docs: consolidated documentation PRs (#178–#189) — validated & corrected

docs/ROADMAP.md

@@ -128,7 +128,7 @@ ownership/lifetime/effects, (4) an MVP needs no PhD in Roslyn.
 |------|---------|----------|
 | **P0** | WPF/event/timer/subscription leaks; `IDisposable` ownership (leaks, fields, use-after-dispose); DI lifetime mismatch (captive dependency) | [P-004](proposals/P-004-wpf-lifetime-profile.md), [P-005](proposals/P-005-idisposable-ownership.md), [P-006](proposals/P-006-di-lifetimes.md) |
 | **P1** | ArrayPool/Span ownership-view bugs; hidden effects / architecture rules | [P-007](proposals/P-007-arraypool-span.md), [P-008](proposals/P-008-effects-and-resources.md) |
-| **P2** | async resource lifecycle / WPF async audit; `ValueTask` affine usage; typestate/protocols | [P-021](proposals/P-021-async-audit-pack.md), [P-008](proposals/P-008-effects-and-resources.md), [P-010](proposals/P-010-type-disciplines.md) |
+| **P2** | async resource lifecycle / WPF async audit; `ValueTask` affine usage; typestate/protocols; resource state-machine soup + stale async writes | [P-021](proposals/P-021-async-audit-pack.md), [P-008](proposals/P-008-effects-and-resources.md), [P-010](proposals/P-010-type-disciplines.md), [P-027](proposals/P-027-resource-state-machine.md) |
 | **P3** | LOH fragmentation; static-collection memory bloat; cross-thread `ObjectDisposedException` | — (runtime-bound; see detectability matrix) |
 
 > **Are we showable yet?** The concrete "delicious .NET alpha" gate — the A–G bar
@@ -326,3 +326,11 @@ own scan. Label them as estimates wherever they appear.
 | [P-020](proposals/P-020-ownts-react-effects.md) | OwnTS React effects profile (`Own.React`) — effect-storm angle | horizon | draft |
 | [P-021](proposals/P-021-async-audit-pack.md) | Async audit pack (`Own.Async`) — safety-first WPF/application async lifecycle diagnostics | P2 | draft |
 | [P-025](proposals/P-025-obligation-protocols.md) | Obligation protocols (`Own.Protocols`) — barrier-sensitive project invariants (OBL001–005) | P1 | first slice built (core + bridge + fixtures; extractor pending) |
+| [P-026](proposals/P-026-csharp-strictness-retrofit.md) | C# strictness retrofit profile (`own audit strictness`) — witness/score over existing findings | P2 | draft (framing) |
+| [P-027](proposals/P-027-resource-state-machine.md) | Resource state machines & stale-async-write detection (extends `Own.Async`) | P2 | draft |
+| [P-028](proposals/P-028-unneeded-dependency-profile.md) | Unneeded-dependency profile (`Own.Lean`) — evidence-only "you don't need this abstraction" findings (YDN001–002) | P2 | draft |
+| [P-029](proposals/P-029-agent-memory-layer.md) | Agent memory & policy layer (`.agents/`) — reviewed destination for AGENTS.md and learned-rule promotions | enabling | draft |
+| [P-030](proposals/P-030-naughty-strings-testing.md) | Naughty-strings robustness pack (BLNS crash-testing of lexer/parser/serializers/CLI) | enabling | draft |
+| [P-031](proposals/P-031-resource-model-files.md) | Project resource model files (`own.models.yaml`) — declarative acquire/release/capture | P2 | draft |
+| [P-032](proposals/P-032-own-arch-facts.md) | Own.Arch facts & intent model — deterministic architecture-fact core (deepens P-023) | P2 | draft |
+| [P-033](proposals/P-033-probabilistic-data-structures.md) | In-process sketches & bitmap indexes for audited legacy apps | horizon | draft |

docs/notes/agent-capability-layer.md

@@ -112,7 +112,7 @@ syscall/reachable-binary level. Two different enforcement models — don't confl
 | Phase | What | Verdict |
 |---|---|---|
 | **1. Policy engine** | `owen-policy`: parse `owen.policy.toml`, `policy check/explain`, `gen-ignore` | **Do.** Daily use, zero risk, not built. 80% of daily value. |
-| **2. Runner enforcement** | wrap agent in worktree + Sandboy | **Built** (`sandboy/`). Wire to a real gate step. |
+| **2. Runner enforcement** | wrap agent in worktree + Sandboy | **Spiked** (`sandboy/` — authored, not yet compiled; acceptance gate: `cargo build --release` + `tests/demo.sh`, see `sandboy/README.md`). Wire to a real gate step. |
 | **3. WIT tool components** | move tools to capability-scoped components | **Selective.** WIT only where input/author is untrusted: `secret-scanner`, `patch-analyzer`, `verifier-adapter` (parse untrusted output) — yes. `memory-search` over **your own** data — plain code, WIT buys nothing. |
 | **4. MCP/WIT bridge** | `owen-mcp` tools backed by policy + components | Thin, later. |
 
@@ -139,7 +139,7 @@ syscall/reachable-binary level. Two different enforcement models — don't confl
 canonical policy      owen.policy.toml                     (Phase 1 — build)
 context hygiene       generated ignore + filtered packs    (hygiene, NOT security)
 tool isolation        WIT + Wasmtime (own-adapter-host+)   (Phase 3 — selective)
-native isolation      worktree + Sandboy                   (built: sandboy/)
+native isolation      worktree + Sandboy                   (spiked: sandboy/)
 agent integration     mode (B): agent-with-shell in the    (Sandboy is the cage,
                       Sandboy cage, Owen tools on top       WIT tools are contracts)
 memory / verifier     only through policy-mediated ifaces
@@ -161,3 +161,65 @@ generated output of one policy engine, not your architecture.
 3. **Policy ⇄ Sandboy overlap** — how much of `[exec]`/`[network]` should be
    *compiled down* into a Sandboy policy (real enforcement) vs stay advisory
    context? Ideally `owen policy` emits a `sandboy` policy for mode (B).
+
+---
+
+## 8. Addendum (2026-07-05): authoring language for `owen.policy` — CUE, not TOML
+
+§3 sketched `owen.policy.toml` as a single flat file. That's fine while there is
+one profile. It stops being fine the moment there is more than one — `no-net`,
+`worktree-only`, a `windows`-tagged exec profile, a `trusted-repo` vs
+`untrusted-repo` split — because those need to **compose** ("inherit the base,
+add these steps"), and TOML has no merge semantics of its own. Composing TOML by
+hand means copy-pasting the base into every profile, and a copy that forgets
+`network.default = "deny"` is precisely the failure mode this whole layer exists
+to prevent — a config bug that reads as a permission grant.
+
+**Decision: author `owen.policy` in [CUE](https://cuelang.org).** The reason to
+prefer it over "TOML + a templating layer" is CUE's *unification* model: a
+parent and a child don't override each other, they unify, and unification is a
+**compile error** if they disagree. A leaf profile that tries
+`network: "allow"` against a base that says `network: "deny"` doesn't silently
+win — it fails to build. That is a materially different guarantee than
+inheritance-with-override (Terragrunt-style merge, Jsonnet `+`), where the leaf
+always wins and a mistaken override ships silently.
+
+```text
+policies/
+  no-net.cue             # network: "deny" — the floor, never overridden
+  worktree-only.cue      # repo.read/write confined to the worktree
+  default-processes.cue  # exec allowlist
+gates/
+  own-net.cue            # unifies the policies above + step list
+  own-net.windows.cue    # must *explicitly* switch to a different process
+                         # profile to add e.g. `powershell` — can't inherit a
+                         # denylist that silently forgot it
+```
+
+Compiled down to flat artifacts for whatever actually enforces it at runtime —
+rendered TOML for the per-step Sandboy policy (`cue export --out toml`, see
+`sandboy/README.md`), flat JSON for the gate manifest / `owen policy check`
+consumer — the authoring layer is for
+humans; the enforcement point should stay a boring, strict parser with no CUE
+evaluation at run time.
+
+Runner-up: **Nickel** (`import` + record merge via `&`, typed contracts) — a
+reasonable second choice if the policy ever wants functions or generated
+defaults; picked CUE first specifically because a security floor benefits more
+from "conflicts are hard errors" than from programmability.
+
+**Rejected for this use** (fine tools, wrong fit for a security source of
+truth): **Jsonnet** (`+`/`super` composition is generative — right for stamping
+out many manifests, wrong posture for policy, and a silent-override bug is just
+as easy as in TOML with fancier syntax); **Dhall** (safe and total, but more
+ergonomic weight than this scale needs — CUE gets the same "disagreement is an
+error" property more cheaply); **HCL/Terragrunt** (`include` + `merge_strategy`
+gives structural inheritance, but drags in Terraform's whole tooling/mental
+model for a project that has nothing to do with infrastructure deployment).
+
+**This does not change §0/§1.** WIT/Wasmtime stays the *execution* boundary for
+tool components that parse untrusted input (already spiked as `audit/adapters`,
+per `sandboy-isolation-adr.md` §6's update) — it is not a candidate for policy
+*authoring*. The two axes stay separate: CUE composes the data, WIT/Sandboy
+enforce it. See `007/docs/zero-trust-framework.md` for how 007 concretely
+consumes a CUE-authored policy as `.007/gate.lock.json`.