feat(api): orchestrator interchange refuses table access and repo tokens

CHANGELOG.md

@@ -6,6 +6,7 @@ All notable changes to TEPP are documented here. The format follows Keep a Chang
 
 ### Added
 
+- `tepp_api` contextual-orchestrator HTTPS interpretation interchange: credential-free `POST /v1/interpretation-runs`, table-access/non-https refusal, repository-write/review-agent secret refusal, and explicit denial that orchestrator output is scientific acceptance.
 - `membership_core` estimation rows: one document emits every active membership at an event time, recovered weights are scored with computed RMSE, and collapsing a known multiple-membership set into a single independent row is refused (atomistic fallacy).
 - `persistence_postgres` typed membership assignment (migration `0006`): `entity_record`, `project_record`, and `text_segment` plus exactly-one observed-unit and target constraints that replace the polymorphic `membership_target_id` stub, with SQL insert/lookup, fail-closed inverted-window and backslash-label refusal, and live proof that one document persists two entity memberships and one project membership.
 - Actions workflow fleet auditor (`scripts/actions_workflow_fleet.py`): paginated registry inventory bound to the exact default-branch SHA/tree, classification of present/orphan/disabled/GitHub-dynamic identities, and fail-closed orphan disable that confirms GitHub's official `disabled_manually` state.

DOCUMENTATION.md

@@ -33,6 +33,7 @@ TEPP's approved PRD v0.4 and implementation plan are the primary product baselin
 | Hourly NIM product-development operations | [`docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md`](docs/operations/HOURLY_NIM_PRODUCT_DEVELOPMENT.md) |
 | Actions workflow fleet audit | [`docs/operations/ACTIONS_WORKFLOW_FLEET.md`](docs/operations/ACTIONS_WORKFLOW_FLEET.md) |
 | Actions fleet research doctoring | [`docs/research/actions-workflow-fleet.md`](docs/research/actions-workflow-fleet.md) |
+| Orchestrator HTTPS interchange doctoring | [`docs/research/orchestrator-http-interchange.md`](docs/research/orchestrator-http-interchange.md) |
 | Membership estimation-row doctoring | [`docs/research/membership-estimation-rows.md`](docs/research/membership-estimation-rows.md) |
 | Hourly NIM OpenCode doctoring | [`docs/doctoring/hourly-nim-opencode-development.md`](docs/doctoring/hourly-nim-opencode-development.md) |
 | Change history | [`CHANGELOG.md`](CHANGELOG.md) |

crates/membership_core/src/network.rs

@@ -88,7 +88,9 @@ impl MembershipNetwork {
         self.assignments
             .iter()
             .copied()
-            .filter(|assignment| assignment.member_id() == member_id && assignment.is_active_at(instant))
+            .filter(|assignment| {
+                assignment.member_id() == member_id && assignment.is_active_at(instant)
+            })
             .collect()
     }
 
@@ -133,7 +135,12 @@ impl EstimationMembershipRow {
     /// Copy the scientifically relevant fields from one assignment.
     #[must_use]
     pub fn from_assignment(assignment: MembershipAssignment) -> Self {
-        Self { member_id: assignment.member_id(), group_id: assignment.group_id(), role: assignment.role(), weight: assignment.weight().value() }
+        Self {
+            member_id: assignment.member_id(),
+            group_id: assignment.group_id(),
+            role: assignment.role(),
+            weight: assignment.weight().value(),
+        }
     }
 
     /// Member identity on this row.

crates/membership_core/tests/atomistic_collapse_structure_contract.rs

@@ -10,11 +10,7 @@ fn event_time(value: &str) -> EventTime {
     EventTime::parse_rfc3339(value).expect("event time")
 }
 
-fn assignment(
-    member: MemberId,
-    group: GroupId,
-    role: MembershipRole,
-) -> MembershipAssignment {
+fn assignment(member: MemberId, group: GroupId, role: MembershipRole) -> MembershipAssignment {
     MembershipAssignment::new(
         member,
         group,
@@ -79,6 +75,10 @@ fn rows_from_different_members_fail_closed() {
             .estimation_rows_at(second_member, instant)
             .expect("second rows"),
     );
+    assert_eq!(
+        refuse_atomistic_collapse(&mixed, 0),
+        Err(MembershipError::InvalidWirePayload)
+    );
     assert_eq!(
         refuse_atomistic_collapse(&mixed, 2),
         Err(MembershipError::InvalidWirePayload)

crates/tepp_api/src/lib.rs

@@ -11,6 +11,7 @@ mod authorization;
 mod envelope;
 mod error;
 mod export;
+mod orchestrator_http;
 mod wire;
 
 /// Analysis-run contract version constant.
@@ -46,3 +47,17 @@ pub use authorization::ExportAuthorizationRequest;
 pub use authorization::authorize_export;
 /// Fail closed when an export decision is denied.
 pub use authorization::require_export_allowed;
+/// Maximum orchestrator JSON body size.
+pub use orchestrator_http::MAX_ORCHESTRATOR_BODY_BYTES;
+/// Maximum orchestrator idempotency-key size.
+pub use orchestrator_http::MAX_ORCHESTRATOR_IDEMPOTENCY_KEY_BYTES;
+/// Versioned interpretation-run path.
+pub use orchestrator_http::ORCHESTRATOR_INTERPRETATION_PATH;
+/// Credential-free orchestrator HTTPS exchange.
+pub use orchestrator_http::OrchestratorHttpExchange;
+/// Build an interpretation request for contextual-orchestrator.
+pub use orchestrator_http::orchestrator_interpretation_exchange;
+/// Orchestrator output is never scientific acceptance.
+pub use orchestrator_http::refuse_orchestrator_as_scientific_acceptance;
+/// Refuse repository-write or review-agent secret names.
+pub use orchestrator_http::refuse_repository_write_secret;