docs: operationalize Coven Automations v1 tracker roadmap and drift check (coven#859)

[CompleteDotTech]

Summary

• Operationalizes the GitHub-side half of the P0 control: Operationalize Coven Automations v1 through Cave’s canonical Beads graph and GitHub mirrors #859 operational delivery graph for Coven Automations v1 (Program: Coven Automations v1 — reliable, identity-bound familiar routines #854): one reviewed roadmap artifact, one machine-readable Bead↔GitHub mapping, one credential-free drift check, and one dated status/decision record.
• Follows the operational correction on P0 control: Operationalize Coven Automations v1 through Cave’s canonical Beads graph and GitHub mirrors #859 (comment 5469149789, 2026-08-30): the canonical Beads graph is Cave's embedded-Dolt database cave (OpenCoven/coven-cave), .beads/issues.jsonl there is a public-scrubbed review export, and no competing Beads store is initialized in OpenCoven/coven. Bead provisioning itself is delegated to P0: Seed Coven Automations v1 into Cave’s canonical Beads/Dolt execution graph coven-cave#5220; bead IDs stay null (warn-level W010) in the mapping until #5220 declares them.

Files changed (4 files, +1318)

• docs/roadmaps/coven-automations-v1.md — roadmap artifact: canonical tracker roles (Beads / GitHub / Coven runtime), sync metadata (last sync, source branch, writer designation), P0/P1/P2 policy, generated outcome-mapping table, dependency graph, release gates, active blockers, drift-check usage; carries a generated-content warning and does not duplicate mutable run status.
• docs/roadmaps/coven-automations-v1.mapping.json — machine-readable one-to-one mapping for Program: Coven Automations v1 — reliable, identity-bound familiar routines #854, Native familiar automations: replace harness-owned schedules with durable Coven routines #816, P0: Specify coven.automations.v1 schemas, state machines, idempotency, and changefeed #855, P0: Harden automation time, retries, cancellation, fencing, and crash recovery #856, P0: Bind automation runs to principal authority, familiar revisions, capabilities, approvals, and receipts #857, P0: Build automations conformance, chaos, SLO, and operator diagnostics #858: explicit depends_on edges matching P0 control: Operationalize Coven Automations v1 through Cave’s canonical Beads graph and GitHub mirrors #859's minimum graph, acceptance gates, dispositions, evidence links, cross-repository child policy, and P2 exclusions.
• docs/roadmaps/drift-check.mjs — offline, dependency-free drift check (no network, no credentials): mapping invariants (duplicate/missing mapping, unknown deps, cycles, priority validity, P0 owner/gate/disposition, completed-work-without-evidence), generated-mirror contract enforcement (the roadmap table block is regenerated by --render and verified on every run), optional --beads-export <issues.jsonl> cross-check (state/priority/surface:shared label/1:1 linkage), sensitive-payload scan of tracker output, and --selftest proving every detection class with fixtures. Severity policy: error fails CI; warning (pending provisioning) does not, keeping CI honest without staying red on work owned by another repository.
• docs/superpowers/plans/2026-08-30-issue-859-coven-automations-v1-tracker-operationalization.md — dated status/decision record: what exists on main today (automations series landed 2026-08-28 via PRs feat(automations): routine definitions and control actions (coven#816, part 1) #846/feat(automations): non-destructive legacy Codex import (coven#816, part 5) #847, commits 882fc83…1de50a8; no Beads store in this repo), pre-change integrity report (including the pre-existing push-only Classify changes CI failure on the base SHA), decisions D1–D7, criterion-by-criterion verdict, remaining work, critical path, and the initial evidence packet.

Issue

Refs #859.

Vehicle note: opened in the fork CompleteDotTech/coven as the CI vehicle — this token cannot write to OpenCoven/coven. Re-target upstream once write access is restored. Refs #859.

Deliberately not Closes: the issue's own completion semantics keep #816 open until its evidence checklist is done, and #859 spans bead provisioning in OpenCoven/coven-cave#5220 (outside this repository). Closing on merge would close work that is only partially established; per #859, a GitHub issue is not closed merely because partial implementation landed.

Test plan

Checked = ran locally in this checkout (node v24.16.0, no Rust toolchain, no python3):

• node docs/roadmaps/drift-check.mjs --selftest — all 11 drift fixtures and 6 sensitive-payload rules detected (exit 0)
• node docs/roadmaps/drift-check.mjs — 0 errors; 6 × W010 pending-provisioning warnings, exit 0
• node docs/roadmaps/drift-check.mjs --beads-export .beads/issues.jsonl run against the OpenCoven/coven-cave checkout export — 0 errors; confirms zero Automations v1 beads exist and no sensitive payloads in the export
• node docs/roadmaps/drift-check.mjs --render — regenerated block is byte-identical to the committed one (idempotent)
• node --check docs/roadmaps/drift-check.mjs; JSON parse of the mapping file
• Secret scan + privacy guard mirrored locally in JS over the four changed files using the exact rule set from scripts/check-secrets.py / scripts/check-coven-privacy.py (python3 is unavailable locally) — clean
• python3 scripts/check-secrets.py + python3 scripts/check-coven-privacy.py --range — deferred to CI (policy-guard runs them on this PR)
• cargo fmt --check / cargo clippy / cargo test — deferred to CI; not applicable locally (no Rust toolchain) and not exercised by a docs-only diff (CI classification keeps Rust jobs skipped)

Risk and Rollback

• Risk level: low — docs-only change (all paths under docs/); no code, no workflow changes, no tracker state mutated (bead state untouched; provisioning explicitly delegated to P0: Seed Coven Automations v1 into Cave’s canonical Beads/Dolt execution graph coven-cave#5220).
• Rollback plan: revert this single commit; the mapping and roadmap are additive and nothing outside the PR consumes them yet.

Agent Handoff

• Current state: single commit on agent/issue-859-p0-control-operationalize-coven-automations-v1, based on upstream main at 1364cec; DCO signed-off.
• Follow-ups: (1) provision the Automations v1 epic + six surface:shared beads via P0: Seed Coven Automations v1 into Cave’s canonical Beads/Dolt execution graph coven-cave#5220, then set real bead IDs in the mapping (one-line reviewed change; W010 clears, missing-mapping drift escalates to error); (2) wire node docs/roadmaps/drift-check.mjs into relevant PR CI and the weekly rollup cadence; (3) fill the Native familiar automations: replace harness-owned schedules with durable Coven routines #816 evidence checklist; (4) map cross-repository child outcomes one-to-one as they are created.
• Known gaps: live Dolt database not readable from this environment (no bd/dolt binary) — bead reuse-check against live state is owned by #5220; the coven claim registry could not be used (no Rust toolchain to build the CLI) — REST deconfliction (no open PR or branch for P0 control: Operationalize Coven Automations v1 through Cave’s canonical Beads graph and GitHub mirrors #859) plus a dedicated clone/branch covers the anti-duplication intent.

CI note (checkless repository, draft→ready provenance)

• No CI exists on CompleteDotTech/coven: the repository has never run a GitHub Actions workflow (0 total workflow runs, confirmed 2026-08-30 via the Actions API) and the head SHA 83ba34a8a8d368d408c6637a424a0dfa4c8e0ca7 reports check-runs total_count: 0. Per the draft-until-green contract for a checkless repository, there is no CI verdict to report; upstream OpenCoven/coven checks (policy-guard: secret scan, privacy guard; docs-only classification skips Rust jobs) will run when this branch is re-targeted upstream.
• Ladder provenance: the upstream PR attempt (gh pr create --repo OpenCoven/coven ..., 2026-08-30T15:24Z) failed with GraphQL: Resource not accessible by personal access token (createPullRequest); this fork PR is the working CI vehicle.
• Draft→ready provenance: the PR was created as a draft at 2026-08-30T15:25:09Z; a ready_for_review event was recorded at 2026-08-30T15:26:16Z by actor CompleteDotTech — the shared token identity used by concurrent sweeps — before any check could report. This session did not merge the PR and did not use GraphQL to change draft state; the REST API cannot convert a PR back to draft. End state (ready, unmerged) matches the checkless-repo contract outcome.

---

Recreated upstream from [https://github.com/CompleteDotTech/coven/pull/3], preserving source head 83ba34a8a8d368d408c6637a424a0dfa4c8e0ca7 and branch agent/issue-859-p0-control-operationalize-coven-automations-v1.