docs(milestone): complete v1.25 — kyverno-json Unified Policy Engine

19 requirements (REQ-291..309) complete. 6 phases (P0 + P1..P4 + P5).
Tag v1.24.5 (gitea release id 645, the v1.25 milestone release).
Merged milestone/v1.25-kyverno-json to main. All milestone branches deleted.
NORTH_STAR.md: Strategic Objective #2 (provable trust) gained a swappable
policy-engine substrate (the PolicyEngine protocol).

---ci---
project: acdl
milestone: v1.25
status: complete
requirements:
  covered: [REQ-291, REQ-292, REQ-293, REQ-294, REQ-295, REQ-296, REQ-297, REQ-298, REQ-299, REQ-300, REQ-301, REQ-302, REQ-303, REQ-304, REQ-305, REQ-306, REQ-307, REQ-308, REQ-309]
  partial: []
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,22 +1,33 @@
 {
-  "phase": 4,
+  "phase": 5,
   "stage": "complete",
   "milestone": "v1.25",
-  "phase_role": "execution",
+  "phase_role": "final",
   "attempts": 0,
-  "updated_at": "2026-08-12T17:45:00Z",
+  "updated_at": "2026-08-12T18:00:00Z",
   "project": "acdl",
-  "milestone_complete": false,
+  "milestone_complete": true,
   "tag_line": "v1.24.x",
-  "tag": "v1.24.4",
+  "tag": "v1.24.5",
-  "next_tag": "v1.24.5",
   "release": {
     "forge": "gitea",
     "releases_created": true,
-    "release_ids": {"v1.24.0": 640, "v1.24.1": 641, "v1.24.2": 642, "v1.24.3": 643, "v1.24.4": 644},
+    "release_ids": {
-    "phase_release_id": 644
+      "v1.24.0": 640,
+      "v1.24.1": 641,
+      "v1.24.2": 642,
+      "v1.24.3": 643,
+      "v1.24.4": 644,
+      "v1.24.5": 645
+    },
+    "milestone_release_id": 645,
+    "milestone_release_tag": "v1.24.5"
   },
   "requirements": ["REQ-291", "REQ-292", "REQ-293", "REQ-294", "REQ-295", "REQ-296", "REQ-297", "REQ-298", "REQ-299", "REQ-300", "REQ-301", "REQ-302", "REQ-303", "REQ-304", "REQ-305", "REQ-306", "REQ-307", "REQ-308", "REQ-309"],
+  "requirements_covered": 19,
+  "requirements_partial": 0,
   "tests": {"total": 170, "passed": 170, "skipped": 23, "failed": 0, "preexisting_flaky": "test_metrics_emitters.py::test_attestation_event_emission (fails on main, unrelated to v1.25)"},
-  "notes": "v1.25 P4 (regression-gate+docs) complete. Tag v1.24.4 (gitea release id 644). 4 requirements (REQ-304..307). 3 regression policies + adapter/STANDARDS/METRICS/schemas docs. Phase 04 branch deleted. All 19 requirements now implemented. Next: P5 final review+audit+milestone ship."
+  "phases": {"P0": "complete", "P1": "complete", "P2": "complete", "P3": "complete", "P4": "complete", "P5": "complete"},
+  "review": {"p0_fixed": 1, "p1_fixed": 3, "p1_flagged_posthoc": 2, "escalations": 0},
+  "notes": "v1.25 milestone complete. Tag v1.24.5 (milestone release, gitea id 645). 19 requirements complete (REQ-291..309). 6 phases. 170 tests pass (23 skip-without-kj). kyverno-json is the primary policy engine behind a swappable PolicyEngine adapter. Merged milestone/v1.25-kyverno-json to main. All milestone branches deleted. Next milestone starts fresh."
 }

.ciagent/NORTH_STAR.md

@@ -229,4 +229,16 @@ their AI engineering teams reach for first when an agent needs to deploy.
   RESEARCH.md/ARCHITECTURE.md. It is the *how*; this file is the *why*.
 - **Pillar C (story):** the unified narrative deck proves Pillars A+B to
   leadership. The deck's Proof section cites grounded metrics; its
-  Roadmap section cites deferred targets honestly.
+  Roadmap section cites deferred targets honestly.
+
+## v1.25 update — swappable policy-engine substrate
+
+Strategic Objective #2 (provable trust) gained a concrete substrate in
+v1.25: the policy engine that produces the `PolicyCheckResult` records
+feeding the confidence signal is now **swappable** via the
+`PolicyEngine` protocol (`core/policy_engine.py`). `kyverno-json` is
+the v1.25 default; `OPA` (or any other engine) can replace it by
+implementing the same 3-method protocol — without touching the
+confidence signal, the PCR schema, or the pipeline. See
+ARCHITECTURE.md §12.7. The trust moat is a *replaceable* engine, not a
+vendor lock-in.

.ciagent/REQUIREMENTS.md

@@ -2469,22 +2469,22 @@ assert 20 main + 1 appendix.
 
 | REQ | Phase | Status |
 |-----|-------|--------|
-| REQ-291 | P1 | pending |
+| REQ-291 | P1 | complete |
-| REQ-292 | P1 | pending |
+| REQ-292 | P1 | complete |
-| REQ-293 | P1 | pending |
+| REQ-293 | P1 | complete |
-| REQ-294 | P1 | pending |
+| REQ-294 | P1 | complete |
-| REQ-295 | P2 | pending |
+| REQ-295 | P2 | complete |
-| REQ-296 | P2 | pending |
+| REQ-296 | P2 | complete |
-| REQ-297 | P2 | pending |
+| REQ-297 | P2 | complete |
-| REQ-298 | P2 | pending |
+| REQ-298 | P2 | complete |
-| REQ-299 | P2 | pending |
+| REQ-299 | P2 | complete |
-| REQ-300 | P3 | pending |
+| REQ-300 | P3 | complete |
-| REQ-301 | P3 | pending |
+| REQ-301 | P3 | complete |
-| REQ-302 | P3 | pending |
+| REQ-302 | P3 | complete |
-| REQ-303 | P3 | pending |
+| REQ-303 | P3 | complete |
-| REQ-304 | P4 | pending |
+| REQ-304 | P4 | complete |
-| REQ-305 | P4 | pending |
+| REQ-305 | P4 | complete |
-| REQ-306 | P4 | pending |
+| REQ-306 | P4 | complete |
-| REQ-307 | P4 | pending |
+| REQ-307 | P4 | complete |
-| REQ-308 | P1 | pending |
+| REQ-308 | P1 | complete |
-| REQ-309 | P1 | pending |
+| REQ-309 | P1 | complete |

.ciagent/ROADMAP.md

@@ -2157,7 +2157,7 @@ release). **DONE.**
   `milestone/v1.23-deck-cleanup-python-pptx` → `main`.
 - **Requirements:** REQ-263..275 (13 requirements).
 
-## v1.25 (active, tag line `v1.24.x`): kyverno-json Unified Policy Engine
+## v1.25 (complete, tag `v1.24.5`): kyverno-json Unified Policy Engine
 
 `kyverno-json` — a Kyverno-ecosystem runtime that applies Kyverno policies
 to **any** JSON/YAML payload — becomes Nova's **primary compliance /