Clean context rot from agent-facing docs

CLAUDE.md

@@ -13,7 +13,7 @@ This file is the standing context for any AI assistant working in this repo. Rea
 
 ## Phase
 
-**MVP code complete on `main`; repo went public 2026-05-22.** The original 2026-05-26 ship target was pulled forward from a planned 2026-08-11 and then again pulled in by four days when the hardening sprint closed faster than expected. Full v1.0 scope is preserved; design-partner onboarding (originally roadmap Week 12) is post-launch. As of 2026-05-22 the implementations for roadmap weeks 1–11 have all landed: object store, atomic memory snapshot, rollback (incl. reverse migrations), MCP fingerprinting, six-dimension diff, Python SDK + LangGraph checkpointer, and the broken-prompt demo (`examples/langgraph-rollback/scripts/run-demo.sh`). Remaining work is verification + outreach, not new features — see [`docs/product/sprint-2026-05-20.md`](docs/product/sprint-2026-05-20.md) for the current sprint and [`docs/architecture/benchmarks.md`](docs/architecture/benchmarks.md) for early performance numbers. Note: the "< 5 min from `git clone` on a fresh machine" claim is still aspirational — the cold-start timing has only been measured on developer machines with warm cargo caches; a fresh-machine timing is sprint item A1. The MVP target is a single named demo — ["the broken prompt"](docs/product/demo-scenario.md) — running reliably from `git clone` to working rollback in under 5 minutes. Every design decision must trace back to making that demo crisp.
+**MVP code complete on `main`; repo went public 2026-05-22.** The original 2026-05-26 ship target was pulled forward from a planned 2026-08-11 and then again pulled in by four days when the hardening sprint closed faster than expected. Full v1.0 scope is preserved; design-partner onboarding (originally roadmap Week 12) is post-launch. As of 2026-05-22 the implementations for roadmap weeks 1–11 have all landed: object store, atomic memory snapshot, rollback (incl. reverse migrations), MCP fingerprinting, six-dimension diff, Python SDK + LangGraph checkpointer, and the broken-prompt demo (`examples/langgraph-rollback/scripts/run-demo.sh`). Remaining work is verification + outreach, not new features — the 2026-05-20 hardening sprint that drove the verification push is fully executed and archived at [`docs/archive/sprint-2026-05-20.md`](docs/archive/sprint-2026-05-20.md); [`docs/architecture/benchmarks.md`](docs/architecture/benchmarks.md) has early performance numbers. The "< 5 min from `git clone`" demo claim is CI-verified as of 2026-07-10: the `demo` CI job runs `run-demo.sh` end-to-end on a fresh ubuntu runner in under 2 minutes (with cached cargo dependencies; a fully cold cache adds build time but has ample headroom in the 5-minute budget). The MVP target is a single named demo — ["the broken prompt"](docs/product/demo-scenario.md) — running reliably from `git clone` to working rollback in under 5 minutes. Every design decision must trace back to making that demo crisp.
 
 If a feature, abstraction, or dependency is not on the path to the demo, it does not ship in MVP. See [`docs/product/mvp-spec.md`](docs/product/mvp-spec.md) §"Explicitly out of scope" — the boundary is hard.
 
@@ -45,7 +45,7 @@ crates/
   agentic-cli/      the `agentic` binary
   agenticd/         the daemon (single binary, tokio, one commit at a time)
 sdk/python/         `agentic-sdk` package + LangGraph integration
-examples/           demo agent code (placeholder until ~week 9)
+examples/           the broken-prompt demo (langgraph-rollback/, incl. run-demo.sh)
 docs/
   product/          mvp-spec, roadmap, demo-scenario
   adr/              accepted architectural decision records
@@ -104,7 +104,7 @@ How to apply:
 - **Don't reorder the 2PC staging in commit code.** Per ADR-0002 Decision 3: blobs to object store → collect content hashes → build Commit blob → Git push (single commit point) → branch ref update. Failure-injection tests are required at each boundary. This is the plumbing that makes "atomic rollback" honest rather than aspirational.
 - **Don't expose storage-layer concepts to platform integrators.** Per ADR-0002 Decision 6, the SDK's public surface trades in `Commit` objects only. No Git ref names, no object store paths, no internal segment IDs in public types — those preclude the v2+ storage swap.
 - **Don't add a web UI.** CLI-first is a deliberate ADR-0001 Decision 9. v1.1 distribution lever, not MVP product.
-- **Don't commit secrets.** [ADR-0013](docs/adr/0013-secret-scanner.md) specifies a `put_raw`-time pattern + entropy scanner that hard-rejects matched blobs with a typed `SecretDetected` error. The scanner is implemented and enforced — do not bypass it; fix the input or add a blob-hash allowlist entry per ADR-0013 Decision 4.
+- **Don't commit secrets.** [ADR-0013](docs/adr/0013-secret-scanner.md) specifies a `put_raw`-time pattern + entropy scanner that hard-rejects matched blobs with a typed `SecretDetected` error. The scanner is implemented and enforced — do not bypass it; fix the input or add a blob-hash allowlist entry per ADR-0013 Decision 4. One sanctioned relaxation exists: blobs under declared checkpoint-path prefixes (default `__langgraph__/`, flag `--scanner-exempt-entropy-prefix`) skip **only the entropy heuristic** per [ADR-0017](docs/adr/0017-entropy-exemption-for-checkpoint-paths.md) — pattern rules always run. Do not widen that exemption without amending the ADR.
 - **Don't edit files in the main checkout.** Use a worktree under `.worktrees/<slug>/` — see "Worktree discipline" above. Toni works in parallel on the same machine, so `HEAD` can move under you mid-edit.
 
 ## The demo is the discipline
@@ -143,9 +143,10 @@ When in doubt, these are authoritative:
 - [`docs/product/demo-scenario.md`](docs/product/demo-scenario.md) — the demo as discipline
 - [`docs/adr/0001-architecture-foundations.md`](docs/adr/0001-architecture-foundations.md) — foundational decisions (Decision 7 amended by ADR-0003)
 - [`docs/adr/0002-substrate-and-supercommit.md`](docs/adr/0002-substrate-and-supercommit.md) — substrate, extended Commit, 2PC staging order
-- [`docs/adr/0003-claude-agent-sdk-integration.md`](docs/adr/0003-claude-agent-sdk-integration.md) — first non-LangGraph integration target (the first platform-partner integration / Claude Agent SDK), layered session-manifest path
+- [`docs/adr/0003-claude-agent-sdk-integration.md`](docs/adr/0003-claude-agent-sdk-integration.md) — first non-LangGraph integration target (the first platform-partner integration / Claude Agent SDK): real-time atomic sidecar integration per ADR-0004, with layered manifest-export only as the documented escape hatch
 - [`docs/adr/0004-realtime-agenticd-for-executor.md`](docs/adr/0004-realtime-agenticd-for-executor.md) — sidecar `agenticd` topology for the Executor's real-time atomic integration: deployment shape, snapshot triggers, failure semantics, GCS-backed `ObjectStore` (Decisions 3 and 4 amended by ADR-0005)
 - [`docs/adr/0005-sessionstore-amendment-to-adr-0004.md`](docs/adr/0005-sessionstore-amendment-to-adr-0004.md) — Accepted amendment (2026-05-22): snapshot primitive is the Claude Agent SDK's `SessionStore.append`; loud-fail preserved via a synchronising `PreToolUse` hook
+- [`docs/adr/`](docs/adr/) — the full accepted set runs through ADR-0017; notably [ADR-0013](docs/adr/0013-secret-scanner.md) (secret scanner), [ADR-0016](docs/adr/0016-mcp-url-policy.md) (MCP URL policy), and [ADR-0017](docs/adr/0017-entropy-exemption-for-checkpoint-paths.md) (checkpoint-path entropy exemption)
 - [`docs/architecture/overview.md`](docs/architecture/overview.md) — runtime topology
 - [`docs/architecture/snapshot-model.md`](docs/architecture/snapshot-model.md) — the technical heart
 - [`CONTRIBUTING.md`](CONTRIBUTING.md) — what's accepted right now, code style, ADR process

README.md

@@ -14,7 +14,7 @@ A commit captures all six dimensions atomically. A rollback restores all six coh
 
 ## Status
 
-**MVP code complete; repo went public 2026-05-22.** The 12-week build landed weeks 1–11 on `main`; the final week is verification, design-partner outreach, and demo polish. The cold-start "under 5 minutes from `git clone`" line in the demo is verified on developer machines with warm cargo caches; a fresh-machine timing is still in flight. See [`docs/product/roadmap.md`](docs/product/roadmap.md) for week-by-week progress and what's safe to depend on.
+**Open-source MVP complete; repo went public 2026-05-22.** The 12-week build landed in full; production validation is in progress — design-partner use in real deployments is the bar before v1.0 language. The "under 5 minutes from `git clone`" demo claim is CI-verified: a `demo` CI job runs the whole broken-prompt scenario end-to-end on a fresh runner on every pull request (under 2 minutes with cached cargo dependencies). See [`docs/product/roadmap.md`](docs/product/roadmap.md) for the build's historical record.
 
 ## Why this exists
 
@@ -26,7 +26,7 @@ We build it.
 
 ## What ships in the MVP
 
-- **`agentic` CLI** — `init`, `commit`, `log`, `diff`, `rollback`, `branch`, `status`.
+- **`agentic` CLI** — `init`, `commit`, `log`, `diff`, `rollback`, `status` (plus `ping`, `resolve`, `cat-object`).
 - **`agenticd` daemon** — Rust binary that owns the content-addressed object store and the snapshot/rollback engine.
 - **Python SDK (`agentic-sdk`)** — typed client, plus a drop-in LangGraph checkpointer.
 - **One memory backend:** Postgres + pgvector, deeply integrated.
@@ -88,7 +88,7 @@ git.agentic/
 │   │   ├── roadmap.md            12-week build narrative; repo went public 2026-05-22
 │   │   └── demo-scenario.md      the canonical demo
 │   ├── adr/
-│   │   └── 0001-architecture-foundations.md
+│   │   └── 0001 … 0017 — accepted architectural decision records
 │   └── architecture/
 │       ├── overview.md           system diagram and component boundaries
 │       └── snapshot-model.md     the technical heart
@@ -115,7 +115,7 @@ pytest
 The broken-prompt walkthrough lives at [`examples/langgraph-rollback/`](examples/langgraph-rollback/). Everything below is rooted there:
 
 - [`scripts/run-demo.sh`](examples/langgraph-rollback/scripts/run-demo.sh) starts Postgres+pgvector via the local `docker-compose.yml`, `cargo build`s `agenticd` + `agentic` from the workspace, then drives the commit → break → rollback cycle end-to-end.
-- The Python LangGraph agent runs locally via `python agent.py`, invoked by [`scripts/ask.sh`](examples/langgraph-rollback/scripts/ask.sh). Follow the venv + pip-install step in the demo's own [`README`](examples/langgraph-rollback/README.md) before running the script — the script itself does not bring up a Python environment.
+- The Python LangGraph agent runs locally via `python agent.py`, invoked by [`scripts/ask.sh`](examples/langgraph-rollback/scripts/ask.sh). `run-demo.sh` bootstraps its own Python venv (with the SDK, LangGraph, and psycopg) at `examples/langgraph-rollback/.venv` on first run — no manual Python setup is needed; the demo's own [`README`](examples/langgraph-rollback/README.md) covers running the agent by hand.
 
 `agenticd` and the agent are both local processes, not containers.
 

docs/architecture/overview.md

@@ -209,7 +209,21 @@ Total wall-clock target: < 5s for typical rollbacks.
 
 ## 6. Security model (MVP)
 
-The daemon runs as the same user as the application. There is no authentication on the socket beyond filesystem permissions. The object store is unencrypted at rest. Secrets are not yet machine-rejected: [ADR-0013](../adr/0013-secret-scanner.md) specifies a `put_raw`-time pattern + entropy scanner that will hard-reject matched blobs with a typed `SecretDetected` error; the implementation lands in PR-3 of the v1.0 hardening sprint. Until it does, operators must not commit secrets to prompts or memory.
+The daemon runs as the same user as the application.
+Socket access is peer-authenticated per [ADR-0012](../adr/0012-socket-peer-authentication.md):
+the daemon checks the connecting process's UID via `SO_PEERCRED` against an
+`--allowed-uid` allowlist, and refuses to start without one unless
+`--insecure-allow-any-uid` is passed explicitly (demo and development only).
+Availability limits on the socket (connection caps, per-UID rate budget, idle
+timeouts) ship per issue #118 as `agenticd` flags.
+The object store is unencrypted at rest.
+Secrets are machine-rejected at write time: the [ADR-0013](../adr/0013-secret-scanner.md)
+pattern + entropy scanner hard-rejects matched blobs with a typed
+`SecretDetected` error before any bytes touch disk.
+Two sanctioned relaxations exist: a blob-hash allowlist (ADR-0013 Decision 4)
+and a path-scoped entropy exemption for declared checkpoint blobs
+([ADR-0017](../adr/0017-entropy-exemption-for-checkpoint-paths.md), default
+prefix `__langgraph__/`) — pattern rules always run.
 
 Post-MVP, we add:
 

docs/ops/2026-05-21-agenticd-architectural-analysis.md

@@ -1,5 +1,13 @@
 # Architectural Analysis — `crates/agenticd/` (the daemon)
 
+> **Status (2026-07-10): CLOSED — historical record.** All eleven recommendations
+> (A1–A11) landed on `main` and were verified code-grounded when tracking issue
+> [#34](https://github.com/git-agentic/git.agentic/issues/34) closed on 2026-07-10.
+> This document stays in place because accepted ADRs (0010, 0011) link to its
+> finding anchors. Do not treat its "recommended" items as open work; the code
+> on `main` is the current state.
+
+
 **Date:** 2026-05-21
 **Focus area:** `crates/agenticd/src/` (six files, 1503 lines) + call-graph extensions into `agentic-core`, `agentic-memory`, `agentic-proto`.
 **Produced by:** the `han:architectural-analysis` skill — five agents in pipeline: `structural-analyst`, `behavioral-analyst`, `concurrency-analyst`, `risk-analyst`, `software-architect`.

docs/plans/a8-reverse-migration/feature-implementation-plan.md

@@ -1,5 +1,10 @@
 # Implementation plan — A8 reverse-migration outer tx + restore-guard fix + wire `accept_data_loss`
 
+> **Status (2026-07-10): EXECUTED — historical record.** This plan shipped in
+> May 2026 (issue #37). It is kept for the audit trail; the code on `main` is
+> the current state.
+
+
 ## Source Specification
 
 - **GitHub issue #37** (`must-fix-v1.0`, milestone `v1.0`) — acceptance criteria.

docs/product/demo-scenario.md

@@ -32,7 +32,7 @@ A `git revert` of the prompt change doesn't fix anything: the schema is still bu
 
 ## The demo walkthrough
 
-The demo is a single shell session. It runs in under five minutes from `git clone`.
+The demo is a single shell session. It runs in under five minutes from `git clone` — CI-verified: the `demo` job runs it end-to-end on a fresh runner on every pull request, in under 2 minutes with cached cargo dependencies.
 
 ```bash
 # Setup (one time)

docs/product/mvp-spec.md

@@ -55,7 +55,7 @@ A `git.agentic` commit content-addresses all six dimensions into one immutable o
 
 ### In scope
 
-1. **CLI tool `agentic`** — `init`, `commit`, `log`, `checkout`, `rollback`, `diff`, `branch`.
+1. **CLI tool `agentic`** — `init`, `commit`, `log`, `status`, `diff`, `rollback` (plus `ping`, `resolve`, `cat-object`). *As shipped:* the originally-specced `checkout` and `branch` subcommands did not land in v1.0 — branch refs exist in the daemon and the SDK's checkpointer uses per-thread branches, but branch manipulation from the CLI is v1.1 work.
 2. **Rust core engine** — content-addressed object store, snapshot algorithm, rollback algorithm, schema-compat checks.
 3. **Python SDK** — `agentic.commit(...)`, `agentic.rollback(version)`, context-manager hooks for capturing prompts/tools/model.
 4. **One memory backend adapter: Postgres + pgvector.** Copy-on-write snapshots via Postgres logical replication slots and content-addressed embedding tables. Single backend, deep integration.