Bootstrap hotpath from engineering spec v0.1

Commit the spec and scaffold the system it describes:

- SPEC.md: the full v0.1 engineering spec
- crates/: trust-layer Rust workspace, unit-tested
  - bench-runner: interleaved ABAB scheduling with discarded warm-ups,
    deterministic bootstrap CIs over the ratio of medians,
    CI-lower-bound accept rule, env fingerprinting, and a CLI with
    compare + A/A self-test modes (A/A verified passing end-to-end)
  - diff-test: gate outcome model, sha256 corpus pin verifier that
    refuses on mismatch, per-target equivalence policy parser
    (byte-identical default, explicit fp-tolerance opt-in)
  - ledger: append-only SQLite attempt schema with UPDATE/DELETE
    refused by triggers, anti-double-attempt query
  - report: cores-saved and dollars/yr ROI math over speedup CIs,
    pricing.toml inputs
- playbook/: classes 1-7 with preconditions, procedure, verification
  notes, and known failure modes per class
- agent/: Python package skeleton — six-tool contract and prompting
  spine, harness IPC deferred to Phase 1
- config/: accept.toml (2% threshold, 30 runs/side), pricing.toml
- targets/, corpora/, results/calibration/: layout and policy docs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EcKPWQ3MQD4NdEHwar96u2

crates/diff-test/src/lib.rs

@@ -0,0 +1,67 @@
+//! Equivalence gates (SPEC §3.2) and corpus hash-pinning.
+//!
+//! The gate *sequencing* (upstream tests → golden replay → differential
+//! fuzz → sanitizers) is orchestrated per-target; this crate owns the
+//! pieces that must be trustworthy regardless of target: the pin
+//! verifier that refuses to run on a tampered corpus, and the
+//! per-target equivalence policy parser (byte-identical unless a target
+//! declares an explicit FP tolerance).
+
+pub mod pin;
+pub mod policy;
+
+use serde::{Deserialize, Serialize};
+
+/// Outcome of one gate layer. `Skipped` is only legal where the SPEC
+/// allows it (e.g. TSan when no concurrency primitives changed) and the
+/// reason is always recorded.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub enum GateOutcome {
+    Passed,
+    Failed { detail: String },
+    Skipped { reason: String },
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum GateLayer {
+    UpstreamTests,
+    GoldenReplay,
+    DifferentialFuzz,
+    Sanitizers,
+}
+
+/// All layers must pass; any failure is an auto-reject (SPEC §8).
+pub fn all_passed(results: &[(GateLayer, GateOutcome)]) -> bool {
+    results.iter().all(|(_, o)| {
+        matches!(o, GateOutcome::Passed | GateOutcome::Skipped { .. })
+    }) && results
+        .iter()
+        .any(|(_, o)| matches!(o, GateOutcome::Passed))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn any_failure_rejects() {
+        let results = vec![
+            (GateLayer::UpstreamTests, GateOutcome::Passed),
+            (
+                GateLayer::GoldenReplay,
+                GateOutcome::Failed { detail: "stdout diverged".into() },
+            ),
+        ];
+        assert!(!all_passed(&results));
+    }
+
+    #[test]
+    fn all_skipped_is_not_a_pass() {
+        let results = vec![(
+            GateLayer::Sanitizers,
+            GateOutcome::Skipped { reason: "n/a".into() },
+        )];
+        assert!(!all_passed(&results));
+    }
+}