[lahlfors]

Summary

Implements the remaining B3a-3 (W4 second half) deliverables in packages/cage-conformance/ and publish-client-sdk.yml, and enforces partner brand anonymity across all five code and test trees (Generic in Code, Specific in Prose):

1. Endpoint Conformance Profiles (verify --endpoint <url> --profile <profile>):

   • Adds run_endpoint_verification() and PARTIES_BY_PROFILE in runner.py supporting provider-01-v0.2 (POST /cage/validate, GET /legal-baseline/{region}, GET /evidence-chain/{thread_id}) and actuator-01-v1 (GET /v1/keys/receipt-manifest, POST /v1/actuate, plus cryptographic verification of returned ExecutionReceipts against the live manifest via diagnose_receipt()).
   • Wires --endpoint, --profile, --bearer-env, and --timeout into cli.py, enforcing --endpoint + --profile pairing and mutually exclusive --direction vs. --endpoint selection.
   • Adds deterministic provider_01 request/response test vectors (ALLOW, REFUSE, ESCALATE, missing-decision, and missing-authority_record_id negative vectors) in vectors/provider_01_v02.json.
   • Updates parties.json, packages/cage-conformance/README.md, and docs/architecture/CONFORMANCE_VERIFIER_SPEC.md.

2. conformance-v* Release Workflow:

   • Extends .github/workflows/publish-client-sdk.yml to trigger on both sdk-v* and conformance-v* tags, selecting packages/cage-conformance when conformance-v* is pushed or selected via workflow_dispatch, running scripts/check_conformance_sync.py + tests/test_cage_conformance.py, and publishing sdist/wheel + SHA256SUMS to GitHub Releases.

3. Partner Anonymization & 5-Directory Gate G8 Enforcement:

   • Renames scripts/verify_provider_01_wire_and_hostile.py and tests/integrations/provider_01/test_provider_01_step2_qualification.py (along with vectors/provider_01_v02.json) and updates all path citations in docs/POAM.md.
   • Replaces partner brand identifiers across src/gateway/, src/integrations/, packages/cage-conformance/, scripts/, and tests/ (Provider01NormativeProvider, PROVIDER_01_REFUSE, Provider07*, PROVIDER_07_*, Provider08*, consequence:token:, CAGE_CONSEQUENCE_CONSUMPTION_TTL_SECONDS, provider-01-v0.2).
   • Expands scripts/check_vendor_brands.py (Gate G8) to scan all five directories (src/gateway/, packages/cage-conformance/src/, src/integrations/, scripts/, and tests/) across file/directory paths, Python AST symbol/identifier names (ClassDef, FunctionDef, AsyncFunctionDef, Name, Attribute, arg), and string/bytes constants (ast.Constant), codifying the Layer 3 external wire-protocol constant boundary in LAYER3_WIRE_PROTOCOL_PROVENANCE (22 provenance-verified wire literals, each checked against its cited .md/.json partner spec or vector artifact on disk, with unused entries failing Gate G8) and AGENTS.md.

Verification

• uv run pytest tests/test_layer_boundary_gates.py tests/integrations/provider_01/test_provider_01.py tests/integrations/provider_01/test_provider_01_step2_qualification.py tests/integrations/provider_02/test_verification.py tests/integrations/provider_07/test_provider_07_adapter.py tests/test_defer_queue.py tests/test_governance_middleware.py tests/test_normative_provider_conformance.py tests/test_pii_sanitizer.py tests/test_actuator_01_adapter.py tests/test_actuator_01_envelope.py tests/test_actuator_01_receipt_verification.py tests/test_actuator_01_signatures.py tests/test_partner_harness.py tests/test_cage_conformance.py -q (450 passed)
• python scripts/check_vendor_brands.py --verbose (Gate G8 PASSED: No forbidden vendor brands in 895 Python files or 1086 paths (22 provenance-verified wire literals))
• python scripts/check_conformance_sync.py (3 proof modules byte-identical, no src/ or proof/ imports)
• python scripts/check_doc_references.py (All documentation references, file paths, and symbols are valid)
• uv run bandit -r src/ scripts/ -c pyproject.toml -ll -ii (0 issues identified across 118,669 lines)