roadmap: qualify autonomy per workflow

[yihanzhu]

What changed

• Qualify authority for a recorded target, workflow, task class, resolved profile, versions, permissions, and execution environment instead of trusting an agent in general.
• Give each stage attempt a terminal status and each executed stage an evidence-backed result, including useful no-code and inconclusive outcomes.
• Add a portable verification interface that keeps proof kinds separate and binds proof to the relevant identities.
• Keep portable core limited to typed results and references; later initiatives still own qualification policy and enforcement.
• Make the first shadow workflow narrow and read-only when practical, and require each execution environment to earn qualification before bounded writes.
• Keep the README rollout summary aligned with that qualification unit.

Why this is one change

All additions support one rule: authority belongs to a versioned workflow scope whose runs return explicit, evidence-backed results. The separate verification-pack, blinded-eval, skill-lifecycle, metrics, model-policy, target-readiness, and audience-interface work stays in later initiatives.

Safety

This changes ROADMAP.md plus the one README rollout sentence that must stay in sync. It does not enable autonomous writes or change credentials, workflows, hooks, merge rules, reviewer permissions, or the human merge gate. Because ROADMAP.md is a constitution path, the operator must read and merge this PR; the branch cannot activate itself.

Proof

Verified in a clean detached worktree at commit 760ac16:

• ShellCheck 0.11.0 over every tracked shell script: passed.
• Required-file structure check: structure ok.
• North-star resolver: 74 passed, 0 failed.
• North-star gate and consumer tests: 226 passed, 0 failed.
• models.conf parser: 63 passed, 0 failed.
• degraded Codex gate: 91 passed, 0 failed.
• v2 pending-stage, round-cap, and quota-preflight suites: passed.
• v2 rename suite: 13 passed, 0 failed; pathname and probe guards passed.
• Rename gate: clean.
• Commit whitespace check: passed.

Closes #151

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 4ec7a83
Reviewed-base: 2f53375
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/152-31404/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The roadmap change is internally coherent, but it leaves the repository's rollout summary describing the older, broader autonomy unit. Because this concerns the safety boundary for autonomous writes and violates the documented synchronization rule, it should be corrected before merging.

Review comment:

• [P2] [Compliance] Align the README with workflow-scoped qualification — /var/folders/rm/bkx4f4b91vqfn79vk02pcd140000gn/T/tmp.oNu0BujQhx/ROADMAP.md:305-306
  The README rollout summary still says bounded writes are enabled “one stage at a time,” while this change makes the unit of authority a qualified workflow scope. That leaves conflicting safety guidance despite the repo rule requiring README and docs to stay synchronized; update the README summary in this change.

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	760ac16
Status:	✅  Deploy successful!
Preview URL:	https://1c75bf74.fabrica-6yx.pages.dev
Branch Preview URL:	https://codex-verified-workflow-road.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 760ac16
Reviewed-base: 2f53375
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/152-47842/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

The documentation changes are internally consistent and keep the README aligned with the roadmap. No concrete behavioral regression or safety-rail weakening is evident.