feat(openimis): effect-verified insurance eligibility-check reference workflow + showcase

[abrichr]

E1 product proof: effect-verified insurance eligibility check on the openIMIS reference environment

Builds the runnable coverage / eligibility-check workflow on the just-merged openIMIS insurance environment (#141), wired to the effect-verifier kit (#134): look up a policyholder in openIMIS's Insuree Enquiry, ask the service-eligibility question, and certify the answer against openIMIS's own PostgreSQL policy tables — a read-only SQL contract, never the screen.

What's demonstrated (all runs real, on this fixture, synthetic data only)

• Record once, headed (scripts/openimis_eligibility_demo.py record): 6-step demonstration on insuree 999000001; insuree number parameterized as insurance_no.
• Compile + certify: lint green (effect coverage: n/a (no consequential/irreversible steps), one benign vacuous-postcondition warn); certify --policy permissive PASS. clinical-write accurately flags the two unlabeled dialog clicks (confidence 0.70) and the typing step's vacuous postcondition — right findings for unattended writes, documented honestly in the README.
• Green replay on 999000003 — a policyholder the demonstration never saw: 6/6 steps, template rung at confidence 1.00, typed input read back, 0 model calls, ~13 s. Both contracts CONFIRMED by the SQL verifier built from the committed deployment.eligibility.yaml.
• Halt-on-anomaly on 999000002 (policy lapsed 2026-05-31): the GUI lookup completes and the dialog still shows a service-eligibility thumbs-up — the misreadable screen — then field_equals is REFUTED (coverage 'Inactive', expected 'Active') and the run HALTS with evidence instead of certifying eligibility.

Effect contracts (bound to the run's insurance_no)

kind	contract	green (999000003)	halt (999000002)
record_written	exactly one in-force policy row for the checked policyholder	CONFIRMED	CONFIRMED
field_equals	coverage == 'Active' in the system of record	CONFIRMED	REFUTED → RUN HALTED

The verifier runs ONE read-only SELECT (fixture.py::ELIGIBILITY_ORACLE_SQL; a unit test pins the YAML copy to it) as a dedicated read-only role created by the bootstrap (SELECT on 3 tables, default_transaction_read_only=on — the role, not the kit's statement filter, is the enforcement). Secret via OPENIMIS_ORACLE_PASSWORD env reference; DB port published loopback-only.

Changes

• benchmark/openimis_claims/fixture.py — lapsed + second in-force synthetic policyholders, read-only oracle role, shared oracle SQL, bootstrap_eligibility(), coverage() oracle
• benchmark/openimis_claims/compose.yml — 127.0.0.1:9402:5432 for the oracle
• benchmark/openimis_claims/deployment.eligibility.yaml — the kit config (new)
• scripts/openimis_eligibility_demo.py — up / bootstrap / record / compile / replay (--expect-halt) (new)
• docs/showcase-openimis/ — FINDINGS.md + both run reports (report.json, REPORT.md, step screenshots) + 2 gifs (unedited footage + closing card quoting the report) + stills (new)
• tests/test_openimis_eligibility.py — 11 no-docker contract tests pinning YAML ↔ fixture SQL ↔ bundle effects, secret-env fail-loud, param-binding, injection refusals (new)
• README — eligibility section with reproduction commands and an honesty box

Media (in docs/showcase-openimis/)

• eligibility_replay.gif (0.84 MB, 13 s) — green replay + CONFIRMED card
• eligibility_halt.gif (1.54 MB, 17 s) — lapsed-coverage HALT + REFUTED card
• stills/ — active dialog, lapsed dialog (thumbs-up the DB refutes), verdict cards

Honest claims

Contract-proven fixture demo on synthetic data. Not a benchmark, not a customer deployment, no claim about commercial payer portals; a dental-office deployment would target the office's actual payer portal/clearinghouse with its own read-only oracle. openIMIS (AGPL-3.0) stands in as a real open-source insurance platform.

Frozen lanes untouched (no changes under backends/windows*, win_agent, replayer, resolver, macOS pixel, paper/, hosted). ruff check + ruff format --check clean on all touched files; full local pytest suite green.

🤖 Generated with Claude Code

[abrichr]

Holding this PR in draft while the release boundary is repaired.

The reference workflow is useful evidence, but this branch is based on the affected 1.14.0 line and directly overlaps the MIT-only PyPI source-distribution fix in #144. It must not merge or publish ahead of the independently verified 1.14.1 replacement.

Next review:

1. Rebase onto the verified 1.14.1 main.
2. Keep all adapted openIMIS/AGPL benchmark material outside the PyPI wheel and sdist while retaining complete provenance in the Git checkout.
3. Re-run the archive validator and full protected CI on the rebased exact head.
4. Reassess the demo against the current breadth freeze and one-design-partner milestone before returning it to ready.

No evidence is being discarded; draft status is a sequencing and package-boundary safeguard.

[abrichr]

Status refresh (2026-07-19): the MIT-only package boundary is restored and independently verified through v1.16.0; that historical release blocker is closed. This PR remains intentionally draft for the product boundary, not because evidence is being discarded. If resumed, rebase onto the then-current exact released main, keep every adapted openIMIS/AGPL benchmark file repository-only and excluded from wheel/sdist, re-run the archive validator and protected matrix, and connect the reference to the active sandbox/attended workflow rather than creating a second demo architecture. No merge is appropriate on the current head.