chore(openspec): reconcile and archive the second-brain change; guard the next cut (Q5)

0.2.0 shipped the whole second-brain layer while its change sat at 0/19
tasks, unarchived, with a proposal still selling the withdrawn Obsidian-CLI
adapter — an agent following docs/contributing.md found no capability spec
and instructions to build something three families cut. Ruling: archive-
and-reconcile, never archive fiction (ARBITRATION Q5).

Reconciled BEFORE archiving: proposal.md's What Changes and Risks now match
design D4/D12 (adapter withdrawn; the four keys it used are refused with a
naming error); tasks.md records what actually happened — shipped items
ticked, the adapter and daily_note struck, the per-lane verifier items
replaced by the P2 council that actually reviewed the merged diff, and the
owner prompt run ticked against its filled checklist (run 2026-09-04, Kiro
CLI 2.21.0). Then openspec archive second-brain, which wrote the
second-brain capability spec into openspec/specs/ and applied the two
deltas. ADR-0010 is now Accepted (it shipped), here and in the index.

The guard, so this cannot recur: check-release-consistency.py gains a
--release mode wired into release-check via the new
release-consistency-shipped recipe (NOT preflight — open changes are legal
during a cycle; only shipping one is not). It fails when any directory
under openspec/changes/ (archive/ excluded) has commits since the last tag
and is neither archived nor carrying an explicit 'deferred: <reason>' in
its .openspec.yaml, and it validates archive entries added since the last
tag with the openspec CLI (soft-skip when absent, same convention as
spec-check; scoped to NEW archives because a July archive predating the
guard has unticked tasks nobody has evidence to reconcile). The always-on
ADR check fails any ADR present in the last tag that still says Proposed.

Positive controls, per this campaign's trap #1: setting ADR-0010 back to
Proposed turns the always-on check red (proving it would have fired on
0.2.0); restore turns it green. The shipped-changes guard's control run
follows in the next verification step, since it needs a committed change.

Author: NetDevAutomate

docs/adr/0010-second-brains-are-projections.md

@@ -1,6 +1,7 @@
 # ADR-0010 — Second brains are projections; plan Markdown is the source of truth
 
-**Status:** Proposed, 2026-09-03. Motivated by change `openspec/changes/second-brain/`
+**Status:** Accepted, 2026-09-04 (proposed 2026-09-03; shipped as `v0.2.0`; clause 1
+amended 2026-09-04). Motivated by change `openspec/changes/archive/2026-09-04-second-brain/`
 (R-84, 0.2.0). Contract: `docs/architecture/second-brain.md`.
 
 ## Context

docs/adr/README.md

@@ -39,4 +39,4 @@ the code and ask "why on earth is it done this way?" — it gets an ADR, and
 | [0007](0007-dev-only-vendored-assets.md) | Dev-only vendored assets live in git, not in the wheel | Accepted | `vendor/dev/` |
 | [0008](0008-retire-ttyd-entirely.md) | Retire ttyd entirely; the Web UI owns interactive sessions | Accepted | ttyd retirement stages 2-7 |
 | [0009](0009-one-session-authority.md) | The session-state file is the claim; the in-process slot is a cache | Proposed | M2 session-authority remediation |
-| [0010](0010-second-brains-are-projections.md) | Second brains are projections; plan Markdown is the source of truth | Proposed | `second-brain` |
+| [0010](0010-second-brains-are-projections.md) | Second brains are projections; plan Markdown is the source of truth | Accepted | `second-brain` |

…spec/changes/second-brain/.openspec.yaml …e/2026-09-04-second-brain/.openspec.yamlopenspec/changes/second-brain/.openspec.yaml renamed to openspec/changes/archive/2026-09-04-second-brain/.openspec.yaml openspec/changes/second-brain/.openspec.yaml renamed to openspec/changes/archive/2026-09-04-second-brain/.openspec.yaml

@@ -29,8 +29,10 @@ Three constraints shape the answer:
 - **An Obsidian backend** writing projections into `<vault>/<folder>/`
   (`Study/Plans/<plan_id>.md`, `Study/Today.md`): atomic, idempotent, refusing
   any target outside the vault or lacking StudyLoop's `studyloop:` frontmatter
-  marker. The official Obsidian CLI is an opt-in adapter that degrades to the
-  file writer whenever the app is not answering.
+  marker. Plain files and nothing else: an official-Obsidian-CLI adapter was
+  built and withdrawn before release (design D4), and the four config keys it
+  used (`use_cli`, `vault_name`, `template`, `daily_note`) are refused with an
+  error naming them rather than silently ignored (design D12).
 - **A `studyloop brain` command group** — `status`, `publish`, `pull`, `enable`,
   `template` — lazily registered, each with `--json`.
 - **A once-only wind-down offer**: the protocol offers a publish exactly once,
@@ -88,9 +90,10 @@ Three constraints shape the answer:
 - **Writes into a learner's real files.** Mitigated by the ownership marker, the
   vault-boundary refusal, atomic replace, and a test suite that cannot resolve
   the real vault at all.
-- **The Obsidian CLI grammar is unversioned.** Mitigated by keeping it an
-  optional adapter behind a probe: a grammar change costs one file and degrades
-  to plain files meanwhile.
+- **The Obsidian CLI grammar is unversioned.** Resolved by withdrawal: the
+  opt-in adapter was built, reviewed and removed before release (design D4);
+  plain files carry the whole feature, and its four config keys are refused
+  with an error naming them.
 - **A learner edits a projection and loses the edit.** Accepted and documented:
   edits are replaced on the next publish with a warning, and personal notes
   belong in the sibling `.notes.md` file that StudyLoop only ever reads.

openspec/changes/second-brain/design.md …rchive/2026-09-04-second-brain/design.mdopenspec/changes/second-brain/design.md renamed to openspec/changes/archive/2026-09-04-second-brain/design.md openspec/changes/second-brain/design.md renamed to openspec/changes/archive/2026-09-04-second-brain/design.md

@@ -0,0 +1,110 @@
+# Implementation Tasks
+
+Three lanes, each on its own branch and worktree, each with a disjoint file set
+enforced by `packages/studyloop/tests/fixtures/lane_ownership.yaml`. Lane **m7**
+(core) and lane **m9** (process artefacts) ran in parallel; lane **m8** (xTiles
+stage 1) started once both had merged into the integration branch.
+
+Every item was red-first: a failing test on concrete data, then the code, then
+`env -u VIRTUAL_ENV just preflight` as the per-item gate, with docs and the
+changelog landing in the same commit as the behaviour they describe. Each item
+names the evidence subdirectory that holds its `00-dod.md`, `01-red.txt`,
+`02-green.txt`, `03-gate.txt` and `05-docs.diff`; the roots are
+`reviews/2026-09-03-second-brain/evidence/m7/`, `…/m9/` and `…/m8/`.
+
+Reconciled 2026-09-04 before archiving, per the review ruling
+(`reviews/2026-09-04-second-brain-review/ARBITRATION.md` Q5): ticks record what
+shipped in 0.2.0, strikes record what was cut, and the per-lane verifier items
+are replaced by the review that actually happened.
+
+## Lane m7 — core (`lane/m7-second-brain-core`)
+
+- [x] **Foundation commit.** Repoint the lane-ownership guard's merge base to an
+      ordered tuple of integration branches with an env override, map lanes
+      m7/m8/m9, add the `live_obsidian` marker and deselect it by default in
+      both `pyproject.toml` files, and add the vault-isolation fixture plus the
+      session-finish hook that fails the run if the real vault changed.
+      _Evidence: `00-foundation/`._
+- [x] **Protocol, config and the null path.** `SecondBrain` protocol with its
+      exact-method guard, `SecondBrainConfig`, `NullBackend`, the xTiles
+      stage-1 object, `brain status` and `brain publish --plan`, and the
+      optionality tests (`sys.modules`, directory-tree snapshot, CLI output).
+      _Evidence: `T1/`._
+- [x] **Heading constants.** Extract the plan-Markdown heading constants in
+      `planning/markdown.py` so the projection renderer reads them instead of
+      re-deriving the same strings a second time. _Evidence: `T3a/`._
+- [x] **Obsidian backend.** Plan and Today projections, the atomic
+      vault-boundary writer with the ownership marker and content hash,
+      backlinks behind a lazy import with a warn-once fallback, and due-card
+      extraction shared with the review service. ~~The opt-in CLI adapter with
+      its probe and fallback~~ — built, reviewed and **withdrawn before
+      release** (design D4); its four config keys (`use_cli`, `vault_name`,
+      `template`, `daily_note`) are refused with an error naming them (D12).
+      _Evidence: `T2/`._
+- [x] **Templates as package data.** Ship the Obsidian templates under
+      `studyloop/data/templates/obsidian/`, add the drift guard that keeps them
+      in step with the renderer, assert they carry no ownership marker, and
+      implement `brain template`. _Evidence: `T3/`._
+- [x] **Full command group and integration points.** The rest of the `brain`
+      group (`pull`, `enable`), the `config init` follow-up, the doctor check,
+      the once-only wind-down offer, and the regenerated agent manifest.
+      ~~`daily_note`~~ — cut with the adapter; never shipped. _Evidence: `T4/`._
+- [x] **Obsidian half of the guide.** `docs/second-brain.md`, the touched pages,
+      the mkdocs entry, and the docs-drift guards that make a stale sentence a
+      red test. _Evidence: `T6a/`._
+- [x] **Verification.** ~~Independent per-lane verifier in a clean worktree~~ —
+      replaced by the P2 review council on the merged diff (SIGNOFF-P2): a
+      four-family independent review of the shipped layer, arbitrated in
+      `reviews/2026-09-04-second-brain-review/ARBITRATION.md`, with the static
+      checks (no module-level provider import, no `Path.home()` in the package,
+      vault untouched by the suite) carried by always-on tests instead of a
+      one-off verifier.
+- [x] **Sign-off and merge** into the integration branch; shipped as `v0.2.0`.
+
+## Lane m9 — process artefacts (`lane/m9-second-brain-spec`)
+
+- [x] **ADR-0010.** Record that second brains are projections and that the plan
+      Markdown is the source of truth, with the rejected alternatives
+      (two-way sync, an xTiles client now, writing into `AgentMemory/`, an
+      environment-variable provider override, a web-UI button), and add the
+      index row in `docs/adr/README.md`. Clause 1 amended 2026-09-04 to the
+      rule the code obeys (`studyloop plan …` is the plan's only writer).
+      _Evidence: `T7/`._
+- [x] **Contract page.** `docs/architecture/second-brain.md`: the ten clauses
+      with the check that proves each one, plus the `.gitignore` exception that
+      makes the page trackable under the `docs/architecture/*` deny rule.
+      _Evidence: `T7/`._
+- [x] **OpenSpec change.** This directory: proposal, design with the D1–D13
+      decision table and the alternatives, the new `second-brain` capability
+      spec, and the deltas to `configuration-and-secrets` and `cli-surface`.
+      _Evidence: `T7/`._
+- [x] **Gates.** `just spec-check`, `just docs`, `just lint`, `just typecheck`,
+      the lane-ownership guard on this branch, and the hygiene grep proving no
+      absolute path, account name or commit hash reached a public file.
+      _Evidence: `T7/`._
+- [x] **Sign-off and merge** into the integration branch — via the P2 council
+      on the merged diff (SIGNOFF-P2), not a per-lane verifier.
+
+## Lane m8 — xTiles stage 1 (`lane/m8-xtiles-stage1`)
+
+- [x] **The shared wind-down skill.** One skill body, self-gated on
+      `provider: xtiles` plus a connected `xtiles` MCP server, installed into
+      every detected harness by `studyloop install agents`, with the harness
+      wrappers, the agent-instruction paragraphs and a regenerated manifest.
+      _Evidence: `T5/`._
+- [x] **xTiles half of the guide.** The provider section of
+      `docs/second-brain.md`, the three prompts, and the sources rows.
+      Reworded post-run per ARBITRATION Q2/N1–N4/N6 (planner tile not task;
+      no board-view promise; skip the Review task when nothing is due).
+      _Evidence: `T6b/`._
+- [x] **Owner prompt run.** Run 2026-09-04 by the owner in Kiro CLI 2.21.0
+      against a real xTiles Plus account — not Claude Code, and the docs say
+      so. P1/P1b and P3 wrote what they describe; P2 created the project but
+      not the board or the visible page structure it promised. Filled
+      checklist and redacted transcript:
+      `reviews/2026-09-03-second-brain/evidence/m8/xtiles-prompts/`.
+- [x] **Verification.** ~~Preflight, docs-drift guards and hygiene grep rerun
+      by an independent verifier~~ — replaced by the P2 council on the merged
+      diff (SIGNOFF-P2).
+- [x] **Sign-off**, integration gate, review council, and owner merge and tag
+      (`v0.2.0`, 2026-09-04).