spec(proposal): Phase 5 — approval semantics over the Phase-2 Ward (threads-uqx)

[BunsDev]

Summary

Records the provisional Phase 5 approval-semantics design over the Phase-2 Ward.
Val opened implementation on the recorded defaults; independent Nova attestation
and final Val freeze remain explicit human gates.

Authority constraints

• RFC-0001 and frozen Phase 0 remain upstream.
• Protected-surface proposals reject at Gates 1, 2, and 4.
• Principal-authorized protected updates use a separate audited authority path.
• Channel remains the load/enforcement axis; ApprovalPath is an orthogonal
  promotion ceremony.
• Veto windows are delayed-apply only and revalidate evidence at deadline.
• Deterministic predicates are authoritative; descriptors and probes cannot
  authorize promotion.
• Commit trailers, agent statements, and authorship claims cannot satisfy Nova
  or Val gates.

Remaining freeze gates

• threads-uqx.2: merge familiar-contract PR RFC-0001 §5.5: add S_p(F) ∈ S_p(F) as explicit closure precondition (Cody soundness flag) #3 for closure and provenance.
• threads-uqx.12: align RFC/schema approval-tier declarations with typed
  daemon semantics.
• threads-uqx.13: create an authorized, sanitized, reproducible v0.1 migration
  fixture.
• threads-uqx.8: complete implementation and migration fidelity.
• threads-uqx.7: extend the Cave contract after daemon read models exist.
• threads-uqx.9: independently attributable Nova coherence sign-off.
• threads-uqx.10: direct Val freeze or rejection.

Review evidence

Fresh-context authority review identified four blocking defects. Commit
7eb8522 fixes all four and a second fresh-context review reported no
significant issues. The Beads graph is acyclic.

[BunsDev]

Independent coherence review (fresh-context, commissioned by coordinator session; reviewed branch tip 3fe72ca) — NEEDS-REVISION, record-level. Five findings before/alongside merge:

HIGH — decision #1 annotation contradicts frozen Phase-0. "ApprovalPath is authoritative; Channel is a derived load descriptor. Never gate on Channel" — but frozen PHASE-0 makes Channel a first-class enforcement axis: §2.1 (every gate check = 'does thread T hold under channel C'), §5 (unknown channel → Reject), §3.3 (C7 requires SerializationMarker under Channel::Serialization; two-compaction is channel-keyed). Taken literally the rule makes C7 unimplementable, and it misbinds the Phase-0 term descriptor (§2.2) onto Channel (§2.5 violation). Rescope to: "never derive ApprovalPath from Channel" — the underlying decision (classification independence) is sound. Urgent because uqx.3–.5 are already committed on feat/phase-5-uqx3-approval-types with this annotation marked load-bearing for all eight decisions.

MEDIUM×4:

1. RFC-0001 §5.2/§4.2 divergence unflagged — RFC still mandates ward.toml TOML + [protected].invariants array; "v0.1 TOML stays dead" needs either a declaration→predicate compilation story or a named RFC-amendment dependency (the doc flags RFC-0001 §5.5: add S_p(F) ∈ S_p(F) as explicit closure precondition (Cody soundness flag) #3/RFC-0001 §4.2 predicate (iv): require provenance on admitted entries (Echo soundness flag) #4 scrupulously; this one is missing).
2. §4 terminal audit events vs decision-feat(portability): surfaces content map + lossy one-way .af exporter (threads-jq4) #2 close reasons don't compose: superseded undefined, rejected absent from close reasons, expired ambiguous when expiry triggers apply — reconcile into one event/reason table before ApplyAudit (issue ward_audit: add an apply-audit event type so the coven daemon can persist Gate-4 apply records #5) consumes it.
3. §0 ("does not start Phase 5") vs §7/§8 ("Phase 5 is open… executed") — restate as: §§0–5 proposal-as-reviewed, §§6–8 decision record.
4. §7 bead list has no v01.bak corpus content migration/fidelity item — uqx.4 builds the mechanism; nothing accepts that the retired invariants (name/person/pronouns/purpose/coven) are actually re-expressed with coverage. Add a bead gated before/at uqx.10 freeze.

Verified sound: ApprovalPath lattice = RFC §5.3 exactly (incl. MUST NOT auto-promote protected surface); delayed-apply-only holds everywhere (no provisional-apply reintroduction); strand-kind and channel extension discipline respected; metaphor binding otherwise exemplary. Full analysis on bead threads-uqx.

[BunsDev]

Authority-review remediation is now pushed in 7eb8522. The spec excludes protected targets from ApprovalPath, makes RFC/schema alignment (threads-uqx.12) and an authorized reproducible migration fixture (threads-uqx.13) explicit freeze dependencies, and no longer treats a co-author trailer as Nova gate evidence. Final fresh-context review: no significant issues. PR remains draft because independent Nova attestation and final Val freeze are intentionally unsatisfied.

[BunsDev]

Upstream RFC/schema gate is now implemented as stacked draft OpenCoven/familiar-contract#4 (1854e4e). It adds standards-compliant TOML + JSON Schema validation, the typed approval compiler contract, 6 positive/36 negative conformance fixtures, migration guidance, and immutable RFC snapshots. It remains human-gated: familiar-contract#3 must merge first, then #4 retargets to main and requires independently attributable Nova + Val approval.