Arm the fail-safe recorder/audit orchestrator hooks (item 28.2 stage 1)

.aiqt/orchestration.json

@@ -1,4 +1,15 @@
 {
   "version": 1,
-  "companion_stores": ["/opt/cleanlanguage/private"]
+  "companion_stores": ["/opt/cleanlanguage/private"],
+  "record": {
+    "findings": "/opt/cleanlanguage/private/open-findings.md",
+    "pending_decisions": "/opt/cleanlanguage/private/pending-decisions.md",
+    "handoff": "/opt/cleanlanguage/private/session-handoff.md"
+  },
+  "lease": {
+    "path": "/opt/cleanlanguage/private/session-state.md",
+    "max_age_hours": 24
+  },
+  "state_dir": "/opt/cleanlanguage/orch-state",
+  "dispatch_tools": []
 }

.github/workflows/orchestration-registry.yml

@@ -34,6 +34,17 @@ jobs:
         shell: bash
         run: python3 tools/check-orchestration-registry.py
 
-      - name: Run the orchestration-registry tests
+      - name: Run the orchestration-registry gate tests
         shell: bash
         run: python3 tools/test-orchestration-registry.py
+
+      - name: Run the stage-1 hook behaviour tests
+        shell: bash
+        run: python3 tools/test-orch-stage1-hooks.py
+
+      # Re-run the gate against the committed registry by its explicit path, so this step is RED both on
+      # a malformed edit and (via the gate tests above, which assert the arming keys are present) on a
+      # tree that lacks the stage-1 arming change.
+      - name: Validate the committed orchestration registry explicitly
+        shell: bash
+        run: python3 tools/check-orchestration-registry.py .aiqt/orchestration.json