Define shared reference promotion policy

[changeroa]

Purpose

Define strict JSON-only eligibility and review gates for a possible later shared-experimental promotion.

Scope

• Add promotion RFC schema, zero-claim shared policy, and a closed JSON fixture inventory.
• Require canonical profile binding, support, evidence, ownership, compatibility, migration, rollback, and provenance.
• Constrain normative-correctness bypass to adoption count only.
• Reject YAML, path/symlink/duplicate-key, forged-profile, lifecycle, aesthetic, and claim-boundary violations.

Claim boundary

No promotion occurred. Examples are synthetic, example-only, deferred, single-account, and contain zero adopter attestations. Stable has no numeric consumer threshold.

Verification

• Promotion harness 74/74; 70 invalid inputs nonzero and 4 valid inputs zero.
• Independent safety/context matrix 23/23.
• Promotion, governance, domain, and consumer pairs plus full inherited aggregate: PASS.

node scripts/validate-promotion-rfc.mjs --json
node scripts/test-validate-promotion-rfc.mjs --json

Durable evidence: .omo/evidence/consumer-reference-roadmap-implementation/pr6/; authoritative run 29282276349.

Stack and rollback

Base is codex/roadmap-05-state-evidence; merge sequentially after roadmap 05. Revert 9965afa to remove only this promotion-governance layer.

[changeroa]

ULW triage — changes requested

Reviewed exact head 9965afad8e526646267be894b3164b99be4efbf9 against base 7589f6bfa65371c42387fa7fbf70bbd28d1d407c in isolated worktrees. The canonical validator (3/3), official promotion harness (74/74), full inherited validation sequence, git diff --check, and all four GitHub jobs pass. Path containment, strict JSON, closed inventory, canonical profile binding, claim boundaries, and CI permissions also held under adversarial review.

Merge is blocked by contract false-successes:

1. Mandatory evidence can be omitted or failed. consumer-reference/contract.md:55 requires every RFC to carry passing claim-scoped and regression evidence. The schema only requires one arbitrary evidence item, and scripts/validate-promotion-rfc.mjs:115-127 enforces both only for stable transitions (plus regression for normative bypass). At this exact head, ordinary deferred and normative-bypass RFCs missing one required family returned exit 0 with ok: true; failed claim-scoped/regression entries can also pass on the ordinary route. Require both passing families for every RFC and add negative controls.
2. The independent-consumer gateway is unreachable. Governed profiles are required to be example_only: true and related, while scripts/governed-profile-registry.mjs counts only non-example independent profiles as eligible and rejects invalid registry records before counting. A two-consumer positive probe therefore failed with promotion_profile_registry_invalid / promotion_independence_unproven. Define a valid independent adopter shape (or separate adopter validation from example-profile validation) and add a positive eligibleCount === 2 test.
3. Schema/runtime binding parity differs. profile_record is optional in the schema but mandatory at runtime; direct schema validation accepts an unbound attestation that the CLI rejects. Make this requirement consistent.

Additional hardening: whitespace-only ownership/evidence/provenance strings currently satisfy required fields.

This PR also sits on the blocked #21–#24 stack. The central semantic-distinctness and evidence-integrity findings remain relevant, and PR #26 leaves the promotion contract/schema/validator/harness unchanged, so the cumulative head does not repair the blockers above.

Outcome: triage: changes-requested; not safe to merge yet.