Enforce bounded programme authorization

docs/architecture/FORGE_V1_BOOTSTRAP_GOVERNANCE_DECISION.md

@@ -32,6 +32,11 @@ authority inputs; derived state/evidence refresh alone is not material.
 `BOOTSTRAP_AUTHORIZATION_STALENESS = DEFINED`  
 `BOOTSTRAP_NODE_DISPATCH_AUTHORITY = MACHINE_DECIDABLE`
 
+The record is written only through Forge's canonical governance writer with
+capability `OWNER_PROGRAMME_AUTHORIZATION`. Its source reference and verified
+owner-account binding are immutable evidence; a local status write, a copied
+prompt, or a retrospective assertion is not an authorization record.
+
 ## Owner authorization
 
 Forge has no inherited EP Owner Authorization workflow. This decision creates
@@ -49,26 +54,28 @@ New commits invalidate it. It is distinct from CI and Human UI Review.
 
 ## Merge and operating boundary
 
-Bootstrap V1 auto-merge is disabled. A node reaches `MERGE_READY` only after
+Within a valid programme authorization, a node may be squash-merged only after
+an executable exact-head qualification has passed. A node reaches `MERGE_READY` only after
 implementation, local and exact-head hosted qualification, resolved reviews,
 applicable UI/owner/security gates, valid authority, fresh contracts and
 mergeability. It then enters `WAITING_HUMAN_MERGE`; human merge is followed by
 post-merge qualification before `DONE`. A bounded merge packet includes node,
 PR, exact head, risk, DoR/DoD, CI/reviews/gates, scopes, unlocked dependents and
 known risks. Parallel PRs re-evaluate after every merge.
 
-`BOOTSTRAP_AUTO_MERGE = FALSE`  
-`HUMAN_MERGE_REQUIRED = TRUE`  
+`BOOTSTRAP_AUTO_MERGE = QUALIFIED_SQUASH_ONLY`
+`QUALIFIED_SQUASH_MERGE_REQUIRED = TRUE`
 `MERGE_DECISION_PACKET = DEFINED`  
 `PARALLEL_PR_MERGE_REEVALUATION = TRUE`
 
-Autonomous repair remains disabled: a future runner may classify and stop at
-`REPAIR_REQUIRED`, never reinvoke itself without a separate finite policy.
-The first operating mode is autonomous preparation/observation only; programme
-approval, out-of-envelope decisions, security/UI/owner gates, repair authority
-and merge stay human.
+Autonomous repair is permitted only when its programme authorization states a
+finite per-PR/per-head budget. The current policy supports at most three
+attempts for an exact head; a new head requires a fresh exact-head
+qualification and its own budget. The runner must stop at scope expansion,
+expired or revoked authorization, failed security/review/CI, or exhausted
+budget.
 
-`AUTONOMOUS_REPAIR_ENABLED = FALSE`  
+`AUTONOMOUS_REPAIR_ENABLED = BOUNDED_PER_EXACT_HEAD`
 `UNBOUNDED_AUTONOMOUS_REPAIR = FALSE`  
 `BOOTSTRAP_RUNNER_CAN_SELF_AUTHORIZE = FALSE`  
 `BOOTSTRAP_GOVERNANCE_FORWARD_COMPATIBLE = TRUE`

docs/architecture/FORGE_V1_BOOTSTRAP_ORCHESTRATOR_READINESS.md

@@ -27,7 +27,7 @@ DISPATCHABLE = SEMANTIC_READY AND DEPENDENCY_SAFE AND REPOSITORY_SAFE
 
 Temporary local scheduling for this Forge bootstrap repository is `BOOTSTRAP_COORDINATION`, never an execution lease; EP remains the repository-write lease owner. `BOOTSTRAP_RUNNER_IS_LEASE_AUTHORITY = FALSE`; `BOOTSTRAP_PROMPT_IS_AUTHORITY = FALSE`; `CI_GREEN_UNLOCKS_DEPENDENTS = FALSE`; `POST_MERGE_DAG_REEVALUATION = TRUE`; `HUMAN_GATE_GLOBAL_STOP_BY_DEFAULT = FALSE`.
 
-The canonical [V1 Bootstrap Governance Decision](FORGE_V1_BOOTSTRAP_GOVERNANCE_DECISION.md) selects a bounded hybrid programme authorization. `BOOTSTRAP_MISSION_AUTHORITY = BOUNDED_V1_BOOTSTRAP_PROGRAMME_AUTHORIZATION (MODEL_C)`: an explicit human authorization record admits only its immutable node set and authority envelope. It never omits the permanent Roadmap → Candidate → Business approval → Architecture approval → Mission → Action model; a new product, architecture, security, cross-product, repository, scope, or undefined-contract finding returns the node to full governance. `BOOTSTRAP_AUTO_MERGE_POLICY = DISABLED`; a human merge remains required.
+The canonical [V1 Bootstrap Governance Decision](FORGE_V1_BOOTSTRAP_GOVERNANCE_DECISION.md) selects a bounded hybrid programme authorization. `BOOTSTRAP_MISSION_AUTHORITY = BOUNDED_V1_BOOTSTRAP_PROGRAMME_AUTHORIZATION (MODEL_C)`: an explicit human authorization record admits only its immutable node set and authority envelope. It never omits the permanent Roadmap → Candidate → Business approval → Architecture approval → Mission → Action model; a new product, architecture, security, cross-product, repository, scope, or undefined-contract finding returns the node to full governance. `BOOTSTRAP_AUTO_MERGE_POLICY = QUALIFIED_SQUASH_ONLY`: an executor may merge only a currently qualified exact head after all actual CI, review, security and Owner Authorization gates pass.
 
 ## Scheduler-grade coverage
 
@@ -64,9 +64,9 @@ NOT_READY -> READY -> BOOTSTRAP_CLAIMED -> IMPLEMENTING -> PR_OPEN -> CI_RUNNING
 
 `BLOCKED`, `FAILED`, `STALE`, `SUPERSEDED`, and `REPLAN_REQUIRED` require explicit resolution. `BOOTSTRAP_NODE_LIFECYCLE = DEFINED`. `CODE_IMPLEMENTED`, `PR_OPEN`, `CI_GREEN`, `MERGE_READY`, `MERGED`, and `DONE` differ; only `DONE` satisfies a predecessor.
 
-Every qualification names `LOCAL_TEST`, `HOSTED_CI`, `INSTALLED_PRODUCT_CANARY`, `SECURITY_GATE`, `BROWSER_GATE`, `CROSS_PRODUCT_GATE`, `HUMAN_REVIEW`, `OWNER_AUTHORIZATION`, or `POST_MERGE_GATE`, exact SHA, result and new-head invalidation.
+Every qualification names `LOCAL_TEST`, `HOSTED_CI`, `INSTALLED_PRODUCT_CANARY`, `SECURITY_GATE`, `BROWSER_GATE`, `CROSS_PRODUCT_GATE`, `HUMAN_REVIEW`, `OWNER_AUTHORIZATION`, or `POST_MERGE_GATE`, exact SHA, result and new-head invalidation. The durable programme record is written by the canonical governance writer and records the verified owner account binding and source reference; it never synthesizes a GitHub check.
 
-Ordinary review is same-node `REPAIR_REQUIRED`; an architecture decision, dependency, new capability or scope expansion is `REPLAN_REQUIRED`. CI failures must first classify as `IMPLEMENTATION_DEFECT`, `TEST_DEFECT`, `FLAKY_INFRASTRUCTURE`, `STALE_BASE`, `DEPENDENCY_CHANGED`, `SECURITY_FAILURE`, `QUALIFICATION_GAP`, or `UNDEFINED_CONTRACT`. No canonical retry limit exists: automatic repair requires a future operator-set finite limit; otherwise it is disallowed. `UNBOUNDED_AUTONOMOUS_REPAIR = FALSE`.
+Ordinary review is same-node `REPAIR_REQUIRED`; an architecture decision, dependency, new capability or scope expansion is `REPLAN_REQUIRED`. CI failures must first classify as `IMPLEMENTATION_DEFECT`, `TEST_DEFECT`, `FLAKY_INFRASTRUCTURE`, `STALE_BASE`, `DEPENDENCY_CHANGED`, `SECURITY_FAILURE`, `QUALIFICATION_GAP`, or `UNDEFINED_CONTRACT`. Automatic repair is limited to three attempts per exact PR head under the programme authorization; a changed head must be requalified. `UNBOUNDED_AUTONOMOUS_REPAIR = FALSE`.
 
 Human UI review, owner authorization, business approval, architecture approval and security decision pause only their node; each needs named evidence and returns to re-evaluation. Other safe nodes continue. The canonical governance decision supplies Forge's consequence-based risk mapping: `NORMAL_LOW` needs no separate Owner Authorization, `ELEVATED` needs exact-head Owner Authorization, and `HIGH` needs exact-head Owner Authorization plus security review. A new commit invalidates the authorization. This is a Forge contract, not an inference from EP.
 
@@ -92,6 +92,6 @@ After a human merge: refresh main, verify merge SHA, clean context, refresh Repo
 
 ## Governance closure
 
-The governance decision resolves the three prior blockers: `BOOTSTRAP_MISSION_AUTHORITY = RESOLVED`, `OWNER_AUTHORIZATION_SCHEDULER_CONTRACT = RESOLVED`, and `BOOTSTRAP_AUTO_MERGE_POLICY = DISABLED`. The future runner is therefore contract-ready for a separately approved implementation Mission; dispatch still requires an actual, non-stale programme authorization record and cannot use repair automation.
+The governance decision resolves the three prior blockers: `BOOTSTRAP_MISSION_AUTHORITY = RESOLVED`, `OWNER_AUTHORIZATION_SCHEDULER_CONTRACT = RESOLVED`, and `BOOTSTRAP_AUTO_MERGE_POLICY = QUALIFIED_SQUASH_ONLY`. The future runner is therefore contract-ready for a separately approved implementation Mission; dispatch still requires an actual, non-stale programme authorization record and applies the finite repair budget per exact head.
 
 `FORGE_V1_BOOTSTRAP_ORCHESTRATOR_READY_FOR_IMPLEMENTATION = YES`.

forge/governance_authority.py

@@ -18,6 +18,7 @@ class GovernanceCapability(str, Enum):
     BUSINESS_APPROVAL = "BUSINESS_APPROVAL"
     ARCHITECTURE_APPROVAL = "ARCHITECTURE_APPROVAL"
     SECURITY_APPROVAL = "SECURITY_APPROVAL"
+    OWNER_PROGRAMME_AUTHORIZATION = "OWNER_PROGRAMME_AUTHORIZATION"
 
 
 @dataclass(frozen=True)
@@ -30,12 +31,14 @@ class GovernanceDecision:
     scope: tuple[str, ...]
     gates: tuple[str, ...]
     predecessor_digest: str | None = None
+    evidence: dict[str, object] | None = None
 
     def document(self, installation_id: str, operator_id: str, occurred_at: str) -> dict[str, object]:
         return {
             **asdict(self), "capability": self.capability.value,
             "scope": list(sorted(self.scope)), "gates": list(sorted(self.gates)),
             "installation_id": installation_id, "operator_id": operator_id, "occurred_at": occurred_at,
+            "evidence": self.evidence or {},
         }
 
 

forge/operator_identity.py

@@ -41,9 +41,9 @@ def _governance_state(self, context):
   rows=self.db._connection.execute('SELECT capability FROM governance_authority WHERE installation_id=? AND operator_id=? ORDER BY capability',(context.installation_id,operator)).fetchall()
   return tuple(row['capability'] for row in rows)
  def _valid_adoption_provenance(self, context, binding):
-  expected=('ARCHITECTURE_APPROVAL','BUSINESS_APPROVAL','SECURITY_APPROVAL'); operator=self._governance_operator_id(context)
+  expected=('ARCHITECTURE_APPROVAL','BUSINESS_APPROVAL','OWNER_PROGRAMME_AUTHORIZATION','SECURITY_APPROVAL'); operator=self._governance_operator_id(context)
   rows=self.db._connection.execute('SELECT capability,bootstrap_provenance,digest FROM governance_capability_grants WHERE installation_id=? AND operator_id=? ORDER BY capability',(context.installation_id,operator)).fetchall()
-  if len(rows)!=3 or tuple(row['capability'] for row in rows)!=expected:return False
+  if len(rows)!=len(expected) or tuple(row['capability'] for row in rows)!=expected:return False
   for row in rows:
    try:document=json.loads(row['bootstrap_provenance'])
    except (TypeError,ValueError):return False
@@ -52,7 +52,7 @@ def _valid_adoption_provenance(self, context, binding):
   return True
  def _persist_governance_capabilities(self, context, kind, provenance, binding=None):
   if not self.authorize(context): raise PermissionError('trusted bound operator required')
-  expected=('ARCHITECTURE_APPROVAL','BUSINESS_APPROVAL','SECURITY_APPROVAL'); state=self._governance_state(context)
+  expected=('ARCHITECTURE_APPROVAL','BUSINESS_APPROVAL','OWNER_PROGRAMME_AUTHORIZATION','SECURITY_APPROVAL'); state=self._governance_state(context)
   if state:
    if state!=expected or kind!='EXISTING_G001_GOVERNANCE_ADOPTION_V1' or binding is None or not self._valid_adoption_provenance(context,binding): raise PermissionError('conflicting governance capability provenance')
    return