feat(addie): execute bounded architecture diagnostics

[bokelley]

Adds a fixed, one-shot, immutable-evidence provider-backed executor for the predeclared synthetic 24-case architecture diagnostic cell. The only cell binds Anthropic Haiku routing and Sonnet generation across direct, two-stage, and deterministic-policy fallback arms. It preserves strict escrow, usage/identity/tool/continuation ledgers, request byte caps, zero-call validation, and diagnostic-only/non-promotable status. No provider calls were made in this PR.

---

Open workspace in Conductor

[aao-secretariat]

Ladon verdict: Approve

Approve — Addie eval-only PR.

This PR adds a one-shot, immutable-evidence executor for the synthetic 24-case architecture diagnostic cell (new 363-line execution module, a runner byte-guard, plus unit + CLI tests). No protocol surface (static/schemas/source/**, docs/reference/**, dist/**), changeset scope, or versioning/spec-drift gates are touched, so none of the schema↔docs, changeset, oneOf, artifact-immutability, or breaking-change governance rules apply.

The reviewer surfaced no Critical/High/Medium findings. The new code is fail-closed and bounded (whole-cell escrow, 168-dispatch ceiling, 120s timeouts, transportRetries:0).

Decision walk-through:

• Rows 1: no critical/high findings.
• Row 2: gated_paths is false — not triggered despite review_decision=REVIEW_REQUIRED.
• Row 3: high_risk true, but reasons are (added)/(modified) with no deletions.
• Rows 4–5: no medium findings, so no data-loss/schema/infra escalation and no high-risk+medium escalation.
• Row 6: no prior decision.
• Row 7: no no-auto-approve team match.
• Row 8: fewer than three medium findings (zero).
• Row 9: falls through to approve.

high_risk is a look-closer heuristic here (new file + modified file under server/src/addie/**); with zero reviewer concerns the modification is presumed contract-preserving.

[aao-secretariat]

Ladon verdict: Approve

Approve.

Subsequent pass on diagnostic-only Addie eval files. The diff touches two new/modified files under server/src/addie/eval/** plus three test files, adding ~1026 lines with only 2 deletions. No static/schemas/source/**, docs/reference/**, dist/**, package.json version, or wire surface is touched, so changeset, oneOf-discriminator, immutability, and 3.1.x patch-eligibility gates do not apply. No protocol-policy question is decided, so governance-precedent citation is not required.

The reviewer traced the reworked execution.ts: WeakMap admission authentication rejects forged handles and contradictory provenance before dispatch, mid-arm failures retain partial observations with complete:false, checksum-collision rollback unlinks the artifact for safe retry, and lease release runs in finally with reservedUsd zeroed — all confirmed by new tests. No correctness, budget-leak, or state-machine defect found.

Decision-table walk: no critical/high findings (row 1 no). gated_paths: false (row 2 no). High-risk reasons are (added) and (modified) — no (deleted) (row 3 no). No medium findings at all (rows 4, 5, 8 no). Prior decision was approve, not escalate (row 6 no). No no-auto-approve team match (row 7 no). Falls through to row 9 → approve.

The (modified) on fixed-trace-runner.ts matches a high-risk glob, but per the high-risk-flag guidance a modification with no medium-or-higher finding is presumed safe. Net improvement over prior clean pass; no fresh actionable findings.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean subsequent pass on PR #7360.

This delta hardens the Addie fixed-trace architecture diagnostic finalizer (fsync-backed durability, single-use FixedTraceArchitectureDiagnosticOutputFinalizationError, and the finalizeCompletedFixedTraceArchitectureDiagnosticArtifact wrapper) plus manual-eval catch ordering that never overwrites completed paid evidence with a setup-failure artifact, all backed by matching failure-path tests. Reviewer verified finalize single-use, accurate durability flags, no-overwrite guards, and empty-file-on-failure behavior.

Scope check: server-only eval harness (server/src/addie/eval/** and tests) with no schema, docs, dist, or changeset surface touched — no spec drift, changeset, oneOf, immutability, or 3.1.x concerns apply.

Gate review:

• No critical/high/medium findings (row 1, 4, 5, 8 not triggered).
• gated_paths: false (row 2 not triggered).
• high_risk: true but only via (added) and (modified) reasons with no finding on the modified file, and no (deleted) reasons (rows 3/5 not triggered).
• Prior decision was approve, so sticky escalation (row 6) does not apply.
• No no-auto-approve team match (row 7 not triggered).

Falls through to row 9 → approve.