docs(designs): argue ported records from their own reasons, not a private repo's authority (RIG-3746)

docs/designs/DECISIONS.md

@@ -375,8 +375,8 @@ check enforces the mechanical half. Full rationale:
 | DL-160 | The desktop app is first-class multi-window: every top-level surface (Bridge, a channel, an agent workspace, Backlog/Done, Settings) is an independently mountable window-scoped view (own DL-127 route, own focus zones + command scope, no sibling region required); compass-native spawns/manages OS windows, this record owns the decomposition; in-window tabs (Linear-style) and split views are deferred to the Beta milestone (RIG-1808), admitted by the same decomposition without rework (D6.1) | Active (Matt, 2026-08-05) | [ux foundation §D6](ui/compass-ux-foundation/design.md#d6--rendering-the-frozen-ia-surface-by-surface-composition) |
 | DL-184 | Token adoption is a FULL CUTOVER, not the DL-157 incremental strangler: a pre-dogfood codebase has no live users to protect, so the legacy `:root` tier is deleted and every consumer flips to `--cx-*` in one atomically-merged migration (canvas → Night Owl, base.css un-shadowed, state dots recolored, D7 stylelint guard wired directly at error), proven by a Playwright visual-smoke harness Matt reviews | Active (Matt, 2026-08-07) | [DS token cutover](ui/compass-ds-token-cutover/design.md) |
 | DL-174 | Compass test coverage is a differential-oracle pyramid: every seam carries a hermetic in-memory reference in the default gate plus a `pgtest` suite proving the real Postgres backend obeys the same contract; Postgres is the one live dependency the strategy gates on (D1) | Active (Matt, 2026-08-07) | [test strategy §Decisions](meta/compass-test-strategy/design.md#decisions) |
-| DL-175 | The real-Postgres `pgtest` suites run INLINE as a step in the one existing `CI` job — no separate CI job, lane, or moon task; one required check, hermetic moon `test` stays dependency-free via the build tag (D-A1, overruling the internal monorepo ancestor's separate `test-pg` lane; Matt: "trimmed but no extra CI job, it goes in the same existing job") | Active (Matt, 2026-08-07) | [test strategy §A1](meta/compass-test-strategy/design.md#a1--one-ci-job-pgtest-inline-no-separate-lane-amends-the-ancestor-records-d2dl-049) |
-| DL-176 | CI Postgres is the shipped GitHub Actions SERVICE CONTAINER — digest-pinned `postgres:16-alpine`, health-gated, URL-form TCP DSN, digest kept equal to `pgtest.go`'s image pin — not the internal monorepo ancestor's per-step embedded `postgresql_18` postmaster, which solved a Woodpecker constraint compass does not have (D-A2) | Active (Matt, 2026-08-07) | [test strategy §A2](meta/compass-test-strategy/design.md#a2--postgres-provisioning-in-ci-the-shipped-service-container-amends-the-ancestor-records-d4) |
+| DL-175 | The real-Postgres `pgtest` suites run INLINE as a step in the one existing `CI` job — no separate CI job, lane, or moon task; one required check, hermetic moon `test` stays dependency-free via the build tag (D-A1, overruling the ancestor record's separate `test-pg` lane; Matt: "trimmed but no extra CI job, it goes in the same existing job") | Active (Matt, 2026-08-07) | [test strategy §A1](meta/compass-test-strategy/design.md#a1--one-ci-job-pgtest-inline-no-separate-lane-amends-the-ancestor-records-d2dl-049) |
+| DL-176 | CI Postgres is the shipped GitHub Actions SERVICE CONTAINER — digest-pinned `postgres:16-alpine`, health-gated, URL-form TCP DSN, digest kept equal to `pgtest.go`'s image pin — not the ancestor record's per-step embedded `postgresql_18` postmaster, which solved a Woodpecker constraint compass does not have (D-A2) | Active (Matt, 2026-08-07) | [test strategy §A2](meta/compass-test-strategy/design.md#a2--postgres-provisioning-in-ci-the-shipped-service-container-amends-the-ancestor-records-d4) |
 | DL-177 | Require-live teeth live in the harness: `COMPASS_REQUIRE_LIVE=1` (set by the CI pgtest step) turns `RequireDSN`'s no-DSN skip path into `t.Fatal` at the one policy seam every suite passes through — layered with, not replacing, the workflow-level skipped-suite assert step (D2/S1) | Active (Matt, 2026-08-07) | [test strategy §Decisions](meta/compass-test-strategy/design.md#decisions) |
 | DL-178 | Whole-flow scope is one thin composing test: `runner.Dial` over TLS with a real minted Runner-kind token through the production `RunnerService` door built by `buildNetworkServer` — the one seam no suite on `main` composes; a full smoke rebuild is rejected as re-describing shipped work (D3/S2) | Active (Matt, 2026-08-07) | [test strategy §Decisions](meta/compass-test-strategy/design.md#decisions) |
 | DL-179 | The `podman`-tagged surface (runtime lifecycle suites and the `go/e2e/` dogfood legs) stays skip-if-absent and out of this record's gate; its CI promotion is owned by the dogfood-e2e/infra lane (D4) | Active (Matt, 2026-08-07) | [test strategy §Decisions](meta/compass-test-strategy/design.md#decisions) |
@@ -411,7 +411,7 @@ check enforces the mechanical half. Full rationale:
 | ID | Decision | Status | Record |
 | --- | --- | --- | --- |
 | DL-164 | **Start-half (Active):** starting an agent is the lifecycle operation (`startAgent` → composite `SpawnAgent`), which rejects when the target agent already holds a live session; an agent owns multiple cards, so the `SessionBinding` map is keyed by card (`workstreamId` = `Issue.id`), not agent, inside one container / one live session. **Add-half superseded by DL-185 (Matt, 2026-08-07):** the manual add-a-workstream board mutation (`addWorkstream`) and UI-side agent creation (`CommsService.CreateAgent`) are dropped. | Superseded by DL-253 (Matt, 2026-08-25) | [spawn control §Control flow](agent/compass-spawn-control/design.md#control-flow-start-an-agent-spawnagent) |
-| DL-165 | The Bridge spawn-control lane builds live-wired against the shipped `AppStoreOptions` client seam (real RPC awaits when clients are present, surfaced offline refusals when not — the shipped `stopAgent` shape), superseding the internal monorepo's walking-skeleton posture whose premises (no injection seam, no live streams, stub stop) no longer hold in compass; parked for Matt's ratification (OQ-P1) | Superseded by DL-253 (Matt, 2026-08-25) | [spawn control §Posture](agent/compass-spawn-control/design.md#posture-live-wired-from-the-start-amends-the-walking-skeleton-posture--dl-165) |
+| DL-165 | The Bridge spawn-control lane builds live-wired against the shipped `AppStoreOptions` client seam (real RPC awaits when clients are present, surfaced offline refusals when not — the shipped `stopAgent` shape), superseding the ancestor record's walking-skeleton posture whose premises (no injection seam, no live streams, stub stop) no longer hold in compass; parked for Matt's ratification (OQ-P1) | Superseded by DL-253 (Matt, 2026-08-25) | [spawn control §Posture](agent/compass-spawn-control/design.md#posture-live-wired-from-the-start-amends-the-walking-skeleton-posture--dl-165) |
 | DL-166 | Spawn is one server-side composite `CompassService.SpawnAgent` RPC orchestrating Provision→Start under a single `client_request_id` with server-owned end-to-end dedup (retry returns the same `session_id`, no second container) and a pre-Provision reject-on-live short-circuit ordered after the dedup-join lookup; client-orchestrated two-call flow rejected | Superseded by DL-253 (Matt, 2026-08-25) | [spawn control §DL-166](agent/compass-spawn-control/design.md#dl-166-prior-decision--server-side-composite-spawnagent) |
 | DL-167 | `AgentSessionStatus` gains `agent_account_id`, populated at every construction site (board projection, SubscribeEvents push synthesis, Runner-side Status) — a join onto the live hub binding Server-side and new Runner-local account carriage (AgentSpec→handle→liveSession), with the terminal STOPPED status resolving its account before `unbindSession`; makes the UI reconcile full-fleet within the binding's live scope and is the prerequisite of the reject-on-live scan | Superseded by DL-253 (Matt, 2026-08-25) | [spawn control §DL-167](agent/compass-spawn-control/design.md#dl-167-prior-decision--agent_account_id-on-agentsessionstatus) |
 | DL-168 | A stopped card stays restartable: the card's start affordance shows on no-binding OR a `stopped` binding (agent not live), the exact predicate the `startAgent` guard reads, and restart mints a fresh binding — a no-binding-only affordance would strand every stopped card since `applyStopped` keeps the binding | Superseded by DL-253 (Matt, 2026-08-25) | [spawn control §DL-168](agent/compass-spawn-control/design.md#dl-168-prior-decision--a-stopped-card-stays-restartable) |

docs/designs/agent/compass-forks-reversal/design.md

@@ -24,7 +24,7 @@ machinery that existed only to carry them.
 - **FROZEN (Matt, 2026-08-19): shared `RigelBuild/{devenv,nix2container,oh-my-pi}`
   repos + combined patch work.** Compass consumes the shared canonical fork
   repos — one canonical fork per upstream. Sealed patches useful to both the
-  internal monorepo and compass land in the shared repos, never duplicated. Do
+  fleet and compass land in the shared repos, never duplicated. Do
   not relitigate; tasks execute it.
 - **Shared-repo patch ownership is disjoint (forge coordination, 2026-08-19).**
   On the shared canonical repos each lane owns a disjoint patch set: forge owns
@@ -274,7 +274,7 @@ this record does not require it.
   repos: one fork per upstream, patch work combined. Two forks of the same
   upstream would duplicate the sealed patches and re-create the divergence this
   reversal exists to end. Frozen; not relitigated here.
-- **Defer until the internal monorepo's reversal fully lands** — rejected. Only
+- **Defer until the fleet's reversal fully lands** — rejected. Only
   the nix2container lane has a genuine cross-repo dependency (the shared
   nix-DB-drop fix); serializing the whole reversal behind that completion keeps
   7424 vendored files (and
@@ -576,7 +576,7 @@ Interfaces:
    `devenv.nix:476`, `ci.yml:812`, `publish-agent-image.yml:139,160`,
    `tools/agent-image-env-gate/index.ts:100,118`) —
    **LOAD-BEARING, but narrower than first framed.** The *flake-input* half is
-   settled: the internal monorepo's prior art froze the nix-flake-input class as
+   settled: the prior art froze the nix-flake-input class as
    `github:RigelBuild/<fork>` pinned **via lockfile** (the deliberate default
    plus a whole-repo narHash fix), so compass's one flake-input consumer,
    `agent-image/devenv.lock`, converges on that with no reason to diverge. What
@@ -598,7 +598,7 @@ Interfaces:
    has no prior-art analog. The coherent alternative is the literal style — keep
    the `github:…/<rev>` literals but have L1/L2 add a CI assert that each
    literal's rev equals the corresponding `devenv.lock` rev, named in the lane
-   gates; this mirrors the internal monorepo's terraform-provider class, a pinned
+   gates; this mirrors the prior art's terraform-provider class, a pinned
    **non-flake** consumption (tagged GitHub Release + committed sha256 manifest,
    verified at build time) — the prior-art shape for "pin and verify a path not
    resolved through a lockfile." This is the record's one genuine fork — Matt's

docs/designs/agent/compass-forks-reversal/oq-resolutions.md

@@ -59,7 +59,7 @@ Impact on **L3** (`design.md:437-490`):
 
 **Ruled (Matt, 2026-08-21): install the fork tools as pinned packages; do not
 keep raw `nix run` literals.** The flake-input half of OQ2 was already settled
-(converge on the internal monorepo's lockfile-pinned `github:RigelBuild/<fork>` default). For
+(converge on the prior art's lockfile-pinned `github:RigelBuild/<fork>` default). For
 the raw-CLI half — the six sites that invoke a fork CLI with `nix run` and so
 bypass `devenv.lock` — the resolution is to **install** the two fork tools
 (devenv's patched CLI carrying compass's container module, and

docs/designs/agent/compass-spawn-control/design.md

@@ -5,9 +5,9 @@ Status: Active
 This record freezes on merge; later changes supersede by citation, never
 rewrite.
 
-Ported from the internal monorepo's prior record with
+Ported from a prior ancestor record with
 Matt-ruled amendments, re-grounded against the current compass tree
-(`main@origin`, 2026-08-07). The internal monorepo's prior decisions are
+(`main@origin`, 2026-08-07). The ancestor record's prior decisions are
 re-expressed here as DL-164..DL-171.
 
 > **Amendment (DL-185, Matt 2026-08-07):** the manual add-a-workstream /
@@ -36,9 +36,9 @@ control that starts a workstream agent (provision + start, with an optional
 initial prompt) from the board, and hardens the existing stop into the same
 control model.
 
-*(Port note — superseding the internal monorepo's premise: the source record
+*(Port note — superseding the ancestor record's premise: the source record
 described stop as a no-op stub, `const stopAgent = () => {};`. That was true of
-the internal monorepo's snapshot; compass has since shipped the real
+the ancestor record's snapshot; compass has since shipped the real
 `stopAgent`, so every stop-side task below hardens or extends shipped behavior
 rather than replacing a stub.)*
 
@@ -69,7 +69,7 @@ were consequences of the now-shipped change.)*
 
 ### Posture: live-wired from the start (amends the walking-skeleton posture — DL-165)
 
-The internal monorepo's prior record froze a walking-skeleton posture (its
+The ancestor record froze a walking-skeleton posture (its
 OQ-A) on three facts of that tree: `createAppStore` took no arguments,
 `SubscribeEvents` had zero UI consumers, and no live client seam existed.
 **All three are false in compass today**: `createAppStore(options:
@@ -244,7 +244,7 @@ lifecycle affordance is start/stop on an existing card:
    incidental property DL-170 exists to stop leaning on).
 
    The check **must not** be sourced from Server-side in-memory state.
-   Compass now carries the reverse index the internal monorepo lacked —
+   Compass now carries the reverse index the ancestor record lacked —
    `Hub.SessionForAccount` (`relay_comms.go:157-171`, over
    `accountSessions`) — but it is still **live-scoped and cleared on every
    Runner re-enroll** (`hub.go:707-711`, pinned by
@@ -305,7 +305,7 @@ agent-keyed map would bleed one card's pill onto siblings). The binding
 carries its `agentAccountId` for the RPC. Bindings are store-internal
 wire-lifecycle bookkeeping, not a fixture-shape change: the compass board's
 `Issue` (`stub-data.ts:202-240`) and `Agent` shapes stay frozen.
-*(Terminology port note: the internal monorepo's UI had a `Workstream` type; the compass
+*(Terminology port note: the ancestor record's UI had a `Workstream` type; the compass
 board renders `Issue` cards (`board.ts:39-56`, `components/IssueCard.tsx`)
 and has no `Workstream` symbol. This record keeps "workstream" for the
 concept — an issue promoted to a unit of work — and `workstreamId` binds to
@@ -355,7 +355,7 @@ equally.
 
 ### Alternatives considered
 
-- **Walking-skeleton-first** (the internal monorepo's prior ruling, Matt-ruled there): build the
+- **Walking-skeleton-first** (the prior, superseded ruling): build the
   control UX as fixture mutations, wire later in a stacked lane. Superseded
   by the shipped compass store: the injection seam and live streams the
   skeleton waited on already exist (`store.ts:551`, `:667`, `:897-932`), and
@@ -370,7 +370,7 @@ equally.
   session started by another client or surviving a refresh can't reconcile.
   Rejected (Matt ruled the wire attribution, DL-167).
 - **Server-side reject-on-live check over `SessionForAccount`**: compass now
-  has the reverse map the internal monorepo lacked (`relay_comms.go:157-171`), but it fails
+  has the reverse map the ancestor record lacked (`relay_comms.go:157-171`), but it fails
   open after a Runner re-enroll (`hub.go:707-711`); the Runner scan is
   authoritative. Rejected — the Control-flow section carries the argument.
 - **Browser `confirm()` for stop**: rejected — blocks the event loop,
@@ -761,7 +761,7 @@ the compass service-owner. Independent of the UI tasks, so no freeze block.
   (`compass.proto:59`). Request = `agent_account_id`=1, `initial_prompt`=2,
   `client_request_id`=3; Response = `session_id`=1, `container_name`=2.
   Server orchestrates the existing RunnerHub `Provision` then `Start`
-  (`runnerhub/commands.go:40-88`). *(The internal monorepo's T0 additionally relaxed the
+  (`runnerhub/commands.go:40-88`). *(The ancestor record's T0 additionally relaxed the
   repo requirement in `runner/spec.go` and guarded `cloneRepo` — all shipped
   in compass under RIG-1527; `BuildSpec` at `spec.go:76-88` already builds a
   repo-less spec. Dropped from scope.)*
@@ -870,11 +870,11 @@ the compass service-owner. Independent of the UI tasks, so no freeze block.
 
 ## Resolved decisions
 
-The internal monorepo's prior record resolved eight load-bearing forks with
+An ancestor record resolved eight load-bearing forks with
 Matt and ratified two deferrals. This port re-expresses them as compass ledger
-rows DL-164..DL-171, plus one port-amendment row (DL-165). The prior rulings'
-full arguments live in the source record; the compass-grounded substance is
-folded into the sections above. Mapping:
+rows DL-164..DL-171, plus one port-amendment row (DL-165). Each row below
+carries its own compass-grounded argument; the sections above hold the
+substance. Mapping:
 
 ### DL-164 (prior decision) — start-an-agent; multiple cards per agent; reject-on-live
 

docs/designs/infra/ci/compass-local-dev/design.md

@@ -38,8 +38,8 @@ This record therefore only documents the hazard and the interim workaround;
 it designs no compass-side gate change.
 
 Local dev is the developer's own box — not a deployed `main` or `preview`
-environment. Those deployed environments are internal infrastructure, defined
-in the private infrastructure design repo, and are not redesigned here. The
+environment. Those deployed environments are a managed-plane concern, out of
+tree, and are not redesigned here. The
 repo-facing PR-validation surface (the expanded e2e harness and its
 results-on-PR) is Record B
 (`docs/designs/platform/compass-pr-validation/design.md`).

docs/designs/infra/ci/compass-pr-validation/design.md

@@ -10,9 +10,9 @@ Status: Draft
 > (`docs/designs/platform/compass-dogfood-e2e/design.md`, RIG-1681, H1-H8).
 > Local-dev / gate mechanics are a separate record
 > (`docs/designs/platform/compass-local-dev/design.md`). UI-visible changes
-> are additionally previewable in an isolated PR-preview environment defined
-> in the private infrastructure design repo; that environment's hosting,
-> deploy workflow, and selection mechanism live in that repo's records, not
+> are additionally previewable in an isolated PR-preview environment, which is
+> out of tree: that environment's hosting, deploy workflow, and selection
+> mechanism are a managed-plane concern, out of scope
 > here — this record owns only the repo-side validation surfaces, including
 > the configurable UI build the preview consumes.
 
@@ -165,8 +165,8 @@ format/lint/test.
 - **Scripts over bash.** Any summary/capture logic beyond a one-liner is a
   bun/TS tool under `tools/`, not shell in YAML.
 - **De-leak.** This is a public repo. The isolated PR-preview environment is
-  referred to only generically — "an isolated PR-preview environment defined
-  in the private infrastructure design repo". No internal hostnames,
+  referred to only generically — as "an isolated PR-preview environment", out
+  of tree. No internal hostnames,
   addresses, ports, service/unit names, or private repo names appear in this
   record or in anything it produces (workflow YAML, skill text, PR comments).
 - **Sequencing floor.** Tasks that extend the CI gate land AFTER #256
@@ -190,7 +190,7 @@ A2 and the Plan has no B2.
 
 A general compass-ui capability: make the UI bundle buildable against ANY
 configured door URL + bearer via build-time env — the isolated PR-preview
-environment (defined in the private infrastructure design repo) consumes this
+environment, which is out of tree, consumes this
 capability; local/dev targets can too. No code change to connection
 resolution is expected — `resolveConnection` already requires a base URL and
 normalizes an absent token to a no-auth client