[FLO-13.2c] Complete artifact adversaries, graph fixtures, and kit documentation

[szmyty]

Parent: #29
Roadmap-Step: FLO-Q03
Depends on: #45
Completes: #29
Unblocks: #30

Outcome

Complete the hermetic orchestration provider kit with deterministic artifact adversaries, single- and multi-provider graph fixtures, and redistribution documentation that make the kit reusable for the broader workflow matrix.

Scope

• Add closed, named artifact/evidence behaviors for:
  • missing bound output;
  • extra provider-declared output;
  • partial output/result;
  • altered or corrupt content identity/evidence;
  • stale correlation evidence; and
  • contradictions among events, results, bindings, and observations.
• Prove that a protocol-valid provider success followed by host observation or acceptance failure never yields AcceptedArtifactSet.
• Keep claims precise:
  • an undeclared file outside bound locators is not automatic discovery;
  • corrupt means digest/evidence or explicitly synthetic validation corruption, not generic provider-native semantic validation by Flow.
• Add deterministic single-provider and multi-provider composition fixtures using public APIs without introducing a production DAG scheduler.
• Publish the immutable package layout, build/run instructions, redistribution/license/checksum notes, behavior catalog, and requirement-to-test matrix.
• Update the parent [FLO-13.2] Build the hermetic orchestration provider kit #29 and FLO-Q03 evidence handoff when the full kit is complete.

Checkpoints

• [FLO-13.2c.1] Reject missing, extra, and partial physical artifact outcomes #56 — reject missing, extra, and partial physical artifact outcomes.
• [FLO-13.2c.2] Reject corrupt, changed, stale, and contradictory artifact evidence #57 — reject corrupt, changed, stale, and contradictory artifact evidence.
• [FLO-13.2c.3] Execute deterministic single- and multi-provider composition fixtures #58 — execute deterministic single- and multi-provider composition fixtures.
• [FLO-13.2c.4] Finalize hermetic provider kit documentation and #29 evidence handoff #59 — finalize kit documentation and the [FLO-13.2] Build the hermetic orchestration provider kit #29 evidence handoff.

The checkpoints are sequential. At maintainer direction, #56–#59 are consolidated in draft PR #60 while retaining separately named acceptance evidence. #46 and #29 close only after PR #60 is merged and default-branch CI is green.

Acceptance criteria

• Every artifact adversary has a stable name, explicit trigger, owning validation boundary, and exact expected error/outcome.
• Provider success plus missing, changed, stale, extra, partial, or contradictory artifact evidence cannot produce an accepted artifact token.
• Single- and multi-provider fixtures preserve explicit ordering, artifact dependencies, provider identities, and deterministic evidence.
• The graph fixtures do not claim durable scheduling, retry, resume, or real provider algorithms.
• The source bundle is immutable, MIT-redistributable, offline-build/test capable from a previously populated Cargo cache, and Flow-digest-verifiable; target-specific binary redistribution obligations are explicit.
• The requirement-to-test matrix covers all parent [FLO-13.2] Build the hermetic orchestration provider kit #29 acceptance criteria and names any honest residual gaps.
• Focused tests, Rust 1.85, stable Rust, and all repository validators pass.

Non-goals

• Automatic filesystem discovery of undeclared files.
• Generic semantic validation of real provider-native artifacts.
• Real Aniflow, Optiflow, or Renderflow algorithms.
• A production graph scheduler, public Flow CLI, or durable run engine.
• Sandbox/authenticity claims beyond the released public contracts.
• Mutable dependencies or external services.

[szmyty]

All four sequential checkpoints (#56–#59) are now implemented and independently evidenced in maintainer-directed draft PR #60. Its current head d3f6e49fbf8526ad8a109cfdf2e3aa9f926044af passed fresh PR CI run #46.

The issue body now records the consolidated-PR decision and the precise source-vs-binary redistribution boundary. Per the acceptance gate, this parent remains open until PR #60 merges and default-branch CI is green; only then should #46 and #29 close and #30 become unblocked.

[szmyty]

Completed and closing with post-merge evidence:

• PR [FLO-13.2c] Complete artifact adversaries, compositions, and provider-kit evidence #60 merged as c653c3667dd1879bd7009f83a4906ab6ae9ba832.
• Default-branch CI passed: https://github.com/egohygiene/flow/actions/runs/36021762108.
• Sequential checkpoints [FLO-13.2c.1] Reject missing, extra, and partial physical artifact outcomes #56, [FLO-13.2c.2] Reject corrupt, changed, stale, and contradictory artifact evidence #57, [FLO-13.2c.3] Execute deterministic single- and multi-provider composition fixtures #58, and [FLO-13.2c.4] Finalize hermetic provider kit documentation and #29 evidence handoff #59 closed through the merge.
• PR [FLO-13.2c] Complete artifact adversaries, compositions, and provider-kit evidence #60 records the named adversary boundaries, deterministic compositions, immutable/offline package evidence, redistribution limits, and the complete [FLO-13.2] Build the hermetic orchestration provider kit #29 requirement-to-test handoff.

The documented gate is satisfied. #30 is now unblocked.