P0: Implement Python PoCI reference verifier

[safal207]

Parent: #180
Depends on: #181, #182, #183, #184

Objective

Implement a deterministic offline verifier for Action Proof Envelope v0.1.

Target paths

• scripts/verify_poci.py
• reusable module under the existing Python package structure if appropriate

Required verification stages

1. parse and schema validation;
2. protocol/profile compatibility;
3. intent signature reference and expiry checks;
4. authority, scope, budget, and replay checks;
5. causal-parent presence and consistency;
6. proposal-to-execution binding;
7. execution receipt integrity;
8. observed-result integrity;
9. witness statement and conflict evaluation;
10. decision and reason-code aggregation;
11. canonical output and evidence-root verification.

CLI contract

python3 scripts/verify_poci.py path/to/envelope.json

The command must return:

• deterministic JSON on stdout;
• a concise human summary on request;
• non-zero exit status for invalid or non-accepted evidence according to documented modes.

Definition of done

• All committed fixtures return their expected decisions and reason codes.
• Verification works offline.
• No network calls are made.
• Output ordering is stable.
• Unexpected exceptions are converted to fail-closed verifier errors.
• CLI supports a machine-readable mode suitable for CI.

[safal207]

Implementation is available in stacked draft PR #195. It provides offline deterministic verification, distinct ACCEPT/HOLD/BLOCK/CHALLENGE exit codes, duplicate-key rejection, semantic evidence checks, canonical envelope-root computation, and manifest mode. The embedded verification verdict is intentionally not trusted.