feat(sol): frontier provider mesh with proof-carrying execution - #264

Purpose

Continue the SOL control plane into a provider-neutral frontier interoperability mesh while keeping Automaton-3 as the sole authority root, and add a durable cross-provider organization loop in which provider work becomes bounded, content-addressed, non-authoritative evidence instead of disappearing in chat/session state.

Exact lineage attestation

BASE = #225 @ cd920379df1a23a61b969f0e52549c04bc3a91bb
CURRENT_HEAD = 5f331e55d5d3a3f14c99d800eefaa13178cc098e
ORGANISM_INTEGRATION_PARENT = ec84aa32b939a0c3b14748f32704526a6f136641
PR264_VERIFICATION_PARENT = 31aec51c32caa2431cb94ee742c912059802568b
MERGE_BASE = cd920379df1a23a61b969f0e52549c04bc3a91bb

#225 is restored to its frozen head cd920379.... A transient placement error put the organism commits on the #225 head branch; the exact 24-file implementation delta was transplanted as one commit on #264 (31aec51c... -> ec84aa32...) and #225 was then restored byte-exact to cd920379.... The current #264 head adds one CI repair commit over that integration so LUT-KAN direct execution has repository-root import visibility.

Integrated external exact-head witness — ESTABLISHED

A separate GitHub-hosted runner checked out AEGIS by exact SHA 5f331e55d5d3a3f14c99d800eefaa13178cc098e and ran the inherited Frontier/Sensorium verification and the new cross-provider organism path in one job.

RUNNER_REPOSITORY = tarikskalic33/info
RUN_ID = 32251071387
JOB_ID = 96061953009
ARTIFACT_ID = 9364438511
EXTERNAL_ARTIFACT_DIGEST = sha256:8b055ee7e1262fac4d9e0a0e11f6cbea173906fdbef8912a0a3d0c7cb63a3917

Observed execution:

EXACT_INTEGRATED_LINEAGE = PASS
COGNITIVE_EVIDENCE_BINDING = 6/6 PASS
FRONTIER_PYTHON = 59/59 PASS
LUT_KAN_REPLAY = PASS
FRONTIER_JSON_CONTRACTS = PASS
CONSTITUTIONAL_BUNDLE = PASS
SHARED_CLAUDE_GEMINI_CODEX_ENTRYPOINT_VALIDATION = PASS
NARROW_CONTRIBUTION_CAPABILITY = PASS
BROADER_ORCHESTRATION_AUTHORITY_PROMOTION = ABSENT
ORGANISM_PROVIDER_SESSION_CONTRACTS = 33/33 PASS
D3_OPERATOR_BOUNDARY = PASS
D4_DENY = PASS
FRONTIER_SENSORIUM_RUNTIME = PASS
TYPESCRIPT_TYPECHECK = PASS
COMMON_MCP_BUILD = PASS
CLAUDE_GEMINI_CODEX_SHARED_LAUNCHER = PASS
MCP_RESOURCE_REGRESSION = PASS
MCP_AUTOMATON3_REGRESSION = PASS
REAL_PROVIDER_STDIO_WORK_CYCLE = PASS
CREDENTIAL_SCAN = PASS

The real provider stdio cycle is:

provider session
  -> shared AEGIS MCP launcher
  -> Automaton-3 identity/authority evaluation
  -> aegis_next_work
  -> bounded provider work
  -> aegis_contribute_text
  -> content-addressed artifact
  -> exact pre-state fence
  -> durable hash-chain journal

The provider contribution remains NON_AUTHORITATIVE_EVIDENCE; it cannot approve, verify or admit itself.

Durable organism implementation

The integrated slice includes:

• persistent work queue and append-only hash-chain journal;
• restart-safe D0/D1/D2 queueing;
• D3 WAITING_OPERATOR semantics and explicit approval path;
• D4 deny;
• bounded retry/failure handling;
• content-addressed provider artifact storage with tamper detection and size/media bounds;
• exact order/journal pre-state binding for contribution writes;
• provider/model/session identity bound to live repository HEAD, exact action digest, commit-bound skill/capability/policy roots and current organism state root;
• shared repo-relative MCP launcher for Anthropic/Claude, Google/Gemini and OpenAI/Codex project entrypoints;
• fail-closed provider/model mismatch handling;
• no authority signer secret embedded in provider project configuration.

Provider-session bootstrap produces identity only:

IDENTITY_ONLY_NOT_AUTHORIZATION

Authority remains external to model output. The CI E2E uses a deterministic test authority key fixture solely inside the runner; this is not represented as a production-safe signer topology.

Current ledger

LINEAGE_CONTINUITY = ESTABLISHED
BASE_ALIGNMENT_WITH_FROZEN_225 = ESTABLISHED

FRONTIER_EXTERNAL_EXACT_HEAD_TEST_PASS = ESTABLISHED
CROSS_PROVIDER_ORGANISM_EXTERNAL_EXACT_HEAD_TEST_PASS = ESTABLISHED
COMMON_MCP_PROVIDER_STDIO_E2E = ESTABLISHED
CONTENT_ADDRESSED_PROVIDER_CONTRIBUTION = IMPLEMENTED_AND_TESTED
CONTRIBUTION_PRESTATE_FENCE = IMPLEMENTED_AND_TESTED
PROVIDER_OUTPUT_AUTHORITY = NEVER
BROADER_ORCHESTRATION_AUTHORITY_PROMOTION = ABSENT

AGNT_004_DESIGN = SPECIFIED
AGNT_004_IMPLEMENTATION = ESTABLISHED_IN_BRANCH
AGNT_004_EXTERNAL_EXACT_HEAD_COMPONENT_WITNESS = ESTABLISHED
AGNT_004_EMPIRICAL_VALIDATION = NOT_ESTABLISHED
AGNT_004_FULL_AUTHORITY_INTEGRATION_PASS = NOT_ESTABLISHED

AEGIS_REPO_NATIVE_EXACT_HEAD_CI_PASS = NOT_ESTABLISHED / BLOCKED_BY_ISSUE_269
PRODUCTION_ADMISSION = NOT_ESTABLISHED

Constitutional Sensorium boundary

The observation contract remains non-authoritative:

authorityEffect = OBSERVATION_ONLY
observationTier = T2
authorityWeight = 0
mayGroundStateTransition = false

Provider/model output is evidence only. D3 requires explicit operator approval and D4 remains denied. No provider win, score or contribution changes AEGIS authority.

Security/dependency boundary

The earlier #264 dependency triage established that the reported npm vulnerabilities are in the development/tooling graph while npm audit --omit=dev reported zero production-graph vulnerabilities at that audited SHA. This does not erase the tooling debt and no forced dependency upgrade is applied here.

Deliberately not claimed

• no merge to main;
• no production provider calls or credit spend;
• no API-key, IAM, OAuth or DNS provisioning;
• no production-safe authority-signer sidecar/service yet;
• no atomic authoritative state admission;
• no CompleteVerification claim;
• no claim that cross-provider performance establishes AGI;
• no production/certification claim.

Next implementation closure

The next organism slice reuses the existing #264 SSEStreamLease owner/generation/fencing semantics to add durable work claim/lease fencing so multiple providers cannot silently duplicate the same queued work. This must remain bounded by the same Automaton-3 authority path rather than creating a second scheduler authority root.

Effect-bound verification continues independently through the frozen #268 -> #270 -> #272 lineage; this PR does not reinterpret DecisionReceipt, ExecutionReceipt or EffectReceipt semantics.