feat: add Lotus Family auditor v0.1

.github/workflows/lotus-family-conformance.yml

@@ -0,0 +1,36 @@
+name: Lotus Family conformance
+
+on:
+  pull_request:
+    paths:
+      - "standards/lotus-family/**"
+      - ".github/workflows/lotus-family-conformance.yml"
+  push:
+    paths:
+      - "standards/lotus-family/**"
+      - ".github/workflows/lotus-family-conformance.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  conformance:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Run Lotus Family conformance suite
+        run: |
+          python -m unittest discover \
+            -s standards/lotus-family/conformance \
+            -p 'test_*.py' \
+            -v

standards/lotus-family/.gitignore

@@ -0,0 +1,2 @@
+artifacts/
+__pycache__/

standards/lotus-family/ACCEPTANCE.md

@@ -0,0 +1,7 @@
+# Acceptance criteria
+
+- Removing a required English or Russian contract term produces `DRIFT`.
+- A regression test that is not discovered by configured CI produces `DRIFT`.
+- Missing snapshots, refs, or exact commit identities produce `UNKNOWN`, never `PASS`.
+- Evidence records checked file paths and SHA-256 hashes.
+- Audit results remain advisory and grant no execution or merge authority.

standards/lotus-family/DECISION-CODES.md

@@ -0,0 +1,15 @@
+# Lotus Family audit result codes
+
+| Outcome | Reason code | Meaning |
+|---|---|---|
+| `PASS` | `LOTUS_CONTRACT_CONFORMANT` | Every configured invariant passed for the supplied snapshot and caller-provided identity claims. |
+| `DRIFT` | `LOTUS_CONTRACT_DRIFT` | A required contract, test, or executable CI discovery invariant is missing. |
+| `UNKNOWN` | `SNAPSHOT_UNAVAILABLE` | The repository snapshot is unavailable. |
+| `UNKNOWN` | `COMMIT_SHA_INVALID` | The supplied commit claim is not a lowercase 40-character SHA. |
+| `UNKNOWN` | `REPOSITORY_REF_MISSING` | The repository ref claim was not supplied. |
+| `UNKNOWN` | `REPOSITORY_NOT_CONFIGURED` | No manifest adapter exists for the repository ID. |
+| `UNKNOWN` | `MANIFEST_INVALID` | The manifest cannot be parsed or violates the audit-only boundary. |
+
+Consumers must branch on `outcome` and `reason_code`, not on human-readable detail.
+A `PASS` does not verify remote provenance and grants no ownership, approval,
+execution, delivery, deployment, or merge authority.

standards/lotus-family/IMPLEMENTATION.md

@@ -0,0 +1,5 @@
+# Implementation slice v0.1
+
+This first slice turns the Lotus Family strength map into executable checks.
+It intentionally audits materialized exact snapshots and does not perform remote
+repository access or consequential actions.

standards/lotus-family/NOTICE.md

@@ -0,0 +1,4 @@
+# Authority notice
+
+Lotus Family audit output is advisory evidence only. It does not grant ownership,
+approval, execution, delivery, deployment, or merge authority.

standards/lotus-family/README.md

@@ -0,0 +1,89 @@
+# Lotus Family Conformance v0.1
+
+A bounded, machine-readable audit surface for checking the shared Lotus contract
+across Pythia, CML, and LS.
+
+## Outcomes
+
+- `PASS` — every configured content and executable-CI invariant passed for the
+  supplied snapshot and the caller-provided repository, ref, and commit claims.
+- `DRIFT` — the snapshot is available, but a required contract term, regression
+  test, or CI discovery rule is missing.
+- `UNKNOWN` — the repository snapshot, ref claim, commit claim, or manifest could
+  not be evaluated safely. `UNKNOWN` is never promoted to `PASS`.
+
+## Identity assurance
+
+Version 0.1 does not fetch a remote repository and does not prove commit
+reachability or a clean working tree. Repository, ref, and commit values are
+caller-provided claims recorded in evidence. Results expose
+`identity_assurance.mode = caller_claim_only` so consumers cannot mistake these
+claims for verified provenance.
+
+SHA-256 evidence binds each check to the exact bytes read and evaluated from the
+supplied snapshot. It does **not** prove that those bytes came from the claimed
+remote repository, ref, or commit. Independent trusted materialization and
+provenance verification are required before evidence may be called fresh for an
+exact head.
+
+Until that verification exists, `PASS` means conformance of the supplied
+snapshot contents, not cryptographic proof that the snapshot came from the
+claimed remote commit.
+
+## Causal spacetime testing model
+
+The test model has two compatible layers:
+
+- `causality/lotus-family-causality-v0.1.json` and
+  `causality/test-paths-v0.1.json` preserve the original causal routes;
+- `causality/lotus-family-system-v0.1.json` and
+  `causality/system-routes-v0.1.json` add spatial, temporal, hierarchical, and
+  trajectory views.
+
+The system graph separates bounded snapshot `PASS` from independently verified
+exact-head freshness and merge eligibility. Centrality means review priority and
+blast radius only; it never grants ownership, approval, execution, delivery, or
+merge authority.
+
+Every new blocker must add or reuse a graph node and include an executable route
+when runtime behavior is involved. This prevents isolated regression tests from
+hiding missing relationships between workflow structure, inherited execution
+context, test selection, evidence, and verdicts.
+
+## Boundary
+
+The auditor is read-only and `audit_only`. Its result does not grant ownership,
+approval, execution, delivery, deployment, or merge authority.
+
+It does not fetch repositories, call GitHub, merge pull requests, or deploy
+software. An integration materializes the repository snapshot it wants to audit.
+
+## Snapshot layout
+
+```text
+snapshot-root/
+  safal207__pythiaLabs/
+  safal207__Causal-Memory-Layer/
+  safal207__LS/
+```
+
+Each directory must contain the files named by
+[`manifest/lotus-family-v0.1.json`](manifest/lotus-family-v0.1.json).
+
+## Run one audit
+
+```bash
+python standards/lotus-family/conformance/lotus_family_auditor.py \
+  --manifest standards/lotus-family/manifest/lotus-family-v0.1.json \
+  --snapshot-root /path/to/snapshots \
+  --repository-id pythia \
+  --repository-ref refs/heads/main \
+  --commit-sha 0123456789abcdef0123456789abcdef01234567 \
+  --output artifacts/lotus-family/pythia.json
+```
+
+Exit codes are `0` for `PASS`, `2` for `DRIFT`, and `3` for `UNKNOWN`.
+
+The evidence artifact records the caller-provided repository identity claims,
+check outcomes, checked file paths, SHA-256 hashes, identity-assurance limits,
+and the audit-only authority boundary.

standards/lotus-family/ROADMAP.md

@@ -0,0 +1,20 @@
+# Lotus Family auditor roadmap
+
+## v0.1
+
+- manifest for Pythia, CML, and LS;
+- syntactically exact repository ref and commit SHA claims;
+- explicit `caller_claim_only` identity assurance;
+- `PASS / DRIFT / UNKNOWN` outcomes;
+- bilingual contract, authority firewall, regression test, and executable CI discovery checks;
+- causal graph, executable causal routes, and derived traceability;
+- SHA-256 evidence from the same bytes used for evaluation;
+- audit-only authority boundary.
+
+## Follow-up
+
+- materialize snapshots through a trusted integration;
+- verify remote repository identity, commit reachability, and clean snapshot state;
+- sign or attest evidence artifacts without granting execution authority;
+- aggregate three repository results into one family report;
+- generate selected regression fixtures from causal routes while keeping human review.

standards/lotus-family/VERSION

@@ -0,0 +1 @@
+0.1

standards/lotus-family/causality/SYSTEM-MODEL.md

@@ -0,0 +1,68 @@
+# Lotus causal spacetime system model
+
+The system model extends the original causal test graph with four additional
+views while keeping one audit-only source of truth.
+
+## Five dimensions
+
+- **Causal** — why a condition changes risk or outcome.
+- **Spatial** — where evidence exists: repository, file, workflow, job,
+  dependency graph, step, inherited shell, working directory, test scope,
+  evidence bundle, review, or merge gate.
+- **Temporal** — which state must precede another and when independently bound
+  exact-head evidence becomes stale.
+- **Hierarchy** — how goals, invariants, controls, evidence, outcomes, gates, and
+  authority boundaries relate.
+- **Trajectory** — how the system moves toward bounded snapshot `PASS`,
+  fail-closed `DRIFT`, stale evidence, or merge eligibility.
+
+Machine-readable sources:
+
+- `lotus-family-system-v0.1.json` — 49 nodes, 64 unique directed
+  relationships, centers, and four canonical trajectories;
+- `system-routes-v0.1.json` — 36 connected routes, including runtime
+  regressions and governance-only merge trajectories.
+
+## Centers without centralized authority
+
+The model has separate semantic, snapshot-evidence, and governance centers:
+the invariant set, same-byte hashes, independently verified exact head, and the
+advisory authority boundary.
+
+Same-byte hashing proves which supplied bytes were evaluated. It does not prove
+remote provenance. `center.exact_head` participates only in governance
+trajectories after `gate.provenance_verified`; runtime audit `PASS` routes retain
+`limitation.identity_unverified`.
+
+Centrality scores mean review priority and blast radius only. A highly connected
+node deserves stronger tests and independent review; it does not gain ownership
+or approval authority.
+
+## Time and merge separation
+
+`PASS` belongs to the bounded snapshot-audit trajectory. Merge eligibility is a
+separate trajectory requiring independent provenance binding, fresh exact-head
+evidence, green CI, green security, a fresh exact-head review, and no actionable
+blockers. Even `state.merge_eligible` terminates at
+`authority.advisory_only`.
+
+A head change moves independently bound evidence to `time.evidence_stale`, which
+leads to `state.merge_blocked` until checks and review are rerun on the new exact
+head.
+
+## Effective execution context
+
+GitHub Actions `defaults.run` values are resolved through workflow, job, and step
+scope. Step-level values override job defaults, and job defaults override
+workflow defaults. Unknown shells and non-root or dynamic working directories
+fail closed because raw command text alone cannot prove which tests execute.
+
+## New blocker rule
+
+Every newly discovered blocker must:
+
+1. add or reuse a system node;
+2. add a directed relationship if the causal, spatial, temporal, or hierarchical
+   link is new;
+3. include an executable route when runtime behavior is involved;
+4. preserve the boundary `PASS != APPROVED != MERGED`.

standards/lotus-family/causality/TRACEABILITY.md

@@ -0,0 +1,37 @@
+# Lotus Family causal traceability
+
+The causality graph is the primary behavioral model. This table is the human-readable coverage ledger. A route is valid only when each adjacent node pair is an edge in `lotus-family-causality-v0.1.json`, and the route executes to the declared outcome in `test_causality_model.py`.
+
+## Policy
+
+- New blockers add or reuse a causal node before a regression route is accepted.
+- `PASS` routes must reach evidence produced from the same bytes that were evaluated.
+- `DRIFT` routes model a broken invariant or a false-positive CI path.
+- `UNKNOWN` routes model evidence that cannot be evaluated safely.
+- All outcomes remain advisory and grant no merge or execution authority.
+
+## Routes
+
+| Route | Repository | Scenario | Expected | Causal path |
+|---|---|---|---|---|
+| `CML-PASS-001` | `cml` | `valid` | `PASS` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → control.manifest_valid → control.contract_terms_present → control.workflow_job_runnable → control.step_enabled → control.direct_run → control.test_env_clean → control.shell_straight_line → control.contract_test_selected → evidence.same_bytes_hashed → outcome.pass → authority.advisory_only |
+| `LS-PASS-001` | `ls` | `valid` | `PASS` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → control.manifest_valid → control.contract_terms_present → control.workflow_job_runnable → control.step_enabled → control.direct_run → control.test_env_clean → control.shell_straight_line → control.contract_test_selected → evidence.same_bytes_hashed → outcome.pass → authority.advisory_only |
+| `PYTHIA-PASS-001` | `pythia` | `valid` | `PASS` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → control.manifest_valid → control.contract_terms_present → control.workflow_job_runnable → control.step_enabled → control.direct_run → control.test_env_clean → control.shell_straight_line → control.contract_test_selected → evidence.same_bytes_hashed → outcome.pass → authority.advisory_only |
+| `CI-NONRUN-001` | `cml` | `workflow` | `DRIFT` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → control.manifest_valid → control.contract_terms_present → control.workflow_job_runnable → control.step_enabled → control.non_run_text → risk.false_ci_pass → outcome.drift |
+| `CI-STEP-SKIP-001` | `cml` | `workflow` | `DRIFT` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → control.manifest_valid → control.contract_terms_present → control.workflow_job_runnable → control.step_skipped → risk.false_ci_pass → outcome.drift |
+| `CI-JOB-SKIP-001` | `cml` | `workflow` | `DRIFT` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → control.manifest_valid → control.contract_terms_present → control.workflow_job_not_runnable → risk.false_ci_pass → outcome.drift |
+| `CI-NO-RUNNER-001` | `cml` | `workflow` | `DRIFT` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → control.manifest_valid → control.contract_terms_present → control.workflow_job_not_runnable → risk.false_ci_pass → outcome.drift |
+| `CI-QUOTED-ENV-001` | `cml` | `workflow` | `DRIFT` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → control.manifest_valid → control.contract_terms_present → control.workflow_job_runnable → control.step_enabled → control.direct_run → control.test_env_override → risk.false_ci_pass → outcome.drift |
+| `CI-SHELL-CONTROL-001` | `cml` | `workflow` | `DRIFT` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → control.manifest_valid → control.contract_terms_present → control.workflow_job_runnable → control.step_enabled → control.direct_run → control.test_env_clean → control.shell_control_flow → risk.false_ci_pass → outcome.drift |
+| `CML-SUBSET-001` | `cml` | `workflow` | `DRIFT` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → control.manifest_valid → control.contract_terms_present → control.workflow_job_runnable → control.step_enabled → control.direct_run → control.test_env_clean → control.shell_straight_line → control.contract_test_excluded → risk.false_ci_pass → outcome.drift |
+| `PYTHIA-SUBSET-001` | `pythia` | `workflow` | `DRIFT` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → control.manifest_valid → control.contract_terms_present → control.workflow_job_runnable → control.step_enabled → control.direct_run → control.test_env_clean → control.shell_straight_line → control.contract_test_excluded → risk.false_ci_pass → outcome.drift |
+| `CI-FAKE-STEPS-001` | `cml` | `workflow` | `DRIFT` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → control.manifest_valid → control.contract_terms_present → control.workflow_job_not_runnable → risk.false_ci_pass → outcome.drift |
+| `IDENTITY-INVALID-001` | `cml` | `invalid_commit` | `UNKNOWN` | input.snapshot_present → input.identity_claims_invalid → outcome.unknown |
+| `SNAPSHOT-MISSING-001` | `cml` | `missing_snapshot` | `UNKNOWN` | input.snapshot_missing → outcome.unknown |
+| `CONTRACT-DRIFT-001` | `cml` | `missing_term` | `DRIFT` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → control.manifest_valid → control.contract_terms_missing → outcome.drift |
+| `IDENTITY-LIMIT-001` | `cml` | `valid` | `PASS` | input.snapshot_present → input.identity_claims_well_formed → limitation.identity_unverified → risk.identity_overclaim → authority.advisory_only |
+| `MANIFEST-INVALID-001` | `cml` | `invalid_manifest` | `UNKNOWN` | control.manifest_invalid → outcome.unknown |
+
+## Coverage interpretation
+
+Node coverage shows that a condition or decision is represented. Edge coverage shows that a causal relationship is exercised. Route coverage shows that an end-to-end behavioral path reaches the expected `PASS`, `DRIFT`, or `UNKNOWN` result. The matrix remains useful for review and audit, but it is derived from the causal routes rather than acting as the source of truth.