An ADR never cites a path into the session tree, and adr validate refuses it in every project
Accepted
Context
`.coder/` is session process. adr-077 ignores it in every spine repo, adr-062 keeps it in the private overlay, and adr-080 already states the rule for one surface: nothing references the process, and a source judgement that cites it is refused by the constraint `no-coder-as-a-source-of-record`. That constraint greps `.ontoref/positioning/sources/` only. ADR files were never covered, and the gap was paid.
THE CASE. On 2026-09-13 an agent amending an ADR in a consumer project filled the optional `warrant` array with a `'Session` reference to a file inside `.coder/` that did not exist. The user-level instructions loaded into that session forbid citing session files from product artefacts. The rule was present in context and was not applied at the moment of writing; nothing downstream refused it, and the agent then built further edits on the amended ADR.
MEASURED BEFORE DECIDING. A scan of ADR files for a path into `.coder/` found 23 lines in ontoref's own corpus and 1 in DD-eca. They fall into three kinds: session plans and notes cited as evidence or warrant (the shape the agent copied — adr-049 carries a `'Session` warrant into the tree); a constraint whose check opens a session plan, which cannot look on any other machine; and operational paths naming where a tool writes or what the overlay holds. All three make a published decision depend on a tree that is gitignored and pushed nowhere.
WHY A CONSTRAINT IN AN ADR CANNOT CARRY THIS. `adr validate` globs the current project's `adrs/` only, and the installed data dir ships the ADR schema but no ADRs. A Hard constraint declared in ontoref's corpus would bind ontoref alone. A rule for every project has to live in the command every project runs.
Decision
`adr validate` scans every ADR file of the project it runs in, whatever its status, for a path into `.coder/`, and fails when it finds one — reported beside the Hard constraints and counted in the same refusal.
A path into the tree is `.coder/` followed by a name character. Naming the layer itself, followed by whitespace, a quote or a backtick, is not a citation: adr-077 and adr-080 must be able to say what the layer IS without depending on what it CONTAINS.
There is no exemption list and no severity knob. A decision that needs what a session produced extracts it into a governed surface — an ADR field, a qa entry, a backlog item, a positioning source — and cites that.
Constraints
- Hard `adr validate` wires the session-citation scan into its refusal.
Alternatives considered
- A Hard Grep constraint in an ontoref ADR — rejected: `adr validate` reads only the running project's adrs/; the constraint would bind ontoref and no consumer.
- A migration that asks each project to add its own constraint — rejected: It makes a protocol rule depend on every project copying it correctly, which is the replica shape adr-074 forbids, and a project that never applies the migration is never checked.
- Exempt operational paths and flag only evidence citations — rejected: The distinction is not textual, so it would be an allowlist, and an allowlist is where the next citation hides. Both kinds dangle outside the machine that wrote them.
- Keep the rule in agent instructions only — rejected: That is the state in which the failure happened.
Anti-patterns
- A session file as warrant — Citing a plan, note or transcript inside `.coder/` as the evidence, warrant or source of a governed decision.