docs: split v5 remediation into six governed children

[ohjonathan]

Summary

This docs-only governance PR completes the parent v5 remediation charter at Pre-A and transfers the work into six independently governed, user-facing child deliverables.

The parent records the exact terminal Template 16 disposition Split into multiple proposals. It does not enter Phase A-E and grants no implementation authority.

What this PR contains

• a read-only live audit confirming [P1-containing] v5.0.1 patch-safe sweep + v6.0.0 path compatibility removal #149, 🗺️ Audit remediation tracker (from PR #145) #158, Machine-readable audit registry and external parity gate #165, and [Feature] Content-addressed activation receipts and portable AGENTS/map freshness #173-[Feature] Workspace-defined document vocabularies and governed enum-repair mappings #178 remain open and still require tracked work;
• the parent proposal/tracker closeout and updated six-child cardinality;
• proposal, tracker, and manifest scaffolds for:
  1. project-ontos-v5-remediation-board-hygiene
  2. project-ontos-issue-165-audit-registry
  3. project-ontos-v5-0-3-dependency-resolver
  4. project-ontos-v5-0-3-log-paths
  5. project-ontos-v5-0-3-built-in-status-alias
  6. project-ontos-v5-0-3-required-version-preflight
• regenerated Ontos context and agent instructions for the 248-document graph.

All six children are user_facing: true, require Product review in B.1, B.2, and D.2, and remain blocked before Phase A until their own non-author Template 16 verdict says exactly Proceed to Phase A.

Release and issue custody

• v5.0.3 owns the dependency resolver, shared log-path contract plus the coupled [P1-containing] v5.0.1 patch-safe sweep + v6.0.0 path compatibility removal #149 wrapper slice, the built-in status alias, and the required-version downgrade preflight.
• Machine-readable audit registry and external parity gate #165 retains exactly 91 Fable records plus 9 R2 records, with its curated IDs kept distinct from [Feature] Stable finding IDs, Git diffing, and no-new-debt validation baselines #174 runtime finding keys.
• [Feature] Workspace-defined document vocabularies and governed enum-repair mappings #178 remains open after both v5.0.3 slices; complete workspace vocabulary behavior remains a v5.1 obligation.
• v6.0.0 remains limited to the exact eleven previously promised deprecated public path removals.
• This PR performs no live GitHub issue mutation and changes no product code, tests, packaging, or release artifacts.

GLM review

GLM was used for both governance decisions:

• canonical parent Template 16 verdict: Split into multiple proposals;
• supplemental six-child governance review: Approve.

The supplemental review is preserved byte-for-byte with its prompt, redacted captures, dispatch result, and route attestation. It is recommendation-only evidence, not a strict-P3 receipt or merge/phase authority.

The Codex-authored validation sidecar:

• records eight factual/citation corrections without rewriting the hash-bound GLM artifact;
• makes clear that GLM reviewed commit 41f0893, not the final post-review evidence/map commits;
• identifies the two conservative post-review B.2 tracker corrections;
• records the OpenCode exact-path worker_file versus R30-B verifier mismatch and entropy-only false positives;
• confirms zero non-entropy secret findings.

Validation

• scripts/llm-dev doctor
• manifest conformance for the parent and all six children
• review-seat checks for the parent and all six children
• docs-only changed-path scope gate: 41 paths
• clean scoped working tree
• Ontos full link check: 248 loaded documents, 0 load warnings, duplicate IDs, broken references, broken frontmatter/body links, or orphans
• cardinalities: 4 releases, 9 audited issues, 11 v6 removals, 6 child triples
• GLM artifact shape: verdict_shaped / Approve
• prompt, raw, stderr, artifact, result, and attestation hashes reconciled
• secret-pattern scan clean
• PR diff check clean outside the byte-preserved redacted GLM stderr capture, whose original trailing whitespace is retained to keep its recorded SHA-256 truthful

Review focus

1. Confirm the six custody boundaries are independently actionable and do not absorb sibling scope.
2. Confirm the required-version preflight is an explicit v5.0.3 user-facing child while full [Feature] Workspace-defined document vocabularies and governed enum-repair mappings #178 vocabulary delivery remains in v5.1.
3. Confirm the parent terminates at Pre-A and cannot be read as implementation authorization.

[ohjonathan]

Falsification review — PR #180

Method. Rather than read for style, I took each falsifiable assertion in the PR description and tried to disprove it against ground truth: the PR-head tree (5868864), the repo's own tooling re-run in an isolated worktree, recomputed SHA-256s, and live gh issue state. 22 claims were each run through two independent adversarial passes, plus three critics (completeness, internal-contradiction, conformance). This was an AI-assisted review; findings are cited to file:line so you can check them.

Headline: the description's checkable factual claims hold up — I could not falsify a single one of the 22, and every validation gate the PR cites reproduces clean. That is unusually good. The value below is in what the claims don't say: the governance authority is self-attested, and the hash-bound GLM record ships with known-but-uncorrected internal errors.

---

✅ Claims that survived falsification (reproduced, not taken on trust)

Claim	Ground truth
docs-only, "41 paths", no product/tests/packaging/release code	git diff --name-only bd04620..HEAD = 41, all under docs/, manifests/, or AGENTS.md/Ontos_Context_Map.md; 0 leaks
"all hashes reconciled", artifact byte-for-byte	Recomputed: artifact fa64970d96a5… (matches all 4 recorded refs), prompt a418c255, raw 28b975ba, stderr 02e56d27, probe c0308c32 — all match
stderr trailing whitespace retained to keep SHA truthful	13 trailing-WS lines present; stderr_hash matches
"248 loaded documents, 0 load warnings/dupes/broken refs/orphans"	ontos link-check: documents_loaded: 248, all zero, exit 0
"manifest conformance + review-seat checks parent+6", "doctor"	Re-ran in worktree: ontos doctor 10 passed/0 failed, ontos verify --all exit 0, scripts/llm-dev verify 4/4 each for parent + 6 children, review-seats --check exit 0 on all 7
live audit "#149,#158,#165,#173-#178 remain open"	All 9 OPEN live; recorded titles/labels/milestones/update-times match gh (e.g. #149 2026-07-14 14:36 = live 14:36:15Z)
parent verdict "Split into multiple proposals", terminates Pre-A	pre-a-proposal-verdict.md:29,188 verbatim; no Phase-A entry / implementation authority
6 child triples, all user_facing: true, Product seat at B.1/B.2/D.2	All 6 proposal+tracker+manifest present; user_facing: true ×6; 3 Product seats each
"eleven" v6 removals; #165 "91 Fable + 9 R2", distinct from #174	Internally consistent (proposal §18.1 "count as eleven"; #165 proposal:78,98,231 "neither aliases nor successors")
"eight factual/citation corrections"; "zero non-entropy secret findings"	Exactly 8 fact_check_corrections; secret_scan all 0, independent scan found no credentials
cardinalities 4/9/11/6; GLM "verdict_shaped/Approve"; reviewed 41f0893	Each verified against gates; reviewed_commit = 41f08938… (commit 3/6; commits 4–6 are provenance)

---

🔶 What the falsification surfaced (the claims are true, but incomplete / self-attested)

1. [MAJOR — caveat] The governance authority is provenance-by-self-attestation, not independently verifiable.
Every artifact substantiating GLM's "Approve" and "Split into multiple proposals" verdicts — the review, dispatch-intent/result, raw/stderr captures, route-attestation, and recorded hashes — is author-produced within this PR. The SHA-256 chain proves the artifact is internally consistent and unaltered after recording; it does not prove an external GLM invocation actually returned this content. This is inherent to the setup and worth stating plainly: the merge rests on trusting the author's capture, not on a re-runnable external check.

2. [MAJOR] The hash-bound GLM artifact ships with real internal errors — disclosed in the sidecar, but not corrected in-place. The primary record a reader opens (phase-0-glm-governance-review.md) still contains all of these byte-for-byte; only a separate sidecar footnotes them away:

• PR-P-1/PR-P-3 inversion: :251 says "PR-P-1 … was honestly downgraded from static-inspection" — incoherent (static-inspection is the lowest tier, nothing to downgrade from) and inverted. Ground truth: pre-a-proposal-verdict.md has PR-P-1 = static-inspection, PR-P-3 = direct-run; the same review file at :391 correctly attributes the downgrade to PR-P-3. Self-flagged at validation.yaml:114-120 (round-1-evidence-label).

• Miscited enforcing gate + invented subsection: :141,:152 say the 91+9 invariant / namespace rule is checked by G-cardinality-1 at manifest "lines 68-73" and attributes text to "§8.8". Ground truth: lines 67-73 are the informational cardinality_assertions: block; the actual id: G-cardinality-1 gate is at manifest:204, and there is no §8.8 (only ## 8. at proposal:218). Self-flagged at validation.yaml:102-107.

• Misattributed [Feature] Workspace-defined document vocabularies and governed enum-repair mappings #178 wording: :217-220 sources "[Feature] Workspace-defined document vocabularies and governed enum-repair mappings #178 stays open" to child trackers that contain no #178 string; the quote actually lives in board-hygiene-proposal.md:211. Self-flagged at validation.yaml:108-113.

• Fabricated count: :55 asserts the verdict "states 17 times that the parent ends at Pre-A"; the sidecar (repeated-pre-a-language) retracts it as "not supported by a recorded cardinality check."

  These are exactly why the 8-item sidecar exists — but "the GLM review is accurate" is not a safe reading. "The GLM review has 8 known defects, disclosed but preserved uncorrected in the certified record" is.

3. [MAJOR — robustness] The "six independently governed / parallel children" framing understates real asymmetries. Two of the six diverge structurally (all gate-passing, but not symmetric):

• Verification diversity: built-in-status-alias and required-version-preflight declare D.5 verifiers claude-opus + claude-sonnet + gemini (manifests …alias.yaml:127-129, …preflight.yaml:129-131) — two are Anthropic sibling models and there is no GLM verifier seat; the other four carry claude + gemini + glm. The framework counts sibling variants as distinct families, but playbook.md:928 warns "Do not describe same-provider variants as provider diversity." These same two children also omit the require_lifecycle_dispatch_bundles/strict_p3 fields and use author self-consolidation (fast-path), while gate depth (9 vs 6) and deliverable_type also vary. All legal; worth a one-line confirmation each divergence is deliberate. (These are scaffolds — declared intent, not executed evidence.)

4. [MINOR] The description omits a fourth release train. "4 releases" is correct, but the prose only names v5.0.3, v5.1, and v6.0.0 — it never mentions v5.2.0 (proposal:46,480, §15–17), which owns #177/#174/#175. A reader would infer three releases.

5. [MINOR] The disclosed "post-review delta" under-enumerates. validation.yaml:127-136 lists exactly two tracker paths changed after the GLM-reviewed commit, but 41f0893..HEAD also regenerated AGENTS.md and Ontos_Context_Map.md (the 248-doc graph GLM never saw) plus the whole GLM capture set. The material governance change (B.2 → mandatory) is disclosed; the generated-file regeneration is not named.

---

⚪ Non-findings (things that look alarming but aren't PR defects)

• scripts/llm-dev gate-preflight … G-branch-1 exits 1 in my worktree — a detached-HEAD artifact (git branch --points-at 5868864 = the PR branch), not a content defect.
• verify-live-docs exits 1 on a CHANGELOG heading — pre-existing; CHANGELOG.md is unchanged by this PR.
• ontos doctor agents_staleness/git_hooks warnings — heuristic/local-env, non-blocking.

---

Bottom line

No factual claim in the description was falsifiable, and the validation pipeline reproduces end-to-end — genuinely rigorous work. This is docs-only and terminates at Pre-A, so nothing here is a merge blocker on its own. Before merge I'd ask the author to weigh two things: (a) the governance verdicts are self-attested, not independently authenticatable from repo state; and (b) the certified GLM record ships four disclosed-but-uncorrected internal errors — consider whether the sidecar footnote is sufficient, or whether the primary artifact should carry inline [corrected: …] markers so a future reader of the hash-bound record isn't misled. The six-child asymmetries (#3) and the v5.2.0 omission (#4) are worth a sentence of confirmation but don't block.

_{Scope: bd04620..5868864, 41 files. Claims re-verified against the PR-head worktree with the repo's own tooling; gh for live issue state.}