fix: scope retained G2 evidence validity to the attested contract surface

[CompleteDotTech]

Summary

Implements OpenCoven#16: the retained G2 attestation stays bound to the contract surface it actually proves instead of the entire future repository tree, while unrelated repository-readiness, governance, and operational documentation may evolve.

The defect. The passed-evidence relationship verifier required the historic tested source commit to be the pull-request head's merge-base and the entire tested-source-to-head diff to contain exactly one modified file, docs/G2-EVIDENCE.md. That correctly protected the original evidence-only attestation PR, but applied forever it prevents every later non-evidence repository change: the G2 evidence relationships step fails on PR OpenCoven#15's onboarding/readiness-only diff (failing run) even though rust formatting, clippy, workspace tests, state-machine tests, reusable conformance, migrations, crash recovery, fault-injection clippy, evidence-checker unit tests, npm distribution, dependency audit, and secret scanning all pass on the tested jobs.

The design. scripts/g2-scope-manifest.json (versioned, schema_version: 1) is a fail-closed G2 attestation-scope manifest. Both relationship verifiers — local git and the GitHub Actions compare — classify every tested-to-terminal changed path through one shared logic:

• Protected patterns enumerate the G2-attested contract surface, derived from what the checker validates (crates/** including all golden and migration fixtures; docs/ARCHITECTURE.md, docs/SCHEMAS.md, docs/TESTING.md), what the reviewed workflow exercises (.github/workflows/ci.yml, packages/psyche-npm/**, Cargo.toml, Cargo.lock, rust-toolchain.toml, clippy.toml, deny.toml), and the trust root itself (scripts/check-g2-evidence.py, scripts/check-g2-evidence-test.py, scripts/g2-test-manifest.json, the scope manifest, and docs/G2-EVIDENCE.md).
• Unscoped paths are the explicitly classified operational/readiness surface: README.md, LICENSE, SECURITY.md, AGENTS.md, CONTRIBUTING.md, .gitignore, agent/**, docs/ROADMAP.md, docs/PROTOCOL-OWNERSHIP.md, docs/CLI.md, docs/CONFIGURATION.md, scripts/agent-bootstrap, scripts/agent-check. Every file of PR Establish Psyche roadmap and agent-readiness foundation OpenCoven/psyche#15 is covered, so it passes this gate without claiming its new files were covered by G2.
• Unmatched or new paths default to protected until explicitly classified.
• The checker enforces a REQUIRED_PROTECTED_PATHS floor independently of manifest edits, so the manifest itself cannot shrink the trust root.
• Renames, copies, deletes, typechanges, submodule changes, unsafe paths, and truncated (>=300-file) compare responses fail closed, even when the paths classify unscoped.
• Changing only docs/G2-EVIDENCE.md remains subject to the original exact evidence-only relationship rules.
• Diagnostics list the protected paths that invalidated the attestation without quoting protected contents.

G2 validation is not disabled or bypassed: every existing source hash, command hash, matrix row, workflow invariant, manifest relationship, CI attestation check, and evidence field is still enforced (57 pre-existing checker tests pass unchanged; two only had their expected error text updated to the new scope classification).

Attestation lifecycle. Because this repair touches protected trust-root paths, its own rule invalidates the retained attestation: docs/G2-EVIDENCE.md transitions from Status: passed (tested source f4f242f88f41dcb8286c867ea1601dac2c14a80a, CI attestation https://github.com/OpenCoven/psyche/actions/runs/31565714638 — preserved here and in git history) to the exact candidate placeholders until a new candidate/attestation replaces it. Nothing unrelated is blessed: candidate evidence records no tested source and no CI attestation. After merge, a new evidence-only PR records the next exact-head attestation under the scoped rules, and PR OpenCoven#15 rebases onto this gate.

Issue

Refs OpenCoven#16
Closes OpenCoven#16

Test plan

• python3 scripts/check-g2-evidence-test.py: 70/70 locally (57 pre-existing + 13 new focused tests), including:
  • reproduces the former freeze (an unrelated readiness file rejected by the original evidence-only rule) and proves an explicitly unscoped readiness/governance-only delta preserves the retained attestation;
  • mutations to psyche-core, store migrations, Coven bindings, test support/conformance, golden fixtures, CI, the toolchain/lockfile/dependency policy, the evidence checker, its tests, its manifest, and the scope policy all invalidate the attestation;
  • unknown/new paths default to protected until explicitly classified;
  • renames, deletes, copies, typechanges, submodule changes, unsafe paths, and truncated compare responses fail closed (both verifiers);
  • pull-request and local verification agree (one shared classification logic);
  • the original evidence-only attestation path remains valid and tested, and the evidence document cannot bless unrelated changes;
  • the scope manifest is fail-closed (JSON, schema version including booleans, exact keys, unsafe patterns, repeats, cross-set ambiguity, required protected floor).
• Offline validate_repository against the real tree: workflow hash and structure, scope manifest, candidate evidence, manifest/matrix relationship, and all source and documentation invariants.
• Full CI on the exact head: Rust matrix (Linux, macOS, Windows) including G2 evidence relationships, dependency audit, secret guard, and npm distribution.

Vehicle note: opened in the fork CompleteDotTech/psyche as the CI vehicle — this token cannot write to OpenCoven/psyche. Re-target upstream once write access is restored. Refs OpenCoven#16.

[CompleteDotTech]

CI status: no checks can report yet — the fork's Actions workflows are not initialized (documented per the no-fake-green rule).

• CompleteDotTech/psyche is a fresh fork (created 2026-08-30T14:09:35Z). GET /actions/workflows returns total_count: 0, GET /actions/runs has never returned a run, and GET /commits/<head>/check-runs is 0 for both 7bcedd7 and 00430d2 after the standard 10-minute wait windows. Actions permissions report enabled: true, so the missing piece is the one-time "enable workflows" consent in the Actions tab of the fork — until a repository owner performs it, the pull_request event cannot start the CI workflow here.
• This repo's CI workflow itself is unchanged and hash-pinned (.github/workflows/ci.yml); once Actions is enabled on the fork, re-running the PR will execute the full exact-head matrix (Linux/macOS/Windows Rust checks incl. G2 evidence relationships, dependency audit, secret guard, npm distribution).
• An empty signed commit (00430d2) was pushed to re-fire the pull_request event as a legitimate registration attempt; it did not initialize workflows.
• Draft-state anomaly, documented for the record: this PR was opened with --draft at 16:01:41Z and was flipped to ready_for_review at 16:03:23Z by something other than this agent (no gh pr ready was ever called here). The REST update a pull request endpoint ignores draft, and re-drafting via GraphQL is outside this session's sanctioned API discipline, so the PR cannot be returned to draft from here. It must not be merged until exact-head CI is green on all three operating systems.

Local verification that did run: python3 scripts/check-g2-evidence-test.py → 70/70 (57 pre-existing + 13 new focused tests), plus an offline validate_repository pass over the real tree (workflow hash + structure, scope manifest, candidate evidence, manifest/matrix relationship, source and documentation invariants).