L04 — Governed Operation Engine module gate #5

Outcome

One versioned plan, approval, execution, publication, revalidation, provenance, and rollback path.

Module owner

LoopLibCore correction subsystem. Adapters in other surfaces consume this module contract; they do not create alternate PDF or provenance authority.

Entry dependencies

• L01 — Evidence Core

Exit gate

Every supported surface produces equivalent semantics; stale or unauthorized work cannot publish; validation reads exact published bytes.

Native sub-issues

• L04-01 — Reconcile registry and canonical plan contract
• L04-02 — Enforce operation-owned save and impact policy
• L04-03 — Compute isolated nonpublishing preview
• L04-04 — Bind exact-plan approval and revocation
• L04-05 — Centralize approved Core execution
• L04-06 — Revalidate exact published bytes
• L04-07 — Converge provenance and sign-off
• L04-08 — Implement forward rollback and cross-surface parity

Evidence and scope rules

Pin the starting SHA. Distinguish implementation, runtime proof, independent proof, and release admission. Use the repository's mapped tests, architecture proof lanes, check-change gate, and a scoped changelog fragment for PRs. Do not import legacy status as loop2 completion. Resolve overlaps by verifying current code first and updating an existing outcome branch if one exists.

Sources

Approved master roadmap · Legacy/research intake (legacy #587).