Register and seal AXM Aperture package extensions

[BigBirdReturns]

Classification

Closes #37. This is the Genesis authority transaction for AXM Aperture AP-311. It registers the complete Aperture story-package extension family and adds a domain wrapper that validates one whole package before delegating the only write, Merkle, manifest, signature, and self-verification transaction to the existing generic compiler.

Nothing in spec/v1, the gold shard, identity derivation, hybrid signature suite, Merkle construction, verifier logic, or verifier error codes changes. The frozen verifier remains opaque to story, edition, provider, playback, exposure, knowledge, and actuation semantics.

RFC 0009 extension family

aperture-package-revisions@1
aperture-positions@1
aperture-facts@1
aperture-causal-edges@1
aperture-reveals@1
aperture-edition-maps@1
aperture-sources@1

All fields are canonical JSONL strings. Integers and intervals use canonical decimal strings. Rates are reduced rational strings. Confidence is a canonical decimal string in [0,1]. Arrays are compact JSON-array strings. Optional identifiers and absent interval coordinates use the empty string. Every table has a unique composite sort key.

One-pass compiler law

compile_aperture_shard receives the seven tables separately from CompilerConfig, requires cfg.extra_ext to be empty, validates and normalizes the complete bundle, and calls compile_generic_shard exactly once with the normalized extra_ext mapping. It contains no file writer, Merkle implementation, manifest implementation, signature implementation, or reseal path.

Extension registration is idempotent and runs before compiler_generic imports its registry. A conflicting definition for the same published @1 identifier refuses package import rather than mutating the schema silently.

Semantic refusal before custody

The package validator refuses missing or extra tables, empty registered tables, unknown or missing fields, non-string values, duplicate primary keys, malformed package, TimeMap, and digest identities, invalid integer, rational, confidence, and interval forms, unknown package revisions, broken position parents, facts without their declared first reveal, unknown causal endpoints, self-causal edges, unknown provenance sources, incompatible TimeMaps, map identity drift between segments, and overlapping provider or canonical ranges.

Semantically unordered arrays, rational fractions, and confidence values are normalized before Genesis writes canonical JSONL, giving byte-stable extension tables under input reordering such as 2/2 versus 1/1, 1.000 versus 1, and reversed subject lists.

Qualification

The source candidate passes Python syntax compilation and a standalone domain qualification covering idempotent registration, complete bundle acceptance, array, rate, and confidence normalization, and refusal of missing tables, unknown first reveals, self-causal edges, and unknown source custody.

The repository test adds the complete hosted authority lane:

• one-pass extra_ext compilation under the existing hybrid compiler;
• all seven extension files present in the signed manifest;
• no Parquet and no post-compile injection;
• verification with a publisher key written outside the shard;
• repeated builds with semantically reordered inputs producing identical manifest and extension bytes;
• refusal of a competing CompilerConfig.extra_ext source.

Repository CI remains the authority for the ML-DSA-backed compile and verify cases, the complete Genesis suite, frozen-gold checks, compatibility contract, and all existing extension regressions.

Cross-repository candidates

Aperture custody and exact-oracle candidate  BigBirdReturns/axm-core#31
Arc timed-media verifier                    BigBirdReturns/axm-arc#245
Core rebuildable extension runtime          BigBirdReturns/axm-core#33

local Aperture qualification
qualification1_8ae7452d6f0d903fb27e81319fa83b59e4d0b0004f03124b191a3a1a607843a8

local Aperture exact oracle
oracle1_8f77458995aaa5626158ecedcfef3752e2cd0efd4a7cd1cdc1e372b50cb89cdd

All remain candidate evidence. This PR does not accept G2, create the dedicated Aperture repository, decide narrative truth, verify a provider edition, infer viewer state, mount Core tables, or control playback.

Lineage

The branch starts directly from current Genesis main 411ef40e6cfc3ecb97ac3e256c8151be678347c8. It does not modify an open donor branch or require a consumer to depend on one.

Control question

Can Genesis seal the complete story package as ordinary extension bytes in one pass while remaining unable to decide what the story means, what edition is playing, or what the viewer knows?