Refine stewardship evidence and specify owner preparation handoffs

Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e782-9f45-7382-afff-77ad665b88ec
2026-09-28 13:06:18 +02:00 · 2026-09-28 13:06:18 +02:00 · 3bd576990b
commit 3bd576990b
parent fdbf8bf9d1
12 changed files with 708 additions and 40 deletions
--- a/decisions/rollback-gate-amendment.md
+++ b/decisions/rollback-gate-amendment.md
@ -0,0 +1,53 @@
+# Proposed amendment: allow the prerequisite proof to be produced
+
+Status: proposed; not enacted. Decision:
+`e9aca79b-f167-4326-94cd-037dcea34cd2`.
+
+## Problem
+
+The standing rule requires all four entry conditions before T03/T04, while T04
+was intended to produce condition 4. Unrelated application rollback receipts do
+not resolve this dependency. Moving the same experiment to another repo merely
+to evade the gate would not resolve it either.
+
+## Exact proposed rule
+
+Replace the all-four prerequisite for the **disposable-only portions of T03/T04**
+with these conditions:
+
+1. Entry conditions 1–3 are met and the evidence is accepted for the tested scope.
+2. railiance-forge has a file-backed, separately authorized rehearsal record
+   naming an isolated disposable instance, its product/version/configuration,
+   fixtures, permitted operations, cleanup and rollback evidence.
+3. The rehearsal uses no existing production org/repository/package, customer
+   data or production credential grant. Its GitOps and image-pull consumer is a
+   disposable fixture. Configuration differences from production are recorded.
+4. Only disposable repo transfer/rename, package behavior and recovery are
+   exercised. No existing repo is used merely because it seems low-stakes.
+5. T03/T04 evidence may satisfy condition 4 only for behavior reproduced with
+   equivalent relevant configuration; untested production-specific differences
+   remain blockers. The forge owner signs off applicability.
+
+**All four entry conditions remain required before any production transfer,
+production rehearsal, or T05 execution.** G3/G4 still need accepted behavior and
+rollback evidence; production GitOps and fresh-pull acceptance remain required
+before migration completion. This amendment changes sequencing, not evidence
+quality or production authority.
+
+## Files to change if accepted
+
+- AGENTS.md, “Before anything else”: keep the all-four production rule and add
+  the exact disposable-only exception above for T03/T04.
+- ORGREF-WP-0001 entry gate: reference the exception and keep conditions 1–4.
+- T03/T04: distinguish disposable prerequisite proof from later production
+  applicability verification; remove the requirement for prior condition-4
+  proof only from the disposable portion.
+- GOAL.md/history and State Hub decision: record the accepted amendment and
+  its scope. Do not mark any gate green merely because this rule is accepted.
+
+## Effect today
+
+None on execution readiness: conditions 2 and 3 still fail, and no owner
+rehearsal record/target has been authorized. Accepting this proposal alone would
+not permit any live action now. Until explicitly accepted, AGENTS.md and the
+original all-four rule remain unchanged.
--- a/history/2026-09-28-coordination-followup.md
+++ b/history/2026-09-28-coordination-followup.md
@ -0,0 +1,54 @@
+# Preparation coordination follow-up — 2026-09-28
+
+User instruction: proceed with the remaining preparation coordination.
+
+## What advanced
+
+- Reviewed the 35 previously unresolved repositories against their local purpose
+  and scope records. Four now have evidence-backed proposals: disaster-control
+  → coulomb; ops-hub → helixforge; whynot-control and whynot-design → candidate
+  whynot. The current matrix has 122 proposed and 31 unresolved assignments.
+  None is marked approved; named maintainers and effective grants remain unknown.
+- Prepared the exact rollback-gate sequencing amendment in
+  `decisions/rollback-gate-amendment.md`. Explicit approval was requested, but
+  none has been received. AGENTS.md and the all-four gate are unchanged.
+- Specified a sanitized authenticated owner export contract. Linked the existing
+  credential caller-identity and PAT-lane work by stable IDs; did not retry the
+  denied credential request or use another principal.
+- Linked coverage and GitOps owner records, produced a 52-row workload diagnostic
+  queue, and enumerated all 326 excluded source/archive items for disposition.
+  These are review contacts/context records, not accepted new owner task grants.
+- Inspected all four markitect-main gitlinks and recorded their exact revisions.
+  They still point to the old forge endpoint. Attached wiki and issue-facade
+  identities require reconciliation beyond the standalone assignment matrix.
+- Repeated the inventory consecutively. Reference sets remained equal, but
+  hub-core content changed, so condition 3 still fails. The retry receipt is
+  diagnostic only; the earlier full snapshots are retained unchanged.
+
+## Decisions still required
+
+Existing State Hub decisions were updated in place, not duplicated:
+
+- `60c5767c-d510-4d13-9a24-d5d58485b7e5`: candidate whynot naming, 31 unresolved
+  stewards, acceptance of all proposed targets and named teams.
+- `5f3680fc-0cd5-4d27-ba39-59fbdd13313c`: authorized authenticated export/access,
+  exclusion disposition and complete consumer census.
+- `e9aca79b-f167-4326-94cd-037dcea34cd2`: proposed disposable-only exception to
+  the sequencing rule. Accepting it would not permit execution today because
+  conditions 2/3 and the scoped owner rehearsal record are still missing.
+
+The candidate whynot addition is grounded in its existing organizational intent,
+not the lifecycle of every experimental repo. The requested naming preference
+remains unanswered; the matrix explicitly marks it as unaccepted.
+
+Factory integration of Vergabe Teilnahme remains insufficient evidence to infer
+its product steward. Likewise canon ownership is not an organization/team grant.
+No new maintainers, server IDs or accepted remediation tasks were invented.
+
+## Validation and readiness
+
+JSON/CSV populations, proposal counts, 52 coverage rows, 326 exclusion rows,
+source evidence paths/hashes and preserved AGENTS.md were checked. No production
+implementation or T03–T05 work started. No messages were sent to other agents.
+T01/T02 remain waiting on the concrete acceptance gaps; the four-condition entry
+gate is still not met.
--- a/inventory/README.md
+++ b/inventory/README.md
@ -100,3 +100,18 @@ precheck, **not the whole G6 gate**. Before G6, extend it with reviewed per-loca
 historical dispositions and the accepted runtime/package inventory, then prove
 GitOps recovery and fresh pulls/reschedules under the owner execution records.
 Do not change `g1_complete` or `approved` merely to obtain a green check.
+
+## Follow-up review
+
+[Owner evidence contract](owner-evidence-contract.md) specifies the sanitized
+export needed from an authorized forge owner. [Owner follow-ups](owner-followups.md)
+link stable work-record IDs, the 52-row workload review queue and all 326 excluded
+source items. Four pinned submodules still reference the old forge endpoint;
+wiki/issue-facade identity reconciliation remains open.
+
+A further consecutive pair also failed stability: hub-core changed between runs.
+`stability-retry.json` records hashes and the changed fields as a diagnostic
+receipt; temporary full retry outputs were not retained as accepted evidence.
+The original full snapshots and comparison remain unchanged. No credential retry
+was made after the policy denial; the existing owner records explain where to
+resolve caller binding without substituting another workload's identity.
--- a/inventory/exclusion-review.csv
+++ b/inventory/exclusion-review.csv
@ -0,0 +1,327 @@
+repository,path,reason,proposed_handling,acceptance
+activity-core,.env.example,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+artifact-store,.env.example,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+binect-chrome,public/icons/icon-128.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+binect-chrome,public/icons/icon-16.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+binect-chrome,public/icons/icon-32.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+binect-chrome,public/icons/icon-48.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+binect-chrome,specs/binectapi_rest.pdf,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+binect-js,examples/din5008/260114-brief-testbriefBinectJs.odt,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+binect-js,examples/din5008/260114-brief-testbriefBinectJs.pdf,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+binect-js,examples/din5008/260114-brief-testbriefKeinePlz.odt,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+binect-js,examples/din5008/260114-brief-testbriefKeinePlz.pdf,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+binect-js,history/260116-suggested-improvements.md,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+coulomb-social,.env.example,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+direkt-vermittlung-de,DirektVermittlungDe.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+direkt-vermittlung-de,prototype-grok4.1/direktvermittlungde-backend/.env.example.txt,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+evidence-binder,src/repos/in-memory-links.ts,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+evidence-binder,src/visual-guide/rect-registry.ts,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+facetted-interfaces,history/FIAM_v0.2_Draft6/history/draft5-fixtures/estate-history/estate.sqlite,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+facetted-interfaces,history/FIAM_v0.2_Draft6/tools/__pycache__/catalog_exchange.cpython-312.pyc,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+facetted-interfaces,history/FIAM_v0.2_Draft6/tools/__pycache__/declaration_matching.cpython-312.pyc,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+facetted-interfaces,history/FIAM_v0.2_Draft6/tools/__pycache__/evidence_scoring.cpython-312.pyc,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+facetted-interfaces,history/FIAM_v0.2_Draft6/tools/__pycache__/index_query.cpython-312.pyc,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+facetted-interfaces,history/FIAM_v0.2_Draft6/tools/__pycache__/validate_fiam.cpython-312.pyc,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+ground-game,editions/ground-darvo-r0/GROUND_DARVO_Edition_CSV_Bundle_v0.1.zip,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,scripts/__pycache__/check-entries.cpython-312.pyc,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/bernd-20260815-how-it-started.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/claude-1cc71ea1-clay-borg-aspect-space.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/claude-8d5d2963-email-connect-test-harness.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/claude-b15c1ddf-info-tech-canon-assimilation.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-019fe2ec-state-hub-architecture-recovery.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-01a023c0-two-windows.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-01a053ff-forge-river-nine-doors.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-01a06e87-keycape-measured-claims.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-01a06ea3-verifier-earned-its-green.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-01a06ec5-qonto-runtime.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-01a087ca-seven-threads.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-01a087d8-work-beneath-finished.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-01a0e429-recovery-four-waits.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-01a0e6ef-five-gates.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-01a0e6f1-telemetry-receipt.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260819-clean-rooms-handoff.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260819-issue-core-direct-service.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260820-activity-core-truthful-automation.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260821-address-moved.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260821-glas-two-reins-one-task.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260821-reef-dark-sockets.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260821-seven-tables-crossed.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260821-watcher-stayed.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260822-empty-room-learned-sequence.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260822-errand-became-interface.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260822-machine-stayed-still.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260822-sbom-ledger-found-room.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260822-sealed-hatch-dead-bell.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260822-second-chamber-first-changed-keys.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260822-window-found-drivers.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260823-catalog-learned-not-yet.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260823-claim-knew-holder.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260823-engine-became-mirror.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260823-helper-got-a-room.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260823-identity-handoff.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260823-repair-path-queue-truth.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260823-three-maps-one-closed-gate.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260824-tamq-queue.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260828-tamq-two-windows.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260901-binding-object-honest-gates.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260901-policy-risk-register-let-go.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260907-coordination-new-ring.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260928-key-matched-approval.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260928-ten-original-rings.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-20260928-tenant-engine-three-steps.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-canon-b081d39-scope-stars.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-ceiling-gap-three-connectors.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-clock-closeout-20260928-bench.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-coordination-one-open-ring.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-evidence-binder-right-map.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-fabric-three-open-ends.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-federation-foundation.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-fi-bounded-stream-honest-gaps.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-fi-four-waiting-threads.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-fiam-four-source-plates.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-four-gates-and-an-archive.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-frontend-patterns-closeout-old-constellation.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-infra-eight-open-ends.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-interface-canon-distinct-meanings.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-kaizen-boundary-custody.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-kings-guard-fresh-glass-old-evidence.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-knative-promise-recorded.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-launcher-at-the-threshold.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-ledger-before-pipes-portrait.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-netkingdom-registration-bridge.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-nine-matches-open-clasp.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-platform-beneath-domain-tenant-zero.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-platform-evidence-found-its-date.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-policy-nexus-source-to-rollback.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-pqrst-record-kept-its-crack.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-qonto-quiet-stream-spoke.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-radar-three-threads.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-railiance-binding-one-closed-clasp.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-rapp-core-hub-private-door.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-recovery-under-old-overlay.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-reef-storage-evidence-caught-up.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-risk-register-visible-obligations.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-source-stayed-connected.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-statehub-snapshot-and-signature.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-status-had-not-moved.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-telemetry-reconstruction.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-three-lamps-open-clock.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-two-old-names.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-two-requests-open-acceptance.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-username-came-through-two-doors.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-warden-empty-frame.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/codex-whitehat-clean-cutoff.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-019fde05-ground-game-aspect-catalog.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-019ff52d-coulomb-social-landing-pad.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-019ff52e-email-connect-night-window.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-019ff826-audit-core-honest-custody.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-019ffabd-rapp-postgres-tested-restore.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-019ffd41-railiance-platform-closed-plates.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-019ffd77-tenant-engine-self-portrait.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-019fff72-resource-control-five-facets.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a0057c-railiance-infra-declared-state.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a0062f-info-tech-canon-consumer-join.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a00632-fin-hub-unknown-is-never-cheaper.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a00673-hall-the-empty-chair.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a00677-railiance-master-private-by-default.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a006b2-ops-warden-delegation-register.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a0079f-key-cape-aal1-is-not-a-hallway-pass.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a007fa-flex-auth-matching-live.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a018dd-user-engine-do-not-probe-warn.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a0193f-flex-auth-applying-the-end-state.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a02670-empty-room-sent-ten.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a04996-reset-ran-acknowledgement-stayed-unused.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a04c9f-railiance-master-workload-not-a-fifth-axis.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a04cea-engine-declared-production-stayed-closed.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a04cea-f0d6-user-engine-own-voice.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a04ceb-2057-approval-engine-consume-unguessed.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a04ceb-zone-engine-offline-pip.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a05e32-pending-is-not-a-green-tick.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a05ef1-kings-guard-propose-not-act.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a05f07-consume-landed-first-lane-unapplied.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a060e9-risk-nexus-same-sitting-did-not-climb.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a06253-approval-engine-harness-live-rooms-closed.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a06256-snapshot-got-a-digest.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a0a23b-public-door-off-narrow-key.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a0e242-quiet-counters-did-not-clear.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok-01a0e2a1-memo-version-three.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/grok.1fi-15463ccf-runbook-never-run.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+hall-of-helix,visuals/metamuse-f2bff2d5-projection-identity-convergence.webp,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+helix-forge,design/HelixForge.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+informed-decision,docs/evidence/2026-09-11-recorded-desktop.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+informed-decision,docs/evidence/2026-09-11-review-desktop.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+informed-decision,docs/evidence/2026-09-11-review-mobile.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+intelligence-radar,data/artifacts/33573adb9f1871b903f79b77d7755a44cc20bb913ef48ac9000ddb090e41f7ed,over-4MB,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+intelligence-radar,history/20260913-intelligence-radar-starter-2026-09-13_chatgpt.zip,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+intelligence-radar,history/20260913-intelligence-radar_grok.zip,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+kaizen-agentic,wiki/AbcdekGuidance.md,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+key-cape,bin/keycape,over-4MB,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+key-cape,bin/keycape-to-keycloak,over-4MB,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+key-cape,bin/lldap-export,over-4MB,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+key-cape,bin/lldap-to-ldap,over-4MB,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+key-cape,bin/validator,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+key-cape,history/KEY-WP-0011-rotated-credentials-2026-08-23-final.tar.age,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+marki-docx,tests/regression/fixtures/word_first/source.docx,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.claude/agents/agent-claude-documentation.md,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,.claude/agents/agent-keepaChangelog.md,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,.venv_old/bin/python,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,.venv_old/bin/python3,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,.venv_old/bin/python3.8,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,.venv_old/lib64,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,.venv_old/share/python-wheels/CacheControl-0.11.7-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/appdirs-1.4.3-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/certifi-2018.1.18-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/chardet-3.0.4-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/colorama-0.3.7-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/distlib-0.2.6-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/distro-1.0.1-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/html5lib-0.999999999-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/idna-2.6-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/ipaddress-0.0.0-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/lockfile-0.12.2-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/packaging-17.1-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/pip-9.0.1-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/pkg_resources-0.0.0-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/progress-1.2-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/pyparsing-2.2.0-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/requests-2.18.4-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/retrying-1.3.3-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/setuptools-39.0.1-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/six-1.11.0-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/urllib3-1.22-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/webencodings-0.5-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,.venv_old/share/python-wheels/wheel-0.30.0-py2.py3-none-any.whl,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,_issue-tracking/issue-facade,gitlink-or-directory-not-scanned,Capture gitlink revision and canonical repo/wiki identity; sibling HEAD scan alone is insufficient,unreviewed
+markitect-main,assets/33/33794900aef1bda0b9bbb8f24f26e6181507169bb1979a8502503ae68962a9aa.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,assets/33/33ed8dd1f8e470138f016e1a2641d38ccbc1c1cfb10ffdac59ef309974748c6d.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,assets/34/345fe884e0f85e1d08e893f4c977b8e7437542126b6be90d86e8b8f68bba686f.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,assets/61/61cb7a679ea77d0765e7f2285b080add305d096a795abc48e82a7cd8d915d9d3.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,assets/9e/9e90160cc46e32c3790e38e55bdc3bbd8d61f85036191b6693d02e53c06b1e4d.jpg,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,assets/b5/b509163964e822915ea7e822759ecae39dd696626e70b74b96de6ac7396415d0.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,assets/d1/d1f2de1aa975f05ac067cb3512059a675aad9acd6e1bcd5dc57e1dd51d00db01.pdf,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,assets/e4/e4d8e7de1bda3f19dd16c984ec045bed1a60fe69989ff48a2875cf81dfd56bb6.pdf,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,assets/eb/eb41ad8186ddebf801dd8c64bd75e5b18c95d8bce648be10ae298f5fd97fe3a6.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,assets/f4/f45288fe7b30287abefccd6e96eafa2413c2f73671c433a9fd17f96876dcba68.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,capabilities/kaizen-agentic,gitlink-or-directory-not-scanned,Capture gitlink revision and canonical repo/wiki identity; sibling HEAD scan alone is insufficient,unreviewed
+markitect-main,capabilities/testdrive-jsui,gitlink-or-directory-not-scanned,Capture gitlink revision and canonical repo/wiki identity; sibling HEAD scan alone is insufficient,unreviewed
+markitect-main,docs/agents,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,examples/asset-management/demo_hash_store/demo_inputs/company_logo.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/asset-management/demo_hash_store/demo_inputs/diagram.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/asset-management/demo_hash_store/demo_inputs/logo.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/asset-management/demo_hash_store/metadata.db,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/asset-management/demo_hash_store/store/sha256/25965a/25965aaacc4f361784870ed2624f0178ea7c3cf33961ffb73ef13bafed7cd28c.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/asset-management/demo_hash_store/store/sha256/54f88e/54f88ec7aa8570d4ad655943d36f5db47021501baeac8ceeb3b726157de6ebf5.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/asset-management/demo_workspace/demo_assets/company_logo.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/asset-management/demo_workspace/demo_assets/diagram.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/asset-management/demo_workspace/demo_assets/logo.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/asset-management/demo_workspace/documents/project_a/assets/diagram.png,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,examples/asset-management/demo_workspace/documents/project_a/assets/logo.png,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,examples/asset-management/demo_workspace/documents/project_b/assets/company_logo.png,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,examples/asset-management/demo_workspace/documents/project_b/assets/system_diagram.png,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,examples/asset-management/demo_workspace/packages/project_a.mdpkg,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/asset-management/demo_workspace/packages/project_b.mdpkg,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/asset-management/demo_workspace/shared_assets/images/25965aaacc4f361784870ed2624f0178ea7c3cf33961ffb73ef13bafed7cd28c.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/asset-management/demo_workspace/shared_assets/images/54f88ec7aa8570d4ad655943d36f5db47021501baeac8ceeb3b726157de6ebf5.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/image-assets/images/architecture_diagram.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/image-assets/images/company_logo.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/image-assets/images/dashboard_screenshot.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/image-assets/images/performance_chart.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/image-assets/images/project_icon.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,examples/image-assets/images/settings_panel.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,history/2025/251114-legacy-files/.env.tddai,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+markitect-main,node_modules/.bin/baseline-browser-mapping,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/browserslist,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/esparse,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/esvalidate,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/glob,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/import-local-fixture,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/jest,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/js-yaml,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/jsesc,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/json5,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/napi-postinstall,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/node-which,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/parser,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/semver,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/tldts,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/.bin/update-browserslist-db,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/@jest/reporters/assets/jest_logo.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,node_modules/@unrs/resolver-binding-linux-x64-gnu/resolver.linux-x64-gnu.node,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,node_modules/@unrs/resolver-binding-linux-x64-musl/resolver.linux-x64-musl.node,binary-content,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+markitect-main,node_modules/istanbul-lib-instrument/node_modules/.bin/semver,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/jest-snapshot/node_modules/.bin/semver,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,node_modules/make-dir/node_modules/.bin/semver,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+markitect-main,wiki,gitlink-or-directory-not-scanned,Capture gitlink revision and canonical repo/wiki identity; sibling HEAD scan alone is insufficient,unreviewed
+net-kingdom,.sops.yaml,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+net-kingdom,sso-mfa/bootstrap/secrets.enc/authelia/secrets.env.age,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+net-kingdom,sso-mfa/bootstrap/secrets.enc/breakglass/secrets.env.age,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+net-kingdom,sso-mfa/bootstrap/secrets.enc/keycape/key.pem.age,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+net-kingdom,sso-mfa/bootstrap/secrets.enc/keycape/pi_admin_token.age,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+net-kingdom,sso-mfa/bootstrap/secrets.enc/keycape/secrets.env.age,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+net-kingdom,sso-mfa/bootstrap/secrets.enc/lldap/secrets.env.age,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+net-kingdom,sso-mfa/bootstrap/secrets.enc/postgres/secrets.env.age,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+net-kingdom,sso-mfa/bootstrap/secrets.enc/privacyidea/pi.enc.age,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+net-kingdom,sso-mfa/bootstrap/secrets.enc/privacyidea/private.pem.age,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+net-kingdom,sso-mfa/bootstrap/secrets.enc/privacyidea/public.pem.age,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+net-kingdom,sso-mfa/bootstrap/secrets.enc/privacyidea/secrets.env.age,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+pr-hall-of-helix,assets/helix-forge.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+railiance-apps,.sops.yaml,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-apps,helm/forgejo-runner-registration.sops.yaml,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-apps,helm/forgejo-runner-registration.sops.yaml.template,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-apps,helm/forgejo-secrets.sops.yaml,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-apps,helm/forgejo-secrets.sops.yaml.template,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-apps,tools/check-sops.sh,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-bootstrap,.sops.yaml,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-cluster,.sops.yaml,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-forge,helm/gitea-values.sops.yaml,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-hosts,.sops.yaml,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-hosts,inventory/group_vars/secrets.sops.yaml,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-hosts,scripts/sops.sh,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-infra,.sops.yaml,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-infra,docs/evidence/resource-hosteurope-railiance01/observations/latest.json,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+railiance-infra,scripts/sops.sh,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-platform,.sops.yaml,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-platform,argocd/repositories/issue-core.repository.sops.yaml.template,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-platform,argocd/repositories/railiance-platform.repository.sops.yaml.template,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-platform,argocd/repositories/rapp-issue-core.repository.sops.yaml.template,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-platform,helm/apps-pg-secret.sops.yaml.template,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-platform,helm/forgejo-db-secret.sops.yaml.template,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-platform,helm/gitea-db-secret.sops.yaml.template,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-platform,helm/valkey-values.sops.yaml,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-platform,helm/valkey-values.sops.yaml.template,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+railiance-platform,tools/vendor/bin/age,over-4MB,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+state-hub,.env.example,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+state-hub,deploy/railiance/apps/manifests/state-hub-env.secret.sops.yaml.template,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+state-hub,deploy/railiance/platform/state-hub-db-credentials.sops.yaml.template,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+tele-mcp,assets/TeleMcpLogo.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+testdrive-jsui,_jsui/css/base.css,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/css/controls.css,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/css/editor.css,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/css/themes/github.css,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/js/components/dom-renderer.js,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/js/components/floating-menu.js,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/js/controls/contents-control.js,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/js/controls/control-base.js,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/js/controls/debug-control.js,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/js/controls/edit-control.js,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/js/controls/status-control.js,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/js/core/event-emitter.js,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/js/core/section-manager.js,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/js/core/section.js,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/js/testdrive-jsui.js,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,_jsui/js/utils/html-generator.js,symlink-not-followed,Resolve target/revision through owner; link separately scanned source or inventory missing target,unreviewed
+testdrive-jsui,examples/todohtml/_markitect/plugins/testdrive-jsui/static/images/icons/edit.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+testdrive-jsui,examples/todohtml/_markitect/plugins/testdrive-jsui/static/images/icons/reset.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+testdrive-jsui,examples/todohtml/_markitect/plugins/testdrive-jsui/static/images/icons/save.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+testdrive-jsui,static/images/icons/edit.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+testdrive-jsui,static/images/icons/reset.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+testdrive-jsui,static/images/icons/save.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+timeline-svg,TimelineSvg.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+vergabe-teilnahme,.env.example,sensitive-or-encrypted,Owner to supply reference-only projection; never decrypt or copy credentials here,unreviewed
+whynot-control,design/WhyWhyNotLogo.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+whynot-design,assets/whynot-logo-original.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+whynot-design,assets/whynot-logo.png,binary-extension,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+inter-hub-haskell,.env.example,sensitive-binary-or-large,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+inter-hub-haskell,.sops.yaml,sensitive-binary-or-large,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+inter-hub-haskell,deploy/railiance/secrets/inter-hub.env.sops.yaml,sensitive-binary-or-large,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
+inter-hub-haskell,static/favicon.ico,sensitive-binary-or-large,"Owner to attest no embedded operational reference, or supply sanitized reference locations",unreviewed
--- a/inventory/owner-evidence-contract.md
+++ b/inventory/owner-evidence-contract.md
@ -0,0 +1,57 @@
+# Owner evidence required to complete G1
+
+Decision `5f3680fc-0cd5-4d27-ba39-59fbdd13313c` remains open. The previous
+credential request was denied by the policy gate. This contract can be fulfilled
+by an authorized forge owner; it does not authorize this project to impersonate
+that owner, mint credentials, or use State Hub's workload credential.
+
+## Export contents
+
+Provide a JSON export with the fields below. A successful HTTP response, an
+empty list, or a site-admin flag alone is not proof of coverage.
+
+| Section | Required evidence |
+| --- | --- |
+| provenance | Capture time, source instance URL, product/version, authenticated principal identifier (no token), export tool/revision, owner attestation and scope |
+| repositories | Immutable ID, current owner/name, visibility, archive state, default branch and revision; include private and archived repositories |
+| packages | Immutable package/version identity where supported, owner, type, name, tags/digests, repository association separately; include unlinked packages and retained rollback versions |
+| access | Actual org/team membership and repository grants, direct collaborators, branch protections, machine-reader grants; distinguish inherited from direct grants |
+| automation | Deploy-key IDs and read/write flags (no key bytes), webhook IDs and destination host/path without query credentials, runner associations and reusable workflow consumers |
+| pagination | Endpoint/filter and observed counts for every page, termination evidence, API permission failures and omissions; no silent partial success |
+| consumers | GitOps source allowlists and repository credential references, runtime/current and rollback image consumers, package index users, external clones/CI and frozen-cluster consumers |
+| completeness | Owner-confirmed reconciliation with this project's public/local/registered census; every omission explicitly accepted or blocking |
+
+Do not export credential values, key bytes, Secret objects, webhook secrets,
+auth headers, token-bearing URLs or raw environment/configuration dumps.
+Names and grant IDs are sufficient for the access comparison. Record unavailable
+surfaces as blockers rather than replacing them with empty accepted lists.
+
+## Acceptance procedure
+
+1. Validate identities and pagination; reconcile the 12 local paths absent from
+   the anonymous census, remote-only private repos and archived repos.
+2. Join repo/package identities to the assignment matrix. Do not derive package
+   ownership from Git repository ownership.
+3. Reconcile reference locations, runtime consumers and each excluded surface.
+4. Record grant-preservation checks for every proposed transfer; no broad new
+   org membership may silently widen access.
+5. Capture two consecutive source/server/runtime snapshots in a declared
+   unchanged-fleet window. Stop acceptance if revisions, content, grants or
+   consumer sets change. Compare semantic inventory and record provenance.
+6. Only after owner attestation and all coverage gaps are closed may G1 and
+   condition 3 be accepted. Stable partial output is insufficient.
+
+## Existing owner records
+
+- WARDEN-WP-0025 — `70c11222-d8e7-5936-99f7-7d626a4a5deb`: admin PAT lane
+  establishment. Historical success does not establish current caller access.
+- WARDEN-WP-0031 — `739bad25-2345-5f4f-aaa3-cc4cd8c71f6c`: caller identity
+  on policy requests. Its documented 403 distinction concerns system binding;
+  it supplies the right diagnostic owner, not permission to substitute an identity.
+- MASON-WP-0003 — `4015b46d-02f1-56ac-853e-87e8542cf0dd`: State Hub's narrow
+  forge-read workload lane. This is a separate principal and use; it is not an
+  alternative credential for this project following the denial.
+
+These are context records, not newly accepted owner follow-ups. A new repair or
+export activity must retain its owner's own record and be linked here once it
+exists. No owner messages or task assignments have been sent.
--- a/inventory/owner-followups.md
+++ b/inventory/owner-followups.md
@ -0,0 +1,46 @@
+# Owner follow-up register
+
+This register links evidence and existing owner work by stable ID. It does not
+copy tasks, reopen completed workplans or assert that an owner has accepted new
+work. No messages have been sent. `accepted_remediation_record` stays empty until
+an actual owning-repo record is identified and accepted.
+
+| Gap | Existing owner context | Acceptance needed here |
+| --- | --- | --- |
+| Forge credential policy denial | WARDEN-WP-0031 `739bad25-2345-5f4f-aaa3-cc4cd8c71f6c`; WARDEN-WP-0025 `70c11222-d8e7-5936-99f7-7d626a4a5deb` | Authorized metadata export or caller-binding repair evidence, then successful scoped metadata read; no policy bypass |
+| Complete repo/package/access census | railiance-forge; project decision `5f3680fc-0cd5-4d27-ba39-59fbdd13313c` | [Owner evidence contract](owner-evidence-contract.md); the original lane work is not an export task |
+| Universal coverage contract and collector omissions | RMASTER-WP-0021 `37667c23-1fa9-430e-8d80-d67d98f90e38`; RMASTER-WP-0025 `09d6dfc6-0bde-5516-acaa-a6a4f0551805` | Owner resolution of excluded managed Jobs/DaemonSets/substrate workloads; exactly-one-rapp check over an accepted complete census |
+| Current unclaimed workload names | [52-row follow-up table](workload-followups.csv) | Owner acceptance of the correct declaration/name mapping and green fresh coverage receipt |
+| Runtime image and rollback protection | RPF-WP-0028 `622d1208-b085-5ec2-9fb7-5e41f23e1843`; RPF-WP-0048-T03 `6c2650a2-5da8-5999-a6e7-b22eb7c655f4` | Join package ownership and actual retained digests across old/new namespaces; image retention is not workload ownership or transfer rollback |
+| GitOps/legacy consumers | RPF-WP-0044 `98140775-3b9a-5cf9-9af6-722502d487dc` | Current and frozen-cluster source/access export and explicit external-consumer coverage |
+| Core Hub name drift | RPF-WP-0030 `f7a13cc2-7b1f-5644-89a8-b4e9a934b018` | Reconcile live candidate/publisher names with rapp-core-hub declarations; do not invent another rapp from a name mismatch |
+| Notice-page workload coverage | RPF-WP-0047 `6ab44339-66d3-522b-9d34-fc9ff6f20d1b` | Owner ruling on bao-notice's managed-workload declaration; deployment completion alone does not satisfy the family check |
+
+The follow-up CSV is a diagnostic routing proposal based on known repo purpose
+and workload names. It is **not** a namespace-to-rapp or repo-to-org ownership
+mapping. Neither the contacts nor the context workplans count as accepted new
+remediation tasks. New owner records must be linked rather than invented here.
+
+## Exclusions requiring disposition
+
+[exclusion-review.csv](exclusion-review.csv) enumerates all 326 excluded files
+or gitlinks in the retained local/archive snapshot. Every row is unreviewed.
+Binary formats generally need an owner attestation rather than text extraction;
+encrypted sources need sanitized reference projections; symlink targets and
+submodule revisions must be reconciled explicitly.
+
+The four markitect-main submodules expose a concrete gap beyond sibling scans:
+
+| Path | Gitlink revision | Current declared remote identity |
+| --- | --- | --- |
+| `_issue-tracking/issue-facade` | `70d7ec0cdcbdff1a41cc420e2c939f855fe7787b` | coulomb/issue-facade |
+| `capabilities/kaizen-agentic` | `afc038d98b1efc5098f473e55fdddd2999f798ba` | coulomb/kaizen-agentic |
+| `capabilities/testdrive-jsui` | `b8f13b4ae5e80e76a162187613b67cbdc3a65171` | coulomb/testdrive-jsui |
+| `wiki` | `8818df03d3d7be241c144fd839d90c4d7c0ba20a` | coulomb/markitect-main.wiki |
+
+Source: markitect-main `.gitmodules` and `git ls-files --stage`, September 28.
+All four still name the old `http://92.205.130.254:32166` endpoint. This review did
+not contact that endpoint or fetch submodules. The wiki and issue-facade identities
+are not represented as standalone subjects in the 153-row candidate matrix;
+they need owner reconciliation (wiki attachment, alias/retirement, or additional
+repo). Do not invent server IDs or assume a sibling HEAD equals the pinned gitlink.
--- a/inventory/stability-retry.json
+++ b/inventory/stability-retry.json
@ -0,0 +1,23 @@
+{
+  "date": "2026-09-28",
+  "kind": "non-accepting-retry-receipt",
+  "snapshot_files_retained": false,
+  "first_sha256": "7a6825b42bd74cf07da88a1fb009414223126896bbe00f70c0f9c89e6e85045a",
+  "second_sha256": "c51f5303d50a69642ca4a0a81e23e2d6dbc53027a63f76671a7d374c7945bcd5",
+  "normalized_equal": false,
+  "local_reference_sets_equal": true,
+  "changed_repositories": [
+    {
+      "repo": "hub-core",
+      "fields": [
+        "content_sha256",
+        "files_considered"
+      ],
+      "before_head": "3c5cbfbafef35c1bb68dd92afaee26b65ead2582",
+      "after_head": "3c5cbfbafef35c1bb68dd92afaee26b65ead2582",
+      "before_content": "305d2c2dfb9d58f35ad4b9b97fe8812d458764875e30bf455a6b9f5fa2d3a2df",
+      "after_content": "fe70ca6b0ebf27e4244909931e45484af1d82890504f2dfd47326c0bc6acfbc4"
+    }
+  ],
+  "acceptance": "not met; this is a diagnostic receipt, not substitute full accepted snapshots"
+}
--- a/inventory/workload-followups.csv
+++ b/inventory/workload-followups.csv
@ -0,0 +1,53 @@
+namespace,kind,name,review_contact_candidate,existing_context_record,accepted_remediation_record,evidence
+activity-core,Deployment,actcore-api,activity-core; railiance-platform,RPF-WP-0048 / b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54,not yet linked,coverage-2026-09-28.txt
+activity-core,StatefulSet,actcore-app-db,activity-core; railiance-platform,RPF-WP-0048 / b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54,not yet linked,coverage-2026-09-28.txt
+activity-core,Deployment,actcore-event-router,activity-core; railiance-platform,RPF-WP-0048 / b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54,not yet linked,coverage-2026-09-28.txt
+activity-core,StatefulSet,actcore-nats,activity-core; railiance-platform,RPF-WP-0048 / b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54,not yet linked,coverage-2026-09-28.txt
+activity-core,Deployment,actcore-statehub-edge-relay,activity-core; railiance-platform,RPF-WP-0048 / b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54,not yet linked,coverage-2026-09-28.txt
+activity-core,Deployment,actcore-temporal,activity-core; railiance-platform,RPF-WP-0048 / b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54,not yet linked,coverage-2026-09-28.txt
+activity-core,StatefulSet,actcore-temporal-db,activity-core; railiance-platform,RPF-WP-0048 / b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54,not yet linked,coverage-2026-09-28.txt
+activity-core,Deployment,actcore-temporal-ui,activity-core; railiance-platform,RPF-WP-0048 / b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54,not yet linked,coverage-2026-09-28.txt
+activity-core,Deployment,actcore-worker,activity-core; railiance-platform,RPF-WP-0048 / b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54,not yet linked,coverage-2026-09-28.txt
+activity-core,Deployment,llm-connect,activity-core; railiance-platform,RPF-WP-0048 / b8cf2fc2-60c2-5d4e-a60a-55f1304d9f54,not yet linked,coverage-2026-09-28.txt
+approval-engine,StatefulSet,approval-engine,approval-engine,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+argocd,StatefulSet,argocd-application-controller,railiance-enablement; railiance-platform,RPF-WP-0044 / 98140775-3b9a-5cf9-9af6-722502d487dc,not yet linked,coverage-2026-09-28.txt
+argocd,Deployment,argocd-applicationset-controller,railiance-enablement; railiance-platform,RPF-WP-0044 / 98140775-3b9a-5cf9-9af6-722502d487dc,not yet linked,coverage-2026-09-28.txt
+argocd,Deployment,argocd-redis,railiance-enablement; railiance-platform,RPF-WP-0044 / 98140775-3b9a-5cf9-9af6-722502d487dc,not yet linked,coverage-2026-09-28.txt
+argocd,Deployment,argocd-repo-server,railiance-enablement; railiance-platform,RPF-WP-0044 / 98140775-3b9a-5cf9-9af6-722502d487dc,not yet linked,coverage-2026-09-28.txt
+audit-core,Deployment,audit-core,audit-core,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+bao-notice,Deployment,bao-notice,railiance-platform,RPF-WP-0047 / 6ab44339-66d3-522b-9d34-fc9ff6f20d1b,not yet linked,coverage-2026-09-28.txt
+core-hub,Deployment,core-hub-api-candidate,core-hub; rapp-core-hub,RPF-WP-0030 / f7a13cc2-7b1f-5644-89a8-b4e9a934b018,not yet linked,coverage-2026-09-28.txt
+core-hub,Deployment,core-hub-api-repository-publisher,core-hub; rapp-core-hub,RPF-WP-0030 / f7a13cc2-7b1f-5644-89a8-b4e9a934b018,not yet linked,coverage-2026-09-28.txt
+coulomb,Deployment,ihp-railiance-probe,ihp-railiance-probe; railiance-apps,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+coulomb-social,Deployment,coulomb-social,coulomb-social,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+databases,Cluster,apps-pg,railiance-platform; rapp-postgres; consuming workload owner,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+databases,Cluster,forgejo-db,railiance-platform; rapp-postgres; consuming workload owner,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+databases,Cluster,net-kingdom-pg,railiance-platform; rapp-postgres; consuming workload owner,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+databases,Cluster,platform-pg-2,railiance-platform; rapp-postgres; consuming workload owner,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+databases,Cluster,state-hub-db,railiance-platform; rapp-postgres; consuming workload owner,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+email-connect,Deployment,email-connect,email-connect,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+flex-auth,Deployment,flex-auth-informed-decision-sitting,flex-auth; corresponding consuming workload owner,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+flex-auth,Deployment,flex-auth-informed-decision-t03,flex-auth; corresponding consuming workload owner,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+flex-auth,Deployment,flex-auth-ops-warden,flex-auth; corresponding consuming workload owner,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+flex-auth,Deployment,flex-auth-secrets-engine,flex-auth; corresponding consuming workload owner,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+flex-auth,Deployment,flex-auth-tenant-engine,flex-auth; corresponding consuming workload owner,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+flex-auth,Deployment,flex-auth-user-engine,flex-auth; corresponding consuming workload owner,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+forgejo,Deployment,forgejo-gitea,railiance-forge,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+forgejo,Deployment,forgejo-runner,railiance-forge,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+informed-decision,Deployment,informed-decision,informed-decision,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+inter-hub,Deployment,inter-hub,core-hub; ops-hub,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+mfa,Deployment,privacyidea,net-kingdom,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+policy-nexus,Deployment,policy-nexus,policy-nexus; rapp-policy-nexus,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+rapp-qonto-egress,Deployment,qonto-egress-proxy,rapp-qonto; qonto-assistant,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+rein-aharness,Deployment,rein-aharness,rein-aharness,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+reuse,Deployment,reuse-surface,reuse-surface,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+reuse,Deployment,reuse-surface-landing,reuse-surface,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+sso,Deployment,authelia,net-kingdom; key-cape,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+sso,Deployment,identity-provisioner,net-kingdom; key-cape,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+sso,Deployment,keycape,net-kingdom; key-cape,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+sso,Deployment,lldap,net-kingdom; key-cape,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+state-hub,Deployment,state-hub,state-hub,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+state-hub,Deployment,state-hub-mcp,state-hub,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+target-revenue,Deployment,target-revenue,target-revenue; railiance-apps,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+target-revenue,Cluster,target-revenue-pg,target-revenue; railiance-apps,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
+vergabe-demo-company,Deployment,vergabe-teilnahme,vergabe-teilnahme; railiance-apps,RMASTER-WP-0025 / 09d6dfc6-0bde-5516-acaa-a6a4f0551805,not yet linked,coverage-2026-09-28.txt
--- a/taxonomy/README.md
+++ b/taxonomy/README.md
@ -19,12 +19,13 @@ repository prefix or lifecycle stage alone does not establish stewardship.
 | --- | --- | ---: |
 | railiance | Infrastructure, delivery, platform operations and managed workload packaging | 32 |
 | netkingdom | Security, identity, authority, policy and security evidence | 20 |
-| helixforge | Software factory, development tooling, capability/knowledge/interface frameworks | 59 |
+| helixforge | Software factory, development tooling, capability/knowledge/interface frameworks | 60 |
 | binky | Company-specific coordination and finance integration | 3 |
-| coulomb | Explicit Coulomb product/engagement and estate/personal continuity | 4 |
-| Unresolved | Insufficient evidence to choose a steward | 35 |
+| coulomb | Explicit Coulomb product/engagement and estate/personal continuity | 5 |
+| whynot (new candidate) | Prototype exploration, market signals and its design system | 2 |
+| Unresolved | Insufficient evidence to choose a steward | 31 |

-The 118 assignments are recommendations derived from current descriptions and
+The 122 assignments are recommendations derived from current descriptions and
 scope documents, not evidence that their proposed maintainers have accepted
 responsibility. JSON `open_items` flags cross-cutting cases requiring particular
 attention. Every row still needs named maintainers and access reconciliation.
@ -58,8 +59,8 @@ or into binky because of legal ownership. These review groups remain unassigned:
 | Document/evidence products | binect-chrome, binect-js, citation-engine, citation-evidence, citation-work, direkt-vermittlung-de, evidence-anchor, evidence-binder, evidence-source, vergabe-teilnahme | Product steward; keep each product/component family coherent where responsibility is shared |
 | Shared data/communication facilities | artifact-store, doc-store-pg, email-connect, plenty-gobble | Reusable framework steward versus infrastructure-service steward |
 | Commercial and company tooling | adaptive-pricing, fin-hub, human-resources, target-revenue | Generic product responsibility versus Binky-specific operational ownership |
-| Cross-estate canon/governance | commerce-canon, info-tech-canon, interface-canon, prj-canon-federation, disaster-control, guide-board, ops-hub | Cross-estate continuity versus HelixForge/NetKingdom responsibility |
-| Research, prototypes and independent products | clay-borg, freedom-intelligence, ground-game, inter-hub-haskell, polycode-sim, python-snake, soul-frame, timeline-svg, whynot-control, whynot-design | Accountable research/product steward; `whynot` is an existing responsibility candidate outside the seed taxonomy |
+| Cross-estate canon/governance | commerce-canon, info-tech-canon, interface-canon, prj-canon-federation, guide-board | Cross-estate continuity versus HelixForge/NetKingdom responsibility |
+| Research, prototypes and independent products | clay-borg, freedom-intelligence, ground-game, inter-hub-haskell, polycode-sim, python-snake, soul-frame, timeline-svg | Accountable research/product steward; the prototype stage alone does not identify the steward |

 Their current paths stay unchanged pending a decision; that is not permanent
 approval to retain them in coulomb. Do not infer public/private treatment from
@ -92,3 +93,23 @@ cross-repo edit or a new assignment of authority.

 The convention should include a new-repo checklist: accountable steward, org,
 visibility, team grants, package publication owner and cross-org consumers.
+
+## Deeper evidence review
+
+Four formerly unresolved rows now have concrete proposals: disaster-control →
+coulomb (explicit Coulomb continuity intent); ops-hub → helixforge (framework
+extension handoff HF-WP-0001, `48d91935-197e-4ad4-be07-7bbcd535847c`); whynot-control
+and whynot-design → proposed whynot (their existing intents explicitly name that
+organization). Source paths, hashes and revisions are in each matrix row.
+These are recommendations, not newly accepted ownership or grants.
+
+The proposed whynot addition is subject to the requested naming preference.
+No organization has been created. It does not make all experiments whynot-owned.
+Vergabe Teilnahme remains unresolved: its selection as a HelixForge factory
+customer (HFACT-WP-0001, `ed4fe524-036f-5221-8deb-00e24e944de1`) establishes delivery
+integration, not necessarily product stewardship. Likewise a shared canon's
+semantic authority does not establish its organization or maintainer team.
+
+No verified named-maintainer/Forgejo-team roster was found in the inspected
+purpose records. Role placeholders therefore remain proposals; no human or
+service identity is assigned by inference from repository names or task owners.
--- a/taxonomy/assignments.csv
+++ b/taxonomy/assignments.csv
@ -22,7 +22,7 @@ core-hub,14,f4038d32-948d-49e2-9b84-4fd48109100f,helixforge,draft,public,"Softwa
 coulomb-loop,35,9d7b100b-1538-483e-a873-cf70980c59e3,coulomb,draft,public,Explicit Coulomb engagement/product or estate/personal continuity responsibility; not a default for all shared dependencies.,"{""head"": ""d07455fbacd3e125e1ba6d991041c811b5c353d2"", ""path"": ""SCOPE.md"", ""repo"": ""coulomb-loop"", ""sha256"": ""38197986c12453c3cc8e2b66f5ccc38184ade127386ff8e71b64b6e22440f8c3""}"
 coulomb-social,106,fc3296df-e3e0-49a4-b022-4701f3c71f9b,coulomb,draft,public,Explicit Coulomb engagement/product or estate/personal continuity responsibility; not a default for all shared dependencies.,"{""head"": ""aee6dfdc7651bf19f3459fa1685af997a70f1dd1"", ""path"": ""SCOPE.md"", ""repo"": ""coulomb-social"", ""sha256"": ""a8ef224b64b551f649e50f7b8b2f491a9d5a31aefc981134271cf4d193d03f65""}"
 direkt-vermittlung-de,81,d166babe-c3f0-4e46-8091-a2c44ab557fb,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""bba68d1948cbe6525c55b53f9311f092afa21e5d"", ""path"": ""SCOPE.md"", ""repo"": ""direkt-vermittlung-de"", ""sha256"": ""49b4f81c87210c1f81f5137ee8575c642eff4cca2ceb181b275e78931a4483f3""}"
-disaster-control,17,439a69fc-084a-4074-88fe-c99de627deeb,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""9f437a5a069279941ea8b982870725b36d0ca7ac"", ""path"": ""SCOPE.md"", ""repo"": ""disaster-control"", ""sha256"": ""6ada8f0085abda948faebcad056e3e587721c938ca829804dc5bb1023ced527e""}"
+disaster-control,17,439a69fc-084a-4074-88fe-c99de627deeb,coulomb,draft,public,Explicit Coulomb-stack continuity control plane; its intent defers standalone product extraction and leaves implementation with infrastructure owners.,"{""head"": ""9f437a5a069279941ea8b982870725b36d0ca7ac"", ""line"": 5, ""path"": ""INTENT.md"", ""repo"": ""disaster-control"", ""sha256"": ""5b68d5ac2b6a490ad7caed829657ea17536b4cdcd619f1d0ae4dad206fd92af7""}"
 doc-store-pg,116,,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""e1ddb12198b05531156ee831b2d214fd90a72ff0"", ""path"": ""INTENT.md"", ""repo"": ""doc-store-pg"", ""sha256"": ""8dee3e5484e459765d0df87bcb981caff9c094865802dc2ad119b481b0265abf""}"
 domain-tree,36,146bcec9-59e8-481e-9996-f0b30ab28abb,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""2f2dd5ed57c1d22322b7be5ae0de134ced9bbc60"", ""path"": ""SCOPE.md"", ""repo"": ""domain-tree"", ""sha256"": ""137a989c5319d855a85cc49ff54c76e0d24d804051b12dfb03b7a7ff81e43f80""}"
 email-connect,37,3ce9ef37-9672-4096-9d28-5ef77e450c07,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""bedb99193e05941133f3519bc928b284e9e540cd"", ""path"": ""SCOPE.md"", ""repo"": ""email-connect"", ""sha256"": ""2a09339750f8edee3b775d026878b9b94bda825f796a7d492d6f63cf9fc66b51""}"
@ -72,7 +72,7 @@ net-kingdom,67,4589488d-625b-4ffe-b8f0-48744d7b1498,netkingdom,draft,public,"Sec
 open-cmis-tck,57,b6b8dacd-4100-475a-8390-c326e1cebdec,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""d8d63f824456808c2d08f501a6e1f1535dbd54a6"", ""path"": ""SCOPE.md"", ""repo"": ""open-cmis-tck"", ""sha256"": ""c4300fbccafcecefee893c5696c84cc8f6b93fcb9e105e8ec55019ff54fab499""}"
 open-reuse,21,d416fd6f-3c9d-4ba7-a5ca-f7543940ee6a,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""f0456ac33131e8ebc5328169cb0244858288a3bc"", ""path"": ""SCOPE.md"", ""repo"": ""open-reuse"", ""sha256"": ""45b24c2a506f3ad295cd489b7b26fe8854f2959898e760218b6135449b297783""}"
 ops-bridge,20,1bf99f56-6e94-4379-a9ea-295a4c181889,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""190ef1e188e12c606f1359325fd9fdd1dbef29e2"", ""path"": ""SCOPE.md"", ""repo"": ""ops-bridge"", ""sha256"": ""63cd52d1cdf38e72af0285c25aa2292f959080c6befe565a1d2690747a813975""}"
-ops-hub,58,c96dd8b3-3d15-4c50-8daf-0ec6a2c56ddf,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""75f4944144b000119a68d3ed6eb8d938b05f73a1"", ""path"": ""SCOPE.md"", ""repo"": ""ops-hub"", ""sha256"": ""56feb5acd3ad98061070353c91f473bd45f30912829f17ed4e835f932ebd6fb9""}"
+ops-hub,58,c96dd8b3-3d15-4c50-8daf-0ec6a2c56ddf,helixforge,draft,public,"Operations extension of the HelixForge/Core Hub framework, supported by the accepted HF-WP-0001 handoff; consuming Railiance observations does not make it infrastructure ownership.","{""head"": ""75f4944144b000119a68d3ed6eb8d938b05f73a1"", ""line"": 9, ""path"": ""INTENT.md"", ""repo"": ""ops-hub"", ""sha256"": ""6e9ab3d2d1d4fa10b526cd7eb133be75b9432c0ec009bff53b5373ee75c8e628""}"
 ops-mason,102,b9066ab1-c6fe-409b-9145-64ba374654db,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""13a633760791bb2c30edb475a4bed36af1cd3461"", ""path"": ""SCOPE.md"", ""repo"": ""ops-mason"", ""sha256"": ""7da4c8c660b1c8d15675768a5f6040303fe3ca3b4f05b1bba4633be3cc6e0c77""}"
 ops-warden,16,74df727e-a756-42de-b776-11928b03bd1f,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""4d5595ba8b4963a728a597ba16ebcec2badbd59f"", ""path"": ""SCOPE.md"", ""repo"": ""ops-warden"", ""sha256"": ""47b47468746617c84f8411ac671bb488ab740b4c3133401f5d7b55d3d024345f""}"
 phase-memory,23,d56e0504-044d-4021-ae43-e9d706dbd087,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""755fd2c3e2a5414cd89ee59df1814196d872b768"", ""path"": ""SCOPE.md"", ""repo"": ""phase-memory"", ""sha256"": ""2856b8dcc36e58f9c242079988df9bcd864ee96445d6109bf6db3fa13f41f694""}"
@ -148,7 +148,7 @@ user-engine,77,761e6ac3-6483-4b7f-ac7a-5e5741a01118,netkingdom,draft,public,"Sec
 vantage-point,61,14a5657e-f875-4cd4-8801-3c7dcecb11f2,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""d760b74e6cb9dc94265fa94482136911bdfe6440"", ""path"": ""SCOPE.md"", ""repo"": ""vantage-point"", ""sha256"": ""f03fe2ddaf1994b407c5babd1b3d4ede7d280e9470940beb92e4e6e56bd1f473""}"
 vergabe-teilnahme,62,ff7b0754-9d54-4abf-a752-d342870f5993,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""5fddf5f8f0626c9b4567b59a2486880694084396"", ""path"": ""SCOPE.md"", ""repo"": ""vergabe-teilnahme"", ""sha256"": ""bc58ebef916e20f0edf486df9f51e2c822e42a538dd9b42b2ab88feac367fe0f""}"
 whitehat-security,126,14487b12-9a94-4d98-83e5-dcc0b58b650a,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""b5cc6706b95a7e639a89429aee1a4f4a4ead405f"", ""path"": ""SCOPE.md"", ""repo"": ""whitehat-security"", ""sha256"": ""8af1dcd511ae0c39c529bf5a3a7d7d7f18800729c0bb5ef5ec1cc358526bc9ed""}"
-whynot-control,63,76af2d82-9a4b-4797-b542-3f4f5545b6cc,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""cadbe22d9e806d53fc96ab0934555f4720c6dc84"", ""path"": ""SCOPE.md"", ""repo"": ""whynot-control"", ""sha256"": ""f4af21e5525c39c4a4b268d64117443e6b06db1caefafb16cc2c33636df19a66""}"
-whynot-design,64,a53a75fb-e9fa-41d9-8a96-12a4b924dc63,UNRESOLVED,unresolved,public,No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.,"{""head"": ""a79a4d803e9aed13f66d072bf409b6f86000f01f"", ""path"": ""SCOPE.md"", ""repo"": ""whynot-design"", ""sha256"": ""ec1eecdac57b7e82108760f699b9f08503130e556d4e41764728fea57251a88a""}"
+whynot-control,63,76af2d82-9a4b-4797-b542-3f4f5545b6cc,whynot,draft,public,"Existing intent explicitly names whynot as the prototype/market-signal organization; this is a proposed accountable grouping, not a generic experimental lifecycle bucket.","{""head"": ""cadbe22d9e806d53fc96ab0934555f4720c6dc84"", ""path"": ""INTENT.md"", ""repo"": ""whynot-control"", ""sha256"": ""35b37fb5c586f35fd9f610f8dc2b5aa849c8bb31e04a3f6d50554adbd66c264e""}"
+whynot-design,64,a53a75fb-e9fa-41d9-8a96-12a4b924dc63,whynot,draft,public,"Existing intent explicitly names whynot as the prototype/market-signal organization; this is a proposed accountable grouping, not a generic experimental lifecycle bucket.","{""head"": ""a79a4d803e9aed13f66d072bf409b6f86000f01f"", ""path"": ""INTENT.md"", ""repo"": ""whynot-design"", ""sha256"": ""89981e41e62c947121d38fa19a971cb8519ddb48fb20c3639a4246cf008fd010""}"
 wise-validator,65,,helixforge,draft,public,"Software factory, development tooling, knowledge/interface framework or capability lifecycle responsibility.","{""head"": ""7c83e388d88c43aae720e1e435758ee357cbe5d9"", ""path"": ""INTENT.md"", ""repo"": ""wise-validator"", ""sha256"": ""8e73ffd7d972135a5b56d13473519eeaaffdf0e6b17b2c1c3779bcc5b6ffe87d""}"
 zone-engine,131,ff057178-b3ca-48f4-b7b5-2cda570ed12f,netkingdom,draft,public,"Security, identity, authority, policy or security-evidence responsibility; runtime placement does not determine this assignment.","{""head"": ""9fd05d09fe17aaeee1347b9cc35a2d6618f37304"", ""path"": ""SCOPE.md"", ""repo"": ""zone-engine"", ""sha256"": ""953dbf718481adae00fa53258ede0632df65bdc7f6a1cb3e1dd3344357dba80d""}"
--- a/taxonomy/assignments.json
+++ b/taxonomy/assignments.json
@ -571,24 +571,25 @@
      "current_visibility": "public",
      "evidence": {
        "head": "9f437a5a069279941ea8b982870725b36d0ca7ac",
-        "path": "SCOPE.md",
+        "line": 5,
+        "path": "INTENT.md",
        "repo": "disaster-control",
-        "sha256": "6ada8f0085abda948faebcad056e3e587721c938ca829804dc5bb1023ced527e"
+        "sha256": "5b68d5ac2b6a490ad7caed829657ea17536b4cdcd619f1d0ae4dad206fd92af7"
      },
      "forge_repository_id": 17,
      "open_items": [
-        "Choose steward and target organization; do not default shared products to HelixForge or Binky",
+        "Confirm proposed responsibility and named accountable maintainer; evidence review is not acceptance",
        "Named accountable steward and team membership approval",
        "Existing grants, collaborators and automation access reconciliation"
      ],
      "permissions_profile": "preserve-grants-then-explicit-teams",
-      "proposed_org": null,
-      "proposed_steward_role": null,
+      "proposed_org": "coulomb",
+      "proposed_steward_role": "coulomb repository maintainers",
      "purpose": "A viable emergency planning, preparation and response system for complex organizational environments. Brace for impact and recover quickly.",
-      "rationale": "No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.",
+      "rationale": "Explicit Coulomb-stack continuity control plane; its intent defers standalone product extraction and leaves implementation with infrastructure owners.",
      "repository": "disaster-control",
      "state_hub_repository_id": "439a69fc-084a-4074-88fe-c99de627deeb",
-      "status": "unresolved",
+      "status": "draft",
      "target_visibility": "preserve-current; verify before transfer"
    },
    {
@ -1787,24 +1788,25 @@
      "current_visibility": "public",
      "evidence": {
        "head": "75f4944144b000119a68d3ed6eb8d938b05f73a1",
-        "path": "SCOPE.md",
+        "line": 9,
+        "path": "INTENT.md",
        "repo": "ops-hub",
-        "sha256": "56feb5acd3ad98061070353c91f473bd45f30912829f17ed4e835f932ebd6fb9"
+        "sha256": "6e9ab3d2d1d4fa10b526cd7eb133be75b9432c0ec009bff53b5373ee75c8e628"
      },
      "forge_repository_id": 58,
      "open_items": [
-        "Choose steward and target organization; do not default shared products to HelixForge or Binky",
+        "Confirm proposed responsibility and named accountable maintainer; evidence review is not acceptance",
        "Named accountable steward and team membership approval",
        "Existing grants, collaborators and automation access reconciliation"
      ],
      "permissions_profile": "preserve-grants-then-explicit-teams",
-      "proposed_org": null,
-      "proposed_steward_role": null,
+      "proposed_org": "helixforge",
+      "proposed_steward_role": "helixforge repository maintainers",
      "purpose": "Inter-hub extension for the operations & resiliance subdimension of the orthogonal architecture standard perspective.",
-      "rationale": "No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.",
+      "rationale": "Operations extension of the HelixForge/Core Hub framework, supported by the accepted HF-WP-0001 handoff; consuming Railiance observations does not make it infrastructure ownership.",
      "repository": "ops-hub",
      "state_hub_repository_id": "c96dd8b3-3d15-4c50-8daf-0ec6a2c56ddf",
-      "status": "unresolved",
+      "status": "draft",
      "target_visibility": "preserve-current; verify before transfer"
    },
    {
@ -3641,24 +3643,24 @@
      "current_visibility": "public",
      "evidence": {
        "head": "cadbe22d9e806d53fc96ab0934555f4720c6dc84",
-        "path": "SCOPE.md",
+        "path": "INTENT.md",
        "repo": "whynot-control",
-        "sha256": "f4af21e5525c39c4a4b268d64117443e6b06db1caefafb16cc2c33636df19a66"
+        "sha256": "35b37fb5c586f35fd9f610f8dc2b5aa849c8bb31e04a3f6d50554adbd66c264e"
      },
      "forge_repository_id": 63,
      "open_items": [
-        "Choose steward and target organization; do not default shared products to HelixForge or Binky",
+        "Confirm adding whynot to candidate org list; naming preference requested, not yet answered",
        "Named accountable steward and team membership approval",
        "Existing grants, collaborators and automation access reconciliation"
      ],
      "permissions_profile": "preserve-grants-then-explicit-teams",
-      "proposed_org": null,
-      "proposed_steward_role": null,
+      "proposed_org": "whynot",
+      "proposed_steward_role": "whynot repository maintainers",
      "purpose": "WhyWhyNot: Discover and explore the weird and the useful building and reviewing prototypes.",
-      "rationale": "No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.",
+      "rationale": "Existing intent explicitly names whynot as the prototype/market-signal organization; this is a proposed accountable grouping, not a generic experimental lifecycle bucket.",
      "repository": "whynot-control",
      "state_hub_repository_id": "76af2d82-9a4b-4797-b542-3f4f5545b6cc",
-      "status": "unresolved",
+      "status": "draft",
      "target_visibility": "preserve-current; verify before transfer"
    },
    {
@ -3666,24 +3668,24 @@
      "current_visibility": "public",
      "evidence": {
        "head": "a79a4d803e9aed13f66d072bf409b6f86000f01f",
-        "path": "SCOPE.md",
+        "path": "INTENT.md",
        "repo": "whynot-design",
-        "sha256": "ec1eecdac57b7e82108760f699b9f08503130e556d4e41764728fea57251a88a"
+        "sha256": "89981e41e62c947121d38fa19a971cb8519ddb48fb20c3639a4246cf008fd010"
      },
      "forge_repository_id": 64,
      "open_items": [
-        "Choose steward and target organization; do not default shared products to HelixForge or Binky",
+        "Confirm adding whynot to candidate org list; naming preference requested, not yet answered",
        "Named accountable steward and team membership approval",
        "Existing grants, collaborators and automation access reconciliation"
      ],
      "permissions_profile": "preserve-grants-then-explicit-teams",
-      "proposed_org": null,
-      "proposed_steward_role": null,
+      "proposed_org": "whynot",
+      "proposed_steward_role": "whynot repository maintainers",
      "purpose": "A design system for clean neutral prototyping and early production.",
-      "rationale": "No sufficiently clear steward among the proposed organizations. Retain current path pending an explicit stewardship choice; experimental maturity is not ownership.",
+      "rationale": "Existing intent explicitly names whynot as the prototype/market-signal organization; this is a proposed accountable grouping, not a generic experimental lifecycle bucket.",
      "repository": "whynot-design",
      "state_hub_repository_id": "a53a75fb-e9fa-41d9-8a96-12a4b924dc63",
-      "status": "unresolved",
+      "status": "draft",
      "target_visibility": "preserve-current; verify before transfer"
    },
    {
@ -3735,6 +3737,14 @@
      "target_visibility": "preserve-current; verify before transfer"
    }
  ],
+  "candidate_org_additions": [
+    {
+      "accepted": false,
+      "basis": "whynot-control and whynot-design INTENT.md",
+      "name": "whynot",
+      "status": "proposed"
+    }
+  ],
  "durable_convention_home_proposal": "the-custodian",
  "experimental_policy": "Do not create a lifecycle-only organization; keep experiments with their responsible steward. Any incubator exception requires a named steward and exit policy.",
  "schema_version": 1
--- a/workplans/ORGREF-WP-0001-foundation-and-entry-gate.md
+++ b/workplans/ORGREF-WP-0001-foundation-and-entry-gate.md
@ -71,6 +71,9 @@ forge-owner rehearsal after conditions 1–3, with all four conditions retained
 production. It is a proposal, not an exception to AGENTS.md. Until the gate is
 explicitly amended, consume independently authorized applicable proof or remain
 deferred. Do not start T03/T04 to work around this dependency.
+The [exact proposed amendment](../decisions/rollback-gate-amendment.md) is now
+reviewable; approval has been requested but is not assumed from preparation
+authorization. No standing rule has changed.

 Reuse owner work instead of rebuilding it: `RPF-WP-0028` provides durable image
 inventory; `RPF-WP-0048-T03` provides digest/rollback retention protection.
@ -134,6 +137,10 @@ Preparation delivered September 28:
  package ownership and private completeness are not known.

 See [inventory instructions and gaps](../inventory/README.md). T01 is not done.
+The follow-up now links [owner records](../inventory/owner-followups.md), a
+52-row coverage review queue, 326 excluded-item dispositions and four submodule
+pins. An immediate retry still observed hub-core changing; condition 3 remains
+unmet. Authenticated evidence has an explicit [export contract](../inventory/owner-evidence-contract.md).

 Known starting evidence, verified 2026-08-11: 112 repos with a `coulomb/`
 origin; `repoURL: https://forgejo.coulomb.social/coulomb/railiance-platform.git`
@ -169,12 +176,14 @@ visibility/team permissions and unresolved assignment (if any); approve the
 matrix and select the permanent convention owner before declaring G2 complete.

 Preparation delivered September 28: [taxonomy proposal](../taxonomy/README.md)
-and CSV/JSON matrix cover 153 known paths: 118 proposed org assignments and 35
+and CSV/JSON matrix cover 153 known paths: 122 proposed org assignments and 31
 explicitly unresolved stewards. Visibility is preserved by proposal; named teams,
 actual grants and missing private IDs still need owner evidence. Recommend no
 lifecycle-only `experimental` org and `the-custodian` as the durable convention
 home, both pending acceptance. Decision
-`60c5767c-d510-4d13-9a24-d5d58485b7e5` tracks the concrete review. G2 is not accepted.
+`60c5767c-d510-4d13-9a24-d5d58485b7e5` tracks the concrete review. G2 is not accepted. The deeper review proposes
+whynot as an additional steward, and records evidence for ops-hub/disaster-control.
+Naming and maintainer acceptance remain pending.

 ```task
 id: ORGREF-WP-0001-T03