or repeated contributor demand makes governed discretionary work load-bearing.	ADR 0075, ADR 0080	ADR 0075 Open Question #2.	If triggered, design names catalog shape, activation criteria, authorization actor, bounded read/write scope, and provenance for create/assign/complete/cancel/override.
PLN-0274	Trigger	Open	CI, ADR/spec	Future optional: define when a new rejection-register entry requires ADR 0075 amendment versus a superseding ADR.	Future optional; answer only when repeated contributor demand makes rejection-register amendment vs supersession policy load-bearing.	ADR 0075, ADR 0080	ADR 0075 Open Question #3.	If triggered, ADR 0075 states when a new rejection becomes an ADR amendment versus a superseding ADR.
PLN-0350	Trigger	Open	Stack, Gov	SBA pilot contracting vehicle decision: choose between SBIR Phase I (≤6 months, ≤$323k cap, reauthorized through 2031), FAR Part 13 simplified acquisition (≤$250k, sole-source to small business permitted), or unsolicited proposal under FAR 15.6. Activate trigger: SBA conversation opens with explicit pilot intent. Abandon trigger: no SBA pilot contact by 2027-04 (TealWolf prioritizes commercial-mode SaaS or alternate federal customer).	Future optional; activates on adopter pull.	Stack governance, gov-OSS-SaaS review 2026-04-27	gov-OSS-SaaS review finding #1; STACK.md §Governance ownership. Execution home: TealWolf entity-level decision; PLANNING.md tracks the decision shape.	Vehicle chosen and contract template / SBIR proposal drafted; entity (TealWolf or Focus partnership) identified as prime; small-business size standard (NAICS 541511 / 541512) confirmed.
PLN-0351	Trigger	Open	Stack, Gov	FedRAMP / ATO posture for SBA pilot deployment with real applicant data. Choose: full FedRAMP Moderate ATO (12–18 months, $200k–$1M typical), FedRAMP Tailored / Li-SaaS (lighter, ~6 months), Authority to Test (ATT) with synthetic data only, or deployment as subsystem inside SBA's existing ATO boundary via ISA/MOU (faster, requires SBA Authorizing Official sign-off). FIPS 140-3 module declaration on `kms-cloud` (PLN-0337) is a prerequisite for any path beyond ATT. Activate trigger: SBA pilot moves from synthetic to real applicant data. Abandon trigger: SBA pilot stays synthetic indefinitely OR pilot uses an existing FedRAMP-authorized hosting environment that absorbs the ATO scope.	PLN-0337 (kms-cloud — FIPS 140-3 module choice gates ATO scope).	Stack governance, gov-OSS-SaaS review 2026-04-27	gov-OSS-SaaS review finding #2; STACK.md §Compliance framework mapping (FedRAMP rev5 row).	ATO posture chosen and documented; if ATT or subsystem path, scope-of-test or ISA/MOU drafted; if full ATO path, 3PAO engaged and SSP authoring scoped.
PLN-0352	Trigger	Open	Stack, Gov	CLA/DCO posture before first external contributor lands code. STACK.md §Governance currently states "No CLA today" — sufficient for pure Apache-2.0 OSS-as-service; becomes load-bearing the moment TealWolf wants commercial-tier features, enterprise IP indemnification, or relicensing. Activate trigger: before first external contributor PR lands. Lean: DCO turnkey (sign-off line in commits) — lowest friction, sufficient for Apache-2.0 OSS-as-service; CLA is the heavier alternative if commercial relicensing becomes load-bearing. Abandon trigger: none — lands or stays an inactive Trigger; if no external contributors materialize, posture remains stated-default.	Future optional; activates on first external contributor.	Stack governance, gov-OSS-SaaS review 2026-04-27	gov-OSS-SaaS review finding #3; STACK.md §Governance contribution and cadence.	DCO sign-off line documented in CONTRIBUTING.md; bot or CI check enforces sign-off; STACK.md §Governance updated to reflect chosen posture.
PLN-0353	Trigger	Open	Stack, Gov	FAR 52.227-14 (Rights in Data — General) + DFARS 252.227-7014 (where applicable) review against Apache-2.0 stack at first SBA contract draft. Default rights interaction: Apache-2.0 grants the government unlimited rights at delivery, so 52.227-14 baseline is non-conflicting. Risks: assertions-of-restrictions register (Apache-2.0 §4 attribution), modifications-with-government-purpose-rights, contractor-developed-software clauses. Activate trigger: first SBA contract draft circulates. Abandon trigger: SBA pilot uses SBIR template (covers IP under SBIR data rights, separate regime).	PLN-0350 (vehicle decision determines which rights regime applies).	Stack governance, gov-OSS-SaaS review 2026-04-27	gov-OSS-SaaS review finding #4.	Counsel-reviewed assertions-of-restrictions register documented; contract IP clauses cross-checked against Apache-2.0 obligations; no contract clause silently overrides OSS license.
PLN-0354	Trigger	Open	Stack, WOS, Formspec, Gov	OMB M-24-10 artifact bundle (AI in Federal Government) when SBA Chief AI Officer needs filings: AI use case impact assessment template, rights-impacting AI safeguards self-attestation, agent inventory export shape. STACK.md §Compliance maps M-24-10 to "WOS deontic constraints + Trellis attestation" — that's a claim shape; the artifacts SBA's CAIO files are separate. Activate trigger: SBA CAIO needs filings under current AI-EO regime (verify current memo number — AI EO regime has been turbulent through 2025-26). Abandon trigger: SBA pilot exempt from M-24-10 scope OR EO/memo regime renders M-24-10 obsolete.	PLN-0350 (vehicle decision); ADR-0074 cluster (accessControl + Privacy Profile semantics inform agent inventory).	Stack governance, gov-OSS-SaaS review 2026-04-27	gov-OSS-SaaS review finding #5; STACK.md §Compliance OMB M-24-10 row.	Three artifacts authored: AI use-case impact assessment template; rights-impacting safeguards self-attestation form; agent inventory export shape (likely WOS schema extension or sidecar).
PLN-0355	Trigger	Open	Stack, WOS, Trellis	ESIGN/UETA compliance gate before commercial-mode SaaS signature flow ships. ESIGN requires: consumer disclosure and consent, ability to access and retain the record, clear attribution of the signature to the signer, integrity of the signed record. Certificate-of-completion (Trellis ADR 0007) is the integrity artifact; consumer-consent flow + record-retention UX + attribution audit trail are remaining. PLN-0370 marketing-claim reframe holds the line until this gate lands. Activate trigger: commercial-mode SaaS ships signature flow OR marketing reframe rolled back. Abandon trigger: marketing reframe holds permanently AND signature flows stay Trigger-gated for commercial-mode (federal-mode WOS-T4 path is already covered by Signature Profile).	Trellis ADR 0007 (certificate-of-completion); WOS-T4 closeout (parent TODO-STACK.md).	Stack governance, gov-OSS-SaaS review 2026-04-27	gov-OSS-SaaS review finding #7; STACK.md §Open contracts (signature attestation; certificate-of-completion is open work).	Consumer-consent flow shipped in commercial-mode SaaS UI; record-retention UX documented; attribution audit trail bound to certificate-of-completion; counsel-reviewed compliance memo references ESIGN, UETA, and applicable state laws. eIDAS (EU) is separate, larger lift — defer to a sibling Trigger if EU launch surfaces.
PLN-0356	Trigger	Open	Stack, Ops	SOC 2 Type II prep before first regulated mid-market SaaS customer. SOC 2 audit cycle is ~6–12 months (Type I observation period + Type II measurement period). Without SOC 2, commercial-mode SaaS sells to prosumer / SMB / non-regulated only. Tension: the "DocuSign-replacement" wedge (per VISION.md §II Q1, currently reframed by PLN-0370) appeals to the SAME buyer set DocuSign sells to (regulated mid-market). Activate trigger: first $50k+ SaaS contract enters procurement OR enterprise vendor-risk-questionnaire surfaces. Abandon trigger: commercial-mode SaaS stays consumer-tier indefinitely.	PLN-0370 (marketing reframe — without it, the wedge implies regulated mid-market sooner).	Stack governance, gov-OSS-SaaS review 2026-04-27	gov-OSS-SaaS review finding #8.	SOC 2 Type II report issued; Trust Center page published; vendor-risk-questionnaire response template ready; security disclosure policy (PLN existing in TODO-STACK.md "Sustaining") landed as prerequisite.
PLN-0357	Trigger	Open	WOS, Stack	Confidential-compute adapter sequencing: ship `processing-tee` / `processing-fhe` / `processing-mpc` when deployment surfaces. Activate triggers: `processing-tee` when hardware-rooted attestation is required (FedRAMP-Moderate+ workloads not covered by audited-decryption posture); `processing-fhe` when a workload's operations are FHE-tractable AND customer values math-rooted confidentiality over hardware-rooted; `processing-mpc` when multi-operator deployment surfaces with no single party permitted to hold plaintext. Abandon trigger per adapter: if no deployment surfaces by 2027-04, strip scaffolding from `wos-server-ports::ProcessingService` trait surface to recover trait simplicity. Architecture admits all three via the port; do not pre-ship.	Future optional; activates on adopter pull.	wos-server VISION §X #4	`wos-spec/crates/wos-server/VISION.md` §X (open decisions, item 4). Execution home: `wos-spec/crates/wos-server/TODO.md` (no WS-* yet — add when activate trigger fires per adapter).	Adapter shipped per activate trigger; architecture remains pluggable; abandon trigger documented if no deployment surfaces.
PLN-0289	Trigger	Open	WOS, CI	Track ADR 0059 Phase 3 mapping as a strategic obligation, not immediate implementation: every future WOS emission must remain mappable to stable unified-ledger taxonomy event types.	Future gated by ADR 0059 Phase 2/3 activation.	ADR 0059, WOS audit 2026-04-24	audit verdict 1 (`0059-unified-ledger-as-canonical-event-store.md`).	When Phase 3 activates, WOS emission taxonomy mapping is documented and fixture-backed.
PLN-0290	Trigger	Open	WOS, CI	Keep ADR 0060 `Ref`/`Key`/`*Id` taxonomy as future PR policy, not immediate implementation; apply when schema edits touch remaining ambiguous references.	Future gated by schema PRs touching cross-reference fields.	ADR 0060, WOS audit 2026-04-24	audit verdict 22 (`adr/0060-cross-reference-naming-ref-key-id.md`).	Touched schema PRs apply the taxonomy; no plain-string key remains under a `*Ref` suffix in edited areas.
PLN-0296	Trigger	Open	Formspec, WOS, Trellis, Stack, CI, ADR/spec	Future optional: decide whether WOS, Formspec Response IDs, and Trellis bundle artifacts should share a TypeID utility ADR after first implementations prove reuse value.	Future optional; answer only after first WOS/Formspec/Trellis TypeID implementations prove shared utility reuse is worth coordination cost.	ADR 0061, WOS audit 2026-04-24	audit verdict 21 (`adr/0061-custody-hook-trellis-wire-format.md`).	If triggered, a shared-stack TypeID utility ADR names reuse scope, ownership, and migration path; otherwise local TypeID implementations remain independent.
PLN-0313	Trigger	Open	Trellis, Stack, ADR/spec	Execute Trellis ADR 0008 interop adapter bundle only when adapter trigger criteria fire: `scitt-receipt`, `vc-jose-cose-event`, `c2pa-manifest`, and `did-key-view`. Phase-1 reservation stays separate from ecosystem adapter implementation.	Trigger-gated by ADR 0008 adapter criteria; `did-key-view` co-lands with key-class migration.	Trellis ADR 0008, Trellis ADR 0006, Trellis ADR 0007	`trellis/TODO.md` #19-#22 (per-adapter rows); `trellis/TODO.md` #18 remains the Phase-1 reservation row Trellis-local unless stack planning needs it.	Trigger condition is documented; selected adapters land with tests, registry/manifest wiring, and no ecosystem dependency leakage into Trellis core crates.
PLN-0392	Trigger	Open	Trellis, Stack, ADR/spec	Tenant-scope Trellis export shape decision. Core §18 ZIP layout is per-`ledger_scope`; tenant-scope spans many. Choose: (a) `070-tenant-package-manifest.cbor` cataloging constituent per-scope ZIPs with cross-binding digests, OR (b) new top-level package format nesting per-scope exports. Owner lean: option (a). Activate trigger: first tenant-scope export use case surfaces. Abandon trigger: none — center-adjacent profile-specific extension; will eventually land.	PLN-0382 (export must cover recipient-rotation events).	Trellis Core §18 amendment / new ADR	`/VISION.md` §XI active uncertainty; STACK §Open contracts profile-specific extensions.	Choice ratified; CDDL written; fixture vector for one tenant spanning two `ledger_scope`s passes verifier; secret-exclusion list (per ADR-0013 absorption) enforced.
PLN-0393	Trigger	Open	Stack, SaaS Platform, Procurement	WCAG 2.2 AA conformance + VPAT for each frontend app per PLN-0389 (Studio, Caseworker, Admin). Procurement-blocking center commitment per VISION §V. Activate trigger: first procurement evaluation requires VPAT OR first regulated CTO accessibility review opens. Abandon trigger: none — center commitment, will eventually land. Calendared cost (auditor time + remediation cycle) is a different cost mix than engineering work.	PLN-0389 (three-app split must exist before per-app VPAT is meaningful).	Procurement	STACK §Proof packages buyer; `/VISION.md` §V procurement-blocking.	VPAT authored per app; WCAG 2.2 AA audit passes with documented exceptions; remediation backlog tracked.
PLN-0394	Trigger	Open	Stack, Procurement	SOC 2 controls inventory authored pre-cert. Distinct from PLN-0356 (SOC 2 Type II report itself); this is the inventory of which controls map to which architectural commitment, control-category (per VISION §V five categories: product / deployment / operational / customer-configurable / inherited), and customer-configurability. Procurement-blocking center commitment. Activate trigger: first vendor-risk-questionnaire surfaces OR PLN-0356 audit cycle begins. Abandon trigger: none.	PLN-0356 (SOC 2 Type II — this is its prerequisite).	Procurement	STACK §Proof packages; `/VISION.md` §V "Compliance claims are tier-qualified".	Controls inventory document published; each control maps to architectural commitment + category + customer-configurable boolean; audit firm accepts inventory as scoping basis.
PLN-0395	Trigger	Open	Stack, Procurement	Pricing model (one model, all configurations × postures × topologies). Procurement-blocking center commitment. 3 configurations × 3 postures × 3 topologies = 27-cell theoretical matrix collapses to fewer real SKUs in practice; dimensional analysis hasn't been done. Activate trigger: first commercial contract negotiation OR first procurement RFP requires pricing transparency. Abandon trigger: if synthesis lead-wedge thesis kills (no signed LOI in mid-market regulated by 2027-04 per soft-spot #1), revisit pricing in light of revised wedge.	PLN-0370 (marketing reframe — pricing must align with claim shape).	Procurement	`/VISION.md` §V "Compliance claims are tier-qualified"; archived synthesis soft-spot #9.	Pricing matrix published; SKU-to-deployment-config mapping documented; one canonical model holds across all advertised configurations.
PLN-0396	Trigger	Open	Stack, Procurement	Subprocessor list maintained — every adapter that processes customer data named, with scope-of-data + jurisdiction. Procurement-blocking center commitment per VISION §V (synthesis-added; not in ADR-0015 source claim). Activate trigger: first contract requires subprocessor disclosure OR enterprise customer's vendor-risk process surfaces. Abandon trigger: none.	None.	Procurement	`/VISION.md` §V Compliance taxonomy rule 5; archived synthesis ADR absorption table (ADR-0015 row).	Subprocessor list published with per-adapter scope-of-data + jurisdiction; updated automatically on adapter additions; customer-facing Trust Center page hosts current version.
PLN-0397	Trigger	Open	Stack, Ops, Procurement	Incident-response and breach-notification commitments. Operational SLO category per VISION §V; procurement-blocking center commitment. Includes: incident severity taxonomy; RTO/RPO commitments per SLO category; breach notification timeline (jurisdiction-specific: US state laws, GDPR Art. 33/34, sectoral — HIPAA Breach Rule, FERPA, etc.); customer-notification template; post-incident-review obligation. Activate trigger: first commercial contract OR first procurement evaluation surfaces incident-response commitment. Abandon trigger: none.	PLN-0394 (SOC 2 controls inventory — incident response is a SOC 2 CC7 control).	Procurement	STACK §Proof packages; `/VISION.md` §V Operational SLO.	Incident-response policy authored; breach-notification commitments documented per jurisdiction; runbook ships with deployment package; tabletop exercise log demonstrates operational readiness.
PLN-0398	Trigger	Open	WOS, Stack, ADR/spec	DocuSign 100% parity administrative surface — pulled from "soft-deferred as product scope" back into 1.0 per VISION §X active uncertainty. Capability surface (NOT DocuSign UX clone): template libraries, bulk-send, send-for-signature dashboards, signer status views, reminder cadence configuration, audit history view. Activate trigger: first lead-wedge customer surfaces feature-for-feature parity comparison OR first commercial-mode signature contract enters procurement. Abandon trigger: if lead-wedge thesis kills (no signed LOI by 2027-04), reassess scope.	PLN-0380 (signature.md §1.3 reopen + extensions); PLN-0386 (formspec-server send-for-signature port).	WOS Signature Profile + product-scope ADR	`/VISION.md` §X "DocuSign 100% parity bar / Administrative surface in scope"; archived synthesis lead-wedge realignment.	Per capability-surface item: spec or product-scope ADR ratified; reference implementation lands; conformance fixture proves capability against parity matrix; UX deliberately diverges from DocuSign brand patterns.
PLN-0399	P1	Open	Formspec, WOS, Studio, Conformance, ADR/spec	FEL temporal builtins fail closed on missing timezone context. Migrate `fel-core::current_date()` and `fel-core::now()` from infallible signatures to `Result<RFC3339Timestamp, MissingTimezoneContextError>`; thread `&Timezone` explicitly through every FEL evaluator call site. Why this is architectural debt, not implementation detail: today the builtins read process-local TZ as a side channel — per-process global state leaking into spec evaluation, the worst kind of architectural debt. ADR 0069 D-6 pins explicit-timezone-required as the FEL invariant; the error type is the only structural way to make every call site (Formspec parse/eval, WOS guards/conditions, Studio FEL preview, Python conformance evaluator) either inject an explicit timezone or fail audibly — no silent UTC fallback. Cross-spec breaking change per `nothing-is-released` posture. Filed as cluster follow-up post-Session 14–16 maximalist landing.	ADR 0069 acceptance (currently Proposed, owner-probe gated per `TODO-STACK.md`).	ADR 0069 (D-6)	`thoughts/adr/0069-stack-time-semantics.md` D-6; `/TODO.md` "Formspec-side cross-layer" entry; cluster audit at `wos-spec/thoughts/audit-2026-04-28-provenance-emission-completeness.md`.	`fel-core::FelEvaluator::eval_with_context(expr, env, tz)` carries `&Timezone` explicitly; `current_date()` / `now()` return `Result<_, MissingTimezoneContextError>`; Formspec Python evaluator (`src/formspec/fel/evaluator.py`), WOS guard evaluator (`wos-runtime`), Studio FEL preview, and conformance harness all updated to inject explicit tz from caller (calendar context for WOS guards; user TZ for Formspec response display); migration test proves the silent-UTC path is unreachable in any caller.
PLN-0400	P1	Open	Trellis, Conformance, ADR/spec	Trellis CBOR envelope timestamp wire migration: `uint` Unix-seconds → `uint64` nanoseconds-since-Unix-epoch per ADR 0069 D-2.1. Today `trellis/specs/trellis-core.md` line 2431 declares the base CDDL type as `timestamp = uint ; Unix seconds UTC`; D-2.1 pins `uint64` nanoseconds as the sole CBOR encoding the verifier accepts. Sites: `valid_from` (line 453), `created_at` (line 518), checkpoint `timestamp` (line 887), `signing_event_timestamp_mismatch` reason code (line 2034), `user_content_attestation_timestamp_mismatch` reason code (line 2042), base type (line 2431). Why this matters now, not later: second-precision wire is structurally incapable of carrying SLA-clock ordering under ADR 0067 statutory clocks — silent precision loss at envelope ingest contaminates downstream deadline arithmetic. Retagging after first production records lock the wrong shape is the exact architectural-debt class ADR 0069 D-2.1 exists to prevent. Maximalist envelope discipline (Trellis ADR 0001-0004): change the bytes now; `v1.0.0` is a coherent-snapshot tag, not a freeze. Note: PLN-0074 closure rationale ("Trellis epoch/seconds remains an internal encoding detail") was authored under a prior ADR 0069 draft that left CBOR encoding non-normative; D-2.1 made it normative and that closure note is superseded for this slice — PLN-0074 itself stays closed (cross-layer string wires were the question; that answer holds), this row carries the byte-wire migration.	ADR 0069 acceptance (currently Proposed, owner-probe gated per `TODO-STACK.md`); supersedes PLN-0074 closure-rationale framing on the CBOR-encoding slice (PLN-0074 stays closed on the cross-layer-string question).	ADR 0069 (D-2.1, D-3)	`thoughts/adr/0069-stack-time-semantics.md` D-2.1 + D-3; `trellis/TODO.md` item #20 sub-bullet; `trellis/specs/trellis-core.md` §28 CDDL.	CDDL §28 + every cited site migrated to `uint64` nanoseconds; Rust + Python parity per ADR 0004 (Rust authoritative); `tamper/0NN-timestamp-uint-seconds-rejected` legacy-format negative vector lands in `trellis-conformance`; verifier rejects sub-nanosecond and second-precision encodings; chain-timestamp-order check (trellis/TODO.md item #20 main bullet) lands in same wave.

Closed / Merged / Superseded Rows

Rows here are intentionally non-active. They remain only to preserve ID history and explain why the active backlog no longer needs a separate answer or task.

ID	Imp×Debt	Status	Owner/layer	Closed rationale	Depends on	Source ADR	Source pointer	Evidence required for done
PLN-0310	Closed	Superseded	Stack, WOS, Trellis, Formspec, ADR/spec	Closed-by-supersession 2026-04-27. Synthesis-merge promoted identity attestation from Trigger to P0 center commitment per VISION §V open-contracts list — no longer "wait for WOS-T4 to lift the binding." Active work tracked in PLN-0381 (parent-repo stack ADR for IdentityAttestation shape, `wos.identity.*` taxonomy, claim graph).	Superseded by PLN-0381; no remaining Trigger condition.	PLN-0381 (canonical replacement)	VISION §V "Open contracts decompose into center commitments" promotion; STACK §Open contracts identity attestation shape.	Closed row not in active queue; canonical row PLN-0381 carries the work.
PLN-0037	Closed	Done	Formspec, Stack, CI, ADR/spec	Superseded by ADR 0070 D-2: Invalid Formspec submissions produce no WOS event, no Trellis append, and no stack decision record; telemetry, if any, is outside the decision record path.	No active decision remains; retained only as closed-history context.	ADR 0070	ADR 0070 D-2 + premise review (proposed refinement).	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0046	Closed	Done	Trellis, ADR/spec	Superseded by ADR 0070 D-6: Failure telemetry anchors on next success/recovery; a separate durable failure journal is not an active question.	No active decision remains; retained only as closed-history context.	ADR 0070	ADR 0070 D-6 + premise review (open design risk).	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0059	Closed	Done	WOS, CI, ADR/spec	Merged into PLN-0109: WOS-originated evidence is a roadmap trigger, not a stack architecture question; ADR 0072 already permits WOS MAY originate.	No active decision remains; retained only as closed-history context.	ADR 0072	ADR 0072 D-4 + implementation plan.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0063	Closed	Done	WOS, CI, ADR/spec	Superseded by ADR 0072 metadata split: The broad attachment privacy row over-bundled filename disclosure, fixed manifest metadata, and slot identity; active work remains in ADR 0072 profile/implementation rows, not this umbrella question.	No active decision remains; retained only as closed-history context.	ADR 0072	ADR 0072 Open Question #2 + premise review hardening.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0074	Closed	Done	Trellis, ADR/spec	Superseded by ADR 0069 D-1/D-2: Cross-layer wire timestamps are RFC3339 UTC with the chosen precision policy; Trellis epoch/seconds remains an internal encoding detail.	No active decision remains; retained only as closed-history context.	ADR 0069	ADR 0069 D-1/D-2 + Open Question #2 + premise review.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0078	Closed	Done	ADR/spec	Merged into PLN-0115: Leap-second parser/runtime policy is one question; canonical row PLN-0115 carries the decision.	No active decision remains; retained only as closed-history context.	ADR 0069	ADR 0069 D-4 + alternatives + premise review.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0079	Closed	Done	Conformance, ADR/spec	Merged into PLN-0134: `clock_source` optional-vs-required policy is one attestation-tier question; canonical row PLN-0134 carries the decision.	No active decision remains; retained only as closed-history context.	ADR 0069	ADR 0069 D-5 + Open Question #1 + premise review.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0090	Closed	Done	Stack, CI, ADR/spec	Merged into PLN-0004: Tenant identifier format and canonical regex are one decision; PLN-0004 carries enforcement context.	No active decision remains; retained only as closed-history context.	ADR 0068	ADR 0068 Open Question #1.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0091	Closed	Done	Stack, CI, ADR/spec	Merged into PLN-0013: Cross-tenant actor identity and proofing boundary are one decision; PLN-0013 carries authorization/audit context.	No active decision remains; retained only as closed-history context.	ADR 0068	ADR 0068 Open Question #2.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0092	Closed	Done	Trellis, CI, ADR/spec	Merged into PLN-0012: Supersession bundle semantics are one carry-forward tuple decision; PLN-0012 carries validator context.	No active decision remains; retained only as closed-history context.	ADR 0068, ADR 0066	ADR 0068 Open Question #3 + ADR 0066.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0093	Closed	Done	CI, ADR/spec	Merged into PLN-0011: Case ID uniqueness scope is one storage/API/verifier decision; PLN-0011 carries TypeID/UUIDv7 context.	No active decision remains; retained only as closed-history context.	ADR 0068, ADR 0061	ADR 0068 D-4 + ADR 0061.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0094	Closed	Done	CI, ADR/spec	Merged into PLN-0015: Compatibility-rubric check is part of resolving ADR 0068 identity immutability vs ADR 0071 mutable pins.	No active decision remains; retained only as closed-history context.	ADR 0071, ADR 0068	ADR 0068 + ADR 0071 + proposed rubric in hardening item below.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0099	Closed	Done	WOS, Stack, CI, ADR/spec	Merged into PLN-0035: commit-boundary precedence is part of the ADR 0070 failure-contract decision, not a separate row.	No active decision remains; retained only as closed-history context.	ADR 0070	ADR 0070 D-1 + WOS `DurableRuntime` posture.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0100	Closed	Done	Formspec, Stack, CI, ADR/spec	Merged into PLN-0037: Formspec reject telemetry policy was already answered by ADR 0070 D-2 and closed with PLN-0037.	No active decision remains; retained only as closed-history context.	ADR 0070	ADR 0070 D-2 (proposed clarification).	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0101	Closed	Done	WOS, CI, ADR/spec	Merged into PLN-0042: `stalled` modeling and recovery default are one operational posture decision; PLN-0042 carries runtime config/docs context.	No active decision remains; retained only as closed-history context.	ADR 0070	ADR 0070 D-4 + premise review.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0102	Closed	Done	CI, ADR/spec	Merged into PLN-0046: `CommitAttemptFailure` observability lag was already answered by ADR 0070 D-6 and closed with PLN-0046.	No active decision remains; retained only as closed-history context.	ADR 0070	ADR 0070 D-6 + premise review.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0103	Closed	Done	WOS, CI, ADR/spec	Merged into PLN-0047: Runtime compensation compatibility is one ADR 0070/0066 scope decision; PLN-0047 carries WOS schema context.	No active decision remains; retained only as closed-history context.	ADR 0070, ADR 0066	ADR 0070 + ADR 0066 + current WOS model/schema.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0107	Closed	Done	WOS, CI, ADR/spec	Superseded by ADR 0066 D-1/D-2: ADR 0066 already assigns mode `reason` to the revisit event and WOS authorization to `AuthorizationAttestation`; remaining work is schema/mapping cleanup.	No active decision remains; retained only as closed-history context.	ADR 0066	ADR 0066 D-1/D-2 + premise review.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0108	Closed	Done	CI, ADR/spec	Superseded by atomic ADR 0072 rows: Attachment profile umbrella bundled metadata disclosure, plaintext re-hash, and slot identity; atomic ADR 0072 rows carry any remaining work.	No active decision remains; retained only as closed-history context.	ADR 0072	ADR 0072 Open Question #2 + D-1 + D-6 + premise review.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0111	Closed	Done	WOS, CI, Conformance, ADR/spec	Closed before compression: ADR 0073 mode vocabulary remains closed at `workflowInitiated` and `publicIntake`; reopen only with new shared-fixture evidence.	No active decision remains; retained only as closed-history context.	ADR 0073	ADR 0073 Open Question #2 + current schema contract.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0112	Closed	Done	Trellis, Stack, CI, Conformance, ADR/spec	Merged into PLN-0067: ADR 0073 closure-criteria execution is the shared fixture bundle implementation path, not a separate row.	No active implementation remains in this row.	ADR 0073, Shared fixture design	ADR 0073 implementation status + shared fixture bundle design.	PLN-0067/0069 carry shared fixture bundle and CI evidence.
PLN-0116	Closed	Done	CI, ADR/spec	Merged into PLN-0131: Timestamp-order failure taxonomy is one verifier reporting question; PLN-0131 carries the active decision.	No active decision remains; retained only as closed-history context.	ADR 0069	ADR 0069 D-3 + premise review.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0118	Closed	Done	CI, Conformance, ADR/spec	Merged into PLN-0134: Clock-source attestation posture is one policy-tier question; PLN-0134 carries the active decision.	No active decision remains; retained only as closed-history context.	ADR 0069	ADR 0069 D-5 + Open Question #1 + premise review.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0128	Closed	Done	Trellis, Stack, CI, Conformance, ADR/spec	Closed: ADR 0073 closure checklist is already defined by shared fixture bundle design; active execution remains in PLN-0067/0069.	No active implementation remains in this row.	ADR 0073, Shared fixture design	ADR 0073 implementation status + `thoughts/specs/2026-04-24-shared-cross-seam-fixture-bundle-design.md`.	Closed row is not active; canonical row or source artifact carries remaining work.
PLN-0130	Closed	Done	CI, ADR/spec	Merged into PLN-0076: timestamp profile taxonomy is part of implementing the centralized ADR 0069 precision policy.	No active implementation remains in this row.	ADR 0069	ADR 0069 D-2 + premise review hardening.	PLN-0076 carries precision policy and field-class scoping.
PLN-0133	Closed	Done	Conformance, ADR/spec	Merged into PLN-0080: FEL timezone migration plan is part of staged `today()`/`now()` enforcement.	No active implementation remains in this row.	ADR 0069	ADR 0069 D-6 + implementation plan + premise review hardening.	PLN-0080 carries lint/warn/policy-gate/hard-fail rollout criteria.
PLN-0136	Closed	Done	WOS, CI, Conformance	Merged into PLN-0135: Tier-1 extension rule parity is part of uniform WOS extension-seam hardening.	No active implementation remains in this row.	ADR 0064	handoff §4.1 + ADR 0064 D-1/D-3 loop reliability requirement.	PLN-0135 carries schema and rule coverage for extension allow/reject behavior.
PLN-0137	Closed	Done	WOS, CI, Conformance	Merged into PLN-0276: truth-in-coverage work is now the WOS rule-coverage ratchet and CI promotion seed.	No active implementation remains in this row.	ADR 0064	ADR 0064 Alternatives Considered #1 (revisit trigger depends on §4.2 metrics) + open-questions Q4 actions.	PLN-0276 carries rule coverage workflow and ratchet work.
PLN-0138	Closed	Done	WOS	Merged into PLN-0277: release-train compatibility residuals belong with WOS release automation.	No active implementation remains in this row.	ADR 0064	ADR 0064 Consequences + handoff §4.4 + open-questions Q3/Q5.	PLN-0277 carries Changesets, publish script, release workflow, and README versioning work.
PLN-0139	Closed	Done	WOS, Conformance	Closed: broad Claim-A enablement umbrella is superseded by granular WOS audit rows PLN-0275 through PLN-0288.	No active implementation remains in this row.	ADR 0064	ADR 0064 Consequences + handoff §5.1-§5.6 + open-questions Q1/Q2/Q6.	Closed row is not active; canonical row or source artifact carries remaining work.
PLN-0141	Closed	Done	WOS, CI, ADR/spec	Superseded by ADR 0064 posture: ADR 0064 D-1..D-4 are load-bearing decisions; remaining work is residual execution/hardening, not reopening the ADR character.	No active decision remains; retained only as closed-history context.	ADR 0064	ADR 0064 Decision scope wording + premise review.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0142	Closed	Done	WOS, CI, ADR/spec	Merged into PLN-0146: ADR 0064 revisit evidence belongs in the Revisit Rubric edit, not the active question queue.	No active decision remains; retained only as closed-history context.	ADR 0064	ADR 0064 Alternatives Considered + handoff/open-questions follow-on.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0143	Closed	Done	WOS, CI, ADR/spec	Merged into PLN-0145: Schema-count wording is an editorial hardening edit; it is not a live architecture question.	No active decision remains; retained only as closed-history context.	ADR 0064	ADR 0064 Context/D-1 ("18 schemas") + premise review.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0151	Closed	Done	WOS, CI, ADR/spec	Split into PLN-0166/0167/0168: ADR 0067 umbrella defaults are three separate decisions: timestamp granularity, post-hoc elapsed closure, and multi-jurisdiction behavior.	No active decision remains; retained only as closed-history context.	ADR 0067	ADR 0067 Open questions.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0169	Closed	Done	Formspec, WOS, CI, ADR/spec	Merged into PLN-0172: Dual-origin StatuteClock arbitration belongs in the ADR 0067 ownership/arbitration hardening row.	No active decision remains; retained only as closed-history context.	ADR 0067	ADR 0067 D-2 (implementation uncertainty from premise review).	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0244	Closed	Done	WOS	Merged into PLN-0243: foreach transition execution uses existing Kernel §4.7 sequence; no standalone implementation is required.	No active implementation remains in this row.	ADR 0078	ADR 0078 Implementation plan step 2.	PLN-0243 carries foreach prose landing and confirms transition sequence reuse.
PLN-0246	Closed	Done	WOS	Merged into PLN-0243: foreach mutation history uses existing `mutationSource: computed`; no standalone implementation is required.	No active implementation remains in this row.	ADR 0078	ADR 0078 Implementation plan step 4.	PLN-0243/0247 carry foreach mutation/provenance prose.
PLN-0269	Closed	Done	CI, ADR/spec	Superseded by ADR 0080: Coercion stays per-surface in binding maps; projection mismatches fail atomically.	No active decision remains; retained only as closed-history context.	ADR 0080	ADR 0080 Open Question #1.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0270	Closed	Done	WOS, CI, ADR/spec	Superseded by ADR 0080 + PLN-0233: `verificationLevel` stays optional at L0 and profile-governed for rights-impacting transitions; concrete lint work is PLN-0233.	No active decision remains; retained only as closed-history context.	ADR 0080	ADR 0080 Open Question #2.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0271	Closed	Done	WOS, CI, ADR/spec	Superseded by ADR 0080: Quarantine reset authorization belongs to AI Integration policy; kernel only records the provenance fact.	No active decision remains; retained only as closed-history context.	ADR 0080	ADR 0080 Open Question #3.	Closed row is not in the active question queue; canonical row or source ADR carries any remaining work.
PLN-0280	Closed	Done	WOS, Conformance	Merged into PLN-0279: determination fixture migration belongs with K-DET-001 promotion evidence.	No active implementation remains in this row.	WOS audit 2026-04-24	audit verdict 3 + cross-ref delta.	PLN-0279 carries rule promotion and fixture migration proof.
PLN-0283	Closed	Done	WOS, CI	Merged into reopened PLN-0282: legal-sufficiency cross-reference and Invariant 6 deduplication belong in one current-artifact reconciliation pass, not a separate closed-stale claim.	No active implementation remains in this row.	WOS audit 2026-04-24	audit verdict 17.	PLN-0282 carries current evidence reconciliation and any remaining precise follow-up creation.
PLN-0284	Closed	Done	WOS, CI, ADR/spec	Merged into reopened PLN-0282: the feature-matrix/spec-schema mismatch must be checked against current WOS artifacts before any prose-or-flip implementation is filed.	No active decision remains; retained only as closed-history context.	WOS audit 2026-04-24	audit verdict 17 + cross-ref delta + audit recommendation 2.	PLN-0282 carries the active reconciliation; this row preserves the prior audit-question history only.
PLN-0288	Closed	Done	WOS, Trellis, CI	Merged into PLN-0278: synth completion criterion 6 depends on the WOS benchmark suite.	No active implementation remains in this row.	WOS audit 2026-04-24	audit verdict 10 + audit recommendation 4.	PLN-0278 carries benchmark and convergence completion criteria.
PLN-0292	Closed	Done	Formspec, WOS	Closed: Phase 11 master is overtaken by ADR 0073 `IntakeHandoff`; archive action PLN-0304 carries remaining cleanup.	No active implementation remains in this row.	ADR 0073, WOS audit 2026-04-24, Phase 11 master	audit verdict 24 (`specs/2026-04-11-formspec-wos-phase11-integration-master.md`).	PLN-0304 carries frontmatter flip and archive path for Phase 11 master.

Navigation Menu

Uh oh!

Planning Backlog (Cross-ADR)

Reading guide for active clusters

Active Spec/ADR Questions

Outstanding Implementation Tasks

Semantic Spec/ADR Edits and Review Cleanup

Safe Clerical Edits and Review Cleanup

Future Optional / Trigger-Gated Work

Closed / Merged / Superseded Rows

Uh oh!

FilesExpand file tree

PLANNING.md

Latest commit

History

PLANNING.md

File metadata and controls

Planning Backlog (Cross-ADR)

Reading guide for active clusters

Active Spec/ADR Questions

Outstanding Implementation Tasks

Semantic Spec/ADR Edits and Review Cleanup

Safe Clerical Edits and Review Cleanup

Future Optional / Trigger-Gated Work

Closed / Merged / Superseded Rows