[Wenbobobo]

Outcome

Moves candidate generation to a selected-formal-field-blind V2 task projection and closes the pre-RC V1 fidelity-artifact admission gap.

Boundary

• translators receive source claims, frozen mathematics, a non-answer formalization envelope, and projected obligations
• selected Lean statement/hash, draft-contract hash, obligation descriptions, Lean fragments, and authority are not projected
• translator, mutation, and reviewer identities are snapshotted before callbacks
• proposal bindings are attached server-side; mismatches fail before mutation/review
• the control plane re-derives the permitted projection from frozen contract/source bindings and typed HashKindV1.PROMPT digests
• legacy reviewed V1 evidence remains replayable historically but cannot be newly registered

This is selected-formal-field-blind groundwork. It does not prove process/chronology isolation, independent model identity, blind-model capability, or mathematical fidelity.

Adversarial checks

Rejects selected-Lean injection with recomputed hashes and a re-signed artifact, source locator/hash/excerpt drift, unknown/duplicate spans, malformed/blank obligations, projection drift, missing/extra fields, wrong top/candidate hashes, and fewer than two candidates. The test-only unreviewed switch cannot bypass malformed reviewed evidence.

Verification

• two independent audits; final result: no P0-P3, merge
• full CI before rebase: 786 passed, 12 skipped
• WSL real source-backed OCI canary: passed, builder_unreviewed_bypass=false, not_a_promotion
• post-rebase focused: 133 passed
• Ruff and stable patch-id check: passed

Current canary evidence: 9c55e87e872d1a11377c12a0700b22233101f6704cbebf3d6903eb4196bc2577.