feat: bootstrap workspace with CI, typecheck, and import guardrails

docs/license-and-provenance.md

@@ -0,0 +1,40 @@
+# License and Provenance
+
+## Source Licenses
+
+- **BitVid:** GPL-3.0-or-later
+- **BitRoad:** MIT
+
+## Derived Works
+
+This repository combines:
+
+1. **Original architectural work** (MIT)
+   - Workspace structure
+   - Core target model
+   - Policy engine design
+
+2. **GPL-encumbered behavior** (must remain GPL-compatible)
+   - BitVid moderation thresholds
+   - Trust seed behavior
+   - Report aggregation rules
+
+3. **MIT-licensed reference concepts**
+   - BitRoad addressable targets
+   - Storefront/product identifiers
+
+## Compliance Strategy
+
+- Core policy engine is MIT-licensed original work
+- BitVid-compat adapter is GPL-3.0-or-later
+- Clear separation between:
+  - Generic governance interfaces (MIT)
+  - BitVid-specific behavior (GPL)
+
+## Audit Trails
+
+All extracted behavior is documented in:
+
+- `fixtures/bitvid/` (input/output pairs)
+- `docs/reference-map.md` (source locations)
+- Commit history (clean room steps)

docs/reference-map.md

@@ -0,0 +1,25 @@
+# Reference Map
+
+## Pinned Versions
+
+- **BitVid:** `4525c1c` (2026-07-26)
+- **BitRoad:** `bcd6c8e` (2026-07-26)
+
+## Core Module References
+
+| Module | BitVid Source | BitRoad Source | Purpose |
+|--------|---------------|----------------|---------|
+| identifiers | - | `src/commerce/address.mjs` | Coordinate parsing |
+| targets | `js/services/moderationUtils.js` | `src/commerce/storefronts.mjs` | Addressable target model |
+| authority | `js/accessControl.js` | - | Role resolution |
+| policy | `js/services/moderationService.js` | - | Threshold handling |
+
+## License Provenance
+
+BitVid is licensed under GPL-3.0-or-later. This repository contains:
+
+- **Original work:** New architecture, neutral target model
+- **Derivative work:** Behavior extracted from BitVid fixtures
+- **Reference-only:** BitRoad address semantics
+
+Consult `docs/license-and-provenance.md` for detailed audit trails.