[SGS-005] Add production/oracle/hard-authority projections with invariance tests

[Tyler-R-Kendrick]

Summary

Implements SGS-005 / SLM-443: make authority transitions explicit when semantic requirements/plans are consumed by production, oracle-diagnostic, evaluator-only, or compiler-certified paths — reusing SemanticPlanV1.to_production_dict, EvidenceKind, and OpenUISemanticPlanCompiler.certified_restrictions instead of introducing a second restriction system (per the SGS-001 ownership map's new_owner_justified: false verdict for this issue).

• PromptSemanticRequirementsV1.to_production_dict (new — SemanticPlanV1 already had one, prompt_requirements.py had no analog): drops oracle_override facts from a production manifest, recording each as a dropped_facts entry with a downgrade_reason instead of silently losing it; drops any ambiguity group left with a dangling member reference (a group can't survive with one member removed); never rewrites a kept fact's authority.
• compiler.py: AuthorityProjectionV1 / project_authority — a pure re-labeling of an already-decided RestrictionResult's evidence into the ownership map's authority-tier vocabulary (compiler-hard/oracle-diagnostic/advisory-learned/evaluation-only):
  • COMPILER_AUTHORED_CERTIFIED evidence that produced no certified hard removal (missing/rejected certificate) never earns compiler-hard.
  • A certified hard removal whose depends_on cites oracle or unresolved evidence is tainted and downgraded — nested provenance smuggling can't launder an oracle fact into compiler-hard authority.
  • Any hard removal from non-certified evidence (only reachable through allow_unsafe_predicted_hard_control) is forced to evaluation-only — visibly non-promotable regardless of its declared kind.
  • ORACLE_GOLD evidence is excluded from a production-mode manifest.
  • Never recomputes hard/soft removal decisions — the exact candidate domain is unaffected by projecting it.
• Registers data.progspec.semantic_contracts (semantic_plan.py/prompt_requirements.py were untracked by the version-stamp registry — a real gap this closes) and bumps harness.experiments.slm146_plan_compiler (already owns compiler.py).

Acceptance criteria (from the issue)

• Oracle/gold evidence is rejected from production-hard paths.
• Predicted/retrieved evidence can rank/seed/revise but cannot hard-prune without independent compiler certification (pre-existing certified_restrictions invariant; the projection never contradicts it).
• Projection is deterministic/idempotent — P(P(x)) == P(x) tested on both contracts.
• No projection changes the exact candidate domain by itself — tested by asserting RestrictionResult is byte-identical before/after projecting.
• Unsafe diagnostic controls remain visibly non-promotable — tested explicitly for the allow_unsafe_predicted_hard_control escape hatch.

Test plan

• tests/test_data/test_progspec/test_prompt_requirements.py (+10 tests): oracle-fact dropping, authority never rewritten, ambiguity-group smuggling, round trip, idempotence.
• tests/test_data/test_semantic_plan_extraction/test_compiler.py (+12 tests): tier assignment, uncertified-claim downgrade, unsafe-control downgrade, oracle exclusion/inclusion by mode, tainted-dependency smuggling, domain-parity, bucket disjointness, idempotence, round trip, plan integration.
• tests/test_data/test_progspec/test_semantic_plan.py (+3 tests): non-oracle production path, idempotence, no-reintroduction-of-stripped-fields.
• Full tests/test_data/test_progspec/, tests/test_data/test_semantic_plan_extraction/, and related consumer suites (385 tests) pass.
• python -m scripts.verify_version_stamps --check
• python -m scripts.verify_ownership_map
• python -m scripts.refresh_test_cases --check --changed (no test-case resources touched)
• ruff check on all changed files

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
slm-training	Ready	Preview	Aug 8, 2026 5:18am

[coderabbitai]

Warning

Review limit reached

@Tyler-R-Kendrick, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 27 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0cb5d215-01d5-48b7-83cd-c2f80e120c1b

📥 Commits

Reviewing files that changed from the base of the PR and between f67ab4a and b089309.

📒 Files selected for processing (7)

• src/slm_training/data/progspec/prompt_requirements.py
• src/slm_training/data/semantic_plan/__init__.py
• src/slm_training/data/semantic_plan/compiler.py
• src/slm_training/resources/versions.json
• tests/test_data/test_progspec/test_prompt_requirements.py
• tests/test_data/test_progspec/test_semantic_plan.py
• tests/test_data/test_semantic_plan_extraction/test_compiler.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}