P0: Pilot canonical agent manifests and immutable readiness workflow adoption

[BunsDev]

Outcome

Prove the governance contract proposed in #7 against real canonical repositories before expanding it organization-wide.

Pilot repositories:

1. OpenCoven/familiar-contract — canonical identity/principal-binding owner and an R4 trust boundary.
2. OpenCoven/psyche — canonical orchestration owner and a priority agent-readiness uplift.

A substitution such as OpenCoven/coven is acceptable only if current repository evidence shows it creates a materially safer or more representative pilot. Record the rationale rather than silently changing scope.

Blockers and prerequisites

• feat(governance): establish the OpenCoven organization control plane #7 must be reviewed and merged.
• The reusable workflow must be referenced by the exact accepted .github commit SHA, never a branch or mutable tag.
• Inspect each target repository's current AGENTS.md, README, ADRs, schemas, tests, CI, release policy, CODEOWNERS, protected paths, and worktree constraints before changing it.
• Repository-local implementation truth outranks the central registry when they conflict; reconcile the registry by reviewed PR rather than forcing a false manifest.

Per-repository implementation

• add or reconcile a concise root AGENTS.md router;
• add agent/manifest.json conforming to opencoven.agent-repo/v1;
• declare canonical domains and explicit non-ownership boundaries;
• classify R3/R4 paths, generated paths, network use, secrets, and side effects;
• expose deterministic ./scripts/agent-bootstrap, ./scripts/agent-check fast, and ./scripts/agent-check full adapters without replacing better native verification;
• consume .github/.github/workflows/reusable-agent-readiness.yml at the immutable accepted policy SHA;
• add repository-specific negative tests and immutable producer/consumer canaries where the contract boundary requires them;
• provide a machine-readable evidence packet with exact commands, revisions, environment, migration, rollback, unsupported checks, and uncertainty.

Authority boundary

A manifest, workflow, task, issue, prompt, model output, or green check cannot grant familiar identity, principal, Threads, Psyche, Coven, release, publication, or repository-administration authority. R4 changes must preserve operation-specific authorization, exact-state binding, and fail-closed behavior.

Acceptance criteria

• Both pilot repositories have inspected and reviewed repository-local plans.
• Both manifests match current implementation evidence and the public registry.
• Both clean-clone bootstrap and fast checks pass without ambient credentials.
• Both reusable workflow references use the exact accepted 40-character .github commit SHA.
• Familiar Contract proves malformed/unauthorized identity inputs fail closed without overstating runtime conformance.
• Psyche proves caller/task text cannot create authority and orchestration objects remain distinct from identity/runtime state.
• Packed-artifact, real-daemon, or downstream evidence is used wherever source-only checks would hide the boundary.
• Central registry status moves from planned to enforced only after the repository-local checks are green on the protected branch.
• Failures, unsupported platforms, stale evidence, and degraded states are represented truthfully.
• No existing security, release, ownership, or conformance gate is weakened.

Completion evidence

Link exact PRs, accepted commits, workflow runs, manifests, native checks, cross-repository canaries, and any unresolved exceptions. Do not close on a planning document alone.