RigelBuild · mattwilkinsonn · Sep 1, 2026 · Sep 1, 2026
@@ -2082,7 +2082,7 @@ jobs:
         # separate, secret-bearing per-PR job (the LIVEGITHUB_*/LINEAR_FORGE testbed
         # creds), so "the PR gate carries no secrets" is now true of the dogfood
         # tier alone — see the record
-        # docs/designs/product/compass-forge-integration-testing.
+        # docs/designs/server/compass-forge-integration-testing.
         #
         # Same capture-replay-exit shape as the moon job's suites: redirect (not
         # a `| tee` pipeline, whose exit status is tee's 0 and would swallow a

@@ -17,7 +17,7 @@
 // lane removes on migration (Matt ruling 2026-08-15) — the ratchet stays whole,
 // so any NEW raw motion reds CI.
 //
-// Refs RIG-2034; design: docs/designs/product/compass-ds-token-cutover/design.md (e)
+// Refs RIG-2034; design: docs/designs/ui/compass-ds-token-cutover/design.md (e)
 module.exports = {
 	rules: {
 		// D7 ban 1a — raw hex color literals. Catches hex in properties stylelint

@@ -11,7 +11,7 @@ import { BadgeGlyph } from "./BadgeGlyph";
 // a CSS-selector change could silently break.
 
 // The six frozen glyph grids, transcribed verbatim from the ASCII art in
-// docs/designs/product/compass-badge-clarity/design.md §"The six glyph grids"
+// docs/designs/ui/compass-badge-clarity/design.md §"The six glyph grids"
 // (`#` = lit, `.` = off; 9×9). This is an INDEPENDENT copy of the contract —
 // the component transcribes the same grids into [x,y] coordinate arrays, so
 // comparing the rendered rects against these grids catches a wrong grid even

@@ -24,8 +24,8 @@ the thread is where the exchanges that matter live, indexed per conversation.
 This is **structural, not a prompting convention**. The only path that writes a
 comms message is an explicit post; a streamed turn writes nothing to comms. An
 agent cannot flood a channel just by thinking out loud — it must deliberately
-post. See the [Zulip threading model](../designs/product/compass-zulip-threading-model/design.md)
-record (ledger DL-098, DL-099) and [session persistence](../designs/product/compass-agent-session-persistence/design.md)
+post. See the [Zulip threading model](../designs/server/compass-zulip-threading-model/design.md)
+record (ledger DL-098, DL-099) and [session persistence](../designs/agent/compass-agent-session-persistence/design.md)
 (the log and the live trace are two projections of one artifact, DL-088).
 
 ## The session log is read-only — you never prompt into a session
@@ -65,7 +65,7 @@ Because communication is a first-class surface rather than a log tail, a comms
 message can carry **typed blocks** richer than plain text — most notably a
 structured **`ask`** (a question with discrete answer options): it is *posted*
 over the comms lane like any message, and its answer is *correlated back* over
-the control lane (see [the ask round-trip](../designs/product/compass-ask-comms-roundtrip/design.md),
+the control lane (see [the ask round-trip](../designs/agent/compass-ask-comms-roundtrip/design.md),
 ledger DL-211). More typed block kinds are planned. These are native to
 Compass's comms surface and do not necessarily project onto a flatter external
 message vocabulary.

@@ -50,7 +50,7 @@ built on top of it, out of tree.
 - **Public URL is per-deployment.** Managed is `compass.rigel.build`; a
   self-hosted deploy sets its own. The core reads a public-base-URL config value
   (flag + env), never a hardcoded host — see
-  [`compass-linear-agent-responder`](../designs/product/compass-linear-agent-responder/design.md).
+  [`compass-linear-agent-responder`](../designs/server/compass-linear-agent-responder/design.md).
 - **Bundled dependencies default on, with a clean external opt-out.** The
   self-hosted stack bundles its postgres by default and exposes
   `--database-external`; the managed tier supplies its own. Future bundled deps

@@ -82,7 +82,7 @@ this record rides its `RunnerCallTransport` seam and does not re-decide it.
   ruleset" (`go/internal/runtime/egress.go:7-9`). The container-runtime record
   moves the MVP *policy* to default-open but keeps the mechanism and the moat
   rationale — "blast-radius containment"
-  (`docs/designs/product/compass-agent-container-runtime.md:77`, `:206-217`) —
+  (`docs/designs/agent/compass-agent-container-runtime.md:77`, `:206-217`) —
   and per-agent restriction stays "a future opt-in" (`:216-217`). A Unix socket
   is not a network address, so the frozen transport opens no port and disturbs
   no egress posture; nothing in this record's comms legs relies on or perturbs

@@ -4,7 +4,7 @@ Status: Active
 
 Design for how a per-agent Compass container gets its **toolchain**, its
 **credentials**, and stays **current** over a long-lived session, on the Go
-stack (`go`). Companion to the [architecture lineage](compass-architecture-lineage/design.md)
+stack (`go`). Companion to the [architecture lineage](../meta/compass-architecture-lineage/design.md)
 record (the isolation and container-runtime rationale). All grounding
 is against the working tree at `6b192e731` (branch
 `compass-sea-1327-container-runtime-design`); `oss/` is byte-identical to

@@ -16,7 +16,7 @@ its T3) and the lifecycle tools (`packages/compass-agent/src/lifecycle.ts`):
 same broker shape, same identity model, same registration path. Everything
 below the agent — the Server write chokepoint, the hub relay, the Runner
 gateway leg, and the proto carrier — is COMPLETE and frozen elsewhere
-([`compass-forge-write-path/design.md`](../compass-forge-write-path/design.md));
+([`compass-forge-write-path/design.md`](../../server/compass-forge-write-path/design.md));
 this record consumes it and designs nothing on the Go side.
 
 **Grounding.** This record and the code it describes live together in this
@@ -72,7 +72,7 @@ else.
    in-band `unimplemented` until the writer lands.** The backend arms are
    `CodeUnimplemented` stubs (`go/server/forge.go`) pending the
    `agent_forge_subscriptions` store writer, which the poll-driver lane owns
-   ([`compass-forge-poll-driver/design.md`](../compass-forge-poll-driver/design.md),
+   ([`compass-forge-poll-driver/design.md`](../../server/compass-forge-poll-driver/design.md),
    DL-163: the tables land writer-less; that lane brings the writer). Matt
    ruled build-all: the tools ship now so the surface is stable and complete;
    the two arms simply error at runtime (rendered as a clean in-band
@@ -362,7 +362,7 @@ hard scope enforcement is A8's frozen deferral, not reopened here.
   churn), and the runtime error is honest — the per-tool guidance states the
   arm is not yet wired, so the model learns "not available yet", not "broken".
   This composes with the poll-driver lane
-  ([`compass-forge-poll-driver/design.md`](../compass-forge-poll-driver/design.md),
+  ([`compass-forge-poll-driver/design.md`](../../server/compass-forge-poll-driver/design.md),
   DL-163: the tables land writer-less; that lane brings the writer).
 - **Deferring the `ForgeRef` (provider/host) selector.** Considered and
   OVERRULED by Matt: expose it now. The wave needs BOTH forges — it files

@@ -53,7 +53,7 @@ owner-pull. No new delivery rail, no new authz model.
 
 Matt: ids are a leak; client UIs and agents address channels and topics only
 by their actual name. The precedent is the merged handle-addressing cutover
-(`docs/designs/product/compass-handle-addressing-cutover/design.md`, PR #698,
+(`docs/designs/server/compass-handle-addressing-cutover/design.md`, PR #698,
 RIG-2880), whose pattern this record mirrors exactly:
 
 - **Request-INPUT** fields carry the name, resolved to an id at the service

@@ -4,7 +4,7 @@ Status: Active
 Tracker: SEA
 
 > **Amends frozen contract (#1018, DL-091 / DL-032).** This record is a
-> sibling amendment to `docs/designs/product/compass-issue-model/design.md`
+> sibling amendment to `docs/designs/server/compass-issue-model/design.md`
 > (merged in #1018) and composes with the DL-070 server projection it froze.
 > It ratifies Matt's 2026-08-04 ruling that the board lifecycle is
 > **agent-primary**: "i'm not sure we should even have the UI move cards? i
@@ -385,7 +385,7 @@ PR, per the same-PR-flip rule):
   write-path ruling; explicitly not touched).
 
 `Interfaces:` consumes the frozen records cited above; produces
-`docs/designs/product/compass-agent-primary-lifecycle/design.md` + the
+`docs/designs/agent/compass-agent-primary-lifecycle/design.md` + the
 `DECISIONS.md` delta. Gate: `design-ledger-gate`.
 
 ### T2 — compass-repo: the `BoardCall` proto family + regen (NOT this PR)

@@ -11,7 +11,7 @@ seams: the agent→Server lifecycle relay (spawn + despawn), the missing
 agent-side tool pair. Companion records this composes with:
 [`compass-agent-comms-tools/design.md`](../compass-agent-comms-tools/design.md)
 (the agent-tool + relay pattern this mirrors, DL-028/DL-029),
-[`compass-server-ownership-layer/design.md`](../compass-server-ownership-layer/design.md)
+[`compass-server-ownership-layer/design.md`](../../server/compass-server-ownership-layer/design.md)
 (#995 — the Server as ownership layer; its DL-049 sibling-call-family precedent),
 and [`compass-agent-container-runtime.md`](../compass-agent-container-runtime.md)
 (the provisioning substrate the spawn drives).
@@ -193,7 +193,7 @@ exist inside it is the agent's business, so a spawned peer clones whatever it
 has credentials for, after launch. This mirrors the same removal on
 `ProvisionAgentWorkspaceRequest` (server-side auto-clone is deleted, not made
 optional) — see the ownership record's OQ-4, superseded to *removed*
-([`compass-server-ownership-layer/design.md`](../compass-server-ownership-layer/design.md),
+([`compass-server-ownership-layer/design.md`](../../server/compass-server-ownership-layer/design.md),
 OQ-4). Post-MVP, an agent tool may clone on the agent's behalf so agents need
 hold no git creds; until then the container's scoped credential stands.
 

@@ -87,7 +87,7 @@ Grounding, verified this run:
   - The agent-facing spawn path: `SpawnPeerRequest` on the `AgentGateway`
     lifecycle family, orchestrated server-side through `LifecycleCaller` →
     `store.CreateAgent`
-    (`docs/designs/product/compass-agent-spawn-despawn/design.md:659-662`:
+    (`docs/designs/agent/compass-agent-spawn-despawn/design.md:659-662`:
     `SpawnAsAccount(ctx context.Context, caller store.AccountID, req
     *compassv1internal.SpawnPeerRequest)`). A spawned agent's parent **is
     the spawning agent** — the server resolves the caller's account id at
@@ -308,7 +308,7 @@ curated taxonomy that drifts from it.
 
 ### T1 — this record + ledger row (this PR, docs-only)
 
-Freeze this record at `docs/designs/product/compass-agent-trees/design.md`
+Freeze this record at `docs/designs/agent/compass-agent-trees/design.md`
 and append DL-095 to `docs/designs/product/DECISIONS.md` in the same diff
 (§Ledger delta). No code changes.
 

@@ -3,7 +3,7 @@
 Status: Draft
 
 This record is the RIG-2257 successor to the T7 runner/hub dependency filed by
-`docs/designs/product/compass-ask-comms-roundtrip/design.md` Decision 3. It is
+`docs/designs/agent/compass-ask-comms-roundtrip/design.md` Decision 3. It is
 a pre-freeze rewrite of this same record: Matt ruled the prior draft's
 owed-marker + control-op-wake architecture out (see Alternatives considered),
 in favor of **the answer to an ask becoming a normal message on the existing

@@ -116,7 +116,7 @@ message Ask {
   // The questions, in the order the agent asked them. At least one.
   repeated AskQuestion questions = 6;
   // Superseded single-question shape (compass-0.5 D5); see
-  // docs/designs/product/compass-ask-typed-derivation.md.
+  // docs/designs/agent/compass-ask-typed-derivation.md.
   reserved 2 to 5;
   reserved "question", "options", "allow_multiple", "chosen_option_ids";
 }

@@ -250,7 +250,7 @@ is in NONE of the three bundle whitelists —
 > "`configTopDirs are the only permitted top-level directories in a config
 > bundle` — skills/extensions/mcp/settings/rules/agents"
 >
-> `docs/designs/product/compass-per-agent-overrides/design.md:134-141`
+> `docs/designs/agent/compass-per-agent-overrides/design.md:134-141`
 > (delivery-gap caution, verified): "`prompts/` is in NONE of the bundle
 > whitelists — the store door (`agent_config.go:35-42`), the runner unpack
 > (`config_materialize.go:71-78`), and the CLI bundle builder (`bundle.go:63-70`)

@@ -9,7 +9,7 @@ shape of case-1 (root-manager boot): the seeded root Manager's first turn is a
 Compass-authored **initial Setup thread in its home channel**, sent by a
 **reserved `@compass` system-sender alias** — and scoped the details out to
 this follow-up. Per the parent record
-(`docs/designs/product/compass-first-turn-delivery/design.md:299-301`): "The
+(`docs/designs/agent/compass-first-turn-delivery/design.md:299-301`): "The
 follow-up record owes: the reserved-alias representation, reserved-handle
 validation, Setup-thread creation trigger (root-manager first
 `StartAgentSession`), thread content/versioning, and its ledger rows." This

@@ -828,7 +828,7 @@ reports without gating.
    never rewrites): D2's no-secrets, deterministic per-PR cadence governs THIS
    dogfood tier and is unchanged. A separate secret-bearing forge live-oracle
    step joins the per-PR gate as its own decision (DL-210,
-   [forge integration testing](../../product/compass-forge-integration-testing/design.md));
+   [forge integration testing](../../../server/compass-forge-integration-testing/design.md));
    it does not modify this tier.
 3. **D3 — Harness shape (Decision, Matt, 2026-08-05): option C.** A
    `//go:build podman` Go test suite over the merged compass-stack bring-up

@@ -10,7 +10,7 @@ blocks hosted/GA deployments where the host uid is arbitrary
 preflight-and-refuse is the interim, arbitrary-uid is the GA-blocking
 follow-up — this record). The **launch mechanism is already decided and
 frozen** in the Active record
-`docs/designs/product/compass-agent-container-runtime.md` — T1's uid-mapping
+`docs/designs/agent/compass-agent-container-runtime.md` — T1's uid-mapping
 invariant (`:630-640`), T2's flag switch (`:668-670`: "``Create``
 (`podman.go:347-357`) switches `--userns=keep-id` to
 `--userns=keep-id:uid=<agent-uid>,gid=<agent-gid>`" — `Create` is now at

@@ -24,7 +24,7 @@ The Runner executes Sessions commands strictly serially: `RunSessions`
 that loop for a full container build/pull (minutes), so no Stop, Status,
 despawn, or second spawn can execute on that Runner meanwhile. The
 spawn/despawn record made Provision agent-triggerable in a loop and named the
-exposure (`docs/designs/product/compass-agent-spawn-despawn/design.md:231-233`:
+exposure (`docs/designs/agent/compass-agent-spawn-despawn/design.md:231-233`:
 "A spawn's minutes-long container build/pull therefore head-of-line-blocks
 every other command on that Runner — Stop, Status, despawn, a second spawn, an
 operator reload"). Matt resolved its OQ-6 as accept-for-MVP (`:886-888`:

@@ -4,7 +4,7 @@ Status: Active
 
 Tracker: RIG-1611 — PR #75 review LOW #3, parked at review time ("no change for
 MVP, multi-Runner only"). Provenance: the parent product record
-`docs/designs/product/compass-notification-delivery/design.md` (RIG-1569 T3)
+`docs/designs/server/compass-notification-delivery/design.md` (RIG-1569 T3)
 ships the fan-out consumer whose head-of-line blocking motivates this record;
 that record is frozen (`Status: Active`) and is cited, never edited. This is
 the **SERVER-side counterpart** to the already-**MERGED** RUNNER-side work

@@ -48,7 +48,7 @@ citing `packages/compass-agent/src/mapping.ts:16-19`:
 > not opaque bytes, and explicitly **not ACP**."
 
 The sibling record even flags the comment as stale
-(`docs/designs/product/compass-message-surface-rendering/design.md:448-451`:
+(`docs/designs/ui/compass-message-surface-rendering/design.md:448-451`:
 "Compass-0.8 ruled the trace 'not opaque bytes, and explicitly **not ACP**'
 … the comment's vintage is stale") — but no surface an agent reads *first*
 carried the supersession. Supersession churn is real and concentrated:

@@ -17,11 +17,11 @@ load-bearing open forks remain — the record is freeze-ready).
 Composes with the frozen RIG-1715 gateway record
 (`docs/designs/platform/compass-server-llm-gateway/design.md`), the frozen
 RIG-2936 per-Manager profile record
-(`docs/designs/product/compass-per-agent-overrides/design.md`), the
+(`docs/designs/agent/compass-per-agent-overrides/design.md`), the
 config-delivery record
-(`docs/designs/product/compass-agent-config-delivery/design.md`, DL-078),
+(`docs/designs/agent/compass-agent-config-delivery/design.md`, DL-078),
 and the config-passthrough record
-(`docs/designs/product/compass-agent-config-passthrough/design.md`);
+(`docs/designs/agent/compass-agent-config-passthrough/design.md`);
 consumes the RIG-2562 model evaluations (in design in the internal
 fleet-tooling repo) as evidence, not as a blocker.
 

@@ -4,7 +4,7 @@ Status: Superseded by compass-native-app/design.md
 
 Design for the Compass desktop shell (RIG-1022): the thin native app that hosts
 the UI webview and connects it to the Compass daemon. Companion to the
-[architecture lineage](compass-architecture-lineage/design.md) record and the transport spec
+[architecture lineage](../meta/compass-architecture-lineage/design.md) record and the transport spec
 [`../../specs/product/compass.md`](../../specs/product/compass.md).
 
 ## Problem / Intent

@@ -4,7 +4,7 @@ Status: Active
 Tracker: SEA
 
 > **Amends frozen contract (#1018, DL-068).** This record is a sibling
-> amendment to `docs/designs/product/compass-issue-model/design.md` (merged in
+> amendment to `docs/designs/server/compass-issue-model/design.md` (merged in
 > #1018): the merged record is frozen, so a later change ADDS a record. It
 > ratifies Matt's 2026-08-01 ruling that agent attribution is a plain display
 > fact — not a trust claim — reversing DL-068's hedge-unless-verified board
@@ -135,7 +135,7 @@ Author this record; add DL-094 (the display-fact contract); flip DL-068 to
 supersede is warranted (see §Ledger delta for the DL-092 judgment).
 
 `Interfaces:` consumes the frozen records cited above; produces
-`docs/designs/product/compass-attribution-simplification/design.md` and the
+`docs/designs/server/compass-attribution-simplification/design.md` and the
 `DECISIONS.md` delta (DL-094 + the DL-068 flip). Gate: `design-ledger-gate`.
 
 ### T2 — proto: slim `AgentAttribution` (compass repo; NOT this PR)

@@ -41,7 +41,7 @@ Six threads:
    app-actor is a delegation endpoint that cannot be *assigned* work
    (responder record: "a delegation is routed to the right stable Compass
    Manager … the Linear session is a doorway, not a home",
-   `docs/designs/product/compass-linear-agent-responder/design.md:42-45`), so
+   `docs/designs/server/compass-linear-agent-responder/design.md:42-45`), so
    a live end-to-end delegation needs a user identity to perform the
    human→app handoff.