Codex/epistemic consolidation

.github/workflows/ci.yml

@@ -52,6 +52,60 @@ jobs:
       - name: Tests
         run: pytest -q
 
+  conformance:
+    name: cross-implementation agreement
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      # The Node implementation is deliberately not installed from npm: it has
+      # zero dependencies, so a bare runtime is the whole requirement.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+      - name: Install
+        run: |
+          python -m pip install -U pip
+          pip install -e '.[test]'
+      - name: Canonicalization census
+        # Gates on cc.canonical.v2 only. v1 is retained read-only for
+        # historical receipts and is expected to carry its known defects.
+        run: python scripts/canonicalization_probe.py
+      - name: Evidence cards are current
+        run: python scripts/build_evidence_cards.py --check
+      - name: Corpus is current
+        run: python scripts/build_conformance_corpus.py --check
+      - name: Independent Node implementation agrees
+        run: node verifiers/node/cc_compose_verify.mjs
+      - name: Differential fuzz
+        run: python scripts/differential_compose.py --cases 4000 --seed 1
+      - name: Conformance, canonicalization and acceptance suites
+        run: pytest -q tests/conformance tests/acceptance tests/unit/compose tests/unit/cli tests/unit/canonical tests/unit/evidence_card
+
+  test-extra-is-sufficient:
+    name: the documented install path works
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+      # Installs '.[test]' SPECIFICALLY, not '.[dev]'. The extra strangers are
+      # told to use must be the extra that is tested; before this job the two
+      # diverged and the documented path produced a red suite (finding F-01).
+      - name: Install the documented test extra
+        run: |
+          python -m pip install -U pip
+          pip install -e '.[test]'
+      - name: Tests
+        run: pytest -q
+
   package-build:
     runs-on: ubuntu-latest
     timeout-minutes: 15

.gitignore

@@ -58,3 +58,7 @@ protocol_*.jsonl
 
 # Generated bundles and built docs (never track)
 *.zip
+
+# Film render intermediates (the .mp4 masters and posters are tracked; these are not)
+visual_identity/before_you_see_it/renders/.frames-*/
+visual_identity/before_you_see_it/renders/*.webm

Makefile

@@ -113,12 +113,14 @@ GOV_CAPSULE_TESTS    := tests/integration/test_claim_governance_capsule.py
 	dev install setup init lock deps \
 	fmt lint type security package-build \
 	test test-unit test-int test-kernel test-release test-reporting test-week3 test-week6 cov bench \
+	conformance differential acceptance test-compose canon-probe evidence-cards \
 	check-artifact-boundary check-repro-clean \
 	enterprise-smoke \
 	reproduce-smoke reproduce-mvp reproduce-figures figures reports ccc \
 	reproduce-paper verify-paper-artifacts paper-smoke \
 	verify-invariants verify-statistics verify-audit \
 	docs docs-serve \
+	film film-ghost-ark \
 	docker-build docker-run \
 	clean distclean \
 	carto-install carto-smoke carto-mvp carto-verify-audit carto-verify-stats carto-suggest \
@@ -301,6 +303,41 @@ test-release: test-kernel
 test-reporting: install
 	PYTHONPATH=src $(VENV_DIR)/bin/pytest tests/unit/reporting -q
 
+# --- cross-implementation agreement (upgrade workstream W5) -----------------
+# Agreement here establishes that two implementations of one specification
+# compute the same values. It does NOT establish that either is correct: both
+# were authored in this project and can share a misreading of the spec.
+
+conformance: install
+	PYTHONPATH=src $(VENV_DIR)/bin/python scripts/build_conformance_corpus.py --check
+	node verifiers/node/cc_compose_verify.mjs
+	PYTHONPATH=src $(VENV_DIR)/bin/pytest tests/conformance -q
+
+differential: install
+	PYTHONPATH=src $(VENV_DIR)/bin/python scripts/differential_compose.py --cases 4000 --seed 1
+
+# The acceptance gate for consumability: an external consumer's PUBLISHED
+# four-control result, reproduced from cc.compose. Not "the API exists" --
+# their numbers, from this library.
+acceptance: install
+	PYTHONPATH=src $(VENV_DIR)/bin/pytest tests/acceptance -q
+
+test-compose: install
+	PYTHONPATH=src $(VENV_DIR)/bin/pytest tests/unit/compose tests/unit/cli -q
+	$(VENV_DIR)/bin/ruff check src/cc/compose src/cc/cli/guard.py
+
+# Reproduces the S1 canonicalization findings. Exits non-zero while any
+# unintended-kernel class remains, so the findings stay falsifiable.
+# Evidence cards for an external Atlas. The committed cards are the not-run
+# scaffold: verdicts are host-specific and must not be published from a laptop.
+evidence-cards: install
+	PYTHONPATH=src $(VENV_DIR)/bin/python scripts/build_evidence_cards.py --check
+	PYTHONPATH=src $(VENV_DIR)/bin/pytest tests/unit/evidence_card -q
+
+canon-probe: install
+	PYTHONPATH=src $(VENV_DIR)/bin/python scripts/canonicalization_probe.py
+	PYTHONPATH=src $(VENV_DIR)/bin/pytest tests/unit/canonical -q
+
 test-week3: install
 	$(ACT); pytest -q --disable-warnings \
 		tests/unit/test_fh_intervals_alpha_cap.py \
@@ -472,6 +509,19 @@ docs: install
 docs-serve: install
 	$(ACT); mkdocs serve -a 127.0.0.1:8000
 
+# ======================================================================
+# Film
+# ======================================================================
+# "Before You See It" - deterministic 15s film, rendered frame by frame from
+# visual_identity/before_you_see_it/film.html. Needs playwright + a chromium
+# build; see that directory's README.
+
+film: install
+	$(ACT); python visual_identity/before_you_see_it/render_film.py --cut cc-framework
+
+film-ghost-ark: install
+	$(ACT); python visual_identity/before_you_see_it/render_film.py --cut ghost-ark
+
 # ======================================================================
 # Verifications
 # ======================================================================

README.md

@@ -9,6 +9,36 @@ stacked-system failure, not a safety certification.**
 <!-- DOI badge placeholder: uncomment after Zenodo mints a DOI in Phase 2e. -->
 <!-- [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.TODO.svg)](https://doi.org/10.5281/zenodo.TODO) -->
 
+---
+
+<p align="center">
+  <a href="visual_identity/before_you_see_it/README.md">
+    <img src="visual_identity/before_you_see_it/renders/poster__cc-framework.png" width="860"
+         alt="A frozen protocol: claim, falsifier, control, non-claim, and one empty result slot">
+  </a>
+</p>
+
+<p align="center">
+  <b>A story can start a question. It cannot finish an answer.</b><br>
+  <sub><a href="visual_identity/before_you_see_it/README.md"><b>Before You See It</b></a>
+  &nbsp;·&nbsp; a 15-second film &nbsp;·&nbsp; <i>Keep the wonder. Check the claim.</i></sub>
+</p>
+
+Those five cards are the entire discipline. Name the **claim**. Name the
+**falsifier** that would end it. Name the **control** that could embarrass it.
+Name the **non-claim** it will never support. Then lock all four *before* the
+result slot is filled, and let the result disagree.
+
+This repository is the machinery for doing that to composed AI guardrail
+evidence: Frechet-Hoeffding bounds that stay honest about unknown dependence,
+evidence roles that decide what a measurement is allowed to say, receipts that
+prove bytes and refuse to prove safety, and claims that expire. The film has one
+`INCONCLUSIVE` frame in it on purpose - and when it has no verifier output to
+show, it stamps `ILLUSTRATION` on its own footage rather than imply a result it
+was not given.
+
+---
+
 CC-Framework is a Python research framework for dependence-aware analysis of
 composed binary guardrail failures. It computes what available guardrail
 evidence supports under stated dependence assumptions. It does not certify that