[OPEN] Registry governance — working group, conflict resolution

[Faux16]

Context

From concept-and-spec.md:

[OPEN] — Registry governance. Working group composition. Conflict resolution. Decision: defer until first 5 vendors join; bootstrap via ZAK + Anthropic + OpenAI + 2 customer references.

The registry today is a CC0 directory of signed actor entries. There's no formal policy for:

• Who can merge new entries (currently: stewards via CODEOWNERS).
• What to do when two parties claim the same FQDN.
• How to revoke or flag a compromised entry.
• Whether the registry is the only trust anchor or one of many (federation).

Goal

Author an RFC (decisions/00NN-registry-governance.md) that:

1. Defines who can merge entries today and how that expands when the working group forms (per GOVERNANCE.md Phase 2).
2. Specifies the conflict-resolution process for duplicate FQDNs / revocations.
3. States the trust model — registry merges are well-formedness attestations, not product endorsements (already in the registry README; formalize).
4. Decides whether multiple parallel registries are explicitly supported (and if so, how clients reconcile).

Comment period

This is a substantive change, possibly breaking if it changes what a merge attests to — at least 2 weeks of public comment per GOVERNANCE.md. Likely 4 weeks if the conclusion alters the wire-format expectations around actor.conformance_report references.

Triggers

This issue can sit open until conditions are met:

• 5+ committed external implementers (per GOVERNANCE Phase 2 bar), or
• A real duplicate-FQDN / revocation incident, whichever comes first.

Pointers

• Registry README: openagp/registry
• Org governance roadmap: GOVERNANCE.md