feat(vindex): a plan names who judged it and what it judged (plan schema 4)

[chrishayuk]

What

Step 2 of the Explorer roadmap: planner identity. Plan schema 3 → 4.

• SystemPlan.planner: PlannerIdentity { package, package_version, semantics_version } — who judged.
• ArtifactPlan.source: ArtifactSource { path, revision?, unpinned_revision? } — what was judged: the argument as given and, for hf://, the immutable commit the facts were read at, or the revision name it fell back to when the hub named none.
• PLANNER_SEMANTICS_VERSION (= 1): bumped only when a rule change can flip a verdict (the sliding-window normalisation would have been one); a CLI, wording or layout fix never bumps it. Two verdicts are comparable exactly when it agrees.
• Cache authority is pinned-only. A persisted verdict cache requires an immutable source revision: SystemPlan::cache_key() is Some((commits…, semantics_version)) only when every artifact carries a commit, and None for a local path or an unpinned_revision. An unpinned verdict (hf://org/model@main when the hub named no commit) may be shown, visibly marked unpinned, and must never be stored as authority — main on Monday and main on Tuesday can name different facts.
• plan_system keeps its signature (local source = the inventory's recorded path); plan_system_with_sources states sources and refuses a mismatched pairing. larql vindex3 plan and vindex plan both pass the resolved commit through.
• SystemPlan::parse reads a plan back and refuses another schema by name ("plan schema 3; this build reads plan schema 4"), so a pre-identity plan can never be read as an unattributed verdict. planner and source are deliberately not serde-defaulted.

Why now

The server's plan-by-source endpoint (step 4) and the Explorer's cache both need to say which planner judged which commit; a verdict without that is incomplete, and the same planner has already changed a verdict once (6 Qwen3 sizes, 3 → 0 blocking).

Gates

plan/tests/identity.rs (nine): identity equals this build's; a local source is the inventory's path; a stated source carries its revision and changes no verdict; sources pair one-to-one or are refused; round-trip + parse refusals by name (schema 3, no schema, not JSON); cache key present for a pinned source, absent for an unpinned one, absent for a local one, absent when any one artifact of several is unpinned; semantics witness — an admissible and a blocked fixture verdict pinned beside PLANNER_SEMANTICS_VERSION.

Local: fmt; clippy -D warnings for larql-vindex (--all-targets), vindex-cli, larql-cli (both feature shapes); larql-vindex check in three shapes, full suite + e0 + benches, coverage policy; larql-cli tests both shapes + registry checks; vindex-cli tests + --locked; doc gates.

Witness — larql vindex3 plan hf://Qwen/Qwen3-0.6B and vindex plan --json hf://Qwen/Qwen3-0.6B

Both front doors, release builds, 11.47 MB staged for a 1.50 GB checkpoint that never touched disk. The identity fragment they wrote, byte-identical between the two CLIs:

schema: 4

planner:
  package:           larql-vindex
  package_version:   0.2.0
  semantics_version: 1

artifacts[0].source:
  path:     hf://Qwen/Qwen3-0.6B
  revision: c1899de289a04d12100db370d81485cdf75e47ca

admissible: true   blocking: 0   (40 representable)
capabilities: text_generation: executable, image_conditioned: executable, audio_conditioned: executable, drafting: executable
cache_key: Some(([c1899de289a0…], 1))

Docs

docs/vindex3-format.md §4 now describes schema 4 and the semantics-version promise (it still said PLAN_SCHEMA = 2).