feat: add admission-only end-to-end Developer OS rehearsal v4

[Mopati123]

Purpose

Add the first composed end-to-end Developer OS rehearsal from repository intelligence through HPL scheduler admission, while explicitly preventing runtime execution.

Rehearsal path

target repository
  -> repository graph
  -> change impact
  -> Developer OS plan
  -> bounded repo.read binding
  -> pinned kernel harness
  -> HPL admission
  -> ExecutionPlan + ExecutionToken
  -> STOP

v4 hardening

The kernel harness now:

• prepends the pinned kernel src/ directory to PYTHONPATH;
• prefers <kernel>/.venv/bin/python when present;
• preserves the operator environment without injecting credentials;
• retains exact certified-kernel HEAD pinning.

Authority boundary

The rehearsal always invokes the kernel with execute=False.

It refuses if a runtime result appears. The expected proof is scheduler admission plus token issuance only.

Evidence

The rehearsal emits deterministic hashes for:

• repository graph;
• change impact;
• Developer OS plan;
• HPL binding;
• kernel harness receipt;
• rehearsal receipt.

Truth boundary

CI mocks the kernel subprocess boundary. Passing CI proves the composed contract, not a real local cross-repository admission. The next operational proof should run this command against the user's exact certified local kernel checkout, still in admission-only mode.

Review order

This PR is stacked on certified Developer OS v3 and remains draft until CI passes.

Certified Phase N v4 contract baseline

At head 94584263636a49163e94469eefe3c75a0f731508, the dedicated Repository Intelligence CI completed successfully.

Certified v4 additions:

• admission-only end-to-end rehearsal composition;
• repository graph -> impact -> Developer OS plan -> HPL binding -> pinned kernel harness;
• exact certified kernel HEAD requirement;
• kernel src/ injection into PYTHONPATH;
• preference for <kernel>/.venv/bin/python when available;
• explicit execute=false rehearsal semantics;
• refusal if runtime execution appears unexpectedly;
• deterministic rehearsal receipt spanning graph, impact, plan, binding, harness, kernel head, token presence, and runtime-executed status.

Truth boundary: CI certifies the composed contract with the kernel subprocess mocked. It does not yet prove a real local cross-repository HPL admission. The next proof is an admission-only rehearsal against the user's exact local certified kernel checkout, with no OpenHands network effect and no repository mutation.

This commit is the certified Phase N v4 contract baseline. PR remains draft and unmerged.

Operational local admission-only proof

A clean-room local rehearsal was executed against the actual WSL clones with Python bytecode generation disabled.

Pinned heads:

• codebase-prompting: 94584263636a49163e94469eefe3c75a0f731508
• apex-hpl-governed-kernel: a5d2d913e41fd9a80212825921d0919fd8320b3b

Observed receipt:

• admitted=true
• execution_requested=false
• execution_token_present=true
• runtime_executed=false
• kernel_head=a5d2d913e41fd9a80212825921d0919fd8320b3b
• graph_sha256=sha256:02392ff7024b5722edf07bf777f39a803a1e84feeb7705c65751f4e1d3dd551f
• impact_sha256=sha256:899fbc7fe7c101bb2e2b1610e104cc8f4059dc1ae0a172fac1ac7d205e94d93e
• developer_plan_sha256=sha256:348725f47d29822ffb1d600a9ba5d4fed96901c9752ffbc4feca0cf2024a5839
• binding_sha256=sha256:e2d74a7cdd65cadc426c4c317d48d10e9f07b9a7e1a5acc80a3b58a85bf7a035
• kernel_harness_receipt_sha256=sha256:de60a501792ab5a8e3bbb0c53dd1bb66474f717897d737dbed544b3d982d8a41
• rehearsal_sha256=sha256:5477b5d3c4a6ebe1480b8f69c1766f30665ae189336b9367ea8b78e8b9d04c05

Post-run Git status showed both worktrees clean with no tracked or untracked files created.

Operational conclusion for v4: the actual local Repository Intelligence -> Developer Plan -> HPL binding -> pinned kernel harness -> HPL scheduler admission -> ExecutionToken path is proven in admission-only mode. No RuntimeEngine effect, no OpenHands network effect, and no repository mutation occurred.

This does not certify live OpenHands execution. The next tranche should exercise a separately governed non-consequential repo.read runtime effect before any repo.patch mutation rehearsal.