fix: align public design docs with private locked versions, fix subagent subject_key pattern

Author: rayyagari2-create

docs/adapter-designs/DESIGN-01.md

@@ -350,7 +350,7 @@ means no observed violation. It does not mean no violation occurred.
 | Surface | Value | Notes |
 |---|---|---|
 | contextInjectionSurface | `rules_file` + `agents_md` | .cursor/rules/*.mdc + AGENTS.md |
-| eventSurface | `hook_rich` | 18 hook events including subagentStart/Stop |
+| eventSurface | `hook_rich` | ~21 hook events including subagentStart/Stop; includes Tab hooks and workspaceOpen |
 | controlSurface | `tool_level` | failClosed: true blocks on hook failure |
 | approvalSurface | `pre_tool` + `pre_session` | AWF intake gate + per-tool via hooks |
 | artifactSurface | `git_diff` + `pr_url` + `test_results` + `handoff_note` | Cloud agent REST API artifacts |
@@ -361,15 +361,21 @@ means no observed violation. It does not mean no violation occurred.
 | sandboxSurface | `sandbox_mode` + `worktree` | --sandbox + --worktree flags |
 | trustSubjectType | `agent` | .cursor/agents/ definitions |
 | enforcementDepth | `tool_level` | Event-rich, comparable to Claude Code |
-| currentEvidenceStrength | E1 | Artifact level until hooks wired to AWF |
-| targetEvidenceStrength | E3 | Local hooks / E2 cloud agents (SSE) |
+| currentEvidenceStrength | per-mode (see below) | Mode A local: E1 until hooks wired. Mode B cloud: E1 before adapter / E2 after Gate 2 SSE verification. Mode C self-hosted: E1. Mode D human: E1. |
+| targetEvidenceStrength | per-mode (see below) | Mode A local: E3 (conditions in DESIGN-06 §8). Mode B cloud: E2 hard ceiling. Mode C self-hosted: E3 pending worker hook test. Mode D human: E3-observed not E3-enforced. |
 | requiresRuntimeHookInstall | true | AWF hooks deployed to .cursor/hooks.json |
-| supportsFailClosed | true | failClosed: true blocks on hook failure |
+| supportsFailClosed | true — requires failClosed: true per blocking hook entry. Default is fail-open. E3 claims require Cursor build >= 2026-05-14 patched release. | See DESIGN-06 §8 |
 
 **Notes:**
 - Cloud agent outbound webhooks: "coming soon." Use SSE stream as substitute.
 - Cursor is classified event-rich/controlled. Closer to Claude Code than Codex.
 
+**Known gaps:**
+- Fail-closed requires explicit per-hook opt-in; default is fail-open.
+- E3 claims require Cursor build >= 2026-05-14 patch.
+- SDK has no canUseTool-equivalent; hooks are the only synchronous enforcement path.
+- Enterprise audit log is admin-action only, not a tool-call audit surface.
+
 ---
 
 ### Devin

docs/adapter-designs/DESIGN-02.md

@@ -79,7 +79,7 @@ OpenClaw (sub-agents via ACP)
 
 **subject_key pattern:**
 ```
-{runtime}::subagent::{parent_agent_id}::{task_class}::{session_id}
+{runtime}::subagent::{parent_agent_id}::{task_class}::{workspace}::{repo}::{session_id}
 ```
 
 **Examples:**
@@ -148,7 +148,7 @@ No internal agent decomposition is visible to AWF.
 
 **subject_key pattern:**
 ```
-{runtime}::session::{workspace}::{task_type}::{playbook_or_config}
+{runtime}::session::{workspace}::{repo}::{task_type}::{playbook_or_config}
 ```
 
 **Examples:**
@@ -215,7 +215,7 @@ not an autonomous agent's behavior.
 
 **subject_key pattern:**
 ```
-{runtime}::human::{human_actor_id}::{workspace}::{task_type}
+{runtime}::human::{human_actor_id}::{workspace}::{repo}::{task_type}
 ```
 
 **Examples:**
@@ -348,11 +348,11 @@ the same subject_key.
 | Trust type | Stable components | Unstable (exclude) |
 |---|---|---|
 | agent | runtime, "agent", agent_name, workspace | session_id, run_id |
-| subagent | runtime, "subagent", parent_agent_id, task_class, session_id | run_id |
-| role_profile | runtime, role, workspace, task_type, risk_lane, sandbox_mode, skill_set | session_id |
-| session | runtime, "session", workspace, task_type, playbook | session_id, run_id |
+| subagent | runtime, "subagent", parent_agent_id, task_class, workspace, repo, session_id | run_id |
+| role_profile | runtime, role, workspace, repo, task_type, risk_lane, sandbox_mode, skill_set | session_id |
+| session | runtime, "session", workspace, repo, task_type, playbook | session_id, run_id |
 | graph_node | "langgraph", graph_id, node_name, workspace | invocation_id |
-| human_runtime | runtime, "human", human_actor_id, workspace, task_type | session_id |
+| human_runtime | runtime, "human", human_actor_id, workspace, repo, task_type | session_id |
 | task | runtime, "task", workspace, task_class, work_item_id | run_id |
 
 ---
@@ -409,7 +409,7 @@ confidence in a STANDARD tier (not enough sessions to be certain).
    An agent-srv with HIGH trust on Claude Code starts PROVISIONAL on Codex.
 
 2. **Trust subjects are runtime-scoped.**
-   `claude_code::agent::agent-srv::ruvoni` and `codex::worker::ruvoni::backend::medium-risk::workspace-write`
+   `claude_code::agent::agent-srv::ruvoni::family-trip-ai` and `codex::worker::ruvoni::family-trip-ai::backend::medium-risk::workspace-write::backend-skill`
    are different trust subjects even if they represent the same "backend agent concept."
 
 3. **Workspace isolation is enforced.**
@@ -433,6 +433,11 @@ confidence in a STANDARD tier (not enough sessions to be certain).
 trust subject was created. It covers agent instruction files, role TOML configs,
 Devin playbook content and skill_set composition.
 
+config_hash covers agent/role/playbook definition, allowed tools, skill set,
+sandbox mode, and governance-relevant runtime config. Changing allowed tools
+or sandbox mode resets the confidence band even if the prompt definition is
+unchanged.
+
 **When config_hash changes:**
 - The trust_subject_id remains the same (history is preserved)
 - confidence_band resets to LOW unless the change is verified cosmetic
@@ -449,8 +454,10 @@ Devin playbook content and skill_set composition.
 
 ## Open Questions
 
-1. Should subagent trust_subject_id accumulate across sessions for named subagents in Claude Code?
-   Currently specified as session-scoped. Needs decision.
+1. OQ-1 RESOLVED: Subagent trust remains session-scoped by default. If a runtime exposes
+   persistent named subagents with stable definitions and reliable lifecycle events, AWF may
+   promote them to agent trust subjects in a future adapter version. Until then, subagents are
+   contributing subjects only, not long-lived primary trust subjects.
 2. For Codex role_profile subjects, if the .codex/agents/*.toml file is modified mid-sprint,
    should config_hash check fire before or after session start?
 3. LangGraph: should graph_node trust_subject_id be per-graph version or per-graph-name?

schemas/v1/trust-subject.schema.json

@@ -49,7 +49,7 @@
       "type": "string",
       "pattern": "^[a-z0-9_-]+(::[a-z0-9_-]+)+$",
       "maxLength": 200,
-      "description": "Stable, deterministic identity string for this subject. Same runtime + same config MUST produce the same subject_key. Construction rules: (1) all lowercase; (2) components separated by '::'; (3) no spaces — use hyphens within a component; (4) include only components stable across sessions for this subject_type; (5) maximum 200 characters. Patterns by subject_type — agent: {runtime}::agent::{agent_name}::{workspace}::{repo}; subagent: {runtime}::subagent::{parent_agent_id}::{task_class}::{session_id}; role_profile: codex::{role}::{workspace}::{repo}::{task_type}::{risk_lane}::{sandbox_mode}::{skill_set}; session: {runtime}::session::{workspace}::{task_type}::{playbook_or_config}; graph_node: langgraph::{graph_id}::{node_name}::{workspace}; human_runtime: {runtime}::human::{human_actor_id}::{workspace}::{task_type}; task: {runtime}::task::{workspace}::{task_class}::{work_item_id}. Unique per (workspace_id, runtime_provider, subject_key)."
+      "description": "Stable, deterministic identity string for this subject. Same runtime + same config MUST produce the same subject_key. Construction rules: (1) all lowercase; (2) components separated by '::'; (3) no spaces — use hyphens within a component; (4) include only components stable across sessions for this subject_type; (5) maximum 200 characters. Patterns by subject_type — agent: {runtime}::agent::{agent_name}::{workspace}::{repo}; subagent: {runtime}::subagent::{parent_agent_id}::{task_class}::{workspace}::{repo}::{session_id}; role_profile: codex::{role}::{workspace}::{repo}::{task_type}::{risk_lane}::{sandbox_mode}::{skill_set}; session: {runtime}::session::{workspace}::{task_type}::{playbook_or_config}; graph_node: langgraph::{graph_id}::{node_name}::{workspace}; human_runtime: {runtime}::human::{human_actor_id}::{workspace}::{task_type}; task: {runtime}::task::{workspace}::{task_class}::{work_item_id}. Unique per (workspace_id, runtime_provider, subject_key)."
     },
     "workspace_id": {
       "type": "string",