eval: prove complex VRS and provider receipt boundary

[myobie]

Summary

This draft gathers the active, unmerged eval work on the exact current main:

• replaces the superseded prompt/compliance VRS variants with a complex catalog-activation matched pair and a designed-to-pass command-policy cell;
• freezes matched surfaces and adds model-free executable mutation proofs without weakening the living-spec judge;
• fails Claude authorization closed on stale, context-drifted, override-tainted, non-exact, duplicate, or over-budget evidence;
• makes paired product failures eligible to continue to their control only after provider termination has produced a schema-valid, durable usage/cost receipt; and
• adds a hermetic end-to-end A–D proof through the public bin/overnight.sh entry point.

The branch is restacked through merged PRs #51 and #53.

Provider termination contract

Before launch, every provider command must expose the exact USD 0.05 hard-budget and JSON-output contract. After every provider termination—including watchdog timeout—the runner requires exactly one normalized receipt bound to cell, provider, model, token counts, cost, budget, and status. It atomically persists that receipt before classifying the product verdict.

• valid under-budget product FAIL: persist, run paired control, preserve final failure
• valid under-budget product timeout: persist, run paired control, preserve final failure
• missing or malformed receipt: write STOPPED before control
• valid over-budget receipt: persist, then write STOPPED before control

Current real provider declarations do not satisfy that guarantee, so the launch gate intentionally refuses them. This draft does not authorize or perform the preregistered matched-pair provider run.

Model-free proof

Exact command:

ST2_BIN=<exact-9887b28-binary> OVN_KEEP_TMP=1 \
  bin/check-overnight-receipt-boundary.sh

Result:

PASS a: product timed_out=0 persisted under-budget usage, paired control ran, final rc=1
PASS b: product timed_out=1 persisted under-budget usage, paired control ran, final rc=1
PASS c-missing: absent receipt stopped before control, final rc=1
PASS c-malformed: malformed receipt stopped before control, final rc=1
PASS d: over-budget receipt persisted then stopped before control, final rc=1
PASS: overnight A-D receipt boundary exercised real preflight, launch gate, post-termination classification, persistence, continuation, and STOPPED semantics without a provider call

The fake seam only redirects the provider/eval binaries, temporary run root, and watchdog duration. It still crosses the production clean-main guard, exact pinned preflight, budget gate, receipt parser/persistence, verdict classification, continuation, and stop logic.

Validation

PATH=<exact-9887b28-bin-dir>:$PATH bin/check-corpus.sh

Green results include:

• exact pinned st2 source 9887b28, SHA-256 d49d44fd4f3f6f655455c212353a469fefa956082bedf22163deb767d8a36a0d
• 165 shell files parse
• 72 KDL files parse
• 42 maintained cells and 10 nested catalogs load semantically
• all fixture-reset, event-first DING, canonical harness, model policy, VRS matching/mutation, runner policy, no-PII, history, and generated-catalog gates pass
• git diff --check clean

No provider/model call and no deployment occurred while completing this draft.

[myobie]

Provider execution remains held on the focused acceptance dependency in #61: the real provider path must enforce a hard USD 0.05 per-cell cap and yield exactly one normalized receipt after every termination, including timeout. This does not change frozen head d0678ad77d3424d516446225d9ddcc17e0312283, authorize a paid run, weaken the living-spec judge, or infer a VRS result.