docs: re-base the policy audit matrix on the 44-policy corpus (#310)

Merge PR #310

Author: piyushmakhija28

README.md

@@ -475,7 +475,7 @@ claude-workflow-engine/           # 369 Python files total
 │   ├── e2e/                      # 3 end-to-end scenario tests
 │   └── load/                     # 1 concurrency / load test
 │
-├── docs/                         # 255 files — architecture docs, ADRs, runbooks, ALL policy/rule
+├── docs/                         # 253 files — architecture docs, ADRs, runbooks, ALL policy/rule
 │                                 # .md files (flattened here, no subfolders), CONTRIBUTING.md,
 │                                 # CODE_OF_CONDUCT.md, and the GitHub issue/PR templates
 ├── uml/                          # Regenerated per pipeline run (13 types, Mermaid/PlantUML)
@@ -850,4 +850,4 @@ Key rules:
 
 ---
 
-**Version:** 2.1.0 | **Last Updated:** 2026-08-08
+**Version:** 2.1.0 | **Last Updated:** 2026-08-10

docs/README.md

@@ -19,7 +19,7 @@ permits: `README.md`, `CLAUDE.md`, `SRS.md`, `CHANGELOG.md` and `VERSION`.
 | [`phase-6-sprint/`](phase-6-sprint/) | Sprint plan and issue drafts | 4 |
 | [`phase-7-routing/`](phase-7-routing/) | Issue-to-agent routing | 4 |
 | [`phase-8-alignment/`](phase-8-alignment/) | Pre-implementation alignment | 4 |
-| [`policies/`](policies/) | Pipeline policies | 46 |
+| [`policies/`](policies/) | Pipeline policies | 44 |
 | [`releases/`](releases/) | Per-release design notes | 7 |
 | [`reports/`](reports/) | Investigations and audits | 26 |
 | [`standards/`](standards/) | Coding and testing standards | 52 |
@@ -89,9 +89,12 @@ Numbered rules 01-46 plus per-language standards. These mirror `~/.claude/rules/
 
 ## `policies/` -- Pipeline policies
 
-One document per policy the SDLC pipeline enforces. These mirror `~/.claude/policies/`, which is the directory `get_policies_dir()` actually reads.
+One document per policy the SDLC pipeline enforces. `~/.claude/policies/` is the directory
+`get_policies_dir()` actually reads; it is **not** a mirror of this one -- the two are different
+sets and nothing keeps them in step. See `docs/reports/policy-implementation-audit-v2.md`
+section 4.
 
-<details><summary>46 file(s)</summary>
+<details><summary>44 file(s)</summary>
 
 - [EXECUTION-SYSTEM-FIXES-SUMMARY.md](policies/EXECUTION-SYSTEM-FIXES-SUMMARY.md)
 - [INTELLIGENT-PROMPT-GENERATION-UPGRADE.md](policies/INTELLIGENT-PROMPT-GENERATION-UPGRADE.md)
@@ -126,9 +129,7 @@ One document per policy the SDLC pipeline enforces. These mirror `~/.claude/poli
 - [prompt-generation-policy.md](policies/prompt-generation-policy.md)
 - [quality-gate-policy.md](policies/quality-gate-policy.md)
 - [recovery-policy.md](policies/recovery-policy.md)
-- [session-chaining-policy.md](policies/session-chaining-policy.md)
-- [session-memory-policy.md](policies/session-memory-policy.md)
-- [session-pruning-policy.md](policies/session-pruning-policy.md)
+- [session-management-policy.md](policies/session-management-policy.md)
 - [task-phase-enforcement-policy.md](policies/task-phase-enforcement-policy.md)
 - [task-progress-tracking-policy.md](policies/task-progress-tracking-policy.md)
 - [test-case-policy.md](policies/test-case-policy.md)

docs/phase-0-reverse-engineering/as-built-prd.md

@@ -182,7 +182,7 @@ That is an absence-of-literal-token finding, not an absence-of-relationship find
 semantic-intent correlation (`docs/policies/*.md` intent field vs. SRS.md's 9 FR + 6 NFR = 15 entries),
 each mapping backed by the specific evidence already gathered in `policy_enforcement_raw.json`.
 
-### 4.1 Mapped policies (32 of 46)
+### 4.1 Mapped policies (32 of 44)
 
 | Policy | Status | Maps to |
 |---|---|---|
@@ -209,7 +209,7 @@ each mapping backed by the specific evidence already gathered in `policy_enforce
 | prompt-generation-policy.md | ENFORCED | FR-2 (Step 1) |
 | quality-gate-policy.md | ENFORCED | FR-2 (Step 5) |
 | recovery-policy.md | ENFORCED | FR-1 (Level 0) |
-| session-memory-policy.md | CONTRADICTED | NFR-3 |
+| session-management-policy.md | PARTIAL | NFR-3 |
 | task-phase-enforcement-policy.md | ENFORCED | FR-9 |
 | task-progress-tracking-policy.md | PARTIAL | NFR-3 |
 | test-generation-policy.md | ENFORCED | FR-2 (Step 5) |
@@ -227,7 +227,7 @@ rather than evidenced. Treated as a genuine orphan for that reason, not merely b
 CONTRADICTED (compare `callgraph-analysis-policy.md`, also CONTRADICTED, which *does* map cleanly to
 FR-3's explicit text).
 
-### 4.2 Genuine orphans (14 of 46) -- policies supporting no SRS FR/NFR
+### 4.2 Genuine orphans (12 of 44) -- policies supporting no SRS FR/NFR
 
 | Policy | Status | Reason it maps to NONE |
 |---|---|---|
@@ -241,18 +241,32 @@ FR-3's explicit text).
 | intelligent-decision-engine-policy.md | CONTRADICTED | Describes a consolidation that was never built (systems it claims to unify were deleted in v1.13); no current-topology equivalent exists to map to any FR. |
 | parallel-execution-policy.md | DOCUMENTED-ONLY | Describes calling-agent behavior (multiple Task/Agent tool calls), not a pipeline capability; no SRS FR covers subagent parallelism. |
 | proactive-consultation-policy.md | DOCUMENTED-ONLY | Self-declared deprecated; its stated replacement is two other Steps, not a distinct capability. |
-| session-chaining-policy.md | PARTIAL | Session parent/child/related chaining is a session-mgr MCP-server feature (external repo); no SRS FR in this repo's 15-entry corpus addresses it. |
-| session-pruning-policy.md | CONTRADICTED | No SRS FR governs session retention windows; NFR-3 covers checkpoint recovery, not pruning, and the mechanism is a no-op regardless. |
 | test-case-policy.md | DOCUMENTED-ONLY | Describes a manual-testing-mandatory-vs-optional distinction that is a behavioral instruction to the calling agent, not a pipeline gate; no SRS FR addresses it. |
 | user-preferences-policy.md | DOCUMENTED-ONLY | Describes a 3+-occurrence learning threshold with no SRS FR counterpart; only a passthrough context field exists in code. |
 
-**Genuine orphan count: 14 of 46 (30.4%)** -- not 46 of 46. Six of the 14 (anti-hallucination,
-architecture-script-mapping, git-auto-commit, intelligent-decision-engine, session-pruning, plus
+**Genuine orphan count: 12 of 44 (27.3%)** -- not 46 of 46. Five of the 12 (anti-hallucination,
+architecture-script-mapping, git-auto-commit, intelligent-decision-engine, plus
 cross-project-patterns as the one live-but-unmapped exception) are independently CONTRADICTED or
 ENFORCED-but-unmapped for reasons unrelated to the SRS-ingestion gap -- i.e., even a perfect SRS
 correlation pass would still classify them as NONE, because the capability they describe is either
 broken or genuinely out of the current SRS's stated scope.
 
+**Adjusted 2026-08-10 from 14 of 46; six of the 14 became five of the 12.** PR #308 replaced
+`session-chaining-policy.md`, `session-memory-policy.md` and `session-pruning-policy.md` with one
+`session-management-policy.md`. Two of the three (`session-chaining`, `session-pruning`) were
+orphans in the table above; the third was mapped to NFR-3 in section 4.1. **The one policy that
+replaced all three is mapped, not an orphan**: it is the state-persistence layer NFR-3
+(Reliability) covers, and it inherits that mapping directly -- so section 4.1 stays at 32 and the
+orphan list loses two names without gaining one. `session-pruning` was one of the six that would
+have stayed orphaned under perfect SRS coverage, which is why that sub-count falls to five.
+
+**This is arithmetic on the existing correlation, not a new one.** No surviving policy's mapping
+was re-decided, and the SRS correlation that produced the 14 figure was not re-run. The findings
+recorded for the three superseded policies are preserved in
+`docs/reports/policy-implementation-audit-v2.md` section 1.4, not withdrawn: the two CONTRADICTED
+classifications rested on measured absences of spawn targets, and a policy being rewritten does
+not make that measurement false.
+
 ---
 
 ## 5. Six-Gate Validation Results