docs(governance): make G0 evidence non-self-invalidating

[eimyroot]

Purpose

Replace the self-invalidating current main = G0 PASS documentation model with an exact-SHA retained-evidence model.

A G0 run may verify one exact main SHA. Committing a versioned CURRENT G0 = PASS statement changes main and therefore immediately makes that exact-SHA proof stale. This PR removes that loop.

Truth model

LATEST_RETAINED_G0_VERDICT = VERIFIED
LATEST_RETAINED_G0_SOURCE_SHA = a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c
CURRENT_LIVE_G0 = DERIVED / QUERY_ONLY
RELEASE_CANDIDATE_G0 = FRESH_EXACT_CHECKOUT_REQUIRED

The retained evidence remains immutable proof for its exact scope. Current live G0 is queried/derived at decision time. Release-candidate construction must run fresh G0 against its exact checked-out ${GITHUB_SHA}.

Retained evidence

• canonical repository: eimyroot/Voodoo-One
• G0 workflow run: 34031128405
• exact verified SHA: a7e7c075dc44d61d4f7e8870cc3c0580ff290c2c
• artifact: g0-governance-evidence-34031128405-1
• artifact id: 9988632821
• artifact digest: sha256:be646405590ac07f6293eaeb94a72c77ecf8ea02c16a31b31ccf93ef4ec92a2c
• retained verdict: VERIFIED

Older G0 evidence remains historical and is never promoted to a later exact SHA.

Scope

• CURRENT_PRODUCT_STATE.md: retained evidence + live-derived G0 model
• docs/product/CURRENT_CAPABILITIES.md: exact-SHA evidence scope; no current PASS serialization
• README.md: same public truth model
• docs/governance/GITHUB_MAIN_GOVERNANCE_BASELINE_V1.md: contract vs evidence vs live-query separation
• tests/system/test_pr01_repository_identity_truth.py: regression assertions for the non-self-invalidating model and fresh release-candidate G0

Non-scope

No product runtime, migrations, auth/RBAC, provider authority, production effects, GitHub ruleset settings, release/deploy authorization, provider WRITE or G8 behavior changes.

Merge gate

Keep this PR draft until canonical exact-head CI verify is green. Do not merge on retained G0 evidence alone. This PR does not authorize release or deployment.

[eimyroot]

go

[eimyroot]

merge

[eimyroot]

VOODOO workstream arbitration — 2026-09-19

WORKSTREAM_STATUS = PAUSE / RECONCILE_REQUIRED

Do not continue this branch toward merge unchanged.

Observed remote state:

• PR head: bb2fc66ae40f3703ffe189a9531403d189798f41
• current main: 10a8ed616f12989299cf006e4d6395f6c89a6cf0
• compare: 18 commits ahead / 12 commits behind
• changed current-state surfaces include CURRENT_PRODUCT_STATE.md, README.md, and docs/product/CURRENT_CAPABILITIES.md, which overlap newer R3/G8 truth work in PR docs: adopt R3 architecture and reconcile G8 live evidence #166

Preserve the unique G0 exact-SHA / non-self-invalidating evidence semantics, but resume only by extracting or rebasing those still-valid changes onto the current canonical state after conflict review. Do not close or discard evidence merely because this workstream is paused.

This status does not authorize merge, release, deployment, provider WRITE or production effects.