[FLO-13.2c] Complete artifact adversaries, compositions, and provider-kit evidence

[szmyty]

Closes #56
Closes #57
Closes #58
Closes #59
Parent: #46
Parent kit: #29
Next after merge and green default-branch CI: #30

Outcome

Completes all four sequential #46 checkpoints in one maintainer-directed draft PR. Invalid physical/evidence outcomes stop at their exact Flow-owned boundary, fixed single-provider and two-provider compositions preserve exact accepted-artifact handoffs, and the hermetic provider kit now has its complete package workflow, behavior catalog, parent #29 evidence matrix, and #30 handoff.

Changes

Checkpoint #56 — physical outcomes

• Reject missing output during typed host observation.
• Reject extra provider-declared and partial outputs during exact artifact acceptance.
• Keep undeclared-file discovery and provider-native semantic validation out of scope.

Checkpoint #57 — evidence integrity and freshness

• Reject corrupt result evidence before ValidatedExecution and protocol-valid event/result contradictions during artifact acceptance.
• Bind each opaque ObservedArtifactSet to its canonical root and exact binding snapshot.
• Re-observe bound artifacts immediately before promotion and reject changed, removed, stale-invocation, or changed-binding evidence.
• Preserve portable v1 schemas and keep free-form provider provenance non-authoritative.

Checkpoint #58 — deterministic compositions

• Execute explicit two-stage inspect → transform single-provider and two-provider fixtures.
• Derive the downstream binding only from the upstream AcceptedArtifactSet, preserving artifact ID, port, media type, kind, locator, and digest.
• Drive every stage through public resolution, execution-subject, authority, runner, artifact-observation, and acceptance boundaries.
• Run each composition twice in fresh roots and require equal normalized evidence plus byte-identical accepted outputs.

Checkpoint #59 — package and evidence closeout

• Document the exact primary, inspector, and renderer package layouts plus the locked offline build/finalization procedure.
• Correlate package and executable digests across manifest, operator lock, execution-subject lock, and fresh observations; add focused exact-layout and license-tamper coverage.
• Publish the complete trigger → boundary → exact outcome → promotion catalog and exact test index.
• Map every parent [FLO-13.2] Build the hermetic orchestration provider kit #29 acceptance criterion to executable evidence and documentation.
• Record redistribution, offline-cache, non-atomic observation, trusted-unconfined, scheduler, and unknown-mode-test limits explicitly.
• Update the integration indexes and FLO-Q03 roadmap handoff. [FLO-13.2c] Complete artifact adversaries, graph fixtures, and kit documentation #46 and [FLO-13.2] Build the hermetic orchestration provider kit #29 remain open until this PR merges and default-branch CI is green; [FLO-13.3] Prove compatibility, artifact, and provider-failure scenarios #30 follows that gate.

Explicit limits

The supported redistributable artifact is the MIT source bundle plus locked build instructions. A locally built binary is conformance input, not a turnkey binary distribution; target-specific dependency licenses and notices remain the binary redistributor's responsibility. The fixed test sequencer is not a scenario-manifest executor, production scheduler, durable plan/run engine, retry, checkpoint, or resume implementation. The synthetic providers are not real Aniflow, Optiflow, or Renderflow adapters. Final re-observation detects net evidence drift but is not an atomic filesystem snapshot or operating-system sandbox.

Validation

Passed locally for the #59 head:

• python3 tools/validate_contracts.py
• python3 tools/generate_scenario_sources.py --check
• python3 .agents/specs/validate-specs.py
• python3 .agents/skills/validate-skills.py
• python3 .agents/agents/validate-agents.py
• git diff --check

Head d3f6e49fbf8526ad8a109cfdf2e3aa9f926044af passed fresh PR CI run #46: repository validators plus Rust 1.85 and stable rustfmt, clippy with warnings denied, all-target tests, Rustdoc, examples, and package verification.

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 15⭐
  Check Your Progress