docs(governance): plan new-project 0.11.0 adoption

.governance/approval-evidence.schema.json

@@ -0,0 +1,89 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/wellmanifest/new-project/governance/approval-evidence.schema.json",
+  "title": "new-project trusted merge approval evidence",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "source",
+    "repository",
+    "pullRequest",
+    "headSha",
+    "ticket",
+    "actor",
+    "verification"
+  ],
+  "properties": {
+    "schema": { "const": "new-project.approval-evidence/v1" },
+    "source": {
+      "enum": ["github-review", "github-app-review", "signed-attestation"]
+    },
+    "repository": {
+      "type": "string",
+      "pattern": "^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$"
+    },
+    "pullRequest": { "type": "integer", "minimum": 1 },
+    "headSha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "ticket": { "type": "string", "pattern": "^ticket-[0-9]{3}$" },
+    "actor": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["login", "type"],
+      "properties": {
+        "login": { "type": "string", "minLength": 1 },
+        "type": { "enum": ["User", "Bot", "Workflow"] }
+      }
+    },
+    "verification": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["method", "verified"],
+      "properties": {
+        "method": {
+          "enum": ["github-api-allowlist", "github-attestation", "sigstore"]
+        },
+        "verified": { "const": true },
+        "issuer": { "type": "string", "minLength": 1 },
+        "predicateType": { "type": "string", "minLength": 1 }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": { "properties": { "source": { "const": "github-review" } } },
+      "then": {
+        "properties": {
+          "actor": { "properties": { "type": { "const": "User" } } },
+          "verification": {
+            "properties": { "method": { "const": "github-api-allowlist" } }
+          }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "source": { "const": "github-app-review" } } },
+      "then": {
+        "properties": {
+          "actor": { "properties": { "type": { "const": "Bot" } } },
+          "verification": {
+            "properties": { "method": { "const": "github-api-allowlist" } }
+          }
+        }
+      }
+    },
+    {
+      "if": { "properties": { "source": { "const": "signed-attestation" } } },
+      "then": {
+        "properties": {
+          "verification": {
+            "required": ["method", "verified", "issuer", "predicateType"],
+            "properties": {
+              "method": { "enum": ["github-attestation", "sigstore"] }
+            }
+          }
+        }
+      }
+    }
+  ]
+}

.governance/diagnostics.json

@@ -16,6 +16,9 @@
     "GOV-INTENT-003": "Ticket intent was not committed before the first implementation commit.",
     "GOV-APPROVAL-001": "Implementation lacks approval from a trusted external source.",
     "GOV-APPROVAL-002": "Approval refers to a different ticket.",
+    "GOV-APPROVAL-003": "Approval evidence is missing, repository-controlled or structurally invalid.",
+    "GOV-APPROVAL-004": "Approval evidence is bound to another repository, pull request or commit.",
+    "GOV-APPROVAL-005": "Approval actor or verification method is not trusted for the claimed source.",
     "GOV-SCOPE-001": "A changed implementation path is outside the approved intent scope.",
     "GOV-WORKSTREAM-001": "An active v2 ticket declares a missing or unknown workstream.",
     "GOV-WORKSTREAM-002": "A workstream exceeds its active-ticket limit.",
@@ -25,6 +28,11 @@
     "GOV-DEPENDENCY-002": "An active ticket depends on a ticket that is missing or not closed.",
     "GOV-CONFLICT-001": "Tickets declared as conflicting are active at the same time.",
     "GOV-INTEGRATION-001": "A shared contract path lacks valid routing through an integration ticket.",
+    "GOV-DELIVERY-001": "The implementation slice lacks or exceeds its approved <=30-minute delivery contract.",
+    "GOV-DELIVERY-002": "The implementation slice reached its pre-stop checkpoint.",
+    "GOV-ARCHITECTURE-001": "Architecture ownership, UI/data impact or component mapping is unresolved.",
+    "GOV-BASE-001": "The target branch or base SHA differs from the approved delivery contract.",
+    "GOV-BUDGET-001": "The actual implementation diff exceeds its approved file, component, interface or dependency budget.",
     "GOV-OWNER-001": "An untrusted actor changed a human-owned participant file.",
     "GOV-DOCKER-001": "The required Docker runtime declaration is incomplete.",
     "GOV-STACK-001": "The declared technology stack lacks its required project marker.",