Install observational Merge Steward

.github/aw/actions-lock.json

@@ -1,5 +1,10 @@
 {
   "entries": {
+    "actions/checkout@v4": {
+      "repo": "actions/checkout",
+      "version": "v4",
+      "sha": "11d5960a326750d5838078e36cf38b85af677262"
+    },
     "actions/checkout@v6.0.3": {
       "repo": "actions/checkout",
       "version": "v6.0.3",
@@ -24,6 +29,11 @@
       "repo": "actions/upload-artifact",
       "version": "v7.0.1",
       "sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
+    },
+    "github/gh-aw-actions/setup@v0.87.10": {
+      "repo": "github/gh-aw-actions/setup",
+      "version": "v0.87.10",
+      "sha": "bc8c008a419c5b7a29df6f5641edd35fd1c6ea85"
     }
   }
 }

.github/merge-steward.md

@@ -0,0 +1,45 @@
+# Merge Steward policy
+
+This policy was accepted on 2026-09-03 from the workflows and repository rules on
+the trusted `main` branch.
+
+## Readiness
+
+A pull request is ready when it is not a draft and fresh evidence for its exact
+head SHA has succeeded for:
+
+- `Test & Lint`
+- `Playground E2E (Playwright)`
+- `Build`
+- `Validate Python Examples`
+
+The repository currently requires neither approvals nor resolved review threads.
+Branch protection requires the authoritative `Test & Lint` check. Merge Steward
+records all four CI checks as policy requirements without adding a synthetic
+Steward status check.
+
+## Boundaries
+
+- Operation starts in `observe` mode. The reconciler writes plans only to its
+  workflow summary.
+- Existing CI remains authoritative and continues to run on every PR change.
+  No selective workflow adapter is installed.
+- OpenEvolve is advisory and branch-conditional. Copilot setup is advisory.
+- Pages build and deployment are post-merge only and never Steward-dispatched.
+- Autoloop, Goal, Evergreen, and CI Doctor remain independent automation.
+  Steward never dispatches them. Evergreen keeps its existing opt-in behavior.
+- Diagnosis is limited to exhausted deterministic handling, unknown blocking
+  failures, and maintainer-asserted policy ambiguity for the current head. Its
+  safe outputs are staged and its agent job is read-only.
+- Routine green, waiting, stale, duplicate, and already-reported states never
+  invoke a model or post a comment.
+
+## Native auto-merge
+
+Native GitHub auto-merge with squash is accepted as the eventual handoff after
+all readiness evidence is fresh. It is not live during observation. Before any
+future handoff, the deterministic reconciler must reload policy from the default
+branch, recheck the PR head and readiness, and rely on GitHub's native policy
+enforcement. It never force-pushes or lets the diagnosis agent merge.
+
+The machine-readable source of truth is `.github/merge-steward.yml`.