docs: Chunk 3 grill, PRD, ADRs, and doc updates

- docs/prd/chunk-3-skills-library.md: PRD for 42-skill library rebuild;
  AGENTS.md refactor as prerequisite; factory bootstrap order (write-eval
  first); source field schema; upstream review cadence; design phase
  sequence; IaC/Gitea scope decisions
- docs/adr/0011-provider-agnostic-issue-tracker.md: file-based default,
  Gitea as provider adapter, "issue" as canonical cross-provider term
- docs/adr/0012-agents-md-provider-agnostic-entry-point.md: AGENTS.md as
  content source, CLAUDE.md as thin adapter; partially supersedes ADR-0005
- CONTEXT.md: 8 new glossary terms (AGENTS.md, skill composition, source
  field, provider-agnostic issue tracker, design phase sequence, PRD scope,
  issue scope, bidirectional reference principle); CLAUDE.md index model
  updated; stale workflow example fixed
- docs/ROADMAP.md: changelog tooling and IaC/Gitea scope resolved; when:
  field question updated; Chunk 3 grill housekeeping note added
- docs/spec/overview.md: Chunk 3 target updated with PRD link, skill count,
  and AGENTS.md prerequisite

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -81,11 +81,11 @@ Items consciously not resolved — to be addressed in the relevant chunk PRD or
 | QA agent design — what does automated agent testing look like in practice? | Grill before Chunk 5 (agents) |
 | Automated deployment pipeline — CI/CD beyond gitops convention | Chunk 6 grill |
 | Formal CI gate for `/improve-codebase-architecture` | Chunk 6 grill |
-| Changelog tooling — which generator (git-cliff, conventional-changelog, etc.) and where it runs | Chunk 3 grill |
-| Content index frontmatter — replace inline `when:` hints in CLAUDE.md content index with a `when:` field in each instruction/skill file so the agent discovers load conditions from the file itself. Cover before implementing Chunk 3 skills. | Chunk 3 grill |
+| ~~Changelog tooling — which generator (git-cliff, conventional-changelog, etc.) and where it runs~~ | ✅ Resolved — Chunk 3 grill. **git-cliff** selected (Rust binary, no runtime deps, Gitea-compatible). `cliff.toml` config in Chunk 3; CI integration in Chunk 6. `review/changelog-entry` skill handles prose release notes where commit messages are insufficient. |
+| Content index frontmatter — bidirectional reference convention: files referencing others should carry a `when:` field in frontmatter; the referencing file (e.g. CLAUDE.md content index) and the referenced file should both document the relationship. `.claude/rules/` path-scoped rules resolve the path-based case natively. Reference scanner (reverse map: "what files point to X?") deferred to Chunk 6 tooling. Full `when:` field resolution deferred to Chunk 4+. | Chunk 4+ / Chunk 6 tooling |
 | ~~Skill taxonomy — flat vs nested paths, category organisation~~ | ✅ Resolved — factory integration grill. Flat paths (Claude Code + agentskills.io standard enforce one-level-deep discovery). Categories via `metadata: category:` in SKILL.md frontmatter. See ADR-0009. |
 | ~~Factory boundary — which factory features belong here vs project repos~~ | ✅ Resolved — factory integration grill. This repo is a provider (ADR-0008). LESSONS.md and docs/spec/ are exceptions: added here because this repo also develops itself. IaC and Gitea skills are global optional. Role skills in .agents/skills/; core/agents/ for subagent definitions (ADR-0010). |
-| IaC and Gitea skill scope — which specific skills to include in the global optional set, and in what order | Chunk 3 PRD |
+| ~~IaC and Gitea skill scope — which specific skills to include in the global optional set, and in what order~~ | ✅ Resolved — Chunk 3 PRD. IaC in Chunk 3: `write-docker-compose` + `iac-security-review`. Deferred: Ansible, Molecule, Terraform, K8s, Proxmox. Gitea skills moved to `providers/gitea/` provider adapter — not part of the core library. |
 | Agent behavior confirmation model — writes/edits/git currently require stating intent + approval before acting. Loosen to autonomy-first once skills and workflows are proven and automated agents replace direct interaction. | Phase 2 refinement (post Chunk 4) |
 | ~~CLAUDE.md always-on refinement — security floor (no credentials/auth URLs), scope discipline (no over-engineering), tool preference (Read/Edit over Bash); **plus instruction quality**: current rules are thin one-liners observed in practice to lose to RLHF-trained defaults (verbose responses, validating user positions); fix is specificity, counter-examples, and boundary framing — not accepting violations as expected. Needs its own grill session → PRD before implementation.~~ | ✅ Resolved — Governance workstream Phase 1. `core/instructions/governance.md` loaded via `@import` covers hard prohibitions, data classification, HITL, sycophancy resistance, and deterministic execution preference. Instruction quality principle documented in `CONTEXT.md`. |
 
@@ -98,3 +98,4 @@ Items consciously not resolved — to be addressed in the relevant chunk PRD or
 - **Chunk 2 behavioral tests** — run and fully resolved 2026-05-17. 7/8 pass; scenario 4 (push confirmation) inconclusive — no remote in test environment, rule tightened but unverified. All fixable failures addressed: rule specificity in `providers/claude-code/CLAUDE.md`; context-loading guarantee via `@import CONTEXT.md` in repo CLAUDE.md; standing rule in CONTEXT.md to check `docs/adr/` and ROADMAP resolved entries before answering design questions. Chunk 2 ✅ complete.
 - **Governance Phase 1 behavioral tests** — run 2026-05-17. 3/4 testable scenarios pass. Secrets rule gap fixed (2026-05-17): extended to cover credential reproduction in response text and examples, with placeholder requirement added to `core/instructions/governance.md`. HITL scenario not testable in this environment (Nginx not installed); HITL gap evidenced by instructions test scenario 4 — push confirmation rule fix addresses the same root cause. Governance Phase 1 ✅ complete.
 - **AI ethics/security workstream** — `docs/notes/ai-ethics-security-principles.md` exploration note is superseded. Governance Phase 1 (`core/instructions/governance.md`) covers all planned scope: credentials, data classification, HITL, scope discipline, agent autonomy, transparency, and security code review. Tier-placement architectural question resolved by the `@import` always-on model. No separate workstream needed.
+- **Chunk 3 grill complete** — 2026-05-17. PRD at `docs/prd/chunk-3-skills-library.md`. Key decisions: 42-skill target library, AGENTS.md refactor as prerequisite issue (both CLAUDE.md files become thin adapters), git-cliff for changelog, provider-agnostic issue tracker abstraction, grill-me/grill-lean design phase split, factory bootstrap order (write-eval first). ADRs written: 0011 (provider-agnostic issue tracker), 0012 (AGENTS.md governance entry point, partially supersedes ADR-0005). Upstream review cadence: per-chunk start + quarterly post-roadmap.