ADR-0026.

Date: 2026-07-16 Status: accepted Deciders: Thibault Souris (maintainer) Method: decision-loop — the audit's whitespace finding ("the scaffolds stop at tested code; run and hand-over after merge is where you are alone") confronted with runward's own precedent (ADR-0017: a deliverable no gate enforces drifts to orphan), challenge on ceremony cost, durable position

Context

Hand-over is runward's exclusive ground. The audit verified it as genuinely empty competitive space: every spec-driven scaffold stops at tested code; none carries the system across the succession — the runbook, the finalized charter, the moment the receiving team runs it without the builder. runward's method carries it (workflows/handover.md), and the public promise is precise: the hand-over is proven by a real task redone without you.

But the promise is enforced nowhere. The handover phase has zero gated deliverable and zero mapped rules: check --strict verifies architect, topology, floor and govern manifests, and stops. The redone-task proof, the runbook's executability, the finalized charter, the named successor — all Definition-of-Done prose, none of it verified. This is the exact defect ADR-0017 closed for the topology vision, one phase later: a deliverable no gate enforces drifts back to orphan, and a differentiator no gate backs is a claim, not a feature. The strongest ground runward owns is the least verified part of its chain.

Decision

Gate the hand-over, symmetric with ADR-0017's topology move. Five pieces.

1. A gated deliverable: runward/handover.md — the hand-over note, the kit made legible in one place: the kit index (each leave-behind artifact, where it lives, its state), the redone-task proof record (which real task, when, by whom, with an evidence pointer the gate can verify), the named succession (owner, escalation path, review cadence), and the provider-swap drill record. Scaffolded by init (joins MISSION_LAYOUT), listed as a phase-6 artifact beside the runbook.
2. Four craft rules, phases: [handover], each verifying a traced decision, never a live state:
   • handover-redone-task-proof (CRITICAL, ASI09) — a real task was redone end to end without the departing builder, and the record names the task, the date, the doer and the evidence.
   • handover-runbook-executable (HIGH, ASI08) — the runbook covers the recovery gestures (start, observe, debug, resume from checkpoint, swap the model provider, rerun the evaluation bench, process a suspended approval) with real commands, not prose intentions.
   • handover-agents-charter-final (HIGH, ASI10) — AGENTS.md is finalized as the leave-behind: verification commands (including runward check --strict), judgment boundaries, never/PR rules — the standing constraint on every agent that inherits the system.
   • handover-succession-named (HIGH) — the system has a named owner after the departure, an escalation path, and a review cadence; an unowned agentic system is an incident with a start date.
3. The gate config grows one pair: handover → handover.md in GATED_DELIVERABLES, EXPECTED_MAPPED.handover = 4 (the ADR-0002 non-vacuity floor). conformance() is phase-generic — no mechanics change. The compliance assembler inherits the new manifest automatically (it reads GATED_DELIVERABLES).
4. A hand-over phase skill (ADR-0018): the fifth relevance-loaded skill, emitted with the other four — the craft surfaces when an agent starts preparing a succession.
5. The reference mission and this repository's own mission each carry a filled handover.md that passes the gate — the feature ships demonstrated, per the self-gating standard (v0.15.0).

The invariants hold: the gate checks that the succession decisions are traced (a recorded proof, a named owner, real pointers — verifiable down to the typed-evidence layer of ADR-0019), never that the hand-over went well. Deterministic, zero-LLM, never a runtime.

Alternatives discarded

• Keep hand-over as Definition-of-Done prose. The status quo, and ADR-0017's rejected alternative verbatim: a deliverable no gate enforces drifts to orphan. Worse here — this is the differentiator the positioning leans on; prose-only makes the flagship claim the least backed one.
• Gate the runbook alone (no hand-over note). The runbook is one artifact of the kit; the redone-task proof and the succession have no home in it, and stretching it into one would bloat a recovery document with governance records. The note indexes; the runbook operates.
• Verify the redone task by running something. Crosses never-a-runtime (ADR-0005). The gate verifies the record of the proof — task, date, doer, evidence pointer — exactly as it verifies a placement or a threat-model decision.
• More than four rules (charter-per-agent, drill-per-provider…). Ceremony. Four rules cover the four failure modes the field names: nobody re-ran it, nobody can operate it, nothing constrains the next agent, nobody owns it. Growth on evidence, like every rule set change.

Consequences

• Positive. The exclusive ground becomes the verified ground: "the hand-over is proven by a real task redone without you" stops being copy and becomes a red-or-green fact. The evidence pack gains a Handover section for free; the whitespace the audit told us to own is now gated, not narrated.
• Negative, accepted. Every mission gains a fifth manifest to fill (manifest --sync scaffolds it; for a mission that never reaches hand-over, the note honestly says so and its rows stay ahead as the phase-6 gap the gate already reports). Rules 60 → 64, the floors table grows, and the smoke/tests surface follows.
• On other boundaries. MISSION_LAYOUT, PHASES (phase 6 gains the note), GATED_DELIVERABLES, EXPECTED_MAPPED, EXPECTED_RULES, the phase-skill set, the handover workflow's Outputs/DoD, both shipped missions, smoke and unit tests.

Reevaluation trigger (mandatory, dated)

Reopen if real missions systematically park all four handover rules as n/a before ever reaching phase 6 (signal that the manifest lands too early in the mission's life — consider gating it only once the floor phase closes), or if operators fake the redone-task record (a proof record that is theater means the check must move closer to the evidence, e.g. requiring a typed pointer to the redone task's artifact — still deterministic).

Trigger set on: 2026-07-16 · Watched via: the n/a ratio on handover rules across missions and the hand-over sections of field reports.

References

• ADR-0017 — the precedent: an orphaned vision made a gated phase; this repeats the move for phase 6.
• ADR-0019 — the evidence layer the proof record's pointers inherit.
• ADR-0010 — the charter-as-leave-behind this gates.
• templates/workflows/handover.md — the workflow whose Definition of Done becomes verifiable.