Migration: this repo keeps only the policy algebra, the Lua reference interpreter, the docs and the Python example host — everything else moves out or is deleted

[jmlago]

Owner decision (2026-06-12): with Σ_pol merged (#2) and the engine repaired (#3), this repo's contents must converge to its confirmed telos — definition + protocol + default interpreter. The membership test for any file: does a non-Lua host need it to be conformant?

Stays

• The protocol: docs/SIGMA-POL.md, tests/golden/ (+ gen_vectors.lua)
• The algebra + reference interpreter: llm_policy/{sig,term,fields,interp,elaborate,ir}.lua and the verbs llm_policy/{filter,rank,mutate,sequence,policy,candidate,util}.lua
• The documentation: README.md, docs/POLICY_DESIGN.md (engine sections rewritten/removed)
• example_host/ (Python, already exists): the embedding demonstration
• Product tests: ir_*, policy_verbs, filter, parity, _assert, _json + a minimal test harness (fixtures, no loop)

Goes (moves out) or is deleted

• llm_policy.lua — the engine (~1100 lines): CATALOG/config resolution, RUNTIME (breakers, EMA, TTL'd disables, discovery), build_ctx, execute/execute_step, traces, provider_status, state snapshots, metrics seeding. It moves out repaired (Audit fixes, reworked: TTL'd disables, breaker fault attribution, quality seed, provider_status on shared recovery views #3 was the pre-gate).
• router.lua (compat shim), config.example.lua, metrics.example.lua
• genvm/ (dispatch + overlays — host adapter; follows the engine)
• Engine tests: execute, execute_step, provider_status, price_enrichment, profile_inheritance, weights_and_score, derive_needs, declarative_policy, smoke_rank

Seams to pin BEFORE the cut

1. The ctx contract (ctx.state.{ema, breakers, disabled, credits} shapes) — today implicit between engine and verbs; it becomes THE product↔runtime interface. Document it normatively or the two sides will drift.
2. The declarative profile schema elaborate consumes — becomes a shared contract.
3. Dependency direction: the runtime repo depends on llm-policy, never the reverse.
4. Minimal CI here first (suite + golden diff): verification across two repos with no CI is double blindness.

Gates

• Gate 0 ✅ engine repaired before moving (Audit fixes, reworked: TTL'd disables, breaker fault attribution, quality seed, provider_status on shared recovery views #3).
• Gate 1: seams pinned + CI.
• Gate 2: the cut — A/B: the union of both repos' suites = today's 495, zero loss.
• Gate 3: verifiable cleanliness — grep -rn 'RUNTIME\|CATALOG\|host\.' llm_policy/ → zero hits outside comments; router.lua gone; README no longer promises a loop.

Destination of the engine (new llm-router repo vs the subzero ecosystem host repo): owner's call at execution time.