docs: harden control-plane execution gates

docs/ECC-2.0-GA-ROADMAP.md

@@ -62,33 +62,47 @@ The execution sequence is deliberately read-only first and promotion-gated:
 2. **ECC2 MCP read plane.** Add an opt-in MCP server over existing ECC2
    stores with bounded, redacted `list_sessions`, `get_diff`,
    `worktree_status`, and `merge_queue` tools. This slice performs no task,
-   merge, approval, or filesystem mutation.
+   merge, approval, or filesystem mutation. Bind caller identity and a
+   canonical realpath workspace ID at server startup; expose only records owned
+   by that workspace/caller; deny undeclared read capabilities; and rate-limit
+   and audit every read without logging returned content.
 3. **ECC2 MCP mutation plane.** Add `create_task`, `merge_task`, and
    `approve_tool` only after the read plane is stable. Require explicit
    capability gates, immutable audit receipts, dry-run previews, and the
-   existing risk/profile policy at every mutation boundary.
+   existing risk/profile policy at every mutation boundary. Caller identity,
+   workspace ownership, and per-tool authorization fail closed before inputs
+   reach the store or filesystem.
 4. **Worktree lifecycle contract.** Define and schema-validate
    `ecc.worktree.yml`; specify `new`, `split`, `fork`, and `close` state
    transitions; define bounded context seeding and lifecycle hooks without
    copying secrets or raw harness transcripts.
 5. **TCAS leases and merge serialization.** Derive touched paths from tool
-   activity, persist `{session, branch, touched_paths, heartbeat}` leases, show
-   overlap before blocking, then add queue serialization, lease expiry, and
-   human escalation records.
-6. **Consent-gated OTLP v2.** Standardize `ecc.*` span names and redacted
-   attributes, propagate `TRACEPARENT`, and add an explicit opt-in live
-   exporter. Existing JSON export remains the offline fallback; no prompts,
-   secrets, or memory bodies enter telemetry.
-7. **Skill-quality and promotion gates.** Stabilize invocation telemetry
+   activity and normalize each path against the canonical workspace. Persist
+   `{session, branch, touched_paths, heartbeat, owner, epoch}` leases with
+   transactional acquire/renew/release, unique overlap enforcement, and
+   compare-and-swap owner/epoch checks. Show overlap before blocking, then add
+   queue serialization, bounded lease expiry/recovery after heartbeat loss,
+   and human escalation records.
+6. **Consent-gated telemetry schema.** Standardize `ecc.*` span names and
+   bounded attributes, define `TRACEPARENT` propagation, and require explicit
+   consent, schema validation, and deterministic redaction before any sink.
+   Missing or invalid consent fails closed. Prompts, secrets, memory bodies,
+   raw diffs, and unbounded error text are forbidden by schema and regression
+   tests for both offline and future live output.
+7. **Consent-gated OTLP exporter.** Add the opt-in live exporter only after
+   the telemetry schema and redaction suite are stable. Existing JSON export
+   remains the offline fallback, but it passes through the same consent,
+   validation, redaction, and bounded-output gate as the live sink.
+8. **Skill-quality and promotion gates.** Stabilize invocation telemetry
    before adding determinism and delta-value measures. Proposed skills live in
    a candidate area and may reach canonical surfaces only through a recorded
    eval result, human approval, append-only transition event, and reversible
    promotion.
-8. **AgentShield v2 enforcement.** Introduce a versioned allow/approve/block
+9. **AgentShield v2 enforcement.** Introduce a versioned allow/approve/block
    policy contract enforced by ECC2, followed by signed provenance, registry
    locks, and optional dual-engine scanning from
    [issue #2415](https://github.com/affaan-m/ECC/issues/2415).
-9. **Distribution interop.** Add provenance-preserving npx-skills and ClawHub
+10. **Distribution interop.** Add provenance-preserving npx-skills and ClawHub
    import/export only after the policy and promotion contracts are stable.
    Training or inference automation remains deferred until telemetry,
    evaluation, consent, and rollback gates are operational.
@@ -96,8 +110,10 @@ The execution sequence is deliberately read-only first and promotion-gated:
 Each numbered item is a separate implementation lane. Do not combine the
 read-only MCP plane with mutations, the telemetry schema with live export, or
 candidate generation with promotion. Each lane requires unit and integration
-coverage, adversarial boundary tests, a migration/rollback note, and fresh
-Linux, macOS, and Windows evidence before the next dependent lane begins.
+tests, end-to-end coverage for its critical operator flow, at least 80% line
+and function coverage, adversarial boundary tests, a migration/rollback note,
+and fresh Linux, macOS, and Windows evidence before the next dependent lane
+begins.
 
 ## 2026-05-20 Delta