Lower source-defined profiles into validated registries

[alexlopashev]

Closes #109

Outcome

• add canonical profile-source lowering APIs that return identified syntax/profile roots, co-authored policy documents, and one atomically validated source-local registry
• allow source §syntax definitions to name one exact §extends parent
• materialize deterministic artifact IDs identical to equivalent canonical typed-document construction
• resolve syntax/profile/policy inheritance and overlays before custom parsing, compilation, or formatting
• reject mixed executable sources and all invalid topology/effective-map cases without exposing a partial registry
• exercise the frozen reference-program profile source through its existing deferred front-end boundary
• advertise bounded bhcp/feature.profile-source-lowering@0 support and include the new target in the hosted test plan

Red-to-green evidence

Base after required rebase: dd26643ce52c65a19b07ce98c9e57134ecc56a9d.

The first focused source-to-artifact parity test failed before implementation with Rust E0432: bhcp::pipeline::parse_profile_source did not exist.

After independent review exposed an unattached-policy atomicity gap at ca2c79362e4742ed37f611c716e7fa6e18381246, the new unattached missing-parent case failed because parse_profile_source returned Ok. The registry now validates each registered policy ancestry component independently, without composing unrelated optional overlay sets.

After implementation and correction:

• mise exec -- cargo test --test profile_source_lowering: 2 passed
• the parity test covers exact parent/mapping/formatting/type-mode/overlay fields, deterministic artifact IDs and CBOR, source-local resolution, custom compilation, and formatting
• the atomic matrix covers missing/cyclic syntax parents; unattached missing, cyclic, and cross-layer policy inheritance; attached policy cycles; ambiguous surfaces; punctuation prefixes; recursive aliases; reserved-core rebinding; weaker modes; missing overlays; executable definitions; and semantic overrides
• all profile, governance, policy-overlay, profile-audit, feature-manifest, CI-plan, schema, and v0 completion-contract targets passed
• mise exec -- cargo clippy --all-targets -- -D warnings passed
• git diff --check passed

Full validation

The unchanged canonical gate passed from a clean, explicitly bounded experiment-controller scratch directory:

mise exec -- cargo fmt --check
mise exec -- cargo clippy --all-targets -- -D warnings
mise exec -- cargo test --all-targets
mise exec -- cargo build --release
mise exec -- cargo test --test schema_fixtures

Documentation impact

Updated SEMANTICS.md, README.md, THREAT_MODEL.md, schema/conformance guidance, the Phase 4 audit continuation, and the feature manifest. Wiki maturity/architecture claims will be reconciled in the required post-merge audit.

Residual risk

This slice exposes the validated source-local registry through the Rust pipeline. The frozen reference program still stops at its already-declared unsupported match source-expression boundary, and the complete CLI/source-to-IR audit remains assigned to later roadmap issues.

Exact reviewed head

df873480f2b4f89798aa0cd78b36e5787ed201fe

[alexlopashev]

Independent review by Codex task /root/review_109 at exact head ca2c79362e4742ed37f611c716e7fa6e18381246.

Actionable finding — [P1] validate unattached policy topology before exposing the registry (src/profile.rs:623).

ProfileRegistry::validate walks every registered syntax and profile, but it never walks the registered policy set. Policy inheritance is validated only indirectly when resolve reaches a policy through a profile overlay. Consequently parse_profile_source returns Ok(ParsedProfileSource) for a source containing an unattached cyclic (or missing/cross-layer-parent) policy chain plus one valid syntax. I reproduced this against the reviewed head with two organization policies a §extends b / b §extends a and one valid syntax: the API returned OK policies=2 syntaxes=1 profiles=0.

That exposes an invalid source-local registry despite the PR/SEMANTICS/README/threat-model claims that topology is validated atomically and no partial registry escapes. Please validate every registered policy inheritance component for closed, acyclic, same-layer topology before returning, without treating unrelated optional overlay sets as though they were all attached together, and add missing-parent/cycle (ideally cross-layer too) cases where the invalid policies are not referenced by a profile.

Proportionate checks otherwise passed: profile_source_lowering, profile_resolution, policy_composition, v0_completion_contract, ci_workflow, and goal_algebra_conformance. I did not edit or merge the branch.

[alexlopashev]

Resolved the P1 atomicity finding at exact head df873480f2b4f89798aa0cd78b36e5787ed201fe. Added red-green cases for unattached missing-parent, cyclic, and cross-layer policy inheritance; each registered policy ancestry component is now validated independently without combining unrelated overlays. The focused suites and full canonical gate pass. Requesting fresh independent review of this immutable head.

[alexlopashev]

Fresh independent review by Codex task /root/review_109 at exact immutable head df873480f2b4f89798aa0cd78b36e5787ed201fe.

No actionable findings. The prior P1 is resolved: ProfileRegistry::validate now validates each registered policy symbol with only its own transitive ancestry, so unattached missing-parent, cyclic, and cross-layer components fail closed while unrelated optional overlay roots are not composed together. The retained negative matrix covers all three unattached topology cases. I also independently probed two unrelated policy roots whose type modes would conflict if globally composed; parse_profile_source correctly returned both documents and the validated registry.

Reviewed the full code, normative S9.1/EBNF, README/threat/conformance/schema claims, deterministic artifact-identity parity, feature manifest, frozen reference-program deferred-front-end boundary, and hosted CI-plan update. Local checks passed: formatting and diff checks; all-target clippy with warnings denied; profile_source_lowering, profile_resolution, policy_composition, governance_parser, profile_models, profile_lowering, profile_formatting, profile_phase_audit, v0_completion_contract, ci_workflow, goal_algebra_conformance, and schema_fixtures.

I will merge only this exact head after every required remote check is green. The issue and mutex:profiles refs remain owned by the authoring task and will not be released here.