fix: feat: vault as procurement gate + RESOURCES.md capability inventory (#504)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

formulas/run-planner.toml

@@ -212,12 +212,22 @@ Update the tree by applying these operations:
 
 5. **Propose new capabilities**: If you identify a capability the factory
    needs (e.g., "marketing formula, runs weekly"), add it to the tree as
-   a proposed prerequisite. Anything with recurring cost should note:
-   "→ vault approval required" so the planner files it to vault next run.
+   a proposed prerequisite. Anything with recurring cost (new accounts,
+   new infra, new cron entries, new formulas) should be procured through
+   the vault — see the file-at-constraints step for how to file requests.
 
-6. **Check vault decisions**: Read any open vault issues to see if
-   previously proposed capabilities have been approved or rejected.
-   Update the tree accordingly.
+6. **Check vault state**: Scan vault directories for procurement status:
+   - `$FACTORY_ROOT/vault/pending/*.md` — requests awaiting human action.
+     Any prerequisite that depends on a pending procurement request should
+     be marked: `[ ] <name> ⏳ blocked-on-vault (vault/pending/<id>.md)`
+   - `$FACTORY_ROOT/vault/approved/*.md` — fulfilled, being processed.
+   - `$FACTORY_ROOT/vault/fired/*.md` — completed. Check if the resource
+     now appears in RESOURCES.md and mark the prerequisite resolved.
+   - Do NOT file issues for objectives blocked on pending vault items.
+
+7. **Re-read RESOURCES.md**: Check for newly available capabilities that
+   were not present last run. If a new resource appears, mark the
+   corresponding prerequisite as resolved.
 
 Write the updated tree to: $FACTORY_ROOT/planner/prerequisite-tree.md
 Use this format:
@@ -228,7 +238,8 @@ Use this format:
   ## Objective: <name> (#issue or description)
   - [x] Resolved prerequisite (reference)
   - [ ] Unresolved prerequisite (#issue or description)
-  Status: READY | BLOCKED — <reason> | DONE
+  - [ ] Resource need ⏳ blocked-on-vault (vault/pending/<id>.md)
+  Status: READY | BLOCKED — <reason> | BLOCKED — awaiting vault | DONE
 
 Keep the tree focused — only include objectives from VISION.md milestones
 and their genuine prerequisites. Do not inflate the tree with nice-to-haves.
@@ -293,9 +304,53 @@ Rules:
 - When deploying/operating, reference the resource alias from RESOURCES.md
 - Promoted predictions from triage may become constraints if they block
   downstream objectives — rank them the same way
+- **Do NOT file issues for objectives blocked on pending vault items** —
+  these are waiting for human procurement, not dev work
 
-If all top 3 constraints already have open issues, note that the backlog
-is aligned with the constraint focus. No new issues needed.
+### Filing vault procurement requests
+
+If a constraint requires a resource the factory does not have (check
+RESOURCES.md), and that resource has recurring cost (account, infra,
+domain, API key, new cron job), file a procurement request instead of
+an issue:
+
+1. Check if a request already exists in vault/pending/ or vault/approved/
+   for this resource (match by filename).
+
+2. If no request exists, create a markdown file at:
+     $FACTORY_ROOT/vault/pending/<resource-id>.md
+
+   Format:
+   ```
+   # Procurement Request: <human-readable name>
+
+   ## What
+   <description of what's needed>
+
+   ## Why
+   <why the factory needs this — which objectives it enables>
+
+   ## Unblocks
+   <list prerequisite tree objectives this unblocks, with issue numbers>
+
+   ## Proposed RESOURCES.md Entry
+   ## <resource-id>
+   - type: <social|compute|asset|communication|ci|source-control>
+   - capability: <what it can do>
+   - env: <ENV_VAR_NAME if secrets needed>
+   ```
+
+3. Mark the prerequisite in the tree as blocked-on-vault:
+     `[ ] <name> ⏳ blocked-on-vault (vault/pending/<resource-id>.md)`
+
+4. vault-poll.sh will notify the human automatically.
+
+Procurement requests count toward the 3-item-per-run limit (issues +
+procurement requests combined).
+
+If all top 3 constraints already have open issues or pending vault
+requests, note that the backlog is aligned with the constraint focus.
+No new items needed.
 """
 needs = ["update-prerequisite-tree"]