Base layer: the mesh as it is, under the mesh as it should be

HQ held only the to-be. Every reader had to already know the system the
decisions were about, and an as-is claim had nowhere to live except inside
an intention.

Adds 02-DESIGN/00-as-is — eleven documents written from the implementation
and the operational record, not from intent, including the parts nobody
would choose again. The two existing designs move under 01-to-be. Layers
are declared in frontmatter and never mix: a design that ships does not
move, its as-is counterpart is written, and both stand.

Back-fills adr/0001-0014 for decisions taken in implementation and never
recorded — the broker, the module abstraction, the mesh database, managed
files, provisioning, migrations, the workspace removal, failing loudly,
the constitution, application placement, linking, the employee model, the
artifact, the three silos. Each marked reconstructed, dated from the
history, and citing the evidence it was recovered from. The two existing
records renumber to 0015 and 0016 so the ledger runs oldest first;
0017 extends 0015 to modules outside the core, principle only — the
domain list is deliberately not invented here.

how-we-build.md becomes the source of the mesh constitution, with a sync
playbook, so the enforced copy stops being the only one that is true.

Process becomes explicit: five playbooks, eight thin skills that defer to
them, a repository map, and AGENTS.md with CLAUDE.md as its include.

The five Observations become 04-ISSUES 001-005 where they can be owned and
closed. 006 is new and uncomfortable: HQ is not indexed into the knowledge
base. That claim is what decision 27 rests on, it was never checked, and
the README now says so instead of repeating it.

Also corrects the ADR index into something generated, the "02-DESIGN is
empty" claim, the VISION.md pointer that did not survive the repo split,
and a note asserting the symlink rule was contradicted — it was a
misreading; the rule forbids hand-made links, the installer links by design.

.claude/skills/hal-amend-design/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: hal-amend-design
+description: Use when a hal-hq design document must change, or when an as-is document is found to be wrong about what the mesh actually does. Triggers on "the design changed", "that's not how it works any more", "update the as-is", "this shipped differently".
+---
+
+# hal-amend-design
+
+Changes a design document. **Authoritative playbook:**
+[`00-GENESIS/process/02-graduation.md`](../../../00-GENESIS/process/02-graduation.md).
+
+## Which layer is being changed
+
+**Establish this first — the two amend for opposite reasons.**
+
+| Layer | Amend when | Requires |
+|---|---|---|
+| `01-to-be/` | The intention changed | A decision record. Always. |
+| `00-as-is/` | The mesh changed, or the document was wrong about it | Evidence from the implementation. Never a decision. |
+
+An as-is document is corrected against **what the code does**, not against what anyone meant.
+If the implementation and the intention disagree, the as-is document records the implementation
+and says they disagree.
+
+## Amending the to-be layer
+
+1. Write the decision record. If it reverses an earlier one, that record gets
+   `status: superseded` and `superseded-by:` — its text is never edited.
+2. Edit the design; set `updated:` to today.
+3. If this came from an issue, set that issue's `amended-design:`.
+4. Add the ledger line to `DECISIONS.md`.
+
+## Amending the as-is layer
+
+1. Establish what is actually true — from the code, a pipeline log, a live query, the
+   operational record. Not from a design document.
+2. Edit the document. Set `updated:` only if the **implementation state** changed; a
+   correction to text that was always wrong does not change it.
+3. If the correction reveals that something shipped differently from its design, say so in the
+   as-is document and leave the to-be document alone. That divergence is a finding, and may
+   deserve an issue.
+
+## Do not
+
+- Do not put a future intention in an as-is document.
+- Do not quietly fix a wrong claim that held up a decision. Record that it was wrong and where
+  it was relied on — that is the failure this repository exists to name.

.claude/skills/hal-diagnose/SKILL.md

@@ -0,0 +1,40 @@
+---
+name: hal-diagnose
+description: Use when investigating an open hal-hq issue — finding which component owns a symptom, and why. Triggers on "diagnose issue N", "where does this live", "who owns this bug", "why does this happen".
+---
+
+# hal-diagnose
+
+Investigates an open issue to the point where its owner is known. **Authoritative playbook:**
+[`00-GENESIS/process/03-issues.md`](../../../00-GENESIS/process/03-issues.md).
+
+## Before forming a hypothesis
+
+**Search the operational memory for the literal symptom text.** Not after a hypothesis fails —
+before forming one. The knowledge base is indexed on symptoms, and the entry needed is usually
+titled after the error being stared at.
+
+This fires hardest on familiar ground, where a confident trail feels like progress. Two entries
+have been rediscovered from scratch over several hours in one session because the search was
+skipped. Both were already written down.
+
+If the search returns nothing and the problem is then solved, write the finding back. An empty
+result is not "nothing to learn" — it is the reason the next person repeats the work.
+
+## Steps
+
+1. Read `00-report.md`. Move `status:` to `diagnosing`.
+2. Investigate. Write `01-diagnosis.md` in the same folder: the trail, **dated**, including
+   what was ruled out and how. Archaeology — which commit, which pull request, which date a
+   behaviour changed — is the most valuable content here.
+3. When the owner is known, set `status: located` and fill `located-in:` with repositories or
+   modules from [`00-GENESIS/repos.md`](../../../00-GENESIS/repos.md).
+4. On resolution: `status: resolved`, fill `fixed-by:`. If the root cause was a design gap, run
+   `hal-graduate` for the amendment and fill `amended-design:`.
+
+## Rules
+
+- State evidence, not assertion. A date and a reference outrank a conclusion.
+- Record what was ruled out. The next person needs to know where not to look.
+- Closed issues are never deleted.
+- `wontfix` is legitimate and requires a sentence saying why.

.claude/skills/hal-graduate/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: hal-graduate
+description: Use when a hal-hq research effort concludes and becomes design, or when a design must change. Triggers on "graduate this research", "this is decided", "write the ADR", "close the effort", "the design changed".
+---
+
+# hal-graduate
+
+Closes a research effort into a decision and a design, or amends an existing design.
+**Authoritative playbook:**
+[`00-GENESIS/process/02-graduation.md`](../../../00-GENESIS/process/02-graduation.md) — read
+it; this skill adds only the scaffolding.
+
+## Steps
+
+1. **Check against GENESIS** — `mission.md`, `context.md`, `effect.md`. If the conclusion
+   conflicts, say which is wrong, in writing, before proceeding.
+2. **Write the decision record** in `adr/`, next free number, frontmatter per
+   [`adr/README.md`](../../../adr/README.md). `reconstructed: false` — this one is being taken,
+   not recovered. Record the rejected options.
+3. **Write the design** under `02-DESIGN/01-to-be/` with `layer: to-be`, `status: designed`,
+   empty `code:`, today's `updated:`, and `decisions:` pointing at the record.
+4. **Close the effort** — the research `status.md` gets `status: graduated` and `became:`
+   pointing at both.
+5. **Add the ledger line** to `DECISIONS.md` under today's heading.
+
+## Amending an existing design
+
+A design changes only through a decision. Write the record first; if it reverses an earlier
+one, set that record's `status: superseded` and `superseded-by:` — **never edit its text**.
+Then edit the design and set `updated:`.
+
+## When something ships
+
+Write or update the matching `02-DESIGN/00-as-is/` document so it describes what now runs,
+including anything that shipped differently from the intent. Set the to-be document's
+`status: implemented` and its `code:`. **The to-be document does not move** — both stand.
+
+`status: implemented` must be defensible from the owning repository's main branch. If it
+cannot be checked, it is `in-progress`.
+
+## Do not
+
+- Do not move a to-be document into `00-as-is/`.
+- Do not edit an as-is document to describe an intention.
+- Do not change a decision record's meaning. Supersede it.

.claude/skills/hal-handoff/SKILL.md

@@ -0,0 +1,32 @@
+---
+name: hal-handoff
+description: Use when a hal-hq design is settled and implementation is about to start in a code repository. Triggers on "start building this", "hand this off", "ready to implement", "who owns this now".
+---
+
+# hal-handoff
+
+Hands a settled design to a code repository. **Authoritative playbook:**
+[`00-GENESIS/process/04-build-handoff.md`](../../../00-GENESIS/process/04-build-handoff.md).
+
+## Steps
+
+1. **Confirm it is settled.** `status: designed`, and every claim traceable to a record in
+   `adr/`. An open question in the text is a reason to run `hal-new-research`, not to build
+   around it.
+2. **Name the owner.** Set `code:` from
+   [`00-GENESIS/repos.md`](../../../00-GENESIS/repos.md). If the repository does not exist yet,
+   add it to `repos.md` in the same change.
+3. **Read the as-is counterpart.** What is being replaced must be written down in
+   `02-DESIGN/00-as-is/` before it is changed. Building against an undocumented as-is is how
+   shipped behaviour gets lost.
+4. **Flip the status** to `in-progress`, `updated:` today.
+5. Build in the code repository. hal-hq never carries implementation.
+6. On completion, run `hal-graduate`'s "when something ships" section.
+
+## Non-negotiable
+
+- Every merge is a human checkpoint, without exception.
+- **Never open a pull request unprompted.** A permissions list saying it is allowed is not a
+  request.
+- Work in an isolated worktree, never a shared checkout.
+- Never push to the main branch.

.claude/skills/hal-new-issue/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: hal-new-issue
+description: Use when something is wrong with the HAL mesh at the level of design or governance — a rule enforced by nothing, a stated behaviour that does not happen, a failure the design lets pass silently. Triggers on "this is broken", "open an issue", "that rule isn't enforced", "this reports success and does nothing".
+---
+
+# hal-new-issue
+
+Opens a numbered issue. **Authoritative playbook:**
+[`00-GENESIS/process/03-issues.md`](../../../00-GENESIS/process/03-issues.md).
+
+## First, decide it belongs here
+
+| Belongs in `04-ISSUES` | Belongs in the knowledge base |
+|---|---|
+| The design permits a failure to be silent | How to fix one occurrence of it |
+| A documented rule is enforced by nothing | A command that works around it |
+| A stated invariant is false in practice | A node-specific quirk |
+| Finding the owner needs the whole mesh in view | Symptom → fix, once the answer is known |
+
+**Search the knowledge base first** for the literal symptom text. If the answer is already
+there, this is not an issue — it is a lookup. If the answer is a general lesson, it belongs in
+both.
+
+## Steps
+
+1. Next free number. Create `04-ISSUES/NNN-short-name/00-report.md` with:
+
+   ```yaml
+   ---
+   status: open
+   opened: YYYY-MM-DD
+   located-in: []
+   fixed-by:
+   amended-design:
+   ---
+   ```
+
+2. Write the symptom **as observed**, in plain terms, with the evidence that it happened —
+   what was run, what came back, when.
+3. Say why it matters beyond the instance. An issue that is only one occurrence is a knowledge
+   base entry.
+4. End with open questions rather than a proposed fix. Diagnosis is a separate step.
+
+## Do not
+
+- Do not name nodes, domains, addresses or paths. This repository is public.
+- Do not guess the owner — `located-in:` is filled by diagnosis, not by opening.

.claude/skills/hal-new-research/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: hal-new-research
+description: Use when starting a new research effort in hal-hq — an idea, technology or approach worth investigating before it is committed to design. Triggers on "research X", "investigate X", "spike X", "should we use X", "is X worth doing".
+---
+
+# hal-new-research
+
+Scaffolds a new research effort. **Authoritative playbook:**
+[`00-GENESIS/process/01-research.md`](../../../00-GENESIS/process/01-research.md) — read it;
+this skill only does the mechanical setup.
+
+## Steps
+
+1. Find the next free number: list `01-RESEARCH/NNN-*`, take the highest plus one, zero-padded
+   to three digits.
+2. Create `01-RESEARCH/NNN-descriptive-name/` (kebab-case from the topic).
+3. Create `status.md` in it with exactly this frontmatter, then a prose summary of **what** is
+   being investigated, **why**, and **what it touches**:
+
+   ```yaml
+   ---
+   status: ongoing
+   initiated: YYYY-MM-DD
+   touches: []
+   became: []
+   ---
+   ```
+
+4. Do the research in further documents in the same folder. Keep the summary current.
+
+## Do not
+
+- Do not restate the status in prose. It lives in frontmatter, in one place.
+- Do not fill `became:` while the effort is open — `hal-graduate` sets it at closure.
+- Do not skip or reuse a sequence number.
+- Do not write into `02-DESIGN` from an open effort.
+- Do not name the mesh being observed. Evidence is required; identification is forbidden.
+
+## Closing
+
+An effort never just stops. It closes through `hal-graduate` as `graduated` or `abandoned`,
+always with `became:` pointing at what it turned into. Nothing is deleted.

.claude/skills/hal-status/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: hal-status
+description: Use when you need a cross-cutting view of where hal-hq stands — research state, design implementation state, open issues, or the decision-record index. Triggers on "what's the status", "show the ADR index", "where do things stand", "what's in progress", "what's open".
+---
+
+# hal-status
+
+Generates a cross-cutting view **from frontmatter**. This is a read-and-render skill, not a
+workflow — hal-hq has **no central status file by design** (decision 35). Every view is
+generated on demand and never written back to disk.
+
+## What to read
+
+| Section | Files | Frontmatter |
+|---|---|---|
+| Research | `01-RESEARCH/NNN-*/status.md` | `status` (`ongoing` / `graduated` / `abandoned`), `initiated`, `touches`, `became` |
+| Design | `02-DESIGN/**/*.md` (not READMEs) | `layer` (`as-is` / `to-be`), `status` (`designed` / `in-progress` / `implemented` / `abandoned`), `code`, `updated`, `decisions` |
+| Decisions | `adr/NNNN-*.md` | `status` (`proposed` / `accepted` / `superseded`), `date`, `deciders`, `reconstructed`, `superseded-by`, `extends` |
+| Issues | `04-ISSUES/NNN-*/00-report.md` | `status` (`open` / `diagnosing` / `located` / `resolved` / `wontfix`), `opened`, `located-in`, `fixed-by`, `amended-design` |
+
+## Steps
+
+1. Read the frontmatter block from every file above — a grep across each tree is enough, no
+   need to load bodies.
+2. Render what was asked as Markdown tables. Group and sort sensibly. The **ADR index** is one
+   of these views: records ordered by number, with title, date and status, and reconstructed
+   ones marked.
+3. Flag anything inconsistent at the end, as flags — do not silently correct the render:
+   - a `graduated` or `abandoned` effort with an empty `became:`
+   - an `implemented` design with an empty `code:`
+   - a `superseded` record with no `superseded-by:`
+   - an `open` or `diagnosing` issue with no activity
+   - a to-be design whose `decisions:` points at a record that does not exist
+   - an as-is design whose claims are older than its `updated:` date suggests
+
+## Do not
+
+- **Do not write a status file.** Central status files are explicitly rejected. The view is
+  always generated, always ephemeral. This includes the ADR index — the hand-written one had
+  already drifted after a single addition, which is why it was removed.
+- Do not infer status from prose. Trust only the frontmatter; if it is wrong, flag it.

.claude/skills/hal-sync-constitution/SKILL.md

@@ -0,0 +1,38 @@
+---
+name: hal-sync-constitution
+description: Use after changing a rule in hal-hq's 00-GENESIS/how-we-build.md, to publish the derived constitution page the mesh injects into design sessions. Triggers on "sync the constitution", "publish the rules", "I changed how-we-build", "update the governed page".
+---
+
+# hal-sync-constitution
+
+Publishes the derived constitution from its source. **Authoritative playbook:**
+[`00-GENESIS/process/05-constitution-sync.md`](../../../00-GENESIS/process/05-constitution-sync.md).
+
+## What this is
+
+[`00-GENESIS/how-we-build.md`](../../../00-GENESIS/how-we-build.md) is the **source**. The
+knowledge base carries a **derived** page that the mesh injects into every eligible design
+session, and against which a check phase can block work.
+
+Two texts stating the same rules drift, and the enforced copy wins by default — so the reasoned
+copy quietly stops being true. This skill is the mechanism that prevents that, and it is how
+the claim "HQ is the source" is checked.
+
+## Steps
+
+1. Confirm the source change is recorded as a decision. A rule the mesh enforces is
+   architecturally significant; if there is no record, run `hal-graduate` first.
+2. Derive the page: the **rules without the reasoning**. Section numbering is stable — the
+   orchestrator and the review fragments cite sections by number, so never renumber to tidy.
+3. Publish it to the knowledge base under the constitution slug, replacing the body.
+4. **Read it back and verify the change is present.** A publish that reported success and did
+   nothing is exactly the failure class this repository exists to name — do not skip this.
+5. Note the sync in the decision's ledger line.
+
+## Do not
+
+- **Never edit the derived page directly.** An edit there survives until the next sync and then
+  vanishes, taking its reasoning with it.
+- Do not relax a rule in the derived page. Overrides may only tighten.
+- Do not report the sync as done without the read-back. If it could not be performed, say so —
+  an unsynced rule is a rule the mesh does not enforce, whatever the source says.