docs: prompt → gate → restore divergence audit + relaxation plan

[KyubumShin]

Summary

Three companion design docs from the post-Exp22 audit sweep. No code changes.

• docs/findings/2026-05-28-prompt-gate-restore-divergence.md — where the 3-tier (prompt 권고 → gate block → restore) pattern breaks down. Categories A (prompt-only) / B (gate without envelope) / C (envelope without routing) / D (trace coverage).
• docs/findings/2026-05-28-enforcement-relaxation-plan.md — per-finding tier recommendation (block / warn / telemetry) so the cleanup work isn't "block everything."
• docs/findings/2026-05-29-over-enforcement-audit.md — where Layer 2 OVER-applies. Categories A (hard-coded threshold) / B (lifecycle binary block) / C (prompt over-prescription).

Why now

After the 5-issue Exp22 follow-up cycle (PRs #226 / #227 / #228 / #229 / #231), the user asked for a sweep against the intended pattern. The first audit found under-enforcement; the second confirmed the relaxation lever (ENFORCEMENT_DEFAULTS) already exists; the third found over-enforcement that prevents legitimate workflows.

Resulting issues

Under-enforcement track:

• [3-layer audit] Add mpl-recover routing for unrouted block codes + drop phantom aliases #234 (mpl-recover routing)
• [3-layer audit] Wire bare block(reason) hooks to recordBlockedHook envelope + enforcement config #235 (envelope wiring)
• [3-layer audit] Tighten mpl-write-guard for protected paths (decomposition.yaml + mpl-cancel safe-cleanup hole) #236 (write-guard tightening — reshape note added on A1 / A3)
• [3-layer audit] mpl-hook-trace diagnostic gaps — PURPOSES map drift + endsWith boundary + state category #237 (trace diagnostic)
• [3-layer audit] Soft-signal telemetry surface for prompt-only quality rules (HA-01 / probing hints / seed invention / etc.) #238 (telemetry surface — reshape note added on integration vs new file)

Over-enforcement track:

• [Over-enforcement audit] Prompt over-prescription cleanup (test count floor / forced reviewer / per-TODO test) #239 (hard-coded thresholds → config)
• [Over-enforcement audit] Extract hard-coded thresholds to .mpl/config.json #240 (lifecycle binary → 3-mode + scope load-bearing fields)
• [Over-enforcement audit] Lifecycle binary block → warn/block/off + scope load-bearing fields #241 (prompt over-prescription cleanup)

Key takeaway

The relaxation lever already exists — hooks/lib/mpl-config.mjs::ENFORCEMENT_DEFAULTS defines per-rule warn/block/off policies. Most cleanup work is wiring hand-rolled blocks to the existing policy + extracting hard-coded literals to config — NOT introducing new constraint surface area.

Test plan

• Docs only — no code changes, no tests affected.

🤖 Generated with Claude Code

[KyubumShin]

Scheduled Hermes PR Review

Scope: lightweight diff review of PR #233 at 0bd4674.

Findings

• ✅ Looks Good — 변경 범위가 docs/findings/*.md 3개 신규 문서로 한정되어 있고, PR 설명의 “Docs only — no code changes”와 일치합니다.
• ✅ Looks Good — 세 문서가 각각 under-enforcement audit, enforcement relaxation plan, over-enforcement audit로 역할이 분리되어 있어 후속 issue([3-layer audit] Add mpl-recover routing for unrouted block codes + drop phantom aliases #234–[Over-enforcement audit] Lifecycle binary block → warn/block/off + scope load-bearing fields #241) 추적 맥락이 명확합니다.
• ✅ Looks Good — 보안상 민감한 토큰/credential 또는 실행 코드 변경은 diff에서 확인되지 않았습니다.
• 💡 Suggestion — 후속 작업을 진행할 때는 각 finding의 hooks/...:line 참조가 이후 코드 변경으로 쉽게 stale될 수 있으므로, 구현 PR에서는 해당 참조를 다시 검증하는 체크리스트를 포함하면 좋겠습니다.

Notes / Caveats

• Tests were not run because this PR is documentation-only and contains no executable code changes.
• Review was diff-only; linked issues and referenced source locations were not exhaustively revalidated against the current repository tree in this scheduled lightweight pass.

---

Automated periodic review by Hermes Agent.