feat(explain): implement ATLAS-WP-0004 T01+T02 — effective-config resolver + config explain

Activate WP-0003 and WP-0004. Add tools/effective_config.py (deterministic,
order-independent override-path resolver — path only, never a value) and
tools/config_explain.py + `make explain` to render the layer path, winning
layer, validator, owner, consumers, and secret references for any surface.*.
Verified on all 4 seeded surfaces; order-independent; no values/secrets leak.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/ATLAS-WP-0003-discovery-connectors.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Discovery connectors"
 domain: infotech
 repo: config-atlas
-status: ready
+status: active
 owner: codex
 topic_slug: custodian
 created: "2026-06-26"
-updated: "2026-06-26"
+updated: "2026-06-27"
 state_hub_workstream_id: "e4400d9c-021a-4e44-8e9b-719f94a9561a"
 ---
 

workplans/ATLAS-WP-0004-explain-and-graph.md

@@ -4,11 +4,11 @@ type: workplan
 title: "Effective-config explain and graph"
 domain: infotech
 repo: config-atlas
-status: ready
+status: active
 owner: codex
 topic_slug: custodian
 created: "2026-06-26"
-updated: "2026-06-26"
+updated: "2026-06-27"
 state_hub_workstream_id: "fbfdbf2b-ca6b-450e-a654-a61c5939f068"
 ---
 
@@ -44,11 +44,18 @@ T04 (blast-radius). T01 and T03 may start in parallel.
 
 ```task
 id: ATLAS-WP-0004-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "cee293aa-b407-4b97-a462-b67d7aa0f170"
 ```
 
+Result 2026-06-27: Added `tools/effective_config.py` — a pure, deterministic
+resolver that orders a surface's `sources[]` by canonical L0-L9 layer rank and
+emits the override path (contributing layers, winning layer, what each overrode,
+validator, owner). Renders the PATH only, never a value; non-layer roles
+(feature-control-key) are listed as linked authority. Verified order-independent
+(8x shuffle -> identical path).
+
 Implement a static resolver that, from a surface's `sources[]` (with layer `role`),
 the L0–L9 ordering, and the explicit merge rules, produces the **override path**:
 ordered contributing layers, the winning layer, what each overrode, the validating
@@ -63,11 +70,17 @@ the `config explain` shape in [`wiki/ConfigLayering.md`](../wiki/ConfigLayering.
 
 ```task
 id: ATLAS-WP-0004-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "5d66a8c1-74bd-4c6f-9ea6-839e884ad103"
 ```
 
+Result 2026-06-27: Added `tools/config_explain.py` and `make explain
+SURFACE=...`. Renders the resolver output (layer path, overrides, winning layer,
+validator, owner, consumers, secret refs) for any `surface.*` id. Verified on all
+4 seeded surfaces; no values or secret values appear in output. Documented in
+`.claude/rules/stack-and-commands.md`.
+
 Add a `tools/` command (e.g. `config_explain.py`) that takes a `surface.*` id and
 renders the resolver output as the human/agent-readable `config explain` view.
 Reuse the existing `tools/` + Makefile pattern (`make explain SURFACE=...`).