Close the v0.6.3 reward-verifier, trust-boundary, sidecar and streaming gaps - #46

Final correctness and trust-boundary pass before v0.6.3 is tagged. Every
defect below was reproduced against b769251 first; the reproducers are kept as
regressions.

The static reward verifier accepted definition-time code

PR #45 stopped bridge doctor importing an untrusted reward scaffold, but the
static policy only audited decorators and default arguments. Everything else
that runs when a module is imported passed with status: ok, findings: [] and
the strongest level:

def exploit():
    Path("PWNED.txt").write_text("executed")
    return object

class Hidden(exploit()):          # accepted, no finding
    pass

Class bases, metaclass= and other class keywords, parameter and return
annotations, annotated-assignment annotations and Python 3.12 type-parameter
bounds are now audited. Only expressions that actually evaluate — calls,
lambdas, comprehensions, await, walrus — are rejected, so ordinary
annotations such as -> float and bases such as (object) still pass.

Keyword-only parameters were never inspected either, so this passed as a
verified interface despite raising TypeError on verl's three-argument call:

def compute_score(data_source, solution_str, ground_truth, *, extra_info): ...

The strongest default level is renamed interface_statically_verified →
interface_shape_verified: the old name read as a safety claim the check
cannot make. Imports are listed with import_runtime_safety: not_verified,
relative bundle-local imports are refused, and source bytes, AST nodes, AST
depth and finding count are bounded so a hostile file yields a bounded
diagnostic. 20 new regressions; none of them ever creates the marker file.

A bundle's claims were reported as results

The doctor read upstream_config_parse_passed, distributed_execution_tested
and algorithm_semantic_parity out of the bundle's own
compatibility-report.json and exposed them as top-level fields.
provenance/SHA256SUMS ships inside the bundle it describes, so anyone who
edits a claim can reseal it — the test builds exactly that bundle.

Output is now split into bundle_declared_claims (testimony,
trust: unsigned_self_consistent), locally_recomputed_checks (this process,
against bytes on disk) and provenance_trust
(signature_verification: not_available). Top-level flags reflect only what was
recomputed. --require-verl now performs the upstream OmegaConf parse and
structured merge locally instead of comparing an installed commit id.

Portable metadata privacy ran one regex

A manifest holding an API key, a bearer token and a database URL with inline
credentials passed, because the only detector was an absolute-path pattern.
Structured JSON/YAML is now walked so a finding names a JSON path
($.nested.credentials.api_key), unstructured text reports a line number, and
the scan is bounded by file size, total bytes and finding count. Matched text is
still never returned. Status is heuristic_passed/heuristic_failed — it is a
detector, not de-identification proof.

Malformed sidecars were read as empty

{}, {"rows": []}, a wrong namespace and schema_version: 999 were all
accepted as "this dataset has no extensions", silently discarding the provenance
the sidecar exists to carry. Schema version, exact namespace, a rows mapping,
canonical integer keys within the source row count, JSON-compatible values,
unknown top-level fields and optional source_sha256/source_rows binding are
now validated. Sidecars published by 0.6.0–0.6.2 still read. Diagnostics name
the location, never the payload.

Conversion materialized the whole dataset

convert-dataset called pq.read_table(source).to_pylist(). It now streams
record batches through a ParquetWriter, with the output schema derived once
from the source schema so an optional nested field appearing only in a later
row group cannot produce a second incompatible schema. Publication still happens
only at commit, so strict conversion stays complete-or-nothing, and a rejected
row stops the run before the next row group is read — both proven by
instrumented tests that fail if read_table is called or if a later batch is
fetched.

Text integrity

docs/release-checklist.md shipped — not applicable and CHANGELOG.md
shipped base → SFT as GBK-mangled sequences; three files carried a BOM. The
result is valid UTF-8, so nothing ever raised. All repaired, and
scripts/check_text_integrity.py now gates CI on the mis-decoding leaders,
U+FFFD and unexpected BOMs. Its allowlist is exactly two files: the detector and
its own tests, which must spell the sequences out.

Validation

No frozen scientific result, task JSONL or published adapter is touched. No new
benchmark, algorithm, distributed claim or OPD/PPO parity claim is added. Issue
#39 remains out of scope.