feat: advance the evidence-gated research core (R01/R02/R03/R04 batch)

.dockerignore

@@ -0,0 +1,7 @@
+node_modules
+.git
+evidence
+reports
+**/dist
+**/*.tsbuildinfo
+*.sqlite*

.env.example

@@ -7,7 +7,5 @@ ALD_DATABASE_PATH=./evidence/ald.sqlite
 ALD_LOG_LEVEL=info
 ALD_BASE_NETWORK=base-sepolia
 
-# Paths and endpoints are intentionally blank.
-ALD_KEY_DIR=
-ALD_BASE_RPC_URL=
-ALD_ANCHOR_KEY_FILE=
+# Secret values and secret file paths are injected only by `fort run` (with FORT_HOST set).
+# They are intentionally absent from this file.

.github/workflows/book-integrity.yml

@@ -1,47 +1,93 @@
-name: Research book integrity
+name: Consolidated integrity suite
 
 on:
   pull_request:
-    paths:
-      - RESEARCH.md
-      - research-book.html
-      - book/**
-      - scripts/build-research-book.mjs
-      - scripts/research-book-entry.js
-      - package.json
-      - package-lock.json
-      - vitest.config.ts
   push:
     branches:
       - main
-    paths:
-      - RESEARCH.md
-      - research-book.html
-      - book/**
-      - scripts/build-research-book.mjs
-      - scripts/research-book-entry.js
-      - package.json
-      - package-lock.json
-      - vitest.config.ts
 
 permissions:
   contents: read
 
 jobs:
-  verify-book:
+  consolidated-suite:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24.21.0
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 12.3.4
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v6
+
+      - name: Create independent-statistics venv
+        run: |
+          uv venv --python 3.13
+          uv pip install --python .venv/bin/python -r requirements.txt
+
+      - name: Audit dependency graph
+        run: |
+          mkdir -p artifacts
+          pnpm audit --audit-level=high --json > artifacts/pnpm-audit.json
+
+      - name: Run consolidated suite with timing
+        run: |
+          mkdir -p artifacts
+          /usr/bin/time -v pnpm run check:ci 2> artifacts/consolidated-runtime.txt
+
+      - name: Upload test and runtime evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: consolidated-suite-evidence
+          path: artifacts/
+          retention-days: 30
+
+  mode-r:
+    runs-on: ubuntu-latest
+    needs: consolidated-suite
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 22.13.0
-          cache: npm
+          node-version: 24.21.0
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 12.3.4
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
+
+      - name: Run real-container Mode R suite with timing
+        run: |
+          mkdir -p artifacts
+          /usr/bin/time -v pnpm run test:mode-r 2> artifacts/mode-r-runtime.txt
 
-      - name: Verify manuscript and book assets
-        run: npm test
+      - name: Upload Mode R runtime evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: mode-r-suite-evidence
+          path: artifacts/
+          retention-days: 30

.gitignore

@@ -1,6 +1,8 @@
 node_modules/
+.venv/
 dist/
 coverage/
+.artifacts/
 *.tsbuildinfo
 .env
 .env.*
@@ -9,3 +11,7 @@ coverage/
 *.sqlite
 *.sqlite-shm
 *.sqlite-wal
+/plans/
+**/tickets/
+/artifacts/
+.vitest/

CONFIGURATION.md

@@ -1,8 +1,9 @@
 # Configuration
 
 Runtime configuration is loaded through `@ald/config`. Environment variables contain
-only operational values and paths. Private key material and API tokens must never be
-stored directly in environment files committed to this repository.
+only non-secret operational values or short-lived file paths materialized by `fort`.
+Private key material, signer seeds, RPC credentials, and API tokens must never be
+stored directly in environment variables or repository files.
 
 ## Variables
 
@@ -13,32 +14,74 @@ stored directly in environment files committed to this repository.
 | `ALD_DEPLOYMENT_MODE` | `prototype` or `research-grade` | `prototype` | No |
 | `ALD_EVIDENCE_DIR` | Path | `./evidence` | No |
 | `ALD_DATABASE_PATH` | Path | `<evidence>/ald.sqlite` | No |
-| `ALD_KEY_DIR` | Path | `<evidence>/keys` | Yes in research-grade mode |
+| `ALD_RUN_SIGNER_SEEDS_JSON_FILE` | Fort-materialized path | None | Yes in research-grade mode |
 | `ALD_LOG_LEVEL` | `debug`, `info`, `warn`, or `error` | `info` | No |
+| `ALD_ANCHOR_CLASS` | `simulated` or `public-chain` | `simulated` | No |
 | `ALD_BASE_NETWORK` | `base-sepolia` or `base-mainnet` | `base-sepolia` | No |
-| `ALD_BASE_RPC_URL` | URL | None | Required only when anchoring is enabled |
-| `ALD_ANCHOR_KEY_FILE` | Path | None | Required only when anchoring is enabled |
+| `ALD_BASE_RPC_URL_FILE` | Fort-materialized path | None | Required only for an amended `public-chain` profile |
+| `ALD_ANCHOR_KEY_FILE` | Fort-materialized path | None | Required only for an amended `public-chain` profile |
+| `ALD_ALLOW_MAINNET_ANCHORING` | `true` or unset | unset | Must be `true` (together with an explicit publisher opt-in) before any Base mainnet transaction is submitted |
 
 ## Secret Handling
 
-- Store private keys in files outside the repository and provide only their paths.
+- Store all secret values only in the encrypted `safe` repository and access them
+  through `fort`; do not create ad-hoc secret files.
 - Do not commit `.env` files. The repository ignores `.env` and `.env.*`.
-- Use a dedicated, low-balance anchor wallet.
-- Run `npm run scan:secrets` before committing.
-- Research-grade mode fails fast unless `ALD_KEY_DIR` is explicitly configured.
+- The approved research `RunConfig` defaults to `anchorClass: "simulated"` and uses
+  no wallet, RPC credential, faucet, token, or fee.
+- If a future amendment permits `anchorClass: "public-chain"`, use a dedicated,
+  low-balance anchor wallet and independent verification endpoint.
+- Run `pnpm run scan:secrets` before committing.
+- Research-grade mode fails fast unless Fort materializes
+  `ALD_RUN_SIGNER_SEEDS_JSON_FILE` in files mode.
+- Mainnet anchoring is double opt-in: the anchor publisher must be constructed with `allowMainnet: true` and `ALD_ALLOW_MAINNET_ANCHORING=true` must be set. The current governance policy separately prohibits all public-chain research transactions.
+- The signer material is a versioned JSON envelope containing an exact run-id map
+  and all six Ed25519 signer domains. The Nursery reads its mode-0600 regular file
+  once; the path is then removed from the child environment. Learner containers
+  never receive the path or file mount. Seeds never enter the evidence store or a
+  bundle.
 
 ## Examples
 
 Prototype defaults require no environment variables:
 
 ```powershell
-npm run build
+pnpm run build
 ```
 
-Research-grade mode requires an explicit isolated key directory:
+Research-grade Mode R uses Fort file materialization:
 
-```powershell
-$env:ALD_DEPLOYMENT_MODE = 'research-grade'
-$env:ALD_KEY_DIR = 'C:\ald-secrets\keys'
-npm run build
+```sh
+fort --host https://fort.aureuma.ai run --repo agentic-language-development --env dev \
+  --keys ALD_RUN_SIGNER_SEEDS_JSON --mode files -- \
+  pnpm run test:mode-r-study
 ```
+
+The encrypted value must authorize each exact study run id. The qualification
+command can run without credentials using ephemeral in-memory signers, but that
+path is explicitly non-confirmatory. Simulated funding removes the wallet/RPC
+dependency; it does not remove the persistent per-run signer or registration gates.
+
+## Toolchain Law (permanent user order, 2026-10-04)
+
+- NEVER install anything via Homebrew on this machine (old installation, no
+  bottles; R was attempted and abandoned for this reason).
+- System packages go through MacPorts ONLY (`port`).
+- Python goes through uv ONLY (`~/.local/bin/uv`, already installed; do NOT
+  reinstall it via MacPorts). Project environments live in the repo `.venv`.
+- The independent-statistics sidecar is Python/scipy (port of the former R
+  scripts); R/Rscript must not be reintroduced to code, docs, or CI.
+
+## Independent-statistics venv setup
+
+The confirmatory gates spawn `scripts/*.py` through the repo-local `.venv`
+(resolved by `scripts/resolve-venv-python.mjs`; no PATH or absolute-path setup).
+Create it once per checkout:
+
+```sh
+uv venv --python 3.13
+uv pip install --python .venv/bin/python -r requirements.txt
+```
+
+`requirements.txt` pins the exact numpy/scipy versions the frozen receipts were
+generated with. CI provisions the same venv via `astral-sh/setup-uv`.