daily operating surface
Every proposed action with evidence, rule context, and Bucket scope. Approvals write per-action audit events. Live provider writes remain blocked behind the Phase 1 safety gate.