Plan integration: PlanApplication seam, Bugs A/B closed (Phases 0–1) [in progress]

.github/workflows/ci.yml

@@ -158,7 +158,14 @@ jobs:
     # defects were hiding in there: a 500 from a file-deletion race in session
     # teardown, and a 200ms sleep racing a 187ms CSS fade.
     runs-on: ubuntu-latest
-    timeout-minutes: 25
+    # Budget, measured not guessed: main's last green e2e (run 34160855304,
+    # 2026-09-07) ran 515 tests in 14m23s inside a 25-minute ceiling; the
+    # plan-integration branch runs 567 in 21m42s (run 35216220593) and was
+    # killed by that same ceiling at 25m16s with the test matrix green (run
+    # 35217712505, 2026-09-17). Forty minutes is ~1.6x the measured run --
+    # still a real guard against a hung browser, no longer a coin flip on
+    # runner speed. Revisit when the suite next grows by a tenth.
+    timeout-minutes: 40
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1

.gitignore

@@ -522,6 +522,16 @@ docs/architecture/session-memory/*
 # Receipts (adapter-scope decisions, measurement records) are small Markdown/JSON
 # and must be tracked; same negation as feat/knowledge-proof so the branches merge.
 !docs/architecture/session-memory/receipts/
+# Un-ignored 2026-09-15 — plan-integration programme record (issues #7–#15): council
+# briefs, seat receipts, arbitration, verification receipts and the archify spec.
+# Same shape as session-memory above: small Markdown/JSON only; any delivered
+# HTML stays ignored and regenerates from the spec via `archify deliver`.
+!docs/architecture/plan-integration/
+docs/architecture/plan-integration/*
+!docs/architecture/plan-integration/council/
+!docs/architecture/plan-integration/receipts/
+!docs/architecture/plan-integration/*.architecture.json
+!docs/architecture/plan-integration/*.md
 
 # Demo recordings (large, local-only)
 demos/

.pre-commit-config.yaml

@@ -33,7 +33,20 @@ repos:
     # by design -- exactly what a "Hex High Entropy String" detector is
     # built to flag, and exactly what it should ignore here: there is no
     # secret to leak, only a pinned digest of a committed, public file.
-    exclude: packages/studyloop/tests/acceptance/uat/data/.*_registry\.json$
+    # Council manifests (docs/architecture/plan-integration/council/*/manifest.json)
+    # carry the brief and system-prompt sha256 so a seat receipt can be tied to
+    # the exact text it answered -- again a digest of a committed file, not a key.
+    # Plan-integration receipts (docs/architecture/plan-integration/receipts/*.json)
+    # are the same class: the verification receipt records the golden fixture's
+    # sha256 and the UAT redacted summary carries the rubric hash and the
+    # private bundle's manifest digest (council D-22) -- every one a digest the
+    # redaction rules allow out precisely because it identifies without revealing.
+    exclude: |
+      (?x)^(
+        packages/studyloop/tests/acceptance/uat/data/.*_registry\.json|
+        docs/architecture/plan-integration/council/.*/manifest.*\.json|
+        docs/architecture/plan-integration/receipts/.*\.json
+      )$
 - repo: https://github.com/PyCQA/bandit
   rev: 1.8.3
   hooks:
@@ -85,6 +98,21 @@ repos:
     language: pygrep
     types:
     - text
+  # trufflehog (added 2026-09-15): provider-specific credential detectors on the
+  # staged changes -- AWS/Bedrock, GitHub, OpenAI, Anthropic, Slack, ... -- as
+  # a second, independent layer under detect-secrets' entropy heuristics. The
+  # wrapper consumes trufflehog's JSON and prints detector/file/line only; the
+  # raw match is never echoed, so a caught secret cannot leak via the hook's
+  # own output. Fails on `verified` and `unknown` results alike: an
+  # revoked or fake key still leaks the shape of a real one. Binary via mise.
+  # Full-history sweep: `uv run python scripts/security/trufflehog_redacted.py --history`.
+  - id: trufflehog
+    name: trufflehog (staged changes, redacted output)
+    entry: uv run --group dev python scripts/security/trufflehog_redacted.py
+    language: system
+    pass_filenames: false
+    always_run: true
+    stages: [pre-commit]
   # One hook, the same invocation as `just typecheck`, so the commit-time check
   # and the release gate cannot disagree. The previous two hooks ran pyright on
   # each package's src/ only; a test-only type error (R-51) passed the hook and

CONTRIBUTING.md

@@ -24,5 +24,5 @@ just preflight
 - Conduct: [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) (Contributor Covenant 2.1).
 - Security concerns go through [GitHub's private advisory form](https://github.com/NetDevAutomate/StudyLoop/security/advisories/new), never a public issue.
 
-StudyLoop is a pre-1.0 pre-release with six first-party mentor harnesses (Kiro CLI, Codex and Claude Code are
-core; OpenCode, pi and Grok Build are preview). Proposals for another harness start with an issue, not a pull request.
+StudyLoop is a pre-1.0 pre-release with six first-party mentor harnesses (Kiro CLI, Codex, Claude Code and pi are
+core; OpenCode and Grok Build are preview). Proposals for another harness start with an issue, not a pull request.

README.md

@@ -107,8 +107,9 @@ clear:
 - the Web UI needs the local StudyLoop server and does not work offline;
 - voice uses a configured Kokoro-compatible server, then falls back to operating
   system voices when available;
-- study plans can be created in the Web UI or CLI, but the current Web UI form is
-  manual—an agent-led planning interview is not integrated there yet;
+- study plans can be created in the Web UI form, the CLI, or through the agent-led
+  architect interview (Web UI, CLI, or MCP); an active plan biases the next-action
+  recommendation but is never bound to a live study session;
 - practice-task generation and verification are currently CLI workflows.
 
 Those limits are tracked openly in the [roadmap](docs/roadmap.md). If one blocks