Control Policy

.github/workflows/cao.json is the sole persistent non-secret CAO policy authority: CAO governs rollout and target authority, while gh-aw governs engine limits, generated job topology, authentication, and safe-output execution. For the normative architecture, requirements, and compliance tests, see the Central Agentic Ops Control Architecture Specification.