core: add private profile graph

[yihanzhu]

What this adds

This adds the private profile-graph owner for the inactive core.contracts.v1 generation. It validates exact adapter-manifest, profile, and resolved-profile shapes. It also checks protected-role separation, resolved source projections, source-claim consistency, and the supplied profile/manifest graph.

The module imports only the accepted schema module. It adds no public root, wrapper, caller, documentation, workflow, profile selection, install, release, or live behavior.

Tracks #155

Exact construction record

• base: 6ae9452848fd1bdec38aaef78efc842f5e938de3
• head: 2c82be159ca923e95b68148d6bd35c024b98c25f
• parent spec blob: c6511d96c1a5e6aed27ba2075b5add65c121f782
• generation: g-14b7ad8ce54c3b8c585ff92063d71551ffc7394cc2294d0297bc7d2b8da2c386
• construction adoption: issue Define portable core contracts #155 comment 5465880478
• review-size record: issue Define portable core contracts #155 comment 5468426989, exact range 1,580–1,680 net lines
• actual change: 1,680 net lines, one profile-graph concern
• direct and full source dependency: schema G3 comment 5466181650
• schema merge: d48ecdb908a395c5205260a662db7d9d3f4c1eb4
• schema export blob: fd3924d414a7d620c2bf5de919a45c2599d572ec
• generation registry blob: 5e113105777694a280166e71d31efd19752e9562
• serial predecessor only: ingress G3 comment 5468279667
• ingress export blob: e882b38b0106aac9142c667771f02e3107f8c52f

Generation export:

core/v1/generations/g-14b7ad8ce54c3b8c585ff92063d71551ffc7394cc2294d0297bc7d2b8da2c386/modules/profile_graph.jq

Activation exports: none.

Exact-head local proof

Run on 2c82be159ca923e95b68148d6bd35c024b98c25f:

• pinned jq 1.6 profile proof: 45/45 owned rules; 135/135 direct cases; 8/8 command-to-rule cells; 8/8 forced routes; 5/5 error layers; 16/16 dependency/activation/restore guards; 7/7 review rows; 92/92 legacy rows; zero failures
• bash scripts/test/run-all.sh: all 11 test scripts passed
• ShellCheck 0.11.0 over every tracked shell script: clean
• bash scripts/check-rename.sh: clean
• git diff --check: clean

The 99 migration rows are fixed data. The larger proof is needed to keep D/P/S routes independent, rebuild cross-document digests before graph checks, cover full source and offer relations, and prove dependency pins in a history-absent checkout without using product code as the test oracle.

The generation remains incomplete, private, inactive, and restorable. PR #183 and the preserved parent-plan worktree were not changed.

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	2c82be1
Status:	✅  Deploy successful!
Preview URL:	https://4b403d81.fabrica-6yx.pages.dev
Branch Preview URL:	https://codex-portable-core-profile.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Test-only shallow-checkout revision

CI run 33309604258 failed only because the proof used git merge-base --is-ancestor for historical schema and ingress commits that are not present in the GitHub shallow checkout.

Revised exact head: 2c82be159ca923e95b68148d6bd35c024b98c25f

The revision changes only:

• scripts/test/portable-core-profile-graph-fixtures.jq
• scripts/test/portable-core-profile-graph.test.sh

The profile product export is byte-identical:

core/v1/generations/g-14b7ad8ce54c3b8c585ff92063d71551ffc7394cc2294d0297bc7d2b8da2c386/modules/profile_graph.jq = blob 48fd185eee7751eedf0ce381b77621e4d7cd1611.

The dependency proof now checks current HEAD tree entries by exact mode, type, path, and blob OID for schema, ingress, and the registry. Fixed fixture metadata separately pins both G3 comment IDs, the schema merge identity, the construction predecessor/base, generation, parent spec, and export OIDs. Manager/final review still authenticates the external G3 comments and ancestry.

A hermetic history-absent regression creates a one-commit shallow repository. It pins SHA-1, disables templates, attributes, autocrlf, hooks, and signing, verifies that the historical schema commit is absent, and then proves the same exact tree tuple passes. The proof also passes with GIT_DEFAULT_HASH=sha256 in the ambient environment.

Exact-head local proof:

• profile proof: 45/45 rules; 135/135 direct; 8/8 cells; 8/8 forced; 5/5 layers; 16/16 guards; 7/7 review rows; 92/92 legacy rows; zero failures
• full runner: all 11 test scripts passed
• ShellCheck 0.11.0 over every shell script: clean
• rename and diff checks: clean
• read-only focused review: PASS, no Important finding
• total scope: exactly 1,680 net lines, within Define portable core contracts #155 comment 5468426989

Required GitHub CI and final exact-head PR review must bind this new head. The PR remains unmerged.

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 2c82be1
Reviewed-base: 6ae9452
reviewer: operator-default @ high

Posted verbatim by codex-review.sh (codex exec review --json --base refs/codex-review/191-81704/base in an isolated temp worktree, sandbox forced read-only). Comments only — Codex never pushes, approves, or merges.

No actionable correctness issues were found in the profile graph implementation or its accompanying proof and restore-manifest changes.

[yihanzhu]

Operator action needed

PR #191 is ready for squash merge.

• exact head: 2c82be1
• exact base: 6ae9452
• required ci: SUCCESS, run 33310257512, app 15368
• final independent review: clean, comment 5468568667
• merge method: squash only

The construction session attempted the authorized exact-head publish, but the host safety layer refused agent-side merge. No workaround was attempted. Please squash-merge this exact unchanged PR in GitHub. The pipeline will verify the receipt and continue automatically.