One-pool multispine builder: assemble-first build path with the agreement gate terminal (#578 increment 2)

[MaxGhenis]

Increment 2 (code) of #578: the #581 assembly seam wired into a real pool build
path, spine-blind end to end, with the spine-agreement gate as the terminal
stage. Rebased onto merged main (6c14a0a). The final local tree passes the
full populace-build suite (3,335 passed, 85 skipped).

What lands

tools/build_us_multispine_pool.py is the one-pool builder consumed by the
k-ladder:

1. SHA-pinned inputs, refuse on mismatch. Five explicit path/SHA pairs;
   packaged ACS digest and byte pins are enforced without downloading.
2. Assemble first. ASEC + ACS flow through assemble_spines(...)
   (provenance receipt, clone-safe ID bound, mass conservation), then the
   combined-pool PUF clone runs.
3. Spine-blind operator chain in canonical order. Fixed-parameter primary
   PUF QRF, the CG tail transfer: field-local donor quarantine + mass-conserving own-tail stratum + E01000 receipt (#567) #568 tail transfer with Tail assignments deliver the donor's joint vector verbatim (fixes the recipient-value overwrite) #570 donor-fidelity assertions,
   raw-preserving ACS transfer, deterministic derivation, take-up seeding, and
   ephemeral SSI simulation. No population operator branches on source spine.
   The transitive runtime graph is scanned; operator_boundary.py is the sole
   provenance-owner addition and is narrowly justified as a rejection-only
   raw-stage validator.
4. An enumerated guard contract, not a completeness claim. The AST
   tripwire certifies direct attribute/subscript/.loc/__getitem__ reads;
   strict query/eval/filter/get surfaces and simple/named-expression
   aliases; canonical column factories and simple/named-expression aliases;
   the documented one-level static string constructions; loop/comprehension
   propagation over static iterables; and statically visible contraband
   guarded names in non-owner modules. It explicitly does not claim to sandbox
   deliberately obfuscated Python or names materialized purely from runtime
   data. Code/adversarial merge review controls the first boundary; assembly
   receipts and runtime validation control the second. The known reverse-slice,
   format_map, __doc__, __annotations__, and container-indexed-method
   misses are pinned as intentional in
   test_documented_out_of_scope_evasions_are_not_caught.
5. Value-preserving runtime constant plumbing. This is not a
   guard-file-only change. support_provenance.py now owns and exports
   PERSON_SUPPORT_CHANNEL_COLUMN = "person_support_channel"; guarded
   non-owner consumers adult_care.py and ssi_take_up.py import it for their
   existing required-source and manifest plumbing. Consumer values and behavior
   are unchanged; the only API addition is the named owner constant.
6. The Assemble spines first: pre-operator multispine seam, spine-blind operators, and the spine-agreement gate (#395, increment 1 of #578) #581 agreement gate is terminal. Batched failures, fixed tolerances,
   and receipts land in the manifest. A red pool writes diagnostics plus a
   manifest with simulation_ready=false and exits nonzero; it cannot claim
   readiness.
7. Output. Nullable input-complete pool H5 plus diagnostics and a
   provenance-rich manifest. Calibration remains deliberately downstream in
   the exact-k ladder.
8. One build path. The late-ACS-append builder
   (build_us_acs_multispine_base.py) is reduced to a deprecated shim,
   following US base v2: one CPS+ACS+PUF-detail pool; datasets labeled by exact record count (dense = full pool; exact-k L0 selection) #578's one-suite doctrine.

Verification

• Guard file: 113 passed, including the pinned 54-module build graph and all
  runtime modules.
• Adult-care + SSI value-preservation suites: 85 passed, 2 skipped.
• Full populace-build: 3,335 passed, 85 skipped.
• Repository-wide Ruff and git diff --check: clean.

No full-data execution occurred; data runs remain separately sized on the
Modal lane per the #578 thread. Increment 2 consumes #581; the run that
adjudicates #403 dispatches after merge.

🤖 Generated with Claude Code

🤖 Generated with Claude Code

[MaxGhenis]

Adversarial round 1: HOLD, four blockers. The one that matters architecturally: the tool consumed pre_clone_enrichment, whose producer already ran ASEC-only operators — assembly-first was true of this tool's own stages but not of the lineage, preserving the #403 disease upstream. Fix round in flight: the producer splits at the pre-operator boundary (raw-stage export; every impute/derive/seed moves post-assembly onto the #581 spine-blind operators), red-path publication becomes invalidate-then-atomic-publish with failure-injection tests at all three interruption points, the guard learns pandas string-read evasions (.get/.query), and the legacy local-release chain keeps a working deprecated path until increment 4 formally retires it.