SniperGold_ML/ml/p3/governance/p3_gov6a_control_plane

P3-GOV-6A — P0/P1 Preventive Controls (control plane)

Implement ONLY the P0/P1 preventive controls defined by P3-GOV-5 and authorized by the P3-GOV-6A phase letter:

Priority	Control	Module
P0	1. STATE != AUTHORIZATION (factual cursor is never authorization)	gov6a_gate.py, gov6a_state.py, gov6a_authorization.py
P0	2. FAIL-CLOSED CONFLICT HANDLING (deterministic gate; STOP with recorded reason)	gov6a_gate.py
P1	3. CHECKPOINT / SOURCE IDENTITY (mismatch -> RESUME_BLOCKED)	gov6a_identity.py
P1	4. EXACT-VALUE PROVENANCE (SOURCE -> EXTRACTION -> VALIDATION -> OUTPUT)	gov6a_provenance.py

Independent oracle: gov6a_oracle.py (raw byte / structural JSON comparison, no shared parsing logic with the implementation).

Regression suite: gov6a_mutations.py — 10 mandatory mutations on disposable fixtures only; required result 10/10 DETECTED.

Runner:

python run_gov6a.py before   # git preconditions + checkpoint SHA before + baseline
python run_gov6a.py suite    # mutation suite TWICE + reproducibility + final
python run_gov6a.py after    # checkpoint SHA after + git scope + files manifest
python run_gov6a.py report   # generate report + handover (docs/) from evidence

Constraints (P3-GOV-6A):

• Real checkpoint is READ ONLY (never a mutable test fixture).
• Real Tickstory source is NEVER read for testing (disposable synthetic fixtures only).
• No CHUNK 11, no ML, no Dukascopy, no production MQL5/.mqh changes.
• SAFE_MAX_CHUNK_SIZE = 24 MiB; SAFE_CHUNKS_PER_TURN = 8 under the tested benchmark workflow (capability evidence only; not activated here).