feat: add independent Rust PoCI verifier and root parity

[safal207]

What changed

Adds the fifth PoCI v0.1 slice:

• an independent Rust PoCI verifier implemented with serde_json and sha2;
• strict JSON parsing that rejects duplicate object keys and floating-point values;
• independent ACCEPT / HOLD / BLOCK / CHALLENGE evaluation;
• stable reason-code precedence;
• domain-separated canonical envelope-root computation;
• a proofpath-poci CLI for single envelopes and full fixture manifests;
• Rust tests against all 12 committed fixtures;
• CI generation of Python and Rust conformance reports;
• mandatory comparison of decisions, primary reason codes, and computed roots for every fixture;
• a portable python-rust-parity-report.json in the PoCI evidence artifact.

Independence boundary

The Rust verifier does not invoke Python and does not consume Python decisions or roots. Each implementation parses the same committed envelope bytes, independently evaluates the evidence chain, and independently computes the envelope root. CI compares only their resulting reports.

Reviewer commands

cargo test -p proofpath-verifier poci --all-targets

cargo run -q -p proofpath-verifier \
  --bin proofpath-poci -- \
  examples/poci-witness/fixtures/manifest.json \
  --manifest --pretty

CI contract

The PoCI workflow fails if either implementation does not pass all 12 fixtures or if any fixture differs on:

• actual_decision;
• actual_primary_reason_code;
• computed_envelope_root.

Stacked PR

Base: agent/poci-ci-demo-v0.1 / #196

Review and merge after #196, then retarget to main if GitHub does not do so automatically.

Backlog

Epic: #180

Advances:

• P1: Extend Rust verifier with PoCI envelope validation #186 — independent Rust verifier and Python/Rust parity
• P0: Add PoCI validation and cross-language checks to CI #188 — completes the previously deferred cross-language root check

Next:

• ecosystem adapters for CML, LTP/T-Trace, LiminalDB, and Ibex (P1: Map PoCI adapters to CML, LTP/T-Trace, LiminalDB, and Ibex #191)

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: faac0a27-0928-4607-912a-41d5ec910cc4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

Validation complete

Final head: a2d52bf5c8bfcf61c5d0201e72d5f546cb1bec16

Both workflows passed:

• PoCI run Bootstrap ProofPath protocol foundation #6 — Python tests, Rust tests, Python report, Rust report, 12-fixture decision/reason/root parity, reviewer demo, and artifact upload all succeeded.
• Rust run #273 — formatting, clippy with -D warnings, workspace tests, Compute Witness CLI fixture, action-boundary metrics, reusable action, Personal Agent Guard, and Agent Payment Guard all succeeded.

Final stacked diff remains limited to three files:

• .github/workflows/poci.yml
• crates/proofpath-verifier/src/poci.rs
• crates/proofpath-verifier/src/bin/proofpath-poci.rs

Uploaded artifact:

• poci-conformance-30603845889
• artifact id: 8782875309
• size: 6020 bytes
• SHA-256: 45659dece2b1f77941fcb95f3851062fa72eb765d423fa0d13073cf852e79e08
• expires: 2026-08-14T04:19:36Z

The artifact includes independent Python and Rust conformance reports plus python-rust-parity-report.json.