feat: model boundary receipts, the verify arm and chain admission

.gitattributes

@@ -0,0 +1 @@
+compiler/tests/fixtures/model-receipt-golden.json text eol=lf

CHANGELOG.md

@@ -10,6 +10,41 @@ tracked in `STATUS.md`, `README.md`, and
 
 ## Unreleased
 
+- **Model boundary receipts, the verify arm and chain admission**: a new
+  artifact kind, `buildlang-model-boundary-receipt/v0`, documented in the new
+  `docs/MODEL-RECEIPT.md` (SCIENTIFIC-RECEIPT.md gains a pointer section).
+  Emission is harness-side (`harness/model_shim.py`'s `--receipt-dir` flag,
+  local-model repo), never buildc; this slice ships the buildc-side READ path
+  only. `receipt verify` gains a fourth schema arm (beside gpu,
+  scientific-runtime, and check) in the new `compiler/src/model_receipt.rs`:
+  offline seal recompute, digest well-formedness (`DIGEST_MALFORMED`), and
+  field-shape contracts (`FIELD_CONTRACT_VIOLATION` for a `daemon_digest.hex`
+  present alongside `UNAVAILABLE`, a `COMPLETED` outcome with a null `reply`,
+  or a `PROTOCOL_VIOLATION` with a present `prompt`) -- no new failure
+  classes, the shared taxonomy is reused whole. `receipt chain build`'s
+  member-schema gate widens from a single-schema equality to a two-schema
+  allowlist (scientific-runtime + model-boundary-receipt); chain verify needed
+  zero changes, since pinned seals and subprocess re-verification already
+  dispatch through the new arm. The scientific verifier's
+  `CAPABILITY_INADMISSIBLE` refusal of any `Model`-observing program is
+  untouched: a model receipt is a different artifact kind by construction, it
+  cannot masquerade as scientific evidence. A byte-identical GOLDEN FIXTURE
+  (`compiler/tests/fixtures/model-receipt-golden.json`, an echo-mode
+  `COMPLETED` receipt) is checked into both this repo and local-model's
+  `_wshim` worktree with the same pinned seal, proving the Rust
+  (`serde_json::to_vec`) and Python (`json.dumps(..., separators=(",", ":"))`)
+  canonicalizations agree byte-for-byte; the no-floats schema is what makes
+  that agreement stable across the two serializers. Tamper coverage: a
+  resealed field-shape violation, a seal mismatch, and a chain binding a
+  model receipt beside a scientific receipt that breaks
+  (`CHAIN_LINK_UNVERIFIED`) when only the model member is tampered, all
+  exercised both as `compiler/src/model_receipt.rs` unit tests and as
+  `compiler/tests/cli.rs` CLI-level tests against the real `buildc` binary.
+  The model receipt is **not** a corpus member (it has no invariant to
+  classify PASS/FAIL_EXPECTED against, and is emitted by a different program
+  entirely) and not a `--self-test` case (that table is
+  scientific-runtime-only): corpus 29/29 and self-test 10/10 stay unchanged,
+  re-run and recorded. Full suite: 1,698 passed, 0 failed; `cargo fmt` clean.
 - **Executed Monte Carlo intervals with a witnessed denominator**: `monte_carlo`
   gains a two-arm `DECLARED | EXECUTED` status. Under the new `--mc-executed`
   flag (opt-in; requires the full `--mc-*` declaration and forces `--columns`

README.md

@@ -257,7 +257,7 @@ output, and the receipt tooling are the verified core; SPIR-V, LLVM IR, WASM,
 Rust, x86-64, ARM64, GPU dispatch, and `#[linear]` types are labeled
 experimental and stay that way until their evidence says otherwise. The
 release-shaped baseline (2026-07-29, local `cargo test` from `compiler/`):
-1683 tests passing, 0 failing (11 ignored), with `buildc receipt corpus`
+1698 tests passing, 0 failing (11 ignored), with `buildc receipt corpus`
 29/29 and `buildc corpus verify` 8/8. Ground-truth release evidence lives in
 [STATUS.md](STATUS.md); [CHANGELOG.md](CHANGELOG.md) tracks changes.
 

compiler/src/main.rs

@@ -17,6 +17,7 @@ mod gpu_receipt;
 mod lsp_dispatch;
 mod memory_layout;
 mod mir_representation;
+mod model_receipt;
 mod module_graph;
 mod scientific_runtime;
 mod symbol_graph;
@@ -42,6 +43,7 @@ use memory_layout::{verify_memory_layout_receipt, MemoryLayoutReceipt, MEMORY_LA
 use mir_representation::{
     verify_mir_representation_receipt, MirRepresentationReceipt, MIR_REPRESENTATION_RECEIPT,
 };
+use model_receipt::{verify_model_boundary_receipt, MODEL_RECEIPT_SCHEMA};
 use module_graph::{verify_module_graph_receipt, ModuleGraphReceipt, MODULE_GRAPH_RECEIPT};
 use scientific_runtime::{
     build_receipt_chain, receipt_chain_seal_hex, ReceiptChainManifest, ScientificCorpusManifest,
@@ -1899,11 +1901,21 @@ fn cmd_receipt_chain_build(receipts: &[PathBuf], output: &Path) -> Result<(), i3
             code
         })?;
         let schema = receipt.get("schema").and_then(|v| v.as_str()).unwrap_or("");
-        if schema != SCIENTIFIC_RUNTIME_SCHEMA {
+        // Allowlist widened for model boundary receipts (design section 6):
+        // a model receipt can be a chain member beside scientific-runtime
+        // receipts, demonstrating propose (model) / dispose (oracle) as a
+        // single chained bundle. `source` extraction below needs no change:
+        // both schemas carry a top-level `source` label. Chain VERIFY needs
+        // zero changes beyond this: pinned seals and subprocess
+        // re-verification (`buildc receipt verify <member>`) already compose
+        // through the schema-agnostic dispatch this widening exercises.
+        if schema != SCIENTIFIC_RUNTIME_SCHEMA && schema != MODEL_RECEIPT_SCHEMA {
             eprintln!(
-                "Error: '{}' is not a scientific-runtime receipt (schema `{}`)",
+                "Error: '{}' is not a chainable receipt (schema `{}`; expected `{}` or `{}`)",
                 path.display(),
-                schema
+                schema,
+                SCIENTIFIC_RUNTIME_SCHEMA,
+                MODEL_RECEIPT_SCHEMA
             );
             return Err(1);
         }
@@ -2714,6 +2726,9 @@ fn cmd_receipt_verify(
     if schema == SCIENTIFIC_RUNTIME_SCHEMA {
         return verify_scientific_receipt_dispatch(&receipt, source_override, false);
     }
+    if schema == MODEL_RECEIPT_SCHEMA {
+        return verify_model_boundary_receipt(&receipt, false);
+    }
     if schema != "buildlang-check-receipt/v1" {
         eprintln!("Error: unsupported check receipt schema `{}`", schema);
         return Err(1);
@@ -2846,6 +2861,18 @@ fn cmd_receipt_verify_json(
         return verify_scientific_receipt_dispatch(&receipt, source_override, true);
     }
 
+    // Model boundary receipts (design:
+    // docs/superpowers/specs/2026-07-29-model-boundary-receipts-design.md):
+    // offline schema/seal/field-contract verification only, no re-run. Routed
+    // the same way as the scientific-runtime arm above, before the
+    // check-receipt schema guard.
+    if receipt_field_str(&receipt, "/schema", "schema")
+        .map_err(|code| receipt_load_failure(true, "SCHEMA_UNSUPPORTED", code))?
+        == MODEL_RECEIPT_SCHEMA
+    {
+        return verify_model_boundary_receipt(&receipt, true);
+    }
+
     let mut checks = Vec::new();
 
     let schema = receipt_field_str(&receipt, "/schema", "schema")?;