feat(phase-5): salvage synthetic retired-Ward corpus onto hardened core (threads-uqx.13)

[BunsDev]

Summary

Executes the salvage plan from #20: cherry-picks the retired-Ward corpus fixtures from closed #17 (tip c6cdb60) cleanly onto main, after #15 (ee3cc29) landed the canonical veto-hardened core. Closes #20; bead threads-uqx.13.

Included (corpus fixtures only, per #20):

• tests/support/phase5_retired_ward_corpus.rs — repository-authored synthetic corpus builder (no historical/private Ward data; provenance block asserts historical_data_used: false)
• tests/phase5_retired_ward_corpus.rs — digest-pinned conformance tests: 5 identity fields, all 4 approval labels, veto windows, region-classification fidelity + path_tier_floor, and 6 fail-closed unsupported cases
• examples/generate_phase5_retired_ward_corpus.rs — canonical JSON generator (cargo run -q -p coven-threads-core --example generate_phase5_retired_ward_corpus)
• src/surface_regions.rs — tightens MaterializedDiff::try_new to reject absent-both and unchanged surfaces (the fail-closed defect flagged in the uqx.13 verification loop: 12/15 → fixed), with unit tests
• specs/PHASE-5-APPROVAL-SEMANTICS.md §7 — uqx.13 tracking entry

Explicitly NOT included: #17's approval.rs / audit.rs / identity_invariants.rs changes — those regressed #15's deserialize_required_veto hardening and are why #17 closed.

Validation (fresh worktree off main)

• clean cherry-pick, no conflicts
• cargo fmt --check clean
• cargo test -p coven-threads-core — 176 + 17 + 4 + 14 pass, 0 fail
• cargo clippy -p coven-threads-core --all-targets -- -D warnings clean
• corpus suite 4/4 incl. pinned SHA-256 b3c5f156…db44; generator output reproduces the pin byte-for-byte

Gate

Draft until Echo semantic validation (owner per #20) + Nova/Val review. Verified fixtures compile and pass against #15's veto-hardened ApprovalPath shape (wire key auto_regression.veto required; corpus valid-cases carry explicit veto objects).

[BunsDev]

🔎 Verified-loop iteration 2 in flight: an independent fresh-context verifier (separate session, holds the frozen threads-uqx.13 rubric from the 2026-07-21 loop) is scoring PR head e2ef8c2 against the packet (threshold ≥92/100, fail-closed min 13/15 — iteration 1 failed at 12/15 before the try_new tightening). Verdict will be posted here. Implementer session: please don't self-certify or launch a duplicate verifier.

[BunsDev]

✅ Verified-loop iteration 2: PASS — 97/100, all mandatory minima met (threshold ≥92; every dimension ≥ its minimum). Fresh-context verifier, PR head e2ef8c2, pinned worktree, no files modified.

Dimension	Score	Min
Spec fidelity	29/30	27
Privacy & provenance	20/20	18
Corpus coverage	19/20	18
Fail-closed behavior	15/15	13
Reproducibility & usability	14/15	14

All packet commands exit 0: corpus tests 4/4, full crate suite 176+17+4+14 pass / 0 fail, fmt clean, clippy -D warnings clean. Generator byte-identical across runs; stdout digest matches the pinned b3c5f156… (modulo trailing newline). No PII/historical data (provenance asserts kind=synthetic, historical_data_used=false). Iteration 1's blocking defect is closed: absent-both/unchanged/duplicate diffs now rejected in try_new with no wire bypass (#[serde(try_from)]).

Non-blocking follow-ups (verifier suggestions, fine post-merge):

1. Document the pinned SHA-256 next to the generation command in specs/PHASE-5-APPROVAL-SEMANTICS.md, noting the digest excludes the trailing newline (shasum of the emitted file differs).
2. Add an AutoRegression { veto: None } corpus case (legal config the harness supports but corpus never exercises).
3. Derive the all-regions assertion from registry.descriptors() instead of hardcoding the three names, so new built-in regions flag corpus staleness.

Note for reviewers: try_new tightening is a disclosed fail-closed tightening (required by the approved malformed-diff cases), not scope expansion — but it does change accepted inputs for all callers; verifier flagged is_modified()/modified_surfaces() as now-dead logic post-construction.

[Copilot]

Pull request overview

This PR implements the salvage plan from #20 by bringing the synthetic retired-Ward Phase 5 corpus fixtures (and the minimal supporting hardening in MaterializedDiff::try_new) onto the veto-hardened core from #15, enabling digest-pinned conformance testing without relying on any historical/private Ward data.

Changes:

• Adds a repository-authored synthetic corpus builder plus digest-pinned conformance tests for identity fields, approval labels, veto windows, and surface-region classification.
• Tightens MaterializedDiff::try_new to fail closed on surfaces with neither before nor after, and on unchanged surfaces, with unit tests.
• Adds a canonical example binary for emitting the corpus JSON and updates the Phase 5 approval-semantics spec tracking entry.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
specs/PHASE-5-APPROVAL-SEMANTICS.md	Adds a threads-uqx.13 tracking entry documenting the public synthetic corpus and generator invocation.
crates/coven-threads-core/tests/support/phase5_retired_ward_corpus.rs	Introduces the synthetic retired-Ward corpus JSON builder with provenance assertions and valid/unsupported cases.
crates/coven-threads-core/tests/phase5_retired_ward_corpus.rs	Adds conformance tests validating identity invariants, approval/veto semantics, region classification fidelity, and pinned SHA-256 digest.
crates/coven-threads-core/src/surface_regions.rs	Hardens MaterializedDiff::try_new to reject absent-both and unchanged surfaces; adds unit tests.
crates/coven-threads-core/examples/generate_phase5_retired_ward_corpus.rs	Adds a canonical generator example for emitting the corpus as deterministic JSON.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.