refactor(contracts): move runtime-fact exports into their own manifest

[doublewhy]

Summary

implementations/python/packages/raes_contracts/contracts/_exports.py is 499 lines. Package files are capped at 500 lines, and the oversized-file allowlist is empty. Publishing the #1366 inject-trigger contracts through the raes_contracts.contracts facade adds a manifest import and a spread entry, which would push the file over the cap. This PR moves the contiguous runtime-fact binding-plane family (18 names) into _runtime_fact_exports.py and spreads it where the names were. PUBLIC_EXPORTS keeps the same membership and order, and _exports.py drops to 483 lines.

Any .py change under implementations/python/packages changes the implementation digest that the research-evidence captures pin. This PR therefore also republishes both captures against this source, as #1404 did. Outcomes and claim limits are unchanged.

Requirement UIDs

• None. This is a behavior-neutral refactor of the facade's export manifest with no requirement scope.

Related Issues

Closes #1418

ADR Impact

• None.

Changes

• raes_contracts/contracts/_runtime_fact_exports.py: new RUNTIME_FACT_EXPORTS list with the same 18 names in the same order, following _mixed_composition_exports.py.
• raes_contracts/contracts/_exports.py: imports RUNTIME_FACT_EXPORTS and spreads it in place of the 18 literal names.
• Research evidence: specification-coverage release 71.0.0 and formal-validation release 72.0.0 (baseline 71.0.0, no deviations) record this source's implementation and contract-models digests. Their revision pins advance in tools/check_specification_coverage.py, tools/formal_semantic_validation/, the three evidence test modules and both research indexes, and the stale "through 66.0.0" historical-validation message in _releases.py is corrected to 71.0.0 (dev's historical retest set already ends at 70.0.0). As on dev, the formal current-release assertion expects no deviations, because nothing changed compiled output.

Test Plan

• Unit tests pass
• Integration tests pass if applicable
• Full completion suite required in CI before merge
• No coverage regression: not measured locally. The new module is a list of names that _exports.py imports, and canonical / coverage-reduce runs in CI.

PUBLIC_EXPORTS built from origin/dev's _exports.py and from this branch are identical in order and membership (570 names), and raes_contracts.contracts.__all__ == PUBLIC_EXPORTS.

This branch is rebased onto dev c474c26. #1485 published specification-coverage releases 69.0.0 and 70.0.0 and formal-validation releases 70.0.0 and 71.0.0, so the refactor commit was reapplied unchanged (same diff) and both captures were regenerated at the next free releases.

Before the republish, at 665bcc6, tools/check_specification_coverage.py reported research-evidence-source-state and a stale contract-models digest, and tools/check_formal_semantic_validation.py reported research-evidence-source-state. After it, both checkers pass.

pytest over test_specification_coverage.py, test_formal_semantic_validation.py, test_issue_989_versioned_evidence.py, test_contracts_facade_exports.py and test_conformance_facade_parity.py passed: 214 passed and 19 deselected in the default selection, and 19 passed and 214 deselected with -m integration. test_conformance_facade_parity.py covers the separate raes_conformance.conformance facade and is unrelated to this change.

nox -s contracts -- --base-rev origin/dev passed all 14 stages, including schema publication, generated-schema drift, specification coverage, formal semantic validation and JSON artifact validation. nox -s lint and make policy passed. nox -s verify-fast-feedback -- --base-rev origin/dev passed every stage it ran. It skipped YAML syntax because no YAML changed, and requirement governance because the branch carries no requirement UID.

Ground Control Checks

• Repository policy command passes
• Pre-push code review and test-quality review: not run for this lane; an independent review runs before the PR is marked ready.

make policy passed locally, with requirement governance skipped as described in the Test Plan.

Traceability

• IMPLEMENTS: (none; requirement-free refactor)
• TESTS: (none added; test_contracts_facade_exports.py checks that PUBLIC_EXPORTS names are unique and resolve on the facade, but no test pins the manifest's order or that the 18 moved names stay in it. Order and membership were compared once against origin/dev (570 names), as the Test Plan records, not by a test)

Checklist

• Code follows the project coding standards; ruff format and ruff check pass on both modules
• FM: not applicable, no semantic change; no executable or runtime adoption is claimed
• No published schema, fixture, model or public name changes; tools/check_generated_schemas.py passes
• PR title is a Conventional Commit; refactor because nothing user-visible changes
• No architectural docs describe the manifest layout; the API reference documents modules with automodule, not the facade's __all__

Documentation

Updated: the specification-coverage and formal-validation research indexes record the new releases.

[doublewhy]

Open pull requests from doublewhy: index and suggested merge order

This lists the 78 open pull requests from this account across rae, lilrae, hub, adapters and workbench, grouped by area, with a suggested merge order. env-packs has none open. Nothing here needs a reply. Any order works: when something merges, I rebase the PRs that depend on it and republish evidence where needed. The order below needs the fewest rebases.

State at 2026-10-12 06:10 UTC:

• Merged on 2026-10-11: rae fix(release): name the repository when publish-github uploads release assets #1415, chore(agents): remove the stale generated-schema rule from the protect-files hook #1417, docs: link the env-packs companion repository #1419, docs: close publication-boundary gaps and standardize the reporting contact #1420, docs: use environment pack terminology across docs and specs #1424, fix(sdl): complete reusable behavior authoring (DSL-116) #1426, refactor(contracts): move runtime-fact exports into their own manifest #1428, fix(runtime): isolate the snapshot that shared-time readback hands the time runtime #1429, docs: add a guide to validating, compiling, and inspecting a scenario plan #1430 and feat(contracts): publish mixed-backend execution and readback contracts #1442; lilrae fix(quality): clear control-plane Sonar findings #1252, ci: restore Sonar analysis for pull requests to dev #1253, ci: restore Sonar analysis for repository PRs #1254, fix(quality): clear the dev new-code violations blocking the Sonar gate #1255, chore(deps-dev): bump hatchling from 1.27.0 to 1.32.0 in /implementations/python in the python-minor-patch group #1256, chore(deps): bump github/codeql-action/upload-sarif from 4.37.9 to 4.38.0 in the github-actions group #1257, fix(release): release commits fail evidence verification and re-run the full check suite #1266, fix(release): keep release bookkeeping from failing verification or re-running checks #1267, fix(tooling): upgrade vulnerable cryptography and pip and retire the macOS x86_64 bootstrap profile #1268, build(dev): provide a ready-to-use development container #1270 and chore: back-merge v4.1.0 into dev #1274; env-packs Implement participant implementation manifest contracts #433 and SDL gap: security-monitoring detection definition semantics #434. Nothing has merged on 2026-10-12 yet.
• rae (44 ready, 4 drafts): the latest CI run on every head passes every required check, except sonar on fix(runtime): compare mixed-runtime target manifests in canonical contract form #1483 and fix(sdl): report lock, trust-policy and import-provenance failures as sdl diagnostics #1484. Every PR outside the evidence lane merges cleanly with dev. docs(guides): correct the imports, rename and CLI-reference statements in the CLI and Python guides #1492, docs(sdl): make the SDL reference example valid and fix two stale statements #1493, ci(docs): check that in-repo GitHub links in docs/public resolve #1495 and fix(tooling): upgrade urllib3 and virtualenv in the development tool lock #1497 are new.
• env-packs (0): no open PRs.
• hub (2): every check passes, including PR Gate.
• adapters (4): the only thing blocking them is the required PR Gate. It fails because SonarCloud rejects the July SONAR_TOKEN (ci: SonarCloud rejects the repository SONAR_TOKEN adapters#102).
• workbench (4): sonar fails for the same reason (ci: SonarCloud rejects the repository SONAR_TOKEN workbench#75). audit now passes on all four, because Participant behavior & interaction semantics (SEM-208, SEM-209, SEM-210, SEM-211, SEM-212, SEM-213, SEM-215) #71 to Author-selectable specificity & constraint surface (DSL-115) #73 carry Participant runtime: state/history, decision/execution lifecycle, shared operational state, concurrency (RUN-305, RUN-306, RUN-307, RUN-308) #74's lock update. dev has no required checks.
• lilrae (20 ready): every check passes on every PR. test(runtime): wait for driver outcomes instead of a fixed tick budget #1261 and feat: add typed partial realization descriptions #1263 conflict with dev; the other 18 merge cleanly. feat!: adopt progressive SDL semantics #1283, ci(policy): align the PR template and body guard with Ground Control rendered bodies #1286, feat(conformance): add observability evidence fixture profile #1287, fix: allow unconstrained realization evidence sources #1288, chore: back-merge v5.0.0 into dev #1291, fix: bind evidence provenance to the run apparatus #1293, fix(evidence): centralize capture admission and governance authority #1296, Preserve extensible HTTP method identity in runtime route inventory #1298 and docs(sdl): audit product-shaped runtime semantics #1300 are new.

The three asks of 2026-10-11

I am applying your three asks across all open PRs: one complete PR per issue, every check green even when the cause is unrelated to the PR, and every follow-up in a PR body either done in the PR or tracked by an open issue. Follow-up issues are being filed and linked from each PR body. Slice PRs are being folded or completed, for example lilrae #1262 into #1269 and rae #1478 into #1471.

rae: changes that leave the research evidence alone

These PRs touch nothing the research evidence binds, so they never force a republish. They can merge at any time, in any order, including between evidence merges. #1461's audit record lists findings that #1472, #1474, #1476, #1488 and #1491 fix (ST-2, CL-2, NS-1, NS-7, NS-8 and GH-7). Whichever side merges second marks them fixed, and I will push that.

PR	Issue	Change
#1432	#1427	Post-edit policy hook checks repository-relative paths
#1455	#1454	Policy gate fails when conftest cannot evaluate its policies
#1437	#938	The README and docs front page become a first stop for new readers
#1452	#1412	VS Code support assessment for SDL authoring
#1461	#1460	Fixture provenance audit record
#1443	#1435	API-404 clauses mapped to each profile's evidence
#1447	#253	Shared-state and derived-context contract composition tests
#1453	none (#1344 audit)	Libvirt TechVault fakes from a captured readback
#1459	none (#1344 audit)	A lease closed in a forked child keeps the parent's locks
#1470	none	The first-scenario tutorial shows what format --check reports, then a check that passes
#1471	#219	The behavior-model spec drops retired classification fields (one slice of #219)
#1472	none (#1344 audit)	Atomicity fakes fail from SQLite's own COMMIT
#1474	#1473	Gates list changed paths NUL-separated, so names git quotes reach them
#1476	#1475	Maintained-client downloads pin HTTP/1.1
#1478	none	The controlled-vocabularies page calls the three behavior catalogs closed, as their records say
#1487	#222	Conformance-reporting clause map (done-when bullet 1), with a test that keeps every citation honest
#1488	none (#1461 audit NS-7, NS-8)	Release fakes model the real gh and curl failure exits
#1489	none	Getting-started points readers at raes semantic validate
#1491	#1490	The CI latency report no longer counts the wait before a re-run as queue time
#1492	none	The CLI and Python guides state imports, rename and the CLI reference correctly
#1493	none	The SDL reference example validates, and two stale statements are fixed
#1495	#1494	CI checks that in-repo GitHub links in docs/public resolve
#1497	#1496	The development tool lock upgrades urllib3 and virtualenv

One stack. I rebase the next PR after each merge.

• feat(examples): add machine-checked metadata to example library entries #1438 (Define metadata for indexing examples, templates, and patterns #381), then feat(examples): add scenario templates with validation commands and claim notes #1445 (Create validated scenario templates for current SDL authoring #378), then feat(examples): add experiment authoring-input templates for runs and studies #1458 (Create task, run, and study template catalog after experiment surfaces are validated #380). feat(examples): add a participant behavior pattern catalog with validated example links #1468 (Create participant behavior pattern catalog after behavior surfaces are validated #379) sits on top.

#1422 (#712) adds a gate over every schema under contracts/schemas/: each one needs a live IMPLEMENTS → SPEC owner. It now adds the owners for #1442's two schemas, which are on dev. Four schemas that #1436 and #1449 add have no owner yet:

• inject-trigger-request-v1
• inject-occurrence-v1
• inject-occurrence-outcome-v1
• inject-occurrence-correlation-v1

Git sees no conflict, so whichever side merges second would turn verify red on dev. #1422 is a draft until #1449 merges; I will then rebase it, add those owners and mark it ready.

rae: changes bound by the research evidence

You now take these PRs in your own order and regenerate their evidence yourself: #1442 and #1429 merged that way, and #1436 and #1449 are in progress. The release-number table from earlier versions of this comment is obsolete, so I removed it. I do not push to a PR you are working on. I republish any of the others on top of dev on request. That takes about 10 minutes, plus 20 to 30 minutes of CI.

The remaining PRs in this lane:

• feat(contracts): publish inject trigger request and occurrence contracts #1436 (feat(contracts): publish inject trigger request and occurrence contracts (part of #1366) #1423) and feat(contracts): publish inject readback, correlation and backend declaration contracts #1449 (Publish inject-trigger and occurrence contracts #1366), in progress with you
• fix(runtime): stop dispatching control-plane requests abandoned before their body completes #1431 (Complete HTTP request-limit boundary tests and documentation #1091), then fix(runtime): declare the missing multi-owner and exactly-once nonclaims #1444 (Verify API-404 completion against control-plane profiles #8)
• fix: realize relayed provisioning plans from their published operations #1433 (fix: realize relayed provisioning plans from their published operations #1425), fix(sdl): keep imported tool affordances bound to their own tool content #1440 (Verify participant tool authoring across composition and compilation (DSL-117) #298), fix(runtime): refuse backend snapshot entries whose runtime domain is an untyped string #1441 (fix(runtime): refuse backend snapshot entries whose runtime domain is an untyped string #1434), feat!: make reference eligibility explicit per purpose and align the editor with validation #1446 (Make target eligibility explicit and align editor suggestions #1339), fix(runtime): gate autonomous participant episode initialization like the control plane #1448 (fix(runtime): gate autonomous participant episode initialization like the control plane #1439), fix(runtime): refuse provisioning results that bind an envelope the plan never selected #1456 (fix(runtime): refuse provisioning results that bind an envelope the plan never selected #1450), fix(runtime): judge and persist realization concerns through portable payloads #1457 (fix(runtime): read admitted payload carriers through their portable projection in realization disclosure and safe persistence #1451) and fix(runtime): order workflow compensation by completion instant, not timestamp text #1464 (fix(runtime): order workflow compensation by completion instant, not timestamp text #1462)
• feat(sdl): add authored participant episode policies to behavior specifications #1463 (Participant Episode Structure And Termination Surface (DSL-120) #307), then feat(sdl): make episode structure a first-class member of participant behavior #1465 (Participant Episode Structure (ACT-623) #309)
• feat!: define participant budget exhaustion and limit-effect semantics #1466 (Participant Budget, Quota, And Exhaustion Semantics (SEM-223) #306), feat: support authored participant interaction budgets #1467 (Participant Interaction Budget Surface (DSL-121) #308) and feat: make interaction budgets a first-class participant behavior member #1469 (Participant Interaction Budgets And Quotas (ACT-624) #310), stacked drafts that go after feat(sdl): add authored participant episode policies to behavior specifications #1463 and feat(sdl): make episode structure a first-class member of participant behavior #1465, because they share files and the 512,000-byte cap on materialized-scenario-v1.json
• fix(sdl): fetch oci modules from public registries through the anonymous token flow #1480 (fix(sdl): fetch oci modules from public registries through the anonymous token flow #1479), then fix(sdl): report lock, trust-policy and import-provenance failures as sdl diagnostics #1484 (Verify reusable and scenario-local behavior authoring (DSL-116) #297), and fix(runtime): compare mixed-runtime target manifests in canonical contract form #1483 (fix(runtime): compare mixed-runtime target manifests in canonical contract form #1482)

Except #1431, #1436 and #1449, they conflict with dev until they are republished, mainly in docs/research/** and the revision pins. Each republish push also carries that PR's pending fixes: the sonar findings on #1483 and #1484, and the updates #1446 and #1484 owe to text that #1426 added.

lilrae

OpenRAE/lilrae#1255, #1256, #1257, #1266, #1267, #1268 and #1274 merged on 2026-10-11. #1259 and #1265 merged as part of #1266. I closed #1276 because your 56a3e02b in #1257 covers it. Every open lilrae PR is ready and passes every check. dev requires up-to-date branches, and most branches are behind dev 1abe440b without conflicts. I no longer update them automatically, because you push to some of them; I update any branch on request. Suggested order:

1. chore: remove the unused in-tree Kali wrapper lilrae#1258 (issue 987), with your review follow-ups.
2. fix(deployment): refuse a Kali shell during capture whichever name or ID selects it lilrae#1272 (issue 1271), then fix(deployment): report unrecorded container names as not part of this lab lilrae#1278 (issue 1277), then fix(deployment): report a container that compose never created instead of an ownership error lilrae#1300 (issue 1299). fix(deployment): explain how to recover from an unowned service index lilrae#1264 (issue 990), then fix(deployment): explain how to recover from a retained index whose mapping drifted lilrae#1281 (issue 1280).
3. fix(mcp): validate tool arguments against each tool's schema before dispatch lilrae#1279 (issue 967) and fix(mcp): stop the remote command and close its channel when run_command times out lilrae#1293 (issue 1290), in either order. They edit the same files but merge cleanly.
4. fix(runs): write local exports owner-only so export-bundle accepts the default directory lilrae#1283 (issue 1282), feat(conformance): add observability evidence fixture profile #1287 (issue 1285), chore: back-merge v5.0.0 into dev #1291 (issue 1289), fix(evidence): centralize capture admission and governance authority #1296 (issue 1295), Preserve extensible HTTP method identity in runtime route inventory #1298 (no issue) and fix: allow unconstrained realization evidence sources #1288 (no issue, docs), in any order.
5. fix(workbench): enforce provider deadlines and clean up owned child processes lilrae#1260 (issue 963) and fix(lifecycle): hold the lifecycle lock only while a monitor tick runs lilrae#1286 (issue 1284). Both are being extended to complete their issues.
6. fix!: bind base-container operational secrets explicitly lilrae#1262, then fix!: bind operational secrets explicitly lilrae#1269 (issue 965). fix(sdl): preserve governed runtime vocabulary identities #1262 is being folded into fix(tooling): upgrade vulnerable cryptography and pip and retire the macOS x86_64 bootstrap profile #1269, which will complete issue 965.
7. test: check TechVault runtime properties on the rendered pack, not the Compose stub lilrae#1261 (tests half of issue 954) and docs: align runtime documentation and tests with the shipped lab lilrae#1263 (docs half). Both conflict with dev. After Dev #1258 merges, they become one PR for issue 954.

In each "then" pair the second PR contains the first one's commits, so it merges after it.

env-packs

No open PRs. OpenRAE/env-packs#433 and #434 merged on 2026-10-11. Issue 414 still needs the fix for #1481 (#1485) to reach a RAES release that env-packs pins.

hub

OpenRAE/hub#44 (issue 41) and OpenRAE/hub#45 (issue 39), in either order. Both pass every check.

adapters

OpenRAE/adapters#98, #99, #100, then #101: the inventories for issues 87, 85, 86 and 88.

• They are stacked only because each one adds a single mkdocs.yml nav line.
• dev requires up-to-date branches, so I rebase each one after the previous merge. That push dismisses earlier approvals.
• All four wait on ci: SonarCloud rejects the repository SONAR_TOKEN adapters#102.
• Each PR only references its issue, so issues 85 to 88 stay open.

workbench

1. chore(deps): update locked cryptography, django, pyjwt and sqlparse for published advisories workbench#74 (issue 76) first, because it fixes the audit job.
2. Then ci: run lint as its own job and spread pytest over the runner's CPUs workbench#73 (issue 61), Participant behavior & interaction semantics (SEM-208, SEM-209, SEM-210, SEM-211, SEM-212, SEM-213, SEM-215) #71 (issue 53) and Explicitness & realization semantics: binding declarations vs processor/backend realization (SEM-218) #72 (issue 60).

#71 to #73 each carry #74's lock update, so audit passes on them. After #74 merges, I will rebase them to drop it.