CS-02: expose IaC provenance SDK and CLI selectors

[maximelb]

Adds IaC attribution and recorded-origin selectors consistently to finding list/facets/causes/CSV and inventory list/facets/CSV. Explicit false is preserved, malformed values fail before HTTP, and all requests remain bound to the client organization. Missing origin evidence is not proof of no IaC.

Validation: focused SDK/CLI 405 passed; complete unit/microbenchmark correctness suite 4,439 passed, 6 skipped (35.74s). Pristine git-archive review checked selector validation, every callback/HTTP path, false/absent handling and tenant isolation; fixed the legacy docstring’s overly broad truncation claim. The repository is exempt from the review bot; this self-review does not substitute for any independent program security gate.

Requires compatible gateway refractionPOINT/lc_api-go#962 and graph refractionPOINT/legion_graph#228 before using the new selectors; no publishing/tagging or feature enablement. Core contracts PRs364–366 and host283 are merged. Documentation includes rollout/rollback and immutable-link/partial-evidence semantics.

Package: https://github.com/maximelb/claude-config/issues/137
Epic: https://github.com/maximelb/claude-config/issues/134

[maximelb]

Final receipt-delta adversarial self-review, per repository review exception: pristine git archive d5ca7bbbd5084910a3b5786b9e35255ac40f0835 extracted at /tmp/CS-02-receipt-review-57vbgms5. Inspected the snapshot's receipt parser and selector construction, then compared the change against the previously reviewed client slice. Checked strict false-versus-zero matching, missing/partial/extra receipt rejection, four-verdict bounds, bounded CSV receipt decoding, preservation of selector-free responses, and stripping the receipt only after validation. No unresolved findings. This is implementation review, not independent security approval or live evidence.

Latest Python 3.10–3.14 CI and Cloud Build 4714d82f-ff02-4e38-bd50-ddae951162ba passed; focused receipt suite: 413 passed.

New selectors fail closed against an older gateway/reader. Server contract rollout remains required; no package completion or feature activation is claimed.

[limacharlie-refractionpoint]

LimaCharlie Cloud Security — code scan

No new code findings were introduced by this pull request.

This check reports and never fails: no gating.fail_on is set on the code_scanning policy.

Scanned refractionPOINT/python-limacharlie 8c98e08…8c168dd — only findings new in the head commit are listed; anything already on the base branch is the repository's own finding set, on the Cloud Security Code page.

This comment is updated in place on every push to this pull request.

[maximelb]

Composition review at 8c168dd3c1df86557157d5c7830a2e49d5cbcd7a from pristine archive /tmp/CS-02-composed-client-review-2cgg264r: incoming master adds the already-landed build-provenance client; retained both doc sections and both test groups. Inspected final snapshot and merge delta: IaC selector validation/receipt paths are unchanged; provenance reads have no IaC selector and retain legacy response handling, and provenance POST bytes bypass the read helper as intended. No open review findings.

Full local validation: 4,456 passed, six pre-existing skips, 17 warnings. Skips are api/completion missing-docstring checks, optional orjson, and three non-Linux platform checks; no Code Security tests skipped. Python 3.10–3.14 matrix green; full cloud rerunning.

Still awaiting additive graph contract before merging this consumer. No deployment, package completion, or independent security approval implied.