feat: Phase 1 FDA host-operator Role and railiance01 pilot (WP-0009 T02–T07)

Lock DEC-FDA-001 working defaults; add roles/host-operator package with
OS/security and load protocols; scaffold eng-coulomb-railiance01-ho-001
with bound agent, vault, ramp checklists, and Kai quote/ledger.

docs/agency-framework.md

@@ -347,6 +347,9 @@ Schema: [integrations/schedule-schema.md](integrations/schedule-schema.md).
 - [ADR-005: Scheduled Agent Execution](adr/ADR-005-scheduled-agent-execution.md)
 - [ADR-006: Customer Engagement Convention](adr/ADR-006-customer-engagement-convention.md)
 - [Forward-Deployed Engagement Architecture](forward-deployed-engagement-architecture.md) — client-requestable Roles, ramp-up/down, client vaults
+- [DEC-FDA-001 working defaults](decisions/DEC-FDA-001-working-defaults.md)
+- [roles/host-operator](../roles/host-operator/) — first Role package (pilot)
+- [engagements/pilots/eng-coulomb-railiance01-ho-001](../engagements/pilots/eng-coulomb-railiance01-ho-001/) — Phase 1 pilot tree
 - [wiki/ForwardDeployedAgencyBusinessModel.md](../wiki/ForwardDeployedAgencyBusinessModel.md) — Kai trial currency, seats/duties, confidentiality
 - [wiki/EcosystemIntegration.md](../wiki/EcosystemIntegration.md) — two-layer measurement model
 - [WP-0002: Agency Framework](../workplans/kaizen-agentic-WP-0002-agency-framework.md)

docs/decisions/DEC-FDA-001-working-defaults.md

@@ -0,0 +1,77 @@
+# DEC-FDA-001 — Forward-deployed agency working defaults
+
+**Status:** accepted (working default; sponsor may override)
+**Date:** 2026-07-16
+**Workplan:** KAIZEN-WP-0009-T02
+**Deciders:** kaizen-agentic (implementation default for Phase 1 pilot)
+
+## Context
+
+Architecture open questions blocked Phase 1 scaffolding. We lock **working
+defaults** so host-operator @ railiance01 can proceed without waiting on a
+separate product decision cycle. Overrides are welcome; change this DEC and
+bump architecture/business model versions.
+
+## Decisions
+
+### D1 — Kai ledger home
+
+**Decision:** Phase 1 uses a **file-based JSONL ledger** at
+`engagements/.../commercial/ledger.jsonl` (schema in architecture §10).
+
+No State Hub extension and no finance-system integration in Phase 1.
+
+**Rationale:** Offline, reviewable, zero new infrastructure; enough to prove
+unit economics before EUR.
+
+### D2 — Engagement store placement
+
+**Decision:**
+
+| Artifact | Location |
+|----------|----------|
+| Role packages (supplier IP) | `kaizen-agentic/roles/<role-id>/` |
+| Pilot engagement tree | `kaizen-agentic/engagements/pilots/<engagement-id>/` |
+| Future production client vaults | Client-owned repo (e.g. railiance-hosts or dedicated ops-engagements); pilot may be **copied** out later |
+
+**Rationale:** Keep Phase 1 self-contained in the supplier repo for iteration.
+Client-owned vault remains the confidentiality rule; pilot path is scaffolding,
+not a claim of ownership of operational knowledge.
+
+### D3 — Multi-target binding
+
+**Decision:** **One Engagement, N Targets.** One bound agent definition;
+baselines and findings are per-target under `vault/baselines/<target-id>.md`.
+
+Pilot has N=1 (`railiance01`).
+
+### D4 — Metrics sharing with supplier optimizer
+
+**Decision:** **Opt-in, default off.** Pilot does not publish vault content or
+raw metrics to supplier optimizer. Local `.kaizen/metrics` or engagement
+`reports/` only. Shared aggregates require `contribute_metrics: approved` on
+the engagement record (not set for pilot).
+
+### D5 — Craft base for host-operator
+
+**Decision:** `base_agent: sys-medic`. Bound definition may start as sys-medic
+prompt + engagement binding appendix; Role package owns charter, protocols, and
+memory template.
+
+### D6 — Privilege policy
+
+**Decision:** `privileged_ops`, package upgrade, firewall change, and reboot
+require **recorded human approval** in the vault session log before execution.
+Observe-class work does not.
+
+## Consequences
+
+- Phase 1 pilot proceeds under `engagements/pilots/eng-coulomb-railiance01-ho-001/`
+- Architecture and business model docs promote to **v0.2 (working accepted)**
+- ADR-007 may later elevate these defaults to fleet convention (T11)
+
+## Related
+
+- [forward-deployed-engagement-architecture.md](../forward-deployed-engagement-architecture.md)
+- [ForwardDeployedAgencyBusinessModel.md](../../wiki/ForwardDeployedAgencyBusinessModel.md)
+- KAIZEN-WP-0009

docs/forward-deployed-engagement-architecture.md

@@ -1,10 +1,12 @@
 # Forward-Deployed Engagement Architecture
 
-**Status:** draft specification v0.1
+**Status:** v0.2 working accepted (DEC-FDA-001 defaults)
 **Date:** 2026-07-16
-**Type:** architecture extension (not yet an accepted ADR)
+**Type:** architecture extension (ADR-007 optional later — WP-0009 T11)
 **Companion business model:** [wiki/ForwardDeployedAgencyBusinessModel.md](../wiki/ForwardDeployedAgencyBusinessModel.md)
+**Decisions:** [docs/decisions/DEC-FDA-001-working-defaults.md](decisions/DEC-FDA-001-working-defaults.md)
 **Extends:** ADR-002 (memory), ADR-003 (protocols), ADR-005 (schedule), ADR-006 (customer engagement)
+**Pilot tree:** `engagements/pilots/eng-coulomb-railiance01-ho-001/`
 
 ---
 
@@ -681,18 +683,27 @@ kaizen-agentic once pilot checklist passes twice.
 
 ## 15. Open technical questions
 
-1. Single monorepo path `engagements/` vs dedicated client engagement repo per company?
-   (**Recommend:** dedicated client repo or subdirectory in existing ops repo — e.g. railiance-hosts or a new `coulomb-ops-engagements`.)
-2. Should bound definitions be signed (supply-chain) for production host ops?
-3. Multi-target engagements: one agent definition vs. one per host?
-   (**Recommend:** one engagement, N targets, N baseline files.)
-4. How aggressively to share metrics aggregates with supplier optimizer by default?
-   (**Recommend:** off until opt-in flag on engagement.)
+Resolved for Phase 1 by [DEC-FDA-001](decisions/DEC-FDA-001-working-defaults.md):
+
+| Question | Working default |
+|----------|-----------------|
+| Engagement store | Pilot under `engagements/pilots/` in kaizen-agentic; production vaults client-owned later |
+| Multi-target | One engagement, N targets, N baseline files |
+| Metrics to supplier optimizer | Opt-in, default off |
+| Kai ledger | File JSONL under engagement `commercial/` |
+
+Still open (non-blocking):
+
+1. Should bound definitions be signed (supply-chain) for production host ops?
+2. When to copy pilot vault to a client-owned repo for pure custody?
 
 ---
 
 ## Related documents
 
+- [DEC-FDA-001](decisions/DEC-FDA-001-working-defaults.md)
+- [roles/host-operator](../roles/host-operator/)
+- [pilot engagement](../engagements/pilots/eng-coulomb-railiance01-ho-001/)
 - [wiki/ForwardDeployedAgencyBusinessModel.md](../wiki/ForwardDeployedAgencyBusinessModel.md)
 - [agency-framework.md](agency-framework.md)
 - [adr/ADR-006-customer-engagement-convention.md](adr/ADR-006-customer-engagement-convention.md)