docs(loop): the charter the autonomous loops steer by

[AminChirazi]

The constitution merged in #186 already protects CHARTER.md — but the file didn't exist. The Scout had no direction to read, and the Ledger had no scope boundary to check a proposed gap against.

What's derived, not invented

Everything traceable to the repo is written down with its source:

• Mission — the README's positioning.
• Nine invariants — from CONTRIBUTING.md, docs/design.md, and the CI jobs that already enforce them (versions agree, the secret-scan corpus, the trace-format/schema coupling).
• Out-of-scope list — assembled from decisions the repo has already made: single Rust binary, no opencode/Node sidecar, no DataMaker dependency, six adapters and not a seventh, no selector-engine growth to match another framework's idioms.
• Priority ordering — false greens first, then broken invariants, then adoption friction.

Nine things I did not invent

Marked DECIDE inline. They need product judgement, and guessing them would have been worse than leaving them open:

	Decision
1	Commercial boundary — is anything deliberately not open-source?
2	Tier 3 (web-suite migration) — worth its noise, or declined?
3	The milestone itself (a proposal is drafted from the README's own "thinner coverage" list)
4	Ledger location — .loop/ is gitignored, so it needs a tracked home
5	Scope budget — net new public API per period
6	Token budget, and whether loops may use third-party agents' API keys
7	Escalation channel — is a needs-human label enough?
8	Identity mechanism — machine users or a GitHub App?
9	Human allowlist — currently exactly AminChirazi

Until each is resolved the loops treat that area as out of scope, which is the safe default rather than a blocker.

An invariant verified rather than asserted

Invariant 2 says replay never requires an API key. I ran it instead of writing it down: flowproof run scripts/demo/order-status.flow.yaml with ANTHROPIC_API_KEY, OPENAI_API_KEY and FLOWPROOF_AI_API_KEY all unset.

It holds. But on a clean box it first failed with:

FAIL: Support agent looks up an order — the agent made 0 model calls, the recording has 2

The real cause was the demo agent dying on ModuleNotFoundError: No module named 'openai' — and its stderr was discarded, appearing in neither stdout nor report.json. Filed as #188.

That's the same defect class as #187, on the same boundary: a real upstream failure presenting as a flowproof problem. Both join the milestone's exit criteria. Tier 2 will produce more of these, because a corpus of third-party agents fails in more ways than a demo does — which makes diagnostics quality load-bearing for the loops' own trustworthiness, not polish.

Verification

• The gate behaves correctly on this very file: allows AminChirazi, refuses loop-bot.
• The constitution check is now a required status check, so this PR exercises it for real.

Host tooling added while verifying: pip3, uv (per CONTRIBUTING.md), and the openai package the demo agent needs.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.