Track what Milestone 1 does not deliver (unblocks the issue #1 definition of done)

[OriNachum]

Milestone 1 is complete and lands in the operations-plane PR. This issue tracks
everything that is not in it, so the gap between "M1 done" and "issue #1 done"
is written down rather than inferred.

Nothing here is an oversight. Each item is either owned by another repo, blocked
on a dependency, deliberately deferred by the plan, or a limit we chose and
documented.

1. Owned by colleague — propose, don't push

Plan task	What	State
t69	Resolve policy/hooks from the operator source root, not the model-writable worktree	Filed privately as GHSA-6pfg-9vcp-hqw4
t70	Child policy as a restriction of the parent (parent_cap INTERSECT child_policy, deny wins)	Filed privately as GHSA-2m42-prxw-43w6
t86	colleague composes shell-cli's executor for the six tools, without subclassing	Not started — colleague's PR to make
t87	Differential parity in one session, then remove colleague's legacy handlers	Not started — depends on t86

The definition of done in #1 requires a migration proposal filed as an issue on
colleague, describing how it drops its copy, allow-lists shell-cli in its
zero-deps guard, and keeps behaviour identical. That proposal is not yet written.

2. Blocked on the two advisories

Policy-composition characterization fixtures. t74a captured the six schemas
and behavioural fixtures at colleague SHA 28fee29, but deliberately excluded
parent/child policy composition and per-model overlay fixtures (deviation d6).
Both advisories change composition semantics, and characterization must never
encode pre-hardening composition as the parity target.

The exclusion was verified, not assumed: grep policy colleague/tools.py returns
zero matches, and neither advisory's owned files include tools.py — so the six
schemas and handler behaviour are provably unaffected.

3. Milestones not started

• M2 — colleague delegates the six tools (see §1).
• M3 — route all colleague local operations. The known-debt counter is at
  13 modules and must reach zero. Includes lint's ruff --fix mutations
  surfacing as changed-path effects (c25/h13), and worktree concurrency
  (c47/h35).
• M4 — ContainerRunner. Also owns the per-runner threat-model split
  (c8/h51), which must land in the same PR that introduces the runner, and
  the linked-worktree git-metadata decision (do not solve it by mounting the
  host common .git writable).
• M5 — ecosystem providers; webglass-cli as a peer seam, planned in its own
  repository.

4. Deliberately uncovered spec targets

The plan covers 90 of the frame's 102 confirmed targets. Twelve are recorded as
deliberately uncovered rather than given placeholder tasks that would claim
delivery: c8, c25, c29, c40, c47, c60, h13, h17, h27, h35,
h45, h51. Tracked upstream as agentculture/devague#85 (the coverage model has
no notion of a deferred target, so plan converge cannot pass — a tool
limitation, not a plan defect).

5. CLI surface still incomplete

policy and operation are real CLI nouns. The canonical groups from #1 §6 that
do not exist yet:

shell env describe|create|destroy
shell fs read|list|stat|write|edit|media
shell process exec|shell
shell git status|diff|worktree|commit|merge

There is currently no CLI verb that itself executes an fs.read or a shell
command — only verbs that introspect the policy and evidence around that
execution. The library has all of it.

6. Known limits we chose and documented

These are contract decisions, not bugs. Each is asserted by a test so it stays
findable.

• Undeclared secrets are not redacted. A declared secret is scrubbed from both
  the live result and the record; a credential a command happens to echo is
  recorded verbatim. redaction.complete is permanently False from a single
  constant so the record and result cannot drift apart.
• freeze has an escape. An exotic mutable value that is neither mapping nor
  sequence passes through unfrozen. Out of contract, stated rather than papered
  over. Mapping detection is duck-typed (keys + __getitem__) precisely because
  a class not registered as Mapping is still consumed as one downstream.
• On-disk and returned evidence bodies have different integrity digests. They
  are different bodies — the persisted one carries a persistence block with
  persisted: null and a note, because a record cannot describe the outcome of
  the write that is still writing it. Each validates against its own bytes.
• applied is three-valued. null means the handler was entered and crashed,
  where partial application is genuinely unknown; either boolean would be a
  fabricated claim.
• 8 characterization tests do not run in CI. They need colleague importable,
  not merely present, and the inventory-gate job has a bare clone. Documented as
  a KNOWN GAP in tests.yml; the pure-AST handler drift gate covers the drift
  that would invalidate the fixtures. Read a green CI as not verifying the
  fixtures against live colleague.

7. Open, unscheduled

#7 — the inventory scanner is a drift detector, not an enforcement gate.
ALLOWLIST is keyed per module, not per site, so a new shell=True spawn
added to any of the 15 already-allow-listed modules passes green. The structural
fix changes the pinned baseline and needs its own reviewed slice.

8. Sequencing note for the first push

Every push to main publishes to PyPI, and 0.13.0 contains the fix for an
exploitable gate bypass (a rewrite could have the policy gate judge git status
while the handler ran rm -rf /; found by independent review before shipping,
never reachable by a consumer because nothing is wired to this package yet).

Publishing that fix and disclosing the two colleague advisories are separate
decisions with an ordering between them. docs/release-runbook.md has the
yank-and-fix-forward path.