feat(sol): frontier provider mesh with proof-carrying execution

.aegis/evidence/agnt-004-local-component-witness-48f9f06c.json

@@ -0,0 +1,60 @@
+{
+  "schema_version": "1.0.0",
+  "witness_id": "agnt-004-local-component-witness-48f9f06c",
+  "repository": "Aegis-Omega/AEGIS-OMEGA",
+  "component": "AGNT-004 Sovereign Sensorium & VCM Bridge",
+  "tested_source_head_sha": "48f9f06c3440af1c49af8670c222c65535559944",
+  "base_sha": "cd920379df1a23a61b969f0e52549c04bc3a91bb",
+  "source_blob_bindings": {
+    "sovereign-omega-v2/src/sensorium/sensorium-observation.ts": "78fd2690bdceffe76007d099e45964d47dbfd557",
+    "sovereign-omega-v2/src/sensorium/vcm-bridge.ts": "22e9ec862fe5c9c7b4cad84d2ff4f2d9e88a3425",
+    "sovereign-omega-v2/src/sensorium/sensorium-degradation.ts": "523ceeff04de29e5ff642c4282eee8c1168072d2"
+  },
+  "execution_environment": {
+    "node": "v22.16.0",
+    "typescript": "5.8.3",
+    "runner": "local-container",
+    "network_checkout": "UNAVAILABLE_DNS",
+    "test_harness": "node:test component harness",
+    "dependency_note": "The three AGNT-004 production source files were byte-bound to GitHub via matching Git blob SHA. The local harness used the current sha256Hex runtime semantics required by sensorium-observation, but this witness is not represented as a full repository checkout or repo-native Vitest execution."
+  },
+  "tdd": {
+    "observation_red": "ERR_MODULE_NOT_FOUND before sensorium-observation implementation",
+    "vcm_red": "ERR_MODULE_NOT_FOUND before vcm-bridge implementation",
+    "degradation_red": "ERR_MODULE_NOT_FOUND before sensorium-degradation implementation",
+    "fail_closed_refinement_red": "malformed recommendation/cap pair failed to throw before repair",
+    "final_component_tests": 17,
+    "final_component_failures": 0,
+    "final_component_status": "PASS",
+    "final_log_sha256": "d4246cae4a8aa22e2bcf5a31395d351be97e33e9af2efdde3a523fde31e7708c",
+    "final_log_bytes": 3027
+  },
+  "established": [
+    "AGNT_004_SOURCE_BYTES_BOUND_TO_TESTED_SOURCE_HEAD",
+    "OBSERVATION_DIGEST_DETERMINISM_FOR_TESTED_CASES",
+    "AUDIT_WALL_CLOCK_EXCLUDED_FROM_OBSERVATION_DIGEST_FOR_TESTED_CASES",
+    "VCM_INTEGER_RECURRENCES_BOUNDED_FOR_TESTED_CASES",
+    "SENSORIUM_DEGRADATION_NON_AMPLIFICATION_FOR_TESTED_CASES",
+    "SENSORIUM_DEGRADATION_IDEMPOTENCE_FOR_TESTED_CASES",
+    "MALFORMED_RECOMMENDATION_CAP_PAIR_FAILS_CLOSED_FOR_TESTED_CASES"
+  ],
+  "not_established": [
+    "FULL_REPOSITORY_LOCAL_TEST_PASS",
+    "REPO_NATIVE_VITEST_PASS",
+    "EXACT_HEAD_GITHUB_ACTIONS_PASS",
+    "AUTHORITY_INTEGRATION_PASS",
+    "EMPIRICAL_VALIDATION_OF_VCM_OR_RETENTION_MODEL",
+    "PRODUCTION_ADMISSION"
+  ],
+  "github_exact_head_observation": {
+    "workflow": "Frontier Provider Mesh",
+    "workflow_run_id": 31930005682,
+    "job_id": 95123267296,
+    "job_head_sha": "48f9f06c3440af1c49af8670c222c65535559944",
+    "runner_id": 0,
+    "steps": 0,
+    "status": "PRE_RUN_INFRA_BLOCKED",
+    "annotation": "The job was not started because your account is locked due to a billing issue."
+  },
+  "witness_scope_rule": "This witness certifies only the recorded tested_source_head_sha and bound source blobs. A later branch head is not automatically certified."
+}

.aegis/evidence/agnt-004-omega3-contract-witness-e04ca.json

@@ -0,0 +1,41 @@
+{
+  "schema_version": "1.0.0",
+  "witness_id": "agnt-004-omega3-contract-e04ca-20260816",
+  "repository": "Aegis-Omega/AEGIS-OMEGA",
+  "source_parent_sha": "e04ca331e7174e770c6470ea8d5e5d7c2352ca26",
+  "scope": "AGNT_004_OMEGA_3_EXPLICIT_PERCEPTION_AUTHORITY_BOUNDARY",
+  "pre_patch_source_blob": "78fd2690bdceffe76007d099e45964d47dbfd557",
+  "post_patch_source_blob": "774dc8ddbc3e437c36e012d597eab3f71f6cf738",
+  "pre_patch_test_blob": "0350dd3cec3a09355c55db27710848058b0aa949",
+  "post_patch_test_blob": "2d01b159714d62bba10e49f55cadeabc909b9544",
+  "tdd_red": {
+    "observed": true,
+    "failure": "undefined !== 'T2'",
+    "meaning": "existing Sensorium observation did not explicitly carry observationTier"
+  },
+  "tdd_green": {
+    "tests": 2,
+    "pass": 2,
+    "fail": 0,
+    "typecheck": "PASS_WITH_LOCAL_SHA256_RUNTIME_SEAM"
+  },
+  "established": [
+    "SENSORIUM_AUTHORITY_EFFECT_OBSERVATION_ONLY",
+    "SENSORIUM_OBSERVATION_TIER_T2_EXPLICIT",
+    "SENSORIUM_AUTHORITY_WEIGHT_ZERO_EXPLICIT",
+    "SENSORIUM_MAY_GROUND_STATE_TRANSITION_FALSE_EXPLICIT",
+    "OMEGA3_METADATA_INCLUDED_IN_OBSERVATION_DIGEST_ENCODING_FOR_TESTED_CASES"
+  ],
+  "not_established": [
+    "REPO_NATIVE_VITEST_PASS",
+    "EXACT_HEAD_GITHUB_ACTIONS_PASS",
+    "FULL_AUTHORITY_INTEGRATION_PASS",
+    "EMPIRICAL_VALIDATION",
+    "PRODUCTION_ADMISSION"
+  ],
+  "sha256": {
+    "post_patch_source": "981657471660113d86796ceeaa682ada86bb07d3c5e5d41db615ad1e3ce9f746",
+    "post_patch_test": "902071565e4aab1877ad45bd32cff379aec9ed940e36c190b0bc0af31d1a060f",
+    "local_green_tap": "2b3810a2b317b398e7e8feb26e05917ec6b42e11f671602030a1c0aaa31ade67"
+  }
+}

.aegis/evidence/constitutional-bundle-v1-local-witness.json

@@ -0,0 +1,50 @@
+{
+  "epistemic_boundary": {
+    "exact_head_ci_pass": "NOT_ESTABLISHED",
+    "local_component_witness": "ESTABLISHED",
+    "production_admission": "NOT_ESTABLISHED",
+    "repository_binding": "PENDING_REF_UPDATE"
+  },
+  "files": {
+    "plan.md": {
+      "bytes": 928,
+      "sha256": "56b4bebdd1975ba916c9b4c40e4aa9892cada738a648da47ab35e74d2c212db0"
+    },
+    "spec.md": {
+      "bytes": 2282,
+      "sha256": "b1d46ab5aeccc0bcdac28b098ebc098f3ca3ee32cd11606f14a9ca81896b444b"
+    },
+    "src/core/constitutional_invariants.mjs": {
+      "bytes": 5561,
+      "sha256": "8faf710cef43f9cd5883f1efa967dc916b6093ce8d33b33e26b42723c4f24bc8"
+    },
+    "state.md": {
+      "bytes": 586,
+      "sha256": "3efd6f3cce396429c51d5b84e89092c847466ea186802dc0ab4900f20cc700b0"
+    },
+    "tests/unit/constitutional_invariants.test.mjs": {
+      "bytes": 7492,
+      "sha256": "1d81ec92fbe418e72bc450670f68b1179fda3f7cec23236241dafd9583525530"
+    }
+  },
+  "runtime": {
+    "node": "v22.16.0",
+    "platform": "Linux-6.18.35-x86_64-with-glibc2.41"
+  },
+  "schema_version": "1.0.0",
+  "scope": "OMEGA_1_OMEGA_2_OMEGA_3_CONSTITUTIONAL_FALSIFICATION",
+  "source_parent_sha": "550c025fc937349df7b4b0ff9d042e1224f07557",
+  "tdd_green": {
+    "command": "node --test tests/unit/constitutional_invariants.test.mjs",
+    "fail": 0,
+    "pass": 35,
+    "skipped": 0,
+    "tests": 35
+  },
+  "tdd_red": {
+    "failure": "ERR_MODULE_NOT_FOUND",
+    "observed": true,
+    "reason": "implementation absent before production code"
+  },
+  "witness_id": "constitutional-bundle-v1-local-20260816"
+}

.codex/config.toml

@@ -0,0 +1,8 @@
+[mcp_servers.aegis]
+command = "node"
+args = ["scripts/aegis-provider-mcp.mjs", "openai", "@AEGIS_CODEX_MODEL"]
+required = true
+default_tools_approval_mode = "prompt"
+enabled_tools = ["aegis_organism_status", "aegis_next_work", "aegis_contribute", "aegis_contribute_text"]
+startup_timeout_sec = 20
+tool_timeout_sec = 60

.gemini/settings.json

@@ -0,0 +1,16 @@
+{
+  "mcp": {
+    "allowed": ["aegis"]
+  },
+  "mcpServers": {
+    "aegis": {
+      "command": "node",
+      "args": [
+        "scripts/aegis-provider-mcp.mjs",
+        "google",
+        "@AEGIS_GEMINI_MODEL"
+      ],
+      "cwd": "."
+    }
+  }
+}

.github/workflows/frontier-provider-mesh.yml

@@ -0,0 +1,134 @@
+name: Frontier Provider Mesh
+
+on:
+  push:
+    branches:
+      - feat/frontier-provider-mesh-v1
+    paths:
+      - 'agents/cognitive_pipeline_auditbound.py'
+      - 'agents/tests/test_cognitive_evidence_binding.py'
+      - 'platform/sol/**'
+      - 'sovereign-omega-v2/src/api/frontier-*.ts'
+      - 'sovereign-omega-v2/src/sensorium/**'
+      - 'sovereign-omega-v2/test/unit/frontier-*.test.ts'
+      - 'sovereign-omega-v2/test/unit/sensorium-*.test.ts'
+      - '.github/workflows/frontier-provider-mesh.yml'
+  pull_request:
+    branches:
+      - feat/sol-cross-platform-control-plane
+    paths:
+      - 'agents/cognitive_pipeline_auditbound.py'
+      - 'agents/tests/test_cognitive_evidence_binding.py'
+      - 'platform/sol/**'
+      - 'sovereign-omega-v2/src/api/frontier-*.ts'
+      - 'sovereign-omega-v2/src/sensorium/**'
+      - 'sovereign-omega-v2/test/unit/frontier-*.test.ts'
+      - 'sovereign-omega-v2/test/unit/sensorium-*.test.ts'
+      - '.github/workflows/frontier-provider-mesh.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: frontier-provider-mesh-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  frontier-contract:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout exact candidate
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install verification dependency
+        run: python -m pip install --disable-pip-version-check jsonschema==4.23.0
+
+      - name: Compile audit-bound modules
+        run: |
+          python -m py_compile agents/cognitive_pipeline_auditbound.py
+          python -m py_compile platform/sol/frontier/*.py
+
+      - name: Verify Copenhagen cognitive recovery
+        run: python -m unittest agents.tests.test_cognitive_evidence_binding -v
+
+      - name: Verify frontier provider mesh
+        run: python -m unittest discover -s platform/sol/tests -p 'test_frontier_*.py' -v
+
+      - name: Preserve INT4 LUT-KAN replay parity
+        run: PYTHONPATH=. python agents/tests/test_lut_kan_parity.py
+
+      - name: Parse canonical JSON contracts
+        run: |
+          python -m json.tool platform/sol/contracts/platform-registry.v1.json >/dev/null
+          python -m json.tool platform/sol/contracts/execution-request.v1.schema.json >/dev/null
+          python -m json.tool platform/sol/contracts/execution-result.v1.schema.json >/dev/null
+          python -m json.tool platform/sol/contracts/proof-carrying-work-order.v1.schema.json >/dev/null
+          python -m json.tool platform/sol/contracts/sse-stream-lease.v1.schema.json >/dev/null
+          python -m json.tool platform/sol/contracts/frontier-connections.v1.schema.json >/dev/null
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: sovereign-omega-v2/package-lock.json
+
+      - name: Install Sovereign Runtime dependencies
+        working-directory: sovereign-omega-v2
+        run: npm ci
+
+      - name: Verify TypeScript frontier + Sensorium runtime behavior
+        working-directory: sovereign-omega-v2
+        run: npm run test -- test/unit/frontier-inference-gateway.test.ts test/unit/frontier-provider-transports.test.ts test/unit/frontier-stream-lease.test.ts test/unit/frontier-automaton3-verifier.test.ts test/unit/frontier-runtime.test.ts test/unit/sensorium-observation.test.ts test/unit/sensorium-vcm-bridge.test.ts test/unit/sensorium-degradation.test.ts
+
+      - name: Typecheck Sovereign Runtime frontier integration
+        working-directory: sovereign-omega-v2
+        run: npm run typecheck
+
+      - name: Reject obvious committed credential material in frontier slice
+        shell: bash
+        run: |
+          python - <<'PY'
+          from pathlib import Path
+          import re
+          import sys
+
+          roots = [
+              Path('platform/sol/frontier'),
+              Path('sovereign-omega-v2/src/sensorium'),
+          ]
+          files = [
+              Path('agents/cognitive_pipeline_auditbound.py'),
+              *sorted(Path('sovereign-omega-v2/src/api').glob('frontier-*.ts')),
+          ]
+          for root in roots:
+              files.extend(
+                  path for path in sorted(root.rglob('*'))
+                  if path.is_file() and path.suffix not in {'.md', '.yml', '.yaml'}
+              )
+
+          patterns = (
+              re.compile(r'sk-[A-Za-z0-9_-]{16,}'),
+              re.compile(r'Bearer\s+[A-Za-z0-9._-]{16,}'),
+              re.compile(r'''api[_-]?key\s*=\s*["'][^"']{12,}''', re.IGNORECASE),
+          )
+          matches = []
+          for path in sorted(set(files)):
+              if not path.is_file() or path.suffix in {'.md', '.yml', '.yaml'}:
+                  continue
+              text = path.read_text(encoding='utf-8', errors='replace')
+              if any(pattern.search(text) for pattern in patterns):
+                  matches.append(path.as_posix())
+
+          if matches:
+              for match in matches:
+                  print(f'credential-like material detected: {match}', file=sys.stderr)
+              raise SystemExit(1)
+          print('CREDENTIAL_SCAN=PASS')
+          PY

.mcp.json

@@ -2,11 +2,11 @@
   "mcpServers": {
     "aegis": {
       "command": "node",
-      "args": ["/home/user/AEGIS-OMEGA/sovereign-omega-v2/mcp-server/dist/index.js"],
-      "env": {
-        "AEGIS_BRIDGE_URL": "https://aegis-vertex.aegisomega.com",
-        "AEGIS_API_KEY": ""
-      }
+      "args": [
+        "scripts/aegis-provider-mcp.mjs",
+        "anthropic",
+        "@AEGIS_CLAUDE_MODEL"
+      ]
     }
   }
 }