feat: Add domain architecture and extract core services from Prism Console

## Domain Architecture
- Complete domain-to-service mapping for 16 verified domains
- Subdomain architecture for blackroad.systems and blackroad.io
- GitHub organization mapping (BlackRoad-OS repos)
- Railway service-to-domain configuration
- DNS configuration templates for Cloudflare

## Extracted Services

### AIops Service (services/aiops/)
- Canary analysis for deployment validation
- Config drift detection
- Event correlation engine
- Auto-remediation with runbook mapping
- SLO budget management

### Analytics Service (services/analytics/)
- Rule-based anomaly detection with safe expression evaluation
- Cohort analysis with multi-metric aggregation
- Decision engine with credit budget constraints
- Narrative report generation

### Codex Governance (services/codex/)
- 82+ governance principles (entries)
- Codex Pantheon with 48+ agent archetypes
- Manifesto defining ethical framework

## Integration Points
- AIops → infra.blackroad.systems (blackroad-os-infra)
- Analytics → core.blackroad.systems (blackroad-os-core)
- Codex → operator.blackroad.systems (blackroad-os-operator)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

services/codex/entries/016-supply-chain-attestation.md

@@ -0,0 +1,27 @@
+# Codex 16 — Supply-Chain Attestation — Build Graphs That Verify Themselves
+
+**Fingerprint:** `23064887b1469b19fa562e8afdee5e9046bedf99aa9cd7142c35e38f91e6fef2`
+
+## Aim
+Ensure every artifact in the supply chain is traceable, reproducible, and cryptographically attested.
+
+## Core
+- Represent artifacts as a DAG \(G = (V, E)\) with digests \(h(v) = H(\text{content})\).
+- Apply in-toto style layouts so that each step \(s\) satisfies its predicate \(\Pi_s\).
+- Leverage measured boot with platform configuration registers \(p_i = H(p_{i-1} \parallel m_i)\) to bind runtime state.
+
+## Runbook
+1. Perform hermetic builds, generate SBOMs, and sign each supply-chain edge with a key scoped to \(\Pi_s\).
+2. During deployment, verify the path from source \(v_0\) to target \(v_*\), confirm SBOM closure, check PCR values, and validate timestamps.
+3. Deny execution if any edge is unsigned or if digests mismatch the expected lineage.
+
+## Telemetry
+- Attestation pass rate across environments.
+- Number of orphan or unreferenced artifacts.
+- SBOM coverage and freshness of signing keys.
+
+## Failsafes
+- Quarantine rollouts that fail attestation and initiate rollback to the last verified state.
+- Require manual review for any unsigned artifact before reattempting deployment.
+
+**Tagline:** Only the proven ship.