feat(provenance): content-addressed verdict cache + report attestation

[drewstone]

What

Track T6 of the 6-track program: judge-verdict caching (perf) + reproducibility attestation (provenance). Two new root modules, exports appended as one contiguous block at the end of src/index.ts (rebase-friendly).

src/verdict-cache.ts

• canonicalJson(value) — stable stringify (recursively sorted keys). Throws on undefined / function / symbol / NaN / ±Infinity / bigint / Map / Set: ambiguity is an error, not a coercion. Honors toJSON so Dates canonicalize to ISO strings instead of {}. Strict/sync counterpart to pre-registration.ts's permissive async canonicalize/hashJson (cross-referenced in the doc).
• contentHash(value) — hex sha-256 over the canonical JSON (node:crypto).
• VerdictCacheStore (sync-or-async get/set) with inMemoryVerdictCache() and fileVerdictCache(path) — JSONL append + in-memory index; a corrupt or wrong-shape line throws at load with file:line, never skip-and-continue.
• cachedJudge(judge, store, { judgeVersion }) — wraps any JudgeConfig generically (preserves TArtifact/TScenario + appliesTo; single JudgeScore import point so the spine PR's type dedupe rebases as a one-line change). Key = contentHash({ artifact: canonicalJson, scenarioId, judgeName, dimensions, judgeVersion }). judgeVersion is REQUIRED — silent judge upgrades must never serve stale verdicts. Hit path never invokes score(); stats() exposes { hits, misses }. Thrown judges are NOT cached (a cached failure would pin a transient outage forever).

LAW (stated verbatim in the module doc): cache JUDGE VERDICTS only — judging the same artifact with the same judge+rubric is pure. NEVER cache agent rollouts.

src/attestation.ts

• attest(report, provenance) → AttestedReport { reportHash, provenance, algorithm: 'sha256/canonical-json' } for ANY serializable report (campaign results, fuzz capsules, scorecards) — deliberately not coupled to any report schema. Provenance carries modelVersions, seeds?, priceTableHash?, codeSha, inputsHash?, caller-supplied createdAt (substrate stays clock-free).
• verifyAttestation(report, attested) → { valid, reason? } typed outcome: names the exact mismatch (unknown algorithm / hash mismatch / non-canonicalizable report).
• Layering doc: cryptographic SIGNING is the consumer's layer; content-addressing is the substrate's.

Tests

28 new deterministic tests (no LLM, no RNG): canonicalJson key-order stability + every ambiguity throw; cache hit/miss across artifact / judgeVersion / rubric-dimension / scenario changes; fake-judge call-count proves the hit path never invokes score(); file-store roundtrip across instances + corrupt-line and wrong-shape loud failures; attest→verify roundtrip + single-field tamper → { valid: false, reason }.

pnpm typecheck / pnpm test (209 files, 2010 passed) / pnpm build all green. No version bump (release sequenced by program lead).

[tangletools]

✅ Auto-approved PR — 9a68fe40

Blanket team auto-approval is enabled for this reviewer service.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-06-10T10:39:38Z}

[tangletools]

✅ Auto-approved PR — a0ea326e

Blanket team auto-approval is enabled for this reviewer service.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: blanket_auto_approve · 2026-06-10T10:55:07Z}