Relationship-aware plan-delta receipt for off-plan ticket rate

REVISED 2026-07-31 per epic-review IC_kwDODSospM8AAAABMlMHzg (Stage 2). The original framing — a naive per-author rate threshold riding "the hourly github-sync walk" — failed two falsifiers: (1) a live 14-day simulation of the 3-tickets/6h threshold produced 68 episodes across all nine active authors, including this epic's own sanctioned five-ticket leaf filing — raw rate is noise, not signal; (2) the runtime premise conflated two walks — the orchestrator sync lane is 2h cadence + default-disabled, and the actual hourly walk is CI-side with no MC/A2A authority, so "rides the existing hourly walk" named a runtime that cannot deliver the receipt. Reframed below as a relationship-aware plan-delta receipt with runtime selection as a proven AC, not an assumption.

Context

Sub of #16212 (execution-fidelity epic, operator-commissioned 2026-07-31). Operator: "i can sadly not handle the new ticket bursts and derailments on my own." Today the only burst detector is operator attention. The #16167 incident produced ten tickets from one author in one night; recent graduations accumulated 50+ off-plan tickets before reaching graduation scope — in both cases the signal existed in plain issue metadata and relationships, and nothing read it.

The Problem

Raw creation rate does not separate derailment from legitimate work. The Stage-2 simulation is the proof: 68 threshold crossings in 14 days of normal swarm operation, including a plan-complete epic filing that is the opposite of the failure mode. What distinguished the #16167 derail burst from tonight's epic filing is not the count — it is the plan relationship: the derail tickets were unlinked to any governing epic and re-proposed settled authority; the epic filing was natively linked, plan-declared, and execution-gated.

So the receipt must measure plan-delta, not rate: tickets created into a governed lane's blast radius that carry no native parent linkage and no EXECUTES plan-authority declaration (post-#16214). A linked, declared burst of any size is invisible to it by construction.

The Architectural Reality

• Native relationship graph — parent-child links are queryable per ticket; the absence of a parent on a governed-lane ticket is mechanical.
• Plan-Authority: declaration (#16214) — sharpens classification once shipped; before it, linkage-absence alone is the coarse signal. #16215 therefore executes after #16214 (native blocked_by).
• Runtime candidates, NONE assumed fit (the Stage-2 correction): the orchestrator github-sync lane exists but is 2h + default-disabled; the hourly data-sync walk is CI-side without MC/A2A delivery authority. A fit runtime must own BOTH fresh GitHub issue/relationship data AND A2A delivery. Selecting and proving it is an AC of this ticket, not a premise.
• AiConfig declarative leaves per ADR 0019 — threshold/window/enabled are config, not constants. §critical_gates 10 applies: read ADR 0019 before authoring or reviewing the config touch.
• A2A add_message — targeted delivery to epic steward + operator; suppressed-wake receipt class.

The Fix

1. Plan-delta classifier (pure function, runtime-agnostic): given a window of created tickets + their native relationships (+ Plan-Authority: lines once #16214 ships), count per author the tickets that are (a) inside a governed lane's blast radius and (b) unlinked AND undeclared. Threshold crossing on THAT count — never on raw rate — flags an episode. Graduation exception (operator-decided 2026-07-31, scope tightened per epic-review correction): exempt ONLY the natively linked parent + full-v1-leaf graduation batch — a graduation legitimately needs many tickets at once. Any linked ticket outside a graduation batch still counts toward its author's window; the exemption is the batch, not linkage in general.
2. Receipt: one [plan-delta] A2A per author+window to the steward(s) of the affected governed lane(s) + operator; body = author, off-plan count vs total created, window, ticket list, governed-lane hits. wakeSuppressed: true. No blocking behavior anywhere.
3. Runtime (operator-decided 2026-07-31): the GitHub CLI, as a dedicated task on the existing Docker orchestrator. Precedent in-tree: SwarmHeartbeatService already establishes the runCmd(gh) pattern. Live constraint (reviewer-verified): the current orchestrator image ships no gh binary and no GitHub token — so this sub's scope includes packaging gh into the image and least-authority read-only credential wiring. No bespoke data-authority framework, no new standalone daemon.
4. Declarative leaves (ADR-0019 shape): threshold (initial 3), window (initial 6h, with a calibration AC measuring 8h — operator: "the 6h window makes sense, maybe better 8h"), enabled — validated against the 14-day simulation data so the false-positive count on that corpus is ~0 (the epic-filing episode MUST not fire).

Contract Ledger

Decision Record impact

aligned-with ADR 0019 (declarative leaves; no env re-derivation, no hidden defaults, no runtime mutation).

Acceptance Criteria

• Classifier is a pure, runtime-agnostic function with a spec proving BOTH corpus anchors: the #16167 derail burst (unlinked, undeclared) fires; this epic's five-leaf filing (linked, gated) does not — with the graduation exception present as a NAMED rule, this epic's filing as its fixture.
• Defaults validated against the 14-day simulation data: legitimate-work false positives ≈ 0 on that corpus, recorded in the PR; initial 3/6h with the 8h window measured against the same corpus and the outcome recorded.
• Runtime: a dedicated task on the existing Docker orchestrator using the GitHub CLI (operator decision 2026-07-31), following the SwarmHeartbeatService runCmd(gh) precedent; the PR records the schedule and cadence.
• Orchestrator image packages gh and wires a least-authority read-only GitHub credential (reviewer-verified gap: current image has neither); no token in argv, rendered Compose, logs, or receipts.
• Leaves declared per ADR 0019; §3 self-audit recorded.
• Fixture: threshold-crossing plan-delta fires exactly ONE suppressed receipt per author+window; continuing episodes extend, never respam.
• Zero blocking paths; disabled flag restores the runtime byte-for-byte.
• Any new .mjs passes structural-pre-flight.

Out of Scope

• Blocking or rate-limiting creation (explicit non-goal).
• Raw-rate alerting of any kind (falsified by the Stage-2 simulation).
• Retroactive analysis of historical tickets beyond the calibration corpus.

Avoided Traps

• Raw rate as signal. 68 false episodes in 14 days, including sanctioned work — measured, not hypothesized. Plan-delta or nothing.
• Over-engineering the runtime question. The Stage-2 walk audit was right that no existing walk held both authorities by default — the operator's answer is simpler than a framework: the GitHub CLI provides fresh data from anywhere; pick a scheduled surface with A2A access and record it.
• A new standalone daemon. The adopted lane must be an existing scheduled surface gaining one receipt.
• Alarm framing. Neutral telemetry to disposition owners; counts and links only.

Related

• Parent: #16212. Blocked by #16214 (the declaration sharpens classification; linkage-absence alone is the interim signal). Sequencing: execution gated behind #16167 stabilization (see parent).
• Epic-review: IC_kwDODSospM8AAAABMlMHzg (the Stage-2 falsifiers this revision answers).
• ADR 0019 — config authority. #16167 — the measured incident.

Live latest-open sweep + A2A claim sweep recorded on parent #16212 at filing time (04:14Z, none competing); revision 04:35Z per epic-review.

Origin Session ID: dd39c5c1-8773-4c9d-a3d4-664f9fb0f952

Retrieval Hint: plan-delta receipt relationship-aware off-plan ticket rate governed lane unlinked undeclared 68 episodes simulation falsified raw rate runtime authority proof