docs(governance): revalidate three active living documents for October 31

.quirk/evidence/governance-integration-20261031-f6ca3b255f95.json

@@ -0,0 +1,92 @@
+{
+  "schema_version": "evidence-receipt.v1",
+  "receipt_id": "qreceipt.governance-integration-20261031.f6ca3b255f95",
+  "repository": "Quirk-Systems/.github",
+  "status": "verified",
+  "subject": {
+    "base_commit": "76d828239136dd13189c024843ad85ab269fcf49",
+    "commit": "f6ca3b255f95839abe4bdcab25dcb38396fd556a",
+    "changed_paths": [
+      ".quirk/evidence/governance-review-20261031-f2deb14f0d9c.json",
+      "docs/intentions/2026-09-20-evidence-first-planning.md",
+      "docs/roadmaps/2026-09-20-org-control-plane.md",
+      "docs/todos/2026-09-20-living-document-rollout.md"
+    ]
+  },
+  "claims": [
+    {
+      "claim_id": "qclaim.governance-integration-20261031.f6ca3b255f95",
+      "claim_type": "evidence",
+      "authority_effect": "none",
+      "statement": "Integrates main after PR 60 using a merge commit whose tree is byte-identical to original PR 61 head 7bad94833a84413683f186756cedf8b96fe58dad. Preserves all original subject commits, receipts, documentation, and historical evidence. Binds the three existing governance corrections and their original receipt to the retargeted main base. At this exact integration subject, 233 tests and all executed validate.sh stages pass, including offline pedantic zizmor 1.31.1; ruff and actionlint are unavailable, 21 existing concept warnings and 20 existing zizmor ignores remain. Strict freshness passes for November 1 and November 3. This receipt does not establish hosted validation success, authority, settings activation, completed cadence/enforcement decisions, or final main integration.",
+      "evidence_paths": [
+        ".quirk/evidence/governance-review-20261031-f2deb14f0d9c.json",
+        "docs/intentions/2026-09-20-evidence-first-planning.md",
+        "docs/roadmaps/2026-09-20-org-control-plane.md",
+        "docs/todos/2026-09-20-living-document-rollout.md"
+      ]
+    }
+  ],
+  "artifacts": [
+    {
+      "path": ".quirk/evidence/governance-review-20261031-f2deb14f0d9c.json",
+      "state": "present",
+      "git_blob": "5346a21eaccba6a7d4da8bcbc471e219337ee7ed",
+      "sha256": "sha256:93f4a6ed3aa8e1fc270f7f0e70cef703e1051f9a10f9f8b09035584dad5c479c"
+    },
+    {
+      "path": "docs/intentions/2026-09-20-evidence-first-planning.md",
+      "state": "present",
+      "git_blob": "bb61570bdd67db145f9004eaa4133ddd3f122bde",
+      "sha256": "sha256:7cf940bc9be2d8c2ede289af4be8902ed09304aca0db6a563c8692aa2214fcac"
+    },
+    {
+      "path": "docs/roadmaps/2026-09-20-org-control-plane.md",
+      "state": "present",
+      "git_blob": "0ead9cce75f95c71b58e8a4507aa2e1307a9fee4",
+      "sha256": "sha256:97710fc8875e88bc9df0a8b2e4fc5b57f89428fbab71283a2b5260427411850e"
+    },
+    {
+      "path": "docs/todos/2026-09-20-living-document-rollout.md",
+      "state": "present",
+      "git_blob": "04898c4455be7524c20c5e29e9478e35d7ef5518",
+      "sha256": "sha256:7c72db425bce9a53a47ca74c8e3dd51c07592c0c4f869c52d4effaa62bce6d8d"
+    }
+  ],
+  "verification": {
+    "commands": [
+      {
+        "command": "scripts/validate.sh",
+        "result": "pass",
+        "exit_code": 0
+      },
+      {
+        "command": "python3 scripts/validate_living_docs.py --strict --today 2026-11-01",
+        "result": "pass",
+        "exit_code": 0
+      },
+      {
+        "command": "python3 scripts/validate_living_docs.py --strict --today 2026-11-03",
+        "result": "pass",
+        "exit_code": 0
+      },
+      {
+        "command": "git diff --exit-code 7bad94833a84413683f186756cedf8b96fe58dad HEAD",
+        "result": "pass",
+        "exit_code": 0
+      },
+      {
+        "command": "git diff --check 76d828239136dd13189c024843ad85ab269fcf49 HEAD",
+        "result": "pass",
+        "exit_code": 0
+      }
+    ],
+    "verified_at": "2026-10-31T20:54:57Z"
+  },
+  "authority": {
+    "admission_effect": "none",
+    "authority_ref": null
+  },
+  "correction": null,
+  "receipt_sha256": "sha256:d7aa6bdc7070dc963cf9d6228095a73c9fb28ffa9819b1c05f2d879cfb324281"
+}

.quirk/evidence/governance-review-20261031-f2deb14f0d9c.json

@@ -0,0 +1,94 @@
+{
+  "schema_version": "evidence-receipt.v1",
+  "receipt_id": "qreceipt.governance-review-20261031.f2deb14f0d9c",
+  "repository": "Quirk-Systems/.github",
+  "status": "verified",
+  "subject": {
+    "base_commit": "7c52c0407ea2fa6d3fa99cf13d86492a74733259",
+    "commit": "f2deb14f0d9c9eb3a1608cde49c72f2ffa572abf",
+    "changed_paths": [
+      "docs/intentions/2026-09-20-evidence-first-planning.md",
+      "docs/roadmaps/2026-09-20-org-control-plane.md",
+      "docs/todos/2026-09-20-living-document-rollout.md"
+    ]
+  },
+  "claims": [
+    {
+      "claim_id": "qclaim.governance-review-20261031.f2deb14f0d9c",
+      "claim_type": "evidence",
+      "authority_effect": "none",
+      "statement": "Substantively revalidates three existing active governance documents against main d320f775a1be9ca8f6becfc19c84165bed176d1d and preserved PR 60 head 7c52c0407ea2fa6d3fa99cf13d86492a74733259. Records recovered review history, five-plan opt-in scope, landed work, draft dependencies, and pending owner decisions; sets November 3 checkpoints without changing status or enforcement. Historical sections, the done goal, and all three portfolio-review files are preserved. At this subject 233 tests and all executed validate.sh stages pass, including offline pedantic zizmor 1.31.1; Ruff and actionlint are unavailable, 21 concept warnings and 20 zizmor ignores remain. Strict validation passes on October 31 and simulated November 1 and November 3. This does not establish hosted success, implemented cadence/enforcement decisions, merge, settings activation, consumer adoption, or freshness on main before integration.",
+      "evidence_paths": [
+        "docs/intentions/2026-09-20-evidence-first-planning.md",
+        "docs/roadmaps/2026-09-20-org-control-plane.md",
+        "docs/todos/2026-09-20-living-document-rollout.md"
+      ]
+    }
+  ],
+  "artifacts": [
+    {
+      "path": "docs/intentions/2026-09-20-evidence-first-planning.md",
+      "state": "present",
+      "git_blob": "bb61570bdd67db145f9004eaa4133ddd3f122bde",
+      "sha256": "sha256:7cf940bc9be2d8c2ede289af4be8902ed09304aca0db6a563c8692aa2214fcac"
+    },
+    {
+      "path": "docs/roadmaps/2026-09-20-org-control-plane.md",
+      "state": "present",
+      "git_blob": "0ead9cce75f95c71b58e8a4507aa2e1307a9fee4",
+      "sha256": "sha256:97710fc8875e88bc9df0a8b2e4fc5b57f89428fbab71283a2b5260427411850e"
+    },
+    {
+      "path": "docs/todos/2026-09-20-living-document-rollout.md",
+      "state": "present",
+      "git_blob": "04898c4455be7524c20c5e29e9478e35d7ef5518",
+      "sha256": "sha256:7c72db425bce9a53a47ca74c8e3dd51c07592c0c4f869c52d4effaa62bce6d8d"
+    }
+  ],
+  "verification": {
+    "commands": [
+      {
+        "command": "scripts/validate.sh",
+        "result": "pass",
+        "exit_code": 0
+      },
+      {
+        "command": "python3 scripts/validate_living_docs.py --strict",
+        "result": "pass",
+        "exit_code": 0
+      },
+      {
+        "command": "python3 scripts/validate_living_docs.py --strict --today 2026-10-31",
+        "result": "pass",
+        "exit_code": 0
+      },
+      {
+        "command": "python3 scripts/validate_living_docs.py --strict --today 2026-11-01",
+        "result": "pass",
+        "exit_code": 0
+      },
+      {
+        "command": "python3 scripts/validate_living_docs.py --strict --today 2026-11-03",
+        "result": "pass",
+        "exit_code": 0
+      },
+      {
+        "command": "git diff --exit-code 7c52c0407ea2fa6d3fa99cf13d86492a74733259 -- docs/goals/2026-09-20-living-documents-validated.md docs/todos/2026-10-03-workspace-portfolio-plans.md docs/reviews/2026-10-30-workspace-portfolio-evidence.json .quirk/evidence/portfolio-review-20261030-bc4d58257330.json",
+        "result": "pass",
+        "exit_code": 0
+      },
+      {
+        "command": "git diff --check 7c52c0407ea2fa6d3fa99cf13d86492a74733259 HEAD",
+        "result": "pass",
+        "exit_code": 0
+      }
+    ],
+    "verified_at": "2026-10-31T14:59:31Z"
+  },
+  "authority": {
+    "admission_effect": "none",
+    "authority_ref": null
+  },
+  "correction": null,
+  "receipt_sha256": "sha256:13fbccb097aca11117a1c4159b1788941f7c9d0cbea9edeb9a0f26e4687ed6b2"
+}

docs/intentions/2026-09-20-evidence-first-planning.md

@@ -4,14 +4,38 @@ Kind: intention
 Status: active  
 Owner: @bryansayler  
 Repository: `Quirk-Systems/.github`  
-Observed head: `7c1061ba8867fdce4d903adc7c9589016e3ab002`  
-Reviewed: 2026-10-03  
-Review by: 2026-10-31  
+Observed head: `7c52c0407ea2fa6d3fa99cf13d86492a74733259`
+Reviewed: 2026-10-31
+Review by: 2026-11-03
 Derived from: `.quirk/evidence/dependency-review-trigger-9925b20c1393.json`, `docs/governance/EVIDENCE_BINDING.md`, `docs/governance/TRUTHFUL_TOPOLOGY_CUT_SPEC.md`  
 Authority effect: **none**
 
 ## Strength
 
+**VERIFIED at the observed head:** main
+`d320f775a1be9ca8f6becfc19c84165bed176d1d` retains exact-range receipt
+validation and the living-document contract. The observed PR #60 head adds a
+substantive portfolio re-read at `bc4d582573306d076c3611f8463dce42d8be90ab`
+and a separate receipt, with exact source heads, incomplete work, and a
+November 3 checkpoint. That is evidence of a completed review, not an owner
+approval or a durable cadence. The [rollout review](../todos/2026-09-20-living-document-rollout.md)
+and [roadmap review](../roadmaps/2026-09-20-org-control-plane.md) separate
+landed work from overlapping drafts and pending human decisions.
+
+**VERIFIED limitation:** the workflow defines checks on pull requests, but
+successful execution is not assured. The PR #60 head's Governance Contracts,
+Dependency Review, and CodeQL runs are recorded as failed, so their historical
+successes below are not a claim about current hosted health. The October 31
+branch response reported main unprotected and the repository ruleset list was
+empty; activation and merge-method settings remain separate owner work.
+
+### Historical strength — October 3 (preserved)
+
+The following observations, counts, present-tense statements, and reference to
+"the observed head" belong to the original review at
+`7c1061ba8867fdce4d903adc7c9589016e3ab002`. They are preserved as history,
+not promoted to October 31 evidence.
+
 The organization already binds claims to exact bytes, and the binding is
 checked on every pull request — though nothing yet makes it *block*, which is
 the correction below. VERIFIED at the observed head: `governance-contracts.yml`
@@ -67,10 +91,10 @@ checks. Planning inherits the receipt discipline instead of escaping it.
 
 ## Goals
 
-- **Done** 2026-10-03: `docs/goals/2026-09-20-living-documents-validated.md`. Every document under the four contract directories carries a validated header and the validator runs in `scripts/validate.sh`. The brief-and-plan opt-in path exists and is tested, but no brief or plan has used it yet; that is a task in the rollout todo, not part of the goal's measure.
-- Goal to write, now the urgent one: the twice-weekly portfolio review in `docs/governance/AUTONOMOUS_OPERATIONS.md` reads the roadmap and to-do documents and bumps their review dates, so freshness is produced by the existing cadence rather than by a separate ritual. On 2026-10-03 nothing produced it: the rollout todo was one day from its review date and the roadmap two — two and three days from any stale result, since the validator fires on `review_by < today` — after thirteen days unread, and only an unrelated drift check caught them.
-- Goal to write: decide where freshness is enforced. This intention says a validator "reports it stale the day it lapses"; what shipped fails the gate instead, and because the `validate` check runs the whole test suite, one stale planning document fails the `validate` check on any pull request whose checks run or re-run while the document is stale, including pull requests that changed nothing related. The intention's own wording is the weaker claim and the implementation is the stronger one — the gap was never written down until now, and closing it is a decision about blast radius, not about whether staleness matters.
-- Goal to write: consumer repositories can run the living-document validator against their own `docs/` through a reusable workflow, once two repositories carry such documents.
+- **Done, preserved:** `docs/goals/2026-09-20-living-documents-validated.md`. PR #42 corrected the measure and recorded the actual unit-test enforcement path. This review leaves that file, its status, and its historical evidence byte-identical. Its October 31 date is exempt from staleness because status is done.
+- **Pending owner disposition and implementation:** integrate living-document review into the existing twice-weekly portfolio agenda. Proposed scope: run strict validation, inspect open documents due by the next checkpoint, re-read against exact evidence, and record continued work or retirement. `AUTONOMOUS_OPERATIONS.md` and `REPOSITORY_STRATEGY.md` §8.10 still do not name that work. Proof of completion would be an accepted checklist change plus a dated review demonstrating its use; neither is claimed here.
+- **Pending owner decision:** select where freshness is enforced. The current real-date test can fail an unrelated PR's next run; changing it, adding a scheduled report, or adding merge-time enforcement requires an explicit disposition with its tradeoffs. The roadmap's owner-decision section holds this question. The October 5 owner follow-up on #42 repeated it without selecting an option.
+- **Blocked on evidence:** identify a second repository carrying living documents before proposing `reusable-living-docs.yml`. Such adoption was not established by this review. The absence of a reusable workflow in this repository does not prove that no external adopter exists.
 
 ## Not this
 
@@ -87,6 +111,42 @@ checks. Planning inherits the receipt discipline instead of escaping it.
 
 ## Review
 
+**Reviewed October 31; still active.** One goal remains done, and cadence,
+enforcement disposition, and consumer rollout remain incomplete. The shorter
+November 3 review date aligns with PR #60's existing portfolio checkpoint and
+keeps these unresolved decisions visible before another lapse; it is not a
+newly configured automation. At that checkpoint, record the owner disposition
+or the explicit continuing dependency, and re-read the source heads before
+renewing. Re-observe earlier if dependencies, the evidence gate, templates, or
+validator entrypoint change. Retire only if the goals are met or the owner
+chooses a different planning home.
+
+**Recovery and scope.** The rollout review records the all-ref history search,
+current source files, and candidate heads. The latest intention edit recovered
+was `ceb13f171620028db3c9e015ac22aad2a98be1c0` in merged PR #42; its
+header still recorded October 3. The newer October 30 portfolio review in
+PR #60 is preserved at `7c52c0407ea2fa6d3fa99cf13d86492a74733259`, not
+mistaken for a review of this intention or for a merge. No newer completed
+review of these three documents was found in the inspected history and PRs;
+inaccessible work remains outside that claim.
+
+**Freshness and authority.** The pre-correction PR #60 tree fails strict
+validation on simulated November 1 with exactly these three active records
+stale. The done goal is exempt. The correction keeps all three active and
+changes no validator, test, workflow, settings, owner, schema, or authority.
+Post-correction local commands and exact subject are recorded by the receipt.
+Hosted execution and human approval remain separate evidence. If no further
+review occurs, these three records become stale on November 4, not November 3.
+
+### Historical goals — October 3 (preserved)
+
+- **Done** 2026-10-03: `docs/goals/2026-09-20-living-documents-validated.md`. Every document under the four contract directories carries a validated header and the validator runs in `scripts/validate.sh`. The brief-and-plan opt-in path exists and is tested, but no brief or plan has used it yet; that is a task in the rollout todo, not part of the goal's measure.
+- Goal to write, now the urgent one: the twice-weekly portfolio review in `docs/governance/AUTONOMOUS_OPERATIONS.md` reads the roadmap and to-do documents and bumps their review dates, so freshness is produced by the existing cadence rather than by a separate ritual. On 2026-10-03 nothing produced it: the rollout todo was one day from its review date and the roadmap two — two and three days from any stale result, since the validator fires on `review_by < today` — after thirteen days unread, and only an unrelated drift check caught them.
+- Goal to write: decide where freshness is enforced. This intention says a validator "reports it stale the day it lapses"; what shipped fails the gate instead, and because the `validate` check runs the whole test suite, one stale planning document fails the `validate` check on any pull request whose checks run or re-run while the document is stale, including pull requests that changed nothing related. The intention's own wording is the weaker claim and the implementation is the stronger one — the gap was never written down until now, and closing it is a decision about blast radius, not about whether staleness matters.
+- Goal to write: consumer repositories can run the living-document validator against their own `docs/` through a reusable workflow, once two repositories carry such documents.
+
+### Historical review — October 3 (preserved)
+
 Retire this intention when its goals are done or when the owner decides
 planning should live outside the repository. Re-observe it whenever the
 evidence gate, the templates, or the validator entrypoint changes, and at