Governance
Key-based input admission and explicit governance integration limits.
Nexus::add_input_strand identifies an input using hex::encode(strand.public_key()). The current implementation passes that writer key into organization-named governance fields. It does not resolve organization membership from a DID string.
GovernanceAuthority supports SingleKey, MultiKeyThreshold { founders, threshold } and OrganizationList. GovernancePolicy has approval/denial lists, an approval requirement, same-organization configuration and an optional agent cap. Denials are checked before approvals. With explicit approval required, founder records are verified using the configured keys; the threshold counts verified founder approvals.
These structures only apply when supplied as NexusConfig.governance. Nexus::with_policy separately installs an entry-level NexusPolicy::allow hook. A policy object sitting in a local variable does not enforce admission.
get_agent_count_for_org currently returns zero because organization identity integration is removed. Do not describe max_agents_per_org as a working count of live organizational membership. Auto-update also requires both the nexus-auto-update Cargo feature and config.auto_update; its task uses spawn_local, so the runtime must provide a local-task context.
