docs: correct drift the v0.13.4 crosscheck found in the internals and delivery chapters

.abcd/development/brief/05-internals/01-agents.md

@@ -51,10 +51,13 @@ record carries, and two hand-kept copies drift the moment one side gains a field
 So the cold-reading item contract does not live with cold reading; the reading
 package imports it from there.
 
-`agents/` also holds two plain docs, its README and its changelog, which carry no
-agent frontmatter. Because the plugin manifest declares no agents key, the loader
-globs the flat `agents/*.md` set and registers both as harness agents alongside
-the real prompt files; iss-110 tracks the mis-registration.
+`agents/` holds the prompt files and their per-agent fixture directories and
+nothing else. Because the plugin manifest declares no agents key, the loader
+globs the flat `agents/*.md` set and registers every file in it as a harness
+agent, so the roster's README and changelog, plain docs with no agent
+frontmatter, live at [`.abcd/development/agents/`](../../agents/README.md)
+instead (iss-110), and `TestPluginAgentSurfaceRegistersOnlyAgents` holds the
+directory to prompts alone.
 
 ## The design roster still to be built
 
@@ -153,11 +156,19 @@ does the deterministic work and hands a prompt to the host's subagent dispatch,
 which owns model choice, credentials and execution, and abcd consumes the
 structured result.
 
-Concrete backends are **opt-in adapters** behind the same seam, selected when an
-operator wants abcd to reach a model directly: a local model, a model CLI run as a
-subprocess, a provider API, or a model over MCP. The `oracle.backend` config key
-records the choice, defaulting to host-delegated; an unreachable adapter degrades
-to that default rather than blocking. Per
+Concrete backends are **opt-in adapters** behind the same seam, for an operator
+who wants abcd to reach a model directly. Two ship. A provider API, hosted or a
+local OpenAI-compatible server, is reached through the OpenAI-compatible adapter
+by pointing an agent's `oracle.roles` entry at `<provider>/<model>` on a
+connection `abcd ahoy connect` configured
+([`03-configuration.md` § The provider adapter's keys](03-configuration.md#the-provider-adapters-keys));
+a provider that cannot be reached leaves the step to the host rather than
+blocking. A model CLI run as a subprocess is a runner that
+`roles.<role>.runner` names (`internal/core/runner`); an absent or failing
+runner hands the role back to the host. A model over MCP is a **design
+target**. The `oracle.backend` config key records a choice, defaulting to
+host-delegated, and routes nothing: host-delegated is the only value with an
+adapter behind it, so install records it without asking. Per
 [`04-universal-patterns.md § 7`](04-universal-patterns.md#7-vendor-agnostic-adapters-with-environment-branching)
 the seam is one interface with a native default and opt-in shapes, never a fixed
 cascade the core imposes.

.abcd/development/brief/05-internals/03-configuration.md

@@ -1,9 +1,13 @@
 # Configuration Model
 
 Almost nothing here is a decision anyone has to make. Installing abcd asks four
-questions, records the answers, and gets on with it; four further keys can be
-hand-set and are read but never written. That is the whole of the configuration
-surface the shipped binary consults. Everything else on this page is either a
+questions, records the answers, and gets on with it; `ahoy install
+--attribution` writes one more key, and four further keys can be hand-set and
+are read but never written. Beyond those nine, the binary reads only keys a
+person opts into: the provider adapter's `oracle` keys and the interview's list
+style, both below, the implement loop's `pace`
+(`internal/core/implement/loop/pace.go`), and the runner routes under `roles`
+and `runner` (`internal/core/runner/config.go`). Everything else on this page is either a
 store abcd lays out for itself, a policy that follows from one of those four
 answers, or an axis the design commits to and has not built.
 
@@ -290,10 +294,10 @@ belong in a drainer layer that does not exist.
 Schema versioning and cross-version migration come in a later phase: a
 configuration record carries `schema_version: 1`, and migrators are added if a
 later phase changes the shape (itd-9). The stamp is a convention rather than a
-held rule, and the tree is not uniform — eight of the thirteen committed records
-carry it, and five do not, the record-lint and docs-lint configuration among
+held rule, and the tree is not uniform — eight of the fourteen committed records
+carry it, and six do not, the record-lint and docs-lint configuration among
 them. Nothing refuses an unstamped record, so a migration that arrives before the
-stamps do has no version to read on those five.
+stamps do has no version to read on those six.
 
 ## The history store
 
@@ -978,7 +982,7 @@ not tied to a spec into `.abcd/work/reviews/`, where the reviews charter already
 governs the shape any sweep would have to meet; the local tier's notes into a
 curated notes target; and an external tool's workspace state into its own
 namespace (itd-7). Only the memory package exists today, and its shipped front
-door takes a URL rather than a harvested directory.
+door takes a local file or an https URL rather than a harvested directory.
 
 Two triggers are drawn: an implicit one at disembark's first phase, and a manual
 CLI refresh. Per-source enable flags would default to on for a private repo and off
@@ -1033,13 +1037,17 @@ abcd/
 │   ├── core/                           # transport-agnostic core, one package per capability
 │   │                                   #   (adr-23); each returns structured results
 │   ├── adapter/                        # the seam packages (adr-22): interface + native default
-│   │   ├── scanner/                    #   + optional plug-in. The scanner is the one seam with a
-│   │   └── gitleaks/                   #   package today; 02-adapters.md is the catalogue
-│   └── surface/cli/                    # the only front door that ships (an mcp/ door is adr-23's third)
+│   │   ├── scanner/                    #   + optional plug-in. The scanner is the one capability
+│   │   ├── gitleaks/                   #   seam with a package today; gitleaks is its plug-in, and
+│   │   ├── hosting/                    #   hosting, openaiapi and tailscale are adapters outside
+│   │   ├── openaiapi/                  #   the capability seams; 02-adapters.md is the catalogue
+│   │   └── tailscale/
+│   └── surface/                        # front doors: cli/, and dashboard/, the one network
+│                                       #   listener (an mcp/ door is adr-23's third)
 ├── commands/<verb>.md                  # markdown command surfaces, flat; the gated list lives in
 │                                       #   ../04-surfaces/README.md (abcd.md is the bare /abcd board)
-├── agents/<name>.md                    # host-delegated agent prompts, plus per-agent fixtures/,
-│                                       #   README.md and CHANGELOG.md — see 01-agents.md
+├── agents/<name>.md                    # host-delegated agent prompts, plus per-agent fixtures/
+│                                       #   and nothing else — see 01-agents.md
 └── hooks/                              # host event hooks; every event command runs through a
     ├── bootstrap.sh                    #   resolving shim. bootstrap.sh PROVISIONS the plugin-root
     ├── <event>.sh                      #   binary and never builds one. Each event's shim is its own

.abcd/development/brief/05-internals/05-prompt-quality.md

@@ -70,9 +70,14 @@ The design target: each agent ships two or three fixture inputs with an expected
 output structure, validated by schema and judged by an oracle for whether the
 output is good enough, run in CI by a generic harness.
 
-Neither half exists. There is no `internal/core/prompttest` package, and every
-shipped agent's `fixtures/` directory holds exactly one file, the injection canary,
-which is layer C's presence check rather than a golden test. The harness lands with
+Neither half exists as a generic layer. There is no `internal/core/prompttest`
+package, and sixteen of the eighteen shipped agents' `fixtures/` directories hold
+exactly one file, the injection canary, which is layer C's presence check rather
+than a golden test. The other two add fixtures for a second output: the intent
+auditor a canary for its consistency role, and the release changelog composer a
+canary for its release page and a no-forecast fixture. The composer's three carry
+expected payloads that `internal/core/release/fixtures_test.go` runs through the
+real ingest, with no model in the loop. The harness lands with
 the first Pass-A agent's spec (the lifeboat pipeline, whose original plan the retired [Phase 6](../../roadmap/phases/phase-6-lifeboat.md) document holds),
 the point at which a second agent exists to generalise the runner over.
 

.abcd/development/brief/06-delivery/01-build-sequence.md

@@ -30,9 +30,14 @@ load cleanly.
 
 A seam is stood up by the milestone that first consumes it, never on day one:
 "wired or it isn't done" forbids the stub-interface scaffold this milestone was
-first drawn around. The scanner is the one seam standing — the native secret and
-PII scan, with an external backend as its config-selected plug-in. The oracle,
-history, spec and run seams, and the wiring packages beside them, are planned
+first drawn around. The scanner is the one capability seam standing — the native
+secret and PII scan, with an external backend as its config-selected plug-in.
+Three further adapter packages stand outside the capability seams: `openaiapi`,
+the opt-in OpenAI-compatible provider an agent's oracle role can be pointed at;
+`hosting`, the provider seam `abcd site setup` routes a rendered site through;
+and `tailscale`, the dashboard's view of this computer's own addresses. The
+oracle seam's own package, the history, spec and run seams, and the wiring
+packages beside them, are planned
 rather than present, and the claim is gated rather than trusted: the `index_drift`
 record-lint rule holds every path in the planned-seams region of
 [`internal/README.md`](../../../../internal/README.md) to being absent from the
@@ -51,9 +56,11 @@ core and the packaging boundary holds.
   the conventions marker block and the rules loader (itd-3), and bootstrapping the
   user-scope history store. There is no `abcd init` and no config get/set pair:
   install is the write path a person reaches for, and the bare invocation,
-  its `--dry-run`, `--identity` and `--remote` modes, and `doctor` are the
-  read-only halves. Two further forms write: `uninstall` takes abcd back out again, and
-  `remote apply` turns on the forge's own secret scanning. The full surface is
+  its `--dry-run`, `--identity`, `--remote` and `--providers` modes, and `doctor`
+  are the read-only halves. Four further forms write: `uninstall` takes abcd back
+  out again, `remote apply` turns on the forge's own secret scanning, `connect`
+  configures a provider on this machine after one verification call, and
+  `credential --home` stores a verified key. The full surface is
   the machine-checked table in
   [`04-surfaces/01-ahoy.md`](../04-surfaces/01-ahoy.md); this milestone is what
   install has to do, not the whole verb.
@@ -82,20 +89,23 @@ core and the packaging boundary holds.
 
 ## 3. Intent, brief, and review through the host-delegated oracle
 
-- **intent**: `/abcd:intent` (itd-1, itd-27, itd-34), with press-release
+- **intent**: `/abcd:intent` (itd-1, itd-34, itd-94), with press-release
   composition. Creation is bare quoted text; the shipped sub-verbs are the machine-checked table in
   [`../04-surfaces/05-intent.md`](../04-surfaces/05-intent.md). Shipping runs the
   other way round: an intent moves to `shipped/` as the close-hook of `abcd spec
   close` — on the close after which no open spec names it, since an intent owns
-  one or more specs — so there is no `intent ship`. `grill` is a design target (itd-27); the
-  admission gauntlet that ships is `/abcd:ideate`.
+  one or more specs — so there is no `intent ship`. There is no `grill` sub-verb
+  either: the grilling itd-27 asked for is the planning interview, `abcd intent
+  interview`, under itd-94, which supersedes it; the admission gauntlet that
+  ships is `/abcd:ideate`.
 - **review**: the oracle seam, **host-delegated by default**
   ([adr-25](../../decisions/adrs/0025-host-delegated-llm-default.md)): abcd emits
   a prompt, the host's subagent dispatch runs it, abcd consumes the structured
   result. Native, CLI, API and MCP adapters are opt-in for an operator who wants
   abcd to reach a model directly; the default install needs no API keys.
 - **MCP front door** *(design target)*: a second thin door over the unchanged
-  core (adr-23). `internal/surface/` holds one door, `cli`; the second is added
+  core (adr-23). `internal/surface/` holds `cli`, the one door onto the core, and
+  `dashboard`, the network listener behind `abcd dashboard`; the second door is added
   once a surface is worth exposing, and the core needs no rework for it because it
   is transport-agnostic already.
 
@@ -126,9 +136,10 @@ and a companion agent loop as opt-in adapter loops behind the same contract. The
 receipt-gated, report-not-block iteration boundary is the seam contract every
 adapter loop inherits.
 
-Nothing of this ships: the binary registers no `run` verb, the run adapter is on
-the planned-seams list, and the operator surface over it is itd-29, in
-`intents/planned/`.
+The seam does not ship: the binary registers no `run` verb, and the run adapter
+is on the planned-seams list. The operator surface itd-29 drew over it is
+superseded by itd-2609201916151817, in `intents/planned/`, whose loop ships on
+the intent key without the seam, through `abcd build`.
 
 ## 6. Lifeboat round-trip