Add Ledger governance and raw fact boundary checks

.github/CODEOWNERS

@@ -0,0 +1,11 @@
+# Ledger source-data changes require PolicyEngine core review.
+* @PolicyEngine/core-developers
+
+# Source contracts, source packages, and governance metadata are especially
+# sensitive because downstream Populace and Thesis builds consume them directly.
+/packages/** @PolicyEngine/core-developers
+/ledger/** @PolicyEngine/core-developers
+/policyengine_ledger/** @PolicyEngine/core-developers
+/docs/** @PolicyEngine/core-developers
+/.github/ledger-agents.yml @PolicyEngine/core-developers
+/AGENTS.md @PolicyEngine/core-developers

.github/ledger-agents.yml

@@ -0,0 +1,62 @@
+schema_version: policyengine_ledger.approved_agents.v1
+owners:
+  github_team: PolicyEngine/core-developers
+approved_agents:
+  - id: ledger-source-ingestor
+    purpose: Add or update source packages that emit raw publisher-backed facts.
+    allowed_paths:
+      - packages/**
+      - ledger/jurisdictions/**
+      - ledger/sources/**
+      - tests/test_ledger_*.py
+      - tests/test_source_*.py
+      - tests/test_etl_*.py
+    required_deterministic_checks:
+      - source-package validation
+      - source-cell preservation
+      - consumer-contract validation
+      - raw-facts boundary validation
+    required_judges:
+      - ledger-source-fidelity
+      - ledger-boundary
+  - id: ledger-target-profile-author
+    purpose: Add source-backed target profiles and model measurement contracts without target values.
+    allowed_paths:
+      - policyengine_ledger/target_profiles/**
+      - ledger/targets/**
+      - tests/test_policyengine_ledger_target_profiles.py
+      - tests/test_us_poverty_target_coverage.py
+    required_deterministic_checks:
+      - no embedded target values
+      - sum-only operation
+      - selector references raw Ledger facts
+    required_judges:
+      - ledger-target-profile
+      - ledger-boundary
+  - id: ledger-contract-maintainer
+    purpose: Change Ledger schemas, identity, provenance, or consumer contracts.
+    allowed_paths:
+      - ledger/core.py
+      - ledger/consumer_contract.py
+      - policyengine_ledger/**
+      - docs/schemas/**
+      - tests/test_ledger_consumer_contract.py
+      - tests/test_ledger_core.py
+      - tests/test_policyengine_ledger_imports.py
+    required_deterministic_checks:
+      - schema validation
+      - consumer-contract validation
+      - package import compatibility
+      - raw-facts boundary validation
+    required_judges:
+      - ledger-contract
+      - ledger-boundary
+required_judges:
+  ledger-source-fidelity:
+    verdict: PASS if every new fact is directly traceable to publisher bytes/cells and no source values are invented.
+  ledger-target-profile:
+    verdict: PASS if profiles contain selectors and measurement contracts only, with no target values or active calibration decisions.
+  ledger-contract:
+    verdict: PASS if schema or identity changes preserve source provenance and do not move Populace responsibilities into Ledger.
+  ledger-boundary:
+    verdict: PASS if reconciliation, aging, imputation, support-aware activation, and solver construction remain outside Ledger.

.github/pull_request_template.md

@@ -0,0 +1,21 @@
+## Summary
+
+## Ledger Governance
+
+For any source package, target profile, consumer contract, schema, or source-data
+boundary change:
+
+- Approved Ledger agent role:
+  - `ledger-source-ingestor`
+  - `ledger-target-profile-author`
+  - `ledger-contract-maintainer`
+- Deterministic checks run:
+- LLM judge verdicts:
+  - `ledger-source-fidelity`:
+  - `ledger-target-profile`:
+  - `ledger-contract`:
+  - `ledger-boundary`:
+
+If this PR does not touch the Ledger source-data boundary, say so here.
+
+## Tests

.github/workflows/ci.yml

@@ -5,8 +5,8 @@ on:
   push:
 
 jobs:
-  arch:
-    name: Arch checks
+  ledger:
+    name: Ledger checks
     runs-on: ubuntu-latest
 
     steps:
@@ -24,75 +24,24 @@ jobs:
       - name: Install dependencies
         run: uv sync --locked --all-extras
 
-      - name: Lint Arch surface
+      - name: Lint Ledger surface
         run: >
           uv run ruff check
-          arch
-          db/cli.py
-          db/etl_snap.py
-          db/etl_aca_enrollment.py
-          db/etl_medicaid.py
-          db/etl_ssi.py
-          db/pe_source_inventory.py
-          db/schema.py
-          db/supabase_client.py
-          db/source_files.py
-          micro/us/census/download_cps.py
-          micro/us/entities.py
-          micro/us/hierarchy_validation.py
-          micro/us/hierarchical_pipeline.py
-          micro/us/pipeline.py
-          micro/us/policyengine.py
-          micro/us/targets.py
-          micro/us/validation_dashboard.py
-          calibration/constraints.py
-          calibration/targets.py
-          tests/test_arch_facts.py
-          tests/test_arch_namespace.py
-          tests/test_arch_normalization.py
-          tests/test_etl_snap.py
-          tests/test_etl_soi.py
-          tests/test_etl_aca_enrollment.py
-          tests/test_etl_medicaid.py
-          tests/test_etl_ssi.py
-          tests/test_source_files.py
-          tests/test_microplex_entities.py
-          tests/test_microplex_hierarchy_validation.py
-          tests/test_microplex_target_adapter.py
-          tests/test_microplex_pipeline.py
-          tests/test_microplex_policyengine.py
-          tests/test_download_cps.py
-          tests/test_hierarchical_pipeline.py
-          tests/test_supabase_client.py
+          ledger
+          policyengine_ledger
+          db
+          scripts
+          tests
 
-      - name: Test Arch surface
+      - name: Test Ledger surface
         run: >
-          uv run pytest
-          tests/test_arch_facts.py
-          tests/test_arch_namespace.py
-          tests/test_arch_normalization.py
-          tests/test_etl_snap.py
-          tests/test_etl_soi.py
-          tests/test_etl_aca_enrollment.py
-          tests/test_etl_medicaid.py
-          tests/test_etl_ssi.py
-          tests/test_source_files.py
-          tests/test_calibration.py
-          tests/test_microplex_entities.py
-          tests/test_microplex_hierarchy_validation.py
-          tests/test_microplex_target_adapter.py
-          tests/test_microplex_pipeline.py
-          tests/test_microplex_policyengine.py
-          tests/test_download_cps.py
-          tests/test_hierarchical_pipeline.py
-          tests/test_supabase_client.py
-          -q
+          uv run pytest -q
 
-      - name: Build target input database
+      - name: Build source input database
         run: |
-          uv run arch --db /tmp/arch-targets-ci.db init
-          uv run arch --db /tmp/arch-targets-ci.db load all
-          uv run arch --db /tmp/arch-targets-ci.db stats
+          uv run ledger --db /tmp/ledger-targets-ci.db init
+          uv run ledger --db /tmp/ledger-targets-ci.db load all
+          uv run ledger --db /tmp/ledger-targets-ci.db stats
 
       - name: Build wheel
         run: |
@@ -102,21 +51,16 @@ jobs:
       - name: Test wheel install
         run: |
           wheel_path="$(find dist -name '*.whl' -print -quit)"
-          uv venv /tmp/arch-wheel-smoke --python 3.14
-          uv pip install --python /tmp/arch-wheel-smoke/bin/python "$wheel_path"
+          uv venv /tmp/ledger-wheel-smoke --python 3.14
+          uv pip install --python /tmp/ledger-wheel-smoke/bin/python "$wheel_path"
           cd /tmp
-          /tmp/arch-wheel-smoke/bin/python - <<'PY'
-          import arch
-          import arch.targets
-          from micro.us.district import DistrictMicroplex
-          from micro.us.pipeline import run_pipeline
-          from micro.us.targets import load_microplex_targets
-          from microplex import ConditionalMAF
+          /tmp/ledger-wheel-smoke/bin/python - <<'PY'
+          import policyengine_ledger
+          import policyengine_ledger.normalization
+          import policyengine_ledger.sources
+          import policyengine_ledger.target_profiles
+          import policyengine_ledger.targets
 
-          assert arch.__name__ == "arch"
-          assert DistrictMicroplex is not None
-          assert run_pipeline is not None
-          assert load_microplex_targets is not None
-          assert ConditionalMAF is not None
+          assert policyengine_ledger.__name__ == "policyengine_ledger"
           PY
-          /tmp/arch-wheel-smoke/bin/arch --help >/dev/null
+          /tmp/ledger-wheel-smoke/bin/ledger --help >/dev/null

AGENTS.md

@@ -0,0 +1,17 @@
+# Ledger Agent Rules
+
+Ledger is a source-backed fact store. It may parse publisher artifacts, normalize
+representation, preserve provenance, and declare target-profile contracts.
+
+Do not put Populace work in Ledger:
+
+- no cross-source reconciliation
+- no aging to a build year
+- no imputation
+- no support-aware target activation
+- no solver-ready target construction
+- no target values in target profiles
+
+Only approved Ledger agent roles in `.github/ledger-agents.yml` should add or
+modify source packages, target profiles, or contract schemas. Source-data PRs
+need deterministic validation plus the listed Ledger judge reviews before merge.