ACMM conformance: alias lattice, quality docs, CI gate

[bketelsen]

Summary

Satisfies every Hive ACMM evaluation criterion (#22–#40) plus the scaffold-CI quality issue (#41) in one cohesive change. The mechanism is the one this repo already trusts: canonical content in the existing shape, conformance paths as committed relative symlinks — recorded in new ADR-0029, extending ADR-0002/0018/0019/0021/0025. Genuinely new artifacts exist only where no canonical content did, and each does real work (CI gate, review rubric, deny-list settings) rather than being checkbox theater.

• Aliases: CONTRIBUTING.md & .cursorrules → AGENTS.md; docs/review-rubric.md → specs/pr-review-rubric.md; docs/metrics.md → specs/pr-acceptance-metric.md; docs/quality.md → design/quality-loop.md; tests/e2e/scaffold-tests → the docs-site scaffold suite. Directory criteria are all real git trees.
• New canonical docs: PR review rubric (spec, from ADR-0019), PR acceptance metric (spec), quality loop (design) — indexed and cross-linked per house rules.
• CI: .github/workflows/ci.yml (SHA-pinned, permissions: {}, ADR-0021) runs scripts/check-docs.mjs (docs-index coverage, link integrity, symlink resolution vs .coverage-thresholds.json, never_relax) and the scaffold e2e suite via npm ci against a newly committed package-lock.json — the reproducible validation [quality] Validate the docs-site scaffold test suite in core CI #41 asked for. The docs-site skill is not in skills-sync.json, so the lockfile does not fan out; repos applying the skill later inherit it.
• Agent surface: .claude/settings.json mechanically enforces ADR-0019's deny list (no PR merges, self-approval, releases, pushes to main); .claude/session-summary.md; .memory/ inbox seeded with the ADR-0018 five-field schema; .github/prompts/ runbooks; PR/issue templates; .editorconfig; .prettierrc.json.

Contingency (recorded in ADR-0029): if the ACMM evaluator declines to follow a symlink for one of the five file criteria, that alias becomes a real stub file — a one-commit fix.

Closes #22
Closes #23
Closes #24
Closes #25
Closes #26
Closes #27
Closes #28
Closes #29
Closes #30
Closes #31
Closes #32
Closes #33
Closes #34
Closes #35
Closes #36
Closes #37
Closes #38
Closes #39
Closes #40
Closes #41

Risk tier

Risk tier: 1 — docs, templates, symlinks, and CI for a docs repo; no application code. New workflow is least-privilege and SHA-pinned (ADR-0021).

Docs housekeeping

• New docs started from their category's TEMPLATE.md
• Every new doc indexed in docs/README.md
• Cross-links added in both directions (ADR ↔ design ↔ spec)
• New significant decision recorded as an ADR first (ADR-0029), in this PR
• Conformance aliases (ADR-0029) — this PR creates the alias registry

Verification

• node scripts/check-docs.mjs green (33 docs, 202 links, 10 symlinks, all thresholds 1.0)
• npm ci && npm test in .agents/skills/frostyard-docs-site/scaffold/ green (6/6 tests, build + pagefind + node --test)
• Every action SHA-pinned (40 chars + # vX.Y.Z), permissions: {}, persist-credentials: false (ADR-0021)
• Per-issue path audit: all 19 criteria satisfied (17 paths; .claude/settings.json covers [ACMM L3] Add Layered safety model #37/[ACMM L3] Add Mechanical enforcement #38/[ACMM L3] Add Structural gates #40)

🤖 Generated with Claude Code