feat: a lab, a blind benchmark with an auditable trail, and the gate that runs it

[darklordVirtual]

Stacked on #8 — the base retargets to main when that merges.

What this is

Four things, and the fourth is why the first three matter.

Supply chain. Base images digest-pinned; Python dependencies exact in docker/requirements.lock. The databases sit on an internal: true network — measured rather than assumed. control-plane-db has no default route; the three containers that publish a port do have egress, and docs/security-model.md now says so per container instead of claiming blanket isolation.

Console. The ledger reads the signed audit chain directly on a SELECT-only credential. It previously showed a health banner and four work orders while 165 assessments, 10 binding refusals and 9 voided approvals sat unread one network away. Assurance moved from a page into an always-visible strip, because it qualifies everything else.

Lab. A separate service, image and port that holds every role token and can act. Separate because the console reports console_access: read-only about itself, and a process that can approve its own proposals cannot credibly say that.

Benchmark. Blind scoring against a sealed key, with an audit trail that can be checked against the chain.

Three bugs the work found

The drawer was permanently open	[hidden] and .drawer have equal specificity; source order won. It ate a third of the viewport, empty.
Every inline style was silently dropped	style-src 'self' keeps the attribute in the DOM and never applies it. No console error. The decision-mix bar had correct percentages in the markup and rendered 40px wide. Fixed via CSSOM; the CSP was not weakened.
Three colour tokens below AA	The light palette had never been rendered. paper-faint measured 3.4:1 in light and 3.5:1 in dark, used for 10px labels. The chain spine was 1.7:1 while carrying information.

Two upstream findings, both from writing answers first

• A read authority does not bind to the record it names. Holding WO-1201 and reading WO-1202, WO-1203 or WO-1150 all return accept/grounded_read_accept with the same intent_authority_hash.
• Value constraints in a signed schema are not enforced. required, additionalProperties and type are; enum and pattern are recorded and ignored.

The second was found blind: the key predicted a refusal, the engine assessed it, and probing every clause afterwards gave the structural/value split. Both are in docs/limitations.md and kept as known gaps, so the day either closes the run says so loudly.

The gate

run.py verify and CI now run the benchmark and verify its report against the audit chain. Those steps were absent: every other check proves the product runs, none proved it decides correctly. Verified by injecting a regression — exit 3.

Verification

• 342 tests (121 contract + 221 e2e)
• 6/6 scenarios, stable across six cold starts
• 18/22 on the sealed key, 0 regressions, 4 known gaps
• audit trail: 25 entries confirmed against the chain; a forged hash is detected

Not verified

Narrow-viewport rendering. resize_window had no effect in this environment, so the media queries and .scroll-x wrapping are covered by tests but never seen. Light mode is now measured for contrast but likewise never rendered.

One 5/6 scenario run earlier today, never reproduced across six subsequent cold starts and never captured.