Contract — ADR-009 Authorship Binding

Step 2 of the 5-step chain. This contract specifies what the ADR file must contain and the invariants the round must hold.

Behavioural contract for the deliverable

The ADR file (docs/architecture/decisions/ADR-009-authorship-binding.md) must satisfy all of the following:

C1 — Frontmatter

YAML frontmatter with these keys exactly:

---
title: "ADR-009: Authorship Binding in the ζ Decision Trail"
description: <one-sentence description naming Finding #2 and the three options>
tags: [adr, decision, legitimacy, zeta, authorship, security]
type: adr
round: post-R83
status: proposed
parent: Architecture Decision Records
updated: 2026-05-06
nav_order: 90
---

status: proposed is mandatory (lowercase, matching ADR-006’s pattern). nav_order: 90 follows the +10 increment from ADR-006’s 60 (skipping 70/80 which are unused by ADR-007 and ADR-008 — both are also doc-only proposed ADRs in flight per the worktree list, but the worktree list is informational only; this round does not coordinate nav_order with them).

C2 — Status block

After the H1, a status block matching ADR-005 / ADR-006:

**Status:** Proposed
**Date:** 2026-05-06
**Round:** post-R83
**Supersedes:** None
**Superseded by:** None

C3 — Section order and content gates

§	Heading	Must contain
1	Context	(a) Naming “Finding #2” verbatim; (b) at least one explicit citation to `src/domains/trail/schema.ts:170-188` for `computeHash` and `:153-159` for the deliberate-exclusion docstring; (c) the practical-attack paragraph (DB-level write, audit-sink replacement, future authoring tool); (d) one sentence linking to `CLAUDE.md` §10 (legitimacy promise); (e) one sentence linking to ADR-006 (the executable-meaning contract whose `partial → complete` line the gap interferes with).
2	Decision	A single named option (A, B, or C) declared as the recommended path. Body ≥ 50 words explaining the recommendation in light of λ Reputation timing.
3	Alternatives Considered	All three options A / B / C in full. Each option ≥ 80 words, with at least: cost summary, security-property summary, key-material posture, fit with future λ Reputation.
4	Consequences	Three subsections (Positive / Negative / Neutral). Plus a chain-validity table (mandatory per task prompt) — one row per option, columns: Option · Invalidates `data/colibri.db` chains? · Invalidates `data/ams.db` chains? · Migration approach.
5	Implementation	Concrete changes a follow-up task can pick up: file paths, function signatures, migration numbers. Per-option follow-up plan only for the recommended option (A/B/C). The two non-recommended options need only a one-line “if reversed” pointer.
6	Verification	How a future round confirms the chosen option was implemented. Must specify Jest test, schema migration, and CLAUDE.md / ADR-006 amendment if needed.
7	References	At least 6 entries: schema.ts hash function, repository.ts insert, verifier.ts compute, migrations/003, CLAUDE.md §10, ADR-006.

C4 — Honesty invariants

No softening of the gap. The Context section must use the words “asserted but not cryptographically bound” or equivalent. It must not call the gap merely a “documentation issue”.
No over-claiming for Option C. Documenting the gap does NOT close it. The ADR must say so explicitly.
No hidden tradeoffs in Option B. The ADR must flag key management as out-of-scope-but-non-trivial. It is not allowed to wave away “store the key somewhere” with a single sentence.
Both DBs assessed. The chain-validity table must answer for both data/colibri.db AND data/ams.db.

C5 — Word count target

Target 1.0k–1.6k words excluding YAML and tables. Hard ceiling 2.0k words. Rationale: ADR-005 is ~750 words pre-postscript; ADR-006 is ~1.2k. A three-option-evaluation ADR is comparable to ADR-006.

C6 — Diff scope

This task may modify only:

docs/audits/adr-009-authorship-binding-audit.md (Step 1, this round)
docs/contracts/adr-009-authorship-binding-contract.md (Step 2, this file)
docs/packets/adr-009-authorship-binding-packet.md (Step 3)
docs/architecture/decisions/ADR-009-authorship-binding.md (Step 4 — the deliverable)
docs/architecture/decisions/index.md (one-line index update)
docs/verification/adr-009-authorship-binding-verification.md (Step 5)

Forbidden: any src/, any data/, any other ADR, any other markdown not in the list above.

Invariants

I1 — Status remains Proposed

T3 cannot move ADRs to Accepted. Per docs/architecture/decisions/README.md §”Who can accept ADRs”: “Only the PM (project owner) may move a PROPOSED ADR to ACCEPTED. Sub-agents must leave new ADRs in PROPOSED status and surface them in their task writeback.” This round respects that boundary.

I2 — Recommendation is reasoned, not arbitrary

The §Decision section’s recommendation must follow logically from the §Alternatives evaluation. A reader who reads §Alternatives first must arrive at the same recommendation §Decision presents.

I3 — No ambient changes

The lint gate (npm run lint) is satisfied because no TS files change. The build gate (npm run build) is satisfied because no TS files change. The test gate (npm test) is satisfied because no test files change AND no source files change. All three remain green by virtue of the no-source-edit rule.

I4 — index.md update is additive

The one-line update to docs/architecture/decisions/index.md adds a row at the bottom of the bulleted list. It does NOT renumber, reorder, or rewrite existing entries.

Acceptance criteria for Step 4 (the ADR file itself)

ID	Check	How to verify
A1	Frontmatter exact per C1	`grep -A 12 '^---' docs/architecture/decisions/ADR-009-*.md \\| head -13`
A2	All 7 sections present in order	`grep -n '^## ' docs/architecture/decisions/ADR-009-*.md` returns Context, Decision, Alternatives Considered, Consequences, Implementation, Verification, References.
A3	Chain-validity table exists	`grep -c 'Invalidates.colibri.db' docs/architecture/decisions/ADR-009-.md` ≥ 1
A4	Word count in band	`wc -w` between 1000 and 2000 (excluding frontmatter / tables; informally checked).
A5	All 3 options explicitly named A / B / C	`grep -c '### Option [ABC]' docs/architecture/decisions/ADR-009-*.md` = 3
A6	At least 3 line-citations to schema.ts:170-188 / :153-159 / repository.ts	`grep -c 'schema.ts:\\|repository.ts:\\|verifier.ts:' docs/architecture/decisions/ADR-009-*.md` ≥ 3
A7	Build + lint + test green	`npm run build && npm run lint && npm test` all return 0.

Out-of-scope (explicit)

Implementing any of the three options. The follow-up round implements; this round only proposes.
Editing other ADRs. ADR-006 will need a footnote / cross-reference if Option A or B is accepted, but that’s the next round’s job.
Touching docs/3-world/social/llm.md or any concept doc. Concept-doc graduation rules (ADR-006) are unchanged by ADR-009 in its Proposed state.
Editing data/colibri.db or data/ams.db. The ADR specifies a migration plan; this round does not run it.