Harden Fable Mode with evidence-bound System 3 control loops

[REX-codebase]

Summary

This PR consolidates the accumulated Fable Mode work into one reviewable change set. It adds a hardened, evidence-bound System-3-style control loop around compatible MCP hosts; it does not claim to alter model intelligence or provide a complete OS sandbox.

Control and verification

• Adds the strict fable_control_plane lifecycle: observe -> record prediction -> propose action -> record outcome -> request verification -> finalize.
• Integrates ClaimGraph, VerifierPlanner, and ThreeValuedAdjudicator into ordinary finalization. Uncovered claims, unresolved UNKNOWN results, invalid provenance, and failed/counterexample-backed claims block finalization.
• Enforces receipt-bound evidence, provenance resolution, verifier policy classes, quorum, diversity, independence, and signed process-attestation scope.
• Preserves legacy fable_session compatibility through an explicit immutable compatibility mode rather than silently weakening strict paths.
• Hardens counterexample integrity, claim decomposition/dependency DAGs, intrinsic risk classification, planner metrics, and mutation/metamorphic verifier hooks.

Runtime, MCP, and broker hardening

• Adds receipt-bound System 3 observe/predict/act/outcome/update/verify/finalize handling.
• Adds authenticated checkpoint/event reconciliation, immutable terminal state, graph closure, sealed axioms, typed measurements, and replay validation.
• Adds broker handshake/cancellation, bounded worker admission, executable/shebang pinning, quotas, workspace accounting, and fail-closed unsafe Windows capabilities.
• Adds session/CAS identity binding, sharded quotas, metadata and cancellation bounds, strict MCP protocol checks, adapter fixtures, and packaging/API drift checks.
• Restores authenticated strict-System-3 state across signed active and finalized checkpoint round-trips, with tampering and unsigned replay rejection.

Validation

• Full unittest suite: 212 passed
• Red-team test suite (test_*redteam*.py): 47 passed
• Server protocol and focused verifier tests included in the full suite
• Documentation checker: 19 Markdown files passed
• compileall: passed for source, tests, and docs
• pip check: passed
• Targeted strict checkpoint probes: active/finalized restore passed; tampering and unsigned authorization replay rejected

Explicit limitations

• The broker is a policy boundary, not an OS/network sandbox; hostile workloads still require container/VM/MAC/seccomp/Job Object isolation.
• In-process verifier claims are not a security boundary; strong process attestation requires an external authenticated verifier/host boundary.
• V1 synchronous interruptive cancellation/deadlines remain unsupported; broker cancellation is bounded and active.
• Release artifacts are unsigned; checksums provide integrity checking, not publisher authentication.
• Claude Code and Antigravity adapters are fixture-tested, not certified against live installations.
• Cross-session adaptation is disabled; persistence is auditable state, not authenticated self-improvement.

Please review the strict finalization, provenance/attestation binding, checkpoint restore path, and broker boundary assumptions in particular.

[REX-codebase]

Superseded by v1.3.0 frontier release on main