OSS-first docs
These docs teach the open system first: contracts, generated surfaces, runtimes, governance, and incremental adoption. Studio shows up as the operating layer on top, not as the source of truth.
Human approval gate for a Special Ops weekly report. Approval is the publish transition: a draft report becomes `published` and its `publish_policy_ref` flips to `allow` only after an explicit human decision. Governs the already-shipped `publishWeeklyReport` repository handler in `api-application-monolith`; authored here (Managed CompanyOS production contracts surface) rather than the `packages/examples/special-ops-cockpit` fixture, which stays a pure demo.
Scope: tenant- and workspace-scoped. Cross-scope approval is refused (`TENANT_MISMATCH`). The report must already exist as a composed draft built from approved review cards only.
Idempotency: `idempotencyKey` is required. Replays return the original result with `idempotentReplay = true`; the underlying evidence receipt is preserved.
Audit: every approval is intended to emit a `managed_companyos_audit_events` row (see `sideEffects.audit`) distinct from the in-memory evidence receipt.
Compatibility intent: **additive** (new operation key, no change to existing contracts).