Anti-drift architecture for normative guarantees + two Tier-1 security fixes

[bokelley]

Summary

Follow-up to the 2026-07 AdCP protocol security audit. The audit's through-line was that AdCP's strongest guarantees are stated in prose but diluted at the layer that enforces them — a MUST with no schema backing, a reference snippet never executed, a fact hand-copied across docs that drifted. This PR lands the enforcement scaffold plus the two mechanical Tier-1 fixes, each shipped with the check that would have caught it.

Anti-drift architecture (specs/spec-anti-drift.md)

Principle: make the enforcement layer the source of truth; push each check to the cheapest deterministic layer; reserve the governing agent for judgment calls.

• Normative-statement registry (static/registry/normative-statements/) — every security MUST/claim tagged by enforcement layer + status, so "prose MUST with no backing" becomes countable.
• Coverage linter (scripts/check-normative-coverage.cjs) — validates the registry, fails when an enforced entry's linked check is missing, and enforces a --min-enforced one-way floor (adding a gap never fails; losing an enforced statement does).
• Offline doctest lane (scripts/run-doctests.cjs) — runs ​```lang doctest blocks deterministically; the lane the existing live-agent snippet suite couldn't be for pure-logic bugs.
• Blocking CI gate (.github/workflows/normative-guarantees.yml).

Tier-1 fixes (each flips its registry row to enforced)

• example_use → adcp_use in the request-signing reference verifier (docs/building/by-layer/L1/security.mdx). Dead code that silently disabled the key-purpose separation check. Guarded by a doctest.
• intent added to the governance-phase enum so a buyer can express the intent-phase check the spec already mandates (the token MUST carry phase: "intent"). Guarded by tests/governance-phase-enum.test.cjs + changeset.

Reviews addressed

Ran through code-reviewer and security-reviewer. Applied: scrubbed the doctest child env + dropped the shell runner + permissions: contents: read (executes PR-authored code in CI); wired the enum guard into CI; switched the ratchet to a --min-enforced count so cataloguing a gap isn't blocked; sanitized the registry notes to state the rule/fix rather than ship exploit recipes to a public repo; added a class check and a resolve-under-ROOT guard to the linter; added NS-GOV-004 for the wire-behaviour MUST the enum test doesn't cover.

Remaining Tier-1 findings (design decisions, tracked)

Not mechanical — each needs a design call: #5826 (verify_brand_claim key→brand binding), #5827 (report_plan_outcome budget attestation), #5828 (rights_constraint verification), #5829 (content-digest on spend calls), #5830 (TMP privacy claim). Rolls up to #3925.

Incidental

One unrelated commit escapes a pre-existing <5% in specs/spec-guardian.md (unpublished; MDX couldn't parse it, tripping the local docs preflight). One-char change, renders identically.

Verification

Precommit passed (4380 unit tests, typecheck). Doctest lane, enum guard, and coverage linter all green. Schema rebuild clean.

🤖 Generated with Claude Code

[aao-release-bot]

Argus is not auto-reviewing this PR because it modifies protected paths that require human review (.changeset/fix-governance-phase-intent.md, .github/workflows/normative-guarantees.yml, static/schemas/source/enums/governance-phase.json, static/schemas/source/governance/check-governance-request.json). A human reviewer should review and merge this PR; Argus will resume on subsequent PRs once these changes land on main.