Deploy provenance target: no per-deploy operator gate, typed provenance on the transaction

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/deploy-provenance-target.md

@@ -0,0 +1,61 @@
+# Deployment provenance instead of an approval gate: target
+
+Status: target, Self, 2026-10-19 (campaign `idunn-deploy-provenance` in
+Eureka's mind). It states the ends. The map will live in
+`deploy-provenance-map.md`.
+
+## Why
+
+Operator, 2026-10-19:
+
+> The rule about the deployment brake was instituted by a cautious agent, but
+> it doesn't actually suit how GameCult operates. The whole point of Eureka is
+> to give the Mind, Persona and Self agency over its own Body. It's requiring
+> my approval for every deployment that violates our principles. Yes, we
+> certainly want to know which agent approved the deployment and why (this is
+> the authority provenance which we might want to add to the transaction), but
+> that's not the same as gating every deploy on my approval.
+
+On the same day a StreamPixels deploy (tx-b40c7240) waited on the brake
+because only the root-held operator identity could release it. The agent
+running the deploy could neither proceed nor record why it should.
+
+`F:\Projects\CLAUDE.md` says a deployment brake *may* gate artifact, revision,
+configuration, schema, unit or authority changes. It does not say that
+operator approval is the gate.
+
+## Invariants
+
+1. **No deployment waits on a per-transaction operator approval.** An agent
+   acting for the Mind, Persona or Self may admit a deployment of a target it
+   is authorized for.
+2. **Every transaction carries typed authority provenance.** That is: who
+   approved it (agent or instance, and faculty), under which session or
+   ruling, and why. It is written before Fencing, it is immutable, and
+   `idunn status` and history show it. It is part of the transaction
+   document, not a log line.
+3. **A brake that survives is a stop, not a gate.** The operator or an
+   authorized agent can halt deployment of a target, and the halt is itself
+   provenance-bearing. The deployment brake and the continuity lifecycle brake
+   stay separate (`F:\Projects\CLAUDE.md` Infrastructure). Neither gates Idunn
+   itself, and the deployment brake never gates continuity.
+4. **Existing invariants hold.** These are `idunn-reincarnation` target r2,
+   `route-continuity-target.md` 1-7 and `authority-map.md`.
+
+## Scope
+
+In:
+
+- The deployment-brake release path in Idunn and `idunn-provision`.
+- The provenance record on the transaction.
+- `idunn status` and history projection of the provenance.
+- The gamecult-ops runbooks that describe a per-transaction operator release
+  (`heimdall-discord-launch.md`, `idunn-host-raven.md`, the StreamPixels
+  runbook).
+
+Out:
+
+- `idunn-reincarnation`. This campaign is mapped after that campaign's cut 2
+  merges, and coordinates with it rather than bundling.
+- Harness permission rules on the workstation, which are the operator's.
+- Heimdall's onboarding failures.