test: rule registry the verifier consumes, and two independent vectors per rule

[imran-siddique]

Closes #124. Authored by @lywinged, from their branch lywinged/trace-spec:feat/124-registry-and-second-vectors. I rebased it onto current main (it was 33 commits behind) and dropped uv.lock; the commit is theirs and the authorship is intact. Opened as a maintainer because the branch had no PR.

What it does. Every action-receipt obligation was exercised by exactly one fixture, so deleting, renaming or weakening any single vector silently retired a rule and nothing failed. This gives each of the 14 obligations a second, independent vector and makes the margin enforceable.

The design follows @carloshvp's review on the issue. The AST walk for string literals is retired as the inventory source, because append, extend, constants and helper returns are silent blind spots. In its place the verifier consumes an explicit tuple of named Rule entries and emits every code from a single loop, so an unregistered check is a check that never runs. The AST survives inverted: it now asserts that nothing else in the module appends to a failure or warning list, so an emission path bypassing the registry fails the suite.

Independence is executable rather than asserted. The issue's definition is "one implementation defect makes one vector pass and the other fail", which only means something if the defects are named, so each rule declares at least one weakened variant of its check: digest-prefix comparison, case-normalised identifiers, clock tolerance, signature structure validated without cryptography. Two vectors count as independent only when a declared defect moves one and leaves the other alone, and a rule with no declared defect fails the suite.

tests/vector_margins.json is the ratchet: 14 rules, all at margin 2, so anything above the floor cannot decay back to it unnoticed.

Verified on current main after the rebase: 313 passed, 1 skipped, ruff clean on tests/ and examples/.

One limit @lywinged states themselves, worth keeping visible: independence is relative to the declared defect set, so a shortcut nobody thought to declare is still invisible. It is a floor on discrimination, not a proof of it. They also noted they would rather the vectors were not all authored by one hand, and that a second independently written set would be more valuable as a cross-run than either set alone. That remains open and is not a reason to hold this.

🤖 Generated with Claude Code

[lywinged]

Thank you for doing the rebase. That branch was 33 commits behind and I had left it without a PR on purpose, so this is work you took on that was mine.

Confirming the half only the author can: I diffed the rebased head against feat/124-registry-and-second-vectors, and tests/test_action_receipt_fixtures.py, tests/test_vector_completeness.py and tests/vector_margins.json are byte-identical. You established that it runs; this is the other half, that it moved without changing.

One thing worth stating before it becomes a question. The branch carries 14 registered rules here and 22 on the fork's main. The extra 8 are the GapDisclosure rules from #117, an unaccepted proposal, so they are deliberately outside this PR and their fixtures sit under a separate proposal-117/ directory with their own numbering. The 14 here stand on their own.

Your summary of the limit is accurate, including the part about a second independently written vector set. That one is still open.