docs(agents): document real stack + review→repair→merge workflow in .obvious/obvious.md

[obvious-autobuild]

Human author: Gilbert Polanco (gilbertpolanco42@gmail.com)

Why

.obvious/obvious.md still declared the repository empty — written before the scaffold merged — so every agent reading the repo contract got a false model: no stack claims, no commands, no setup. The repo is now a pnpm/Turborepo monorepo with Effect v4 contracts (PR #9), CI (PR #3), security negative cases (PR #4), thin-path deploy evidence (PR #5), and the acceptance corpus/harness (PR #6). The repo also had no encoded merge discipline, despite a policy that declares no required human approvals.

Acceptance criteria

1. .obvious/obvious.md no longer claims "empty repository"; documents the real stack, layout, setup steps, env vars, and verification commands.
2. Every documented command verified locally on this PR's tested HEAD.
3. The review → repair → merge workflow encodes all eight required elements: per-PR acceptance criteria + diff inspection, independent verification against current HEAD, checks green required, recheck-HEAD-after-repairs, one serialized merge owner, no invented approvals, arena candidates held until selection, evidence-receipt format.
4. .obvious/config.yml untouched — mergeMethod: squash preserved.
5. CI green.

What

• Rewrite of .obvious/obvious.md — stack table (pnpm 10.34.5/Corepack + Turborepo 2, TS ~6.0.3 strict, Effect v4 4.0.0-rc.115, Convex backend, Expo 57/RN 0.86, Bun 1.3.14 tests), workspace layout with merged-PR history, setup, env handling (EXPO_PUBLIC_CONVEX_URL, never commit .env), and the full local verification block — including the two standalone suites (bun test ./security, evaluation harness + negative control) that CI's turbo task does not cover because security/ and evaluation/ are not pnpm workspace members.
• Review → repair → merge workflow — eight numbered rules plus the evidence-receipt template (PR URL, tested head SHA, review result, checks, merge commit, post-merge smoke, unlocked tasks). A receipt is only evidence when every field is filled; otherwise downstream tasks are not unlocked.
• config.yml untouched.

Rejected alternative: a separate CONTRIBUTING.md — .obvious/obvious.md is what agents already load as repo guidance; a second file would split the contract.

How to Review

Single file: .obvious/obvious.md. Check factual claims against the repo (versions in package.json/pnpm-lock.yaml, CI steps in .github/workflows/ci.yml, standalone-suite claims in security/README.md and evaluation/README.md). The workflow section is policy, not mechanics — judge whether the eight rules plus receipt format are enforceable as written.

Test Evidence

All commands run locally on tested HEAD a0b8695 (docs-only change; code tree identical to 88f103b):

• pnpm install --frozen-lockfile → OK
• pnpm typecheck → 7/7 tasks pass
• pnpm test → 11/11 domain tests pass
• pnpm build → OK
• bun test ./security → 17 pass, 0 fail
• cd evaluation && bun src/run.ts → 6/6 fixtures pass
• Negative control --adapter=./src/example/broken-adapter.ts --expect-failure → fails corpus as documented, exits 0 (expected-failure satisfied)

🔗 Obvious Project · 🧵 Obvious Thread

[obvious-autobuild]

Evidence receipt

PR:               https://github.com/OCPdev25/obv-hackaton/pull/10
Tested head SHA:  a0b8695 (review + local verification ran against this exact HEAD)
Review result:    pass — self-review; repo policy declares no required human approvals;
                  diff inspected against the stated acceptance criteria (all five met)
Checks:           Typecheck, test, build — green on a0b8695
                  https://github.com/OCPdev25/obv-hackaton/actions/runs/35257149600
Merge commit:     241ffe6808883e2ddf3d4cdc916b805da40cd083 (squash)
Post-merge smoke: pnpm typecheck && pnpm test && pnpm build on 241ffe6 — all green
Unlocked tasks:   todo_MCsB4TF2 (completed by this PR); no other tasks gated on it

Local verification on tested HEAD a0b8695: typecheck 7/7 tasks, domain tests 11/11,
build OK, security suite 17/17, evaluation corpus 6/6 + negative control behaves as documented.