docs(adr-0002): D11 amendment — add maxSpawnTimeMs to Provider contract hints

cold-audit catch from 2026-05-23

Retroactive contract sync addressing cold-audit Finding 4 (P2 governance).
D10 (commit 2cfd0b1) added `maxSpawnTimeMs` to all three plugins +
spawn-timeout enforcement loop but did not amend ADR 0002 § Provider
contract in the same merge. ALIGNMENT.md Rule 1 (Cite First) + CLAUDE.md
§ "Hard requirements" item 1 (Authority citation) both require contract
additions to be authority-cited at landing.

Changes (single file, ADR 0002 only):

1. New `## Amendments` section after the header block documenting:
   - Cold-audit Finding 4 as the originating finding
   - Commit 2cfd0b1 as the already-landed code
   - CC 开发铁律 v1.6 § 10.x as the procedural mechanism that caught it
   - ADR 0004 § Trigger taxonomy — Hard triggers bullet 4 as the authority

2. Expanded `hints` documentation from bare-key list to indented sub-bullets
   with one-line description per key. All four keys now documented:
   - requiresTTY (boolean fingerprint)
   - concurrentSpawnSafe (boolean fingerprint)
   - maxConcurrent (declarative hint only at v0.1; type-validated at startup,
     no runtime enforcement wired — separate tracking issue to be filed)
   - maxSpawnTimeMs (new — milliseconds, default 600000, ADR 0004 cited)

Diff-review (Iron Rule v1.6 § 10.x Mode A, fresh-context opus, independent
of drafter) flagged two issues on first pass:

- **B1 blocking**: original draft claimed maxConcurrent was "enforced by the
  spawn-concurrency guard in server.mjs" — grep verified zero such guard
  exists. Folded in: replaced with honest declarative-only framing. The
  irony of D11 itself shipping the same class of documentation–implementation
  drift it was opened to remediate was caught by the reviewer; the fold-in
  closes the loop cleanly.

- **N1 non-blocking**: original draft cited ALIGNMENT.md Rule 2(c) as
  primary authority, but Rule 2(c)'s literal wording is scoped to IR
  fields. Folded in: cite Rule 1 (Cite First) + CLAUDE.md § "Hard
  requirements" item 1 as primary, noting Rule 2(c)'s spirit extends
  to Provider-contract additions.

Follow-up tracked separately: actual runtime enforcement of maxConcurrent
(semaphore / in-flight counter / spawn queue) — declarative→actual closure
to be filed as GitHub issue.

Authority:
- ADR 0002 self-amendment (in-place)
- ADR 0004 § Trigger taxonomy bullet 4
  https://github.com/dtzp555-max/olp/blob/main/docs/adr/0004-fallback-engine.md
- ALIGNMENT.md Rule 1 + CLAUDE.md § "Hard requirements" item 1
- CC 开发铁律 v1.6 § 10.x (procedural authority for cold-audit catch tag)
  https://github.com/dtzp555-max/cc-rules/blob/main/CC_DEV_IRON_RULES.md

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

docs/adr/0002-plugin-architecture.md

@@ -5,6 +5,15 @@
 - **Authors:** project maintainer (with AI drafting assistance)
 - **Related:** OLP v0.1 spec §4.2; ADR 0001 (project founding); ADR 0003 (IR design); ADR 0006 (provider inclusion framework)
 
+## Amendments
+
+### Amendment 1 — 2026-05-23: Add `maxSpawnTimeMs` to Provider contract hints (retroactive sync)
+
+- **Finding:** Cold-audit Finding 4 (P2 governance violation) — commit `2cfd0b1` (D10) added `maxSpawnTimeMs` to all three provider plugins (`anthropic.mjs`, `codex.mjs`, `mistral.mjs`) and the fallback engine's spawn-timeout enforcement loop, but the Provider contract documentation in this ADR was not updated in the same merge.
+- **Code already landed:** The corresponding implementation is live in commit `2cfd0b1` (D10). This amendment is a retroactive contract sync to restore documentation–implementation alignment per ALIGNMENT.md Rule 1 (Cite First) and `CLAUDE.md` § "Hard requirements for plugin / server.mjs / IR changes" item 1 (Authority citation) — both of which require contract additions to be authority-cited at landing. ALIGNMENT.md Rule 2(c)'s literal wording covers IR fields; its spirit extends to Provider-contract additions.
+- **Procedural mechanism:** CC 开发铁律 v1.6 § 10.x (Diff Review vs Cold Audit mode). The diff-review pass that approved D10 missed this omission; the subsequent cold-audit run on 2026-05-23 caught it as Finding 4. This amendment is the required remediation.
+- **Authority:** ADR 0004 § Trigger taxonomy — Hard triggers bullet 4: "Provider CLI spawn timeout (configurable per-provider via `hints.maxSpawnTimeMs`)."
+
 ## Context
 
 OLP declares a curated set of candidate providers — three anticipated Tier D (Anthropic, OpenAI Codex, Mistral Vibe), two anticipated Tier C (xAI Grok, Moonshot Kimi), and three anticipated Tier B (MiniMax, Zhipu GLM, Alibaba Qwen). Per ALIGNMENT.md § Provider Inventory, all 8 ship as **Candidate** at v0.1 founding; transition to **Enabled** requires authority pin filled + plugin landed + Phase audit passed. Each provider has its own CLI binary, its own auth artifact location, its own request shape, its own response shape, its own quota-reporting endpoint (or none), and its own rate-limit posture. The maintainer's strong prior is that this set grows over the project's lifetime — provider economics will continue to shift, and "the right five providers" in 2027 will not be identical to today's five.
@@ -54,7 +63,11 @@ Every provider plugin exports an object conforming to:
 - `estimateCost: (request) => { inputTokens, outputTokensEstimate, currency, usd }` — best-effort, may return null
 - `quotaStatus: async (authContext) => { available, percentUsed, resetsAt, pool }` — best-effort, null if unretrievable
 - `healthCheck: async () => { ok, latencyMs, error? }` — startup and `/health` endpoint use this
-- `hints: { requiresTTY, concurrentSpawnSafe, maxConcurrent }` — fingerprint and concurrency hints
+- `hints: { requiresTTY, concurrentSpawnSafe, maxConcurrent, maxSpawnTimeMs }` — fingerprint, concurrency, and timeout hints:
+  - `requiresTTY` — boolean; whether the provider CLI requires a TTY to produce non-interactive output (e.g., some CLIs suppress JSON output unless forced with a flag or a TTY is present).
+  - `concurrentSpawnSafe` — boolean; whether the provider CLI is safe to spawn concurrently under the same auth context without rate-limit or session collisions.
+  - `maxConcurrent` — integer; maximum simultaneous spawn count OLP will allow for this provider. **Declarative hint only at v0.1**: the value is type-validated at startup (`lib/providers/base.mjs`) but no runtime enforcement (semaphore / in-flight counter / spawn queue) is wired in `server.mjs` yet. Tracking issue to be filed for a follow-up that lands the runtime guard.
+  - `maxSpawnTimeMs` — optional integer, milliseconds; maximum wall-clock time OLP allows for a single provider spawn before treating it as a hard fallback trigger. Defaults to `600000` (10 minutes) if absent. Used by the fallback engine's spawn-timeout enforcement loop; see ADR 0004 § Trigger taxonomy — Hard triggers bullet 4.
 
 **Loading model.** `lib/providers/index.mjs` is a hand-maintained static enumeration. There is no filesystem scan, no `require.context`, no dynamic discovery. Adding a provider requires:
 1. Write `lib/providers/<name>.mjs` conforming to the contract.