Dual-harness fixture suite: blocklist grep, boot check, copy fidelity, receipt compatibility

[aarontrowbridge]

Important

Problem — The protocol layer ships as files across two repos plus deployed copies, and nothing polices the whole surface: no grep for proprietary vocabulary, no boot check, no copy-fidelity verification between the canonical and public skill copies, no receipt-contract compatibility test, no deployment-receipt re-verification — the dual-harness contract is prose until this suite exists.
Approach — The dual-harness fixture suite in amicode: the blocklist grep over the enumerated protocol file set (CI checks out armonissima read-only for the canonical copies), the boot check (frontmatter + skill-reference resolution into the public-set manifest), copy fidelity (bodies byte-identical modulo surface/agents frontmatter), the receipt classification table + ledger-row diff test, and deployment-receipt re-verification.
Scope — in: the suite's five checks, the receipt classification table, the public-set manifest, the CI wiring (armonissima checkout) · out: protocol content (slices 1–5), deployment itself (slice 3's script).

Acceptance Criteria

• Blocklist grep: zero occurrences of any blocklisted string over the enumerated protocol file set — both mode cards, both director-core skill copies (armonissima canonical via CI checkout + amicode public), both gate-pack fixtures, both seed schemas, the blocklist fixture
• Boot check: every card's frontmatter parses with description + mode; every skill reference (backtick-quoted or markdown-linked paths matching **/SKILL.md) resolves into the public-set manifest (amicode's surface: public skills)
• Copy fidelity: the two director-core skill copies' bodies byte-identical; frontmatters differ only in surface and agents fields
• Receipt compatibility: the classification table covers all 9 snapshot fields with one-line rationales; ≥ 7 classified protocol; the ledger-row schema (committed JSON Schema) carries every protocol field name+type; the diff test fails on drift either direction (snapshot field unclassified; protocol field missing/type-changed)
• Deployment re-verification: the committed deployment receipt's source digests match current repo sources — stale receipts fail
• The suite runs green in CI with the armonissima checkout; red when any check's fixture is deliberately broken (self-test)

Testing Decisions

Integrates slices 1–5's artifacts — this slice is the aggregate gate. Delivers oss_degradation_clean and receipt_contract_compatible. Self-tests (deliberately broken fixtures → red) prove the checks bite.

Key Decisions

CI checks out armonissima read-only — canonical stays canonical, the suite stays public. The receipt classification table is authored with rationale per field and covered by the authorship split (reviewer ≠ implementer, PR gate — a self-serving classification is caught in review, stated honestly as social). Named residues: transitive skill closure unggregped (OB-M6); post-deployment destination drift unseen (re-run the deploy script).

Constraints & Invariants

No criterion contains a human step. The suite is itself protocol layer — zero blocklisted strings in its fixtures' content.

Prior Art

The spec's D4 + Measurement Protocol; spec-20260821-034210 D1 (the receipt snapshot source); the distillation spec's fixture-suite precedents.

Source

Part of 497 · spec spec-20260822-063957-auto-rd-two-modes.md (D4, Measurement Protocol) · Blocked by #S1, 498, 501, 499, 500 (the full protocol file set must exist to police it).