docs: policy governance, effective profiles and release-management roadmap

[pcvantol]

One coordinated documentation increment

POLICY_GOVERNANCE_AND_EFFECTIVE_PROFILES_V1 — explicitly documentation and roadmap only, as requested by the owner. This is not implementation, a live policy activation or merge/deployment authorization.

• Defines product-owned policy authority, typed composition, proposal/decision/activation records, immutable effective snapshots, revocation and historical explanation.
• Inventories existing Forge policies and source-pinned EP/Workspace/Platform observations without claiming a management UI already exists.
• Establishes native Forge version/release management as a policy-driven planning capability; EP executes and Forge Platform composes artifacts.
• Clarifies the old per-head repair and mandatory-human-merge prose: no budget reset by SHA, no permission from a policy flag, exact-head qualification and existing scoped delegation stay separate.
• Adds a scoped Markdown + machine-readable documentary policy/release DAG and links it from the canonical roadmap. The executable bootstrap programme DAG is unchanged.
• Full Workspace UI is not a new first-canary dependency; production installer composition must consume real policy/release/artifact qualification.

Coordination

Companion documentation uses the same codex/policy-governance-effective-profiles-v1 branch in EP, Workspace and Forge Platform; PR links will be recorded here after creation. Existing Forge #48/#49, EP #100/#102, Workspace #14 and Platform #16/#17 remain separate owning proposals/implementation lanes. No implementation findings are marked fixed by this documentation.

Validation and boundaries

Only Markdown and documentary roadmap JSON are changed. No source code, tests, workflows, package versions, runtime data, credentials or grants are changed. Hosted validation is requested on this exact candidate; results will be attached. No full local repository test suite is claimed. Pending until legitimate owning merge; no merge requested by this PR creation.

[pcvantol]

Coordinated documentation increment — closure/evidence report

POLICY_GOVERNANCE_AND_EFFECTIVE_PROFILES_V1

Owner	Documentation PR	Exact head
Forge	#50	cb5423e20b89795e08936d7c59266e5a9294c097
EP	pcvantol/engineering-platform#103	d3242c40e886dcb4e7c66ddb4dd7a4012e475545
Workspace	pcvantol/workspace#15	4219243cd6b83757b369a4c2d6e4376f11b8600d
Forge Platform	pcvantol/forge-platform#18	06a7704aee28a7d5ea3446efae856629b57eee73

Verified scope and documentary checks

• Re-fetched all four changed-file lists: 16 files = 15 Markdown + 1 documentary roadmap JSON. No implementation, test source, workflow, version/configuration, executable bootstrap DAG, runtime, grant, credential or consumption changes.
• Re-fetched docs/roadmap/policy-governance-v1.json; local validation input was matched byte-for-byte to Git blob 44e5563f9fbdfdef236070c022f3e37400c324cc using Git blob SHA computation.
• JSON parses; 11 unique nodes / 15 dependencies; all owners and dependency targets known; no self/duplicate dependencies; topological sort succeeds; dependencies match the Markdown roadmap table; all implementation nodes remain PLANNED; execution_authority/runtime_configuration are false.
• Canonical roadmap entrypoints in all four repositories route to their owning designs. Workspace architecture and Platform BOOTSTRAP also route the new surface. Product policy/grant/runtime-fact separation, restrictive composition, snapshots, live revocation and partial activation boundaries are consistent.

Hosted results on those heads

• Forge: Forge CI 34214053813, CodeQL 34214053971, TDE observe 34214053832: SUCCESS.
• EP: Engineering Platform validation 34214369781, Golden 34214369690, Trusted Delivery 34214370140, Security 34214369768, CodeQL 34214369769, TDE 34214369863: SUCCESS. Separate Owner Authorization commit status: SUCCESS.
• Workspace: Workspace CI 34214607980, TDE 34214608031: SUCCESS.
• Forge Platform: Foundation validation 34214795829, CodeQL 34214795826, TDE 34214795834: SUCCESS.
• All four PR metadata snapshots report open, unmerged and Git-mergeable. No independent human review approval or installed qualification is asserted. No full local repository test suite was run; hosted jobs and the separate local documentary graph check are distinguished above.

Coexistence and merge discipline

Existing Forge #48/#49, EP #100/#102, Workspace #14 and Platform #16/#17 are untouched. Reconcile their relevant target architecture and shared roadmap sections against this set; do not replace one proposal's roadmap changes with a stale whole-file version. This documentation does not close their implementation findings or permit competing version allocators.

No merge, release, install, live Mission or grant activation has been performed. The design is PENDING_PR until owning merges; documentary DAG adoption is not runtime execution authority. Any material adoption into a live authorized programme still needs its normal staleness reconciliation without extending expiry or resetting budgets. Full Workspace policy UI stays off the first Mission-canary path; production installer release/policy/artifact compatibility remains an explicit future qualification.