Conform modular participant-control realizations

[Brad-Edwards]

Parent: #1068

Bounded outcome

Publish bounded conformance and assurance for modular participant-control
realizations without requiring backends to select identical mechanisms or
promoting declarations and finite probes into universal claims.

Required evidence

• Portable profile, provider, composition, trigger, effect, history, and
  evidence fixtures.
• Target probes that exercise real provider resolution through the RAES runtime
  and final participant/world crossing.
• Honest, unsupported, weakened, conflicting, stale, failing, and overclaiming
  backend cases.
• Permissive IFC, strict IFC, IFC-triggered injection, transformation, and
  composition with at least one non-IFC mechanism.
• An in-world adversarial-input case that remains distinct from an invalid
  out-of-world realization.
• Exact mechanism/profile/implementation/configuration/evidence bindings and
  explicit limitations/nonclaims.

Acceptance criteria

• Independent downstream packages can run the released conformance surface.
• A backend passes only the exact profiles, mechanisms, effects, and guarantee
  strengths it implements and evidences.
• LilRAE and Shifter may pass different profile/mechanism sets without one being
  treated as the reference truth or as semantically divergent.
• Capability declarations, contract validity, runtime orchestration, backend
  realization, bounded conformance, experimental evaluation, and universal
  properties remain separate statuses.
• Negative probes establish zero prohibited effect where denial is claimed.
• No fixture requires access to backend-private prompts, credentials, native
  state, or external-apparatus details.

Non-goals

• Universal noninterference, controllability, robustness, equivalence, or
  mechanism quality claims.
• Reimplementing a downstream provider inside the RAES conformance package.

Dependencies

• Blocked by Design modular participant control with extensible dynamic IFC and governed control effects #1068, Define extensible dynamic-IFC profiles and participant-control mechanism composition #1070, Publish participant-control provider and profile contracts #1072, and Orchestrate participant-control mechanisms and triggered effects at runtime #1069.

Requirements

• ASR-538
• ASR-535
• SEM-235
• API-424
• RUN-320

These are OpenRAE/rae portable authorities. New SEM-235, API-424, RUN-320 and ASR-538 records and the ASR-536 amendment took authority through #1068 at merged revision ebb70a34b8e7d1cc8964c443841ae57e12ed1014; DRAFT does not mean implemented.

Architecture binding from #1068

Implement or consume ADR-108 and participant-control-composition/rev1 (PC-01–PC-15). Worked cases, requirement disposition, and the delivery graph supply the acceptance and dependency detail.

The linked design is accepted at merged revision ebb70a34b8e7d1cc8964c443841ae57e12ed1014. Dependent implementation must pin this accepted authority and the required released artifacts; listing a UID does not remove an implementation dependency.

Required predecessors within this program: OpenRAE/rae#1068, OpenRAE/rae#1070, OpenRAE/rae#1072, OpenRAE/rae#1069.

Delivery PR: OpenRAE/rae#1234, merged into dev as ebb70a34b8e7d1cc8964c443841ae57e12ed1014.