Post-Phase-4 roadmap: security, registry succession, release discipline, external review, and adoption enablement

[Riverbraid]

Status

POST_PHASE_4_ROADMAP_ACTIVE

Purpose

Move remaining work out of Phase 4 proof-of-concept cleanup and into explicit future phases.

Current bounded claim

PROOF_OF_CONCEPT_SCOPE_GREEN_SYNCED_LOCAL_AND_REMOTE_EXTRA_ARTIFACT_AUDITED_NOT_CERTIFICATION_NOT_PRODUCTION_NOT_EXTERNAL_AUDIT

Scope

This issue tracks future work after Phase 4 proof-of-concept scope closeout:

• execution evidence for patched items
• GitHub settings and security hardening
• secret/history/artifact safety
• reproducibility and dependency hardening
• verification-depth classification
• registry succession and expansion gates
• license and community health work
• readiness and evidence ledgers
• adoption enablement
• developer tooling
• ecosystem visualization
• extension/API planning
• domain expert onboarding
• governance authority boundaries
• external review readiness
• applied governance profiles
• production-readiness gate
• certification exploration only after a real process exists

Boundary

This issue does not mutate registry pins, releases, tags, protocol files, hashes, seals, manifests, workflows, or secrets.

It does not claim security hardening, production readiness, certification, legal approval, external audit, or absence of defects.

[Riverbraid]

Added future-work intake document for the user-provided Riverbraid-Golds missing-file packet:

docs/RIVERBRAID_GOLDS_IMPLEMENTATION_QUEUE.md

Boundary preserved:

• planning only
• no workflow mutation
• no registry mutation
• no release/tag mutation
• no evidence claim upgrade
• no security/production/certification/external-audit claim

The packet is now queued as implementation input, with reconciliation gates for workflows, release behavior, evidence/claim ledgers, Node/package alignment, CODEOWNERS/team references, registry count authority, and future source/test implementation.

[Riverbraid]

Draft PR Riverbraid/Riverbraid-Golds#6 now adds ENVIRONMENT-FLOOR-RELATIONSHIP-POLICY.json to address the cross-repository runtime/engine-pinning gap without pretending the account-wide audit is complete.

The policy requires each floor-participating repository to declare one of: pinned to the Evaluation Kit lock, compatible under a declared range, not on the pinned floor, not assessed, or blocked by an unresolved environment. Current account-wide status remains NOT_ASSESSED, and the Evaluation Kit Docker digest remains visibly unpinned.

This reuses the existing post-Phase-4 roadmap rather than creating a duplicate tracker. Repository-by-repository declarations and execution evidence remain future work under the existing reproducibility and supply-chain phase.