feat(semiotic): gate trust UX, fast activity reads, and symmetric persistence

[ryan-s-roberts]

Summary

• Adds baml-rt-semiotic interceptor crate with tiered gate evaluation, grounding store, and config bundle (GET/PUT /config/semiotic)
• Implements Trust operator surfaces: Settings Trust tab, gate activity API (/config/semiotic/activity), provenance Gate tab, and incident drill links
• Fixes gate persistence symmetry: tool effect started/completed pairs always materialize with a2a_gate, agent_package, and synthetic scope fallback; terminal gate-blocked phase: open rows remain visible in ops
• Adds fast-path query_gate_activity (wall-time + a2a_gate predicate, registry identity, no edge-scan agent scoping) replacing 180s timeout fleet rollups

Code quality (thermo-nuclear review)

• Unified resolve_call_scope for started/completed effect symmetry (single synthetic fallback path)
• Extracted tool_effect_metadata stamping module and ops_row visibility predicates (removed inline retain spaghetti in ops_query.rs)
• Split config handlers into config_handlers/ module tree
• Removed unused emit_host_input_required wrapper; emit_gate_input_required remains canonical

Test plan

• cargo test -p baml-rt-provenance --test effect_bus_tool_ops_test
• cargo test -p baml-rt-provenance tool_started_without_scope
• cargo test -p baml-rt-api get_semiotic
• cargo clippy (pre-commit)
• cargo build -p agentium --release
• scripts/verify_gate_provenance.py against live runner
• Browser: Settings → Trust refresh, chat gate block, Provenance Gate tab

Made with Cursor

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.