feat(governance): containment TLA+, contract+dashboard+OPA security reviews, HSM/Terraform, zk relayer, impl plan
- TLA+ SentinelContainmentProtocol: corrected model-checkable dead-man's-switch
spec (TLC 75 distinct states, no error). TrippedStaysTripped + KillSwitchIntegrity.
Old broken spec (undefined Init) deprecated with header.
- Solidity: OmegaActualTreatyEngineHardened.sol (compiles clean, solc 0.8.26, 0 warn)
fixing SEC-01..06; SECURITY_REVIEW.md; test_contract_logic.py (7/7 prove exploit/fix);
compile.js harness.
- Terraform: multi-region confidential-enclave IaC (validate clean) with VPC, KMS CMK,
AWS CloudHSM v2 key custody (env-02), Nitro/SEV-SNP enclave nodes, IMDSv2; README+gitignore.
Old broken HCL renamed .deprecated.
- zk-SNARK relayer pipeline (run_relayer_pipeline.sh): Groth16 proof -> exported Solidity
verifier (1663B, compiles) -> ABI calldata for on-chain verifyProof.
- Dashboard review (next-app/DASHBOARD_SECURITY_REVIEW.md): DASH-01..08 + 5 falsifiable
vitest checks (5/5 pass).
- OPA/Rego review (rego/POLICY_REVIEW.md): 21/21 tests, recommendations.
- Consolidated IMPLEMENTATION_PLAN_AND_SAFETY_ARCHITECTURE.md: layered architecture,
phased plan 2026-2035, HSM/key-custody, full multi-jurisdictional compliance map, A/B/C/D tiering.
- run_runnable_assurance.sh extended to 11 checks (all PASS); RUNNABLE_ASSURANCE.md updated.