feat: enforce signed qualification admission before actuation

[abrichr]

What

Flow verifies a signed, expiring, revocable workflow qualification admission immediately before any real Standard/Regulated action, including fully local runs (an offline customer uses a local signer registry with a durable checkpoint). Demo is the only unsigned run mode and cannot report production success. Recording, compile, inspect, lint, simulate and qualify stay unsigned.

Four commits:

1. feat: enforce signed workflow qualification admission — openadapt_flow/qualification_admission.py plus the run gate: a managed production dispatch without a signed admission is refused before actuation, and the signed record must bind the exact bundle, governed template, environment, input/action/identity/effect contracts of this run.
2. fix: keep admission identity independent — a record that collapses the admission ID into the runtime-validation ID is refused; they are separate authorities.
3. feat: negotiate qualification authority v2 — the connector advertises managed_qualification_authority_v2, replacing managed_delivery_authority_v1.
4. feat: add the v2 qualification authority contract — the closed cross-language v2 schema and verification:
   • qualification_admission_v2: evidence_runner_signer_sha256, deployment_manifest_sha256, one strict SemVer grammar, and an exact sorted runtime-component inventory binding only the artifacts a substrate uses (web: browser engine + wrapper; native: Capture + OS observer + wrapper; RDP/Citrix: Capture + remote transport + wrapper, with no UIA claim).
   • Signer registry with a durable monotonic checkpoint: provisioning-only initializer, required prior checkpoint (a runtime with no durable checkpoint halts), complete same-revision equality, monotonic generation time, fstat-based owner/permission recheck after open, and fail-closed on Windows where POSIX modes prove nothing about an ACL.
   • qualification_campaign_permit: signed non-production trial authority that cannot become production authority or report production success.
   • terminal_verification_v2: typed VERIFIED terminal receipt on report-v5, bound to the admission, permit chain, run and sequences. A delivery permit must be issued within 60 s of its signer-registry check. The acceptor re-derives the outcome, receipt and all five evidence manifests from the exact retained report bytes, so an internally consistent proof over foreign projections is refused.
   • Every signed integer is a JavaScript-safe StrictInt; every fixed boolean rejects its numeric spelling, so Python and TypeScript verifiers agree on the same canonical bytes.

Stacked on #369 (codex/push-json-contract).

Why

Target state: no production actuation without a signed qualification admission. Fail closed; never convert missing configuration into simulated success. A repair creates a new workflow version and needs a new admission.

Tests

• 349 focused tests pass: test_qualification_admission, test_qualification_admission_v2, test_terminal_verification_v2, test_run_receipt, test_execution_profiles, test_connector, test_runner_client_lib.
• Fast unit suite as CI runs it: 4931 passed, 36 skipped.
• ruff check / ruff format --check / mypy / strict safety-path mypy / scripts/check_consistency.py clean.
• python -m build plus wheel inspection: the wheel carries mechanism and interface only, no corpus, adversary params, or ROC tuning.

🤖 Generated with Claude Code