feat: infrastructure-control network-verification + IP-first doctrine, plus 3 supporting contracts

- infrastructure-control: add Section 5.3 (Network Verification & Routing) with
  dual-path checks, NetBird ingress health, DNS drift detection, and routing
  regression alerts. Add Section 7 (Configuration Doctrine — IP-First) mandating
  LAN IPs for all configs/agents, URLs reserved for human browser access only.
  Also enrich access matrix (Mumuni, Koonimo, LiteLLM Admin, Grafana entries),
  reachability matrix, and CT 116 nginx routing + Prometheus targets.
- build-zulip-plugin: fold Success Criteria into Maintains postconditions.
- pi-approval-architecture: new reference doc — pi approval model vs Hermes,
  architectural limits, /approve and /deny stub commands.
- zulip-approval-fix: new responsibility — documents the Zulip HTML/prefix bug
  that broke /approve and /deny, and the one-line fix applied.

build-zulip-plugin.prose.md

@@ -14,6 +14,30 @@ description: >
 - generation_count: number — How many generations have been produced
 - last_generation: timestamp — When the last generation was created
 - known_issues: array — Issues discovered in the current version
+  
+  **Postconditions** (the plugin is GOOD when ALL pass):
+  
+  *Connectivity*
+  - connected == true — Establishes and maintains Zulip event queue
+  - reconnect_on_failure == true — Reconnects after queue expiry
+  - recovers_from_network_loss == true — Handles temporary network drops
+  
+  *Message Flow*
+  - dm_response_time_ms < 10000 — DMs get a response within 10 seconds
+  - stream_mention_detection == true — @mentions in streams are detected and routed
+  - all_bots_detection == true — @all-bots mentions are detected
+  - echo_loop_prevention == true — Never replies to its own messages
+  
+  *Code Quality*
+  - syntax_check == "pass" — All Python files are valid
+  - has_register_function == true — Exposes `register(ctx)` entry point
+  - plugin_yaml_valid == true — plugin.yaml parses correctly
+  - follows_base_adapter_pattern == true — Extends BasePlatformAdapter
+  
+  *Reliability*
+  - graceful_disconnect == true — shutdown doesn't crash
+  - handles_malformed_messages == true — Bad JSON doesn't kill the poll loop
+  - typing_indicators_work == true — Sends typing notifications
 
 ## Parameters
 
@@ -26,45 +50,19 @@ description: >
 
 The improvement cycle is **event-driven**, not just cron-based:
 
-- **On check failure**: If any Success Criteria fails, wake immediately to fix
+- **On check failure**: If any postcondition fails, wake immediately to fix
 - **On user request**: `prose run build-zulip-plugin` — explicit upgrade
 - **On new pattern**: If another plugin or agent reports a better pattern, wake to assimilate
 - **Retrospective**: Every 24 hours if no other trigger fired — scan for subtle degradation
 - **On first deploy**: Always run Generation 1 when no plugin exists yet
 
-## Success Criteria (What Makes a Plugin "Good")
-
-The plugin is considered GOOD when ALL of these pass:
-
-### Connectivity
-- plugin.connected == true — Establishes and maintains Zulip event queue
-- plugin.reconnect_on_failure == true — Reconnects after queue expiry
-- plugin.recovers_from_network_loss == true — Handles temporary network drops
-
-### Message Flow
-- dm_response_time_ms < 10000 — DMs get a response within 10 seconds
-- stream_mention_detection == true — @mentions in streams are detected and routed
-- all_bots_detection == true — @all-bots mentions are detected
-- echo_loop_prevention == true — Never replies to its own messages
-
-### Code Quality
-- syntax_check == "pass" — All Python files are valid
-- has_register_function == true — Exposes `register(ctx)` entry point
-- plugin_yaml_valid == true — plugin.yaml parses correctly
-- follows_base_adapter_pattern == true — Extends BasePlatformAdapter
-
-### Reliability
-- graceful_disconnect == true — shutdown doesn't crash
-- handles_malformed_messages == true — Bad JSON doesn't kill the poll loop
-- typing_indicators_work == true — Sends typing notifications
-
 ## Remembers
 
 Each generation stores:
 - What worked well (success patterns)
 - What broke (failure modes)
 - What the user complained about (pain points)
-- Which Success Criteria passed and failed
+- Which postconditions passed and failed
 
 ## Generation Rules