brenpike · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -12,6 +12,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+## [4.0.0] - 2026-09-23
+
+### Added
+
+- ADR-0030 (`docs/adr/0030-config-gated-post-merge-decision-report.md`): records the decision to config-gate the post-merge decision report.
+- `tests/policy/safety-decision-report-toggle.json`: policy fixture pinning the opt-in gate and its default-off state.
+
+### Changed
+
+- **BREAKING:** The post-merge decision report is now opt-in and OFF by default. This gates the overlord's Resume-On-Start deferred-report scan and its `hivemind:decision-report` invocation behind a new standing key, `HIVEMIND_ENABLE_DECISION_REPORT`. To restore the report, set `HIVEMIND_ENABLE_DECISION_REPORT` (any non-empty value, checked by presence) in the `env` block of `.claude/settings.json` or `.claude/settings.local.json`.
+- While the key is off, the scan makes no GitHub call and instead touches the zero-byte `.decision-report-done` marker for each awaiting run, so the first session after upgrading marks all existing awaiting runs done. Enabling the key afterward only reports runs that finish after enabling — a run whose PR is still open while the key is off will not report, even after the key is later turned on.
+- The decision journal (`event.outputs.decisions[]`) is still written regardless of this key; Tier-B autonomy is unchanged.
+
 ## [3.1.0] - 2026-09-23
 
 ### Changed

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -116,6 +116,8 @@ The local Codex review model is operator-overridable via `HIVEMIND_LOCAL_REVIEW_
 
 The default post-PR watch (see Branching / PR workflow above) can be switched off standing-wide via `HIVEMIND_SKIP_PR_WATCH`, set in the `env` block of `.claude/settings.json` (committed) or `.claude/settings.local.json` (gitignored, per-account). Unset/empty → the overlord watches normally per its default-watch rule (zero behavior change). Set (checked by presence) → the overlord never watches, short-circuiting the per-run `request.raw` read entirely. Because the committed settings file is in-repo, the key inherits into brood worktrees. Reference: ADR-0029.
 
+The post-merge decision report is opt-in via `HIVEMIND_ENABLE_DECISION_REPORT`, set in the `env` block of `.claude/settings.json` (committed) or `.claude/settings.local.json` (gitignored, per-account). Unset/empty → the report is off: the deferred-report scan renders nothing and makes no GitHub call, but still touches the zero-byte `.decision-report-done` marker for awaiting runs, so enabling it later only reports runs that finish after it is enabled. Set (checked by presence) → the overlord surfaces the post-merge decision report as before. The decision journal is written either way. Because the committed settings file is in-repo, the key inherits into brood worktrees. Reference: ADR-0030.
+
 ## Brood execution
 
 The plugin supports parallel multi-overlord execution via spawn-brood and brood-status skills. Each brood session runs in its own git worktree as an independent Claude Code instance.

diff --git a/CONTEXT.md b/CONTEXT.md
@@ -211,7 +211,7 @@ The per-decision record (situation, options, trade-offs, recommendation strength
 _Avoid_: audit log, decision log
 
 **Decision Report**:
-The post-merge narrative the overlord ALWAYS surfaces after a PR merges, recounting each autonomous decision in the consumer project's ubiquitous language; produced by `hivemind:decision-report`.
+The OPT-IN post-merge narrative the overlord surfaces after a PR merges — only when the decision report is enabled via `HIVEMIND_ENABLE_DECISION_REPORT` — recounting each autonomous decision in the consumer project's ubiquitous language; produced by `hivemind:decision-report`.
 _Avoid_: summary, changelog
 
 **Disposition**:
@@ -388,7 +388,7 @@ _Avoid_: degraded mode, manual mode, safe mode
 - An **Unsafe Git State** blocks all modifying agent operations until resolved
 
 - An **Overlord** records a **Decision Journal** entry for every Tier-B decision; the **Promotion Gate** decides whether the decision is auto-taken or surfaced to the **Overmind**
-- A **Decision Report** is produced once per merged PR that contains ≥1 auto **Disposition** (`did-now`, `deferred`, or `recorded`), rendered in the consumer's ubiquitous language
+- A **Decision Report** is produced once per merged PR that contains ≥1 auto **Disposition** (`did-now`, `deferred`, or `recorded`) when the decision report is enabled via `HIVEMIND_ENABLE_DECISION_REPORT`, rendered in the consumer's ubiquitous language
 - **Remediation** Tier-B choices (planner-escalation, root-cluster routing) are auto-taken + journaled unless the **Promotion Gate** trips
 
 - A **Brood** contains one or more **Strains**, each running in a separate git worktree

diff --git a/README.md b/README.md
@@ -266,7 +266,7 @@ All skills are invoked using the namespaced form:
 | `hivemind:record-state-result` | Record the outcome of the current workflow state into the run ledger and advance `state.current` to the legal next state, validated against the workflow definition |
 | `hivemind:next-wave` | Read-only engine for the overlord's intra-run parallel implement loop — reads the run ledger and computes the ready WAVE (the maximal, file-disjoint set of dependency-satisfied plan steps) to dispatch as concurrent agent delegations this iteration |
 | `hivemind:mark-intent-fallback` | Sanctioned engine write-path for the version-skew intent-fallback resume door and start-fresh stale-run closeout — sets `run.mode:intent_fallback`, appends a fallback event, and optionally closes a stale run via `run.status` |
-| `hivemind:decision-report` | After a run's PR merges or closes, render a chronological narrative of the auto-decisions the run made on the user's behalf — in the consumer project's domain language — and return it as chat text (render-to-chat; writes nothing to disk — the overlord surfaces the narrative and touches a zero-byte done-marker) |
+| `hivemind:decision-report` | The AUTOMATIC post-merge invocation is opt-in and off by default — enable it by setting `HIVEMIND_ENABLE_DECISION_REPORT` in the `env` block of `.claude/settings.json` or `.claude/settings.local.json`; the key gates only that automatic path, and invoking the skill explicitly still works regardless of the key. When enabled, after a run's PR merges or closes, render a chronological narrative of the auto-decisions the run made on the user's behalf — in the consumer project's domain language — and return it as chat text (render-to-chat; writes nothing to disk — the overlord surfaces the narrative and touches a zero-byte done-marker) |
 | `hivemind:zoom-out` | Zoom out for broader context — maps relevant modules and callers using the project's domain glossary vocabulary |
 | `hivemind:improving-architecture` | Read-only architecture analysis — emits a ranked refactoring blueprint of deepening opportunities (shallow → deep modules) for testability and AI-navigability |
 | `hivemind:refactor-to-depth` | Execution skill that performs a behavior-preserving deepening refactor via a refactor-under-green loop — the in-implementation counterpart to the read-only `improving-architecture` blueprint |