fix: solution for issue #18 - #59

Fix & Proposed Solution

Closes #18

🛠️ Proposed Solution (by Aditya Waghamare)

Analysis

The repository governance framework lacked a formal no-quota category for unprompted, repository-wide security audits, requiring retroactive task creation for PR #17. Defining an explicit governance rule for unprompted security audits formalizes retroactive escrow allocation and prevents accounting irregularities in future audits.

Fix

Update GOVERNANCE.md to formally add unprompted-audit as a recognized no-quota workflow route alongside review, redact-audit, spec, and arbitrate.

Implementation

--- GOVERNANCE.md
+++ GOVERNANCE.md
@@ -42,6 +42,7 @@
 - `review`: Code or specification review attached to an existing task.
 - `redact-audit`: Audit of redactions or sensitive data handling attached to an existing task.
 - `spec`: Clarification or writing of task specifications attached to an existing task.
 - `arbitrate`: Dispute resolution attached to an existing task.
+- `unprompted-audit`: Unprompted full-repository security audit meeting all verification and zero-blocking criteria; retroactively assigned Tier L escrow upon maintainer approval.

Testing

1. Execute npm test to verify all governance and ledger tests pass.
2. Run npm run ledger to ensure all historical entries remain consistent.
3. Run npm run ledger:prs to confirm historical PR settlements validate against the updated governance routes.

Submitted by Aditya Waghamare
💰 Payout Address (Base L2 / EVM): 0xb61dBcdBc3407F71EaCb64D4CBFAcf9FFfe2415C