docs(backlog): split external coordination

docs/roadmap/production-grade-9x.md

@@ -113,6 +113,14 @@ API_BASE_REF=<latest-verified-supported-tag> \
 `REL-000` must designate the verified v4 baseline before a v4 release ticket
 uses it in `API_BASE_REF`.
 
+## External coordination rule
+
+GitHub configuration, protected credentials, published tags/artifacts,
+independent review, adopter participation, and elapsed-time proof are owned by
+`EXT-*` tickets only. Referenced implementation tickets may become `[pr]` when
+their local source, generated files, documentation, checks, and `Refs:` commit
+are complete; they need `EXT-*` evidence only to become `[x]`.
+
 ---
 
 # Delivery milestones
@@ -127,6 +135,86 @@ uses it in `API_BASE_REF`.
 
 ---
 
+# [ ] EPIC EXT: External coordination and evidence
+
+**Goal:** Track non-local authority and time-based proof separately from local implementation.
+
+## [pr] EXT-001: Reconcile GitHub project and ticket evidence
+
+**Owner:** GitHub administrator
+**Unblocks:** PRG-001 and all `[x]` transitions
+
+Create required labels/project items and record merged ticket SHAs.
+
+## [ ] EXT-002: Apply and verify repository protections
+
+**Owner:** GitHub administrator
+**Unblocks:** CI-003, SEC-001, SEC-002, GOV-001 through GOV-003
+
+Apply branch/tag/ruleset, CodeQL, secret-scanning, push-protection, and required-check settings; attach authenticated governance evidence.
+
+## [ ] EXT-003: Configure provider sandbox and collect live evidence
+
+**Owner:** Provider account administrator
+**Unblocks:** TST-004
+
+Configure protected Stripe, Resend, and Clerk/OIDC credentials and record sanitized scheduled evidence.
+
+## [ ] EXT-004: Verify and publish v4 trust-repair release
+
+**Owner:** Release maintainer
+**Unblocks:** REL-000 through REL-005 and FIN-001
+
+Resolve tag/module identity and publish only from protected release evidence.
+
+## [ ] EXT-005: Publish verifiable CLI artifacts
+
+**Owner:** Release maintainer
+**Unblocks:** CLI-005
+
+Publish protected cross-platform assets, checksums, signatures, and provenance.
+
+## [ ] EXT-006: Obtain independent review and adopter evidence
+
+**Owner:** Independent reviewers and adopters
+**Unblocks:** ARC-001, GOV-004, FIN-002, FIN-003
+
+Record independent stable-core/production review and two adopter reports.
+
+## [ ] EXT-007: Publish v5 and complete the 90-day proof window
+
+**Owner:** Release maintainer and adopters
+**Unblocks:** FIN-004 and FIN-005
+
+Publish protected v5 releases, then record the required 90-day maintenance and compatibility evidence.
+
+## [ ] EXT-008: Collect controlled reference-service load evidence
+
+**Owner:** Controlled-runner operator
+**Unblocks:** PERF-004 and release-candidate load evidence
+
+Run the configured reference-service load scenario on the fixed controlled
+environment and attach the sanitized raw result, environment metadata, and
+baseline comparison to the release review.
+
+## [ ] EXT-009: Triage live dependency update pull requests
+
+**Owner:** Dependency maintainer
+**Unblocks:** SEC-003 dependency-maintenance evidence
+
+Record a dated disposition for every live dependency update pull request. Do
+not use blind automerge, self-approval, or a protection bypass.
+
+## [ ] EXT-010: Confirm independent maintainer and security authority
+
+**Owner:** Project lead
+**Unblocks:** GOV-001, GOV-002, and independent release approval
+
+Confirm a second active maintainer has accepted repository, release, and
+private-security-advisory authority, then attach the safe governance evidence.
+
+---
+
 # [ ] EPIC PRG: Program control and handover
 
 **Goal:** Make the backlog executable by a team without relying on undocumented