fix: make workspace install under npm and enforce real guardrails

Replace pnpm-only workspace: protocol with npm workspace deps, pin BitVid and
BitRoad reference commits, add Node types, and make the reference-import check
scan package graphs and source for forbidden bitvid/bitroad imports.

docs/checkpoints.md

@@ -0,0 +1,28 @@
+# Checkpoints
+
+## Checkpoint 0 — Repo skeleton (current)
+
+Delivered:
+- npm workspaces monorepo
+- Node 22 + ESM
+- five empty packages under `packages/`
+- Vitest harness
+- TypeScript JSDoc typecheck
+- GitHub Actions CI
+- reference import guard
+- provenance docs
+
+Validation:
+```bash
+npm install
+npm run check:references
+npm run typecheck
+npm test
+npm run build:types
+```
+
+Gate: do not add runtime or BitVid codecs until fixture corpus exists.
+
+## Next checkpoint
+
+Checkpoint 1 — BitVid fixture and conformance corpus only.

docs/license-and-provenance.md

@@ -1,40 +1,46 @@
 # License and Provenance
 
-## Source Licenses
+## Reality check
 
-- **BitVid:** GPL-3.0-or-later
-- **BitRoad:** MIT
+BitVid is GPL-3.0-or-later. Direct ports of BitVid logic or structure into this
+repository create a derivative-work obligation. Do not pretend extracted
+behavior is clean-room MIT unless it truly is independent work.
 
-## Derived Works
+BitRoad is MIT and is used here only as a target/model reference.
 
-This repository combines:
+## Working stance for this repo
 
-1. **Original architectural work** (MIT)
-   - Workspace structure
-   - Core target model
-   - Policy engine design
+Until a lawyer-ready SPDX audit is done, treat the repository as:
 
-2. **GPL-encumbered behavior** (must remain GPL-compatible)
-   - BitVid moderation thresholds
-   - Trust seed behavior
-   - Report aggregation rules
+1. **Tooling / scaffolding** — original workspace layout, CI, docs structure.
+2. **Likely GPL-encumbered governance behavior** — anything characterized from
+   BitVid moderation thresholds, trust seeds, admin lists, report dedupe, mute
+   expiry, and related evaluator precedence.
+3. **MIT-compatible address concepts** — BitRoad coordinate shapes, used as
+   consumer validation cases rather than copied UI/runtime code.
 
-3. **MIT-licensed reference concepts**
-   - BitRoad addressable targets
-   - Storefront/product identifiers
+## Package boundary intention
 
-## Compliance Strategy
+| Package | Intention |
+| --- | --- |
+| `@nostr-governance/core` | Clean API surface + pure evaluator. Avoid BitVid names. |
+| `@nostr-governance/nostr` | Codecs. Legacy BitVid codec is provenance-sensitive. |
+| `@nostr-governance/runtime` | Transport/storage orchestration. |
+| `@nostr-governance/bitvid-compat` | Explicit BitVid-facing adapter. Most provenance-exposed. |
+| `@nostr-governance/testing` | Fakes and fixture loaders. |
 
-- Core policy engine is MIT-licensed original work
-- BitVid-compat adapter is GPL-3.0-or-later
-- Clear separation between:
-  - Generic governance interfaces (MIT)
-  - BitVid-specific behavior (GPL)
+## Rules
 
-## Audit Trails
+- No direct imports from BitVid or BitRoad source trees.
+- Fixtures copied into this repo must record the source commit in README or metadata.
+- If a module is ported from BitVid rather than rewritten cleanly, document it in
+  the PR and keep SPDX compatible with GPL-3.0-or-later.
+- Do not dual-license the whole monorepo casually. Prefer one root LICENSE once
+  chosen, and call out adapter exceptions only if they are scoped carefully.
 
-All extracted behavior is documented in:
+## Open decision (checkpoint 0)
 
-- `fixtures/bitvid/` (input/output pairs)
-- `docs/reference-map.md` (source locations)
-- Commit history (clean room steps)
+Root license has not been finalized in this bootstrap.
+Recommended default for continued extraction work: **GPL-3.0-or-later**.
+
+Decision needed from owner before publishing packages.

docs/reference-map.md

@@ -1,25 +1,39 @@
 # Reference Map
 
-## Pinned Versions
+BitVid and BitRoad are **read-only reference repositories**.
+This repo must not import their source trees.
 
-- **BitVid:** `4525c1c` (2026-07-26)
-- **BitRoad:** `bcd6c8e` (2026-07-26)
+## Pinned reference commits
 
-## Core Module References
+| Repo | Short | Full |
+| --- | --- | --- |
+| BitVid | `726c0d26` | `726c0d26ed98bf08e923ab895d23d0b5ac9ae173` |
+| BitRoad | `bcd6c8e` | `bcd6c8efbd142d8923e7d4110432bdfa0a6cd2a2` |
 
-| Module | BitVid Source | BitRoad Source | Purpose |
-|--------|---------------|----------------|---------|
-| identifiers | - | `src/commerce/address.mjs` | Coordinate parsing |
-| targets | `js/services/moderationUtils.js` | `src/commerce/storefronts.mjs` | Addressable target model |
-| authority | `js/accessControl.js` | - | Role resolution |
-| policy | `js/services/moderationService.js` | - | Threshold handling |
+Pinned on 2026-07-26 from local checkouts under `/home/user/Documents/GitHub/`.
 
-## License Provenance
+## Behavioral references (BitVid)
 
-BitVid is licensed under GPL-3.0-or-later. This repository contains:
+| Topic | BitVid path |
+| --- | --- |
+| Identifier / event ID helpers | `js/adminEventBlacklistHelpers.js` |
+| Access control / roles | `js/accessControl.js` |
+| Admin list persistence | `js/adminListStore.js` |
+| Community blacklist batching | `js/adminListBatch.js` |
+| Trust seeds | `js/services/trustBootstrap.js` |
+| Report / mute aggregation | `js/services/moderationService.js` |
+| Threshold / utility helpers | `js/services/moderationUtils.js` |
+| Video presentation mapping | `js/services/moderationDecorator.js` |
 
-- **Original work:** New architecture, neutral target model
-- **Derivative work:** Behavior extracted from BitVid fixtures
-- **Reference-only:** BitRoad address semantics
+## Structural references (BitRoad)
 
-Consult `docs/license-and-provenance.md` for detailed audit trails.
+| Topic | BitRoad path |
+| --- | --- |
+| Address coordinates | `src/commerce/address.mjs` |
+| Storefront replaceables | `src/commerce/storefronts.mjs` |
+| Product replaceables | `src/commerce/product.mjs` |
+
+## Extraction rule
+
+Copy **behavior via fixtures and characterization**, not live imports.
+Package source that imports BitVid/BitRoad fails `npm run check:references`.