Add GitHub self-governance, docs, policies, CI, and trust-authority scaffolding

[blocksifrdev]

Motivation

• Prepare the repository for public launch by adding governance, security, and contributor controls around protocol- and runtime-critical paths.
• Introduce a reference model for applying TTP to GitHub operations (TTP governing TTP) so non-human role-agents are runtime-authorized before executing protected actions.
• Seed operator and ecosystem documentation, access-control guidance, and manifest-driven role-agent definitions to make on‑boarding and audits repeatable.
• Improve the Trust Authority reference implementation with tests and small crypto/runtime fixes to increase reliability and observability.

Description

• Added GitHub governance and automation scaffolding: CODEOWNERS, workflows for CI and TTP-protected gates (.github/workflows/ci.yml, ttp-protected-gate.yml, ttp-governed-pr-action.yml).
• Introduced GitHub self-governance design and runtime artifacts including docs/github-self-governance-reference-architecture.md, API contract runtime/api/re-authorize.contract.md, authority service scaffold services/authority/*, receipt schema receipts/schemas/execution-receipt.v1.json and extended receipt schema spec/extensions/execution-receipt-v2.schema.json.
• Added role-agent manifests and agent definitions (agents/manifests/role-agents.yaml, agents/*/manifest.json) and a docs-oriented agent agents/docs-dx/manifest.json to model workload identities and allowed actions.
• Added policy and protection artifacts: policy/*.yaml, docs/protected-action-model.md, examples/acceptance/protected-workflow-edit.md, and policy/github-self-governance-policy.yaml to enumerate protected paths and outcomes.
• Expanded repository docs and onboarding: CONTRIBUTING.md, README.md updates, many docs/*.md (getting-started, operator-guide, repo-access-control, public-readiness, ecosystem-integrations, roadmap, open-source-boundary, scim-re mapping, etc.).
• Reference Trust Authority changes: added tests and test runner config (reference-implementations/trust-authority/jest.config.cjs, src/aggregation.test.ts), updated package.json dev deps, small crypto fixes to ed.etc.sha512Sync usage in src/crypto.ts, src/index.ts, and key-generation script, added admin listing route and store helpers (listAgents, getAgentReceiptsAcrossDomains) and store metric support.
• Added simple authority runtime (services/authority/index.ts, receiptSigner.ts, schemas.ts, policyLoader.ts) implementing POST /re/authorize decision flow, chain-hash/receipt signing, and protected-path checks.

Testing

• Unit tests were added for the Trust Authority aggregation logic in reference-implementations/trust-authority/src/aggregation.test.ts and executed with npm test (Jest); the test suite (three assertions covering insufficient-data, score bounds, and issuer-weight capping) passed.
• CI workflow /.github/workflows/ci.yml is configured to run npm install, npm run build, and npm test for reference-implementations/trust-authority on PRs and pushes to main/work (no CI run failures reported here).

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9b88fe08d0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle invalid JSON without crashing the authority server

The /re/authorize handler awaits parseBody(req) without any try/catch, and parseBody explicitly rejects on malformed JSON. Because this callback is async in http.createServer, a bad payload causes an unhandled rejection that terminates the Node process instead of returning a 4xx response, so any malformed request can take the authority service down.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Let STEP_UP and ESCALATE reach the approval job

This step fails the protected-action-gate job for every non-PERMIT decision, but step-up-approval depends on that job via needs. In GitHub Actions, failed dependencies prevent downstream jobs from running unless they use always(), so STEP_UP/ESCALATE decisions never reach the intended manual environment approval path and the workflow hard-fails immediately.

Useful? React with 👍 / 👎.