Zero-ceremony defect capture and the incident observation ledger

[D#17136 named follow-up] — the zero-ceremony defect channel, bound in the graduated recovery umbrella's head ("Defect-channel landing sites (fold-12)"): this ticket is that landing.

Context

D#17136 ("Breaking the doom spiral") graduated 2026-08-15 at family-keyed quorum. Its sharpest specimen: a core skill-invoked surface (query_summaries) was broken in production, a peer knew — "I knew it, so I navigated around using the skill" — and filed nothing, because the ceremony cost of filing exceeds the private cost of the workaround. The operator had to force the ticket into existence. The discussion's verdict: the dup-sweep asymmetry is wrong for defects — a duplicate defect report costs one dedup-close; an unreported production defect costs what query_summaries cost.

This ticket implements the graduated design: defect capture is exempt from creation ceremony, permanently — but capture is not automatic backlog admission.

The Problem

Every capture path today runs the full creation gate set — the two-substrate duplicate sweep (ticket-create-workflow.md §1a), the six-stage challenge chain (§2), the Fat Ticket body (§5). That is the right price for backlog admission and the wrong price for "I just watched production break." Rational agents route around broken substrate and the knowledge dies with the session. The inversion is now load-bearing: even KNOWN production breakage does not become shared knowledge.

The Architectural Reality

• The ceremony lives in .agents/skills/ticket-create/references/ticket-create-workflow.md (§1a sweeps + §2 chain) — the exemption is a payload amendment, never the SKILL.md router (create-skill consulted).
• The capture channel needs no new surface: A2A add_message is already the cheapest durable channel every seat has. A defect-note: subject convention makes notes discoverable with zero new MCP tools (operator ruling 2026-07-26: no new tools).
• The observation ledger needs no new store: the mailbox is already the canonical append-only A2A store, so the ledger is a pure fold projection over it (the discussion's own convergent primitive). (Implementation correction: an earlier draft of this section prescribed a JSONL sibling store — healEventLedgerStore.mjs-shaped; the projection shape subsumes it.)
• ADR 0031's memory-capture invariant (L94: "agents decide what they save; memory capture is never automated") is honored by construction: a defect-note is a deliberate one-line agent action, and the ledger is an explicitly non-memory operational store. No amendment needed — named here so the honor-or-amend fork is decided on the record.
• AGENTS.md has 196 B headroom (24,380 B measured 2026-08-15 against the 24 KiB budget): the identity anti-pattern line does NOT go there — placement runs turn-memory-pre-flight (skill payload / Atlas class).
• #17140 (mailbox semantic index) is adjacent, not overlapping: it makes old messages findable; this ticket makes new defect sightings storable.

The Fix

1. ticket-create-workflow.md amendment — the defect-capture exemption, one compact section: capture format (defect-note: <surface> broke <observed symptom> — one durable line, no sweeps, no six-stage chain); capture ≠ admission; the four promotion triggers (production-down signal, independent second occurrence, operator escalation, triage decision); promotion runs full ceremony incl. V-B-A, capture never waits for it.
2. Identity-substrate anti-pattern line — a workaround without a filed defect-note becomes the explicitly named anti-pattern; placement per turn-memory-pre-flight (never AGENTS.md at current headroom).
3. The defect-note: A2A convention — documented at the exemption site; notes ride add_message (the mailbox is the canonical capture store, already durable, already every seat's).
4. The fingerprint — a shared helper deriving a deterministic observation identity from the note alone (normalized surface + symptom; same note → same fingerprint), so aggregation never depends on who filed or when. Plain module, config-legible class (sibling: ai/embeddingProviders.mjs, ai/planeConfig.mjs); final placement per structural-pre-flight at implementation.
5. The observation ledger is a deterministic PROJECTION over the mailbox — the canonical A2A store is the one canonical writer and store by construction; a pure fold helper (ai/services/memory-core/helpers/defectObservationFold.mjs) computes standing records from defect-note: broadcasts: idempotent RED↔RECOVERED by recompute (a duplicate transition changes nothing; newest transition wins), aging as a fold parameter (nothing mutates to mark a record quiet), operator override = an operator note. No new store, no sync job, no second authority — the discussion's own convergent primitive (append-only trail + bounded projection). node ai/scripts/diagnostics/defectObservations.mjs prints the ledger (plane default, --local fallback). (Corrected during implementation: the JSONL-store shape was replaced by the mailbox projection — same contract, one less store.)
6. Promotion — a triage read of the ledger promotes an observation via the FULL create_issue ceremony. Promotion is where V-B-A runs; the note itself never blocks on it.

Contract Ledger

Decision Record impact

aligned-with ADR 0031 — no amendment: capture is a deliberate agent action and the ledger is explicitly non-memory, so L94's memory-capture invariant holds untouched. Nothing else is cited, predated, or superseded.

Decision Record

Not needed (D#17136 carries no Decision Record line; the target-map ADR rides its OQ2/E′ separately).

Discussion Criteria Mapping (D#17136 → this ticket)

• "Defect CAPTURE is exempt from creation ceremony, permanently" → AC-1.
• "capture is NOT automatic backlog admission… PROMOTION on production-down / second occurrence / operator escalation / triage; promotion runs V-B-A" → AC-1, AC-6.
• "one canonical writer and store, deterministic identity (fingerprint computable from the note alone), idempotent RED↔RECOVERED transitions, operator override, and an aging rule — never a second Memory authority" → AC-3, AC-4, AC-5.
• "Workarounds without a filed note become the anti-pattern the identity substrate names explicitly" → AC-2.
• "Outcome probes update one durable incident identity on RED/RECOVERED transitions, never one ticket per sample" → AC-5 (transition idempotency); the probes themselves ride the stability program (Out of Scope here).

Acceptance Criteria

• ticket-create-workflow.md carries the defect-note exemption (capture zero-ceremony; the four promotion triggers; promotion = full ceremony incl. V-B-A) — payload amendment, not the router.
• The identity substrate names workaround-without-a-filed-note as the explicit anti-pattern; AGENTS.md byte-untouched.
• The defect-note: convention is documented at the exemption site, and the PR evidence includes one real capture filed through it (dogfood).
• The fingerprint helper is deterministic from the note alone; specs cover identity stability + normalization (casing/whitespace/noise ids).
• The observation ledger: the mailbox is the canonical store; the fold helper produces one standing record per fingerprint (count, reporters, sighting bounds); recovery-marker idempotency; aging → quiet as a fold parameter; all spec-armed; the diagnostics script prints the projection.
• No Memory Core write anywhere in the capture/ledger flow; no new MCP tools.
• Promotion path documented: ledger observation → full-ceremony issue, exactly on the four triggers.
• D#17136 notified on landing (its defect-channel landing site discharged).

Out of Scope

• The outcome-probe pair itself (KB-ingestion completion + CPU watchdog) — rides the stability program that the probes gate.
• Mailbox semantic indexing (#17140's scope).
• Automated promotion, automated capture, any Memory Core integration.
• The query_summaries repair class that motivated the specimen (already fixed 08-14).

Avoided Traps

• Capture-as-issue: auto-materializing every note into an issue converts loop 3 into loop 6 while discovery is degraded — the aggregation/promotion split exists precisely to prevent it (D#17136, Emmy's fold).
• A second Memory authority: the ledger is an operational store; if that ever changes, ADR 0031's invariant gets an explicit amendment FIRST.
• New MCP tools: the capture channel rides add_message (operator ruling 2026-07-26).
• AGENTS.md insertion: 196 B headroom; the anti-pattern line lands in payload/Atlas class substrate per turn-memory-pre-flight.

Related

D#17136 (source, graduated) · #17141 (review cut) · #16566 + #16998/#17001 (discovery organs) · #17147 (NOW block) · #17140 (mailbox semantic index — adjacent) · ADR 0031 (honored invariant).

Live latest-open sweep: checked latest 20 open issues at 2026-08-15T10:22Z (newest #17163); "defect-note zero-ceremony" + "defect channel carve-out" searches: 0 hits; no equivalent found. A2A in-flight claim sweep: last-30 messages scanned at 2026-08-15T10:22Z; no competing [lane-claim]/[lane-intent] on this scope (Clio's graduation broadcast explicitly names this ticket claimable).

Origin Session ID: ses_ffbd82b35ffes81WifOgXDQ6jj

Retrieval Hint: "D#17136 defect channel zero-ceremony capture not admission" · "query_summaries workaround specimen reporting-cost inversion"