chore: file the interview-context intent and close the openpgp advisory finding

.abcd/development/brief/06-delivery/03-out-of-scope.md

@@ -108,6 +108,7 @@ gate. That is what keeps "not hand-counted" true after the day it was written.
 - `itd-175` — The product thinker writes down how this could be wrong, and what would show it (Phase 8; the defeater list an acceptance rests on)
 - `itd-176` — Whatever ships says how hard anyone looked at it (Phase 7)
 - `itd-201` — every question abcd's agents put to a human is asked one at a time, in plain language, in the addressee's register, with options that widen
+- `itd-2609151541116052` — every question an interview puts to a human shows the thing being decided before it asks, at every step (refines itd-201)
 - `itd-2609091014076309` — Session and agent worktrees live in a machine-scoped store (`~/.abcd/worktrees/<root-sha>/<name>/`) that abcd lists and reclaims, never beside the user's own projects (the rule is adr-2609091248200336; `builds_on` itd-118, whose worktree clause it supplies the store and the reclaim verb for)
 - `itd-2609091416295622` — A session sees the records its sibling worktrees hold before it mints or fixes one: a read-only ledger diff over `git worktree list --porcelain` (open there and absent here; open here and terminal there), a line on the `/abcd` board and on the record dispatch, no claim and no write (split from itd-2609091034175565 on the maintainer's ruling of 2026-09-09; the shippable piece)
 - `itd-2609091416304128` — `capture resolve` and `capture wontfix` refuse a record already terminal at the local `origin/main` ref as last fetched, stating the ref's age and performing no fetch; the same judgement rendered read-only on `abcd <record-id>` (split from itd-2609091034175565 on the same ruling; the third clause of iss-2609020716570699's remedy, RS001's answer moved earlier)

.abcd/development/intents/drafts/itd-2609151541116052-every-question-an-abcd-interview-puts-to-a-human-shows-the-t.md

@@ -0,0 +1,43 @@
+---
+id: itd-2609151541116052
+slug: every-question-an-abcd-interview-puts-to-a-human-shows-the-t
+spec_id: null
+kind: null
+suggested_kind: null
+reclassification_history: []
+builds_on: []
+severity: minor
+impact: additive
+origin: researcher-authored
+production_mode: dictated-and-formatted
+---
+
+# Every question an abcd interview puts to a human shows the thing being decided before it asks: the acceptance criterion's full text before asking whether it stands, the press-release paragraph before asking to confirm or refine it, the open question before asking to resolve or defer it, the mechanism and scope-condition text before asking about them, at every step of every interview
+
+## Press Release
+
+> _Seeded from a quoted-text intent capture. Expand into the full press-release narrative before planning._
+
+## Why This Matters
+
+Every question an abcd interview puts to a human shows the thing being decided before it asks: the acceptance criterion's full text before asking whether it stands, the press-release paragraph before asking to confirm or refine it, the open question before asking to resolve or defer it, the mechanism and scope-condition text before asking about them, at every step of every interview
+
+## Mechanism
+
+> _Prompted (the claim-recording gradient): why the authors expect this to work, as a falsifiable "we expect X because Y" — not the outcome restated. Replace this line with the claim, or with the exact token `None stated.` alone on its line to record the claim as considered and declined._
+
+## Scope Conditions
+
+> _Required (the claim-recording gradient): the population, platform, scale, or assumptions this claim holds under, one per top-level bullet — `abcd intent plan` stamps each with a persistent identity. Replace this line with those bullets, or with the exact token `None stated.` alone on its line._
+
+## Acceptance Criteria
+
+> _Required (the itd-1 discipline): add at least one Given-When-Then bullet describing the verifiable bar for "shipped" before this draft can be planned._
+
+## Open Questions
+
+_None recorded yet._
+
+## Audit Notes
+
+_Empty. Populated by intent-auditor when intent moves to shipped/._

.abcd/work/issues/wontfix/iss-2609151542247232-ghsa-6xpc-3w4h-frfh-draft-govulncheck-go-2026-5932-reports-g.md

@@ -0,0 +1,19 @@
+---
+schema_version: 1
+id: "iss-2609151542247232"
+slug: "ghsa-6xpc-3w4h-frfh-draft-govulncheck-go-2026-5932-reports-g"
+severity: "minor"
+category: "security"
+source: "agent-finding"
+found_during: "security-advisory triage 2026-09-15"
+origin: researcher-authored
+production_mode: hand-written
+found_at: "go.mod"
+wontfix_reason: "The package is not in the binary: no import of golang.org/x/crypto/openpgp exists, x/crypto is indirect through minisign and selfupdate, and govulncheck's symbol scan is clean. The advisory is a module-level duplicate of a govulncheck candidate and closes against this record."
+---
+
+GHSA-6xpc-3w4h-frfh (draft, govulncheck GO-2026-5932) reports golang.org/x/crypto/openpgp as unmaintained and unsafe by design. Traced on main at 44261a68: the main module imports no openpgp package (go mod why: the main module does not need it; go list -deps finds zero openpgp packages), golang.org/x/crypto v0.55.0 is an indirect dependency reached only through internal/core/update via minio/selfupdate and aead.dev/minisign (blake2b), and govulncheck's symbol-level scan reports zero vulnerabilities the code calls, with the module-level notice covering only packages the binary never links. The advisory's own status field marks it a duplicate of the govulncheck candidate. Nothing in the tree uses the package, so there is nothing to replace or remove; the finding is recorded so the draft advisory can be closed against it.
+
+## Grounds
+
+- declined: replacing or removing a dependency the binary never links would change nothing the scan measures; if a future dependency pulls openpgp into the link, govulncheck's symbol scan in CI is what would show this record wrong