fix: bind gate consumers to artifact path authority

[Stahl-G]

Merge Unit

Blocking predecessor for #484. This PR contains only the shared artifact path authority and gate-impacting consumers. #484 remains frozen until this merges.

Opening Contract

Invariant:
  The artifact contract loader produces one canonical artifact_id -> Path context.
  Registry, completion, and gate-impacting CSM/atomic consumers consume that
  context without re-resolving default or sibling paths.

Producer:
  configs/artifact_contracts.yaml
  contracts_loader.py
  artifact_paths.py

Consumers:
  artifact_registry.py
    - registry artifact identity
    - screened candidate universe binding
    - CSM/atomic gate-impacting cross-artifact validation
  completion_gates.py
  claim_support_matrix.py
  atomic_reader_projection.py
  quality_gates/state.py

New authority/schema/status:
  none

Forbidden surfaces:
  intake evaluator/projection; freeze v2; stale eligibility; status;
  support wording; Quality Panel; handoff/Hermes/switchboard;
  repair/archive/provenance; delivery/finalize; generated agents.

Semantic checked-input/custom-path lifecycle is explicitly outside this PR. This PR only fail-closes missing semantic dependency path bindings already handled by the shared validator.

State x Path Matrix

ID	State	Outcome
PATH-AUTH-01	artifact targets runtime manifest/workflow/registry/event log, including case aliases	fail before state writes
PATH-AUTH-02	two artifact IDs normalize or casefold to one canonical path	fail before state writes
PATH-AUTH-03	workspace symlink changes logical path identity	fail before state writes
PATH-AUTH-04	artifact ID is missing/blank/duplicate, or path is not a non-empty string	fail before state writes
PATH-AUTH-05	blocking CSM and dependencies use separate custom paths	blocking finding emitted; wrong defaults ignored
PATH-AUTH-06	weak CSM and dependencies use separate custom paths	warning finding emitted; wrong defaults ignored
PATH-AUTH-07	explicit CSM path context is incomplete	invalid projection; no default fallback
PATH-AUTH-08	atomic graph and Ledger use custom paths	reader projection consumes both; poisoned defaults ignored
PATH-AUTH-09	explicit atomic context lacks Ledger binding	invalid projection; no default fallback
PATH-AUTH-10	strict Screener uses candidate and screened artifacts in separate custom directories with poisoned sibling bytes	completion consumes the contract candidate universe and succeeds
PATH-AUTH-11	strict Screener references an ID present only in poisoned sibling bytes	completion fails; workflow, registry, and event log are unchanged
PATH-AUTH-12	explicit registry validation context lacks CSM/evidence/semantic dependency binding	typed invalid result; no sibling fallback
PATH-AUTH-13	auditor brief and Claim Ledger use separate custom contract paths while default files contain poison bytes	gate report records custom identities and auditor completion accepts the same binding

Scope

Final head: 5e0955ac.

Complete PR diff: 10 files, +1121/-49.

Production modules: 7.

• artifact_paths.py
• contracts_loader.py
• artifact_registry.py
• completion_gates.py
• claim_support_matrix.py
• atomic_reader_projection.py
• quality_gates/state.py

Tests: 3.

• test_runtime_state.py
• test_quality_gates_commands.py
• test_atomic_reader_projection.py

No #484 intake code is imported or required. _validate_artifact has exactly two production callers; both must pass the complete path context.

Validation

• allowed focused suites: 431 passed
• full repository suite: 2872 passed
• generated assets, version, release, capabilities, product baseline, public safety, Ruff, and git diff --check: passed
• README.md and README_en.md inspected and unchanged

Dependency

After this predecessor merges, #484 must rebase onto new main and remove its duplicate path-authority implementation before review resumes. MU-4 remains blocked.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5e0955acfa

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use the same ledger binding for finalize completion

When stage_id='finalize' and the artifact contract customizes claim_ledger, this now records the generated gate report's metadata.ledger from the contract-resolved path, but _finalize_quality_gate_pass_reasons still requires output/intermediate/claim_ledger.json. In that custom-path workspace, a finalize quality report produced by this function will be rejected by complete_stage_transaction(..., stage_id='finalize') for mismatched ledger metadata, so the finalize stage cannot complete after a successful gate run.

Useful? React with 👍 / 👎.