feat(core): seal revision-bound point support

[lemone112]

Scope — private C8d/F2 Core slice

This replaces the draft public DTO cut with one Session-owned, crate-private protocol. A compiled physical program owns the canonical keyed surface schema and declared occurrence order; the Session alone admits revision-bound observations, supplies the private evaluation permit, and commits a new head only after successful full-support evaluation.

• every canonical scenario × declared occurrence is evaluated in deterministic order;
• encoded-sRGB8 source-over is the single physical composition path;
• exact final-sRGB8 identity, criterion-specific WCAG 2.2 Q55, and non-normative retained reference surplus remain independent axes;
• observation schema, stream, revision, case provenance, and occurrence identity stay bound through the decision;
• checked cardinality and fallible allocation preflight happen before evaluation; a fallible path cannot partially commit Session state;
• empty scenario sets, empty occurrence plans, schema drift, stale/conflicting revisions, and resource refusal are typed failures;
• the old private recheck and readability bridge implementations are removed instead of retained as parallel truth;
• revision-bound joint evaluation consumes the same Session-only authority; its generic kernel is sealed/private, while the lifecycle-free static path has a distinct concrete type.

Evidence boundary

The retained-surplus artifact certifies this exact law:

For every successfully evaluated enabled stability cell, the decision is Retained iff current lower surplus is at least the retained basis-point fraction of max(baseline lower surplus, 0); the declared anchor remains a separate hard floor.

The artifact binds the exact bytes of an 18-file private Rust semantic cone, including its two WCAG compile-time inputs, and has 33 fail-closed source controls. Its general integer/rational identities are checked dependency-free and cross-checked by the recorded Wolfram Language result.

This is deliberately narrower than whole-evaluator certification. It is not whole-crate/compiler/toolchain attestation and does not attest package/FFI/browser transport, renderer pixels, renderer equivalence outside encoded-sRGB8 source-over, or an exact unknown baseline surplus. Evaluation failure yields no successful decision and no Session commit.

Release verification now carries the proof as metadata, binds staged and packed bytes to the exact repository source, and recomputes its self-digest without lossy JavaScript round-tripping of Q55/u128 integer lexemes. The publish gate independently requires the packed proof to equal the exact tag checkout.

Public and policy boundary

No public Program/authoring root, point-support/observation/session type, callable WASM/package evaluator, FFI wire, controller migration, renderer claim, or LPC ReportOnly policy lands here. ThemeConfig / RoleRecipe remain the sole frozen public authoring root until the atomic C7c cut.

WCAG remains an explicit independent criterion axis. A WCAG failure is never relabelled as a pass; retained surplus is neither WCAG, readability, LPC, cleanliness, nor sentiment evidence. The npm tarball and numerical capability manifest expose proof metadata for the private Core site, not a callable point-support API.

The existing public raw semantic::recheck_against* controller route is unchanged legacy debt for #419; this PR does not add a compatibility shim or claim that hard-cut complete.

Validation

• exact-source Rust harness: 78 tests passed, including empty-scenario atomicity, keyed joint preflight, static/runtime separation, every stability anchor, and the full consuming recheck chain;
• compile-negative privacy checks reject forged Session permits/private assessments and external access to measure_wcag22_srgb8;
• point-support proof replay and four source-binding test families pass;
• the criterion-free WCAG facade reissue preserves the numerical kernel/artifact/thresholds, regenerates the exact six-row conformance lineage, and binds pack digest 50dc0131;
• optimized Python is rejected fail-closed;
• Node 22 and Node 24 lossless proof controls pass;
• workflow YAML and all three embedded publisher programs parse;
• exact Rust 1.96 / edition-2024 rustfmt and production parser checks pass;
• source closure: c2825216354b796924560d98e01ae5cebedf324c47e7b26332119c61aded783e.

Authoritative exact-head validation is green: CI run 29878830524 (Rust, full finite-domain WCAG proof, package/release, reproducible WASM, real browser, and Node 22 floor) and Swift run 29878830519.

Still open

This is one private vertical slice, not overall production readiness. Package-private WASM/controller migration (#419), exact #429 resource caps, C8e, the atomic public C7c authoring cut, and later LPC/LCS/cleanliness/sentiment work remain separate DAG steps.

Refs #417 #419 #421 #429 #442 #443 #408

Summary by CodeRabbit

• Новые возможности
  • Добавлена поддержка point-support retained-surplus в режиме Q55 (числовые доказательства) и добавлен соответствующий сайт в конформанс-векторы/manifest.
  • В npm-пакет включены новые evidence-артефакты для point-support.
• Исправления
  • Усилена проверка релизных артефактов перед публикацией: строгая каноничность, контроль SHA-256 и расширенный валидатор numerical evidence (включая point-support), с повышением schemaVersion.
  • Обновлены контрольные данные/контракты и conformance pack 10.
• Тесты
  • Расширены CI-проверки point-support (fail-closed), обновлены и ужесточены сценарии проверки evidence/sha/каноничности.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e829a65d-68e2-4f98-880e-8db1173630e7

📥 Commits

Reviewing files that changed from the base of the PR and between 2aea842 and 049c1d9.

📒 Files selected for processing (7)

• .github/workflows/publish.yml
• crates/labcolors-core/contracts/point-support-reference-surplus-q55-bps-proof-v1.json
• packages/colors/test/release-contract.test.mjs
• scripts/point-support-release-contract.cjs
• scripts/test_point_support_surplus_source_binding.py
• scripts/verify-package-release.mjs
• scripts/verify_point_support_surplus.py

---

Walkthrough

Changes

PR добавляет point-support retained-surplus вычисления и revision-bound session pipeline, переводит наблюдения и joint evaluation на новые контракты, регистрирует numerical evidence и усиливает CI/npm-релиз проверки канонических байтов, SHA-256, proof binding и release-manifest schema v4.

Point-support pipeline

Layer / File(s)	Summary
Revision-bound observations and joint evaluation crates/labcolors-core/src/observation.rs, crates/labcolors-core/src/joint.rs, crates/labcolors-core/src/observation_tests.rs, crates/labcolors-core/src/joint_tests.rs	Наблюдения используют owner/head/prepared-update модель, а joint evaluation разделён на static и revision-bound entrypoints с проверкой surface schema.
Point-support evaluation and session state crates/labcolors-core/src/point_support.rs, crates/labcolors-core/src/session.rs, crates/labcolors-core/src/point_support_tests.rs, crates/labcolors-core/src/session_tests.rs	Добавлены exact, criterion и stability оценки, typed reports, numerical stability evidence и состояния Waiting/Ready/Stale/Failed.
Numerical registry and retained-surplus proof crates/labcolors-core/src/numerics.rs, scripts/verify_point_support_surplus.py, scripts/test_point_support_surplus_source_binding.py, crates/labcolors-core/contracts/*, conformance/vectors/*	Добавлен numerical site point-support retained surplus, Q55 proof contract и независимые проверки source closure, рациональной арифметики, algebraic certificate и integer envelope.

Package release validation

Layer / File(s)	Summary
Package assembly and release verification scripts/release-evidence.mjs, scripts/prepare-npm-package.mjs, scripts/verify-package-release.mjs, .github/workflows/publish.yml, packages/colors/test/*	Публикация включает numerical evidence; валидатор проверяет canonical JSON, exact tarball bytes, proof dependencies, capability checksum и release-manifest schema v4.
CI and package inventory integration .github/workflows/ci.yml, packages/colors/package.json, packages/colors/bench/wasm.json	CI запускает source-binding и Q55 retained-surplus проверки, а npm package inventory включает новый point-support proof и обновлённые WASM budget metadata.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CI
  participant PointSupportSessionV1
  participant prepare_observation
  participant BoundPointSupportRecheckV1
  participant verifyPackageRelease
  participant npmTarball

  CI->>PointSupportSessionV1: run point-support tests
  PointSupportSessionV1->>prepare_observation: prepare revision-bound update
  prepare_observation->>BoundPointSupportRecheckV1: evaluate observation with permit
  BoundPointSupportRecheckV1-->>PointSupportSessionV1: PointSupportDecisionV1
  verifyPackageRelease->>npmTarball: extract packed evidence
  npmTarball-->>verifyPackageRelease: bytes and manifest records
  verifyPackageRelease->>BoundPointSupportRecheckV1: validate numerical proof chain
  BoundPointSupportRecheckV1-->>verifyPackageRelease: validated evidence

Loading

Possibly related PRs

• Labpics-Team/lab-colors#311 — связанная инфраструктура numerical manifest и publish verification.
• Labpics-Team/lab-colors#361 — связанная модель RevisionBoundObservationV1 и представление наблюдений.
• Labpics-Team/lab-colors#362 — связанные изменения joint program, выбора кандидатов и recheck.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 37.35% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Заголовок точно отражает основное изменение: закрытие revision-bound point support в core.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/c8d-point-support-verdict

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/publish.yml:
- Around line 283-405: Сведите реализацию exactJsonPayloadWithoutTopLevelField и
логику POINT_SUPPORT_* в .github/workflows/publish.yml и
scripts/verify-package-release.mjs к единому источнику; если вынести общий
модуль невозможно, добавьте отдельную CI-проверку, сравнивающую их
эквивалентность, чтобы publish-gate и локальная валидация всегда оставались
синхронными.

In `@scripts/verify_point_support_surplus.py`:
- Around line 356-371: Update the zip call in multiply to use strict=True when
combining left_monomial and right_monomial powers, preserving the existing
multiplication behavior while detecting any future exponent-length mismatch.
- Around line 379-388: Замените тавтологичные проверки вокруг identity_anchor в
universal_algebraic_certificate на независимый символьный вывод anchor-surplus
из определения contrast ratio (20L+S)/(20D+S) и порогов 1, 3 и 4.5. Проверьте
коэффициенты 2, 7 и 40 через исходные выражения с l_value, d_value и
scale_value, не используя identity_anchor как эталон; сохраните явные assert для
трёх формул и их проверку относительно anchor_surplus().

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 79f3775a-d400-4284-8cb9-c7d3c66a110f

📥 Commits

Reviewing files that changed from the base of the PR and between b12afe0 and 2aea842.

📒 Files selected for processing (37)

• .github/workflows/ci.yml
• .github/workflows/publish.yml
• conformance/vectors/manifest.json
• conformance/vectors/wcag22.json
• crates/labcolors-conformance/tests/pack_v10_contract.rs
• crates/labcolors-core/contracts/point-support-reference-surplus-q55-bps-proof-v1.json
• crates/labcolors-core/contracts/wcag22-srgb8-q55-proof-v1.json
• crates/labcolors-core/src/appearance.rs
• crates/labcolors-core/src/composition.rs
• crates/labcolors-core/src/constraints/mod.rs
• crates/labcolors-core/src/constraints/readability.rs
• crates/labcolors-core/src/joint.rs
• crates/labcolors-core/src/joint_tests.rs
• crates/labcolors-core/src/lib.rs
• crates/labcolors-core/src/numerics.rs
• crates/labcolors-core/src/observation.rs
• crates/labcolors-core/src/observation_tests.rs
• crates/labcolors-core/src/pair.rs
• crates/labcolors-core/src/point_support.rs
• crates/labcolors-core/src/point_support_tests.rs
• crates/labcolors-core/src/recheck.rs
• crates/labcolors-core/src/recheck_tests.rs
• crates/labcolors-core/src/session.rs
• crates/labcolors-core/src/session_tests.rs
• crates/labcolors-core/src/wcag22.rs
• packages/colors/bench/wasm.json
• packages/colors/package.json
• packages/colors/test/capability-manifest.test.mjs
• packages/colors/test/release-contract.test.mjs
• packages/colors/test/release-provenance.test.mjs
• scripts/check-wasm-size-budget.mjs
• scripts/prepare-npm-package.mjs
• scripts/release-evidence.mjs
• scripts/test_point_support_surplus_source_binding.py
• scripts/verify-package-release.mjs
• scripts/verify_point_support_surplus.py
• scripts/verify_wcag22_q55.py

💤 Files with no reviewable changes (4)

• crates/labcolors-core/src/constraints/readability.rs
• crates/labcolors-core/src/recheck_tests.rs
• crates/labcolors-core/src/recheck.rs
• crates/labcolors-core/src/constraints/mod.rs