fix(harness): re-wire the de-wired gates + route the control plane (#93)

[dollspace-gay]

Closes #93.

What was broken

5581b65f ("Stage-3 REQ-1: the @bv clause tag, parse-gated") removed three hook entries from .claude/settings.json — the PostToolUse/Read recorder and the PreToolUse/Write|Edit pair invoking both tooling/spec-discipline.py and tooling/anti-pattern-gate.py. The commit message is entirely about the @bv clause tag and never mentions the settings change. The crosslink-generic entries survived; only the project-specific ones vanished — the signature of crosslink init regenerating a file that is tracked but machine-authored.

Both agent-facing gates were dormant for the entire Stage-3 arc, while README.md:172 ("they enforce automatically — no setup"), goal.md's R-XLATE-1/2/3, and all four .claude/agents/acto-*.md kept asserting they fire.

It stayed hidden because no route covered the control plane. doc-drift.py pins freshness for files reachable from spec-routes.toml, and .claude/settings.json was not one of them. The design layer governed everything except the file that decides whether the governance runs.

What this does

.claude/settings.json	Restores the three entries — byte-identical to the pre-clobber c7dc32be revision.
tooling/control-plane-check.py (new)	Asserts every hook the docs claim is live is wired and its script present on disk.
tooling/tests/test_control_plane.py (new)	Nine hand-authored oracle fixtures (R-CHAR-3).
tooling/spec-routes.toml	Routes .claude/settings.json, .claude/agents/*.md, and the new gate.
.design/tooling/control-plane.md (new)	Governing doc, REQ-1..REQ-7 + AC-1..AC-7, content-pinned.
CI + Makefile	control-plane gate (hook wiring) step; make control-plane / control-plane-test.
README.md	The enforcement claim now names the check that keeps it true.

Design choices worth a reviewer's attention:

• Assert, don't regenerate. A merge step that silently re-injects the entries after crosslink init is silent repair of a control plane — you stop noticing something keeps breaking it. This fails loudly and prints the exact JSON to paste back.
• Matcher coverage, not equality. Write|Edit|Bash satisfies a Write|Edit requirement; Write alone does not. Equality false-fails on a harmless reorder, substring matching passes a matcher that silently dropped Edit.
• An unparseable settings.json is a FINDING (exit 1), not INCONCLUSIVE — Claude Code loads no hooks at all from one, so it is maximally gate-dead. Exit 3 is reserved for the gate's own environment failing (doc-drift.py REQ-9 / R-HONEST-3: a gate that fails open is a silent pass).
• Wired-but-absent is its own class. Every command is if [ -f "$HOOK" ]-guarded, so a wiring naming a missing script degrades to a silent no-op. MISSING-SCRIPT is separate from MISSING-WIRING because the fix differs.
• The routes are DECLARATIVE for spec-discipline, ENFORCED for doc-drift. is_gated_path requires .rs + a thermite-/forge crate dir + a src/ component, so the hook structurally cannot gate a .json/.md file — the same honest limitation doc-drift-tripwire.md REQ-11 records for tooling/*.py. Same split as the existing doc-drift.py dogfood route.
• Not in make audit. Hook wiring is a development-discipline invariant, not a link in the proof-trust chain (doc-drift decision 5). scripts/audit.sh is byte-identical.

Verification

control-plane exit=0    doc-drift exit=0 (control-plane.md CURRENT)
req-status    exit=0    req-registry exit=0 (453 reqs, 119 views)
46 tooling tests OK (37 existing + 9 new)
scripts/audit.sh byte-identical (AC-7)

Dogfooded. Removing the anti-pattern entry again fires both gates: doc-drift reports DRIFT on control-plane.md, and control-plane-check reports two MISSING-WIRING findings with paste-ready restore snippets. O-2's test fixture is the verbatim post-5581b65f settings.json, so the suite goes red if the gate ever stops catching this exact regression.

Deliberately left open (recorded as OQ-1..OQ-3 in the design doc)

These are the other findings from #93; each is a judgment call I did not want to make silently inside a wiring fix:

1. OQ-1 — acto-critic.md / acto-doc-author.md declare model: fable in frontmatter while their bodies read "Opus — always. … Never substitute." Routing them means any future edit re-pins the doc, but which side is correct is a harness-behavior decision for the maintainer.
2. OQ-2 — no clippy.toml; ci.yml:95 is stock cargo clippy -D warnings with no disallowed_*/unwrap_used. The anti-pattern rules are still hook-only, so a clone that never runs Claude Code gets none of them.
3. OQ-3 — acto-critic withholds Edit but retains Write + unrestricted Bash, so "cannot modify production code" is prose-patched. The critic genuinely needs Write for test files, so the fix is a read-only mount or path-scoped allowlist, not dropping Write.

🤖 Generated with Claude Code

[maxinelevesque]

For the record: I disabled these intentionally when I was doing my work because I found the default process flow on the repo quite annoying haha.

I think it is worth a design note for how to collaborate between folks who use different agent-dev / gating strategies -- what is actually in the repo vs. kept locally for individual devs' preferences.

[dollspace-gay]

Yeah that was a problem with crosslink and still is, individual preferences overriding the defaults :p