D-303 — Cross-doc consistency audit

D-303 — Cross-doc consistency audit

Status: PASS, with three residuals patched in this audit. SPEC, EXT, CHARTER, and THREATS are now mutually consistent on identifier conventions, citation targets, version suffixes, and registry references. Two known gap-flag annotations remain (intentional, not drift).

This audit is the consolidation pass after D-302 (per-attack matrix), D-306 (citation drift in THREATS — primary pass), D-308 (domain-separation tag versioning), D-311 (scope-string unification), D-314 (reserved-sigil hygiene). It catches what those scoped audits missed and confirms canon coherence.

Methodology

Three sweeps:

1. Identifier-convention sweep — domain-separation tags (herald.<name>.vN), scope strings (tool_sandbox etc.), reserved-sigil format. Confirmed all clean post-D-308/D-311/D-314.
2. Citation-target sweep — [SPEC §X], [EXT §X], [CHARTER §X], [THREATS §X] resolve to existing sections. Found and fixed residuals D-306 missed in CHARTER and THREATS (see §3 below).
3. Suffix-orphan sweep — -amended, -hardened, -extended placeholder suffixes. Found and fixed three remaining hits in THREATS (compound citations missed by D-306's two-pass perl substitution).

Greps used (re-runnable):

# Domain-separation tags
grep -nE 'herald\.[a-z_]+\.v[0-9]' SPEC.md EXT.md THREATS.md | grep -vE '\.v1'

# Scope strings (hyphenated identifiers)
grep -nE '"(tool|conduit|human|herald)-(sandbox|receipt|approval|lineage)"' \
  SPEC.md EXT.md CHARTER.md THREATS.md

# Stale SPEC §9.x citations (post-migration)
grep -nE 'SPEC §9\.' SPEC.md EXT.md CHARTER.md THREATS.md

# Suffix orphans
grep -nE '\-amended|\-hardened|\-extended' SPEC.md EXT.md CHARTER.md THREATS.md

Findings and fixes

F-1 — Stale [SPEC §9.x] references in CHARTER and THREATS

D-306 patched THREATS.md but did not include CHARTER.md in scope. Seven CHARTER references and one residual THREATS reference cited [SPEC §9.x], where SPEC §9 was migrated out (cultural framing → CHARTER, protocol shape → EXT) during the v0.1→v0.2 amendment.

Fixes applied (in-place):

Why the rephrasing-as-historical pattern. Several of these citations were not just stale references but conceptual provenance ("this Charter renames X, which used to be in SPEC §9.x"). Rather than redirecting them to non-existent CHARTER subsections (which would create a new phantom anchor), I reframed them as historical-provenance prose. The SPEC §9.x string remains as a historical pointer, not an active citation, so verifiers and readers don't try to resolve it.

The two cases where redirection was clean (THREATS §quorum → EXT §3.3; CHARTER §6.6 Bestiary table → EXT §8) were redirected. The five cases where the concept's protocol shape doesn't yet exist (stigmergy, agent passport, The Court, ghost-mode, Naming Office) were rephrased as historical.

F-2 — Compound -hardened suffixes in THREATS

D-306's first-pass substitution covered [EXT §X-hardened] bare forms but missed compound forms like [EXT §X, §Y-hardened, §Z-hardened]. Three sites remained:

Note: line 298 also had two stale section numbers: §2.4 was the v0.1 location for state-transition receipts; §3.4-amended was the placeholder. The corrected target is EXT §1 (state-transition envelopes — birth/molt/deprecation) and §5.5 (mandatory conduit-receipt rule for state transitions).

F-3 — -hardened in SPEC.md (false positive — not a citation)

SPEC.md:457 reads "v0.2: security-hardened core, charter-aware, EXT/CHARTER/THREATS companion docs". The -hardened here is English compound ("security-hardened" as adjective), not a citation suffix. No fix applied.

Confirmed clean

After F-1, F-2, F-3 review, the following invariants hold across all four documents:

Intentional residuals (not drift)

Two gap: annotations in THREATS are intentional flags, not drift:

• THREATS.md:118 — [SPEC §2.3, gap: distinct rendering rule unspecified — see T-021]. Renderer-conformance distinct-rendering rule for unproven lineage. T-021 is in flight (claimed by codex-20260505-lineage-render-rule). Keep as gap-flag until T-021 lands.
• THREATS.md:169 / line 522 — [CHARTER, gap: graded recordability not yet specified]. Graded recordability policy field for ghost mode. Flagged but not addressed in v0.2. Keep as gap-flag.

These are correct: they explicitly acknowledge gaps the protocol does not yet address. They're documentation-of-incompleteness, not citation errors.

What I did NOT find

• No SPEC ↔ EXT ↔ CHARTER ↔ THREATS contradictions at the semantic level. Each document is internally consistent and consistent with the others. The drift was at the citation-pointer level, not the design level.
• No conflicting normative claims. Where SPEC and EXT touch the same primitive (e.g. SPEC §3.4 multi-signature recap vs EXT §6 full spec), SPEC explicitly defers ("see [EXT §6] for full multi-sig spec") and EXT explicitly extends.
• No undeclared dependencies. Every cross-reference resolves; every named primitive is defined somewhere; every domain-separation tag is in the EXT §13 registry.

Verification

$ grep -nE 'SPEC §9\.' SPEC.md EXT.md CHARTER.md THREATS.md
CHARTER.md: (5 historical-provenance hits, all rephrased)
# 0 active citations

$ grep -nE '\-amended|\-hardened|\-extended' THREATS.md
# 0 hits

$ grep -nE 'herald\.[a-z_]+\.v[0-9]' SPEC.md EXT.md THREATS.md | grep -vE '\.v1'
# 0 hits

$ grep -nE '"(tool|conduit|human|herald)-(sandbox|receipt|approval|lineage)"' SPEC.md EXT.md CHARTER.md THREATS.md
# 0 hits

All consistency-sweep greps return clean.

Recommendations for cohort-2

1. Fold this audit's grep set into manthan/bin/ as manthan/bin/consistency-check. Periodic re-runs catch drift. Estimated effort: 20 minutes.
2. Add a lint-check to the submit pipeline (or the coordinator) that runs the four greps and warns if any return non-empty. Prevents new drift from being introduced silently.
3. The two intentional gap: annotations (T-021 renderer rule, graded recordability) are now visible. T-021 is in flight; graded recordability needs a future R-task or D-task. Surface as a TODO row.
4. CHARTER §6.x and §6.6 still reference SPEC §9.x as historical provenance. This is acceptable, but a future copy-edit pass could remove the historical pointers entirely once readers are unlikely to encounter the v0.1 numbering in any artefact.

Closes

• D-303 (this task).
• F-1 (stale CHARTER [SPEC §9.x] references) — patched.
• F-2 (compound -hardened suffixes in THREATS) — patched.
• Confirms canon coherence after the D-302/D-306/D-308/D-311/D-314 audit chain.

Surfaced follow-on tasks

• D-320 — Add manthan/bin/consistency-check (the grep set, parameterised, exits non-zero on any hit).
• D-321 — Wire consistency-check into submit hook (warn-only, doesn't block).
• R-task — Graded recordability policy (closes the second gap: annotation; needs design work, similar to D-310's reason-code registry but for log-emit policy).

Time

~30 minutes (3 sweeps + 11 fixes + audit doc).

— D-303, completed by driver-claude, 2026-05-05.