docs(decisions): 0258 — the Filed by an agent footer is a wire format fabrika owns (#4759)

[usirin]

Fixes #4759

Records the founder-delegated ruling of 2026-08-10 on #4759 as ADR 0258,
.decisions/0258-report-footer-is-a-pinned-wire-format.md. Purely additive: one ADR file, no other
change.

The ruling this records

the 'Filed by an agent' footer is a wire format owned by fabrika's wire group. One pinned
byte-level spec + golden fixture in wire's contract; report file (the writer) and every reader
test against that one fixture.
— #4759 comment

It is the same ruling #4892 got, so the ADR applies ADR 0251's rule (re-implement calls, pin
formats) to a second shared format rather than inventing a new one. ADR 0238 stands unchanged on
calls; ADR 0159 keeps the marker's meaning and only the ownership of its bytes is settled here.
The #4619 operator-authorship ruling is named as the policy layer above this mechanical one, and is
explicitly not weakened.

Acceptance criteria (from triage's seed)

• An ADR records whether the marker gets an executable pin and which artifact owns it,
  reconciled against ADR 0238's call ban and the deletion test. It does: one wire schema
  module + registry row + a committed fixture file. The pin is a test-time file read, not an
  import or a call, so 0238 is untouched; the v1-side conformance test lives in
  packages/pipeline-cli/ and is deleted with v1, so the deletion test passes in the direction
  that matters.
• The ruling states which producers are in scope. A table names all three:
  packages/fabrika-cli/src/report/compose.ts (emits through the module),
  claude-plugins/kampus-pipeline/skills/report/footer.sh (conforms by a v1-owned test), and
  claude-plugins/kampus-pipeline/skills/wayfinder/SKILL.md — which is ruled not a producer,
  because prose telling a model to write bytes has no pin a test can hold, so it must call the
  one emitter. That third row is stated as the honest limit of the ruling.
• The ruling names the authority the pin asserts against. It splits the authority in two and
  names both halves — see ## Deviations, this is where the ADR departs from the seed.
• report note's deliberate omission is preserved. Stated in the Decision and repeated in
  the Banned list; the test asserting its absence stays.
• A follow-up implementation issue is filed — land the Filed by an agent footer as a wire format — module, fixture, registry row, and the two conformance tests (ADR 0258) #5284 carries the module, the fixture, the
  registry row, both conformance tests, and the migration of the two skill-contract shape
  restatements into the module.

Grounding

Every source claim was re-verified at origin/main while writing, not taken from the intake note.
One of them changed the shape of the fix: the report and triage both recorded that there was no
consumer-side artifact to pin against — true when each looked, and no longer true.
packages/fabrika-cli/src/triage/provenance.ts now ships hasAgentFooter
(/^<sub>Filed by an agent/m), which triage kill re-runs itself. The seam is code-to-code on both
sides today, which is why the ADR can rule "the reader becomes the module's read" rather than
"there is nothing to pin." The ADR's method lesson records this.

Also verified rather than assumed: the deliberate divergence between the anchored reader and
file-verb.ts's bare substring read-back (both docblocks state it), and the two existing shape
restatements in claude-plugins/fabrika/skills/report/contract.md and
claude-plugins/fabrika/skills/triage/contract.md that ADR 0241 bans and this format's module gives
a home.

Deviations

The ruling and triage's seed name different authorities for the pin; the ADR follows the later
ruling and says so out loud. Triage's acceptance criteria (2026-08-02) asked the pin to assert
against "the gh-issue-intake-formats.md §4.5 / ADR 0159 contract, not either implementation." The
founder-delegated ruling (2026-08-10) puts the byte authority in fabrika's wire contract instead.
Those are different artifacts — v1's formats doc versus fabrika's owner module. The ADR follows the
ruling, and reconciles the seed's actual concern two ways: the authority is still neither
implementation (the module owns the bytes, both producers become conformers), and ADR 0159 keeps
the authority over the marker's meaning. The ADR carries this in its own ## Deviations section and
records that the veto is open — if the founder wants §4.5 to hold the byte authority, the ADR is
amended.

ADR number. 0258 was pre-assigned by the dispatcher. Re-verified before committing: origin/main
tops out at 0252 and the in-flight reservation set (open PRs adding a .decisions/NNNN-*.md) tops
out at 0257, so max(union) + 1 is 0258. The enumeration agrees with the assignment.

Contradiction sweep run, nothing to cite. adr/scripts/sweep-shortlist.sh returned eight
lexically adjacent live-accepted ADRs (0246, 0242, 0152, 0244, 0245, 0252, 0236, 0229). Each was read
against the questions this ADR settles — who owns a shared byte format, and how a non-owner conforms.
None rules on either; the adjacency is vocabulary overlap (provenance, fabrika, reader), not a
same-question decision. Nothing superseded, nothing amended-in-part.

No vocabulary impact. Wire format is coined in ADR 0241 and applied here; filing provenance
and the never-auto-close signal are ADR 0159's and are used, not redefined. Recorded explicitly in
the ADR's ## Records.

Routing note

.decisions/** matches no CODEOWNERS row, but ADR 0164 classifies by content as well as path — a
reviewer should run the content probe rather than assume this auto-ships.

[github-actions]

No preview deploy

• No preview deploy for this PR — its diff touches no deploy-relevant path, so no preview stack was minted and e2e is not applicable. _(b834d4e)

• web — Stage pr-5285 torn down.

[usirin]

review-doc: advisory — blocking-set PR (§CP — approval-gated)

PR #5285 is §CP. Path axis is clear — .decisions/** matches no CODEOWNERS row — but ADR 0164
classifies by content, and the shared guard-content-probe verb flags the one changed file:
.decisions/0258-report-footer-is-a-pinned-wire-format.md → guard-touching [guard-vocabulary-match].
cp-classify agrees, returning content-undetermined [content-source-present] on the path axis, which
is not a non-§CP answer. Deciding axis: content (ADR 0164).

My verdict is advisory only: it does not authorize a merge. Under the §CP hard gate (ADR 0135),
a @kamp-us/control-plane member approves this at its current head and ship-it then enqueues it
(ADR 0048 single merge authority) — there is no human hand-merge in the §CP path.

Reviewed-head: @ b834d4e

Class fan. pipeline-cli class-probe classify --namespaces at this head over the changed-file set
returns exactly one namespace: review-doc (1 file, has-docs). No code root, no skills path, no
apps/web/src/ path — so no review-code, review-skill or review-design is required or emitted.

Verified against #4759's acceptance criteria + doc hygiene — all checks pass:

Acceptance criteria (triage seed, #4759 comment)

• [PASS] An ADR records whether the marker gets an executable pin and which artifact owns it,
  reconciled against ADR 0238's call ban and the deletion test. ## Decision rules it a wire
  format owned by fabrika's wire group — one schema module + one registry row + one committed
  fixture. 0238 is reconciled twice and correctly: "ADR 0238's ban is about calls and is untouched",
  and "A file read at test time is not an import and not a call." The deletion test is answered in
  the direction 0238 protects — the v1-side conformance test lives in packages/pipeline-cli/ and
  dies with v1, leaving fabrika whole. That is precisely the shape ADR 0251 already ruled for the
  --epic envelope, so the seed's "a fixture read is a tether too" worry is met, not sidestepped.
• [PASS] The ruling states which producers are in scope. A three-row table names all of them:
  packages/fabrika-cli/src/report/compose.ts (emits through the module),
  claude-plugins/kampus-pipeline/skills/report/footer.sh (conforms via a v1-owned test), and
  claude-plugins/kampus-pipeline/skills/wayfinder/SKILL.md — ruled not a producer, since prose
  telling a model to write bytes holds no pin a test can grip, so it must call the one emitter. The
  ADR states that third row as the honest limit of the ruling rather than hiding it.
• [PASS] The ruling names the authority the pin asserts against — with a disclosed departure from
  the seed's named artifact, which I rule correct. See the two-rulings finding below.
• [PASS] report note's deliberate omission is preserved. Stated in ## Decision and re-stated in
  the Banned list. Verified in source: packages/fabrika-cli/src/report/note-verb.unit.test.ts:108
  asserts not.toContain("Filed by an agent"), and the ADR keeps that test.
• [PASS] A follow-up implementation issue is filed. land the Filed by an agent footer as a wire format — module, fixture, registry row, and the two conformance tests (ADR 0258) #5284 is open and carries exactly the deferred
  scope — module, fixture, registry row, both conformance tests, and the migration of the two
  skill-contract shape restatements.

The two-rulings handling — ruled CORRECT

I read both rulings first-party rather than through the PR body.

• The triage seed (2026-08-02) asked the pin to assert against "the gh-issue-intake-formats.md §4.5
  / ADR 0159 contract, not either implementation."
• The founder-delegated ruling (2026-08-10, #4759 comment)
  instead puts byte authority in fabrika's wire contract: "One pinned byte-level spec + golden
  fixture in wire's contract."

These name different artifacts and the conflict is real. The ADR follows the later ruling and
discloses the departure under a literal ## Deviations heading in both the PR body and the ADR
file, names both artifacts, says which governs and why, and records that the veto is open. That is
disclose-and-follow-the-later-one, not a silent contradiction.

Three things make it more than mere recency. First, the seed's own reasoning for naming §4.5 was
explicitly premised on "there is no consumer-side artifact to pin against today" — and that premise
is now false, which the ADR verified at head and recorded as its method lesson. Second, the seed's
actual concern (not either implementation) survives intact: the module owns the bytes and both
producers become conformers. Third, ADR 0159 keeps the authority the seed cared most about — the
marker's meaning. I checked 0159 directly: it rules the present/absent semantic and calls the
literal "the invariant tell", but it never claims ownership of the byte spec, so 0258's split
(0159 = what the marker means; the module = what it is, byte for byte) needs no amendment to 0159 and
none is claimed. Nothing is silently narrowed.

The #4619 layer is handled correctly too. The ruling's own words — "the footer format is the
mechanical layer, #4619 is the policy layer; pinning one does not weaken the other" — are reproduced
faithfully in the ADR, and the Banned list preserves the narrowing (reading footer-absence as
human-authored for an operator-set account). This matches both the #4619 ruling itself and the
docblock already shipped in packages/fabrika-cli/src/triage/provenance.ts.

Grounding correction — independently verified at source, not from the PR body

The claim that the seam is now code-to-code on both sides holds exactly:

• packages/fabrika-cli/src/triage/provenance.ts:37 ships hasAgentFooter, matching
  /^<sub>Filed by an agent/m after CRLF normalization.
• triage kill re-runs it rather than trusting a caller: kill-verb.ts:43 imports provenanceOf,
  calls it at :119, and provenance.ts:81 routes through hasAgentFooter.
• The deliberate divergence the ADR preserves is real and documented on both sides:
  file-verb.ts:81 is a bare body.includes("Filed by an agent") over its own freshly-composed body,
  and provenance.ts's docblock states the anchor exists so a body that merely quotes the phrase
  cannot answer the close-eligible direction. The ADR keeps them apart and bans collapsing them.

So the intake note and triage's "no consumer-side artifact to pin against" were both true when
written and are no longer true — the ADR is right to rule "the reader becomes the module's read"
instead of "there is nothing to pin."

Every other source claim was re-verified at a freshly fetched origin/main:
compose.ts:98 (literal first in parts, outside the :103 null-filter, rendered :104),
footer.sh:11, wayfinder/SKILL.md:497 (instructs, composes nothing), and both golden-fixture.ts
readers plus wire/registry.ts exist as described.

ADR number 0258 — uncontested at this head

Enumerated the reservation set myself: origin/main tops out at 0252; the open PRs adding a
.decisions/NNNN-*.md claim 0257 (#5282), 0256 (#5281), 0255 (#5277), 0253 (#5273), 0253 (#5271),
0237 (#4703), 0235 (#4614). Nothing claims 0258, so max(union) + 1 = 0258. The pre-assignment holds.

Doc hygiene

• [PASS] House-format — frontmatter carries id/title/status/date/tags; ## Context,
  ## Decision, ## Consequences all present, plus the house extras (Sequencing, Not decided here, Deviations, Records).
• [PASS] Index row + status match — purely additive, no .decisions/index.md committed (correct per
  ADR 0126); frontmatter status: accepted.
• [PASS] Links resolve — all four relative ADR links exist at their exact filenames on origin/main
  (0159, 0238, 0241, 0251), as do all seven repo paths the prose asserts.
• [PASS] No leaked local/home paths — added-lines scan via the shared matcher: clean.
• [PASS] Supersession noted + cross-linked — n/a by design, and correctly so: the ADR states 0159 is
  "not superseded or amended by this — only the ownership of its bytes is settled here", which I
  confirmed against 0159's own text. Nothing needs a forward pointer.
• [PASS] Status sanity — accepted is coherent; this records a settled founder-delegated ruling.
• [PASS] Single Diátaxis mode — single-mode: explanation. Sequencing states what is deferred and why,
  which is rationale, not a procedure; no how-to intrusion.
• [PASS] Clear, concise prose — active voice, concrete, no AI-tell density. House idioms are
  established vocabulary.

ADR contradiction sweep (Step 4a)

• [PASS] Ran independently at the PR head. 250 ADRs scanned, 209 live-accepted + uncited in scope,
  cites 0159/0238/0241/0251. Shortlist of 8 — 0246, 0242, 0152, 0244, 0245, 0252, 0236, 0229 —
  reproducing the author's disclosed set exactly. Opened each: none rules on either question this
  ADR settles (who owns a shared byte format; how a non-owner conforms). The adjacency is vocabulary
  overlap — provenance, fabrika, reader, predicate — not a same-question decision. Semantic
  pass by hand over the four cited governing ADRs: 0251's rule is applied faithfully (including the
  test-ownership direction — a test asserting a v1 property lives with v1), 0241's staging condition
  is genuinely met (both consumers shipped) and its skill-body-restatement ban is honored by deferring
  the two contract.md migrations to the module that will hold them, 0238 is untouched, 0159 keeps its
  meaning authority. Nothing superseded, nothing amended-in-part.

Deviation disclosure (§DEV)

• [PASS] deviation-disclosure — the literal ## Deviations heading is present in the PR body (not
  merely as prose under another heading) and again in the ADR file, and I checked the two separately.
  Both disclose the same seam: the ruling-vs-seed authority split, the ADR-number derivation, the
  contradiction sweep, and the no-vocabulary-impact note. The departure is disclosed, authorized by the
  later founder-delegated ruling, and carries an open veto. Nothing undisclosed that this gate could see.

Read the PR head (§HEAD): all files under review sourced from b834d4e3feb7841123b4342abdb4d1c6200817d8
via a per-run ref and git show, never the launched checkout's working copy; ground-truth checks ran
against a freshly fetched origin/main.

Verdict-written: 2026-08-10T05:12:02Z