Implement local harness and ABI runtime boundary

CHANGELOG.md

@@ -13,6 +13,13 @@
 - Add executable deterministic Rust HMM provider baseline and provider-host benchmark.
 - Add bounded investigator context packing, explicit workspace access, candidate transaction,
   identity envelope, quarantine, and morning-report contracts.
+- Add executable local-harness request/observation normalization with timeout and output
+  bounds, authority-expansion rejection, and explicit proposal-only semantics.
+- Add Git-validated detached proposal worktree materialization, source commit identities,
+  reproducible metadata, and explicit preserve-or-cleanup behavior.
+- Add the reviewed Rust `mnel-provider-loader` unsafe boundary, SHA-256 artifact admission,
+  v1 descriptor/query/result validation, host-owned output copying, native cdylib fixtures,
+  and existing-host quarantine integration tests. ABI v1 is unchanged.
 
 ## 0.1.0a0 — unreleased
 

Cargo.toml

@@ -4,6 +4,10 @@ members = [
   "crates/mnel-provider-classical",
   "crates/mnel-provider-sdk",
   "crates/mnel-provider-host",
+  "crates/mnel-provider-loader",
+  "crates/mnel-provider-fixture",
+  "crates/mnel-provider-fixture-invalid",
+  "crates/mnel-provider-fixture-no-entry",
 ]
 resolver = "2"
 

README.md

@@ -42,7 +42,8 @@ conventional neural-weight training.
 > process-local persistent Rust host, reusable identity-bound snapshots, bounded and
 > normalized diagnostic results, failure quarantine, an executable Rust HMM baseline,
 > deterministic runtime measurements, and bounded investigator context/workspace
-> contracts. It still does not provide dynamic library loading, process isolation,
+> contracts, an executable local-harness/worktree path, and a validated Rust v1 dynamic
+> provider loader. It still does not provide process isolation,
 > unattended model execution, distributed scheduling, protected final custody, formal
 > MNCS/MNCDS conformance, or automatic RAVEL promotion.
 
@@ -96,6 +97,13 @@ copy their authority or silently create substitute implementations.
 - executable `mnel-provider-classical` HMM diagnostic provider and host integration tests;
 - eligible-context packing, read-only/proposal workspace models, identity envelopes,
   candidate transactions, quarantine queues, and deterministic morning-report records;
+- bounded local-harness JSON-line execution with timeout/output ceilings, authority
+  rejection, deterministic observations, and detached Git proposal worktrees;
+- SHA-256 artifact-bound Rust dynamic loading for `mnel_provider_entry_v1`, descriptor and
+  pointer/length validation, host-owned output copying, clean unload, and quarantine
+  integration through the existing provider host;
+- initial immutable transition, tabular, and pair diagnostic snapshot producers with
+  compact binary payloads and dependency-bound content identities;
 - deterministic reference workflow, JSON schemas, mutation-oriented tests, and CI.
 
 ## Install
@@ -296,8 +304,11 @@ operating-system sandbox. Untrusted experiment execution belongs in a hardened r
 with network restrictions, resource controls, immutable verifiers, and disposable
 workspaces.
 
-The provider runtime crates establish contracts and admission policy; they do not yet
-implement a hardened dynamic loader or operating-system sandbox.
+The provider runtime includes a small native-trusted dynamic loader with explicit ABI,
+artifact, pointer/length, output, and diagnostic-authority checks. It is not an
+operating-system sandbox: malformed native code can still crash the host process, so
+untrusted experiment execution belongs in a hardened runner with network restrictions,
+resource controls, immutable verifiers, and disposable workspaces.
 
 A local MNEL result or learned-provider observation can describe bounded development
 context. It cannot by itself establish independent evaluation, protected custody,

crates/mnel-provider-fixture-invalid/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "mnel-provider-fixture-invalid"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+description = "Malformed ABI descriptor fixture for MNEL loader integration tests"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+mnel-provider-api = { path = "../mnel-provider-api" }
+
+[lints]
+workspace = true

crates/mnel-provider-fixture-invalid/src/lib.rs

@@ -0,0 +1,28 @@
+//! A deterministic descriptor that must be rejected before invocation.
+
+#![allow(unsafe_code)]
+
+use mnel_provider_api::{ByteView, Digest32, ProviderDescriptorV1, ABI_VERSION_V1};
+
+static ID: &[u8] = b"fixture.invalid";
+static VERSION: &[u8] = b"0.1.0";
+static mut DESCRIPTOR: ProviderDescriptorV1 = ProviderDescriptorV1 {
+    abi_version: ABI_VERSION_V1 + 1,
+    reserved: 0,
+    provider_id: ByteView {
+        data: ID.as_ptr(),
+        len: ID.len(),
+    },
+    provider_version: ByteView {
+        data: VERSION.as_ptr(),
+        len: VERSION.len(),
+    },
+    declaration_identity: Digest32 { bytes: [8; 32] },
+    implementation_context: core::ptr::null_mut(),
+    infer: None,
+};
+
+#[no_mangle]
+pub extern "C" fn mnel_provider_entry_v1() -> *const ProviderDescriptorV1 {
+    &raw const DESCRIPTOR
+}

crates/mnel-provider-fixture-no-entry/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "mnel-provider-fixture-no-entry"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+description = "No-entry-symbol cdylib fixture for MNEL loader integration tests"
+
+[lib]
+crate-type = ["cdylib"]
+
+[lints]
+workspace = true

crates/mnel-provider-fixture-no-entry/src/lib.rs

@@ -0,0 +1,6 @@
+//! A shared library without the versioned MNEL entry symbol.
+
+#![allow(unsafe_code)]
+
+#[no_mangle]
+pub extern "C" fn unrelated_fixture_symbol() {}

crates/mnel-provider-fixture/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "mnel-provider-fixture"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+description = "Deterministic native cdylib fixture for MNEL loader integration tests"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+mnel-provider-api = { path = "../mnel-provider-api" }
+
+[lints]
+workspace = true

crates/mnel-provider-fixture/src/lib.rs

@@ -0,0 +1,86 @@
+//! Deterministic cdylib fixture. Query identity byte zero selects bounded test behavior:
+//! 1 success, 2 oversized length, 3 provider runtime error, and 4 invalid output pointer.
+
+#![allow(unsafe_code)]
+
+use core::ptr;
+
+use mnel_provider_api::{
+    ByteView, Digest32, ProviderDescriptorV1, ProviderQueryV1, ProviderResultV1, ABI_VERSION_V1,
+    AUTHORITY_DIAGNOSTIC_ONLY, OUTPUT_ANOMALY_SCORE, PROVIDER_STATUS_COMPLETED,
+    PROVIDER_STATUS_RUNTIME_ERROR, VERDICT_SEMANTICS_NOT_A_VERDICT,
+};
+
+static PROVIDER_ID: &[u8] = b"fixture.dynamic-provider";
+static PROVIDER_VERSION: &[u8] = b"0.1.0";
+static DECLARATION: Digest32 = Digest32 { bytes: [9; 32] };
+
+static mut DESCRIPTOR: ProviderDescriptorV1 = ProviderDescriptorV1 {
+    abi_version: ABI_VERSION_V1,
+    reserved: 0,
+    provider_id: ByteView {
+        data: PROVIDER_ID.as_ptr(),
+        len: PROVIDER_ID.len(),
+    },
+    provider_version: ByteView {
+        data: PROVIDER_VERSION.as_ptr(),
+        len: PROVIDER_VERSION.len(),
+    },
+    declaration_identity: DECLARATION,
+    implementation_context: ptr::null_mut(),
+    infer: Some(infer),
+};
+
+#[no_mangle]
+pub extern "C" fn mnel_provider_entry_v1() -> *const ProviderDescriptorV1 {
+    &raw const DESCRIPTOR
+}
+
+extern "C" fn infer(
+    _context: *mut core::ffi::c_void,
+    query: *const ProviderQueryV1,
+    result: *mut ProviderResultV1,
+) -> i32 {
+    // This fixture is intentionally a trusted native test artifact. The loader tests
+    // malformed output metadata without asking the fixture to dereference invalid memory.
+    unsafe {
+        if query.is_null() || result.is_null() {
+            return -1;
+        }
+        let mode = (*query).query_identity.bytes[0];
+        (*result).abi_version = ABI_VERSION_V1;
+        (*result).authority = AUTHORITY_DIAGNOSTIC_ONLY;
+        (*result).verdict_semantics = VERDICT_SEMANTICS_NOT_A_VERDICT;
+        (*result).output_kind = OUTPUT_ANOMALY_SCORE;
+        (*result).scalar_value = 0.75;
+        (*result).calibration_band = 1;
+        (*result).flags = 0;
+        if mode == 3 {
+            (*result).status = PROVIDER_STATUS_RUNTIME_ERROR;
+            return -7;
+        }
+        if mode == 4 {
+            (*result).status = PROVIDER_STATUS_COMPLETED;
+            (*result).observation_payload.data = 1 as *mut u8;
+            (*result).observation_payload.len = 1;
+            return 0;
+        }
+        (*result).status = PROVIDER_STATUS_COMPLETED;
+        if mode == 2 {
+            (*result).observation_payload.len = (*result).observation_payload.capacity + 1;
+            return 0;
+        }
+        let payload = b"fixture-observation";
+        if (*result).observation_payload.capacity < payload.len() {
+            (*result).status = PROVIDER_STATUS_RUNTIME_ERROR;
+            return -2;
+        }
+        ptr::copy_nonoverlapping(
+            payload.as_ptr(),
+            (*result).observation_payload.data,
+            payload.len(),
+        );
+        (*result).observation_payload.len = payload.len();
+        0
+    }
+}