docs(migration-playbook): record convention-seam ratification limitation

docs/MIGRATION-PLAYBOOK.md

@@ -1138,3 +1138,49 @@ with a revisit trigger. (Contrast the "Deferred surfaces" record above, where th
 - **Checker hardening** (block-scalar description unfolding, an unquoted-`Use when:` warning, a
   `CHECK_SKILL_BASE_REF` post-commit audit ref for the git-backed checks, and a line-1 frontmatter-fence
   requirement): the one worker-executable slice — **landed** with this record.
+
+## Convention-seam ratification & the shared-identity limitation — decision record (2026-07-23)
+
+Recorded from the #1187 audit (triggered when the operator did not recall ratifying the
+`consumer-config-layering` → `config-cascade` seam). All 12 `docs/conventions/*` seams are
+**PR-introduced** across the repo's whole history (established from git history), so none was silently
+accreted. In-doc issue/PR citation is the intended ratification signal but is **inconsistent** across
+the surfaces today — some seams cite their ratifying issue in the README/CHANGELOG (`config-cascade`'s
+exception class → #649), others (`hook-precision`, `seam-phrasing`) carry no in-doc reference, so an
+operator auditing from the durable convention surface alone cannot always find it. Converging every
+seam on an in-doc citation is a follow-up, not asserted here as already-true.
+
+**The limitation, stated precisely — two provenance layers, only one collapses.** Distinguish:
+
+- **Git commit metadata** (author, committer, `Co-Authored-By` trailers) **does** carry a distinct
+  identity — this very record's commit is authored by `Codex <codex@openai.com>`; other agents commit
+  under their own identity (e.g. a `Co-Authored-By: Claude …` trailer). So at the commit layer, agent
+  work is often *visible*. But it is **soft, not proof**: an agent can set its git author to anything,
+  so absence of an agent identity does not prove a human authored it.
+- **GitHub gh-account actions** — PR author, PR review, merge, and the account a commit is *attributed
+  to* — **all collapse to `kyle-sexton`** (the account `gh` is scoped to), whether the human or an
+  agent-as-Kyle acted. At *this* layer no in-repo signal distinguishes human ratification from agent
+  accretion.
+
+So the gap is specifically at the **GitHub-account / review-and-merge layer**, which is exactly where
+"ratification" is recorded — and it is a **repo-wide property**, not a defect of any one seam.
+
+**Decision — decline forgery-prone gates; they are theater.** A `CODEOWNERS` rule or a `human-ratified`
+label requiring a `kyle-sexton` review does **not** distinguish anything at the account layer: an agent
+satisfies the same gate under the same identity. Commit signing already runs (`required_signatures`)
+but under the shared key, so it does not separate either, and commit-author metadata is spoofable as
+above. Standing up such a gate would manufacture *false* assurance — worse than naming the limitation.
+So none is added.
+
+**The only real distinguisher (flagged, not imposed).** Cryptographic separation requires an identity
+agents do **not** hold — a distinct human-only GitHub account and/or a signing key kept off the agent
+runners, with branch protection requiring that identity's review on `docs/conventions/**`. That is an
+infrastructure change with real operator cost. **Revisit trigger:** the operator wants provable human
+ratification, or a second human contributor joins (at which point identity separation exists naturally).
+
+**Interim posture.** Ratification stays **trust-based and visible**: a convention-seam change **should
+cite** a ratifying issue/PR in-doc (the norm going forward — converging existing seams on it is the
+follow-up above), and the operator's explicit engagement on that thread (as in the #163434 session) is
+the ratification signal. The audit trail — issue, review comments, commit-author metadata where it
+carries an agent identity, and this record — is the durable account, in place of an account-layer
+assurance the shared GitHub identity cannot provide.