docs: plain-English pass over the active specs

Ran the humanizer rules over 79 prose files in the active specs (brief,
design, requirements, research and narrative docs). Removed em dashes,
significance inflation, forced rule-of-three, bold-label list items and
filler. Skipped tasks.md checklists and the retired specs (harnessx-*,
openrouter-sast-harness, unseen-repo-evaluation).

Every number, path, command, hash and identifier was preserved: checked
each file against HEAD for drift in numbers, inline code and code fences,
zero drift across all 79 files.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

.kiro/specs/ai-service-plane/design.md

@@ -141,7 +141,7 @@ before `ax apply`, and a task without a Model gets none. The value is never rend
 Every actor connection except DNS goes through Agent Substrate's egress gateway (`atenet-egress`), which denies
 an actor without an `EgressPolicy`. Three pieces make the plane work under that rule:
 
-- **Receiver by name.** `ops/ax/receiver-service.yaml.tmpl` (applied by `up.sh`) is a selector-less Service
+- Receiver by name. `ops/ax/receiver-service.yaml.tmpl` (applied by `up.sh`) is a selector-less Service
   `ousast-receiver` in `ax-system`, port 80, with an EndpointSlice on the kind gateway at `OUSAST_ARTIFACT_PORT`
   (fixed, 18090), where the reconciler binds its receiver. Tasks get
   `OUSAST_ARTIFACT_URL=http://ousast-receiver.ax-system.svc.cluster.local/` plus `OUSAST_ARTIFACT_DIAL=<the
@@ -150,12 +150,12 @@ an actor without an `EgressPolicy`. Three pieces make the plane work under that
   `Host` but connects to the address the actor dialled (measured: dialling the kind gateway on port 80 was allowed
   and then refused upstream), so the dial address is the ClusterIP, which kube-proxy maps to the host.
   `OUSAST_ARTIFACT_HOST` set keeps the old direct URL (tests).
-- **Per-task policy.** `policy_for` grants `http` on port 80 to the receiver name, and `tls_passthrough` on 443
+- Per-task policy. `policy_for` grants `http` on port 80 to the receiver name, and `tls_passthrough` on 443
   to the Git hosts of the bound Workspaces' `https` repos and to the bound Model's
   `openultrasast.io/egress-hosts` (`api.deepseek.com` for `deepseek-flash`, validated as a plain DNS name).
   Nothing else: no IP address or wildcard, and passthrough only -- an `https` rule intercepts TLS and the actor
   would need the gateway CA, which ax templates do not mount.
-- **Order.** `ax apply` creates the actor; the reconciler writes the policy with `kubectl ate create
+- Order. `ax apply` creates the actor; the reconciler writes the policy with `kubectl ate create
   egress-policy` (update when one exists), reads it back, waits `OUSAST_EGRESS_SETTLE` (11 s: the gateway caches a
   missing policy as deny for 10 s), then resumes. kubectl-ate has no delete verb; Substrate's store deletes the
   policy with its actor, so after `ax delete task` the reconciler confirms it is gone.

.kiro/specs/ai-service-plane/requirements.md

@@ -14,19 +14,19 @@ a DeepSeek provider -- is carried by our thin `Run` layer and dissolves into ax
 
 ## Boundary Context
 
-- **In scope**: the manifest kinds and a `Run` kind for dependencies, artifacts and budgets; bring-up of ax on
+- In scope: the manifest kinds and a `Run` kind for dependencies, artifacts and budgets; bring-up of ax on
   this host (kind + Agent Substrate + ax controller) with a doctor command; an ax-backed reconciler that
   submits Tasks to ax (one engine-bearing task at a time) and is the only executor; the runner contract and a
   runner image; the first two tasks, `repo-facts` and
   `verify`, with the existing scripts as reference behaviour; measurement on the 46-candidate validation set.
-- **Out of scope**: a remote or multi-node cluster; contributing providers or budgets to ax upstream (a
+- Out of scope: a remote or multi-node cluster; contributing providers or budgets to ax upstream (a
   follow-on once the increment is measured); changing what the model is asked (prompts, families, pass rules)
   except as required to consume `repo-facts`; the judge stage, the config-family question and population v3
   (they become tasks later, under their own specs); any change to `evaluate.py`'s protocol scoring.
-- **Adjacent expectations**: the independent-population protocols and records stay as they are; `finding_dump`
+- Adjacent expectations: the independent-population protocols and records stay as they are; `finding_dump`
   and the engine path are untouched; `vulnerabilities-over-plumbing` applies -- this is plumbing that must pay
   for itself in measured tokens and unchanged or better recall.
-- **Target state (maintainer, 2026-09-29)**: this plane replaces HarnessX as the agentic plane; HarnessX is
+- Target state (maintainer, 2026-09-29): this plane replaces HarnessX as the agentic plane; HarnessX is
   removed by its own spec (`harnessx-removal`) once Requirement 6's measurement shows value; the `Run` layer
   shrinks as ax gains dependencies, budgets and artifacts. No new HarnessX feature is added meanwhile.