feat(spine): ADR-112 real-set follow-on — tamper-evident freeze-orchestration + lc Tier-1 authoring + at-power cert (one-cylinder checkpoint)

[satur8d]

Scope — CONTRACT RULED (strategy 0102Z + 0107Z fixture amendment; boundary FIXED)

The ADR-112 real-set follow-on (operator greenlit 2026-07-03). Creates the FIRST real spine artifacts, scoped toward the one-cylinder checkpoint (one authored rule, certified, catching one real lc defect bots missed). Three operator-gated slices, contract→build→couple→named-merge per slice.

R1 — tamper-evident freeze-orchestration (totem) — NEXT UP

• freeze-split step: derives the window from lc HEAD at freeze time, pins the derivation (asOfCommit = actual lc SHA + inputs recorded in the artifact). The frozen split artifact is TRACKED-PUBLIC (operator-named); the freeze lands as a PR whose operator-named merge IS the human gate (Q3 — no separate naming ceremony).
• Tamper-evidence, (a)+(b) COMPOSED, (c) backstop (Q2): (a) commit-anchored — artifact committed BEFORE authoring; gate asserts frozenAt ≤ the introducing commit's committer timestamp; ledger entries land in strictly later commits. (b) hash-commitment — freeze stamps sha256(splitRef · frozenAt · corpus-integrity); every subsequent ledger entry chains it (a re-stamp orphans downstream entries). (c) non-inspection attestation stays a ledger-recorded backstop. Resolves ADR-112's Deferred attestation-mechanism (strategy folds at R1-merge, incl. the two-class Tenet-19 scoping: committed chronology → mechanism-class; pre-freeze working-tree drafts stay adherence-class, sandbox-narrowed + (c)-recorded).
• totem rule author binding: refuse authoring into a ledger whose splitRef lacks a frozen, committed split artifact — authoredAfterSplit flips declared→mechanically-checked.
• §5.4 workspace sandbox (R1b — INSIDE R1 per ruling): the authoring/test harness sandboxed to the train-side tree as-of the cut. The author cannot own the mechanism that constrains them (same independence axiom as §3 judgedBy ≠ author).
• Constraints: fixture-proven like the D-ladder; must NOT widen the CI: Compile Manifest Attestation cannot see the cohort freeze — @mmnto/strategy-doctrine optional dep never materializes (no registry read auth), #2137 WARN-downgrade unreachable #2289 CI freeze-visibility seam.

R2 — lc Tier-1 authoring (lc-claude's lane; EMBARGOED until R1 live + real split frozen)

Cert-1 set AMENDED to the 3 admissible (0107Z): debug-assert-len-mismatch · procgen-entropy-clock-source · is_finite (floor ≥2 holds). godot-builtin-array-dict-in-sim HELD OUT — no PR anchor, fails Falsifier (a) honestly; contract not amended to rescue it. Fixture rulings on the R2 face: synthetic-from-prose ADMITTED w/ 3 recorded-exemplar conditions (procgen); 3 separation facts become declared negativeFixtures; Rule-43 scoped-exception pairing confirmed in the §3 basis; fixture ages ≤ lc#422 leave cutIndex free. Full-ISO authoredAt; judgedBy = the §3 whitelist-check id (settled, ≠ author).

R3 — at-power cert run + instrumentation

One wind-tunnel pass certifies all admissible rules per-rule; the checkpoint claim reads the FIRST live catch (endorsed likely-first: debug-assert-len-mismatch). Instrumentation: cert report artifact = source (per-rule held-out precision, heldOutActivationsByRule); live catch-rate = post-cert append-only sensor events (tracked-public); lesson→rule latency derives from ledger timestamps; dashboards derive, never hand-mirror. Measurement window opens at R3-merge; checkpoint is event-gated (time-box = review sensor, not deadline) — operator ratifies the window proposal at R3.

Sequencing invariant (§5.1, live on main since D5): freeze BEFORE authoring — the embargo gates are enforced.

Context: strategy ADR-112 + #793/#804 pins + the 0102Z/0107Z rulings; totem#2288; totem#2289 (binding constraint on R1).

🤖 Generated with Claude Code

[satur8d]

Red-team session record (operator-ratified in-session, 2026-07-03 — all six items; session CLOSED)

Item 1 — RULED: OPTION A, mechanism-first. R1 builds full-scope (freeze-orchestration + rule author binding + §5.4 sandbox + tamper-half: proof-by-topology ancestry mechanization, hash-commitment inside authoringContentHash material, content-addressed splitRef), per the 0102Z contract as amended by the panel's build-lane folds. Build hold LIFTED. The first cylinder fires under a mechanism-class freeze — the Track-A claim lands whole.

Item 2 — Post-checkpoint decision rule (PRE-REGISTERED 2026-07-03, operator-ratified, before any R3 result exists):

1. Miss-scoring window = the later of: (a) 14 days from R3-merge, or (b) 20 merged lc PRs touching the certified rules' watched paths (in-scope exposure, not all-lc traffic). Both floors must be met before a miss may be scored — (a) guards against a single-burst narrow sample; (b) guards against a quiet-lc month counting as a verdict.
2. Success is event-gated, not window-gated: ≥1 confirmed live catch by a certified rule that the bots missed closes the checkpoint the moment it lands — day 2 or day 20. The window bounds only how long we wait before scoring a miss.
3. On a miss: a named re-scope round choosing among exactly three options — extend once with stated cause · re-author the rule set · re-scope the rigor. Silent extension is not among them.
4. The verdict reports per-rule in-scope exposure: a rule whose watched paths saw zero traffic in-window is recorded unexercised, never failed (ADR-112 §5.3 held-out-unexercised discipline applied to the live window).

Item 3 — Lens Dispatch-Explorer slice pulled forward (strategy#449 comment carries the codification): R2-window slack ONLY, Spine-untouched by construction, drops without ceremony on any R-ladder demand. R1 > R2-couple > lens, always.

Item 4 — Freeze-lift gates PRE-REGISTERED: (1) R3 merged (spine Gate-1 operational on real artifacts) · (2) #2158 total-accounting contract landed · (3) legacy corpus dispositioned per-rule · (4) lift-as-replacement semantic ruled. Admissibility pre-pass commissioned as one hours-sized issue (see linked); re-mine stays deferred behind the gates with the pre-pass count as trigger-input. Binding clause, verbatim: "a freeze-lift is a re-certification through the spine's Sense-to-Enforce gates (Tenet 9 corollary), never a bulk unfreeze" — provenance + positive + negative controls per rule, inherited bar, no waiver.

Item 5 — Window routing: Fable-primary on all seats UNTIL window close (~2026-07-08, explicit — no early reversion). Every remaining window slice logs a #697-lane capability row (R1 = the key row). Post-close: doctrine baseline (Opus default; Fable on-demand for couple-verify + contract-ruling legs). Rule labeled directional, n≈1; pre-registered review trigger at n≥10 accumulated rows. Doctrine amendment ships from strategy at close.

Item 6 — Plan-audit chartered: two-pass sensor→judge · dispositions-only · one batched operator ratification · kill-shaped items get blind cross-check · retire-misinfo-not-ambition. First workstream: the strategy#611 skynet gate-board derivation. Runs mid-window (Jul 4–5) in build gaps; audit-tail drops before build ever does.

Session close: 6 items, 6 ratified deltas, zero new planning documents — the machinery-before-cargo constraint held.

[satur8d]

R1 face CLOSED (2026-07-03). Shipped totem 9721866a (#2293, 5 bot rounds converged 12→3→2→1→0, couple CLEAN-blessed + re-verified). Strategy lockstep fold MERGED strategy#808 ba0c035: §5.1 construction + §8 currency (exactly-one-of as shipped) + Deferred attestation-mechanism RESOLVED + Tenet-19 Goal-flag FLIPPED (two-class scoped: committed freeze→author chronology = mechanism-class; pre-freeze working-tree residue stays adherence-class, sandbox-narrowed + attestation-recorded). R1 couple closed end-to-end.

Next ladder event: the REAL freeze PR — totem spine freeze-split against lc HEAD with params derived from the ratified policy half (strategy#591), landed via a PR whose operator-named merge is the Q3 human gate. lc's authoring embargo lifts on that merge; then R2.

[satur8d]

Q4 enumeration amendment — operator-ruled 2026-07-04: is_finite fixture anchor swaps mmnto-ai/liquid-city#34 → mmnto-ai/liquid-city#130. Basis (lc-claude drafting finding, strategy-verified where checkable): #34 is the class ORIGIN (ADR-112 Provenance) but carries no canonizing lesson exemplar pair and no 0-FP matcher shape for its sub-idiom; #130 carries the class's only compiled-precedent differential (lesson 26b0683c4749cac0 — verified present in lc compiled-rules; Rapier-translation idiom, active_entity.rs, witnessed as a review-round catch). Both pre-window (2026-04-18 / 2026-04-29 ≪ window start mmnto-ai/liquid-city#447), so the option-(a) leakage-semantics gate admits either — this amends the per-rule anchor ENUMERATION only, not gate semantics. The rejected alternative (synthesize-a-preimage-from-code at #34) is a synthesis mode the synthetic-from-prose ruling deliberately did not cover. Contract fold: rides the lockstep §5.2/§3 amendment with the gate-widen build. Cert-1 set otherwise unchanged: debug-assert-len-mismatch (anchors #64 + #422; #236 moved to negativeFixtures — correct provenance discipline) · procgen-entropy-clock-source (#199) · is_finite (#130, this amendment).