fix(sdd): verify generated research projections against the capability authority

.claude/scheduled_tasks.lock

@@ -0,0 +1 @@
+{"sessionId":"19f52d59-7d48-41cc-91fb-c81af53d251a","pid":89965,"acquiredAt":1776005010875}

.engram/config.json

@@ -0,0 +1,3 @@
+{
+  "project_name": "gentle-ai"
+}

.engram/manifest.json

@@ -0,0 +1,45 @@
+{
+  "version": 1,
+  "chunks": [
+    {
+      "id": "1ad74530",
+      "created_by": "alanbuscaglia",
+      "created_at": "2026-03-27T11:12:50Z",
+      "sessions": 165,
+      "memories": 408,
+      "prompts": 33
+    },
+    {
+      "id": "fd2ecf8b",
+      "created_by": "alanbuscaglia",
+      "created_at": "2026-03-27T22:09:55Z",
+      "sessions": 0,
+      "memories": 8,
+      "prompts": 1
+    },
+    {
+      "id": "be4ddc87",
+      "created_by": "alanbuscaglia",
+      "created_at": "2026-03-28T22:27:54Z",
+      "sessions": 1,
+      "memories": 14,
+      "prompts": 1
+    },
+    {
+      "id": "aaf7a13f",
+      "created_by": "alanbuscaglia",
+      "created_at": "2026-04-01T22:19:17Z",
+      "sessions": 7,
+      "memories": 54,
+      "prompts": 151
+    },
+    {
+      "id": "d21f9e56",
+      "created_by": "alanbuscaglia",
+      "created_at": "2026-05-04T21:43:16Z",
+      "sessions": 74,
+      "memories": 278,
+      "prompts": 395
+    }
+  ]
+}

.gitattributes

@@ -0,0 +1,11 @@
+# Normalize line endings to LF for all text files
+* text=auto eol=lf
+
+# Explicit overrides for binary files
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.zip binary
+*.tar.gz binary

.github/PULL_REQUEST_TEMPLATE.md

@@ -39,19 +39,46 @@ What kind of change does this PR introduce?
 
 ---
 
+## 🤖 AI Assistance
+
+Select exactly one option. Do not check both options.
+
+- [ ] **None** — No material AI assistance was used.
+- [ ] **Material assistance used** — Complete all applicable declaration fields below.
+
+**Tool/model (if known):**
+
+**Material scope:**
+
+**Verification performed:**
+
+Trivial formatting, spelling, minor autocomplete, search/navigation, and trivial, non-substantive mechanical transformations do not need to be itemized. See [AI_POLICY.md](../AI_POLICY.md) for the canonical policy.
+
+---
+
 ## 🧪 Test Plan
 
 **Unit Tests**
 ```bash
 go test ./...
 ```
 
+**Go Format**
+```bash
+go run ./internal/gofmtcheck
+```
+
 **E2E Tests** (Docker required)
 ```bash
 cd e2e && ./docker-test.sh
 ```
 
+**Benchmark Validation**
+
+See the [benchmark guide](../bench/README.md). Benchmark validation applies to review-lifecycle, gates, recovery, delivery, benchmark implementation/corpus/classifier, and benchmark-claim changes. For unrelated changes, explain `N/A` in the Test Plan.
+
 - [ ] Unit tests pass (`go test ./...`)
+- [ ] Go format passes (`go run ./internal/gofmtcheck`)
 - [ ] E2E tests pass (`cd e2e && ./docker-test.sh`)
 - [ ] Manually tested locally
 
@@ -65,26 +92,39 @@ The following checks run automatically on this PR:
 
 | Check | Status | Description |
 |-------|--------|-------------|
+| Check PR Cognitive Load | ⏳ | PR should stay within 400 changed lines (`additions + deletions`) or use `size:exception` |
 | Check Issue Reference | ⏳ | PR body must contain `Closes/Fixes/Resolves #N` |
 | Check Issue Has `status:approved` | ⏳ | Linked issue must have been approved before work began |
 | Check PR Has `type:*` Label | ⏳ | Exactly one `type:*` label must be applied |
 | Unit Tests | ⏳ | `go test ./...` must pass |
+| Go Format | ⏳ | `go run ./internal/gofmtcheck` must pass |
 | E2E Tests | ⏳ | `cd e2e && ./docker-test.sh` must pass |
 
 ---
 
 ## ✅ Contributor Checklist
 
 - [ ] PR is linked to an issue with `status:approved`
+- [ ] PR stays within 400 changed lines, or I have requested/obtained maintainer-applied `size:exception` with rationale documented
 - [ ] I have added the appropriate `type:*` label to this PR
 - [ ] Unit tests pass (`go test ./...`)
+- [ ] Go format passes (`go run ./internal/gofmtcheck`)
 - [ ] E2E tests pass (`cd e2e && ./docker-test.sh`)
+- [ ] Benchmark validation completed, or this change is not applicable to the benchmark (explain why in the Test Plan).
 - [ ] I have updated documentation if necessary
 - [ ] My commits follow [Conventional Commits](https://www.conventionalcommits.org/) format
+- [ ] I understand, reviewed, and take responsibility for the complete submission
+- [ ] I selected exactly one AI-assistance option and, if material assistance was used, completed all applicable declaration fields
 - [ ] My commits do not include `Co-Authored-By` trailers
 
 ---
 
 ## 💬 Notes for Reviewers
 
 <!-- Optional: anything you want reviewers to pay special attention to. -->
+
+For production Go changes in `internal/cli`, `internal/reviewtransaction`, or `internal/sddstatus`:
+
+- [ ] Identify any qualifying security, integrity, admission, repair, or governance guard and challenge its legitimate input population against real-world evidence.
+- [ ] Confirm its `guard:population` direction and claim are adjacent and accurate, and that `.guard-population-baseline.txt` changed only when the guard contract intentionally changed.
+- [ ] Do not treat a passing declaration/registry check as proof that no qualifying guard was omitted or that the population claim is semantically complete.

.github/scripts/parse-linked-issues.cjs

@@ -0,0 +1,28 @@
+'use strict';
+
+// Shared parser for closing issue references in PR bodies.
+// Single seam used by every pr-check.yml gate that reads linked issues:
+// both check-issue-reference and check-issue-approved consume this parse.
+
+const CLOSING_REFERENCE_PATTERN = /(?:closes|fixes|resolves)\s+#(\d+)/gi;
+
+// An HTML comment runs from `<!--` to the next `-->`, or to the end of the
+// body when unclosed. The unclosed case matches how GitHub renders Markdown
+// (the HTML spec closes an open comment at end of input), so everything after
+// an unclosed `<!--` is invisible to reviewers and must not count.
+const HTML_COMMENT_PATTERN = /<!--[\s\S]*?(?:-->|$)/g;
+
+// Removes HTML comments so only reviewer-visible text remains.
+function stripHtmlComments(body) {
+  return (body || '').replace(HTML_COMMENT_PATTERN, '');
+}
+
+// Returns the linked issue numbers referenced by closing keywords in the
+// visible (non-comment) PR body, in order of first appearance.
+function parseLinkedIssues(body) {
+  const visible = stripHtmlComments(body);
+  const matches = [...visible.matchAll(CLOSING_REFERENCE_PATTERN)];
+  return matches.map((m) => parseInt(m[1], 10));
+}
+
+module.exports = { parseLinkedIssues, stripHtmlComments };

.github/scripts/parse-linked-issues.test.cjs

@@ -0,0 +1,61 @@
+'use strict';
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+
+const { parseLinkedIssues } = require('./parse-linked-issues.cjs');
+
+test('a closing reference that only appears inside an HTML comment is not a linked issue', () => {
+  const body = [
+    '## Summary',
+    '',
+    '<!--',
+    'Link the approved issue this PR resolves, e.g.:',
+    'Closes #42',
+    '-->',
+    '',
+    'Some visible description without any reference.',
+  ].join('\n');
+
+  assert.deepEqual(parseLinkedIssues(body), []);
+});
+
+test('a real reference outside a comment plus the template example inside one finds exactly the real one', () => {
+  const body = [
+    'Closes #1770',
+    '',
+    '<!--',
+    'Example: Closes #42',
+    '-->',
+  ].join('\n');
+
+  assert.deepEqual(parseLinkedIssues(body), [1770]);
+});
+
+test('a single-line HTML comment is also ignored', () => {
+  const body = 'Fixes #7\n<!-- Closes #42 --> trailing visible text';
+
+  assert.deepEqual(parseLinkedIssues(body), [7]);
+});
+
+test('multiple visible closing references are all preserved, in order', () => {
+  const body = 'Closes #10\nFixes #11\nResolves #12';
+
+  assert.deepEqual(parseLinkedIssues(body), [10, 11, 12]);
+});
+
+// Documented behavior: an unclosed `<!--` hides everything through the end of
+// the body. This matches how GitHub renders Markdown (the HTML spec closes an
+// open comment at end of input), so a reference after an unclosed `<!--` is
+// invisible to reviewers and must not count as a linked issue.
+test('an unclosed HTML comment hides the rest of the body, matching rendered output', () => {
+  const body = 'Closes #1770\n<!-- forgot to close this comment\nCloses #42';
+
+  assert.deepEqual(parseLinkedIssues(body), [1770]);
+});
+
+test('an empty or missing body yields no linked issues', () => {
+  assert.deepEqual(parseLinkedIssues(''), []);
+  assert.deepEqual(parseLinkedIssues(null), []);
+  assert.deepEqual(parseLinkedIssues(undefined), []);
+});