RigelBuild · rigel-mintaka · Aug 31, 2026 · Aug 31, 2026
@@ -1,7 +1,7 @@
 // Source-hygiene gate: no retired-milestone design citations survive in shipped
 // UI source. The early Compass milestone records (v0.3 through v0.8) were
 // retired (RIG-2453); their still-true rationale was consolidated into
-// `docs/designs/product/compass-architecture-lineage/design.md` and every
+// `docs/designs/meta/compass-architecture-lineage/design.md` and every
 // shipped citation re-pointed there.
 //
 // A vintage provenance tag naming a retired milestone — `design compass-0.6`,
@@ -73,7 +73,7 @@ describe("design-citation hygiene (no retired-milestone design refs)", () => {
 		expect(
 			violations,
 			violations.length > 0
-				? `Retired-milestone design citations found in shipped source — re-point to the architecture-lineage record (docs/designs/product/compass-architecture-lineage/design.md):\n${report}`
+				? `Retired-milestone design citations found in shipped source — re-point to the architecture-lineage record (docs/designs/meta/compass-architecture-lineage/design.md):\n${report}`
 				: "",
 		).toEqual([]);
 	});

@@ -14,7 +14,7 @@ import { STUB_AGENTS, STUB_ISSUES } from "./stub-data";
 import { testQueryClient } from "./test-support";
 
 // T1 — Agent identity: separate co-addressed types + fixture reconciliation
-// (design record `docs/designs/product/compass-architecture-lineage/design.md`,
+// (design record `docs/designs/meta/compass-architecture-lineage/design.md`,
 // T1 §282-400). RED-FIRST: this suite is authored against T1's specified surface
 // — the account-kind `Agent`/`Account` in stub-data.ts (design.md:325-362), the
 // cached `account.homeChannelId` (:339,367-369), the derived `STUB_ACCOUNTS`

@@ -13,7 +13,7 @@ frozen as the agent↔Runner call transport record
 designs the two contract legs it cites but does not define — the Runner→Server
 `RelayCommsCall` RPC and the Server-side execution handler — plus the agent-side
 tools and their identity/authz model. Companion to the
-[architecture lineage](../compass-architecture-lineage/design.md) record (§T5 agent stdio contract)
+[architecture lineage](../../meta/compass-architecture-lineage/design.md) record (§T5 agent stdio contract)
 and the container-runtime record
 [`compass-agent-container-runtime.md`](../compass-agent-container-runtime.md)
 (threat model, egress posture).
@@ -82,7 +82,7 @@ this record rides its `RunnerCallTransport` seam and does not re-decide it.
   ruleset" (`go/internal/runtime/egress.go:7-9`). The container-runtime record
   moves the MVP *policy* to default-open but keeps the mechanism and the moat
   rationale — "blast-radius containment"
-  (`docs/designs/product/compass-agent-container-runtime.md:77`, `:206-217`) —
+  (`docs/designs/agent/compass-agent-container-runtime.md:77`, `:206-217`) —
   and per-agent restriction stays "a future opt-in" (`:216-217`). A Unix socket
   is not a network address, so the frozen transport opens no port and disturbs
   no egress posture; nothing in this record's comms legs relies on or perturbs

@@ -16,7 +16,7 @@ its T3) and the lifecycle tools (`packages/compass-agent/src/lifecycle.ts`):
 same broker shape, same identity model, same registration path. Everything
 below the agent — the Server write chokepoint, the hub relay, the Runner
 gateway leg, and the proto carrier — is COMPLETE and frozen elsewhere
-([`compass-forge-write-path/design.md`](../compass-forge-write-path/design.md));
+([`compass-forge-write-path/design.md`](../../product/compass-forge-write-path/design.md));
 this record consumes it and designs nothing on the Go side.
 
 **Grounding.** This record and the code it describes live together in this
@@ -72,7 +72,7 @@ else.
    in-band `unimplemented` until the writer lands.** The backend arms are
    `CodeUnimplemented` stubs (`go/server/forge.go`) pending the
    `agent_forge_subscriptions` store writer, which the poll-driver lane owns
-   ([`compass-forge-poll-driver/design.md`](../compass-forge-poll-driver/design.md),
+   ([`compass-forge-poll-driver/design.md`](../../product/compass-forge-poll-driver/design.md),
    DL-163: the tables land writer-less; that lane brings the writer). Matt
    ruled build-all: the tools ship now so the surface is stable and complete;
    the two arms simply error at runtime (rendered as a clean in-band
@@ -362,7 +362,7 @@ hard scope enforcement is A8's frozen deferral, not reopened here.
   churn), and the runtime error is honest — the per-tool guidance states the
   arm is not yet wired, so the model learns "not available yet", not "broken".
   This composes with the poll-driver lane
-  ([`compass-forge-poll-driver/design.md`](../compass-forge-poll-driver/design.md),
+  ([`compass-forge-poll-driver/design.md`](../../product/compass-forge-poll-driver/design.md),
   DL-163: the tables land writer-less; that lane brings the writer).
 - **Deferring the `ForgeRef` (provider/host) selector.** Considered and
   OVERRULED by Matt: expose it now. The wave needs BOTH forges — it files

@@ -385,7 +385,7 @@ PR, per the same-PR-flip rule):
   write-path ruling; explicitly not touched).
 
 `Interfaces:` consumes the frozen records cited above; produces
-`docs/designs/product/compass-agent-primary-lifecycle/design.md` + the
+`docs/designs/agent/compass-agent-primary-lifecycle/design.md` + the
 `DECISIONS.md` delta. Gate: `design-ledger-gate`.
 
 ### T2 — compass-repo: the `BoardCall` proto family + regen (NOT this PR)

@@ -11,7 +11,7 @@ seams: the agent→Server lifecycle relay (spawn + despawn), the missing
 agent-side tool pair. Companion records this composes with:
 [`compass-agent-comms-tools/design.md`](../compass-agent-comms-tools/design.md)
 (the agent-tool + relay pattern this mirrors, DL-028/DL-029),
-[`compass-server-ownership-layer/design.md`](../compass-server-ownership-layer/design.md)
+[`compass-server-ownership-layer/design.md`](../../product/compass-server-ownership-layer/design.md)
 (#995 — the Server as ownership layer; its DL-049 sibling-call-family precedent),
 and [`compass-agent-container-runtime.md`](../compass-agent-container-runtime.md)
 (the provisioning substrate the spawn drives).
@@ -193,7 +193,7 @@ exist inside it is the agent's business, so a spawned peer clones whatever it
 has credentials for, after launch. This mirrors the same removal on
 `ProvisionAgentWorkspaceRequest` (server-side auto-clone is deleted, not made
 optional) — see the ownership record's OQ-4, superseded to *removed*
-([`compass-server-ownership-layer/design.md`](../compass-server-ownership-layer/design.md),
+([`compass-server-ownership-layer/design.md`](../../product/compass-server-ownership-layer/design.md),
 OQ-4). Post-MVP, an agent tool may clone on the agent's behalf so agents need
 hold no git creds; until then the container's scoped credential stands.
 

@@ -87,7 +87,7 @@ Grounding, verified this run:
   - The agent-facing spawn path: `SpawnPeerRequest` on the `AgentGateway`
     lifecycle family, orchestrated server-side through `LifecycleCaller` →
     `store.CreateAgent`
-    (`docs/designs/product/compass-agent-spawn-despawn/design.md:659-662`:
+    (`docs/designs/agent/compass-agent-spawn-despawn/design.md:659-662`:
     `SpawnAsAccount(ctx context.Context, caller store.AccountID, req
     *compassv1internal.SpawnPeerRequest)`). A spawned agent's parent **is
     the spawning agent** — the server resolves the caller's account id at
@@ -308,7 +308,7 @@ curated taxonomy that drifts from it.
 
 ### T1 — this record + ledger row (this PR, docs-only)
 
-Freeze this record at `docs/designs/product/compass-agent-trees/design.md`
+Freeze this record at `docs/designs/agent/compass-agent-trees/design.md`
 and append DL-095 to `docs/designs/product/DECISIONS.md` in the same diff
 (§Ledger delta). No code changes.
 

@@ -3,7 +3,7 @@
 Status: Draft
 
 This record is the RIG-2257 successor to the T7 runner/hub dependency filed by
-`docs/designs/product/compass-ask-comms-roundtrip/design.md` Decision 3. It is
+`docs/designs/agent/compass-ask-comms-roundtrip/design.md` Decision 3. It is
 a pre-freeze rewrite of this same record: Matt ruled the prior draft's
 owed-marker + control-op-wake architecture out (see Alternatives considered),
 in favor of **the answer to an ask becoming a normal message on the existing

@@ -116,7 +116,7 @@ message Ask {
   // The questions, in the order the agent asked them. At least one.
   repeated AskQuestion questions = 6;
   // Superseded single-question shape (compass-0.5 D5); see
-  // docs/designs/product/compass-ask-typed-derivation.md.
+  // docs/designs/agent/compass-ask-typed-derivation.md.
   reserved 2 to 5;
   reserved "question", "options", "allow_multiple", "chosen_option_ids";
 }

@@ -250,7 +250,7 @@ is in NONE of the three bundle whitelists —
 > "`configTopDirs are the only permitted top-level directories in a config
 > bundle` — skills/extensions/mcp/settings/rules/agents"
 >
-> `docs/designs/product/compass-per-agent-overrides/design.md:134-141`
+> `docs/designs/agent/compass-per-agent-overrides/design.md:134-141`
 > (delivery-gap caution, verified): "`prompts/` is in NONE of the bundle
 > whitelists — the store door (`agent_config.go:35-42`), the runner unpack
 > (`config_materialize.go:71-78`), and the CLI bundle builder (`bundle.go:63-70`)

@@ -9,7 +9,7 @@ shape of case-1 (root-manager boot): the seeded root Manager's first turn is a
 Compass-authored **initial Setup thread in its home channel**, sent by a
 **reserved `@compass` system-sender alias** — and scoped the details out to
 this follow-up. Per the parent record
-(`docs/designs/product/compass-first-turn-delivery/design.md:299-301`): "The
+(`docs/designs/agent/compass-first-turn-delivery/design.md:299-301`): "The
 follow-up record owes: the reserved-alias representation, reserved-handle
 validation, Setup-thread creation trigger (root-manager first
 `StartAgentSession`), thread content/versioning, and its ledger rows." This

@@ -309,7 +309,7 @@ touch the agent↔Runner vsock hop (RIG-2394), and it never becomes a second
 store — Postgres remains the durability source of truth, preserving the
 DL-019/DL-020 spirit ("the ring is never a second store; losing it loses no
 committed state",
-`docs/designs/product/compass-architecture-lineage/design.md:52-56`).
+`docs/designs/meta/compass-architecture-lineage/design.md:52-56`).
 
 **What rides the substrate.**
 
@@ -370,7 +370,7 @@ poison message parks instead of redelivering forever.
 NATS on the agent↔Runner hop (frozen vsock, RIG-2394); JetStream as the comms
 **message store** (Postgres write-through is the product's structure — the
 audit/search substrate rationale behind DL-021,
-`docs/designs/product/compass-architecture-lineage/design.md:46-51` — and
+`docs/designs/meta/compass-architecture-lineage/design.md:46-51` — and
 that survives this record intact: JetStream carries delivery, Postgres keeps
 the message).
 

@@ -10,7 +10,7 @@ blocks hosted/GA deployments where the host uid is arbitrary
 preflight-and-refuse is the interim, arbitrary-uid is the GA-blocking
 follow-up — this record). The **launch mechanism is already decided and
 frozen** in the Active record
-`docs/designs/product/compass-agent-container-runtime.md` — T1's uid-mapping
+`docs/designs/agent/compass-agent-container-runtime.md` — T1's uid-mapping
 invariant (`:630-640`), T2's flag switch (`:668-670`: "``Create``
 (`podman.go:347-357`) switches `--userns=keep-id` to
 `--userns=keep-id:uid=<agent-uid>,gid=<agent-gid>`" — `Create` is now at

@@ -24,7 +24,7 @@ The Runner executes Sessions commands strictly serially: `RunSessions`
 that loop for a full container build/pull (minutes), so no Stop, Status,
 despawn, or second spawn can execute on that Runner meanwhile. The
 spawn/despawn record made Provision agent-triggerable in a loop and named the
-exposure (`docs/designs/product/compass-agent-spawn-despawn/design.md:231-233`:
+exposure (`docs/designs/agent/compass-agent-spawn-despawn/design.md:231-233`:
 "A spawn's minutes-long container build/pull therefore head-of-line-blocks
 every other command on that Runner — Stop, Status, despawn, a second spawn, an
 operator reload"). Matt resolved its OQ-6 as accept-for-MVP (`:886-888`:

@@ -230,7 +230,7 @@ fixture from this record. This record does not edit the dogfood-e2e record.
 
 ### A5 — Record placement: standalone product record
 
-`docs/designs/product/compass-test-strategy/design.md` — cross-cutting over
+`docs/designs/meta/compass-test-strategy/design.md` — cross-cutting over
 the verticals and the gate contract, directory-form like its siblings.
 Records freeze on merge; this one supersedes-by-citation and rewrites none.
 It supersedes its own ancestor record in the two amended decisions (D-A1,

@@ -263,7 +263,7 @@ we can swap out on the managed service for a bigger dep."** So:
   dependency — "a deterministic in-memory/fake reference proves each contract
   cheaply, and a live `pgtest` suite proves the real Postgres backend obeys
   the same contract"
-  (`docs/designs/product/compass-test-strategy/design.md:123-128,412-416`).
+  (`docs/designs/meta/compass-test-strategy/design.md:123-128,412-416`).
   Class-2 rollup tables are a natural addition, no new dependency.
 
 The rejected bigger-dep paths are in Alternatives considered.

@@ -17,11 +17,11 @@ load-bearing open forks remain — the record is freeze-ready).
 Composes with the frozen RIG-1715 gateway record
 (`docs/designs/platform/compass-server-llm-gateway/design.md`), the frozen
 RIG-2936 per-Manager profile record
-(`docs/designs/product/compass-per-agent-overrides/design.md`), the
+(`docs/designs/agent/compass-per-agent-overrides/design.md`), the
 config-delivery record
-(`docs/designs/product/compass-agent-config-delivery/design.md`, DL-078),
+(`docs/designs/agent/compass-agent-config-delivery/design.md`, DL-078),
 and the config-passthrough record
-(`docs/designs/product/compass-agent-config-passthrough/design.md`);
+(`docs/designs/agent/compass-agent-config-passthrough/design.md`);
 consumes the RIG-2562 model evaluations (in design in the internal
 fleet-tooling repo) as evidence, not as a blocker.
 

@@ -6,7 +6,7 @@ Status: Active
 > iteration of the Compass ADE dev shell, building on the explorable Bridge
 > walking-skeleton (#453, #460). The product vision it serves and the strategic
 > posture behind it are preserved in the
-> [architecture lineage](../compass-architecture-lineage/design.md) record. This record captures the
+> [architecture lineage](../../meta/compass-architecture-lineage/design.md) record. This record captures the
 > shell's interaction model and the workstream/agent state model — not the daemon
 > or the `compass.v1` wire contract, which stay as those records define them.
 

@@ -9,7 +9,7 @@ parallel — the palette is the *do-an-action* surface, the overlay the
 *reference sheet*; the shared substrate is the App-root dispatcher and
 registry both consume, plus the shared commands-as-inventory rule OWNED by
 the RIG-2529 tier-3 scope-gate record
-(`docs/designs/product/compass-tier3-scope-gate/design.md`) — an external
+(`docs/designs/meta/compass-tier3-scope-gate/design.md`) — an external
 frozen dependency both records cite, never redefine (see A3/D6). No other
 cross-dependency is designed here, but at IMPL time the palette and overlay
 PRs touch the same four App-root wiring lines (`spine.ts` deps + signature,
@@ -244,7 +244,7 @@ expose — OQ-4.
 
 **The shared commands-as-inventory rule** (stated identically in the RIG-2482
 overlay record; OWNED by the RIG-2529 tier-3 scope-gate record,
-`docs/designs/product/compass-tier3-scope-gate/design.md`): *register =
+`docs/designs/meta/compass-tier3-scope-gate/design.md`): *register =
 actionable-from-anywhere; a dispatching surface (this palette's action mode)
 reads the registry, a display surface (the overlay) reads the keymap; a
 command is registered beside its behavior, never purely for discoverability —

@@ -18,7 +18,7 @@ command palette is RIG-2483 (do-an-action surface); this overlay is the
 exhaustive reference sheet.
 The sheet's `list.*` completeness rests on the tier-3 scope gate and
 `list.*` registration owned by **RIG-2529**
-(`docs/designs/product/compass-tier3-scope-gate/design.md`), an external
+(`docs/designs/meta/compass-tier3-scope-gate/design.md`), an external
 frozen dependency of this record — cited the same way this record cites the
 merged RIG-2456 spine (see D8, T2b).
 
@@ -198,7 +198,7 @@ Join semantics:
   (`scope: "main"`) and tier 3 becomes scope-aware, closing the RIG-2130
   RD-4/OQ-6 focus hole. That is a shared-dispatcher change and is OWNED BY
   ITS OWN RECORD, **RIG-2529**
-  (`docs/designs/product/compass-tier3-scope-gate/design.md`), which this
+  (`docs/designs/meta/compass-tier3-scope-gate/design.md`), which this
   record depends on as external frozen substrate — the same way it depends
   on the merged RIG-2456 spine. With RIG-2529 merged, the strict join (D3,
   unchanged) surfaces `?`, `Mod+B`, `Shift+Enter`, AND the `list.*` block.
@@ -378,7 +378,7 @@ toggle flips `shortcutsOpen()`; `toggleShortcuts()` then `showBridge()` →
 **Ratified (Matt, 2026-08-23): the long-term end state.** The eight
 `list.*` commands get registered and tier 3 becomes scope-aware — but that
 change is a shared-dispatcher concern OWNED BY **RIG-2529**
-(`docs/designs/product/compass-tier3-scope-gate/design.md`), an external
+(`docs/designs/meta/compass-tier3-scope-gate/design.md`), an external
 frozen dependency of this record, exactly as the merged RIG-2456 spine is.
 RIG-2529 specifies: tier 3 (`dispatch.ts:122-129`) runs a matched global
 entry's command only if `command.scope === "global"` or it matches the
@@ -558,7 +558,7 @@ failure mode to watch for is a naive resolution silently dropping a dep. No
 design change either way.
 
 **Cross-record substrate note:** RIG-2529
-(`docs/designs/product/compass-tier3-scope-gate/design.md`) is the shared
+(`docs/designs/meta/compass-tier3-scope-gate/design.md`) is the shared
 scope-gate substrate BOTH this record and RIG-2483 cite as an external
 frozen dependency; the overlay and palette impl PRs stack on RIG-2529's
 merge. The four shared App-root regions above remain an impl-time
@@ -646,7 +646,7 @@ four-region App-root conflict above is the separate impl-PR concern.)
 8. **The `list.*` overlay-rows rule is RATIFIED (Matt, 2026-08-23): the
    long-term end state — register the group-relative commands AND make
    tier 3 scope-aware — owned by RIG-2529
-   (`docs/designs/product/compass-tier3-scope-gate/design.md`), an
+   (`docs/designs/meta/compass-tier3-scope-gate/design.md`), an
    external frozen dependency of this record.** The naive drafted shape
    (register against a scope-blind tier 3) stays withdrawn as unsafe;
    RIG-2529's scope gate (run a tier-3 match only when `command.scope` is
@@ -685,7 +685,7 @@ the full rulings live in the Decisions above. In brief:
 2. **The `list.*` block (was OQ2, the blocker).** The principled end state
    — register the eight `list.*` commands AND make tier 3 scope-aware,
    closing RIG-2130 RD-4/OQ-6 — extracted to its own record **RIG-2529**
-   (`docs/designs/product/compass-tier3-scope-gate/design.md`), which this
+   (`docs/designs/meta/compass-tier3-scope-gate/design.md`), which this
    record consumes as external frozen substrate (D8, T2b). Neither the
    group-relative-rendering workaround nor deferral to RIG-2483 was taken.
 3. **Shift-drop scope (was OQ3).** The GENERAL rule — drop `Shift` for a