Replace lexical model-policy attestation with a deterministic skipped-surface contract

[BaseInfinity]

Problem

#174 exhausted its two bounded corrective rounds after canonical 11/11 proof. The final normal Sol High + Fable High receipt remained NOT CERTIFIED because arbitrary natural-language xhigh authority cannot be truthfully classified by an expanding regex/negation list.

The frozen non-certifying #174 candidate proved three failure modes:

• declarative authority such as Autonomous coding runs at xhigh can escape enumerated nouns/verbs and falsely allow schema completion;
• whole-document negation lookback can cross line boundaries and suppress unrelated positive authority;
• compliant prose such as Use high, not xhigh or Avoid xhigh can be falsely labeled authority and strand migration.

The same receipt found that the advertised --force-all remediation does not reliably replace/attest all untracked surfaces and complete in one run.

Deterministic contract

Do not infer arbitrary prose semantics. For skipped policy guidance, blank only exact structured reviewer identifiers, then treat every remaining xhigh token as an unattested xhigh reference. Content with no remaining xhigh token is safe for this bounded migration claim. A user can either remove the token from preserved prose or explicitly choose --force-all replacement.

Acceptance criteria

• Replace autonomous-authority/negation heuristics with the bounded token contract above; diagnostics must say unattested xhigh reference, not claim semantic authority.
• Never record the current model-policy schema while any skipped managed or untracked policy surface contains a remaining xhigh token.
• Inspect AGENTS.md, SDLC-LOOP.md, START-SDLC.md, and .agents/skills/sdlc/SKILL.md symmetrically whenever schema migration is pending, independent of profile-migration state.
• Preserve skipped customized/untracked bytes by default and name every unresolved path repeatably on subsequent updates.
• Keep exact reviewer identifiers such as opus-4.8-xhigh from blocking migration without splicing text or crossing line boundaries.
• Treat declarative wording, cross-line adjacency, not xhigh, and avoid xhigh consistently as unattested token cases; resolution is removal of the token or explicit replacement, not semantic rephrasing.
• Make --force-all replace every conflicting managed or untracked policy surface, including the repo SDLC skill, and complete schema migration in the same successful run.
• Restore the pre-update schema and preserved ownership on any failed regeneration.
• Preserve explicit structured mixed-profile selection; benign customized prose with no xhigh token must migrate and converge.
• Add TDD RED→GREEN coverage for declarative authority, cross-line text, prohibition wording, reviewer identifiers, split profile/schema state, untracked repo skill, force-all one-run convergence, clean customization, and injected failure.
• Synchronize ROADMAP and the authoritative milestone only on a newly certified candidate.
• Use a fresh current-origin/main worktree and fresh proof/review. Do not reuse Block model-policy migration completion when preserved guidance still authorizes autonomous xhigh #174 candidate trees, proof stamps, receipts, branches, or correction rounds.
• Require normal Sol High + Fable High review; no exception. The fix(review): stop tool-free cross-model reviews when Claude invokes advisor #158 exception remains consumed.

Provenance

Final #174 receipt: tree 3e00a13fbdeca6530be88ac0bff245d1badaf9aa, patch 3e3b9e4c5d58bc639d697b510a24ee64136980d857758dc79a5cf4c46f3130f9, canonical proof 11/11, joint NOT CERTIFIED (reviewer_verdict, non-transient, no retry). See the final checkpoint on #174.

Authorization boundary

Issue creation records the stop/decomposition. Implementation starts only after the maintainer explicitly authorizes a fresh replan; it is not a third #174 correction.