feature/osoh push implementation descent authority

docs/governance/OSOH_PUSH_IMPLEMENTATION_DESCENT_AUTHORITY.md

@@ -0,0 +1,38 @@
+# OSOH Push Implementation Descent Authority
+
+## Purpose
+Authorize the controlled descent from Level 5 governance into the minimum lower-level MVP work required to realize Sentinel push telemetry without violating constitutional invariants.
+
+## Authorized Descent Target
+The next descent is authorized only for bounded MVP realization of Sentinel push telemetry into OSOH.
+
+## Authorized Implementation Objects
+1. Sentinel deployment event sender
+2. Sentinel heartbeat event sender
+3. OSOH ingest URL wiring
+4. OSOH ingest token wiring
+5. OSOH site identity wiring
+6. bounded server-side secret handling
+7. proof that push events enter OSOH as telemetry-only evidence
+
+## Constitutional Constraints During Descent
+- Sentinel remains external monitored surface
+- push remains telemetry only
+- credential remains ingest-only
+- activation remains blocked
+- hybrid verification remains required
+- OSOH remains final authority
+
+## Forbidden Outcomes During Descent
+- no trust transfer
+- no activation by configuration alone
+- no activation by push alone
+- no broader credential scope
+- no operator or control-plane privilege grant
+- no constitutional reclassification of Sentinel
+
+## Return Requirement
+After implementation, the resulting slice must be reviewable against Level 5 invariants before any further descent.
+
+## Phase Completion Marker
+This phase is complete when the implementation descent authority is explicitly bounded, scoped, constrained, and return-reviewable.

docs/governance/OSOH_PUSH_IMPLEMENTATION_DESCENT_AUTHORITY_DONE_DEFINITION.md

@@ -0,0 +1,21 @@
+# OSOH Push Implementation Descent Authority — Done Definition
+
+## Done Definition
+
+### Condition 1 — Descent Target Is Explicit
+Only bounded Sentinel push telemetry realization is authorized for the next lower-level MVP work.
+
+### Condition 2 — Authorized Objects Are Fixed
+The permitted objects remain limited to deployment sender, heartbeat sender, ingest URL wiring, ingest token wiring, site identity wiring, bounded secret handling, and telemetry-entry proof.
+
+### Condition 3 — Constitutional Constraints Remain Active
+Externality, telemetry-only interpretation, ingest-only credential scope, fail-closed handling, hybrid dependency, and OSOH final authority remain binding during descent.
+
+### Condition 4 — Forbidden Outcomes Remain Blocked
+No trust transfer, no activation by configuration, no activation by push alone, no broader credential scope, and no control-plane privilege expansion are allowed.
+
+### Condition 5 — Return Review Remains Mandatory
+The completed push slice must be reviewed back against Level 5 constitutional invariants before further descent or expansion.
+
+## Phase Completion Marker
+This phase is complete when the lower-level implementation authority is fully bounded, fixed in scope, constitutionally constrained, outcome-limited, and review-returnable.