fix(repo): harden verification coding loop and public contracts

[MatinDeevv]

Summary

• requires explicitly preregistered, nonempty canonical argv policies; receipts can prove but never define required commands
• independently binds generic manifest test evidence to strict v2 receipt and physical log bytes
• makes no-overwrite publication race-safe and removes false failure after successful publication
• executes verification from selected HEAD/index trees and adds adversarial tree-mode tests
• unifies strict receipt verification across runner, CLI, and MCP; removes ambient PYTHONPATH
• pins NVIDIA endpoint, bounds responses, constrains patch scope, distinguishes advisory review, and preserves bounded failure evidence
• adds copied-plugin MCP portability coverage, explicit frozen-archive skip policy, immutable Action pins, valid YAML and truthful public links/docs

Evidence

• Base: 4fc8880f1dd2194f9a58111d0e4fa5ceda958e65
• Final Agent 1 parent: a9445e308e5242fe67d9c134b58fcfcc25817926
• Head: c8891a9368f3a4032c4543d6bf3d8b62aad9f998
• Post-rebase focused suite: 81 passed in 14.72s
• Post-commit HEAD/index verifiers: exit 0
• Exact-head GitHub Actions status is reported only after completion

No market data were inspected. Agent 2 modified no Edge Tribunal implementation files.

[Copilot]

Pull request overview

This PR strengthens the repository’s verification and external-model “coding loop” safety contracts, adds contract tests to prevent regressions, and updates public-facing GitHub/README links and CI job definitions to match the current repository.

Changes:

• Hardened NVIDIA coding loop trust boundary (pinned endpoint + no redirects), bounded response size/timeouts, and constrained patch application scope.
• Strengthened provenance/receipts (atomic writes, stricter canonical hashing) and improved manifest handling (legacy read-only policy + strict JSON parsing + atomic publication).
• Updated CI/workflow + public community files and added tests to enforce required jobs, link correctness, YAML validity, and safety policies.

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/test_workflow_contract.py	Adds a contract test enforcing required CI job IDs exist in ci.yml.
tests/test_public_links.py	Adds tests ensuring public docs don’t link to the prior repository and README contains expected layout/badge constraints.
tests/test_nvidia_patch_scope.py	Adds tests for explicit patch scoping and rejection of dangerous patch types.
tests/test_nvidia_endpoint_policy.py	Adds tests ensuring only the pinned NVIDIA endpoint is accepted.
tests/test_manifest_legacy_versions.py	Adds tests covering legacy manifest readability, future/unknown version rejection, and duplicate-key rejection.
tests/test_github_community_files.py	Adds tests validating .github YAML parses and issue forms have required shape.
README.md	Updates CI badge/link and documents experiments/ directory; removes BOM from header line.
plugins/simple-agent-framework/scripts/verify-test-receipt.py	Adds a verifier for v2 test receipts and their bound logs.
plugins/simple-agent-framework/scripts/run-test-with-receipt.py	Makes receipt/log writing atomic, tightens env capture policy, and adds dependency snapshot hashing.
plugins/simple-agent-framework/scripts/nvidia_coding_loop.py	Pins endpoint, disables redirects, bounds responses, scopes patches to allowed paths/prefixes, and refines loop status outputs.
plugins/simple-agent-framework/scripts/invoke-nvidia-coding-loop.ps1	Removes .env loading and requires explicit -AllowPath forwarding to the Python loop.
plugins/simple-agent-framework/mcp/research_mcp.py	Updates receipt verification logic and adds receipt version support reporting.
plugins/simple-agent-framework/config/external-model-policy.json	Introduces a JSON policy document for external model constraints.
engine/tools/verify_repository.py	Runs verification from the exported selected tree via a subprocess for stronger isolation.
engine/tools/verify_installed_package.py	Emits a stronger installed-wheel receipt (timestamps, member list hash, pip snapshot hash, etc.).
engine/core/run_manifest.py	Adds strict JSON loading (duplicate key/non-finite rejection), legacy version readability policy, and atomic manifest publication.
docs/repository-verification.md	Documents selected-tree subprocess behavior for repository verification.
docs/nvidia-coding-engine.md	Updates the safety contract and invocation example to reflect pinned endpoint and explicit allow-path scope.
docs/FAQ.md	Updates bug report link to the current repository.
.github/workflows/ci.yml	Adds edge-tribunal-tests and agent-framework-tests jobs.
.github/SECURITY.md	Updates vulnerability reporting link to the current repository.
.github/ISSUE_TEMPLATE/feature_request.yml	Fixes YAML structure/indentation and updates text to the current repository name.
.github/ISSUE_TEMPLATE/config.yml	Updates discussions/security contact links to the current repository.
.github/ISSUE_TEMPLATE/bug_report.yml	Fixes YAML structure/indentation and updates text to the current repository name.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.