Assure Passport

Start here.

One signed record per consequential agent change: purpose → permission → approval → deployment → observed behaviour, before anything ships.