mavend: centralize action validation boundary (slice 4)

docs/workflow.md

@@ -1,6 +1,6 @@
 # Session workflow: the five stores and the guards
 
-*Last verified: 2026-08-11 @ 557f5a3*
+*Last verified: 2026-08-25 @ 5cae33a*
 
 How a session starts, where each kind of writing belongs, and what the hooks
 refuse. `CLAUDE.md` carries the commands. This file carries the reasoning.
@@ -37,9 +37,8 @@ This repo is project **Maven** (ID 2). MCP at `http://localhost:9100/mcp`, or
 `http://192.168.1.104:9100/mcp` from workpc. Feature, bug and deploy tasks go
 there.
 
-A task holds the goal, the constraints and the assumption ledger. A session
-without a task id cannot be resumed by anyone, so a session with none asks for
-one first.
+A task holds the goal, the constraints and the assumption ledger. A session may
+start without one: filing is not a gate on work (owner's call, 2026-08-25).
 
 **Close a finished task with `done: true` and nothing else** (owner's call,
 2026-08-07). Do not write a completion summary into the description on the way
@@ -63,13 +62,13 @@ rather than letting the session compact.
 
 ## Guards
 
-Two hooks in `.githooks/`, tracked, wired with `core.hooksPath`. A fresh clone
-needs `git config core.hooksPath .githooks`.
+One hook in `.githooks/`, tracked, wired with `core.hooksPath`. A fresh clone
+needs `git config core.hooksPath .githooks`. `commit-msg` and its `(V-<id>)`
+requirement were deleted on 2026-08-25: a subject ref that names a task nobody
+filed is a wrong link, not a record.
 
 - `pre-commit` refuses master, and refuses more than 300 changed lines in
   non-markdown files. Markdown is exempt and may land as one batch.
-- `commit-msg` requires the subject to end with `(V-<id>)`. `V-` and not `#`,
-  because Gitea autolinks `#123` to a Gitea issue, which is the wrong tracker.
 
 Two more guards live outside the repo, in `~/.claude/hooks/`. `diff-budget.sh`
 blocks further edits past 600 changed lines on a `task/` branch.