Add a language-pack contract so a third language ships as data, parity-gated

[ChelseaKR]

What

English and Spanish live in lang.py, locales/<tag>/bundle.yaml, the guards' certification vocabulary (which #137 shows is English-only in one suite), routing phrases, the escalation card, .es.md corpus mirrors, and per-case eval anchors. E6 in docs/RESEARCH-ROADMAP.md calls for language expansion gated on parity, and it has not been filed or built. The blocker is that "a language" is scattered across six places with no contract.

Define a language pack: the locale bundle, deny-list and certification vocabulary, routing and urgency phrases, escalation-card strings, corpus mirrors, and eval mirror cases anchored to their English cases, plus a reviewed_by attestation naming a human reviewer (never raw machine translation, per the research roadmap). Add sprout lang check <tag> that verifies completeness against the English set, and refuse to enable a pack that fails it. The multilingual and language-parity suites include any enabled tag.

Why it matters

Lucía and Ruth (USER-RESEARCH A4, B2) are the case for Spanish; a Vietnamese or Tagalog household is the same case. A pack contract makes the next language a data contribution with a gate, and it makes the existing two languages mechanically complete, which #137 shows they are not.

Scope

• Pack schema and loader; lang check; per-pack completeness in corpus-report.
• Refactor the English and Spanish surfaces into packs with no behaviour change.
• A demo pt pack covering two species, marked unreviewed and therefore not enabled.

Out of scope

• Authoring a full third language.
• Machine translation of any string.

Done when

• Enabling a pack missing one guard string is refused naming the key.
• en and es eval reports are byte-identical after the refactor.
• The demo pt pack passes lang check and the parity suites over its two species.
• A pack without reviewed_by cannot be enabled.

Pointers

• src/sprout/lang.py, src/sprout/locales/, src/sprout/guards.py, src/sprout/eval/suites/multilingual.py, src/sprout/eval/suites/language_parity.py, docs/ADAPT.md Step 6, The safety suite's certification vocabulary is English-only, so its 11 Spanish toxicity cases cannot detect a Spanish safety certification #137

Proposed with AI assistance.

[ChelseaKR]

Triage against origin/main (b24f12d): unbuilt, premise intact, automatable in its mechanical half.

Verified: src/sprout/locales/ holds exactly en/bundle.yaml and es/bundle.yaml; lang.SUPPORTED is derived from locales.available_languages(), and _SPANISH_CHARS is a hard-coded Latin-script heuristic in lang.py. The issue's diagnosis — that "a language" is scattered across six places with no contract — holds.

Automatable: the pack schema and loader, sprout lang check <tag>, per-pack completeness in corpus-report, refactoring the English and Spanish surfaces into packs, and the acceptance bullets "enabling a pack missing one guard string is refused naming the key", "en and es eval reports are byte-identical after the refactor", and "a pack without reviewed_by cannot be enabled". That last one is the important one and it is pure code: the gate that makes the human attestation load-bearing.

Not automatable, by the issue's own design, and correctly so: the reviewed_by attestation names a human reviewer, and the research roadmap says never raw machine translation. An agent must not author the demo pt pack's content and then attest to it — but note the issue already handles this elegantly: the pt pack is marked unreviewed and therefore not enabled, which means it can be written as a fixture that exercises lang check without ever claiming to be reviewed. Whoever builds this should keep that framing exactly and resist the temptation to mark it reviewed to make a test go green.

One thing worth checking while in there. detect_language scores against _SPANISH_CHARS = "ñ¿¡áéíóúü". A pack contract that admits a non-Latin script needs that heuristic to be per-pack data too, or a third language will be detected as English by default — a wrong answer that looks like a working one.

Not started this pass. Left open.

Triaged with AI assistance; premises checked against origin/main.