Risks and Open Questions

Companion to 070-roadmap.md. Two artifacts live here:

1. The risk register — reviewed at every phase gate; likelihood/impact are updated from observed evidence, not from anxiety.
2. The open questions — each carries a working default that holds until explicitly overturned. Overturning a default requires updating this table and every affected design doc in the same commit.

1. Risk register

Likelihood and impact use a simple Low / Medium / High scale. The mitigation column names the enforcing mechanism: a design rule, a command check, or a specific phase gate in 070-roadmap.md.

Notes on the three structural risks

• R1 (pane contract). This is the highest-leverage discipline in the project: every temptation to “just grep the pane” for completion or status must be redirected to the signal ladder. The pane-idle heuristic exists only to tint a UI badge, and the enforcement point is code review plus the design rule in the tmux-executor doc — there is no lint for intent.
• R3 (provider drift). Likelihood is rated High because subscription CLIs update themselves on their own schedule; the register assumes at least one breaking auto-update per provider per year. The TOML catalog exists largely for this risk: re-pinning or re-templating argv must never require a Rust release.
• R10/R11 (partition and transport). These replaced the old R9 scope guard when the design pivoted to multi-host (ADR-012). The partition risk is bounded by making the worker self-sufficient (local run cache + signal spool) rather than by trying to keep connections alive; the transport risk is bounded by token-class separation and operator-provisioned workers (a worker can never self-register).

2. Open questions

Defaults are current working assumptions, not decisions. “Blocks phase” names the phase whose design must freeze the answer; “none” means the default can hold indefinitely without rework.

3. Decision schedule

When each open question must actually be answered, relative to the roadmap in 070-roadmap.md:

Governance rule: an overturned default is not complete until this table, the affected design doc(s), and any already-written code or contract move in the same commit. A default changed in conversation but not in this file has not changed.