Add minimal typed builder-lineage core

[jeffhuber]

Summary

Adds an explicit, pure typed contract for builder contribution lineage. Immutable targets preserve exact branch case; episodes and identity aliases store canonical values. One target-bound Chain factory enforces the 560-arrival budget before deduplication and validates up to 32 contiguous episodes. Resolution excludes every recorded contributor and waits when the recorded final head is stale.

History validates raw comments and page transport before trust or parsing. Separate immutable authority accounts control strict marker parsing, and rendering requires a validated nonempty Chain. Includes a byte-identical standalone helper, init support declaration, and regenerated package inventory. Live consumers remain unchanged.

Closes #990
Refs #963

Validation

Exact head: 6b1642d561ee46987870f492f95d4222179d2374.

• python -m unittest discover -s tests -p 'test_minimal_lineage_*.py' -v — 30 tests passed, including 528 public + 32 private arrivals, bounded overconsumption refusal, and isolated import/parse/resolve/admit from real init output with package and repository source unavailable to imports.
• Existing release-hygiene package source-reuse test — passed after the two-file manifest correction.
• python -m ruff check . — passed.
• python scripts/privacy_scan.py — passed.
• python scripts/guard_package_workflows.py — passed.
• python -m code_mower.migration release-readiness --json — 20 checks passed.
• Canonical package manifest regeneration and equality — passed.
• Committed-head scope guard and pre-push guard — passed; 10 changed files, 80,246 base-to-head diff bytes.

Broker canonical preflight independently passed all 30 owning tests and 214 recorded subcases across the strict-contract matrix, plus the existing package source-reuse regression. Full unittest discovery passed 3,688 tests with 16 skips. Independent Claude review passed with zero findings and complete diff coverage. Python 3.12/3.13/3.14 package CI, both containment checks, and the authoritative gate passed on this exact head. Protected guard/config hashes are unchanged; source is clean and quiescent, and the broker lease is released with absence observed. Ready for root coordination to merge; no merge has been performed by this lane.

Risk / Rollback

This stage adds a pure contract and packaged support file; it does not activate consumers, adapters, stores, provider calls, or publishing. Revert this commit to remove the contract and inventory declarations.

Data Or Secret Exposure

• This change does not add source, raw diffs, raw transcripts, raw provider output, tokens, or machine-specific paths to public artifacts.

Builder-Provider: codex
Builder-Executor: codex_cli

[jeffhuber]

Root-authorized same-Codex test-only correction: use sys.executable for the materialized import subprocess while retaining -I -S and all isolation assertions. Broker's canonical focused run exposed a PATH-dependent older Python in that child; the provider's Python 3.12 shim run passed. No product/API behavior changes.

Five-minute / 8-MB supervision cap, same session/lease/profile and unchanged 10-file/180-KB guard. No USD cap claim or automatic follow-up source round. After clean delivery, run canonical owning tests, strict-spec/prior-finding matrix, guards and manifest equality before full-suite and independent Claude review. Keep draft.

[jeffhuber]

Bounded same-builder packaging correction for this draft PR at bfb6ba0cf0760bbbd1075951bd39a0d380107035.

The full suite and all package CI matrices report one failure: the existing manifest source-reuse invariant rejects using the canonical lineage module twice as a package source. Keep its canonical source/target entry unchanged; use the committed standalone tools mirror as the source for the tools target and regenerate the committed manifest. Only the two existing manifest files may change. No core, API, test allowlist, consumer, or scope expansion.

The same Codex source session will execute under the existing Code Mower checkout/permission/guard boundary with a five-minute and 8-MB output limit. Before push, require the owning contract/transport/materialization tests, the exact failed release-hygiene test, byte parity, manifest equality, Ruff/privacy/workflow/readiness and scope guards. After clean delivery, the broker will run fresh canonical checks and one full unittest suite; independent Claude review follows a green frozen-head receipt. The PR remains draft; no further correction is automatically authorized.

[jeffhuber]

Claude audit (merge-authority lane)

Head SHA: 6b1642d561ee46987870f492f95d4222179d2374
Findings: P0=0, P1=0, P2=0, P3=0 (blocker policy: any P0/P1/P2 -> BLOCKED)

Claude Audit: PASS

Summary:

Independent Claude review of the Codex-authored pure lineage contract at exact head 6b1642d. Reviewed the complete 80,246-byte diff across all 10 changed files, including typed invariants, strict history and marker parsing, bounded chain handling, canonical identities, isolated packaging support and the final manifest correction. No P0, P1, P2 or P3 findings. Static review; test results are tracked separately.

Findings: none.