Add a neutral capability bundle contract to Workflows/Keepalive

[stranske]

Target: stranske/Workflows
Priority: P1
Depends on: local capability IR/lifecycle stability from issues 4, 7, and 17

Why

Workflows correctly owns the GitHub event loop and agent-agnostic routing (docs/keepalive/Agents.md:68-75; GoalsAndPlumbing.md:140-151), but it has no neutral contract for portable Orchestrator capabilities. Keepalive metrics currently return iteration/action/error/duration/task counts without applied capability/gate IDs (docs/keepalive/METRICS_SCHEMA.md:1-36).

The research backplane is a separate activation-debt proving case. This issue establishes the neutral capability-bundle contract only; participant emission and Workflows registry transitions are split into dependent repo-specific issues.

Scope

Define capability-bundle/v1, integrate deterministic capability/gate/playbook IDs into Keepalive prompt composition and metrics, and synchronize consumer templates.

Non-Goals

• Do not copy local posterior weights, provider credentials, raw prompts, or autonomous local-control commands into Workflows.
• Do not create a second learned router or concurrent live supervisor.
• Do not activate the LMS consumer before its documented charter decision.
• Do not mark planned participants conformant from schema presence alone.
• Do not modify a participant repo or change config/backplane_participants.json lifecycle state in this issue.
• Scaffold-only completion does NOT count: a schema with no validated prompt application, returned metrics IDs, bundle contract tests, and consumer-template synchronization is incomplete for this Workflows issue.

Tasks

• Add a versioned capability-bundle/v1 schema under Workflows contract/schema paths with capability ID/version/hash, deterministic selector predicates, owner, task/acceptance fragments, gate/playbook refs, expiry, and rollback; forbid local weights/credentials/raw prompts.
• Add registry validation and deterministic selection helpers used by .github/scripts/keepalive_prompt_composer.js and related Keepalive runner code without changing label-to-runner authority.
• Extend Keepalive metrics/state with matched/applied capability IDs, bundle/hash, gate versions, rejection reasons, and downstream result.
• Update templates/consumer-repo, sync manifests, conformance tests, and freshness tests from the Workflows source of truth.

Acceptance Criteria

• Workflows contract tests reject a bundle with an unknown capability ID, mismatched content hash, expired selector, unsafe inline prompt, or local routing weight.
• A Keepalive fixture deterministically applies a matching capability fragment and returns its exact ID/hash/gate version in metrics; a nonmatching fixture applies none.
• Root and consumer-template freshness tests fail when bundle schema/runner integration diverges.
• Deliberate break: in .github/scripts/__tests__/capability-bundle-contract.test.js::validBundle, change only content_hash to sha256:deadbeef; run exact test .github/scripts/__tests__/capability-bundle-contract.test.js::hash mismatch blocks dispatch via node --test .github/scripts/__tests__/capability-bundle-contract.test.js --test-name-pattern='hash mismatch blocks dispatch'; observe AssertionError: invalid capability hash reached prompt composition; revert and show the exact test passes.

Implementation Notes

Keep Workflows as the single GitHub controller. The local Orchestrator may compile and select portable deterministic artifacts, but Workflows validates and executes only registry-declared bundles and returns evidence IDs. Backplane participant activation is handled by the Pension-Data producer and Workflows registry-transition issues.

[stranske]

Reopening for verifier sequencing after PR #2744 merged and verify:compare was applied. This source issue should remain open until durable verifier/provider comparison PASS or evidence-backed disposition.

[stranske]

Closer verifier-disposition audit on current main (798239f1, merged PR #2744): the Provider Comparison CONCERNS are stale/ambiguous checklist-read findings rather than remaining completion debt.

Evidence checked against current main:

• Capability bundle contract and validation exist in .github/scripts/capability_bundle.js, root contract/schema docs, and consumer-template mirrors.
• Keepalive metrics/state include applied bundle IDs, hashes, gate/playbook refs, and deterministic rejection reasons via buildMetricsRecord() / parseCapabilityBundlesInput(); docs/keepalive/METRICS_SCHEMA.md documents those fields.
• Root and consumer-template script/docs/schema copies are synchronized through .github/sync-manifest.yml; python scripts/validate_template_completeness.py reports all consumer workflows properly templated and manifested.
• Hash mismatch behavior is covered by .github/scripts/__tests__/capability-bundle-contract.test.js::hash mismatch blocks dispatch.
• The langsmith-fleet-worker-attempt.json change is generated attempt metadata from the agent lane and does not affect runtime capability-bundle behavior.

Validation run from current main:

• node --test .github/scripts/__tests__/capability-bundle-contract.test.js .github/scripts/__tests__/keepalive-prompt-composer.test.js .github/scripts/__tests__/keepalive-loop.test.js -> 127 passed
• python -m pytest -q tests/scripts/test_validate_workflow_yaml.py tests/workflows/test_sync_manifest_delivery.py tests/workflows/test_workflow_agents_consolidation.py tests/scripts/test_validate_template_sync.py -> 81 passed
• python scripts/validate_template_completeness.py -> passed
• node --test .github/scripts/__tests__/capability-bundle-contract.test.js --test-name-pattern="hash mismatch blocks dispatch" -> passed

Disposition: verifier CONCERNS are resolved by current-main evidence; no bounded follow-up PR is needed.

[stranske]

Closing after current-main verifier-disposition audit: merged PR #2744 satisfies the capability-bundle contract, metrics, template sync, and hash-mismatch coverage requirements; no follow-up debt remains.