docs: repository code trace + fix the keyless evidence scripts broken by signed-by-default (F1, F1b)

[dsmcewan]

What

Three things, in five commits:

1. docs/repository-code-trace.md — a file:line trace of how the packages actually compose, written as the call-path companion to repository-manifest.json. It covers the package topology, the trust spine (order of checks in validateRecords, fail-closed trust_mode default, HMAC canonical form, council routing, model backends, verdict-on-facts), the build orchestrator and proposal lifecycle (every step, outcome string and closed set), merkle-dag content addressing, the products above the spine, CI, the active authority record, a GitHub lineage section, a build-orchestrator commit lineage, and sixteen findings confirmed against source.

2. Fix for F1 — docs/runs/proposal-lifecycle/run-lifecycle-e2e.mjs had been failing keyless since the gate became signed-by-default in c8f4ebf: both variants were blocked on trust_mode 'signed' but no secret to verify … packet, while the committed summary still said acceptance_ok: true. Rather than downgrade the evidence to advisory mode, the script now mints ephemeral per-run TELOS_SECRET_<SEAT> values when none are set (operator secrets left untouched, nothing written to disk), declares trust_mode: "signed" explicitly, records which seat secrets were ephemeral vs operator-provided, and adds a third unsigned variant that withholds TELOS_SECRET_CODEX and must be blocked at the approval phase, so the signed claim is verified by the run rather than self-reported.

3. Fix for F1b — docs/runs/agentic-teams-situational/run-teams-situational.mjs was a second instance of the same drift: inline dossier with no trust_mode, unsigned mock packets, blocked at approval keyless while its committed run-summary.json still claimed phase: "build", ok: true. Same fix shape (ephemeral seat secrets, explicit trust_mode: "signed", seat-secret provenance in the summary). The regenerated summary is byte-identical across runs.

The fail-closed-proof CI job now runs both proposal-lifecycle evidence scripts and the three keyless agentic-teams scripts (situational, run-teams, run-teams-market), so this class of drift cannot recur silently. docs/runs/ is outside the env-surface contract's scan scope, so the new env writes do not touch that contract.

Other findings worth a look (unchanged by this PR): F2 the CLI gate path never supplies the ledger dir, so lifecycle enforcement is skipped while reported as enforced; F3 authorization is checked once before dispatch and a respec re-plans without a new decision; F4/F5 provenance provider is never bound to the seat and legacy-mode packets have no replay protection; F11 workflows/hestia.js uses an unregistered mythological name; F14 connectors/meta-ads-mcp is outside every oracle; F1a a missing-secret blocker alongside a reparable finding yields revise for one cycle before blocked.

Checklist

• Affected package suites run locally (list them below with results)
• No new dependencies or lockfiles in zero-dependency packages
• No runtime .telos/ artifacts, secrets, .env*, or *.pem files committed
• Hash-pinned/signed artifacts untouched (or regenerated through their own runners, with the regeneration described below) — run-lifecycle-e2e-summary.json and agentic-teams-situational/run-summary.json regenerated by their own scripts (both deterministic); proposal-lifecycle/run-summary.json deliberately not committed because its plan hashes change every run (ephemeral signer keys are pinned into plan_hash)
• If governance records or contracts changed: node docs/institutional-memory/verify-contracts.mjs and node docs/runs/clotho-self-weave/run.mjs --verify-committed both pass

Test results

Node 22.22.2, on the final commit:

• env -u TELOS_SECRET_CLAUDE -u TELOS_SECRET_AGY -u TELOS_SECRET_CODEX node docs/runs/proposal-lifecycle/run-lifecycle-e2e.mjs -> ACCEPTANCE OK (discharged ready, control blocked by UNDISCHARGED_OBLIGATION, unsigned blocked at approval); same with TELOS_SECRET_* set -> ACCEPTANCE OK
• node docs/runs/proposal-lifecycle/run-proposal-lifecycle.mjs -> ACCEPTANCE OK
• env -u TELOS_SECRET_* node docs/runs/agentic-teams-situational/run-teams-situational.mjs -> phase=build ok=true merge_status=ready self_corrected=true; same with secrets set; summary identical across two runs
• node docs/runs/agentic-teams/run-teams.mjs and node docs/runs/agentic-teams-market/run-teams-market.mjs -> merge_status=ready keyless
• node docs/runs/fail-closed-demo/run.mjs -> BLOCKED / HALTED / VERIFIED, ok:true
• cd build-gate && npm test (runs breakout too) -> green; cd merkle-dag && npm test -> green (first commit; no package source changed since)
• node docs/institutional-memory/verify-contracts.mjs -> 313/313 contracts match
• node docs/runs/clotho-self-weave/run.mjs --verify-committed -> ok:true, 4559 trusted records
• node .github/scripts/check-portable-paths.mjs -> 0 violations
• node docs/institutional-memory/iliad/workflow/check-workflow.mjs -> OK
• .github/workflows/ci.yml parses (PyYAML)

🤖 Generated with Claude Code

https://claude.ai/code/session_01JSb8WNmvor3GNapDqUbc4T

[dsmcewan]

CI note: the review check (Claude Code Review workflow) failed, and the failure is not this PR's.

• The job installed the pinned marketplace and plugin fine, then the Claude Code run ended after 1.7 s with is_error: true, num_turns: 1, total_cost_usd: 0, modelUsage: {} — the model was never called. No review findings were produced and no inline comments were buffered.
• This PR adds one Markdown file under docs/ and touches nothing the review workflow depends on.
• The identical signature appears on unrelated dependabot PRs (build(deps): bump actions/deploy-pages from 4.0.5 to 5.0.1 #165, build(deps): bump actions/upload-pages-artifact from 4.0.0 to 5.0.0 #167, build(deps): bump actions/setup-node from 4.4.0 to 7.0.0 #168 on 2026-09-20, runs 286/288/289/292), while sibling runs minutes apart (287/290/291) succeeded. That points at the CLAUDE_CODE_OAUTH_TOKEN subscription auth being intermittently rejected, or the action's SDK session failing to start, rather than anything in a PR.
• No fix exists in the repo to port. If the token has expired, re-minting it with claude setup-token and updating the repo secret is the remedy; that is outside what this PR can do.

Re-running the failed job once to confirm it reproduces; all other checks on this head are green so far.

---

Generated by Claude Code