docs(analysis): decide explainable risk score architecture

[limaronaldo]

Summary

• define an additive, deterministic and explainable risk assessment architecture
• separate internal golden-model validation from opt-in experimental output
• preserve existing policy, public API, renderer and DSSE contracts
• make correlation evidence and honest comparison boundaries explicit release gates

Why

A headline risk number can aid prioritization but also creates false precision and a second apparent enforcement surface. This ADR establishes an internal-first, reversible path with complete contribution reconciliation, explicit model and coverage identities, and a mandatory deferral path if evaluation is not defensible.

Impact

Documentation only. No detector, score, output, policy, fingerprint, baseline, suppression, verdict, exit-status or attestation behavior changes.

Validation

• git diff --check
• consistency review against the current policy, baseline, output and certification pipelines
• full Level 1 architecture council review, including preserved skeptical dissent

[limaronaldo]

Architecture review verdict: PASS — no blocking findings.

Checklist:

• informational score is separate from policy, verdict and exit status
• E.0, E.1 and E.2 remain independent review gates
• exact weights/formula remain subject to E.1 golden evidence
• library policy and CLI baseline boundaries match current code
• public Rust, default renderer and DSSE v1 compatibility are explicit
• model and coverage identities have distinct semantics
• fingerprint deduplication does not overclaim semantic correlation
• skeptical deferral path is preserved if E.1 evidence is weak

The PR is documentation-only and does not authorize score implementation before merge.