feat(horizon): evidence carrying termination at final boundary

[ruvnet]

Closes #232.

Summary

Adds an opt in evidence carrying completion gate to @metaharness/horizon. A model may propose final, but when DriverConfig.completion is enabled the driver only accepts completion after every required claim resolves to authorized successful trace evidence and a trusted replay seam reconstructs the claimed value.

Design

• typed CompletionCertificate, CompletionClaim, and stable CompletionEvidenceRef
• stable tool event IDs derived from the persisted action counter, not transcript positions
• optional artifact digest binding
• successful and authorized tool evidence required by default
• deterministic caller supplied replayCompletion trust seam
• missing replay, missing claim, ambiguous event ID, failed or denied tool, digest mismatch, or replay mismatch fails closed
• rejected premature completion is recorded and fed into existing halt control so the agent can recover without unbounded retries
• no behavior change when completion gating is disabled

Why stable event IDs

Transcript compaction can reorder or remove array positions. Positional evidence references could silently retarget after compaction. Stable event IDs ensure removed evidence fails closed instead of binding to a different event.

Tests

Adds pure verifier tests for successful replay, transcript reordering, missing claims, missing replay, denied evidence, digest mismatch, duplicate event IDs, and replay mismatch. Adds 128 deterministic unsupported completion fault injections. Adds a WASM gated driver integration test that first attempts unsupported completion, then collects evidence, then completes successfully with a certificate.

Security

Completion evidence is explicitly not authority. The certificate cannot approve tools, expand command policy, grant capabilities, or mutate the evaluator. Existing CommandGuard and tool policy receipts remain authoritative.

Evidence

Motivated by arXiv 2608.23623, submitted 2026 08 22. The reported frozen study shows 0 of 66 premature unsupported terminations for ECT versus 40 of 66 for its controller, with supported completion 97 of 132 versus 92 of 132. These originating team results are not claimed as reproduced here.

Scope

Six files, additive API, no dependency change, no persistent migration. ADR 272 documents trust boundary and rollback.

Acceptance before merge

1. CI and TypeScript build green.
2. Existing Horizon behavior unchanged without a completion config.
3. Deterministic fault injections demonstrate zero unsupported final acceptance.
4. p95 completion verification under 5 ms for certificates bounded to 32 references per claim.
5. No autonomous merge or deployment.