ADR-0009: tiers L1/L2/L3, the local live branch, the trellis CLI

Status: accepted (2026-07-06)

Context

The trial chapter’s three tiers of permanence worked as a mental model but had no machinery: L2 tolerated “imperative in $HOME” as an untracked soft spot, and nothing could enumerate what was live-but-not-landed. The reboot-prep ritual was a skill prompt, not a tool.

Decision

Make the tiers first-class via the trellis CLI and a local live branch. L1: trellis try CMD executes and journals to a tmpfs L1 journal; dies at reboot. L2: trellis keep = commit on live + nix build + hand the human the pkexec activation; the machine builds from live, so main..live IS the mechanically enumerable not-yet-landed set. L3: trellis land squashes live commits into a PR to main, CI gates it, the human merges, trellis sync rebases live. trellis gate is the pre-reboot review (since-boot sweep, hyprctl drift, journal replay, main..live). Clean-tree invariant: a dirty tree is a transient authoring state, never a storage tier - the ward-os “imperative-in-$HOME as tolerated L2 debt” category is abolished.

Alternatives considered

• Keep tiers as prose + reboot-prep skill: proven leaky in the trial.
• No live branch (working tree as L2): unenumerable, unbuildable state.

Consequences

Every durable change has a commit; every reboot is preceded by an auditable promotion decision; erosion has to pass a PR to become permanent.