T22 recorded the exact remaining blocker: "no byte-level enforcement point
exists ... Establishing MiMo-surface enforcement is NEW architecture (a
tool.execute.before governance hook) and was NOT built here." T23 builds it
from verified topology, not invention.
THE SEAM (verified against @mimo-ai/plugin index.d.ts + the decompiled
harness, not assumed): `tool.execute.before` blocks by setting
output.cancel + cancelReason; the tool's execute is then never called. All
hook files run sequentially, and subagent tool calls pass through the same
event — so delegated construction inherits enforcement.
ARCHITECTURE — two events, two jobs, ONE authority:
messages.transform (turn boundary) -> classify once, mint the contract
tool.execute.before (per call) -> deterministic scope enforcement
Every decision derives from canonical state (construction_intent ->
classify_mode -> scaffold -> check_scope). No truth is duplicated; the
contextual entry was EXTRACTED from rune_operator._construction_activation
into construction_activation.activate_from_text (operator path now calls it,
net -96 lines) rather than copied.
SCOPE — declared vs provisional. A scope the need states is declared and
ENFORCED (out-of-scope mutation blocked). A need stating nothing gets a
provisional scope: first contact records the working set, divergence extends
and records rather than blocking. Rationale is measured, not theoretical —
blocking on an unstated scope punishes legitimate multi-area work, and one
mis-classified turn would otherwise block the operator's real work.
LIVE DEFECT FOUND AND FIXED: within minutes of install, the turn boundary
minted four bogus contracts from <actor-notification> envelopes (subagent
completion reports arriving as user-role messages) and then correctly
enforced them against the operator's own work. The installed hook was
removed, the contracts abandoned with defect provenance, the source fixed
(harness-internal envelope guard, same class as builder-bridge.ts), and the
hook reinstalled. Regression test included.
RUNE-ESSENTIAL CLASSIFICATION + DURABLE AWARENESS: rune_relationship()
classifies from evidence (never from a repo name); declare_relationship()
records CORE (Spine `manages`) vs EXTERNAL_DEPENDENCY (external_dependency
entity + `depends_on`) — an external project Rune relies on is never falsely
absorbed into Rune core. Reuses Spine/ProjectRegistry/CapabilityLedger; no
new registry.
VERDICT: SCAFFOLDING_DEFAULT_BUILD_PATH_PARTIAL. Enforcement, contextual
triggering, discussion safety, /build parity, unrelated-project exclusion and
proportionality all pass. Four gates are unproven rather than failed:
subagent inheritance demonstrated live, continuation/resume, automatic scope
promotion, new-project end-to-end. Claiming PROVEN would require evidence not
produced.
Verification: 37 new tests (incl. two driving the real guard via node);
521 targeted regression; full suite 2254 passed / 1 failed — the single
failure is a PRE-EXISTING lint-ledger drift, proven by stashing all changes
and re-running at HEAD (BLE001 347 vs 353). Not re-baselined upward: the
ledger may only shrink. ruff clean. Guard live on the real path (decision
trail at /tmp/rune-scaffolding-guard.log).
LOCAL_MODEL_COMPUTE_EXECUTED = NO.
conductor
15c8d369da