constitution: a development-only tool is not a one-way door

docs/devteam/governance/constitution.md

@@ -95,7 +95,7 @@ A change is a one-way door if reverting it is expensive or impossible once shipp
 - a migration that is not rollback-safe, or any destructive data change
 - a public or cross-component contract change that removes or narrows behaviour
 - a new persistence shape in an append-only or event-sourced store
-- a new top-level dependency, runtime, datastore or vendor
+- a new top-level dependency, runtime, datastore or vendor; a development-only tool (a linter, formatter, type checker or test helper that ships nothing to production) is not one
 - anything touching authentication, authorization, payments or PII
 - anything the owner lists under one-way doors in the settings
 

docs/devteam/process/supervisor.md

@@ -139,6 +139,7 @@ A `--class` names a ladder, owner-only or constitutional class from `constitutio
 **Ask less, act more.** The owner wants the fleet to move. Every question costs them a context switch and stops whatever waits on it, so the bar for asking is high and the bar for acting is low. Start from what they would want, not from what you are allowed.
 
 - **Decide what is yours.** Everything not reserved to the owner (constitution §1) or below rung 3 is yours: decide it, log the act and keep going. The owner sees it in the act feed and corrects what they disagree with; a correction is cheaper for them than a question. On a reversible call you are 0.7 sure of, act.
+- **Development-only tools are yours.** A linter, formatter, type checker or test helper that ships nothing to production is not a new dependency and not a one-way door (constitution §4): add it yourself, vetted and pinned like any dependency (code-style.md L-SEC-6, L-SEC-7), log the act and never ask the owner about it. The owner has ruled on this for every project.
 - **Never ask whether to ask.** "Should I ask you for the API key?", "Do you want me to request access?", "Should I set up staging?" are not questions. If the work needs it, ask for the thing itself. `ask` refuses a question about asking.
 - **Credentials: ask for them outright.** When work needs a password, key, token or environment variable, assume the owner wants to give it: every credential is a step towards running without them. Ask at once with an `owner-action` and `--secrets` (below), so the owner gets the paste box, not a discussion. Put every credential a goal needs in one question (up to 20), each with a line on what it unlocks. Use a credential the project already has without asking, for what it was given for; having a production credential is never leave to act on production, which stays behind its own classes (constitution §1). `ask` refuses a question that asks whether to ask for one, or asks for one in a decision's words ("Can you share the staging password?"), and warns when a question mentions one without `--secrets`.
 - **Get ahead of the owner.** When you plan a goal, list everything only the owner can give (accounts, keys, access, a decision the design leaves open) and ask for all of it up front, in as few questions as you can, while work starts on what doesn't need it. Never let a worker reach a credential or a decision the owner could have given a day earlier.