[FLO-13.2] Build the hermetic orchestration provider kit

[szmyty]

Parent: #13
Depends on: #28, #25
Suite roadmap: #11

Outcome

Build a deterministic, redistribution-safe provider kit that exercises Flow's public process and artifact boundary without importing or reimplementing Aniflow, Optiflow, or Renderflow.

The kit supplies controlled orchestration behavior. Provider repositories remain the authority for real domain algorithms and raw-format fixtures.

Scope

• Implement the smallest hermetic provider bundle supported by the completed [FLO-3.2] Specify external process transport and provider trust boundaries #25 boundary.
• Expose stable fake capability IDs for inspection, transformation, validation, and read-only observation.
• Materialize only declared, bounded, deterministic candidate artifacts.
• Provide configuration-driven behaviors for success, warning/partial outcomes, unavailable or incompatible capability, nonzero exit, timeout, cancellation, bounded-output overflow, and missing/extra/partial/corrupt/stale/contradictory output.
• Include invalid event/result behavior and provider-reported success followed by failed host validation.
• Supply minimal single-provider and multi-provider graphs.
• Record exact kit version, executable identity, configuration digest, inputs, outputs, and expected evidence.
• Package the kit so clean-room tests consume an immutable artifact rather than a sibling workspace.
• Keep all tests offline and free of external tools, paid services, model downloads, and consequential side effects.

Acceptance criteria

• The kit implements only the accepted public Flow process/artifact contract.
• Identical configuration and inputs produce identical normalized evidence and artifact digests.
• Every configured failure is intentional, named, bounded, and distinguishable.
• Provider exit zero or file existence cannot establish accepted execution.
• Source inputs remain byte-for-byte unchanged.
• No network, upload, publication, signing, arbitrary subprocess, or inherited-secret access occurs.
• Package, documentation, examples, and repository validation pass.

Non-goals

• Shipping production provider algorithms.
• Copying provider conformance kits or raw corpora into Flow.
• Implementing durable retries or resume.
• Claiming operating-system isolation beyond guarantees actually enforced by [FLO-3.2] Specify external process transport and provider trust boundaries #25.

[szmyty]

Flow #29 is now split into three sequential, independently reviewable checkpoints:

• [FLO-13.2a] Establish the immutable hermetic provider package and success path #44 — FLO-13.2a: immutable hermetic provider package and deterministic success path
• [FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #45 — FLO-13.2b: bounded lifecycle and protocol outcome matrix (depends on [FLO-13.2a] Establish the immutable hermetic provider package and success path #44)
• [FLO-13.2c] Complete artifact adversaries, graph fixtures, and kit documentation #46 — FLO-13.2c: artifact adversaries, graph fixtures, and final kit documentation (depends on [FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #45; completes [FLO-13.2] Build the hermetic orchestration provider kit #29 and unblocks [FLO-13.3] Prove compatibility, artifact, and provider-failure scenarios #30)

Each checkpoint will use its own focused PR. I am starting #44 now and will return for review with a draft PR before beginning #45.

[szmyty]

Checkpoint 1 is captured for review in draft PR #47.

• [FLO-13.2a] Establish the immutable hermetic provider package and success path #44: implemented and pushed as the immutable hermetic provider package plus deterministic success-path checkpoint
• [FLO-13.2b] Exercise bounded provider lifecycle and protocol outcomes #45: queued for the bounded lifecycle/protocol outcome matrix
• [FLO-13.2c] Complete artifact adversaries, graph fixtures, and kit documentation #46: queued for artifact adversaries, graph fixtures, and final kit documentation

Local and repository validation is green on Rust 1.85 and stable, including all targets, doc tests, clippy, packaging, contract/source generation checks, and repository validators. Independent implementation/documentation review found no remaining blockers.

Paused before starting #45 so we can sync on the checkpoint boundary and review #47.

[szmyty]

Checkpoint #45 is implemented in draft PR #48, stacked on checkpoint #44 / PR #47.

It closes the bounded lifecycle and protocol matrix: prelaunch unavailable/incompatible resolution, warning/partial semantics, nonzero exit, timeout/cancellation with direct-child reaping, bounded stdout/stderr overflow, invalid event/result evidence, and authoritative host rejection. Local Rust 1.85 + stable suites, examples, packaging, repository validators, and two independent reviews are green. PR #48's GitHub Actions CI run is also green.

Checkpoint #46 has not started; pausing here for review and sync as planned.

[szmyty]

The complete parent acceptance handoff is now indexed in docs/integrations/hermetic-provider-kit.md in draft PR #60. The seven-row matrix maps every #29 criterion to exact tests and documentation, including deterministic evidence, named failures, exit-zero/file-existence refusal, immutable inputs, authority/privacy constraints, and repository/package validation.

PR head d3f6e49fbf8526ad8a109cfdf2e3aa9f926044af passed fresh PR CI run #46. #29 remains open until PR #60 merges and default-branch CI is green. The redistribution claim is deliberately scoped to the MIT source bundle and locked build instructions; a local binary is not represented as a turnkey distribution.

[szmyty]

Completed and closing with the final child and default-branch evidence:

• Child [FLO-13.2c] Complete artifact adversaries, graph fixtures, and kit documentation #46 is complete through PR [FLO-13.2c] Complete artifact adversaries, compositions, and provider-kit evidence #60: [FLO-13.2c] Complete artifact adversaries, compositions, and provider-kit evidence #60.
• Merge commit: c653c3667dd1879bd7009f83a4906ab6ae9ba832.
• Default-branch CI passed: https://github.com/egohygiene/flow/actions/runs/36021762108.
• The merged [FLO-13.2c.4] Finalize hermetic provider kit documentation and #29 evidence handoff #59 handoff maps every parent acceptance criterion to executable evidence and documentation, while retaining the explicit non-goals and redistribution limits.

The hermetic orchestration provider kit is complete; #30 owns the next Flow-local scenario matrix.