[sgathrid]

Outcome

Brian now implements the complete governed-source workflow delivered by the shared engine, passes its own quality gates, and has public CI protecting the OSS product.

Functional changes

• Adds source inventory and bounded source inspection to the CLI/MCP workflow.
• Keeps raw evidence separate from curated answers until a validated, approved update is applied.
• Reuses existing byte-identical raw sources instead of duplicating evidence.
• Returns structured needs_revision diagnostics for agents to repair before presenting a ready proposal.
• Makes the MCP approval state machine self-describing in JSON Schema: omit the digest to preview, then apply
  the exact unchanged payload with the digest from status=ready after approval.
• Deprecates the legacy confirmed flag, rejects contradictory compatibility inputs, and advertises the
  ready | needs_revision | applied result states.
• Updates Brian-owned agent guidance, pointer text, README, and dogfood coverage without importing KOS branding, policy, or corpus fixtures.
• Declares the implemented cross-repo workflow contract for KOS candidate validation.

Repository health

• Fixes Brian-owned Ruff and mypy failures with a typed settings snapshot and normalized boolean state.
• Removes the nonexistent private benchmarks package from Brian mypy scope.
• Adds GitHub Actions for Python 3.11/3.13 tests, Ruff, mypy, CLI smoke, public demo audit, and generated-index drift.

Why

The previous KOS overlay copied shared API/tests while correctly preserving Brian-owned product surfaces. That left Brian with five integration failures. This PR completes the public adapters and establishes durable CI rather than weakening the ownership boundary.

Validation

• uv run pytest -q — 410 passed
• uv run ruff check . — passed
• uv run mypy — 24 source files passed
• uv run wiki audit — passed
• uv run wiki gen + generated-file diff — clean
• KOS leak check — passed
• KOS exact-candidate contract suite — 107 passed

Pipeline dogfood

• KOS contract v2 correctly refused Brian v1 with exit 4 before any write.
• After Brian-owned docs, dogfood, and the declaration moved to v2, the exact candidate passed 107 tests and the leak check.
• The four-file KOS overlay applied; final status reports zero pending files and revalidates the same 107 tests.
• The documented divergence override was used because this unmerged Brian PR intentionally contains the prior synchronized versions.

Merge coordination

Land this Brian PR before KOS PR #10 so the new fail-closed preflight is immediately usable.