CR-DD-012A: Implement governed decision foundation

[coreytshaffer]

Status

Internal foundation only. CR-DD-012A adds no public integration or execution authority.

CR-DD-012B remains blocked. This PR does not authorize or implement shared
preview/execution consumption, saved-plan execution, or any new operator
capability.

What changed

• Added an immutable, bounded GovernedRunInputSnapshot foundation.
• Preserved current strict UTF-8, universal-newline, BOM, source-order,
  duplicate-source, verbatim path-header, inline-input, and absent-input
  semantics.
• Made AssembledExecutionBytes—the UTF-8 bytes of
  prompt + "\n\nDATA:\n" + data—the authoritative future parity binding.
• Added mandatory finite construction limits without creating a public CLI
  input limit or converting advisory token budgets into byte limits.
• Added an immutable, privacy-safe GovernedDecision with closed schemas,
  canonical JSON, strict parsing, domain-separated identity, and explicit
  authority boundaries.
• Added focused compatibility, privacy, purity, malformed-input, and
  integration-absence tests.
• Updated only the bounded CR, backlog, architecture, and sequencing records.

Decision IDs are linkage only. They do not establish authenticity, approval,
execution authority, cloud authorization, acceptance, or quality.

Exact scope

Exactly nine authorized files:

• triage_core/governed_run_snapshot.py
• triage_core/governed_decision.py
• tests/test_governed_run_snapshot.py
• tests/test_governed_decision.py
• tests/test_governed_decision_integration_absence.py
• docs/change/requests/CR-DD-012A-governed-decision-foundation.md
• docs/current_backlog.md
• docs/architecture/daily_driver_orchestrator_spec.md
• docs/change/requests/CR-DD-012-shared-governed-run-decision.md

No CLI, existing runtime path, ledger, artifact contract, router, worker,
backend, renderer, cloud-authority, or plan-schema integration changed. No
existing production module imports either new foundation module.

Validation

• Focused CR-DD-012A suite: 103 passed
• Full suite: 1,167 passed, 4 skipped
• Privacy-invariant audit: 698 records passed
• Both foundation modules passed py_compile
• git diff --check: passed
• Remote comparison against main: one commit ahead, zero behind, exactly nine
  files
• Existing ledger SHA-256: unchanged
• Artifact files: unchanged

The full suite appended one metadata-only supervisor usage scan line to the
existing ignored .triagecore/triagecore.log. The line was preserved; no
cleanup or history rewrite was performed.

Explicitly absent

• No integration with ordinary tc run or tc run --plan
• No governed_run_plan.v2
• No snapshot or decision persistence
• No ledger fields or runtime-observation records
• No backend invocation, health probe, route execution, or fallback enforcement
• No cloud authorization change
• No --confirmed-plan or saved-plan execution
• No CR-DD-012B implementation authority

Final review gate

• Snapshot bytes exactly match current worker-message assembly semantics.
• Finite construction limits fail closed without becoming a public CLI
  limit.
• Frozen records and tuples retain no caller-owned mutable aliases.
• Canonical parsing rejects duplicate keys, floats, unknown/missing fields,
  unsupported versions, malformed digests, noncanonical bytes, and ID
  mismatches.
• Serialized decisions contain no prompts, inline data, source content,
  source paths or basenames, sensitive markers, credentials, or secrets.
• Ordered sources, fallbacks, and verification requirements preserve order
  and duplicates.
• Decision IDs remain content linkage only.
• The decision builder has no ambient or volatile dependencies.
• No existing production module imports or consumes the foundation.
• The diff remains limited to the exact nine-file allowlist.