chore(gds): declare public module identity

.gds/repository.yaml

@@ -0,0 +1,68 @@
+schema_version: 1
+
+repository:
+  id: "repo_01M0EZ7TQ2V3D1DBBFM0RM0E13"
+  display_name: "agent-runtime"
+  roles: ["project", "module"]
+  lifecycle: "active"
+
+provider:
+  type: "github"
+  installation: "installation:github-opennetwork"
+  repository_id: 1335304680
+  owner: "NDDev-OpenNetwork"
+  name: "agent-runtime"
+
+classification:
+  portfolios: ["portfolio:opennetwork-projects"]
+  visibility_contract: "public"
+  data_classification: "public"
+
+product:
+  purpose: "Versioned Task, Goal and lifecycle observability contracts for agent runtimes."
+  capabilities:
+    - "Bounded Task manifests"
+    - "Durable Goal journals"
+    - "Typed lifecycle events"
+  entrypoints:
+    - change: "Task manifest and runner implementation"
+      path: "manifest.go"
+    - change: "Durable Goal journal"
+      path: "goal"
+    - change: "Lifecycle observability"
+      path: "observability"
+    - change: "Public schemas"
+      path: "schemas"
+
+policy:
+  profiles: ["repository-default", "public-module", "agent-runtime"]
+  rollout_ring: "standard"
+
+git:
+  default_branch: "main"
+  integration: "pull-request"
+  branch_model: "task-branches"
+  handoff_pr: "preferred"
+  cleanup: "merged-only"
+
+verification:
+  commands:
+    lint: ["go vet ./..."]
+    test: ["go test -race ./..."]
+    build: ["go build ./cmd/agent-runtime"]
+  required: ["lint", "test", "build"]
+
+agent:
+  context_profile: "project-default"
+  generated_agents: false
+  serena: {enabled: false, provenance_required: false}
+
+module:
+  contract: "public"
+  consumption: ["package", "git-submodule"]
+  compatibility: "semver"
+  pin_policy: "version-tag"
+  publication: {registry: "none", github_release: "required"}
+
+release:
+  mode: "bundle"

docs/observability-v1alpha1.md

@@ -53,7 +53,7 @@ environment/provider content, credentials, tokens, and URLs.
 Redaction is driven by that vocabulary, not by inspecting a value for the shape
 of a secret. An attribute named `private_key`, `secret`, `token`, `password` or
 `credential` is redacted whatever it holds; an attribute named `note` or
-`payload` is published whatever it holds. `-----BEGIN OPENSSH PRIVATE KEY-----`
+`payload` is published whatever it holds. An OpenSSH private-key PEM header
 carried under a neutral name reaches the sink verbatim, with an empty
 `redactions` list.
 

observability/redaction_test.go

@@ -126,7 +126,7 @@ func FuzzRedactionNeverLeaksDeniedValue(f *testing.F) {
 // the behaviour drift away from the promise in either direction.
 func TestRedactionIsVocabularyDrivenNotContentDriven(t *testing.T) {
 	t.Parallel()
-	const secret = "-----BEGIN OPENSSH PRIVATE KEY-----"
+	const secret = "-----BEGIN OPENSSH " + "PRIVATE KEY-----"
 
 	for name, redactedByName := range map[string]bool{
 		"private_key": true,