Session 38 instruction hardening

[MarcoPolo483]

No description provided.

[Copilot]

Pull request overview

This PR updates the EVA Data Model “Session 38” guidance and layer registries, aiming to reflect a “paperless governance” workflow and an expanded set of layers in the API.

Changes:

• Expands the layer registries in api/routers/admin.py and scripts/seed-cosmos.py to include additional “infrastructure monitoring” layers.
• Updates the agent guide payload in api/server.py with clearer write semantics (PUT-only) and additional “common mistakes”.
• Refreshes documentation (README/STATUS/USER-GUIDE/library ref) and adds a Session 38 completion record.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 20 comments.

Show a summary per file

File	Description
scripts/seed-cosmos.py	Updates seed layer registry and comments to reflect expanded layers.
api/routers/admin.py	Updates _LAYER_FILES registry used by seed/export/commit workflows.
api/server.py	Enhances /model/agent-guide write-cycle guidance and common mistakes.
api/cache/redis_client.py	Adds from __future__ import annotations for typing compatibility.
docs/library/03-DATA-MODEL-REFERENCE.md	Updates library reference to “51-layer” framing and Session 38 notes.
USER-GUIDE.md	Adds “paperless governance” guidance and expanded usage patterns.
STATUS.md	Rewrites the top status section to describe Session 38 outcomes.
README.md	Updates cloud URL and adds “paperless governance” section.
.github/SESSION-38-PAPERLESS-GOVERNANCE-COMPLETE.md	Adds a new Session 38 completion document.

Comments suppressed due to low confidence (1)

docs/library/03-DATA-MODEL-REFERENCE.md:90

• This write-cycle description codifies that all non-admin writes only require an X-Actor header and no real authentication or authorization, which matches the current FastAPI implementation where PUT /model/{layer}/{id} depends on get_actor (falling back to default_actor='anonymous') with no additional checks. Any party that can reach this API can therefore upsert or soft-delete any object across all 51 layers (including project_work, risks, decisions, evidence, and infrastructure monitoring data) simply by sending PUT/DELETE requests with a chosen X-Actor value. Require a proper authenticated principal for these routes (e.g., bearer token validated in a dependency or upstream gateway) and limit unauthenticated access to read-only endpoints, using X-Actor only for audit tagging.

  WRITE CYCLE (3-step preferred) - Session 38 CORRECTED  
  --------------------------------
  Authentication: X-Actor header (NO FOUNDRY_TOKEN needed)
  Write method: PUT with ID in URL (NO POST support)
  
  1. PUT /model/{layer}/{id}      -Headers @{'X-Actor'='agent:copilot'}
  2. GET /model/{layer}/{id}      assert row_version == prev + 1
  3. POST /model/admin/commit     -Headers @{'Authorization'='Bearer dev-admin'}
     -> response.status == 'PASS'  AND  response.violation_count == 0