retry(spike): execute #182 governance audit after stale approval grant refusal #199

Parent / source: #182 (Spike: Evaluate MCTL governance beyond human-in-the-loop approvals).
Epic: #181 (roadmap/epics/agent-governance-decision-assurance.yaml).

Why this issue exists

This is an execution carrier for #182's audit and nothing more. The original Temporal DevLoop dev-loop-mctlhq-.github-182 closed on 2026-10-18 after mctl-agents#681 correctly refused a stale approval grant: the grant was bound to proposal v1 (fb63a4b03, sha256:09718ba2…), the proposal had been rewritten to v2 by @MCTL reinvestigate (178f7bf9a, sha256:2ca80ff5…), and the approve CWFT refused the mismatch before any edit. A closed loop that did not end as abandoned cannot be restarted on its workflow id (mctl-api#640 restartIfAbandoned), so the audit runs here. The defects behind this are tracked in mctlhq/mctl-agents#701 and mctlhq/mctl-agents#702.

Scope

Identical to the owner-reviewed revised #182 proposal, mctl-gitops 178f7bf9a:
platform-gitops/agents-state/.github/proposals/issue-182-spike-evaluate-mctl-governance-beyond-hu/ (requirements.md, design.md, tasks.md).

The full specification is the current body of #182: its "Current baseline — 2026-10-18" and "Owner corrections for the investigation — 2026-10-18" sections, Scope 1–8, F1–F10, D1–D5 and the acceptance criteria. Read it and the v2 proposal before writing anything. Do not change scope or design unless pinned source evidence forces it; if it does, say what changed and why.

Binding constraints, repeated here so they are not lost:

1. Output: one report at docs/spikes/agent-governance-decision-assurance.md in this repository, plus an optional non-semantic link line in AGENTS.md. No other files.
2. D5 belongs to Spike: Evaluate MCTL governance beyond human-in-the-loop approvals #182 and starts neutral: no prior or working disposition; exactly one of NO NEW EPIC / EXTEND EXISTING / CREATE NEW EPIC, derived from D1–D4.
3. No roadmap change: do not archive, activate or refine roadmap/epics/agent-governance-decision-assurance.yaml or the lifecycle of Epic: Agent Governance & Decision Assurance #181. The report states the recommended manifest delta as text only; applying it is a separate owner-reviewed PR.
4. Pinned source reads are a hard prerequisite: mctlhq/.github, mctlhq/mctl-api, mctlhq/mctl-agents, mctlhq/mctl-gitops (and any other repository used for a substantive claim) at recorded SHAs. If a mandatory repository cannot be read, stop and report the blocker.
5. Paths stay distinct: P1 canonical Temporal DevLoop grant approval (the #681 path); P2 standalone/direct mctl_trigger_approve without a DevLoop grant; P3 incident-responder autonomous / no-human-gate path, classified for F10 only from the policy and authority contract that was read; P4 policy-checkpoint actions; P5 Agent Commerce.
6. No production side effects, no runtime fixes, no follow-up issue creation, no bypasses. roadmap(agent-runtime-assurance): adaptive adversarial assurance for governed agents #151 owns adversarial replay and regression work; name candidate scenarios only.

Additional D3 evidence to include (production, 2026-10-18)

The refusal that closed the original loop is a real production example for F1/F5 on P1 and must be analysed in D3:

• Decision-time binding protected execution: the approve CWFT refused v2 bytes under a v1 grant, and nothing was recorded for v2.
• But the proposal lifecycle and the approval lifecycle are not atomic: a reinvestigate left a pending grant bound to content that no longer existed, and a human decided it (mctl-agents#701).
• The refused approval was projected as we_ … phase: Succeeded and loop Completed, which is not restartable (mctl-agents#702).
• Invariant to state in the report: a free-text approval reason is descriptive metadata only; it confers no binding or authority. (The approver wrote the v2 digest in the reason; nothing checks it.)

Audit records: action_approval.create 13:44:01Z, action_approval.decision 14:17:38Z and action_approval.consume 14:17:40Z for aar_d3572c56815543f59289fa3bf0a30f6d; Argo mctl-agents-approve-6f23268b (flip-status refusal); work_item.execution 14:18:26Z for we_dadf9c08-0156-4ffa-a306-a11e188ae921.

Done when

The report PR for this issue is merged, with D1–D5 as specified in #182. Closing this carrier does not close #182 on its own: #182's owner reviews D5 and closes it.