SBAI-5934: enforce the Option A governance submission gate

[BizaNator]

Summary

SBAI-5934 adds the strict Option A governance contract, evaluator, durable evidence-preserve flow, DCO validation, and submission gate to lore-vm.

The gate is fail-closed over exact staged-subject facts, full pending and reachable ancestry DAGs, canonical file identities, DCO metadata, locks, worktree state, supersession markers, and durable actor evidence. The witness re-derives every terminal criterion from private raw facts; evaluator summaries remain diagnostic-only.

Three typed machine-only operations are registered in their own governance dispatch section:

• governance.dco_validate
• governance.evidence_preserve
• governance.submission_gate_check

The deferred authoritative supersession writer is intentionally not implemented or registered. Calling governance.artifact_mark_superseded remains an unknown operation until its v2 writer contract exists.

Related issue / ticket

SBAI-5934

Type of change

• Bug fix
• New lore op / feature
• UI / UX
• Docs only
• Build / CI / tooling
• Upstream lore pin bump

Checklist

• cargo fmt --all --check passes
• cargo clippy -p lore-vm -- -D warnings passes
• cargo test -p lore-vm passes, including the real-Lore hybrid integration
• cargo check -p loregui passes
• npm --prefix frontend run build passes
• node frontend/scripts/palette-parity.mjs passes
• New operations have an intentional machine-only governance surface; auth dispatch remains unchanged
• No files outside the approved governance fence were touched or reformatted
• No user-facing docs change is required; contract and boundary documentation live with the typed operations

Verification

Exact candidate head: 96a8fcc
Exact base: 37ad236

• cargo +nightly fmt --all -- --check: exit 0
• cargo clippy -p lore-vm --locked -- -D warnings: exit 0
• cargo test -p lore-vm --locked: exit 0; 779 library tests, governance 57/57, default integrations, doctest
• cargo test -p lore-vm --locked --features integration-tests --test governance_option_a hybrid_real_lore: exit 0, 2/2
• cargo check -p loregui --locked: exit 0
• npm --prefix frontend run build: exit 0 after npm ci populated this isolated worktree
• node frontend/scripts/palette-parity.mjs: exit 0; 0 parity errors
• git diff --check: exit 0
• worktree clean

All four commits carry exactly one authorized Signed-off-by trailer. The DCO-only rewrite preserved every per-commit tree ID in order and the final tree is byte-identical to the pre-rewrite rollback ref.

Notes for reviewers

This is a fresh whole-candidate target. Earlier Task-1 and Task-2 verdicts do not transfer to 96a8fcc.

The Task-1 source audit found six real blockers in the earlier three-commit head: incomplete ancestry, staged-tree identity reuse, caller-selected lock branch, noncanonical identities, erased metadata kinds, and first-End terminal truncation. Task 2 was built to close all six. Its exact-byte QA PASS is recorded in SBAI-5934 Jira comment 159749 with report SHA-256 2244f13b6921eb6d571eeb8308f0b4dfdd5f64acef8bc66551cbcb3ecc00da3b.

Load-bearing review points:

• both-parent DAG traversal to roots with an N+1 overflow sentinel
• capture-time local identity for modified files and stable upstream context IDs
• witness-owned private raw projections for all seven criteria, evidence, and stability
• stored evaluator summaries are inert under full-gate poisoning
• exact DCO row cardinality and raw author-response rebinding
• active staged evidence-pointer omission is the sole typed self-reference delta; ancestor pointers remain visible
• no supersession writer, no actor verdict, no dispatch-selected authority
• auth operation code is unchanged

Known explicit boundaries remain tracked separately: authenticated remote fixture SBAI-6001; ancestry-index migration SBAI-6010; upstream provenance and Binary metadata observability SBAI-6011/SBAI-6012.

This PR is ready for fresh exact-head source review. It is not a merge authorization and the author will not self-merge.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
loregui	Ready	Preview	Aug 3, 2026 10:10am

[BizaNator]

HOLD — reaffirming the existing sequencing-hold

Owner: whoever set sequencing-hold (the SBAI-5934 governance lane).

All 19 checks pass — including build on all three targets, e2e, cli-contract, core-check, boundary and attribution — and it is MERGEABLE/CLEAN. Not merging, deliberately.

• The sequencing-hold label is another lane's explicit decision. A backlog sweep should not lift it; whoever set it knows what this must land after.
• The change is substantial rather than incidental: +14,244 lines across 9 files, adding a whole crates/lore-vm/src/ops/governance/ op family (contract, evaluator, evidence_preserve, submission_gate_check, dco_validate) and wiring it into dispatch.rs. Enforcing a submission gate changes what the VM will accept — landing it out of order can reject work that other in-flight PRs depend on being accepted.
• It carries crates/lore-vm/tests/governance_option_a.rs (+5,198), the only test coverage for the entire new op family. This must never be closed as stale — closing it would discard the gate and its tests together.

Worth noting for the owner: with green CI across the board, the only thing standing between this and main is the sequencing decision. If that ordering constraint has already been satisfied, this is ready to go — it just needs the lane to say so.

Held, not closed. Nothing at risk.