Phase 0: correct audit-remediation tail bookkeeping

[ohjonathan]

Summary

Correct the Phase 0 custody record before the remaining audit-remediation sweep:

• return the O4 ledger from complete to active;
• record 10/12 issues shipped, 8 of 33 [P1] v5.0.1 count reconciliation + config/provenance tail #148/[P1-containing] v5.0.1 patch-safe sweep + v6.0.0 path compatibility removal #149 findings addressed by v5.0.0, and 25 remaining;
• split the remaining work into 24 patch-safe v5.0.1 findings and one v6.0.0 public-path removal;
• track the five inherited [P2] Characterization test net before any refactor (audit) #150/[P1] Rewire pre-commit/CI off the frozen v2.8.0 fork, then slim the repo (audit) #156 tails outside the 33-finding arithmetic;
• record Machine-readable audit registry and external parity gate #165 as the open standalone owner of R2-control-plane-parity-1;
• add the Phase 0 llm-dev manifest, spec, tracker, session log, and regenerated Ontos artifacts.

The live GitHub bookkeeping has also been reconciled:

• [P1] v5.0.1 count reconciliation + config/provenance tail #148: 6 checked / 6 remaining;
• [P1-containing] v5.0.1 patch-safe sweep + v6.0.0 path compatibility removal #149: 2 checked / 19 remaining;
• 🗺️ Audit remediation tracker (from PR #145) #158: meta-cycle restored to in progress and control-plane custody mapped to Machine-readable audit registry and external parity gate #165;
• Machine-readable audit registry and external parity gate #165: open with audit and P2-hygiene, no milestone.

No product code, tests, workflows, package metadata, tags, releases, or merges are changed.

Baseline and sequencing

• Baseline: origin/main@3dd093e51e1125147e3533352abda75d7ae1d489
• Head: 629c984
• This PR must merge and be independently reverified before PR A starts.
• Merge, tag, publication, and release actions remain maintainer-owned.

Validation

Passing:

• scripts/llm-dev doctor --manifest ...
• llm-dev manifest conformance: 4/4
• llm-dev scope and cardinality preflights
• llm-dev staging verification
• Ontos map/agent regeneration: 209 documents
• Ontos doctor: 10 passed, 0 failed; only the existing non-Ontos-hook and stale PATH-CLI warnings
• Ontos link-check: clean
• git diff --check
• one complete test-gate run: 1,556 passed

Draft blockers

This PR is intentionally not ready to merge:

1. Three later full-suite runs reproduced the existing order-dependent SQLite WAL snapshot failure in tests/mcp/test_read_only_registration.py::test_read_only_portfolio_queries_existing_snapshot_without_mutation (1 failed, 1,555 passed); that test passes in isolation. No Phase 0 file is on its execution path, but the program's reliable-full-green guardrail is not yet satisfied.
2. The user-facing llm-dev lifecycle is honestly review_pending: B.1/B.2/B.3, D.1–D.6, and E remain pending. No external-family receipt or final approval is claimed.

Related issues

• [P1] v5.0.1 count reconciliation + config/provenance tail #148
• [P1-containing] v5.0.1 patch-safe sweep + v6.0.0 path compatibility removal #149
• 🗺️ Audit remediation tracker (from PR #145) #158
• Machine-readable audit registry and external parity gate #165

[ohjonathan]

Phase 0 review — Claude — approved to merge

Verified the bookkeeping against my independent reconciliation.

• Ledger correction accurate + honest. It now records [P1] v5.0.1 count reconciliation + config/provenance tail #148/[P1-containing] v5.0.1 patch-safe sweep + v6.0.0 path compatibility removal #149 as open / sweep in progress with per-issue counts (6/12 addressed in [P1] v5.0.1 count reconciliation + config/provenance tail #148, 2/21 in [P1-containing] v5.0.1 patch-safe sweep + v6.0.0 path compatibility removal #149) that match my reconciliation exactly (8 addressed / 25 remaining). It independently reached the call I flagged in the dispatch — the breaking paths.py public-API removal (D5b-dead-code-3) routes to v6.0.0, everything else to v5.0.1 — and is honest about the residual #150/#156 tails.
• Check-offs correct (6 in [P1] v5.0.1 count reconciliation + config/provenance tail #148, 2 in [P1-containing] v5.0.1 patch-safe sweep + v6.0.0 path compatibility removal #149, matching the addressed findings).
• Machine-readable audit registry and external parity gate #165 is legitimate, not invented scope — standalone custody of R2-control-plane-parity-1 (the machine-readable registry + parity validator that never landed on main), explicitly non-blocking for [P1] v5.0.1 count reconciliation + config/provenance tail #148/[P1-containing] v5.0.1 patch-safe sweep + v6.0.0 path compatibility removal #149.
• Scope clean — docs/ledger/manifest only; zero ontos/ and tests/ changes.

SQLite WAL flake — disposition

Provably pre-existing, not a regression from this PR. #166 changed no product or test code, so the code is byte-identical to main — the flake is main's, with certainty (not a "probably pre-existing" guess). It's a test-isolation issue in the portfolio WAL registry (tests/mcp/test_portfolio.py / ontos/mcp/portfolio.py; passes in isolation, fails in some orderings), already tracked as one of the #150 test-hygiene tails under #148.

Not a merge blocker. Fix it as a test-hygiene item during the sweep (naturally alongside PR C). Approved to merge as-is.

One mild note: the full lifecycle machinery (spec + tracker + manifest + session log) is heavier than a ledger/issue bookkeeping change needs — harmless, just noting it.