Add a source-bound six-plane pricing oracle with funded-candidate checks (no new κ)

research/source-bound-price-oracle/.gitattributes

@@ -0,0 +1 @@
+frozen/** -text

research/source-bound-price-oracle/CONTRACT.md

@@ -0,0 +1,17 @@
+# Source-bound oracle v1
+
+`oracle.evaluate(candidate_bytes, artifacts, policy)` is pure and uses exact rational comparisons. `artifacts` maps SHA256 to literal bytes. `policy` is a separately trusted reviewer input, installed after inspection of the independent evidence. A candidate cannot authorize its own receipt or expand its model domain. Every exact input and receipt is checked against its literal SHA256.
+
+A scientific payload is the canonical JSON candidate without `receipts` and `requested_label`. Receipts bind that payload SHA, exact head, profile SHA and all source dependencies. This avoids the impossible digest cycle produced by making a candidate include receipts that hash the entire candidate. Producers retain their original immutable invoice; normalized consumer receipts bind the original invoice artifact in `evidence_sha256`. An arithmetic receipt additionally binds the normalized census and closure receipts. No original producer file is overwritten.
+
+`SCHEMA.json` describes the candidate exchange. `oracle.py` defines required coverage, cost states and label transitions. The reviewer policy specifies every allowed charge ID, literal compiler tuple, source theorem artifact, arithmetic check ID and predicate ID. A model with altered law or tuple is rejected until a separately reviewed policy covers it. Predicate inventories belong to each source interface; the implementation does not treat 58 as a universal count.
+
+The six planes are `paid_productive`, `ordinary`, `ownership_stock`, `precision_tape`, `compiler_reserves`, `bit_outer`. Every entry includes `id`, `value_or_symbol`, `unit`, `state`, `evidence_sha256`, `dependency_hashes`, and `invalidation_conditions`. Unknown entries have `value_or_symbol: null`, remain visible, and prevent complete-bill/funded promotion. Optimistic entries likewise prevent promotion. Ordinary symbolic finite-template bounds retain their units; they never enter the rank moment as scalar zero or an unjustified rank charge.
+
+Labels describe separate evidence thresholds. Literal witness bytes allow WITNESS_READY; an independent all-column physical receipt allows PHYSICAL_CHECKED; census and fresh closure plus all resolved six-plane costs allow COMPLETE_BILL_READY. Exact independent arithmetic on those same receipts allows FUNDED_CONDITIONAL. A separate publication receipt allows PUBLIC_REVIEWABLE. SELECTED is only a read-only authenticated selected snapshot in the trusted policy; arithmetic cannot select a result. All retain the five explicit framework assumptions. A claim of PASS in an author result has no admission effect.
+
+The arithmetic envelope carries funded/tested rational savings, strict rational root sign intervals, compiler tuple, positive strict/functional slacks, and named source-specific boolean checks. It consumes 04's independently derived receipt. `source_moment_screen` accepts 04's `moment` backend only in an explicit saving interval and returns MODEL_ONLY. It neither computes new roots nor promotes a positive budget. Passing a model screen requires physical and complete-cost admission.
+
+Calibration imports preserve existing source-bound conclusions. They do not run another author verifier, phase census, native job, cold replay or independent root calculation. Until the new immutable 01–04 receipts exist, #5383 is WITNESS_READY with unknown closure/funding, even though its author result reports a positive κ. #5384 is a verification publication of #5377's construction; it supplies no additional productive fields or additive κ gain.
+
+Security boundary: this is a compatibility checker for reviewer-pinned evidence, not a cryptographic proof checker for prose. SHA256 authenticates bytes against the supplied trusted policy. Review of physical arguments, applicability and authority remains necessary before a digest is added to that policy. Contract errors are input rejections, not counterexamples to a theorem.

research/source-bound-price-oracle/README.md

@@ -0,0 +1,122 @@
+# Source-bound six-plane price oracle
+
+This reusable Python standard-library library checks compatibility of a complete
+cost candidate with separately trusted, exact-source independent receipts. It
+preserves six separate cost planes, exact rational endpoints, explicit unknowns
+and source-specific predicate inventories. It does not discover or prove a new
+construction, compute a new κ, or establish a global optimum.
+
+The two actual frozen receipt joins return **FUNDED_CONDITIONAL**:
+
+| Source | Exact scientific head | Funded κ | Immutable artifacts |
+|---|---|---|---|
+| [Ali Romman's #5383](https://github.com/CrocSwap/integer-mult-bounds/pull/5383) | `4bd6efa51a495a7c7b7754915cf0244e7e60969e` | `151333/50000000 = .00302666` | 28 |
+| [Dugongue's #5387](https://github.com/CrocSwap/integer-mult-bounds/pull/5387) | `b1ab650d36f59e5be682a813145b7c67e219e341` | `605334953/200000000000 = .003026674765` | 32 |
+
+Both have 64,148 paid jobs and 10,800 productive fields. Their literal words,
+pivots, retained boundaries, scalar invoices, fresh precision/stock constants
+and funded compiler heights differ. The #5387 join uses a fresh independent
+physical receipt. Equal histograms transfer no physical coverage. The rejected
+ordering-only transfer is not used. These labels consume independently certified
+hash-bound receipts; this compatibility replay does not repeat their proofs.
+
+## API and trust contract
+
+`oracle.evaluate(candidate_bytes, artifacts, policy)` takes literal JSON bytes,
+a mapping from SHA256 to literal artifact bytes, and a **separately reviewed
+policy**. It returns the strongest justified evidence label or raises
+`ContractError` for incompatible input. `CONTRACT.md` and `SCHEMA.json` define
+the exchange. `TRUSTED-POLICIES.json` fixes the two reviewed policies independently
+of evaluation; a candidate cannot supply its own new policy through this replay.
+The normalized receipt hashes bind the scientific payload without attached
+receipt references, avoiding a hash cycle. Original producer bytes remain intact.
+
+The six planes are paid/productive work, ordinary scalar and routing charges,
+ownership and stock, precision and fixed tape, compiler reserves, and BIT outer
+admission. Every cost has a unit, state, evidence, dependencies and invalidation
+conditions. Unknown is represented by null and blocks funding; optimistic costs
+also block funding. Ordinary charges never enter the rank moment as assumed zero.
+
+The library authenticates bytes against reviewer-maintained policy and checks
+evidence compatibility. It does not machine-prove arbitrary prose or establish
+the reviewer's authority. Physical arguments and applicability require review
+before new digest pins enter a policy. Five inherited assumptions remain:
+`native_all_columns`, `owned_erasure`, `compiler`, `precision_tape`, and
+`analytic_recovery`. Requested publication or selected labels require their own
+evidence. The selected record is read-only historical provenance here.
+
+The only admitted compiler tuple is power 1024, cutoff 20, floor 21,
+tail offset 1/5, theta 63/64 and logarithm power 1000. Each source has its own
+funded/tested endpoint and height receipt. Other tuples, physically realizable
+words and allocations have not been exhausted. The optional
+`source_moment_screen` uses a caller-supplied independent rational interval
+backend on an explicit source-certified domain and always returns MODEL_ONLY.
+
+## Frozen inputs and scope
+
+`frozen/` retains the complete 93-file manifest of the original oracle review
+draft, plus its manifest itself, byte for byte. Its manifest SHA256 is
+`3dd8af4470220929ee516f2d3a97eba6db45ff55908c2cb5ca441f75459fdbed`.
+`frozen/SOURCE-PINS.json` and each join's `origins.json` record original paths;
+all required bytes are committed locally, so replay does not need those paths,
+pending Git heads, network access or scientific engines. Git provenance in
+`SOURCES.json` pins the canonical catalogue and selected snapshot at base
+`1ec1119972c9aefe42525172d07b332fcff81cb4`. Retained external source identities
+are not advertised as ancestor Git pins.
+
+Historical calibration imports selected #4610/.0030217758, independently checked
+#5377/.00302235 with verification publication #5384, and the initially pending
+#5383 profile. The current #5383 and #5387 joins are separate promotion evidence;
+historical pending wording in retained draft documents describes that earlier
+checkpoint. This package adds a registered entrypoint, fixed policy pins,
+actual-join mutation controls and an adapted read-only calibration whose
+predicates remain active under optimized Python. The library is byte-identical
+to its frozen reviewed predecessor. This reusable oracle package complements
+the separate independent validation package; it does not duplicate its engines.
+
+## Reproduce
+
+From the repository root:
+
+```sh
+python3 scripts/research_package.py --package research/source-bound-price-oracle --check-only
+python3 scripts/research_package.py --package research/source-bound-price-oracle
+```
+
+Python 3.12, standard library only. Both normal and optimized direct commands
+are registered, each bounded to 120 seconds:
+
+```sh
+python3 -B research/source-bound-price-oracle/verify.py
+python3 -O -B research/source-bound-price-oracle/verify.py
+```
+
+The direct verifier is portable to a checked source export without Git. It
+checks all frozen bytes, both policy pins and actual joins, three calibration
+profiles, nine synthetic API test groups and six actual-join test groups. The
+controls cover stale or corrupt receipts, missing closure, unknown-as-zero,
+changed word with equal histograms, candidate-authored policy domains, unsupported
+compiler tuples, incomplete costs, and unsupported publication/selection. Normal
+and optimized runs take under one second each locally. A PASS is compatibility
+and transport evidence; no native, cold, root, Lean or full theorem replay runs.
+
+## Open next questions
+
+The structured questions in `TASK.json` identify two next steps: independently
+review a changed source before adding its policy; or prove applicability and
+fund a different compiler tuple before enlarging the domain. These require fresh
+source-specific physical and complete-cost receipts. Neither a matching profile
+nor a positive necessary moment screen supplies those missing obligations.
+
+## Credit
+
+New oracle, consumer review and packaging by **Chris R / Clear1nsight**, with
+substantial OpenAI Codex assistance, under Apache-2.0. Ali Romman owns the
+eight-relation #5383 construction and #5377; Dugongue owns successor #5387.
+Preserve Cao Yifan's word, Cinna Davis's controller/helper lineage, zxv's
+native/compiler/precision work, Jacob Alan Sussman's recursion, ToikY's tensor
+lift, the ordinary-BIT contributors, and all retained notices and source credit.
+The independent producer receipts and exact engines retain their own authorship.
+The generic package generator/runner retain Douglas Colkitt's credit; exporter
+credit remains Tekalign's. This submission contributes reusable evidence
+compatibility controls, without claiming construction or predecessor authorship.

research/source-bound-price-oracle/SCHEMA.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "source-bound-price-candidate/v1",
+  "title": "Immutable scientific payload with separately attached independent receipts",
+  "type": "object",
+  "required": ["schema", "candidate_id", "scientific_head", "canonical_comparison_base", "attribution", "assumptions", "source_dependencies", "model", "profile", "planes", "receipts"],
+  "properties": {
+    "schema": {"const": "source-bound-price-candidate/v1"},
+    "candidate_id": {"type": "string", "minLength": 1},
+    "scientific_head": {"type": "string", "pattern": "^[a-f0-9]{40}$"},
+    "canonical_comparison_base": {"type": "string", "pattern": "^[a-f0-9]{40}$"},
+    "attribution": {"type": "array", "minItems": 1, "items": {"type": "string"}},
+    "assumptions": {"const": ["native_all_columns", "owned_erasure", "compiler", "precision_tape", "analytic_recovery"]},
+    "source_dependencies": {"type": "object", "minProperties": 1, "additionalProperties": {"$ref": "#/$defs/sha"}},
+    "literal_witness_sha256": {"$ref": "#/$defs/sha"},
+    "model": {"type": "object", "required": ["id", "parameters", "theorem_evidence_sha256"], "properties": {"id": {"type": "string"}, "parameters": {"type": "object"}, "theorem_evidence_sha256": {"$ref": "#/$defs/sha"}}},
+    "profile": {"type": "object", "required": ["paid", "productive", "paid_jobs", "productive_jobs", "excluded_productive_credit"], "properties": {"paid": {"$ref": "#/$defs/histogram"}, "productive": {"$ref": "#/$defs/histogram"}, "paid_jobs": {"type": "integer", "minimum": 1}, "productive_jobs": {"type": "integer", "minimum": 1}, "excluded_productive_credit": {"const": {"aliases": 0, "copies": 0, "surrendered": 0}}}},
+    "planes": {"type": "object", "required": ["paid_productive", "ordinary", "ownership_stock", "precision_tape", "compiler_reserves", "bit_outer"], "additionalProperties": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/cost"}}},
+    "receipts": {"type": "object", "additionalProperties": {"$ref": "#/$defs/sha"}},
+    "requested_label": {"enum": ["MODEL_ONLY", "WITNESS_READY", "PHYSICAL_CHECKED", "COMPLETE_BILL_READY", "FUNDED_CONDITIONAL", "PUBLIC_REVIEWABLE", "SELECTED"]}
+  },
+  "$defs": {
+    "sha": {"type": "string", "pattern": "^[a-f0-9]{64}$"},
+    "histogram": {"type": "object", "minProperties": 1, "patternProperties": {"^[1-9][0-9]*$": {"type": "integer", "minimum": 0}}, "additionalProperties": false},
+    "cost": {"type": "object", "required": ["id", "value_or_symbol", "unit", "state", "evidence_sha256", "dependency_hashes", "invalidation_conditions"], "properties": {"id": {"type": "string"}, "value_or_symbol": {"type": ["string", "integer", "object", "null"]}, "unit": {"type": "string", "minLength": 1}, "state": {"enum": ["proved", "constructively_upper_bounded", "optimistically_relaxed", "unknown"]}, "evidence_sha256": {"type": "array", "items": {"$ref": "#/$defs/sha"}}, "dependency_hashes": {"type": "array", "minItems": 1, "items": {"$ref": "#/$defs/sha"}}, "invalidation_conditions": {"type": "array", "minItems": 1, "items": {"type": "string"}}}}
+  }
+}

research/source-bound-price-oracle/SOURCES.json

@@ -0,0 +1,25 @@
+{
+  "schema_version": 1,
+  "base_commit": "1ec1119972c9aefe42525172d07b332fcff81cb4",
+  "files": [
+    {
+      "path": "certificates/selected-result.json",
+      "usage": "provenance",
+      "git_blob": "b288ae44032fd84dd5564243422836cbcd29835e",
+      "sha256": "f9ed52bb642cd1e1486cf2743557ac5fa23cf1514a3277d786a644e39a565038"
+    },
+    {
+      "path": "docs/research/agent-task-catalog.json",
+      "usage": "provenance",
+      "git_blob": "f126dd2e2dad2b669e75d1d0d0bd05c600725602",
+      "sha256": "f7a48bfa2659b88378282a8eee7d9fe52cdf505594124c4d1686b58510fffd72"
+    }
+  ],
+  "retained_offline_evidence": {
+    "manifest": "frozen/MANIFEST.json",
+    "manifest_sha256": "3dd8af4470220929ee516f2d3a97eba6db45ff55908c2cb5ca441f75459fdbed",
+    "files": 93,
+    "origins": "frozen/SOURCE-PINS.json and each frozen/joined-*/origins.json",
+    "availability": "Every frozen input is committed package-local. Pending source heads are informational identities, not external Git head pins needed by replay. Hashes authenticate retained bytes against the fixed policy; source arguments remain independently reviewable assumptions."
+  }
+}