Improvement: enforce the engine's own label contract

[StarshipSuperjam]

Closes #656

A green mechanical check below shows this change conforms to the engine's rules — not that it is correct. What covers correctness is the behavioural steps in Review and your own read of the change; a green check is never a substitute for that. Your merge is the binding gate.

About those checks: only the one that runs when the change is proposed for merge can stop a risky merge — a check that ran while the change was still being written is early advice. Each check is itself proven against a deliberately broken example it must catch, so a passing check can't be one that quietly did nothing — but that proves the check works, not that this change is right. And a check that could not run leaves its area unverified.

Purpose

Make issue labels consistent by enforcing the engine's own label contract — the load-bearing engine label stops getting missed, and the GitHub-native kind labels are applied mechanically instead of by session discipline.

• Grounding found the failure at ~50× the issue's estimate: 55 issues carried a phantom engine-domain label (a session took the descriptive phrase "the engine-domain label" literally — the canonical string is engine) and 54 more open issues had no domain label at all. All were invisible to the debt register, miscounted as the operator's own backlog on the boot card, and skipped the issue-body conformance gate.
• The operator's rulings shaping this: no new/custom labels ever, but the four GitHub-native kind labels (bug, enhancement, documentation, question) should be applied, derived from the title's Kind: prefix — mechanically, so consistency doesn't depend on a session remembering.

Impact: engine-health issues now reliably enter the debt register, the boot counts, and the conformance gate, and every new issue gets its native kind label automatically.

Scope

One PR: the label contract written where sessions read, a settable urgency trailer, a truthful label description, a new title-derived kind-label applicator, and a one-time reconciliation of the live repo's labels.

• The Explore-briefing issue-logging carve-out (modes.py) and the issue_author docstring now state the contract: an engine-health issue carries --label engine at creation, whoever asked — the literal string, never engine-domain; other issues get their native kind label from the engine; a session never mints a label.
• render_engine_issue_body gains an optional urgency argument (telemetry's two classes only; default unrated) appending the same invisible severity marker telemetry writes — composed by the new single source telemetry.severity_trailer.
• ENGINE_DOMAIN_LABEL_DESCRIPTION reworded subject-based ("About the engine's own health (not your product).") — session-filed engine-health issues are normal now, so "Opened by the engine" was wrong on authorship. bootstrap.py reads it live; the GitHub label was updated to match.
• New issue_kind_label.py (pure native_label_for_title mapping + an on: issues CI applicator) and engine-issue-kind-label.yml; new shared issue_label_client.py that the conformance net now also builds on (one transport, not two copies).
• One-time GitHub reconciliation, executed and verified this session (details in Review): 55 engine-domain issues re-mapped to engine, the phantom label deleted, 54 unlabelled issues swept to engine, 38 native kind labels backfilled with the same mapping function the applicator uses, and the live engine description updated.

Change profile — the shape of this pull request at a glance:

• Size: 14 files changed, +856 / −114 lines (before review fixes; final +968 / −126).
• Kinds of thing touched: 11 tools, 3 other files (not in the engine's map).
• Where: .engine/tools, .engine/knowledge, .engine/provisioning, .github.
• Shape: 9 commits on this branch — a standalone change.

This is a description, not a gate — it never blocks a merge. It is here so you can weigh the change by what it touches, not by its line count.

Impact: labels become consistent by construction — the kind axis mechanically, the engine axis by a contract every session now reads at boot.

Behaviors

A session can grade an issue's urgency at filing; every new or edited issue with a mappable title kind gets its native label applied server-side; a session reading its boot briefing learns the exact label strings to use.

• render_engine_issue_body(urgency=…) appends the canonical severity marker last, recovered by telemetry.parse_severity — test_issue_author.py / test_telemetry.py; first real use: issue Improvement: give the boot-pack platform cap a margin canary so Tier-0 growth is caught before the dashboard sheds #899's body.
• A new/edited issue titled with a mappable Kind: prefix gets bug/enhancement/documentation/question added; unmappable titles get none; a native label the repo owner deleted is skipped, never recreated — issue_kind_label.py demo + test_issue_kind_label.py (including the workflow-entrypoint fail contract).
• The applicator's workflow travels to deployed repos and is CODEOWNER-owned — the FOUNDATION_INFRA membership assertions in test_issue_kind_label.py.

Out of scope

No new labels, no urgency backfill, and the engine axis stays contract-guided rather than mechanized.

• The urgency triage of existing engine issues is deferred to a separate session (operator decision); this PR only makes urgency settable.
• Whether an issue is about the engine's own health is a semantic judgment a title can't encode, so the engine label stays a written contract (briefing + docstring + the conformance net's reroute), not automation — only the kind axis is title-derivable.
• The boot-pack margin hair-trigger this build uncovered is tracked as its own issue (Improvement: give the boot-pack platform cap a margin canary so Tier-0 growth is caught before the dashboard sheds #899), not patched here beyond fitting this change inside the budget.

Impact: these are deliberate boundaries agreed with the operator, not gaps.

Risk

No guardrail weakens. The real surfaces are a new issues: write workflow driven by an attacker-controllable title, and ~150 irreversible GitHub label mutations executed outside the diff.

• modes.py is a guarded enforcement hook, but the edit is prose-only inside describe_explore_scope() — the weakening guard classifies it a soft disclosure (verified by tracing _HARD_EXACT and all directional detectors; engine-guard runs green, no acknowledgment needed) and the write-gate logic is untouched.
• The workflow reads the title only from $GITHUB_EVENT_PATH inside Python — never interpolated into a shell line — and the label it applies is a fixed enum, never title text; it is apply-only (cannot mint or strip), additive, non-gating, and cannot self-retrigger. Verified independently by the security review pass.
• The relabel was executed by an idempotent script that verified every engine-domain issue carried engine before the irreversible label delete; the full executed issue lists are recorded in Review. GitHub's per-issue timeline is the audit trail.
• Boot-count shift, disclosed: the engine-health count rises by ~109 (55 re-mapped + 54 swept) and the operator's own-backlog line drops to 0 — expected, since everything open in this mechanic repo is engine-internal work; not a regression.

Impact: the residual risk is bounded to a decorative label being absent where a repo owner deleted it — disclosed in the run log, never an error.

Validation

The full engine test suite passes fresh (5,097 tests), the CI validate suite is green, and both demos self-check.

• validate.py --suite CI: OK, no hard findings.
• Full unittest discover in a fresh worktree at the submitted commit: 5,097 tests, OK — including the new fail-contract, import-order, mapping, and FOUNDATION_INFRA registration tests, and the boot-pack platform-cap test this change first broke and then fixed with margin.
• issue_kind_label.py demo and issue_author.py demo: all self-checks OK, with genuinely reachable failure paths (a broken mapping exits non-zero).
• Live post-relabel verification: 0 open issues lack engine; engine-domain no longer exists as a label; the plan's named spot-check (Delivery wave 1 — local delivery kernel: settle the spec, then break out the build #843) passes; the live engine description matches the code.

Impact: an approver can rely on the code paths being exercised and the repo state being verified, not just asserted.

Review

A thorough review ran: four cold review passes before building and five after, every finding resolved or tracked, with one post-review fix pass that was itself re-verified.

• Depth: thorough (the operator's choice at the plan gate). Before building: independent cold reviews of the design's architecture, buildability, fit to the operator's intent, and risk/governance. After building: independent cold reviews of conformance to the agreed scope, hidden divergence, security and governance, technical integrity, and usability.

• Plan-stage findings, all resolved before code: a circular-import trap in the urgency design (fixed via telemetry.severity_trailer + a function-local import); the workflow's registration seam (FOUNDATION_INFRA, which nothing generic checks — now pinned by tests); a title-injection build invariant (title never reaches a shell); the relabel made idempotent with pre-delete verification; and a corrected guardrail claim — the modes.py edit is a soft disclosure, not an acknowledgment-requiring change.

• Build-stage findings and outcomes: the boot-briefing compaction had dropped the Kind: prefix syntax and the "whoever asked" clause — restored within the measured pack budget (fixed); the workflow entrypoint's fail contract was untested — now pinned with the same test shape its sibling carries (fixed); the urgency error message named the wrong parameter — fixed; the workflow log's "absent" case was ambiguous — now rendered as a sentence (fixed); the boot-pack's ~180-char standing margin is a hair-trigger — tracked as issue Improvement: give the boot-pack platform cap a margin canary so Tier-0 growth is caught before the dashboard sheds #899 (logged); a pre-existing timing flake in an untouched test file was identified as unrelated (no action).

• Post-review fixes were re-checked: between reviewed 3e19fd1 and submitted 3e19fd1 there is no divergence — the review-fix commit is the last commit, and after it the full suite was re-run fresh (5,097 tests, OK) plus the affected modules re-run scoped. In plain figures: between reviewed b8d5040 and submitted 3e19fd1, 112 lines were added and 12 deleted across 6 files, a net change of +100 lines, all of it the review-driven fixes above.

• The one-time relabel executed after review, with every step logged. Re-mapped from engine-domain to engine (55): Bug: collapse review depth to quick when no review lenses are installed #763 Feature: AI onboarding package — make every new repo's session AI operational on the Engine at install #765 Feature: allow Explore-mode writes to the harness memory store (Claude MEMORY.md), and fix the false 'saved' signal on a blocked write #766 New-repo provisioning doesn't surface the memory-backup offer #773 Engine health lifecycle: memory/capture-degraded can't auto-resolve, and Claude-side capture failures aren't diagnosable #774 Narrow the Explore write-gate's plan-mode carve-out to the plan artifact #775 Plan-mode conflict-offer copies omit the /config change path #776 The upstream-clean nudge speaks cross-fork wording over own-repo work #777 Boot's designed tool-runtime-absent finding has no producer #778 Stale comment narration: deleted memory machinery and the RETIRE_ELIGIBLE_CLASSES pin #779 Compaction demo prose names a guardrail-ack label the erasure path never checks #780 Log the sanctioning decision for the engine-erasure label exemption and the widened CI author set #782 Define the dependency-group grammar for a dependency shared by two modules #783 hooks.py's SessionStart owner inventory omits telemetry's bound hooks #784 Log the decision admitting actionlint to the advisory security floor #785 Evaluate a concept-ownership instrument for spec corpora #786 Evaluate growth-vector governance for orientation context (boot briefing size) #787 Evaluate a coverage-gap lifecycle for the knowledge graph #788 Evaluate typed session telemetry with threshold-triggered health checks #789 Add a catalog-routed well-formedness rule over the schema corpus (two schemas have no lock) #794 Log the blessing decision for the four unspecced hygiene and drift check rules #795 Log the decision admitting engine-recall as the single model-auto skill #796 agent-coherence's message says the audit persona keeps Bash; the shipped persona blocks it #797 The audit-prep workflow ships unowned: no manifest declares it and the self-map omits it #798 Three shipped operator verbs (engine-setup, engine-parts, engine-upgrade) have no admitting roster decision #799 The board-coordinate schema ships undeclared by any manifest and unenforced by its own tool #800 The board's live and cached debt counts can silently disagree with no staleness label #801 Two of product-design's lock-weight anti-churn legs are unbuilt: the re-litigation reconcile step and the don't-churn boot norm #802 The coverage floor still traces at capability granularity; the criterion-granular upgrade is unpaid #803 Product-intake instructs authoring committed spec files in Explore, where the write gate denies it — route the flow through Build #804 Institute a hard --help contract for every engine tool entry point #806 --help executes real actions in five engine tools (three touch live GitHub) #807 Two memory build-spec-leaf values (compaction waste threshold, backup cadence) have no durable decision record #811 Conformance sweep needs an owned-product arm for the mechanic topology #812 A merged memory erasure has no completion signal #813 Migration M1: enforce the audit digest's verdict block at emission with CLI-native structured output #815 Migration M2: SessionEnd — wire a real duty or retract the declared ownership #816 Migration M3: fix the routine naming collision in the engine's docs (local scheduled task vs the cloud Routines product) #817 Migration M4: widen the model-bindings effort vocabulary to the platform's ladder (carries a weakening acknowledgment) #818 Migration M5: document host hardening and the engine's load-bearing platform dependencies #819 Build the platform-currency module — the opt-in platform review, from its accepted capability description #820 Memory backup push fails once the ledger exceeds GitHub's single-blob API limit (~40 MB) #822 Shared --help/dispatch CLI seam in validate.py, consolidating the 17 copy-pasted emit()s #826 Retrofit the remaining ~48 accidental-rejection and read-only entry points onto the shared seam #827 Lock the --help contract with a hard CI check + biting fixture, and record the mandate #828 Delivery wave 1 — local delivery kernel: settle the spec, then break out the build #843 Delivery wave 2 — the environment plane: settle the spec, then break out the build #844 Delivery wave 3 — rendered web delivery: settle the spec, then break out the build #845 Delivery wave 4 — authority and deployment: settle the spec, then break out the build #846 Delivery wave 5 — operations and bounded repair: settle the spec, then break out the build #847 Delivery wave 6 — programs and platforms: settle the spec, then break out the build #848 Delivery wave 7 — views and learning: settle the spec, then break out the build #849 Feature: session-record friction audit — mine recent transcripts for recurring friction that never got a durable fix #866 Build-start sync gate: preflight refuses (or auto-syncs) when the build base is behind origin/main #878 Pin-write consent gate: mechanically prevent sessions from adding operator-intent pins without the operator's consent #892. Swept onto engine (54): Enhancement: optional divergent-exploration module — generate and triage candidate product intents #534 Enhancement: litigate a delegates_to lateral edge for the knowledge self-map once agents are fully built #535 Evaluate the multi-agent workflow feature as the parallel-workers substrate when it reaches GA #537 Research: evaluate frontier retrieval swap-ins for the cognitive substrate, and measure the self-map's lateral edge density #538 Future optional module: telemetry-driven auto-calibration — parked with preconditions named #539 Exercise the external-contribution submit path end-to-end from the live mechanic deployment #540 Engine fault: v0.3.1 upgrade of a deployed v0.2.0 repo produces a PR that fails the engine's own full CI suite (overlay doesn't reconcile added/renamed/removed files) #599 Engine fault: the escalate-upstream path tells the operator to find the upstream themselves while the manifest records it #643 Engine fault: contribute_issue can only file a one-line issue — no way to author the body (#557 on the issue path) #644 Research: incorporate pinned Hugging Face assets into delivery qualification #668 Qualification: supported-version deployed upgrade and rollback matrix #703 Behaviorally test the deployed live merge boundary #709 Bind guardrail acknowledgment to the pull request head #710 Validate proportional final-snapshot review against historical repairs #711 Correct operator-facing assurance language #712 Expose helper version and capability fingerprints #713 Return compact recall candidates instead of full records #714 Make recall progressive by default #715 Collapse exact duplicate recall results at read time #716 Tighten conversation-window defaults with explicit widening #717 Isolate legacy memory shapes and remove false lifecycle narration #718 Measure recall quality and context cost before and after #719 Execute the Codex hook shim in behavioral regression tests #720 Validate every committed schema mechanically #721 Measure import cycles and core concentration report-only #722 Represent the full hook chain and check-to-target relationships #723 Add deterministic resource and file-read relationships without overclaiming #724 Add live authenticated GitHub-client boundary verification #725 Split build-orchestration side paths into pointer-linked runbooks #726 Audit other oversized and multi-role Engine surfaces #727 Reproduce the control-economics baseline and expose test and check durations #728 Add bounded content-free validator hook and boot telemetry #729 Prevent metadata-only events from rerunning unchanged code tests #730 Consolidate normally-no-op commit hooks behind one dispatcher #731 Compress the persistent memory cue #732 Re-evaluate deployed projection test placement with evidence #733 Define the versioned universal observation contract #734 Define product profiles and adapter boundaries #735 Build a minimal product-agnostic collector #736 Build the Engine-specific audit adapter #737 Produce bounded snapshot and digest output and qualify three product shapes #738 Move Engine hygiene audit to monthly and on-demand while retaining it #739 Split grounding receipt boot attention brief and full status renderer #740 Preserve continuity and explicit pins under boot size pressure #741 Make operator status action-first and correct misleading copy #742 Add quiet deployed-version availability notices #743 Build the acceptance benchmark harness and gate schema #744 Create the G1 and G2 expert-labeled fixture and scoring path #745 Build G3 and G4 longitudinal recovery and gap-recall gates #746 Define and run the G5 non-engineer human-subject battery #747 Feature: Turn historical sessions into an offline memory-substrate benchmark before considering evolutionary search #781 Engine fault: two more engine operation files ship over their length budgets (engine-arrival, engine-upgrade) #821 Bug: memory ledger's git-root resolution runs an untimeouted, uncached subprocess per tool call #854 Feature: Reframe the README around Engine as an engineering coworker #885. 38 native kind labels applied by the same mapping the applicator ships.

• After review, the branch was reconciled with the moved default branch (the relicense merge): a clean merge, no conflicts, no work lost; the engine's index files were regenerated from the reconciled tree and came back unchanged (0 files needed regeneration). The fast validate suite and the boot-pack cap test were re-run green on the reconciled tree; my own commits are untouched by the merge, so the reviewed→submitted record above still holds.

Nothing here is something you can run yourself — there's no settled description for this project yet.

Impact: the engine's own account of its review — your merge is the binding gate.

Files of interest

The issue-authoring/label seam, and the new applicator with its shared transport.

• .engine/tools/issue_kind_label.py, .github/workflows/engine-issue-kind-label.yml — the new mechanism.
• .engine/tools/issue_label_client.py, .engine/tools/issue_conformance_ci.py — the shared label transport and its first two consumers.
• .engine/tools/telemetry.py, .engine/tools/issue_author.py — the severity-trailer single source and the urgency argument.
• .engine/tools/modes.py — the label contract in the boot briefing (prose only; the write-gate is untouched).

Impact: these determine how every engine issue is labelled at creation and kept consistent after.

AI involvement

Claude Code (Claude Opus 4.8 and Claude Fable 5) planned, built, reviewed, and executed this change end to end; the operator made every scoping decision and holds the merge.

• AI-driven: the grounding that uncovered the engine-domain drift and its root cause (a naming trap in the engine's own vocabulary), the design (single-source severity trailer, the separate sibling-workflow boundary, the shared label client, skip-if-absent), the boot-pack budget diagnosis, and all nine cold review passes.
• Operator-decided: reconcile-and-delete the phantom label; sweep all unlabelled issues to engine; apply kind labels by semantic kind; make the forward rule mechanical; build the urgency hook now; skip-if-absent over provisioning the natives; defer the urgency triage; review depth thorough.

Impact: AI judgment is load-bearing on design and review; every irreversible act traces to a recorded operator decision, and the merge is the operator's.