Guard flow integration lifecycle

[xormania]

Summary

• add the protected flow program topology with exact group/<group> and matching slice/group/<group>/<slice> routes
• preserve accepted merge ancestry and branch/PR evidence while keeping the final flow to dev merge human-owned
• harden the workstream helper and Git/GitHub guards against stale heads, foreign repositories, alternate worktrees and refs, force updates, squash/rebase integration, and direct protected-branch writes
• make CI validate exact branch topology, tested-head identity, result classification, the sole exact flow bootstrap event, Required gates, and CodeQL
• add adversarial workflow, reducer, helper, guard, and Serena-config tests, then update the operating and contributor documentation

Why

The existing rails covered ordinary and legacy workstream development but could not safely express a long-running program integration branch. R0 establishes that delivery path before flow exists, without making flow authoritative over dev or granting agents direct integration authority.

Security and behavior impact

Required evidence now fails closed when a worker is missing, skipped, cancelled, stale, misclassified, or infrastructure-uncertain. The verified helper binds operations to the expected repository, exact PR head and base, approval, ancestry, and successful Required gates plus CodeQL results. Program synchronization uses merge commits so earlier review and test evidence remains reachable.

Serena remains advisory and no-network. Its project config selects the preseeded Bash Language Server 5.6.0 and gives agents bounded host-side workflow orientation; extensionless Bash remains on the ordinary-tool path.

Validation

• ./scripts/dev/check default quick — 33 passed, 0 failed, 0 skipped, 0 infrastructure errors
• policy probe — 67 passed
• ./tools/validate.sh --strict — passed
• ./scripts/dev/docker-gate — 8 passed, 0 failed, 0 skipped, 0 infrastructure errors
• ./scripts/dev/serena-smoke — Codex, Claude, and Grok activation and semantic smoke passed
• ./scripts/dev/lint-scripts and git diff --check — passed

Human follow-up after merge

Create literal flow at the exact R0-updated dev commit, then install hosted rulesets requiring current-head CI / Required gates and CodeQL, current-base testing or a merge queue, latest-head approval, merge commits, and no force push, deletion, or automatic program-branch deletion.