Mission Run Overview
Mission Run: Charter as Sole Door: Close Bypass Access Paths
Make charter.yaml/the charter factory the only access path to provisioned doctrine assets: extend activation gating to all 10 doctrine-artifact kinds and eliminate every identified bypass call-site, no exceptions.
The charter's canonical factory (charter.resolver.DoctrineService) currently activation-gates only 3 of 10 doctrine-artifact kinds (paradigm, procedure, agent_profile) and forwards the other 7 unfiltered; meanwhile roughly 20 call sites across the 5-tier template/command resolver axis, direct repository construction (7 sites), two hardcoded source-tree paths, and unwrapped raw DoctrineService builds (6 sites) reach doctrine assets without going through the factory at all. This mission closes both gaps per operator decision: extend activation gating to all 10 kinds, and eliminate every identified bypass with no allowlist exceptions (including sites whose code comments cite avoiding a runtime-to-charter-to-doctrine boundary ratchet, which must be re-litigated rather than grandfathered) -- making the charter the sole, enforced access path to provisioned doctrine assets for the runtime. This is the G1 done-bar named in the 3.2.x open-core delivery plan. A pre-spec research squad confirmed five adjacent GitHub issues (#2986, #3036, #3039, #3091, #3022) are NOT domain-matched to this mission and must stay deferred as separate follow-ons: the runtime-to-doctrine import ratchet's own function-local-import blind spot, two doctrine-content-shippability gate issues, doctrine-tree relocation, and built-in-pack extraction.