fix: close pre-pilot correctness and provenance invariants

[downwithbgp]

fix: close pre-pilot correctness and provenance invariants

Closes the demonstrated pre-pilot invariant defects from the Session 56 Wirthian design-recovery audit (F-1..F-6, F-8). No new architecture, no features, no evidence changes.

Findings addressed

F-1 — Continuity-gate bypass (characterization). A reachable assessment branch could bypass the continuity gate when no findings were supplied: derive_verdict returned the empty-finding fallback (e.g. NoObservableBgpImpact) before checking unknown continuity / session resets. Intended ordering: the eligibility/continuity gate executes before any result derivation from finding cardinality; an empty finding set cannot imply "no route-state change" without a gap-free UPDATE sequence. The gate now runs first; the empty-finding fallback is only reachable with established continuity. Historical-impact inspection: all 12 tracked report.json files were statically checked — zero have the unknown-continuity + empty-findings combination, so no tracked run was demonstrated affected and no historical result was changed or rederived (F-10: no tracked run demonstrated affected).

F-2/F-3 — Artifact resolution. Four resolvers existed (run page, workbench coverage with only 4 hardcoded case-study dirs, demo fallback with unvalidated root.join, orphan audit). Structurally confirmed: 6 of 118 demo-catalog artifact rows were invisible to the workbench resolver. All consumers now use the single resolve_artifact; is_safe_relative_path is the one containment primitive (rejects empty, absolute, parent traversal, drive-letter/UNC prefixes, backslash separators, Windows trailing-dot/space hazards); resolve_artifact adds canonical containment so a symlink escaping the root is not served. All 118 tracked artifact rows still resolve; Git-checkout and packaged-source resolution agree.

F-4 — Open-event cutoff readiness. A Ready plan for an open event could be stored without a reviewed cutoff (import path) and an open manifest with a non-empty declared end skipped every cutoff gate. Now: Manifest::validate rejects open manifests without analysis_end_utc; build_plan_record classifies open-without-cutoff as Blocked; queue and worker require the cutoff regardless of any declared end (legacy invalid plans cannot reach source access); import requires recorded cutoff provenance (sidecar cutoff_provenance or analyst note) and never treats source fetch time as the cutoff; the cutoff participates in the canonical plan hash.

F-5 — Standalone analyze scope boundary. Decision: project scope is a universal first-party execution policy (docs/DOMAIN.md already documented CLI-wide loading and re-check before source access). cmd_analyze now loads the policy (fail closed on invalid), applies analyze_scope_block (exact-normalized, same semantics as queue/worker) before any planning or source access, exits EXIT_ANALYSIS_BLOCKED, writes no outputs, and warns when the policy file is absent. No exclusions changed; scope remains policy, not auth/sandboxing.

F-6 — Observed result vs expectation assessment. Stored verdict strings carry mixed legacy semantics (e.g. ExpectedLossOfReachability) and were exposed verbatim in observed-result positions. Projection-layer correction (no migration, no historical rewrite): the run API exposes structured observed_result {kind,label} and expectation_assessment {kind,label}; unrecognized stored values project as a neutral label; the raw verdict/assessment fields remain as documented legacy fields; case-study runs expose the projected labels.

F-8 — Documentation CI. The CHANGELOG "Session 55" heading tripped the intentional session-narrative audit (CHANGELOG.md is normative; main CI was already red at 92f83d89). The entry was rewritten in product/change language (release-facing content preserved), the render regenerated, and a regression test added. scripts/audit-docs.sh is green.

Also

• Status-boundary matrix pinned with negative tests (open event ≠ incomplete analysis, no-change ≠ continuity failure, insufficient visibility ≠ no-change, Ready ≠ in-scope, etc.).
• Invariant register updated (6 invariants now enforced) and counts reconciled (the session-56 declared totals were arithmetically wrong); a deterministic parse test enforces the arithmetic.
• Incremental Wirthian design checksum written for b2fde81..HEAD (docs/audits/2026-08-pre-pilot-invariant-closure.md); Session 56 audit gains a follow-up status table.
• Evaluation kit verified unaffected: answer-key regeneration is deterministic and byte-identical to the tracked key.

Constraints honored

• Canonical evidence unchanged · source snapshots unchanged · reviewed case-study interpretations unchanged · project-scope exclusions unchanged · network profiles unchanged · no schema/migration changes.
• No analysis rerun; no source contacted (GRNOC, RouteViews, RIPE RIS, PeeringDB, RIR); no archive acquired; no worker executed against a real plan.
• Zero external evaluation sessions; pilot registry unchanged.
• No runtime files, databases, caches, or screenshots committed.

Not claimed: no historical verdict was proven wrong, no formal verification, no claim that all invalid states are impossible, no external validation.

Gates

cargo fmt --check ✓ · cargo test 1517 passed ✓ · cargo test --release ✓ · cargo test --doc ✓ · clippy -D warnings ✓ · rustdoc -D warnings ✓ · cargo deny licenses/bans ✓ · cargo package ✓ · scripts/audit-docs.sh ✓ · demo init/verify ✓ · evaluator bootstrap ✓ · answer-key generation + drift ✓ · evaluation pack ✓ · read-only DB hash check ✓ · project-scope validation/audit ✓ · artifact audit ✓ · internal-link audit ✓ · secret scan ✓ · tracked-runtime audit ✓ · clean-clone + packaged-source verification ✓