spec: Exceptions concept + EX-CLOUD-LLM (reference design: fellows_local_db)

[richbodo]

What

Introduces the Exceptions concept to the PNA spec, with fellows_local_db as the demonstrating reference design. Reference-driven per CONTRIBUTING.md — the spec change rides along with working code (shipped in fellows_local_db #226/#230).

An Exception (EX-*) is a stable-ID'd condition under which a PNA deliberately departs from a baseline guarantee (a named AC, or the PNA definition). Modeled on software exceptions: raised by a user action, must be caught (never silent), handled by a defined solution. Raising one exits PNA mode; an app stays conformant in non-PNA mode iff every active exception is handled to contract. This reframes conformance from "never deviates" to "catches and handles every deviation honestly."

Artifacts

• spec/exceptions.md (new) — concept, validation-not-certification stance, scope discipline (Goal-anchored + composition-not-enumeration), the RFC-2119 handler contract EX-H1–EX-H8, the Relaxes: / Reversible: / Stresses: header conventions, the per-dimension strength-profile vocabulary, and the first registry entry EX-CLOUD-LLM (with its strength profile + origin note).
• spec/PNA_Spec.md — one-line pointer from vocab-pna (no AC rows changed; lint stays green).
• tools/lint-spec-ids.py — extended to trace EX-* IDs, validate every Relaxes: token (AC / EX / PNA-DEFINITION), check Reversible: well-formedness (+ Reversal: when yes), and validate strength-profile columns against the fixed vocabulary. Shape/presence only; behavioral correctness stays the evaluate flow's job. No-ops when exceptions.md is absent.
• pna-build-eval-contrib/SKILL.md — Evaluate flow gains a "Detect and verify Exceptions" step (caught/handled, reversibility, consent-to-human, strength accuracy, undeclared-deviation backstop); report keyed by AC or EX ID.
• reference_designs/fellows_local_db/ — backfilled record (the Exceptions originating contribution) + an Architecture.md copy carrying the full AC attestation table and the EX-CLOUD-LLM exception attestation.

Verification

• python tools/lint-spec-ids.py → OK (25 AC IDs, 12/12 contracts, 1 exception ID).
• The lint's new checks were negative-tested (flag bad strength classes, unknown Relaxes: tokens, malformed Reversible:).
• The fellows handler is covered by test_pna_exception_mode.py, test_mcpb_settings.py, and the two MCP instructions tests (see the Architecture copy's attestation rows).

Versioning & process notes

• Minor bump per CONTRIBUTING.md (additive: new concept, new sub-contracts, new lint check; no AC semantically altered).
• SWHID stays pending — recorded by the maintainer post-merge via Save Code Now, per CONTRIBUTING.md § Acceptance.

Follow-ups (separate PRs, by design)

• PR 2 — toolkit DX/process: per-repo skill-install docs, validation-not-certification framing promotion, prior_art.md "behavioral exceptions & consent propagation" survey.
• PR 3 — version the toolkit as a unit anchored to the spec version (root VERSION, per-artifact headers, lint enforcement).

🤖 Generated with Claude Code