docs(issue-5): phase 2b scenarios, operations note and task checklist

Three scenarios join the contract set, so the fifteen vectors now cover an
unproven side effect, an undecidable attribution, and an agent whose state goes
unreadable in the window between finalization and notification. All fifteen
match their expected decision.

The side-effect case needed a decision about layering. Authoritative enforcement
belongs in manifest verification, which has the job record and therefore knows
what was declared; the policy honours an explicit negative from the collector so
the case is expressible as a vector. Absence is not read as proof there, because
the manifest check is the layer that fails closed on missing evidence.

The operations note records why the agent declares and the reader re-derives,
the three gates and why the backend allowlist can only be narrowed, the
notification transaction, and the rollback.

It also records a deviation from my own plan. §D2 asked for reviewer sign-off
before promoting an attempt id into the record, since that changes a contract
phase 1 froze. Measurement during implementation showed the change was not
needed: the attempt guard already lives in the evidence layer, where attempt
identity actually is, so auto-completion passes the engine a status precondition
instead. The schema is untouched, the frozen contract holds, and a
characterization test fails the moment a record starts carrying an attempt id,
which is when to revisit it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrDNJkHmm18uu7n7JwV5Qd

.agents/skills/lib_py/loop/policy.py

@@ -154,6 +154,15 @@ def decide(scenario) -> Decision:
     if not filesystem.get("hash_verified"):
         return Decision("hold", "report manifest hash unverified", attribution_ok=True)
 
+    # Side-effect evidence is enforced authoritatively in finalize.verify_manifest,
+    # which has the job record and therefore knows what was declared. The policy
+    # honours an explicit negative from the collector so the case is expressible
+    # as a scenario vector; absence here is not read as proof, because the
+    # manifest check is the layer that fails closed on missing evidence.
+    if filesystem.get("side_effects_verified") is False:
+        return Decision("hold", "declared side effect has no evidence in the commit manifest",
+                        attribution_ok=True)
+
     return Decision("candidate_approved",
                     "attribution, quiescence and a verified manifest all hold",
                     attribution_ok=True)