OIC-SEMANTIC-PROMOTION-001: promote Gate-G-validated bounded reference implementation

[veraxis-protocol]

Promotion of the Gate-G-validated candidate under owner-authorized work order OIC-PR-PROMOTION-001. No repository content is changed by this pull request beyond the branch as already validated: the head commit and tree are exactly the objects independent Gate G examined.

• base main: 9ad37fc80d8f34318c6212ed702de5eab3551cf5
• head oic-weekly-convergence-2026-09-03: a2b5053771ce510fb35ce09f3e99f545c21ac20e
• validated tree: b8e31ec4786a2fd1aca976a6ff047deeee63ef15
• base is an ancestor of the head; no rebase, squash or content edit was performed to open this PR

Customer problem and requirements

• Problem: the OIC-SEMANTIC-PROMOTION-001 bounded reference implementation has completed independent Gate F and Gate G validation on the feature branch and needs to reach main without any departure from the validated tree.
• TDD requirements / invariants: governing design TDD-OIC-001 v1.1. The invariants enforced here are the bounded-promotion path boundary (58 paths maximum, recorded in the capability matrix), the fail-closed code-start gate, and the claims-discipline contracts. The production semantic gate remains BLOCKED.

Scope

• Modules: src/oic (admission, candidate extraction, interpretation proposal, review docket, model provider, frozen synthetic provider), scripts/verify_code_start_gate.py, scripts/falsify_infrastructure.py, scripts/demo_bounded_semantic_path.py, contract and unit tests, admission-boundary design and schema artifacts, benchmark fixtures, docs and packaging metadata.
• Interface/schema versions: admission input, receipt and authority-evidence schemas at v0.1; state-input mapping v0.1; admission test vectors v0.2.
• Build/reuse decision: reuse. 28 COPY_EXACT provenance results are carried from frozen source 3fcdec63b7e546d9b369e0e8664d5d67be6a3b54 and are recorded per-path in docs/capabilities/CAPABILITY_MATRIX.json.

Verification

• Tests and fixtures: full suite on canonical Linux (Python 3.12.3) reported 1,720 passed, 1 declared skip, 0 failed, 0 errors from 1,721 collected; coverage 93.5%. The single skip is tests/contract/test_canada_acquisition_preflight.py:574 (gitignored local receipts intentionally unavailable in CI). make verify and make falsify both pass, the latter observing 4/4 expected falsification checks. Ruff check and format check, strict mypy and the repository credential scan all pass.
• Benchmark partition: frozen synthetic replay only — benchmarks/demo/bounded-semantic-path and the characterization corpora v0.3–v0.5. No real corpus was fetched and no provider was invoked.
• Raw evidence: independent Gate G return OIC-INDEPENDENT-GATE-G-001 (GATE_G_PASS), which verified identity and boundary, audited the shipped claims, ran eight adversarial mutation challenges, and executed the full canonical Linux sequence against this exact head. Two offline demo runs, executed in a network namespace with no interfaces and with credentials stripped, were byte-identical with empty stderr and hashed to 0f9d01bb0dfc488505e027ac7bd8aecf869578e379b5a977cd9d642f2101a39a. Wheel build, clean external-venv install, pip check, package-data verification and import/CLI smoke all pass.
• Rollback: revert the merge commit. main at 9ad37fc80d8f34318c6212ed702de5eab3551cf5 is the pre-merge state and is a strict ancestor of this head, so no history rewrite is needed to restore it.

Risk

• Failure modes: the shipped path is an offline synthetic reference implementation. It is not production compilation and not runtime authorization. Behaviour outside the frozen replay path is unexercised.
• Security/privacy: no credential, token or secret is introduced. The credential/forbidden-pattern scan passes, with the limitation the script itself states — it covers tracked non-binary working-tree files only and is not evidence that the repository contains no secrets. The test suite disables outbound sockets for the whole session.
• Blast radius: 58 paths against the merge base, all additions or modifications; no deletion, rename, mode change, symlink or submodule. SOURCE_MANIFEST.csv is unchanged and remains explicitly INCOMPLETE.
• Dependency/version risk: dependencies are hash-locked in requirements/dev.txt and installed with --require-hashes; pip check reports no broken requirements. CI actions are pinned to immutable commit SHAs.

Claims and limitations

• Claims affected: the repository records a scoped independent Gate F repository validation for candidate c0108a7a80585d6f5732407d4904ba815073ecd2 (tree 1d12b17aad7977c939090909171183be166cfd50), explicitly scoped to reproducibility, boundary integrity, the specified fail-closed properties, packaging and named adversarial checks for that candidate only.
• Limitations affected: none are relaxed. The result does not establish semantic correctness, model accuracy, institutional validity, legal effect, provider qualification, rights resolution, ontology execution, production compilation, runtime authorization, institutional-IR closure, enterprise readiness or benchmark superiority. NVIDIA remains NOT_QUALIFIED; Canada redistribution remains UNRESOLVED; Ontology 007R1 remains unexecuted and execution-unauthorized; the negative-stability live outcome remains DEFERRED; production compilation, runtime authorization and institutional-IR closure remain UNESTABLISHED; the production semantic gate remains BLOCKED.
• Hosted/open parity: not affected by this change.
• ZTL/VEIP boundary impact: none. No ZTL or VEIP boundary path is modified.

Note on repository state: the README and STATUS wording in this tree is the pre-merge wording that Gate G validated. A post-merge repository-state acknowledgment is deliberately out of scope here and is a separate authorized work order; editing those files in this PR would depart from the validated tree.

---

Generated by Claude Code