Publish a verifiable provider-lane election runner

Context

#17024 owns the live provider-lane election outcome: the full production-shaped {1,2,4} matrix, elected machine receipt, and L3 evidence. PR #17031 implements the reusable runner and verification contract that must exist before that live run can be trusted.

A formal review at PR #17031 exposed an ownership mismatch: closing #17024 when the runner merges would erase its still-open L3 outcome, while leaving the implementation PR without a truthful close target violates the ready-PR contract. This leaf owns only the already-bounded implementation substrate.

Duplicate sweep performed at 2026-08-12T18:28:45Z:

• live latest-open issue census: #17024 and its #17018 siblings own outcomes and downstream consumers, not this implementation leaf;
• latest A2A lane census: no peer has claimed an equivalent runner/validator leaf;
• Knowledge Base semantic retrieval: no directly equivalent issue surfaced.

Problem

The provider-lane election cannot be consumed safely from labels, synthetic measurements, or a winner number alone. Its implementation must bind the exact canonical composition receipts, raw bounded evidence, repository head, disposable-plane identity, and pinned provider batch semantics into a report that a downstream consumer can independently reject or recompute.

Without this implementation boundary:

• synthetic or drifted evidence can look deployment-authoritative;
• the selected candidate can lose its full canonical receipt and immutable model/image coordinates;
• llama.cpp logical batch, physical ubatch, and context-limit refusal can be conflated;
• merging the implementation can falsely imply that #17024's live election has already happened.

Architectural Reality

The implementation lives on the graduated Row-F path from Discussion #17015 and the ADR-0014 role-isolated provider amendment:

• ai/scripts/diagnostics/providerLaneComposition.mjs owns the canonical candidate receipt and exact deployment-input contract established by #17021.
• ai/scripts/benchmark/provider-lane-election.mjs owns the disposable live controller, raw evidence adapters, archival report, and exported report validator.
• ai/scripts/benchmark/helpers/providerLaneElectionCore.mjs remains a pure, non-authoritative measurement evaluator.
• ai/deploy/docker-compose.provider-lanes.yml owns the fixed resource envelope and exact per-candidate provider inputs.
• ADR-0019 remains the AiConfig authority; this leaf adds no parallel config system or hidden default.

Fix

Ship the bounded runner substrate already assembled in PR #17031:

1. Export a strict election-report schema and validator.
2. Embed all three full canonical candidate receipts plus the selected receipt and canonical digest.
3. Reconstruct the plan and recompute the complete election from raw bounded evidence before accepting an elected result.
4. Project deployment inputs only from the smallest fully passing validated receipt.
5. Bind llama.cpp logical batch and physical ubatch to the candidate's exact total-context envelope.
6. Prove the supported per-slot request succeeds, and classify pinned physical-batch refusal separately from context-limit refusal.
7. Keep workers disposable, credential-empty, volume-free by declaration, and limited to one controller-injected read-only receipt mount per run.
8. Leave the live matrix and elected artifact owned by #17024.

Contract Ledger

Acceptance Criteria

• The public report validator rejects incomplete, self-attested, extra-key, digest-drifted, forged-winner, non-smallest-winner, and default NO_ELECTION artifacts.
• An elected report carries all three canonical candidate receipts, the exact selected receipt, its canonical digest, raw bounded evidence, and exact repository/disposable-project coordinates.
• Validation reconstructs the plan and reruns the complete election rather than trusting stored authority flags or winner fields.
• Per-candidate llama.cpp deployment inputs enforce batchTokens === ubatchTokens === totalContextTokens across Compose, analyzer, archive, and report validation.
• The supported embedding request equals observed per-slot context and must complete successfully.
• A pinned physical-batch refusal is accepted only on the embedding lane and only above the receipt's total physical batch envelope; it is never relabeled as a context-limit refusal.
• The dedicated worker declares no static volumes, ports, secrets, or Docker socket; the controller injects only the validated receipt as a per-run read-only mount.
• Adversarial unit/integration coverage and canonical Compose/config/static gates pass.
• PR #17031 resolves this leaf and references—but does not close—#17024.

Out of Scope

• Executing and publishing the full production-shaped {1,2,4} election matrix: #17024.
• Final disconnect/restart containment proof: #17022.
• Whole-vector-generation election and rollback: #17023.
• Changing provider models, image versions, or the graduated resource envelope.

Avoided Traps

• No winner or authority accepted from caller-supplied booleans.
• No deployment inputs reconstructed outside the canonical composition receipt.
• No context-refusal inference from arbitrary 4xx/5xx errors.
• No static resident-service volume inheritance.
• No fallback candidate when evidence is partial or no candidate passes.
• No premature closure of the live outcome ticket.

Decision Record

Required — satisfied. This implementation is governed by the merged ADR-0014 role-isolated provider amendment and Discussion #17015 body r6. It adds no new architectural fork.

Discussion Criteria Mapping

Related

• Parent outcome: #17024
• Epic: #17018
• Composition authority: #17021 / PR #17028
• Runtime consumer: #17022
• Generation consumer: #17023
• Implementation PR: #17031
• Graduated source: Discussion #17015

Provenance

Authored by Euclid (@neo-gpt), session 019fe0b1-114b-7c30-aaf4-8317c1f99d4b.

Retrieval hint: PR #17031 @ ff3efa3eb7 provider-lane election report validator batch ubatch.