docs: R24 retest verdict + close the last raw-hex slop gap

[ElxMaj]

R24: the retest gate

Ran the roadmap-closing retest as an 8-dimension multi-agent adversarial pass over shipped main (#104): one finder per dimension, an independent verifier per critical/failing claim (the verifier's corrected verdict wins), synthesized into docs/audits/2027-retest.md. The two load-bearing claims were re-confirmed by hand.

Verdict

Architecturally world-class, and every sacred rule holds on main — nothing writes decided outside the human promoteToDecided path, evidence is append-only + scrubbed, search stays flat with the graph walk only in prepare_task, one Postgres, and the benchmark numbers (2.9x / 1.5x / recall 1.0) reproduce honestly.

But NOT world-class as shipped, for a narrow, specific reason: four high-severity write-side integrity fixes are finished and green but gated behind review, so main still carries the gaps:

Ref	PR	Gap still on main
R8	#93	Span bounds unenforced; MCP propose_node can create a fact whose verbatim slice is empty — a sacred-rule-2 hole reachable from an agent path.
R11	#96	Mutating POSTs have no origin check — a web page can cross-site POST to the loopback console.
R6	#90	marrow demo pollutes whatever DATABASE_URL points at, with no guard.
R9	#94	drift --ci is launderable: a re-run over the same still-contradicting diff exits 0.

No regressions. And a useful correction: R5 keyless semantic search already ships on main (LocalEmbeddingProvider wired in createEmbeddingProvider), so #89 refines rather than introduces it — confirm what it adds before treating keyless search as outstanding.

Full dimension-by-dimension detail, plus the four green quality PRs (#105–#108) and the low/trivial gaps, are in the audit doc.

The one non-gated fix, applied here

R24 requires every finding fixed or waived. The gated ones are waived to you (merge the PRs). The single genuine non-gated finding — two raw-hex colours in the console — is fixed in this PR: .toast and .chip.warn.active now use theme-aware --decided-ink / --contested-ink tokens. This closes the last "no hex outside :root" slop-audit exception and fixes two real AA contrast bugs it was hiding:

• Light theme: the promote toast was dark ink #10231a on the dark-forest decided fill (dark-on-dark).
• Dark theme: the active warn chip was white on the light-salmon contested fill (~2.6:1, failing AA).

Both now read correctly per theme (bone-on-dark / dark-on-light), computed-contrast ~5.7:1 and ~6:1, verified in a real browser in both themes.

pnpm lint, root pnpm test, web tests (116), and the no-em-dash guard are green. Patch changeset for the web contrast fix.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6650aef2dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Regenerate the static demo assets

When the hosted/read-only demo is deployed from packages/web/demo-static, this source-only tokenization is not used: packages/web/demo-static/index.html still points at assets/index-2qvlasXK.css, and that compiled CSS still contains .toast{...color:#10231a} and .chip.warn.active{color:#fff...} with no --decided-ink or --contested-ink tokens. Since packages/web/scripts/export-demo.ts documents that demo-static/ deploys as-is, the user-facing static demo keeps the contrast failures this change claims to fix until the demo assets are regenerated and committed.

Useful? React with 👍 / 👎.