Merge pull request '[TASK SCOPED GOVERNANCE BOOTSTRAP RENEWAL] AIOS Two-Stage Owner Campaign Phase A' (#35) from governance/request/two-stage-owner-campaign-v2-phase-a-renewal-20260731T081147Z into governance/approvals

approvals/governance-policy/AIOS-TWO-STAGE-OWNER-CAMPAIGN-V2-PHASE-A-RENEWAL-20260731T081147Z.json

@@ -0,0 +1,127 @@
+{
+  "schema": "aios.governance-approval/v1",
+  "approval_type": "TASK_SCOPED_GOVERNANCE_BOOTSTRAP_POLICY_ACTIVATION",
+  "approval_plan_id": "AIOS-TSG-BS-PHASE-A-RENEWAL-20260731T081147Z",
+  "task_id": "AIOS-V2R1C4-TWO-STAGE-OWNER-CAMPAIGN-V2-PHASE-A-RENEWAL",
+  "repository": "aios/aios",
+  "issued_at": "2026-07-31T08:11:47Z",
+  "expires_at": "2026-07-31T20:11:47Z",
+  "expected_governance_base_oid": "ebd74398743e36523b593fcc395b73945d4924c5",
+  "expected_governance_base_tree_oid": "ad1255a1127204fad1d1208d8f31dc94fa64e6e1",
+  "approval_request_branch": "governance/request/two-stage-owner-campaign-v2-phase-a-renewal-20260731T081147Z",
+  "request_head_binding": "GITEA_EXACT_HEAD_REVIEW_POST_COMMIT",
+  "human_authorizer": "owner",
+  "authorization_mode": "GITEA_EXACT_HEAD_REVIEW",
+  "required_human_approvals": 1,
+  "allowed_human_approvers": [
+    "owner"
+  ],
+  "require_latest_head_approval": true,
+  "dismiss_stale_approvals": true,
+  "auto_merge_after_machine_gates": true,
+  "phase_a_scope": {
+    "schema_id": "TASK_SCOPED_GOVERNANCE_BOOTSTRAP",
+    "schema_version": 1,
+    "activate_schema_and_validator_only": true,
+    "phase_b_release_authorized": false,
+    "publisher_authorized": false,
+    "writer_authorized": false,
+    "credential_projection_authorized": false,
+    "tag_authorized": false,
+    "registry_authorized": false,
+    "baseline_authorized": false,
+    "production_deployment_authorized": false
+  },
+  "content_bindings": {
+    "schema_document": {
+      "path": "services/aios-single-owner-governance/task-scoped-governance-bootstrap-v1.schema.json",
+      "blob_oid": "9b117667c0d98f995ac059b0e1b5ffed06ca6444",
+      "sha256": "6ec912a96c8bac5c0d3c0a017abc078cb9567ed54dcb20bb0eadb5926ac54fdd"
+    },
+    "validator_policy": {
+      "path": "services/aios-single-owner-governance/aios_single_owner_governance/task_scoped_bootstrap.py",
+      "blob_oid": "c18d15f31340f19fc5da87944901bdfb867ab6dc",
+      "sha256": "de11123b5cd9ccdad4961f1d5d084a8c4a1b2270ce793652ab9c50bb95694eac"
+    },
+    "evidence_manifest": {
+      "path": "evidence/governance-policy/AIOS-TWO-STAGE-OWNER-CAMPAIGN-V2-PHASE-A-20260730T023551Z.json",
+      "blob_oid": "c3d215b3ea525a25de514c32c5aad91d47e140b4",
+      "sha256": "1b0a993940b41a4b16724b557f6abd8b6cebb56dc64cc8f813bd605b6a3399c2"
+    },
+    "checksums_manifest": {
+      "path": "evidence/governance-policy/AIOS-TWO-STAGE-OWNER-CAMPAIGN-V2-PHASE-A-20260730T023551Z.sha256",
+      "blob_oid": "45ed084234dae6a00e69a41cd4f716f46a97d9fb",
+      "sha256": "51c4b029c0792dc98d41f754e484ba3861cf7604443d9c5f289b3b0af768a41a"
+    }
+  },
+  "offline_candidate_bindings": {
+    "schema_seed_commit_oid": "8da47545a507cb798d3d6ab30ff8552a2d0a5ecf",
+    "schema_seed_tree_oid": "991e68577a469657c1c4996814b6634ce5ed752f",
+    "implementation_commit_oid": "a637a9dbb6e0021cb7dcf0d6b0ca00dfe10dce38",
+    "implementation_tree_oid": "bf6e0c16fcad7515465bec4aefdd2e77b1e9bef0",
+    "evidence_closure_commit_oid": "1e4885197f508f7921b148d71e545b3de0029b0a",
+    "evidence_closure_tree_oid": "e55cf9ef19d1c6804f161de54fd3395a06149807",
+    "source_diff_sha256": "c06d002db06da6cbf16f9c8321f1acbfd431f009b5127a13fd2cb5d63b278867",
+    "source_pathset_sha256": "5061402d516c0e9413208ce64e2b52f77d224e6eec1f7b07c5b3a10b58df5eaf",
+    "implementation_bundle_sha256": "15711b225b9ef41cca0588d21b2b95d7a95ac155efc27fcb8772c435fcdab147",
+    "evidence_bundle_sha256": "ec97b8460151fc0e7e7ea9ae044ca13a1543c4b79c41a437ef087d3b1c271857"
+  },
+  "runtime_dependency_bindings": {
+    "handoff_zip_sha256": "668239a549b4a2b2094fe9b5104b84703fe8ed75011fd8ed71ed3958a6dc0706",
+    "installed_wheel_sha256": "abbf616366eb3467d4e651bb5306e22ae5e931b613df5362a0892935c4a1c0c7",
+    "anchor_service": "aios-campaign-anchor.service",
+    "anchor_uid": 988,
+    "runner_uid": 986,
+    "anchor_database": "/var/lib/aios-campaign-anchor/anchor.sqlite3",
+    "anchor_socket": "/run/aios-campaign-anchor/anchor.sock",
+    "AIOS_GITOPS_WRITES_ENABLED": false
+  },
+  "required_machine_status_contexts": [
+    "governance/schema-contract",
+    "governance/validator-security",
+    "governance/fault-injection",
+    "governance/runtime-isolation",
+    "governance/authority-mirror"
+  ],
+  "allowed_operations_after_exact_head_owner_approval": [
+    "observe_governance_pr",
+    "wait_governance_gates",
+    "observe_governance_merge",
+    "observe_validator_activation",
+    "complete_policy_activation"
+  ],
+  "denied_operations": [
+    "main.write",
+    "integration.write",
+    "tag.write",
+    "registry.write",
+    "baseline.write",
+    "production.deploy",
+    "force_push",
+    "history_rewrite",
+    "governance.direct_push",
+    "approval.impersonate",
+    "publisher.create",
+    "writer.create",
+    "credential.project",
+    "phase_b.execute"
+  ],
+  "merge_constraints": {
+    "allowed_modes": [
+      "FAST_FORWARD_TO_APPROVED_HEAD",
+      "EXACT_TWO_PARENT_MERGE_WITH_APPROVED_TREE"
+    ],
+    "force": false,
+    "plus_refspec": false,
+    "tags": false,
+    "prune": false
+  },
+  "governance_declarations": {
+    "AIOS_GITOPS_WRITES_ENABLED": false,
+    "force_push_used": false,
+    "tag_rewritten": false,
+    "direct_main_push": false,
+    "secrets_committed": false,
+    "owner_approval_respected": true
+  }
+}

evidence/governance-policy/AIOS-TWO-STAGE-OWNER-CAMPAIGN-V2-PHASE-A-20260730T023551Z.json

@@ -0,0 +1,75 @@
+{
+  "evidence_type": "TWO_STAGE_OWNER_CAMPAIGN_V2_PHASE_A_CANDIDATE",
+  "generated_at": "2026-07-30T02:35:51Z",
+  "execution_status": "PARTIALLY_COMPLETED",
+  "blocking_layer": "PHASE_A_OWNER_EXACT_HEAD_APPROVAL",
+  "repository": "aios/aios",
+  "governance_base_oid": "ebd74398743e36523b593fcc395b73945d4924c5",
+  "governance_tree_oid": "ad1255a1127204fad1d1208d8f31dc94fa64e6e1",
+  "authority_main_oid": "875d41c3101093149414292067fd700dc214d4d3",
+  "schema_seed_commit_oid": "8da47545a507cb798d3d6ab30ff8552a2d0a5ecf",
+  "schema_seed_tree_oid": "991e68577a469657c1c4996814b6634ce5ed752f",
+  "candidate_source_commit_oid": "a637a9dbb6e0021cb7dcf0d6b0ca00dfe10dce38",
+  "candidate_source_tree_oid": "bf6e0c16fcad7515465bec4aefdd2e77b1e9bef0",
+  "candidate_diff_sha256": "c06d002db06da6cbf16f9c8321f1acbfd431f009b5127a13fd2cb5d63b278867",
+  "candidate_files_sha256": "5061402d516c0e9413208ce64e2b52f77d224e6eec1f7b07c5b3a10b58df5eaf",
+  "candidate_file_count": 44,
+  "schema_document_path": "services/aios-single-owner-governance/task-scoped-governance-bootstrap-v1.schema.json",
+  "schema_document_sha256": "6ec912a96c8bac5c0d3c0a017abc078cb9567ed54dcb20bb0eadb5926ac54fdd",
+  "validator_policy_path": "services/aios-single-owner-governance/aios_single_owner_governance/task_scoped_bootstrap.py",
+  "validator_policy_sha256": "de11123b5cd9ccdad4961f1d5d084a8c4a1b2270ce793652ab9c50bb95694eac",
+  "two_stage_policy_schema_sha256": "6b4def7c1eef19c01ef73c43252eb0cd1a87c103e1047249a3cfcc75c7922bf6",
+  "two_stage_release_schema_sha256": "82ee589dc87db6998ddf0779ce264194cadea0deca66088b0797378f6ce89ad3",
+  "runtime_observer_sha256": "181e632192f1417a98c1efb35631cf80246759080b2e04243576abcdc7da22af",
+  "journal_anchor_sha256": "18feb0792b95f1060aa696cc60943379695a246984aecf76098838f9ed37426e",
+  "package_zip_sha256": "668239a549b4a2b2094fe9b5104b84703fe8ed75011fd8ed71ed3958a6dc0706",
+  "candidate_bundle_sha256": "15711b225b9ef41cca0588d21b2b95d7a95ac155efc27fcb8772c435fcdab147",
+  "anchor_install_wheel_sha256": "abbf616366eb3467d4e651bb5306e22ae5e931b613df5362a0892935c4a1c0c7",
+  "tests": {
+    "two_stage_campaign": {"passed": 67, "failed": 0, "skipped": 0, "collection_errors": 0},
+    "single_owner_governance": {"passed": 105, "failed": 0, "subtests_passed": 17, "collection_errors": 0},
+    "task_scoped_bootstrap": {"passed": 15, "failed": 0, "collection_errors": 0},
+    "compileall": "PASS",
+    "quarantine_fsck": "PASS",
+    "systemd_verify": "PASS_WITH_UNRELATED_HOST_WARNINGS"
+  },
+  "anchor": {
+    "service_status": "active",
+    "anchor_uid": 988,
+    "runner_uid": 986,
+    "uids_distinct": true,
+    "runner_database_write": "DENIED",
+    "unauthorized_socket_peer": "DENIED",
+    "runner_registration_action": "ANCHOR_REQUEST_INVALID",
+    "journal_mode": "WAL",
+    "synchronous": "FULL",
+    "foreign_keys": "ON",
+    "restart_open_reservation": "PASS",
+    "selftest_open_reservation_cleanup": "ABORTED"
+  },
+  "phase_separation": {
+    "required_owner_decisions": 2,
+    "phase_a_authorization": "GITEA_EXACT_HEAD_REVIEW",
+    "phase_b_authorization": "DETACHED_SSH_SIGNATURE",
+    "phase_a_release_authority": false,
+    "one_shot_authority": false
+  },
+  "isolation": {
+    "AIOS_GITOPS_WRITES_ENABLED": false,
+    "publisher_created": false,
+    "writer_created": false,
+    "credential_projection_created": false,
+    "target_branch_created": false,
+    "tag_created": false,
+    "registry_modified": false,
+    "baseline_modified": false,
+    "production_modified": false
+  },
+  "governance": {
+    "force_push_used": false,
+    "tag_rewritten": false,
+    "direct_main_push": false,
+    "secrets_committed": false,
+    "owner_approval_respected": true
+  }
+}

evidence/governance-policy/AIOS-TWO-STAGE-OWNER-CAMPAIGN-V2-PHASE-A-20260730T023551Z.sha256

@@ -0,0 +1,44 @@
+1f4a83cf91e9aacb6f50bc4fb24d4f745a7a31fd1dd7f2d3d3ed0de05e38234f  deploy/systemd/aios-campaign-anchor.service
+6b2525d31b8544488bce1544deb39a087cc2d830fb1b16fda26cde6ce430dbd2  deploy/systemd/aios-policy-activation-verification@.service
+fad52587775ff5f1c5cc16862c5fb1d910bb097c6b3330c00d75db4f7bef0bbd  deploy/systemd/aios-policy-campaign-register@.service
+de11123b5cd9ccdad4961f1d5d084a8c4a1b2270ce793652ab9c50bb95694eac  services/aios-single-owner-governance/aios_single_owner_governance/task_scoped_bootstrap.py
+6ec912a96c8bac5c0d3c0a017abc078cb9567ed54dcb20bb0eadb5926ac54fdd  services/aios-single-owner-governance/task-scoped-governance-bootstrap-v1.schema.json
+5b6d65ae34b2c3bebc1bde8f38c6b0bb73269336d7d4ee5e3416f79c323134d6  services/aios-two-stage-owner-campaign/ANCHOR_REGISTRATION_CONTRACT.md
+8ba5278f96447bf4308813b49fcc433d0cc7a5019cd9e78aeb0d8ada5f00d53b  services/aios-two-stage-owner-campaign/README.md
+7285527358bc8da1d4bc7ff70162dfc3a734086851b734daac89d6f9b330798d  services/aios-two-stage-owner-campaign/SECURITY_DELTA_V2.md
+89f03fdf156d35807bf39f2f1dbf304c01e7e9ad64399276fb72c68d795eda65  services/aios-two-stage-owner-campaign/STEP_EXECUTOR_CONTRACT.md
+7453177223b62509e4854051a75d53f24d8d1f737986f309cc6ae7a2e721459f  services/aios-two-stage-owner-campaign/TWO_STAGE_OWNER_INTERACTION_SPEC.md
+9308ee245a28a0f0ff623fbfc8e3961204b8e67194bffe536a9c3485ca126ac7  services/aios-two-stage-owner-campaign/examples/allowed_signers.example
+9ac7b7fdeb73a99d4f41bf3410ef16f67091d85f9082075287d388e6e5e37eed  services/aios-two-stage-owner-campaign/examples/campaign-anchor.env.example
+926f0c0cfb7bd6db0ebab6bcb5a0530057b8d38ae1e0b436a69a12b44039462b  services/aios-two-stage-owner-campaign/examples/executor-release.example.json
+8d46ec9279eb58c03337d41b63de2abdd9eb0d03f98f0806768dcd309d481ee9  services/aios-two-stage-owner-campaign/examples/policy-activation-verification.example.json
+b34d8895fe872ef27c62c759449757def698eb05157daff8badd0c86f64ee18c  services/aios-two-stage-owner-campaign/examples/release-campaign-manifest.example.json
+a2992f493cf0547e1f4acd3fcd9b20e03c912d8b255e196f640d47e291ec9d8e  services/aios-two-stage-owner-campaign/examples/runtime-observer-policy.example.json
+150c9a8debdcaa4dbb9fd51817ca8710ef805a32f2f96dc5490d0c4f77f2cb6f  services/aios-two-stage-owner-campaign/examples/runtime-observer-release.example.json
+675b39d13223ad281a4d14a04e739639e470e4e2a2591b85264ba37f840f2b49  services/aios-two-stage-owner-campaign/payload/scripts/generate_diff_chunks.py
+5751764275e626c787dad17c2561edd86b2710ae0b3cfeafeec44d98126d9015  services/aios-two-stage-owner-campaign/payload/services/aios-autonomous-control-plane/aios_autonomous_control_plane/lineage_audit.py
+2b501bf32a22e1b10c7254d2268d11aa2424aac5756c52441557c25dbaaaa8d5  services/aios-two-stage-owner-campaign/payload/tests/autonomous_control_plane/test_lineage_audit_v3.py
+3f118bc7a4f2bdfdd47e2c86112e87f95162dba4d88c1579337bd1d442ec9832  services/aios-two-stage-owner-campaign/pyproject.toml
+6b4def7c1eef19c01ef73c43252eb0cd1a87c103e1047249a3cfcc75c7922bf6  services/aios-two-stage-owner-campaign/schemas/governance-policy-activation-verification-v1.schema.json
+82ee589dc87db6998ddf0779ce264194cadea0deca66088b0797378f6ce89ad3  services/aios-two-stage-owner-campaign/schemas/task-scoped-release-campaign-v1.schema.json
+d04543b5407dcefc0a41af1b8a65ebc2e62f779582ae959449f1ac37b305eecf  services/aios-two-stage-owner-campaign/src/aios_two_stage_campaign/__init__.py
+935a1c1166b0c1ea35a82256345000bf2c73ded718d77773bc27a71ecce28f7d  services/aios-two-stage-owner-campaign/src/aios_two_stage_campaign/__main__.py
+4e317e2fbf912662bfbf57d2f7fe1a9f7fd3d8c00f7ad09602d9e885ee4ef3cc  services/aios-two-stage-owner-campaign/src/aios_two_stage_campaign/canonical.py
+863be28723553e5bf5df90eda49e96edf8417e765da7b41579f050b04336d480  services/aios-two-stage-owner-campaign/src/aios_two_stage_campaign/cli.py
+dae1e0ed0f841d928a1dd5094c64b1f39b3213301c1da747f45d032a18833c1e  services/aios-two-stage-owner-campaign/src/aios_two_stage_campaign/errors.py
+baf8931566d2c2fb2985d1814b5ded89719bb4b0eba01e94cca9f3690baadeb2  services/aios-two-stage-owner-campaign/src/aios_two_stage_campaign/executor.py
+18feb0792b95f1060aa696cc60943379695a246984aecf76098838f9ed37426e  services/aios-two-stage-owner-campaign/src/aios_two_stage_campaign/journal_anchor.py
+e24765d3c62f9934a921f099e43a002d349a6c9934438da82040e40238070c58  services/aios-two-stage-owner-campaign/src/aios_two_stage_campaign/orchestrator.py
+181e632192f1417a98c1efb35631cf80246759080b2e04243576abcdc7da22af  services/aios-two-stage-owner-campaign/src/aios_two_stage_campaign/runtime_observer.py
+3f3ce81490b6f0893665ba296fc23be904ae0e5dcbcd3b602e25feb2571262b0  services/aios-two-stage-owner-campaign/src/aios_two_stage_campaign/signature.py
+c71d85d5df2ed0e5367de9aacd230f586e77f3b4c11cf52960c84bbdeec43eb7  services/aios-two-stage-owner-campaign/src/aios_two_stage_campaign/state_machine.py
+75ea8ed1c9b49b1ca3ce452fe229524ebd0ccd802945d3362dd668602ce1f98c  services/aios-two-stage-owner-campaign/src/aios_two_stage_campaign/validator.py
+b1be7e1ed0fa0e16e041f77200d651cf46f6bb029c89d31f0b286d32c026cb66  services/aios-two-stage-owner-campaign/tests/test_canonical_snapshot.py
+0bb956135c90cf71fcb655c4d700c1f71c3442b9e9fddc376959890cdad823de  services/aios-two-stage-owner-campaign/tests/test_executor_v2.py
+9bb8a9f1c3bd9aaf44db3dd2f5b810eb0cb650da0e5a5f5e2ea50be46f12664d  services/aios-two-stage-owner-campaign/tests/test_lineage_payload.py
+681c14ddc0be90f94fd3c3d8a6768fe602ec8acd130ed00a8668505d2db57aa2  services/aios-two-stage-owner-campaign/tests/test_orchestrator_v2.py
+9edf44fe0129098c31d66f6b6f7ab252879b425e2844969d09e22c3c88e6b77d  services/aios-two-stage-owner-campaign/tests/test_runtime_observer.py
+204e77c760380f8e29d10fc0afa4227497109d27493245c55a851de6ff69ac86  services/aios-two-stage-owner-campaign/tests/test_signature.py
+9bc5dfa237e6bf37ccc90bbc618a807892d323cdd41345717b296838b44cd22a  services/aios-two-stage-owner-campaign/tests/test_state_machine.py
+a9ef9c11120f480e0cde3ccbf8a816705621506657d8ac10faf7e38fb54bf367  services/aios-two-stage-owner-campaign/tests/test_validator.py
+4ec67865474c6c7ebaa7d125490486e8644618b1666cbde597420e4e6fe8f1d4  tests/single_owner_governance/test_task_scoped_bootstrap.py

services/aios-single-owner-governance/task-scoped-governance-bootstrap-v1.schema.json

@@ -0,0 +1,323 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "TASK_SCOPED_GOVERNANCE_BOOTSTRAP",
+  "title": "TASK_SCOPED_GOVERNANCE_BOOTSTRAP observed approval envelope",
+  "description": "Versioned fail-closed validation envelope assembled from an immutable request plus observed Owner, Git, machine-gate, runtime, and mirror evidence.",
+  "x-schema-version": 1,
+  "x-schema-status": "CANDIDATE",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "document_kind",
+    "request_id",
+    "schema_id",
+    "schema_version",
+    "request_created_at",
+    "request_expires_at",
+    "requester_identity",
+    "repository_identity",
+    "approval_plan_path",
+    "approval_plan_blob_oid",
+    "approval_plan_sha256",
+    "schema_document_sha256",
+    "validator_policy_sha256",
+    "required_machine_contexts",
+    "governance_base_ref",
+    "governance_base_oid",
+    "request_head_ref",
+    "request_head_oid",
+    "code_base_ref",
+    "code_base_oid",
+    "candidate_commit_oid",
+    "candidate_parent_oid",
+    "candidate_tree_oid",
+    "candidate_diff_sha256",
+    "candidate_files_sha256",
+    "target_ref",
+    "target_initial_state",
+    "provision_publisher",
+    "provision_writer",
+    "provision_credential_projection",
+    "publisher_identity",
+    "writer_identity",
+    "credential_secret_ref",
+    "publisher_scope",
+    "writer_scope",
+    "credential_scope",
+    "observed_preapproval_operations",
+    "allowed_operations",
+    "allowed_operations_sha256",
+    "denied_operations",
+    "maximum_operation_count",
+    "maximum_pr_count",
+    "maximum_branch_count",
+    "maximum_commit_count",
+    "allowed_paths",
+    "allowed_paths_sha256",
+    "approved_at",
+    "expires_at",
+    "maximum_lifetime_seconds",
+    "auto_revoke",
+    "required_human_approvals",
+    "allowed_human_approvers",
+    "approved_by",
+    "owner_review_id",
+    "owner_review_commit_oid",
+    "approval_plan_id",
+    "approval_audit_event_id",
+    "production_runtime_anchor_change",
+    "production_writes_enabled",
+    "tag_operations",
+    "registry_operations",
+    "baseline_operations",
+    "deployment_operations",
+    "force_push_allowed",
+    "tag_rewrite_allowed",
+    "direct_main_push_allowed"
+  ],
+  "properties": {
+    "document_kind": {"const": "ENVELOPE"},
+    "request_id": {"type": "string", "minLength": 3, "maxLength": 192, "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]+$"},
+    "schema_id": {"const": "TASK_SCOPED_GOVERNANCE_BOOTSTRAP"},
+    "schema_version": {"const": 1},
+    "request_created_at": {"type": "string", "format": "date-time", "pattern": "Z$"},
+    "request_expires_at": {"type": "string", "format": "date-time", "pattern": "Z$"},
+    "requester_identity": {"$ref": "#/$defs/identity"},
+    "repository_identity": {"const": "aios/aios"},
+    "approval_plan_path": {"type": "string", "pattern": "^approvals/governance-bootstrap/[A-Za-z0-9._-]+\\.json$"},
+    "approval_plan_blob_oid": {"$ref": "#/$defs/oid"},
+    "approval_plan_sha256": {"$ref": "#/$defs/sha256"},
+    "schema_document_sha256": {"$ref": "#/$defs/sha256"},
+    "validator_policy_sha256": {"$ref": "#/$defs/sha256"},
+    "required_machine_contexts": {
+      "type": "array",
+      "minItems": 5,
+      "maxItems": 5,
+      "uniqueItems": true,
+      "items": {"enum": [
+        "governance/authority-mirror",
+        "governance/fault-injection",
+        "governance/runtime-isolation",
+        "governance/schema-contract",
+        "governance/validator-security"
+      ]}
+    },
+    "governance_base_ref": {"const": "refs/heads/governance/approvals"},
+    "governance_base_oid": {"$ref": "#/$defs/oid"},
+    "request_head_ref": {"type": "string", "pattern": "^refs/heads/governance/request/[A-Za-z0-9._/-]+$"},
+    "request_head_oid": {"$ref": "#/$defs/oid"},
+    "code_base_ref": {"type": "string", "pattern": "^refs/heads/patch/[A-Za-z0-9._/-]+$"},
+    "code_base_oid": {"$ref": "#/$defs/oid"},
+    "candidate_commit_oid": {"$ref": "#/$defs/oid"},
+    "candidate_parent_oid": {"$ref": "#/$defs/oid"},
+    "candidate_tree_oid": {"$ref": "#/$defs/oid"},
+    "candidate_diff_sha256": {"$ref": "#/$defs/sha256"},
+    "candidate_files_sha256": {"$ref": "#/$defs/sha256"},
+    "target_ref": {"type": "string", "pattern": "^refs/heads/patch/[A-Za-z0-9._/-]+$"},
+    "target_initial_state": {"const": "ABSENT"},
+    "provision_publisher": {"const": true},
+    "provision_writer": {"const": true},
+    "provision_credential_projection": {"const": true},
+    "publisher_identity": {"$ref": "#/$defs/identity"},
+    "writer_identity": {"$ref": "#/$defs/identity"},
+    "credential_secret_ref": {"type": "string", "pattern": "^(systemd-credential|secret-ref)://[A-Za-z0-9_.-]+$"},
+    "publisher_scope": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "local_code_write", "administrator"],
+      "properties": {
+        "repository": {"const": "aios/aios"},
+        "local_code_write": {"const": false},
+        "administrator": {"const": false}
+      }
+    },
+    "writer_scope": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["repository", "remote_credentials", "remote_push", "run_as_root"],
+      "properties": {
+        "repository": {"const": "aios/aios"},
+        "remote_credentials": {"const": false},
+        "remote_push": {"const": false},
+        "run_as_root": {"const": false}
+      }
+    },
+    "credential_scope": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "provider", "projection", "audience", "writer_visible",
+        "runtime_anchor_visible", "expires_with_request", "revocation_required",
+        "post_revoke_http_status"
+      ],
+      "properties": {
+        "provider": {"const": "systemd"},
+        "projection": {"const": "LoadCredential"},
+        "audience": {"$ref": "#/$defs/identity"},
+        "writer_visible": {"const": false},
+        "runtime_anchor_visible": {"const": false},
+        "expires_with_request": {"const": true},
+        "revocation_required": {"const": true},
+        "post_revoke_http_status": {"const": 401}
+      }
+    },
+    "observed_preapproval_operations": {
+      "type": "array",
+      "minItems": 2,
+      "maxItems": 2,
+      "uniqueItems": true,
+      "items": {"enum": [
+        "create_governance_request_branch",
+        "create_governance_approval_pr"
+      ]}
+    },
+    "allowed_operations": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {"enum": [
+        "provision_task_publisher",
+        "provision_task_writer",
+        "provision_task_credential_projection",
+        "create_approved_code_branch",
+        "push_approved_code_branch",
+        "read_remote_refs",
+        "revoke_task_credentials",
+        "remove_task_identities"
+      ]}
+    },
+    "allowed_operations_sha256": {"$ref": "#/$defs/sha256"},
+    "denied_operations": {"type": "array", "minItems": 12, "uniqueItems": true, "items": {"type": "string"}},
+    "maximum_operation_count": {"type": "integer", "minimum": 1, "maximum": 10},
+    "maximum_pr_count": {"const": 1},
+    "maximum_branch_count": {"const": 1},
+    "maximum_commit_count": {"const": 1},
+    "allowed_paths": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "string", "minLength": 1}},
+    "allowed_paths_sha256": {"$ref": "#/$defs/sha256"},
+    "approved_at": {"type": "string", "format": "date-time", "pattern": "Z$"},
+    "expires_at": {"type": "string", "format": "date-time", "pattern": "Z$"},
+    "maximum_lifetime_seconds": {"type": "integer", "minimum": 1, "maximum": 43200},
+    "auto_revoke": {"const": true},
+    "required_human_approvals": {"const": 1},
+    "allowed_human_approvers": {"const": ["owner"]},
+    "approved_by": {"const": "owner"},
+    "owner_review_id": {"type": "integer", "minimum": 1},
+    "owner_review_commit_oid": {"$ref": "#/$defs/oid"},
+    "approval_plan_id": {"type": "string", "minLength": 3, "maxLength": 192},
+    "approval_audit_event_id": {"type": "string", "minLength": 3, "maxLength": 192},
+    "production_runtime_anchor_change": {"const": false},
+    "production_writes_enabled": {"const": false},
+    "tag_operations": {"const": false},
+    "registry_operations": {"const": false},
+    "baseline_operations": {"const": false},
+    "deployment_operations": {"const": false},
+    "force_push_allowed": {"const": false},
+    "tag_rewrite_allowed": {"const": false},
+    "direct_main_push_allowed": {"const": false}
+  },
+  "$defs": {
+    "plan": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "document_kind", "schema_id", "schema_version", "payload_sha256",
+        "payload"
+      ],
+      "properties": {
+        "document_kind": {"const": "PLAN"},
+        "schema_id": {"const": "TASK_SCOPED_GOVERNANCE_BOOTSTRAP_PLAN"},
+        "schema_version": {"const": 1},
+        "payload_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "payload": {"$ref": "#/$defs/planPayload"}
+      }
+    },
+    "planPayload": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "allowed_human_approvers", "allowed_operations", "allowed_operations_sha256",
+        "allowed_paths", "allowed_paths_sha256", "approval_plan_id", "approval_plan_path",
+        "approved_by", "auto_revoke", "baseline_operations", "candidate_commit_oid",
+        "candidate_diff_sha256", "candidate_files_sha256", "candidate_parent_oid",
+        "candidate_tree_oid", "code_base_oid", "code_base_ref", "credential_scope",
+        "credential_secret_ref", "denied_operations", "deployment_operations",
+        "direct_main_push_allowed", "expires_at", "force_push_allowed",
+        "governance_base_oid", "governance_base_ref", "maximum_branch_count",
+        "maximum_commit_count", "maximum_lifetime_seconds", "maximum_operation_count",
+        "maximum_pr_count", "observed_preapproval_operations",
+        "production_runtime_anchor_change", "production_writes_enabled",
+        "provision_credential_projection", "provision_publisher", "provision_writer",
+        "publisher_identity", "publisher_scope", "registry_operations",
+        "repository_identity", "request_created_at", "request_expires_at",
+        "request_head_ref", "request_id", "requester_identity",
+        "required_human_approvals", "required_machine_contexts",
+        "schema_document_sha256", "schema_id", "schema_version", "tag_operations",
+        "tag_rewrite_allowed", "target_initial_state", "target_ref",
+        "validator_policy_sha256", "writer_identity", "writer_scope"
+      ],
+      "properties": {
+        "allowed_human_approvers": {"$ref": "#/properties/allowed_human_approvers"},
+        "allowed_operations": {"$ref": "#/properties/allowed_operations"},
+        "allowed_operations_sha256": {"$ref": "#/properties/allowed_operations_sha256"},
+        "allowed_paths": {"$ref": "#/properties/allowed_paths"},
+        "allowed_paths_sha256": {"$ref": "#/properties/allowed_paths_sha256"},
+        "approval_plan_id": {"$ref": "#/properties/approval_plan_id"},
+        "approval_plan_path": {"$ref": "#/properties/approval_plan_path"},
+        "approved_by": {"$ref": "#/properties/approved_by"},
+        "auto_revoke": {"$ref": "#/properties/auto_revoke"},
+        "baseline_operations": {"$ref": "#/properties/baseline_operations"},
+        "candidate_commit_oid": {"$ref": "#/properties/candidate_commit_oid"},
+        "candidate_diff_sha256": {"$ref": "#/properties/candidate_diff_sha256"},
+        "candidate_files_sha256": {"$ref": "#/properties/candidate_files_sha256"},
+        "candidate_parent_oid": {"$ref": "#/properties/candidate_parent_oid"},
+        "candidate_tree_oid": {"$ref": "#/properties/candidate_tree_oid"},
+        "code_base_oid": {"$ref": "#/properties/code_base_oid"},
+        "code_base_ref": {"$ref": "#/properties/code_base_ref"},
+        "credential_scope": {"$ref": "#/properties/credential_scope"},
+        "credential_secret_ref": {"$ref": "#/properties/credential_secret_ref"},
+        "denied_operations": {"$ref": "#/properties/denied_operations"},
+        "deployment_operations": {"$ref": "#/properties/deployment_operations"},
+        "direct_main_push_allowed": {"$ref": "#/properties/direct_main_push_allowed"},
+        "expires_at": {"$ref": "#/properties/expires_at"},
+        "force_push_allowed": {"$ref": "#/properties/force_push_allowed"},
+        "governance_base_oid": {"$ref": "#/properties/governance_base_oid"},
+        "governance_base_ref": {"$ref": "#/properties/governance_base_ref"},
+        "maximum_branch_count": {"$ref": "#/properties/maximum_branch_count"},
+        "maximum_commit_count": {"$ref": "#/properties/maximum_commit_count"},
+        "maximum_lifetime_seconds": {"$ref": "#/properties/maximum_lifetime_seconds"},
+        "maximum_operation_count": {"$ref": "#/properties/maximum_operation_count"},
+        "maximum_pr_count": {"$ref": "#/properties/maximum_pr_count"},
+        "observed_preapproval_operations": {"$ref": "#/properties/observed_preapproval_operations"},
+        "production_runtime_anchor_change": {"$ref": "#/properties/production_runtime_anchor_change"},
+        "production_writes_enabled": {"$ref": "#/properties/production_writes_enabled"},
+        "provision_credential_projection": {"$ref": "#/properties/provision_credential_projection"},
+        "provision_publisher": {"$ref": "#/properties/provision_publisher"},
+        "provision_writer": {"$ref": "#/properties/provision_writer"},
+        "publisher_identity": {"$ref": "#/properties/publisher_identity"},
+        "publisher_scope": {"$ref": "#/properties/publisher_scope"},
+        "registry_operations": {"$ref": "#/properties/registry_operations"},
+        "repository_identity": {"$ref": "#/properties/repository_identity"},
+        "request_created_at": {"$ref": "#/properties/request_created_at"},
+        "request_expires_at": {"$ref": "#/properties/request_expires_at"},
+        "request_head_ref": {"$ref": "#/properties/request_head_ref"},
+        "request_id": {"$ref": "#/properties/request_id"},
+        "requester_identity": {"$ref": "#/properties/requester_identity"},
+        "required_human_approvals": {"$ref": "#/properties/required_human_approvals"},
+        "required_machine_contexts": {"$ref": "#/properties/required_machine_contexts"},
+        "schema_document_sha256": {"$ref": "#/properties/schema_document_sha256"},
+        "schema_id": {"$ref": "#/properties/schema_id"},
+        "schema_version": {"$ref": "#/properties/schema_version"},
+        "tag_operations": {"$ref": "#/properties/tag_operations"},
+        "tag_rewrite_allowed": {"$ref": "#/properties/tag_rewrite_allowed"},
+        "target_initial_state": {"$ref": "#/properties/target_initial_state"},
+        "target_ref": {"$ref": "#/properties/target_ref"},
+        "validator_policy_sha256": {"$ref": "#/properties/validator_policy_sha256"},
+        "writer_identity": {"$ref": "#/properties/writer_identity"},
+        "writer_scope": {"$ref": "#/properties/writer_scope"}
+      }
+    },
+    "oid": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+    "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "identity": {"type": "string", "minLength": 3, "maxLength": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9_.-]+$"}
+  }
+}