[FLO-13.2a] Establish the immutable hermetic provider package and success path

[szmyty]

Parent: #29

Closes #44

Next checkpoint: #45 (intentionally blocked pending review and sync)

Summary

• add a separately compiled hermetic synthetic provider fixture that imports only Flow's public API
• freeze immutable provider/package identity and stable inspect, transform, validate, and observe capability declarations
• exercise the real public success path: resolution → subject observation → authority → local process execution → transcript validation → artifact observation → acceptance
• prove deterministic evidence and output bytes across fresh roots while preserving package and input bytes
• document package materialization, external manifest/lock finalization, trust boundaries, and the checkpoint handoff

Validation

• Rust 1.85: formatting, clippy with warnings denied, all targets, doc tests, focused integration tests, and provider-binary unit tests
• stable Rust: formatting, clippy with warnings denied, all targets, and doc tests
• cargo package --locked --allow-dirty
• python3 tools/validate_contracts.py
• python3 tools/generate_scenario_sources.py --check
• python3 .agents/specs/validate-specs.py
• python3 .agents/skills/validate-skills.py
• python3 .agents/agents/validate-agents.py
• independent read-only implementation and documentation review

Scope boundary

This checkpoint intentionally does not add the bounded lifecycle/protocol outcome matrix (#45), artifact adversaries or graph fixtures (#46), real holon algorithms, external services, checkpoint/resume, provider-native semantic validation, or sandbox/containment/authenticity claims. The process remains explicitly trusted-unconfined.

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 10⭐
  Check Your Progress