feat(contracts): loop.yaml run contract — compile, fail closed, gate only tightens

[wjlgatech]

What

Run inputs (target, goal, lane, ten budget knobs) existed only as CLI flags: un-diffable, unreviewable, and impossible to attach to the proof pack the run produced. This adds src/loopeng/contracts/ plus run --contract, contract check, and contract evidence.

loop-anything contract check docs/examples/loop.yaml
loop-anything run --contract docs/examples/loop.yaml
loop-anything contract evidence docs/examples/loop.yaml --run 12

Three rules that keep it from becoming decoration

1. It compiles, it doesn't extend. Every key becomes a config.Budget / Lane the loop already reads — no new controller state, no knob the engine ignores. One code path, two doors.
2. An unenforced declaration is a parse error, not a no-op. A typo'd max_iteratons:, a safety: block nothing consumes, or maker-authored evaluation.dimensions (maker ≠ checker laundering) all fail the parse, and the message names what is accepted.
3. The gate is monotonic. gate.require_human_confirm: false is rejected — a caller-authored file must never hand back the bypass VerificationGate deliberately withholds.

evidence.required names real ProofPack fields and is verified against the recorded run (exit 1 on a gap). Conflicting flags alongside --contract fail closed rather than silently taking precedence.

Origin

This is items 1 and 7 of an external architecture review that scored the repo 8.6/10. docs/solutions/external-eval-2026-08-12.md adjudicates all twelve proposals against the code rather than the README: 6 real gaps, 5 partial, and 1 rejected as a regression (artifact_type as a closed Literal would re-centralize what the open Domain registry decentralized). It also records the meta-finding — every claim the review made about the code cited the README — and a counter-scorecard that scores human-gate and generality higher than the review, and safety, observability and enterprise readiness lower.

The best idea in the review (a false-green rate benchmark) is named as the top remaining P0.

Evidence

• 57 new tests in tests/test_run_contract.py; suite 543 → 600 passing, 2 skipped.
• ruff check clean against the design-fitness budget (C901 / PLR0915).
• The shipped example docs/examples/loop.yaml is pinned by a test, so it cannot rot.
• README, CHANGELOG, and skills/loop-anything/SKILL.md updated in the same change.

🤖 Generated with Claude Code