Phase 1 — trust-tiered adapter registry, isolation, permissions, checkpoints

[thebeastagi]

Phase 1 — legal/licence gate and adapter hardening

Implements epic #7 (tasks #12–#16). Contract: ROADMAP.md Phase 1.

What lands

Piece	Module	Notes
Trust-tiered registry	sapiens/registry.py	SYNTHETIC / CORE / UNTRUSTED derived from manifest provenance facts; replaces the Phase-0 synthetic-only gate. Explicit registration pins tiers.
Permission/licence manifest	sapiens/permissions.py + permissions.json	Machine-readable owner grants (source, scope, licence, grantor, reference, validity window). Ships empty — zero third-party permissions; clean-room invariant enforced by code.
Subprocess isolation	sapiens/isolation.py	UNTRUSTED adapters never run in-process: child self-applies POSIX rlimits (CPU, AS, NOFILE), parent enforces wall-clock timeout, all failure modes contained fail-closed.
Signed checkpoints + anchoring	sapiens/checkpoints.py, sapiens/ledger.py	New checkpoint event kind with continuity verification; optional HMAC-SHA256 signature (env-held key, never stored); external anchor export/verify.
Kernel wiring	sapiens/kernel.py	Registry-driven tier check; UNTRUSTED ⇒ isolation. L4 stays human-gated.
Manifest provenance	sapiens/models.py	code_origin / data_sources / third_party_source with coherence validation.

Honest limits (documented in code + ARCHITECTURE.md)

• rlimits bound resource use; they are not a security sandbox — third-party code additionally requires a recorded owner permission.
• HMAC is symmetric: proves local key possession, not third-party authorship. External anchoring is a file-export hook; true external timestamping is Phase 5.
• No real-data adapter ships in Phase 1 — tiers are exercised by synthetic adapters and test doubles.

Invariants verified

• L4 promotion remains human-gated (ledger guard untouched, tested).
• No scientific-discovery claims anywhere; CLI still reports scientific_discoveries_claimed: 0.
• Zero ASTRA-family code; permissions.json empty.
• No secrets in any artifact; checkpoint key is environment-only.
• Full suite: 112 tests green (70 core incl. 45 new; demo + MCP unchanged), ruff clean.

Also fixed

Pre-existing fragility: module-level ExecutionContext(10, 2) in test_photometry_adapter.py started its wall clock at collection time and expired once the suite grew past ~2s. Replaced with per-call fresh contexts.

Closes #12, closes #13, closes #14, closes #15, closes #16. Part of #7.