Add versioned effective policy

DEVELOPMENT_NOTES.md

@@ -344,3 +344,47 @@ These are notes, not commitments:
 - Cursor authentication remains deliberately absent. If read cursors ever carry authority rather
   than bounded positions, they will need a different versioned security contract and persisted key
   lifecycle.
+
+## Milestone 2 — active: agent retrieval and MCP experience
+
+### Audit reconciliation
+
+Three independent read-only audits covered effective policy and bootstrap, task-shaped retrieval
+and context capsules, and generation diffs plus client configuration and doctor checks.
+
+They agreed on these boundaries:
+
+- Keep the project descriptor at schema version 1. Process capability and client configuration are
+  machine-specific bindings, not canonical project content.
+- Preserve the legacy adapter-policy payload, no-AST shorthand, tool names, default tool ordering,
+  one-method adapters, and custom context provider.
+- Add one versioned effective-policy authority and derive bootstrap, contract, instructions, and
+  access reporting from it.
+- Add one task-context operation with a closed task-kind vocabulary and one immutable,
+  generation-pinned retrieval plan. Do not create a tool for every task kind.
+- Produce evidence gaps only from declared plan requirements and completed bounded checks. Never
+  infer missing facts from arbitrary project naming.
+- Record only the latest bounded generation transition as disposable evidence. Do not add a
+  history database.
+- Preview client configuration by default. Any write must be explicit, atomic, merge-preserving,
+  and backed by a verified client-format driver.
+- Keep doctor strictly read-only. It must not bootstrap, synchronize, build, render, start a
+  viewer, or rewrite client configuration.
+
+### Versioned effective policy and session contract
+
+The binding now composes an immutable version-1 policy containing capability mode, adapter
+evolution, AST and Logic behavior, synchronization and integrity levels, render and viewer
+behavior, profiling, blocked tools, prohibitions, and explicit precedence. `--no-ast` is a
+restrictive override. The exact legacy `adapter_policy` response remains a projection of the new
+object.
+
+Bootstrap reuses the identity already proven by synchronization and no longer reloads the complete
+project. Its additive version-1 session contract reports binding, generation, effective policy,
+actual registered surfaces and mutation access, render policies, first operation, filtered
+workflow, and prohibitions. Read mode does not recommend proposals. Proposal mode recommends
+registration and review only with writer access. Application is recommended only when the
+exact-hash applier is enabled.
+
+Existing factory defaults and tool order remain unchanged. Explicit application mode fails closed
+without an applier. Operator mode is reserved and currently adds no tools.