feat: ADR 0032 M7 — event-spine wiring guard + realized-architecture doc; MIGRATION COMPLETE

Closes the ADR 0032 migration. M7's original goal ("ContextBus + webhook consume
the spine; delete inline eventing") was assessed and NOT done — it is a regression
or vacuous:
- Webhook is an AuditLogger sink (audit.add_sink), already transitively spine-fed
  via the M1 spine->audit consumer. A direct spine consumer would see only the
  spine-emitted subset = coverage regression.
- ContextBus and the integration RunEventStream are unwired in production.
- Inline audit.record calls ARE the complete event record (read by evidence/
  receipts/webhook), not redundant eventing to delete.

Done instead (owner chose guard + document):
- scripts/validate_event_spine_wiring.py: enforces the realized invariant —
  (A) taxonomy closure (every RunEventType maps losslessly to the audit record);
  (B) no orphaned event bus (AST scan for high-signal lifecycle-event methods
  must match a curated allowlist; generic publish/emit excluded to avoid noise).
- tests/test_event_spine_wiring.py: clean-repo + seeded-bad-fixture coverage.
- check-event-spine-wiring pre-commit hook.
- ADR 0032: "Realized architecture (M1-M7)" section records the converged outcome
  and the lesson — the spine's value is the typed read side + a single typed
  lifecycle path, not relocating runtime-stateful enforcement. The plan gate was
  the one gate that genuinely belonged on the spine.
- Plan §7 M7 row + tasks T001/T002 CLOSED unsuitable, T003 DONE, T004 CLOSED.

Constraint: guard is read-only static analysis; no runtime/behavior change; allowlist names every sanctioned event-delivery surface so new competing buses fail the gate.
Tested: tests/test_event_spine_wiring.py 7 + lifecycle spine 22 + validate_wiring 6 = 35 passed; validator exits 0 on clean repo and flags seeded orphan bus + unmapped event.
Not-tested: full suite not run on 3.12 (hypothesis missing in 3.14 sandbox).
Confidence: high
Roadmap-Status: unchanged
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: johnteee

.pre-commit-config.yaml

@@ -11,6 +11,14 @@ repos:
         entry: python3 scripts/check_circular_imports.py
         language: system
         pass_filenames: false
+      - id: check-event-spine-wiring
+        name: check-event-spine-wiring
+        # ADR 0032 M7 invariant: one typed lifecycle path (EventSpine -> audit
+        # consumer), no orphaned/competing event bus, every RunEventType mapped
+        # to the audit record. Read-only static check.
+        entry: python3 scripts/validate_event_spine_wiring.py
+        language: system
+        pass_filenames: false
       - id: ruff-format
         name: ruff-format
         entry: env UV_CACHE_DIR=.uv-cache uv run ruff format

docs/adr/0032-run-event-taxonomy.md

@@ -122,6 +122,62 @@ New code lives inside the existing `teaagent/runner/` package (teaagent/runner/_
 | M5 | HookRegistry re-homed onto spine; public hook API documented | Existing hook tests pass via aliases |
 | M6 | ContextBus + webhook sinks consume spine; inline emission paths deleted | No orphaned eventing modules |
 
+### Realized architecture (M1–M7, completed 2026-06-13)
+
+The phases above were the *proposal*. Executed parity-first and assessed against
+the code at each step, the migration converged on a **narrower, sound** outcome —
+recorded here as the durable contract (see the per-phase work-logs under
+`docs/work-log/` and the plan `docs/plans/adr-0032-m1-m6-work-plan-2026-06-13.md`):
+
+- **M1** — done as proposed: `AuditLogger` is an `EventSpine` consumer
+  (`register_audit_consumer`), byte-equivalent on the proof scenario.
+- **M2** — re-scoped to **taxonomy-only**: every evidence/decision audit event is
+  typed in `RunEventType` and mapped both directions; the reader surfaces them
+  from the audit JSONL. (Emit-site migration deferred.)
+- **M3** — **plan gate moved to an interceptor** (the one gate that fit), landed
+  shadow→enforce in two commits with a reason-code parity oracle.
+- **M4** — **approval and budget enforcement STAY INLINE.** Both are
+  runtime-stateful (approval: live JIT/session state + handler + auto-mode-
+  swappable policy; budget: mutable dedup sets + an interactive `on_prompt`
+  side-effect handler + multi-point evolving-cost checks). Forcing them into a
+  pure interceptor-on-event was a regression risk invisible to unit parity tests.
+  Their observability still reaches the fold via typed audit events.
+- **M5** — **hook OBSERVABILITY** is typed onto the spine; **hook EXECUTION stays
+  in the tool-dispatch layer** (`teaagent/tools.py`) because PreToolUse/PostToolUse
+  mutate in-flight args/results, and the session-lifecycle hooks are unwired.
+- **M6** — **evidence/receipts fold over the typed stream** (`build_evidence_from_events`,
+  now the production path inside `build_run_evidence_bundle`). Fixed a real
+  lossiness gap (typed `RunEvent` now carries `created_at`).
+- **M7** — **guard + document (this section).** "ContextBus + webhook consume the
+  spine; delete inline eventing" was **not** done: it is a regression or vacuous.
+
+**The realized invariant (M7), enforced by `scripts/validate_event_spine_wiring.py`
+and `tests/test_event_spine_wiring.py`:**
+
+```
+EventSpine.emit ──(register_audit_consumer, M1)──▶ AuditLogger.record
+                                                         │
+                                add_sink fan-out: webhook, OTel, …
+```
+
+- `EventSpine` (`teaagent/runner/_events.py`) is **the** typed run-lifecycle path.
+- `AuditLogger` (`teaagent/audit.py`) is the **complete event record and the sink
+  hub**, and a spine consumer since M1. Governance events that stay inline
+  (approval, budget, hooks) are written via `audit.record` — that **is** the
+  record, not redundant inline eventing to delete.
+- **Webhook / OTel are audit *sinks***, not direct spine consumers — a direct
+  consumer would see only the spine-emitted subset (a coverage regression).
+- `ContextBus` and the integration `RunEventStream` are **unwired in production**;
+  they are not lifecycle buses. The guard's allowlist names every sanctioned
+  event-delivery surface, so a **new competing lifecycle-event bus fails the gate**
+  and forces a conscious decision. The taxonomy-closure check proves no
+  `RunEventType` is orphaned from the audit record.
+
+**Lesson:** the spine's realized value is the **typed read side** (evidence →
+receipts) and a single typed lifecycle path — not wholesale relocation of
+runtime-stateful enforcement. The plan gate was the one gate that genuinely
+belonged on the spine.
+
 ## Consequences
 
 **Positive:**

docs/generated/docs-inventory.md

@@ -42,7 +42,7 @@ Do not edit this file manually — regenerate instead.
 | `adr/0029-consensus-validation-deferred.md` | working | 1587 | `8a2da40abc07` |
 | `adr/0030-root-module-freeze.md` | working | 1297 | `bee25422e85f` |
 | `adr/0031-shadow-mode-exit-criteria.md` | working | 3598 | `46a9a0d5eaac` |
-| `adr/0032-run-event-taxonomy.md` | working | 10046 | `d2cc47767526` |
+| `adr/0032-run-event-taxonomy.md` | working | 13534 | `dcae5044f4c4` |
 | `adr/README.md` | working | 7109 | `713a782f5411` |
 | `agent-contribution-contract.md` | constitution | 5204 | `9c2dad1195d2` |
 | `agent-mode-operator-guide.md` | working | 2778 | `25b258ab7bfe` |
@@ -414,7 +414,7 @@ Do not edit this file manually — regenerate instead.
 | `ops/security-hardening.md` | working | 11733 | `0a385c7dab82` |
 | `ops/troubleshooting.md` | working | 9127 | `4921b6d50f5c` |
 | `permission-and-approval-playbook.md` | working | 6560 | `813bc74bb156` |
-| `plans/adr-0032-m1-m6-work-plan-2026-06-13.md` | archive | 57704 | `53c78129190f` |
+| `plans/adr-0032-m1-m6-work-plan-2026-06-13.md` | archive | 60885 | `70eeb1c1049b` |
 | `plans/agent-ecosystem-acceptance-roadmap-2026-05-31.md` | archive | 29099 | `7c4a4972cfeb` |
 | `plans/community-pain-points-response-plan-2026-06-05.md` | archive | 7276 | `571d010133ad` |
 | `plans/competitive-positioning-plan-2026-05-31.md` | archive | 8726 | `d16dfd2bdd99` |

docs/plans/adr-0032-m1-m6-work-plan-2026-06-13.md

@@ -179,7 +179,7 @@ consumers by M6.
 | ADR-0032-M4 (CLOSED — owner decisions B + B-analog, 2026-06-13) | **No gate moves to an interceptor; approval AND budget enforcement both STAY INLINE.** Both proved runtime-stateful on assessment, a poor fit for the pure-interceptor model. **Approval** (decision B): live JIT/session state, tool handler, auto-mode-swappable policy — every coupling gap was invisible to a unit parity test (`docs/work-log/m4-approval-sliceB-blocked-2026-06-13.md`). **Budget** (decision B-analog): it is three mechanisms — only the global cost cap (`_assert_cost_budget`) is stateless; the phase budget (live `phase_tracker`) and the warning ladder (`_budget_warning_levels_emitted` + `BudgetMonitor._emitted_levels`/`_prompted` dedup sets + an interactive `on_prompt` side-effect handler — the same `assert_allowed` shadow-coexistence trap that blocked approval) are stateful, and even the cost cap is enforced at two evolving-cost points per iteration that do not map 1:1 to events (`docs/work-log/m4-budget-stays-inline-2026-06-13.md`). Both gates' observability is already provided by M2 (their audit events — `tool_call_*`, `approval_*`, `budget_warning`, `budget_prompt`, `phase_budget_warning` — are typed + reader-surfaced); the M6 fold reads them without owning enforcement. Approval/budget behavior unchanged. **Net: plan gate (M3) is the sole governance gate moved to an interceptor.** |
 | ADR-0032-M5 (REVISED — observability-only, 2026-06-13) | **Hook OBSERVABILITY folds onto the spine; hook EXECUTION stays in the tool-dispatch layer.** Assessment found the planned "HookRegistry on spine" unsuitable for the same runtime-coupling reason as approval/budget: PreToolUse/PostToolUse run in `teaagent/tools.py::execute` and **mutate in-flight `arguments`/`result`** (the spine has no channel to ferry mutated payloads back to the dispatch site), and the 6 session-lifecycle hooks (SessionStart/End, UserPromptSubmit, PreCompact, Stop, SubagentStop) have **no production caller** — nothing to strangle; wiring them is feature work. Done: the 5 dispatch-layer hook audit events (`tool_hook_pre_mutation`, `tool_hook_pre_mutation_blocked`, `tool_hook_vetoed`, `tool_hook_post_mutation`, `tool_hook_post_failed`) are typed in `RunEventType` + mapped both directions, so the M2-T001 reader surfaces hook veto/mutation activity from the audit JSONL for the M6 fold. Mapping/reader only; audit bytes unchanged; hook execution + mutation semantics unchanged. See `docs/work-log/m5-hooks-observability-only-2026-06-13.md`. |
 | ADR-0032-M6 (was M2 fold; corrected scope A) — **COMPLETE (FOLD-T001 + T002)** | Evidence and receipts are folded from the typed event stream and equal the legacy builder on success/failure/pending fixtures (cancelled once emitted in M2); the fold reads the full stream (no fallback flag, per Q1). **FOLD-T001**: `build_evidence_from_events()` parallel builder sharing `_assemble_evidence_bundle` with the legacy path (cannot drift; only the event *source* differs), parity-asserted (`tests/test_run_evidence.py::test_m6_fold_*`). Fixed a structural gap: the typed `RunEvent` was lossy — dropped top-level `created_at` (threaded into command/test/approval timestamps); added optional `RunEvent.created_at`, reader populates it. **FOLD-T002 (cutover DONE)**: `build_run_evidence_bundle` now routes production evidence THROUGH the typed reader + fold — the typed stream is the production path; the raw-dict assembly survives only as the shared helper (so the two cannot diverge). Suite-wide green (evidence/receipt/summary/5-min-proof/first-hour/adversarial + all bundle consumers, ~218 tests). **Finding: no synthetic receipt-only fixtures existed to retire** — the receipt/evidence path was already event-backed (`test_run_receipt.py` writes real RunStore events; `test_real_run_receipt_completeness_from_plan` validates a real run); direct `RunEvidenceBundle(...)` constructions are legitimate downstream-consumer/checker unit tests, not masking fixtures. The plan anticipated a gap that does not exist. Parity test re-anchored against `_assemble_evidence_bundle` (the raw-dict path) so it stays meaningful post-cutover. |
-| ADR-0032-M7 (was M6) | ContextBus and webhook sinks consume the spine; inline emission paths are deleted; validator shows no orphaned eventing modules. |
+| ADR-0032-M7 (was M6) — **COMPLETE as guard + document, 2026-06-13** | Original goal ("ContextBus + webhook consume the spine; delete inline eventing") **NOT done — it is a regression or vacuous.** Webhook is an `audit.add_sink` already fed transitively by the M1 spine→audit consumer; a *direct* spine consumer would see only the spine-emitted subset (coverage regression). ContextBus + integration `RunEventStream` are **unwired in production** (no callers) — nothing to migrate. The inline `audit.record` calls are the **complete event record** (read by evidence/receipts/webhook), not redundant eventing to delete. **Done instead (owner: guard + document):** `scripts/validate_event_spine_wiring.py` + `tests/test_event_spine_wiring.py` enforce the realized invariant — one typed lifecycle path (EventSpine→audit consumer), an allowlist of sanctioned event-delivery surfaces so a NEW competing lifecycle bus fails the gate, and taxonomy closure (no RunEventType orphaned from the audit record). Added as a pre-commit hook. ADR 0032 "Realized architecture (M1–M7)" section documents the outcome. **MIGRATION COMPLETE.** |
 
 ## 8. Task Plan
 
@@ -655,7 +655,15 @@ commit once Slice A is green.
 - Parallelizable: yes after T002.
 - Human Review Required: yes for API wording.
 
-### ADR32-M6-T001: ContextBus Consumer
+> **M7 TASKS (mislabeled ADR32-M6-T001..T004 — these are the M7 ContextBus/
+> webhook/validator/cleanup work per the §5 re-sequencing) — RESOLVED 2026-06-13.**
+> T001 (ContextBus consumer) and T002 (webhook consumer) CLOSED as unsuitable
+> (ContextBus unwired; webhook is an audit sink already spine-fed — direct
+> consumption regresses coverage). **T003 (orphaned-eventing validator) DONE.**
+> T004 (delete inline emission) CLOSED — inline `audit.record` IS the complete
+> record, not redundant. See the §7 M7 row and ADR 0032 "Realized architecture".
+
+### ADR32-M6-T001: ContextBus Consumer [CLOSED — unsuitable]
 
 - Goal: make ContextBus consume RunEvents or derive DeltaCards from RunEvents.
 - Scope: context deltas only; do not add async queues.
@@ -681,7 +689,13 @@ commit once Slice A is green.
 - Parallelizable: yes after M5.
 - Human Review Required: yes for model-visible boundary.
 
-### ADR32-M6-T002: Webhook Sink Consumer
+### ADR32-M6-T002: Webhook Sink Consumer [CLOSED — unsuitable]
+
+> **CLOSED (2026-06-13).** `WebhookAuditSink` is an `AuditLogger` sink
+> (`audit.add_sink`); since M1 the audit logger is a spine consumer, so webhook
+> is already transitively spine-fed. Making it a *direct* spine consumer would
+> regress it to only the spine-emitted subset (most governance events are written
+> via direct `audit.record`). Webhook correctly stays an audit sink.
 
 - Goal: route webhook audit delivery through the event spine.
 - Scope: webhook delivery, HMAC, filtering, failure suppression.
@@ -709,7 +723,17 @@ commit once Slice A is green.
 - Parallelizable: yes with M6-T001 after M5.
 - Human Review Required: yes if webhook payload schema changes.
 
-### ADR32-M6-T003: Orphaned Eventing Validator
+### ADR32-M6-T003: Orphaned Eventing Validator [DONE]
+
+> **DONE (2026-06-13).** `scripts/validate_event_spine_wiring.py` +
+> `tests/test_event_spine_wiring.py`. Two checks: (A) taxonomy closure — every
+> `RunEventType` maps losslessly to the audit record (no orphaned typed event);
+> (B) no orphaned event bus — an AST scan for high-signal lifecycle-event methods
+> (`register_consumer`/`register_interceptor`/`add_sink`/`on_event`/
+> `publish_delta`/`subscribe_deltas`; generic `publish`/`emit` excluded to avoid
+> noise) must match a curated allowlist of sanctioned surfaces, so a new
+> competing bus fails. Seeded-bad-fixture tests included. Added as the
+> `check-event-spine-wiring` pre-commit hook.
 
 - Goal: prove there are no competing lifecycle event systems left after M6.
 - Scope: static validation over audit strings, HookRegistry emissions,
@@ -734,7 +758,15 @@ commit once Slice A is green.
 - Parallelizable: yes late M6.
 - Human Review Required: no.
 
-### ADR32-M6-T004: Remove Inline Emission Paths
+### ADR32-M6-T004: Remove Inline Emission Paths [CLOSED — nothing redundant to remove]
+
+> **CLOSED (2026-06-13).** There are no redundant inline emission paths to
+> delete. The inline `audit.record` calls (approval, budget, hooks — everything
+> that stayed inline by the M4/M5 findings) ARE the complete event record that
+> evidence/receipts/webhook read; they are not duplicated by the spine (the
+> spine emits only the runner's lifecycle subset, which the audit consumer
+> records). Deleting them would lose events. The realized invariant is guarded
+> by T003 instead of by deletion.
 
 - Goal: delete or quarantine old inline event emission paths after consumers
   own audit/hooks/context/webhook behavior.