feat: implement institutional governance and recovery architecture

docs/CAPABILITY_AND_INFRASTRUCTURE_FIT.md

@@ -14,6 +14,14 @@
 | Machine-readable companion | [`capability-fit-current.json`](capability-fit-current.json) |
 | Input schema | [`capability-fit.schema.json`](capability-fit.schema.json) |
 
+**Snapshot notice:** this assessment remains valid only for the pinned
+2026-07-22 composition above. Workflow Engine, the optional Workflow editor,
+Datasources, Dataflow, Search, encryption contracts, and other later main-branch
+work must not be inferred into this evidence record. The current product
+direction and implemented-state reconciliation are documented separately in
+the
+[Institutional Governance Target Architecture](INSTITUTIONAL_GOVERNANCE_TARGET_ARCHITECTURE.md).
+
 This is a fit assessment, not a production approval or security certification.
 It deliberately does not infer implementation from a repository, issue, or
 manifest existing. A conclusion needs code plus a route/contract, test,
@@ -468,10 +476,11 @@ which modules a running service activated, migrations, configuration, health,
 or reference-journey behavior. Runtime activation therefore remains an explicit
 unchecked boundary.
 
-### Target, provider and production proof boundary
+### Reference-readiness, provider and production proof boundary
 
-Installed evidence cannot approve a target environment, an external provider,
-or production use. These scopes use a separate, expiring
+Installed evidence cannot establish target acceptance, accessibility, privacy,
+security, operations, recovery, an external provider, or production use. These
+scopes use a separate, expiring
 [`capability-fit-boundary-evidence.schema.json`](capability-fit-boundary-evidence.schema.json)
 bundle. The bundle is bound to the assessment ID, assessment release and exact
 installed-evidence SHA-256 digest. It contains only opaque subject/control/result
@@ -480,8 +489,9 @@ IDs and content hashes, not endpoints, credentials, people or raw result files.
 Boundary evidence is accepted only when at least one Ed25519 signature validates
 against a separately provisioned
 [`capability-fit-proof-authority-keyring.schema.json`](capability-fit-proof-authority-keyring.schema.json).
-Each authority key explicitly lists the scopes it may attest. Target and provider
-claims use `passed` or `failed`; production claims use `approved` or `rejected`.
+Each authority key explicitly lists the scopes it may attest. Target,
+accessibility, privacy, security, operations, recovery, and provider claims use
+`passed` or `failed`; production claims use `approved` or `rejected`.
 One claim per scope, unique control/artifact IDs, `issued_at < expires_at`, current
 validity and exact digest binding are mandatory. Any schema, binding, time,
 signature or authority blocker leaves every supplied boundary claim unchecked;
@@ -554,6 +564,10 @@ Target-environment and production-approval claims must use the assessment's
 operator to supply a bounded opaque expected subject with
 `--expected-external-provider-subject`; without it, such a claim remains
 unchecked and blocks. Expected and observed IDs are retained in proof scope.
+Accessibility, privacy, security, operations, and recovery claims use the same
+deployment subject. The report emits a cumulative `reference_readiness` verdict
+only when all six required scopes are checked and positive. This verdict remains
+separate from production approval and from provider-specific acceptance.
 
 Both authority keyrings are governance trust roots. Installer receipt keys use
 the strict
@@ -575,9 +589,9 @@ cannot relabel it as current. Live admission must omit it and use the actual
 current time.
 
 No boundary bundle or production authority has been supplied for this current
-assessment. Target environment, provider and production proof therefore remain
-explicitly unchecked rather than inferred from the local GreenMail journey,
-source tests or signed release metadata.
+assessment. Reference-readiness, provider, and production proof therefore
+remain explicitly unchecked rather than inferred from the local GreenMail
+journey, source tests, or signed release metadata.
 
 ## Evidence used in this slice