feat(supply-chain): candidate generator + combined promotion gate (v0.1)

[Davincc77]

Summary

Stacked on integration/supply-chain-cumulative (PR #121). Implements the next two planned supply-chain stages as real, tool-backed, NON-NORMATIVE, internal-only automation:

1. Candidate generator — scripts/generate_supply_chain_candidate.py

   • Input: config-only build_request JSON (inline sources and/or referenced source_manifest).
   • Output: candidate skill in the internal v4.2 target shape (all 13 layers: metadata, competency_architecture, memory_system, governance_system, memory_governance, runtime, context_graph, interactions, evidence, security, audit, skill_lifecycle, output_contract) → .internal-skills/supply-chain/candidates/ or --out.
   • 7 foundation + 12 transversal competency anchors; harmonized domain names; skill_lifecycle (not supply_chain); output_contract.graph_bindings; canonical interactions flow.
   • Deterministic: candidate_id/candidate_hash/run_id derived only from canonical input bytes. No clock in the hashed core.
   • Anti-mirage: missing domain info → requires_human_premium_pass with named gaps, never hallucinated. Sources come only from the build_request/source_manifest.

2. Combined promotion gate — scripts/run_supply_chain_promotion_gate.py

   • Orchestrates threat-model (always), source/license (--source-manifest), logical diff (--before), candidate shape checks, and forbidden-claim / public-private boundary tripwires.
   • Classifies ACCEPT / ACCEPT_WITH_REVIEW / BLOCK. Exit 0 acceptable, 1 BLOCK, 2 usage. deterministic_gate_id excludes the clock.
   • Reports whether a human premium pass is required — does not run it. not_run checks recorded with a reason, never as pass. No compliance/security/benchmark claim.

Example artefacts checked in: candidates/xklickd-research-reader.json, promotion-gate/xklickd-research-reader.gate.{json,md}. ACTION_LOG.md added; README integration index updated (stages moved planned → tool-backed with literal scope notes).

Claim boundaries (read literally)

• Emitting the v4.2 shape is NOT a supply-chain completeness claim; a generated candidate is NOT a loaded executable skill (still requires artifact_loaded AND sha256_matches_manifest).
• No universal standard, no automatic GDPR/EU AI Act compliance, no benchmark superiority.
• Public artefacts remain v4.1; v4.2 is internal target only. No release/tag/DOI/publish/deploy. No merge to main. Davincc77/klickd-ai untouched.

Testing

• pytest tests/test_supply_chain_candidate.py tests/test_supply_chain_promotion_gate.py → 39 passed
• Full supply-chain suite (feat(supply-chain): tool-backed audit-trail index + determinism record #116–feat: deterministic supply-chain threat-model generator (v0.1) #120 + new) → 102 passed
• pytest tests/ → 283 passed (1 unrelated jsonschema DeprecationWarning), 0 failures
• verify_xklickd_skill_packs.py verify, validate_v4_schemas.py, validate_v4_1_candidate_mapping.py → all rc 0
• Forbidden-claims / codename grep over committed artefacts → CLEAN; internal track name only inside internal_target
• Determinism: identical input → identical candidate_id/gate_id; gate_id stable across --eval-date
• Block paths verified: forbidden claim, codename leak, private→public leak, public-v4.2 over-claim, missing v4.2 layer, completeness claim

🤖 Generated with Claude Code