feat(validation): add conformance provenance manifest

[seonghobae]

Advances #1077 with the smallest reusable contract slice.

Buyer-visible gap closed

Add fast_mlsirm.conformance, a source-free and content-addressed manifest for capability scope, comparison layer, independent-engine identity, mapping fingerprint, preregistered tolerances, code/fixture/environment provenance, RNG seeds, and license classification.

Boundary

This PR does not import or execute R, Stan, mirt, TAM, ltm, eRm, proprietary binaries, or any external engine. It does not move numerical equations, estimators, scoring, or fit statistics out of Rust. It records evidence metadata only; covered is not construct validity, fairness, or high-stakes approval. Git commit provenance accepts both Git SHA-1 and SHA-256 identifiers; artifact fingerprints remain full SHA-256.

Verification

• python -m pytest -q tests/test_conformance_manifest.py: 18 passed
• Targeted statement/branch coverage for python/fast_mlsirm/conformance.py: 100% (217 statements, 72 branches)
• Ruff, diff check, and AST docstring audit: passed; changed production/test symbols are 100% documented
• Full suite after standard editable install: 4572 passed, 1 known protected-main baseline failure in tests/test_missing_and_extreme_robustness.py::test_rust_and_numpy_agree_on_masked_inputs; the exact tolerance root cause is fixed by pending PR fix(backend): isolate NumPy parity behind reference API #1070 (ce188a2ab882e333400c6c3018183837799f7ae1), not by this contract slice.

Keep Draft until exact-current repository CI, security, coverage/docstring, provenance, and independent review are terminal and clean.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 7e44ddb9-3ab5-4dc7-b716-cd9588094534

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact current head is 7180623d6c4a564474e0749d82991e601595dd51. Re-reviewed the conformance manifest after correcting Git provenance validation: Git SHA-1 and SHA-256 commit IDs are both accepted, artifact fingerprints remain full SHA-256, 18 focused tests pass, targeted statement/branch coverage is 100% (217/217 statements, 72/72 branches), Ruff and AST docstring audit pass. The full-suite baseline failure remains the already-pending #1070 backend-boundary issue. The PR remains Draft pending hosted exact-head checks and independent review.

[seonghobae]

Superseded by the canonical inventory contract in #1081. #1081 owns capability, parameterization, identification, independent-engine, fixture/environment, artifact, layer, and explicit execution-status records without duplicate authority. This PRs additional run-level fields (harness provenance, RNG, tolerance rationale, and raw/normalized output hashes) are retained as the next bounded conformance-evidence slice; they are not silently treated as implemented by #1081. Closing this duplicate avoids two incompatible public conformance schemas.