docs: AAIF authority-at-dispatch reviewer packet (prod 17f1763, 8/8) + SDK 0.1.4 alignment

[chrisjleal]

What

One clean docs change from current main that (a) adds the AAIF authority-at-dispatch reviewer packet for the current production epoch and (b) aligns the SDK docs to the published @proofable/sdk@0.1.4.

Evidence packet — public/evidence/aaif/authority-at-dispatch/2026-10-05/

• README.md, manifest.json, trace.jsonl, SHA256SUMS
• Production revision 17f17630166b1018804a5fca5bc485b6812580aa
• Execution principal: an ordinary non-admin Pro review tenant (admin:false), agent proofable-authority-review, every job pinning an explicit delegationQHash
• Deterministic review: 8/8 PASS; receipt references are included as private-visibility qHashes only (no raw scope lists, prompts, keys, or job replies)
• Supersedes the retired five-case 2026-10-05 packet (removed)

SDK 0.1.4 alignment

• mcp/guarded-action.mdx — delegated mounts with an empty/missing allowedActions list grant nothing; decision-order step 3 rewritten; mount-as-snapshot and revocation-freshness limits stated
• changelog.mdx — v0.1.4 entry
• scripts/validate-doc-copy.mjs — a named audience (for teams, for developers, …) now counts as reader orientation, matching the existing heuristic rule and the protocol gate

Verification

• npm run lint:markdown — 0 errors
• npm run lint:routes — valid
• npm run lint:copy — valid
• npm run lint:openapi — valid

Notes

This is bounded implementation evidence, not AAIF certification, AARM conformance, or an AgentGovBench leaderboard result. The denial cases intentionally produce no signed decision record at this revision; that is a named AARM R5 product gap tracked in _workspace internal/STANDARDS-CONFORMANCE.md.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[chrisjleal]

Superseded. The reviewer packet and the SDK 0.1.4 alignment this PR carried already landed on main as e81885d (packet) and the surrounding docs commits; the only content unique to this branch is the /mcp/oauth auth-first lane, which the protocol single-endpoint contract retired (protocol 25fa293f9) and which main deliberately does not ship. Closing rather than merging a reverted lane back in. The reviewer packet is now served from main at public/evidence/aaif/authority-at-dispatch/2026-10-05/.