feat: enforce portable SDL identifiers

[Brad-Edwards]

Summary

Define and enforce one portable, exact SDL identity contract from authoring through composition, compilation, planning, runtime state, and backend realization, with explicit standards lineage and no claim that ACES addresses are URIs or that this identifier layer establishes behavioral bisimulation.

Requirement UIDs

• DSL-101
• DSL-102
• SEM-205

Related Issues

Closes #723

ADR Impact

• ADR-076

Changes

• Add lowercase ASCII local identifiers, structured qualified names, explicit module namespaces, a typed collision-preserving declaration index, exact reference resolution, and aggregate composition budgets.
• Carry compiler-owned canonical addresses through planning and snapshots; reject endpoint-domain, resource-type, dependency, result, and key/address incoherence before execution.
• Derive bounded provider names deterministically from complete canonical addresses and remove last-segment identity aliases in reference and libvirt realization paths.
• Align authoring tools, language services, schemas, examples, diagnostics, normative SDL specifications, the FM ledger, and accepted ADR-076 with the same identity model.
• Add property, differential, schema/model parity, composition, language-service, processor, runtime, and backend round-trip tests for the identity invariants.

Test Plan

• Unit tests pass (make test)
• Integration tests pass if applicable (make integration)
• make check passes (Spotless, SpotBugs, Error Prone, Checkstyle, JaCoCo)
• No coverage regression

Canonical verification passed: 3,277 tests passed, 1 skipped, 41 deselected; 92% coverage; 31 integration tests; schema/catalog/policy checks and Sphinx documentation build passed. Pre-commit, two core-review cycles, final GRC screening, and test-quality review are clean.

Ground Control Checks

• make policy passes
• gc_evaluate_quality_gates passes or is unchanged by this repo-only change
• gc_run_sweep reviewed; findings fixed or recorded with rationale

Traceability

• IMPLEMENTS: DSL-101 <- aces_sdl identifier validation, variable instantiation, and phase schemas, DSL-102 <- typed declaration index, exact reference resolution, composition namespaces, and compiler address collision checks, SEM-205 <- compiler, plan, snapshot, control-plane, backend, and provider-name address preservation
• TESTS: DSL-101 <- implementations/python/tests/test_sdl_identifiers.py and source/parser/schema parity tests, DSL-102 <- identifier injectivity, collision provenance, composition, language-service, validator, and processor tests, SEM-205 <- runtime control-plane, planner, reference backend, OCI, and libvirt realization tests

Checklist

• Code follows project coding standards (docs/CODING_STANDARDS.md)
• No business logic in API layer
• Domain layer has no framework imports
• Envers @Audited on new entities if applicable
• Changelog is generated by release-please; feature PRs add no fragment
• Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.

[pulumi]

⚠️ Pulumi could not deploy preview(s) for this pull request because GitHub reports it is not mergeable (mergeable state: dirty). This usually means the branch has merge conflicts with its base branch. Resolve the conflicts and push a new commit to retry.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.2% Coverage on New Code
0.1% Duplication on New Code

See analysis details on SonarQube Cloud