feat: complete remaining Conductor work

SKILL.md

@@ -82,6 +82,9 @@ the material:
   [governance.md](references/governance.md).
 - Claims with contradictions or reasoning failures: read
   [reasoning-failures.md](references/reasoning-failures.md).
+- FOI-O final manuscript editing after semantic and citation review: read
+  [foio-editorial.md](references/foio-editorial.md), plus the academic and
+  governance references it requires.
 
 Load more than one content reference only when the material genuinely crosses
 domains. Reasoning guidance supplements a content reference; it does not replace
@@ -99,6 +102,7 @@ Read these files for the full pattern catalog, examples, and remediation guidanc
 - [Academic and research prose](references/academic.md)
 - [Policy, governance, and compliance prose](references/governance.md)
 - [Reasoning failures and self-contradictions](references/reasoning-failures.md)
+- [FOI-O final editorial workflow and evidence receipt](references/foio-editorial.md)
 
 Apply the relevant patterns from the selected reference files. This root skill
 keeps workflow, severity tiers, and detection guardrails; the references hold

SKILL_PROFESSIONAL.md

@@ -17,14 +17,16 @@ Use this variant for technical, policy, academic, and client-facing prose. Keep
 - [Academic module](references/academic.md) — papers and formal research
 - [Governance module](references/governance.md) — policy and compliance
 - [Reasoning module](references/reasoning-failures.md) — reasoning failures and contradictions
+- [FOI-O editorial workflow](references/foio-editorial.md) — final manuscript pass and receipt
 
 ## ROUTING LOGIC
 
 1. Analyze input context:
    * Code or technical docs -> Core + Technical
    * Papers, essays, or formal research -> Core + Academic
    * Policy, risk, or compliance writing -> Core + Governance
-   * Reasoning failures or self-contradictions -> Core + Reasoning
+    * Reasoning failures or self-contradictions -> Core + Reasoning
+    * FOI-O final manuscript editing -> Core + Academic + Governance + FOI-O
    * Otherwise -> Core only
 
 2. Open the linked reference files for the selected modules and apply their patterns.
@@ -79,4 +81,4 @@ Vary sentence rhythm with short and long lines. Use specific details instead of
 
 For severity tiers and false-positive guidance, read [Core patterns](references/core-patterns.md) (sections **SEVERITY CLASSIFICATION** and **DETECTION GUIDANCE**).
 
-Available reference files: core-patterns.md, technical.md, academic.md, governance.md, reasoning-failures.md.
+Available reference files: core-patterns.md, technical.md, academic.md, governance.md, reasoning-failures.md, foio-editorial.md.

conductor/github-mapping.json

@@ -1,28 +1,112 @@
 {
   "schema_version": 1,
-  "generated_at": "2026-08-01T05:57:41.665Z",
+  "generated_at": "2026-08-01T08:00:00.000Z",
   "repository": "edithatogo/authentext",
   "project": {
     "number": 36,
     "node_id": "PVT_kwHOAOYc4M4Be-dE",
     "url": "https://github.com/users/edithatogo/projects/36"
   },
   "counts": {
-    "tracks": 31,
-    "phases": 128,
-    "repository_issues": 168,
-    "open_tracks": 0,
-    "historical_tracks": 31
+    "tracks": 33,
+    "phases": 132,
+    "repository_issues": 174,
+    "open_tracks": 1,
+    "historical_tracks": 32
   },
   "verification": {
     "verified_at": "2026-08-01",
     "duplicate_track_markers": 0,
     "duplicate_phase_markers": 0,
     "native_parent_child_relationships": "verified",
     "issue_states": "verified",
-    "project_membership": "159/159"
+    "project_membership": "165/165"
   },
   "tracks": [
+    {
+      "track_id": "renovate-codecov-verification_20260801",
+      "title": "Renovate and Codecov Verification",
+      "path": "conductor/tracks/renovate-codecov-verification_20260801",
+      "priority": "P1",
+      "historical": false,
+      "metadata_status": "in_progress",
+      "parent_issue": {
+        "number": 234,
+        "node_id": "I_kwDORAMgA88AAAABLCgAGQ",
+        "url": "https://github.com/edithatogo/authentext/issues/234",
+        "state": "open"
+      },
+      "phases": [
+        {
+          "phase_id": "renovate-codecov-verification_20260801.phase1",
+          "number": 1,
+          "title": "Repository integration",
+          "source": "conductor/tracks/renovate-codecov-verification_20260801/plan.md",
+          "reconstructed": false,
+          "issue": {
+            "number": 235,
+            "node_id": "I_kwDORAMgA88AAAABLCgAqQ",
+            "url": "https://github.com/edithatogo/authentext/issues/235",
+            "state": "closed"
+          }
+        },
+        {
+          "phase_id": "renovate-codecov-verification_20260801.phase2",
+          "number": 2,
+          "title": "Hosted verification",
+          "source": "conductor/tracks/renovate-codecov-verification_20260801/plan.md",
+          "reconstructed": false,
+          "issue": {
+            "number": 236,
+            "node_id": "I_kwDORAMgA88AAAABLCgBLw",
+            "url": "https://github.com/edithatogo/authentext/issues/236",
+            "state": "open"
+          }
+        }
+      ]
+    },
+    {
+      "track_id": "foio-editorial-workflow_20260801",
+      "title": "FOI-O Editorial Workflow",
+      "path": "conductor/tracks/archive/foio-editorial-workflow_20260801",
+      "priority": "P1",
+      "historical": true,
+      "metadata_status": "archived",
+      "parent_issue": {
+        "number": 237,
+        "node_id": "I_kwDORAMgA88AAAABLChMvg",
+        "url": "https://github.com/edithatogo/authentext/issues/237",
+        "state": "closed"
+      },
+      "phases": [
+        {
+          "phase_id": "foio-editorial-workflow_20260801.phase1",
+          "number": 1,
+          "title": "Portable workflow contract",
+          "source": "conductor/tracks/archive/foio-editorial-workflow_20260801/plan.md",
+          "reconstructed": false,
+          "issue": {
+            "number": 238,
+            "node_id": "I_kwDORAMgA88AAAABLChNqA",
+            "url": "https://github.com/edithatogo/authentext/issues/238",
+            "state": "closed"
+          }
+        },
+        {
+          "phase_id": "foio-editorial-workflow_20260801.phase2",
+          "number": 2,
+          "title": "Hosted reconciliation and closeout",
+          "source": "conductor/tracks/archive/foio-editorial-workflow_20260801/plan.md",
+          "reconstructed": false,
+          "issue": {
+            "number": 239,
+            "node_id": "I_kwDORAMgA88AAAABLChOpw",
+            "url": "https://github.com/edithatogo/authentext/issues/239",
+            "state": "closed"
+          }
+        }
+      ]
+    },
     {
       "track_id": "post-release-security-quality-frontier_20260801",
       "title": "Post-Release Security and Quality Frontier",

conductor/index.md

@@ -20,6 +20,7 @@ than guessing paths.
 - [Roadmap](./roadmap.md)
 - [Tracks Registry](./tracks.md)
 - [Active Renovate and Codecov Track](./tracks/renovate-codecov-verification_20260801/index.md)
+- [Archived FOI-O Editorial Workflow Track](./tracks/archive/foio-editorial-workflow_20260801/index.md)
 - [Archived Security and Quality Track](./tracks/archive/post-release-security-quality-frontier_20260801/index.md)
 - [Released Bleeding-Edge Track](./tracks/archive/bleeding-edge-agent-skills-conductor_20260731/index.md)
 - [GitHub Issue Mapping](./github-mapping.json)

conductor/roadmap.md

@@ -7,6 +7,18 @@ Local Conductor files define scope and evidence. GitHub issues, subissues, and
 Project fields mirror that state; they do not establish implementation,
 publication, or release.
 
+## Active: hosted dependency closeout
+
+- Verify Renovate hosted access while retaining Dependabot until health is
+  evidenced; retain Codecov OIDC alongside repository-owned coverage gates.
+
+## Completed: FOI-O editorial workflow
+
+- Implement the FOI-O final editorial workflow with deterministic preservation
+  checks and evidence receipts.
+- Keep manuscript acceptance, submission, and publication as explicit human
+  gates outside repository completion.
+
 ## Completed: post-release security and quality frontier
 
 - Move maintained automation from EOL Node 20 to Node 24 LTS.

conductor/tracks.md

@@ -29,6 +29,12 @@ This file tracks all major tracks for the project. Each track has its own detail
 
 **Latest archives:**
 
+- [x] **foio-editorial-workflow_20260801** - Portable, fail-closed FOI-O final
+      editorial workflow with privacy-conscious evidence receipts and retained
+      human acceptance/publication gates. See
+      [`tracks/archive/foio-editorial-workflow_20260801/`](./tracks/archive/foio-editorial-workflow_20260801/index.md)
+      and GitHub [#237](https://github.com/edithatogo/authentext/issues/237).
+
 - [x] **post-release-security-quality-frontier_20260801** - Node 24 and audited
       dependencies, native coverage evidence, solo-maintainer safeguards, and
       reconciled hosted/backlog state. See

conductor/tracks/archive/foio-editorial-workflow_20260801/design.md

@@ -0,0 +1,22 @@
+# Design: FOI-O Editorial Workflow
+
+```mermaid
+flowchart TD
+    A["Editorial intake"] --> B["Capture protected material"]
+    B --> C["Restrained Authentext edit"]
+    C --> D["Deterministic preservation checks"]
+    D -->|"pass"| E["Write evidence receipt"]
+    D -->|"fail"| F["Reject output and report drift"]
+    E --> G["Human editorial acceptance gate"]
+    G -->|"approved externally"| H["Separate submission or publication process"]
+    G -->|"not approved"| I["Retain as unpublished draft"]
+```
+
+## Components
+
+- Canonical academic guidance describes when and how the workflow is invoked.
+- A repository script compares protected semantic tokens between source and
+  edited text and emits a deterministic JSON receipt.
+- Tests exercise valid preservation and each fail-closed boundary.
+- Conductor and GitHub retain implementation evidence; they do not confer
+  editorial or publication approval.

conductor/tracks/archive/foio-editorial-workflow_20260801/index.md

@@ -0,0 +1,7 @@
+# FOI-O Editorial Workflow
+
+- [Specification](./spec.md)
+- [MoSCoW requirements](./requirements.md)
+- [Design](./design.md)
+- [Plan](./plan.md)
+- [Metadata](./metadata.json)

conductor/tracks/archive/foio-editorial-workflow_20260801/metadata.json

@@ -0,0 +1,10 @@
+{
+  "track_id": "foio-editorial-workflow_20260801",
+  "title": "FOI-O Editorial Workflow",
+  "type": "feature",
+  "priority": "P1",
+  "status": "archived",
+  "created_at": "2026-08-01",
+  "updated_at": "2026-08-01",
+  "current_phase": "Complete"
+}

conductor/tracks/archive/foio-editorial-workflow_20260801/plan.md

@@ -0,0 +1,17 @@
+# Plan: FOI-O Editorial Workflow
+
+## Phase 1: Portable workflow contract [checkpoint: 49dfe89]
+
+- [x] Add failing tests for protected-material validation and evidence receipts.
+- [x] Implement the portable validator and receipt contract.
+- [x] Integrate the workflow into canonical academic guidance and regenerate.
+- [x] Phase verification and checkpoint per `conductor/workflow.md`.
+
+## Phase 2: Hosted reconciliation and closeout [checkpoint: e3bc8b6]
+
+- [x] Run sync, validation, lint, coverage, and full tests.
+- [x] Mirror the track and phases as a GitHub issue hierarchy in Project 36.
+- [x] Reconcile and close issue #61 with repository evidence while preserving
+      the external editorial-acceptance and publication gates.
+- [x] Formal review and governed archive.
+- [x] Phase verification and checkpoint per `conductor/workflow.md`.

conductor/tracks/archive/foio-editorial-workflow_20260801/requirements.md

@@ -0,0 +1,34 @@
+# Requirements: FOI-O Editorial Workflow
+
+## Must
+
+- **FOIO-MUST-001:** Preserve citations, URLs, numerical meaning, epistemic
+  qualifiers, legal boundaries, and authorial stance.
+- **FOIO-MUST-002:** Provide deterministic verification with a failing result
+  for protected-material drift.
+- **FOIO-MUST-003:** Produce a portable evidence receipt containing tool,
+  skill/profile, version, input/output hashes, checks, and human-gate status.
+- **FOIO-MUST-004:** Keep editorial acceptance, submission, and publication as
+  explicit human decisions.
+- **FOIO-MUST-005:** Integrate through canonical source fragments and generated
+  artifacts.
+
+## Should
+
+- **FOIO-SHOULD-001:** Supply a reusable example receipt and workflow checklist.
+- **FOIO-SHOULD-002:** Cover success and failure paths in automated tests.
+- **FOIO-SHOULD-003:** Link repository evidence to the Conductor and GitHub
+  issue hierarchy.
+
+## Could
+
+- **FOIO-COULD-001:** Support additional receipt consumers through the stable
+  JSON contract.
+- **FOIO-COULD-002:** Add domain-specific protected-token classes in later
+  tracks.
+
+## Won't this track
+
+- **FOIO-WONT-001:** Publish, submit, or certify an FOI-O manuscript.
+- **FOIO-WONT-002:** Infer factual or legal correctness from token preservation.
+- **FOIO-WONT-003:** Depend on host-only metadata or experimental APIs.

conductor/tracks/archive/foio-editorial-workflow_20260801/spec.md

@@ -0,0 +1,41 @@
+# Specification: FOI-O Editorial Workflow
+
+## Outcome
+
+Provide a portable Authentext workflow for final editorial processing of an
+FOI-O manuscript after semantic and citation integrity have been established,
+without claiming editorial acceptance or publishing the manuscript.
+
+## Functional requirements
+
+- Define a discoverable workflow for intake, protected-literal capture,
+  restrained editing, verification, and evidence recording.
+- Preserve citations, URLs, numerical meaning, epistemic qualifiers, legal
+  boundaries, and authorial stance.
+- Record tool, skill, prompt/profile, version, and verification evidence in a
+  portable machine-readable receipt.
+- Fail closed when protected material changes or required evidence is absent.
+- Keep final editorial acceptance, submission, and publication as human gates.
+
+## Non-functional requirements
+
+- Keep the portable Agent Skill independent of a particular host.
+- Generate maintained root artifacts from canonical `src/` fragments.
+- Add deterministic tests for positive and failure paths.
+- Avoid authorship-detection or publication-certification claims.
+
+## Acceptance criteria
+
+- The workflow is discoverable from the canonical skill and academic guidance.
+- Automated validation detects changed citations, URLs, numbers, qualifiers,
+  or legal boundary statements.
+- A versioned evidence receipt schema and example are documented and tested.
+- Full sync, validation, lint, coverage, and tests pass.
+- GitHub issue #61 is linked to this track and closed only after repository
+  acceptance is evidenced; publication approval remains external.
+
+## Out of scope
+
+- Submitting or publishing a manuscript.
+- Certifying factual, legal, semantic, or citation correctness.
+- Replacing domain, legal, author, or journal editorial review.

conductor/tracks/renovate-codecov-verification_20260801/evidence.md

@@ -0,0 +1,49 @@
+# Hosted Verification Evidence
+
+Verified on 2026-08-01 against `edithatogo/authentext`.
+
+## Repository and Codecov
+
+- Pull request [#233](https://github.com/edithatogo/authentext/pull/233) merged
+  commit `780d07ff953bbe6b6d323eaa4428fb71edab5860` after the complete pull-request
+  matrix passed: CI, CodeQL, workflow lint, behavioral evaluation, portable
+  specification validation, GitHub publication preview, and skill validation on
+  Ubuntu, macOS, and Windows.
+- The PR CI run
+  [30687665180](https://github.com/edithatogo/authentext/actions/runs/30687665180)
+  ran the pinned `codecov/codecov-action` commit with `use_oidc: true`, found
+  `coverage/lcov.info`, acquired the OIDC upload token, and queued the upload
+  successfully. The hosted `codecov/patch` check completed successfully.
+- The default-branch CI run
+  [30687786382](https://github.com/edithatogo/authentext/actions/runs/30687786382)
+  repeated the OIDC upload for merge commit `780d07f`; Codecov accepted 23,377
+  bytes and returned the commit result URL.
+- Native LCOV/JSON evidence, local thresholds, and the GitHub Actions coverage
+  artifact remain in place.
+
+## Renovate
+
+- `renovate.json` inherits the public
+  [`github>edithatogo/renovate-config`](https://github.com/edithatogo/renovate-config)
+  preset and enables the Dependency Dashboard.
+- A paginated search of all repository issues and pull requests found no item
+  authored by `renovate[bot]` or another Renovate bot identity.
+- The authenticated GitHub CLI token can administer the repository but cannot
+  install or enumerate user-account GitHub App installations. GitHub returned
+  `403` for the user-installations endpoint because it requires a GitHub-App
+  authorized user token. The repository-installation endpoint requires an App
+  JWT and therefore cannot establish the Renovate installation from a normal
+  repository token.
+- Browser-assisted installation was attempted at
+  <https://github.com/apps/renovate/installations/new>, but the available
+  browser-control bridge could not initialize in this session. No installation
+  click or authorization is claimed.
+
+## Remaining gate
+
+The repository owner must install or grant the Renovate GitHub App access to
+`edithatogo/authentext` at
+<https://github.com/apps/renovate/installations/new>. After installation,
+trigger Renovate if offered and verify a Renovate-authored Dependency Dashboard
+or pull request. Until that evidence exists, `.github/dependabot.yml` remains
+the fail-closed update path and this track remains in progress.

conductor/tracks/renovate-codecov-verification_20260801/index.md

@@ -4,4 +4,5 @@
 - [MoSCoW requirements](./requirements.md)
 - [Design](./design.md)
 - [Plan](./plan.md)
+- [Hosted verification evidence](./evidence.md)
 - [Metadata](./metadata.json)