System overview design: four-model audit, repair, and regression complete

- system-overview-design.md: repaired with P0/P1/P2 gaps resolved, all 24 frozen baselines listed, error taxonomy, global ~/.air, IPC, TaskSpec/WorkerResult, PromptLayer, PermissionEngine, RuntimeEvent, state machines, capability trust, artifact naming, operations
- Four cross-verification audit reports (GPT-5, MIMO 2.5, Opus 4.7, DeepSeek V4 Pro)
- Three regression reviews (R1: initial repair closure, R2: second pass with PromptLayer L9 wording found, R3: full PromptLayer alignment verified)
- AGENTS.md, plan.md, todo.md synchronized

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

AirPlan/todo.md

@@ -8,6 +8,7 @@ Status values: TODO / DOING / DONE / BLOCKED
 | T-000B | DONE | Contracts Gate | Repair public contract freeze issues | `AirPlan/docs/architecture/interface-contracts-v1.md`, `event-registry-v1.md`, `error-taxonomy-v1.md`, `provider-capability-matrix-v1.md`, `tool-registry-v1.md`, `c4/code-view.md` | P0 contract conflicts resolved: `AirError.cause_ref`/`cause_refs`, `EntityRef` single-source, `permission_template` naming, `TaskInsert`/`EventInsert`, `TaskType/docs`, `Diagnostic`, `DebugKnowledgeStore`/`LearnedMemoryStore`, `PromptLayer`/`CompactionPolicy`, `ProviderAdapter` snake_case, `WaveID`, IPC handshake/direction, `EventSchemaRegistry`, `StreamingToolExecutor`, `PermissionRecordResult` | All contract edits verified | Contracts can be transcribed to `packages/contracts` without conflicts | C4 interface inventory updated implicitly via contract changes |
 | T-000C | DONE | Runtime Gate | Define persistence and runtime invariants | `AirPlan/docs/architecture/db-schema-v1.md`, `runtime-semantics-v1.md`, `event-registry-v1.md`, `interface-contracts-v1.md` | `debug-records.db` and `learned-memory.db` DDL added; FK-off invariants defined; EventBus handler error behavior defined; PermissionEngine record failure path defined; DB closed enum inventory added; workspace GC policy defined; direct mode, ExperienceMiner triggers, Doctor self-bootstrap, air restore semantics defined | All runtime/runtime-semantics and db-schema edits verified | Storage/runtime docs cover invariants needed by EventStore, repositories, recovery, and permission audit | runtime-semantics sections 14-19 added; db-schema sections 20-21 added |
 | T-000D | DONE | UX Scope Gate | Alpha UX scope decided | `AirPlan/plan.md`, `AirPlan/todo.md`, `AirPlan/docs/analysis/requirements.md`, `AirPlan/docs/architecture/main-agent-state-machine.md` | All UX features scheduled as Alpha tasks; VibeBox removed from main plan (separate project branch) | Requirements-to-todo trace check | No original UX requirement silently unscheduled | T-038 through T-045 created; VibeBox references removed from plan/todo |
+| T-000E | DONE | Overview Gate | Repair system overview after four-model audit | `AirPlan/docs/architecture/system-overview-design.md`, `AirPlan/docs/architecture/{gpt5概要设计审查.md,mimo2.5概要设计审查.md,Opus4.7概要设计审查.md,DeepSeek概要设计审查.md,概要设计修复回归审查.md}`, `AirPlan/plan.md`, `AirPlan/AGENTS.md` | All P0/P1 and non-decision P2 overview audit gaps are folded into the overview; all 24 frozen baselines are listed; error taxonomy, global `~/.air`, IPC, TaskSpec/WorkerResult, PermissionEngine, RuntimeEvent, SQLite message invariants, state machines, capability trust, artifact naming, logging/migration/scanner/distribution/test strata are covered | Four-review consensus applied; regression review passed | No remaining overview blocker before detailed design | `system-overview-design.md` repaired; regression report, plan, and AGENTS synchronized |
 | T-001 | TODO | Monorepo | Create Bun workspace and Turborepo skeleton | `package.json`, `turbo.json`, `packages/` | Workspace installs and scripts resolve | `bun install && bun run typecheck` | TypeScript config validates package graph | ADR-0002, C4 package dependency view |
 | T-002 | TODO | Contracts | Implement shared contract package | `packages/contracts/src/` | RuntimeEvent, TaskSpec, WorkerResult, ToolDefinition, ArtifactRef, EvidenceRef, provider, error, IPC, UI types compile | `bun test packages/contracts && bun run typecheck` | Type-only package has no implementation deps | C4 interface inventory |
 | T-003 | TODO | CLI | Implement CLI bootstrap shell | `packages/cli/src/` | CLI can start, print version/help, locate project root, load resources | `bun run air -- --help` | Typecheck CLI package | C4 container view |
@@ -37,17 +38,17 @@ Status values: TODO / DOING / DONE / BLOCKED
 | T-027 | TODO | TUI | Implement OpenTUI/Solid startup and core views | `packages/tui/src/` | TUI starts and shows session/task/agent/tool projections | `bun run air -- tui-smoke --project <fixture>` | Typecheck TUI package | C4 TUI container |
 | T-028 | TODO | TUI | Implement permission/blocker/report UI surfaces | `packages/tui/src/` | Permission prompts and blocker reports render from ProjectionStore | `bun test packages/tui` | Typecheck UI contracts | scope escalation/security model |
 | T-029 | TODO | Agents | Implement Main Agent request classification shell | `packages/runtime/src/agents/main/` | Main Agent stores messages, classifies direct vs delegated work, and reports progress | `bun test packages/runtime --filter main-agent` | Prompt schema checks | solution architecture |
-| T-030 | TODO | Agents | Implement Architecture Designer impact flow | `packages/runtime/src/agents/architecture/` | Requirement/interface changes produce architecture impact events and doc update tasks | `bun test packages/runtime --filter architecture-agent` | Structured output validation | scope escalation ADRs |
+| T-030 | TODO | Agents | Implement Architecture Designer impact and review gate flow | `packages/runtime/src/agents/architecture/` | Requirement/interface changes produce architecture impact events and doc update tasks; architecture-sensitive reviews, phase-complete reviews, and final consistency reviews produce Architecture Designer gate results | `bun test packages/runtime --filter architecture-agent` | Structured output validation | scope escalation ADRs, system overview §10.5 |
 | T-031 | TODO | Agents | Implement Executor/Reviewer/Debugger minimal loops | `packages/runtime/src/workers/roles/` | Simple edit fixture can execute, review, debug failure, and return evidence | `bun run air -- e2e simple-edit-fixture` | WorkerResult schema checks | ADR-0006 |
 | T-032 | TODO | Compaction | Implement Compactor summary flow | `packages/runtime/src/workers/roles/compactor.ts` | Context budget pressure creates summary row/artifact and preserves backtracking refs | `bun test packages/runtime --filter compaction` | Summary schema validation | prompt layering/context baseline |
 | T-033 | TODO | Experience | Implement ExperienceMiner candidate flow with Nudge, Curator, and self-patch | `packages/runtime/src/workers/roles/experience-miner.ts`, `packages/runtime/src/workers/roles/curator.ts` | Verified pattern creates memory/rule candidate; N-turn Nudge trigger fires periodically; Curator dedup/archive runs; self-patch forwards stale rules to ExperienceMiner | `bun test packages/runtime --filter experience` | Candidate/Curator/self-patch schema validation | memory baseline, runtime-semantics §17 |
-| T-034 | TODO | Doctor | Implement Doctor with read-only, fix mode, and bundle export | `packages/runtime/src/doctor/` | Platform, provider config, toolchain, display, disk, permissions checks report; fix mode applies fixes under PermissionEngine; bundle exports diagnostic archive | `bun run air -- doctor --read-only && bun run air -- doctor --fix --dry-run && bun run air -- doctor --bundle` | Doctor report/bundle schema validation | security/platform matrix, runtime-semantics §18 |
+| T-034 | TODO | Doctor | Implement Doctor with read-only, fix mode, and bundle export | `packages/runtime/src/doctor/` | Platform, provider config, toolchain, display, disk, permissions checks report; fix mode applies fixes under PermissionEngine; bundle exports diagnostic archive | `bun run air -- doctor --read-only && bun run air -- doctor --fix --dry-run && bun run air -- doctor --bundle` | Doctor report/bundle schema validation | security/platform matrix, runtime-semantics §19 |
 | T-035 | TODO | Logging | Implement user/developer logs | `packages/runtime/src/logging/` | `air.log` user errors and encrypted developer log path exist with retention policy hooks | `bun test packages/runtime --filter logging` | Secret redaction tests | security/logging baseline |
-| T-036 | TODO | E2E | Implement release gate fixtures | `fixtures/`, `scripts/release-check.*` | Worker, C++ build/test, DB recovery, TUI startup, artifact/event persistence gates run | `bun run release:check` | Typecheck/lint/test all packages | cross-platform matrix |
+| T-036 | TODO | E2E | Implement release gate fixtures | `fixtures/`, `scripts/release-check.*` | Worker, C++ build/test, DB recovery, TUI startup, artifact/event persistence gates, phase-complete architecture review, and final Architecture Designer consistency review run | `bun run release:check` | Typecheck/lint/test all packages | cross-platform matrix, scope escalation |
 | T-037 | TODO | Packaging | Implement binary tarball packaging | `scripts/package.*`, `resources/` | Tarball contains `bin/air`, `resources/`, `LICENSE` and starts on tier-1 Linux | `bun run release:package` | Package smoke validation | distribution baseline |
 | T-038 | TODO | Main Agent | Implement `/direct` and `/done` direct mode | `packages/runtime/src/agents/main/`, `packages/tui/src/` | Main Agent enters DIRECT_MODE with executor permissions; `/done` exits and collects evidence; direct mode events logged | `bun run air -- e2e direct-mode-fixture` | Direct mode state machine and permission template checks | main-agent-state-machine, runtime-semantics §16 |
-| T-039 | TODO | CLI | Implement `air restore` with three granularities | `packages/cli/src/commands/restore.ts`, `packages/runtime/src/restore/` | `air restore file`, `air restore time`, `air restore session` work from git-backed backup repo | `bun test packages/runtime --filter restore` | Restore schema and git operation validation | decisions-round-2 D-032, runtime-semantics §19 |
-| T-040 | TODO | CLI | Implement CLI command catalog | `packages/cli/src/commands/` | `air resume`, `air compact`, `air history`, `air session list`, `air provider list` commands exist and function | `bun run air -- help` shows full catalog; individual commands have `--help` | Command typecheck and help output validation | requirements FR-005, baseline §18 |
+| T-039 | TODO | CLI | Implement `air restore` with three granularities | `packages/cli/src/commands/restore.ts`, `packages/runtime/src/restore/` | `air restore file`, `air restore time`, `air restore session` work from git-backed backup repo | `bun test packages/runtime --filter restore` | Restore schema and git operation validation | decisions-round-2 D-032, runtime-semantics §20 |
+| T-040 | TODO | CLI | Implement CLI command catalog | `packages/cli/src/commands/` | `air resume`, `air compact`, `air history`, `air session list`, and read-only `air provider list/current` commands exist and function; no runtime provider/model switching command exists | `bun run air -- help` shows full catalog; individual commands have `--help` | Command typecheck and help output validation | requirements FR-005, baseline §18 |
 | T-041 | TODO | Main Agent | Implement `compact` and `resume` user commands | `packages/runtime/src/agents/main/`, `packages/cli/src/commands/` | `air compact` triggers manual compaction; `air resume` restores session from DB | `bun run air -- e2e compact-resume-fixture` | Compaction and resume schema validation | runtime-semantics §7, prompt-layering |
 | T-042 | TODO | Main Agent | Implement `history` and `session list` commands | `packages/cli/src/commands/` | `air history` shows session message history; `air session list` lists sessions with status | `bun run air -- session list` and `bun run air -- history` | Output format and DB query validation | db-schema, projection |
 | T-043 | TODO | TUI | Implement permission prompt UX with announce_then_run visualization | `packages/tui/src/components/PermissionPrompt.tsx` | Permission prompts render risk level, options, and announce_then_run mode; user decisions flow through UiCommandChannel | `bun test packages/tui --filter permission` | Permission prompt UI snapshot validation | security-model, scope-escalation |
@@ -56,7 +57,7 @@ Status values: TODO / DOING / DONE / BLOCKED
 
 ## Quality Gates
 
-- T-000A through T-000D are DONE. System overview design, detailed design, and `packages/contracts` implementation may proceed.
+- T-000A through T-000E are DONE. System overview design is repaired after four-model audit; detailed design and `packages/contracts` implementation may proceed.
 - Run the validation command listed for the task before marking it `DONE`.
 - Keep ADR and C4 docs synchronized whenever architecture, module boundaries, dependencies, or ownership change.
 - Record skipped validation, residual risk, and follow-up work explicitly.