Model Plane review findings — non-schema dispositions (SHACL / conformance / spec)

[mdheller]

Part of #241. Tracks the design-review findings that cannot be expressed as JSON-Schema if/then and so land outside sourceos-spec schemas. The schema-expressible ones were fixed inline (#240 SEAM-015 teeth; #246 ledger hash-chain + biometric boundary; #245 SEAM-014/017 manifest teeth + license).

Cross-document invariants → ontogenesis SHACL (T7-8)

• ModelAdapterManifest.baseModelDigest == ModelManifest.modelDigest when baseModelManifestRef is set.
• SourceOSModelCarryRef.modelRef resolves to a ModelManifest.modelDigest.
• AdapterPromotionDecision.baseModelDigest/candidateAdapterDigest resolve to real manifests.
• Ledger hash-chain continuity (entry N's ledgerPrevHash = hash of entry N-1) — schema only requires the field exists, not that the chain is unbroken.
• sensitiveCategories completeness (that the T0 classifier actually ran over the input) — schema can't attest a runtime check happened.

Runtime / conformance → workstation-contracts (T7-19)

• served == receipt reconciliation (finding Feat/agent plane core schemas v0 #5): an independent (non-inferenced) counter proving every completion emitted a receipt. Never-fired = suspect.
• confidence calibration (finding Draft: add core agent-plane schema scaffolds #1/OQ1): the escalation trigger is self-reported; conformance must check confidenceMethod calibration, not trust the scalar.
• biometric-never-crosses-socket (finding chore: document merge conflict remediation in CHANGELOG #7 runtime half): visiond must not return raw embeddings over vision.sock to a networked client — the schema boundary is the decision, the socket is the leak.

Spec text / architecture (source-os docs, ADR)

• router-vs-confidence contradiction (finding docs: add Phase 2 comprehensive agent-plane schema documentation #2): §II says the router decides every crossing; §VII lets confidence trigger escalation after routing. Resolve which gates the boundary.
• audit-set ≠ escalation-set (finding docs: clarify repo topology and semantic role #3): input_retained:false means users can audit what trained the model but not what left the device (hashes only). State the limitation.
• trust concentration in T0 (finding Add merge-conflict marker check to PR template and contributing guide #9) and the boundary-crossing incentive gradient (finding chore: document merge-to-main conflict reconciliation in CHANGELOG #10): note as design tensions.

Base-model license (OQ3/finding #11) is now contract-checkable via ModelManifest.license/ModelAdapterManifest.license (#245) — closed at the contract layer; base-model selection still owed under MIT/Apache-only.