draft: fixed-trace evidence integrity hardening

[bokelley]

Draft review slice B for #7292. Exact base/merge-base: main at 5094c5c0242ea10c2fd8452a21c0ea1bf33a68a3; previous head: 53cfdb08c494cdc48c0fd58af12b0c70a6fe1805; current head: a405909d032ffe000a06e7195e21ff4e2a49c903.

This range is 14 files, +1,695/-951 against the declared base. It remains refusal-only and non-admitting: no runner, tool loop, CLI, provider adapter, request builder, provider dispatch, pricing calculation, clock, verdict parser, comparison algorithm, positive coordinator, signer, issued ledger, or live provider-exposure producer. C owns any future sealed positive execution boundary and remains unpublished.

The prerequisite source is bounded at 16 KiB and must pass both an independently pinned raw SHA-256 and byte-for-byte canonical serialization check in each consumer before parsing. That rejects source-alias mutation, duplicate fields, whitespace/padding, alternate escapes, reorderings, deep payloads, and prototype-pollution encodings before JSON parsing. The obsolete base sourceCommit claim is removed. A owns measurement and final-prerequisite source objects, verifies their independent content digests, and binds those digests plus corpus/suite, partition, design, schedule/episode-cluster, pricing, calibration, custody, and exposure-unavailable leaves into canonical authority. B independently pins every leaf and digest.

There is no public arbitrary-manifest validator or caller-callable drift-error constructor. Intact unavailable prerequisites return frozen ordinary_unavailable; malformed/noncanonical source returns frozen typed pin_drift; A parity failures are private, frozen typed parity_failure errors with immutable diagnostics. The future-C declaration is one recursively typed, deeply frozen 99-leaf requirements schema, including exact terminal status and provider finishReason. Each of the seven closed domains, including singleton schemaVersion and replayStatus, has one named authoritative union used by its interface field, exhaustive tuple helper, recursive manifest, and type-only missing/extra member probes; frozen runtime tuples reject both append and deletion.

The rollout unit fixtures use the deliberate unavailable-only judge summary. The required local and CI npm run typecheck command now runs production TypeScript followed by npm run typecheck:fixed-trace-rollout-tests; the dedicated script asserts that exact parent wiring before compiling. It uses direct npx tsc, so the path is non-recursive. An independent root-unit regression, discovered by existing test:unit / canonical sharding / precommit, verifies the complete package-script, canonical-shard-runner, and Build Check aggregate dependency chain. Its isolated mutated manifest removes the parent invocation, confirms standalone production tsc still passes, and then fails the independent wiring assertion. The dedicated compiler includes the rollout test and fails on any diagnostic other than a fixed exact set of 17 pre-existing transitive billing-SDK diagnostics; no rollout fixture diagnostic is filtered or excluded. The Code Quality comment on intentionally unreachable if (false) compile probes remains resolved: those statements were replaced with zero-runtime type-only @ts-expect-error exhaustiveness assertions.

Verification on parent 53cfdb08c494cdc48c0fd58af12b0c70a6fe1805: root wiring regression 2/2 via vitest --dir tests; required npm run typecheck (including the test-aware rollout compiler gate); standalone npm run typecheck:fixed-trace-rollout-tests; focused protocol/coordinator/judge/import-boundary/rollout suites 128/128; all neighboring fixed-trace suites 14 files / 326/326 (terminal run, 60 s aggregate test timeout); and git diff --check. The isolated four-file esbuild import-closure assertion and 12 killable child probes passed. The seven closed-domain addition/removal TypeScript mutation proof also passed. The full repository precommit and pre-push storyboard matrices were not terminal and are not claimed as passing evidence.

Ladon repair a405909d032ffe000a06e7195e21ff4e2a49c903: the rollout compiler diagnostic allowlist is now at-most-once. Missing known billing baseline entries pass; unknown and duplicate entries fail. The deterministic root regression covers one removed known diagnostic, one injected new diagnostic, one duplicate known diagnostic, and literal error counts. Verification on the repair: normal npm run typecheck including the invoked rollout gate; two root gate/wiring tests together under 120 seconds; corrected gate independently under 90 seconds; bounded five-file fixed-trace suite 128/128 in 10.66 seconds; and git diff --check.

This PR remains draft. It has not received a fresh review; a fresh independent Sol/medium exact-head review is required. No provider calls, spend, production admission, approval, or merge actions were performed.

[aao-secretariat]

Ladon verdict: Approve

Approve — Addie fixed-trace evaluator slice B (refusal-only judge rewrite, dependency-free A manifest, doubly-pinned B prerequisite, coordinator boundary, and import-time parity tripwire).

What I checked:

• No protocol surface touched: no static/schemas/source/**, docs/reference/**, dist/**, or .changeset/*.md changes — schema↔docs coherence, changeset-scope, oneOf-discriminator, artifact-immutability, and 3.1.x patch-eligibility gates all inapplicable.
• package.json change is not a hand-edited version bump (per reviewer scope).
• The reshaped FixedTraceJudgeSummary still typechecks against its rollout.ts consumer; removed judge exports have no other importers.
• No governance-precedent or breaking-class protocol decision involved — this is Addie eval/harness code.

High-risk flag: true, but reasons are (added) new files plus (modified) existing files with no medium-or-higher finding on the modified files — presumed safe per the change-kind rules; no deletions.

Findings: One Medium (exact baseline-count coupling in the typecheck gate) noted by the reviewer, but it is not present in the structured findings list. Even counting it, a single Medium with no data-loss/schema/infra category, no high-risk modified-file coupling, and no team/gated-path trigger falls through to row 9 = approve.

Gate status: gated_paths=false; no no-auto-approve team; no prior decision. Rows 1–8 do not fire.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean pass, no blocking findings.

The delta is entirely Addie fixed-trace refusal-boundary work under server/src/addie/eval/** plus typecheck-gate wiring. No protocol surface (schemas under static/schemas/source/**, docs/reference/**, dist/**, task defs, release scripts) is touched, so changeset/coherence/immutability/oneOf/3.1.x rules do not apply.

Checks passed per reviewer:

• Judge module's removed complete field is not read by the non-delta rollout consumer.
• Module-load parity assertion and byte-bounded canonical manifest pins are fail-closed.
• At-most-once typecheck baseline matches the 17 declared billing diagnostics.

Decision-table walk: no critical/high/medium findings (rows 1, 4, 5, 6, 8 don't fire); gated_paths is false (row 2 n/a); high-risk reasons are all (added)/(modified) with no deletions and no medium findings, so rows 3 and 5 don't fire; no no-auto-approve team match (row 7 n/a). Prior decision was approve, so row 6 sticky logic is n/a. Falls through to row 9 → approve.