Implement M1 local vertical slice

[brendohxd]

Summary

• add a default policy engine for allowed task transitions, linked evidence, independent review, remediation, and human decision gates
• add an evidence-bundle CLI that hashes declared artifacts without executing recorded commands
• add a complete public-safe M1 fixture covering submission, failed review, remediation, resubmission, passing review, and human acceptance
• expose the evaluated task packet through a read-only MCP resource and bounded review prompt
• project derived state, transition history, and gate results into the static console
• run conformance on both Windows and Linux CI

Why

M1 needs to prove Relay''s governance loop locally before GitHub write automation or ITSM-specific research profiles are introduced. This slice keeps Git as the canonical record, preserves disagreement and failed review, and retains named human authority.

Developer impact

• npm run validate checks both the M0 and M1 workspaces
• npm run evidence:create -- --manifest <file> --output <file> builds validated evidence
• npm run build:state:check verifies the committed console projection without relying on a clean worktree
• MCP now lists relay://tasks/{id} and the relay_review_task prompt

Validation

• npm run check
• 12 tests passed on local Windows with Node.js 24.18.0
• M0 workspace valid
• M1 workspace valid: 12 events, 2 evidence bundles, 2 reviews, 1 decision
• public-boundary scan passed
• deterministic console-state check passed
• git diff --check passed

Boundaries

• no GitHub write adapter
• no remote MCP transport or authentication layer
• no arbitrary command execution
• no ITSM scientific material or project-specific policy

AI disclosure

Implementation and documentation were developed with OpenAI Codex assistance and require human review.

[brendohxd]

Verification note: GitHub Actions did not execute any runner steps because the account is locked by a billing issue. This is an infrastructure/account blocker, not a test failure. Local Windows verification with Node.js 24.18.0 passes npm run check with 12 tests, both M0 and M1 workspaces valid, the public-boundary scan passing, and deterministic console state current. WSL and Docker are not installed, so Linux remains explicitly unverified. No code change is proposed for the Actions failure; this PR remains draft pending human review.

[brendohxd]

M1.1 hardening update (commit 11dc90a): added optional actor capability declarations, typed backward-only causal event links, and an offline measured local doctor.
pm run check passes all 15 tests;
pm run doctor reports 5 PASS, 1 expected WARN for the dirty worktree, 0 FAIL, 0 UNKNOWN. No new runtime dependency or paid service was introduced. Capability declarations remain metadata rather than authority, and rebuildable indexes remain non-canonical. The pre-existing local line-ending change in docs/VERSION_MAINTENANCE.md was excluded.

[brendohxd]

M1 protocol review completed in commit 786648e. Fixed three consistency defects: evidence producers now support declared capabilities; MCP event preparation preserves capabilities and causal links; and high/critical-risk acceptance now requires an independently produced reproduction bundle that is reviewed and hashed by the human decision. Independent reviewers are also prevented from reviewing evidence they produced. Local validation passes 18 tests, both workspaces, the public-boundary scan, deterministic console state, and the offline doctor (5 PASS, 1 expected worktree WARN, 0 FAIL, 0 UNKNOWN). Hosted Windows/Linux checks remain account-blocked and are not treated as code evidence.

[brendohxd]

Billing lock resolved and the cross-platform failure was fixed in c45efa0.

Verification:

• Windows: pass
• Ubuntu: pass
• 18/18 M1 tests pass
• public-boundary, schema, event-chain, evidence, policy, and deterministic console-state checks pass

Run: https://github.com/brendohxd/Project-Relay/actions/runs/29680192255

Root cause was platform-dependent text checkout bytes. .gitattributes now forces Git-detected text to LF while evidence hashing remains strict raw-byte SHA-256.