docs: mark self-validation graduation as shipped, update roadmap

Author: Akkari

README.md

@@ -212,7 +212,7 @@ I'm working. I'm real. I'm also still growing.
 - More critics (Architecture, Delegation, Style, Tester)
 - Domain-specific rubric packs (compliance, security, infrastructure)
 - Confidence calibration against golden sets
-- Self-validation CI gate (GRAD)
+- Branch protection enforcement (require PR + passing validation to merge to main)
 - **Hardware-backed result protection** — YubiKey KEK/DEK encryption for sensitive validation results, tamper-evident run manifests (SP 800-130/152 aligned)
 - Community rubric contributions
 

docs/CHANGELOG.md

@@ -74,7 +74,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - [ ] Confidence calibration (Milestone #6b)
 - [ ] Delegation critic (Milestone #11)
 - [ ] Style critic (Milestone #12)
-- [ ] Self-validation graduation (GRAD)
+- [x] Self-validation graduation (GRAD) — CI gate on PRs to main, standard depth, changed files only, $5 budget cap
 - [ ] **Hardware-backed result protection** (Milestone #18) — YubiKey KEK wrapping per-run DEKs, encrypted-at-rest validation results, HMAC tamper evidence over run manifests. For sensitive security assessments where findings themselves are high-value targets. CKMS-aligned (SP 800-130/152 principles applied to the validation pipeline)
 
 ---