feat: complete the verifiable research core

.dockerignore

@@ -0,0 +1,7 @@
+node_modules
+.git
+evidence
+reports
+**/dist
+**/*.tsbuildinfo
+*.sqlite*

.env.example

@@ -7,7 +7,5 @@ ALD_DATABASE_PATH=./evidence/ald.sqlite
 ALD_LOG_LEVEL=info
 ALD_BASE_NETWORK=base-sepolia
 
-# Paths and endpoints are intentionally blank.
-ALD_KEY_DIR=
-ALD_BASE_RPC_URL=
-ALD_ANCHOR_KEY_FILE=
+# Secret values and secret file paths are injected only by `si fort run`.
+# They are intentionally absent from this file.

.github/workflows/book-integrity.yml

@@ -1,47 +1,77 @@
-name: Research book integrity
+name: Consolidated integrity suite
 
 on:
   pull_request:
-    paths:
-      - RESEARCH.md
-      - research-book.html
-      - book/**
-      - scripts/build-research-book.mjs
-      - scripts/research-book-entry.js
-      - package.json
-      - package-lock.json
-      - vitest.config.ts
   push:
     branches:
       - main
-    paths:
-      - RESEARCH.md
-      - research-book.html
-      - book/**
-      - scripts/build-research-book.mjs
-      - scripts/research-book-entry.js
-      - package.json
-      - package-lock.json
-      - vitest.config.ts
 
 permissions:
   contents: read
 
 jobs:
-  verify-book:
+  consolidated-suite:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
+      - name: Set up Homebrew
+        uses: Homebrew/actions/setup-homebrew@49d03f1bf5d455a413dfbdf99e6718054a4cd975
+
+      - name: Install Node.js and pnpm with Homebrew
+        run: |
+          brew install node@24 pnpm
+          echo "$(brew --prefix node@24)/bin" >> "$GITHUB_PATH"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Audit dependency graph
+        run: |
+          mkdir -p artifacts
+          pnpm audit --audit-level=high --json > artifacts/pnpm-audit.json
+
+      - name: Run consolidated suite with timing
+        run: |
+          mkdir -p artifacts
+          /usr/bin/time -v pnpm run check:ci 2> artifacts/consolidated-runtime.txt
+
+      - name: Upload test and runtime evidence
+        if: always()
+        uses: actions/upload-artifact@v7
         with:
-          node-version: 22.13.0
-          cache: npm
+          name: consolidated-suite-evidence
+          path: artifacts/
+          retention-days: 30
+
+  mode-r:
+    runs-on: ubuntu-latest
+    needs: consolidated-suite
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v7
+
+      - name: Set up Homebrew
+        uses: Homebrew/actions/setup-homebrew@49d03f1bf5d455a413dfbdf99e6718054a4cd975
+
+      - name: Install Node.js and pnpm with Homebrew
+        run: |
+          brew install node@24 pnpm
+          echo "$(brew --prefix node@24)/bin" >> "$GITHUB_PATH"
 
       - name: Install dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
+
+      - name: Run real-container Mode R suite with timing
+        run: |
+          mkdir -p artifacts
+          /usr/bin/time -v pnpm run test:mode-r 2> artifacts/mode-r-runtime.txt
 
-      - name: Verify manuscript and book assets
-        run: npm test
+      - name: Upload Mode R runtime evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: mode-r-suite-evidence
+          path: artifacts/
+          retention-days: 30

.gitignore

@@ -1,6 +1,7 @@
 node_modules/
 dist/
 coverage/
+.artifacts/
 *.tsbuildinfo
 .env
 .env.*

CONFIGURATION.md

@@ -1,8 +1,9 @@
 # Configuration
 
 Runtime configuration is loaded through `@ald/config`. Environment variables contain
-only operational values and paths. Private key material and API tokens must never be
-stored directly in environment files committed to this repository.
+only non-secret operational values or short-lived file paths materialized by `si fort`.
+Private key material, signer seeds, RPC credentials, and API tokens must never be
+stored directly in environment variables or repository files.
 
 ## Variables
 
@@ -13,32 +14,50 @@ stored directly in environment files committed to this repository.
 | `ALD_DEPLOYMENT_MODE` | `prototype` or `research-grade` | `prototype` | No |
 | `ALD_EVIDENCE_DIR` | Path | `./evidence` | No |
 | `ALD_DATABASE_PATH` | Path | `<evidence>/ald.sqlite` | No |
-| `ALD_KEY_DIR` | Path | `<evidence>/keys` | Yes in research-grade mode |
+| `ALD_RUN_SIGNER_SEEDS_JSON_FILE` | Fort-materialized path | None | Yes in research-grade mode |
 | `ALD_LOG_LEVEL` | `debug`, `info`, `warn`, or `error` | `info` | No |
+| `ALD_ANCHOR_CLASS` | `simulated` or `public-chain` | `simulated` | No |
 | `ALD_BASE_NETWORK` | `base-sepolia` or `base-mainnet` | `base-sepolia` | No |
-| `ALD_BASE_RPC_URL` | URL | None | Required only when anchoring is enabled |
-| `ALD_ANCHOR_KEY_FILE` | Path | None | Required only when anchoring is enabled |
+| `ALD_BASE_RPC_URL_FILE` | Fort-materialized path | None | Required only for an amended `public-chain` profile |
+| `ALD_ANCHOR_KEY_FILE` | Fort-materialized path | None | Required only for an amended `public-chain` profile |
+| `ALD_ALLOW_MAINNET_ANCHORING` | `true` or unset | unset | Must be `true` (together with an explicit publisher opt-in) before any Base mainnet transaction is submitted |
 
 ## Secret Handling
 
-- Store private keys in files outside the repository and provide only their paths.
+- Store all secret values only in the encrypted `safe` repository and access them
+  through `si fort`; do not create ad-hoc secret files.
 - Do not commit `.env` files. The repository ignores `.env` and `.env.*`.
-- Use a dedicated, low-balance anchor wallet.
-- Run `npm run scan:secrets` before committing.
-- Research-grade mode fails fast unless `ALD_KEY_DIR` is explicitly configured.
+- The approved research `RunConfig` defaults to `anchorClass: "simulated"` and uses
+  no wallet, RPC credential, faucet, token, or fee.
+- If a future amendment permits `anchorClass: "public-chain"`, use a dedicated,
+  low-balance anchor wallet and independent verification endpoint.
+- Run `pnpm run scan:secrets` before committing.
+- Research-grade mode fails fast unless Fort materializes
+  `ALD_RUN_SIGNER_SEEDS_JSON_FILE` in files mode.
+- Mainnet anchoring is double opt-in: the anchor publisher must be constructed with `allowMainnet: true` and `ALD_ALLOW_MAINNET_ANCHORING=true` must be set. The current governance policy separately prohibits all public-chain research transactions.
+- The signer material is a versioned JSON envelope containing an exact run-id map
+  and all six Ed25519 signer domains. The Nursery reads its mode-0600 regular file
+  once; the path is then removed from the child environment. Learner containers
+  never receive the path or file mount. Seeds never enter the evidence store or a
+  bundle.
 
 ## Examples
 
 Prototype defaults require no environment variables:
 
 ```powershell
-npm run build
+pnpm run build
 ```
 
-Research-grade mode requires an explicit isolated key directory:
+Research-grade Mode R uses Fort file materialization:
 
-```powershell
-$env:ALD_DEPLOYMENT_MODE = 'research-grade'
-$env:ALD_KEY_DIR = 'C:\ald-secrets\keys'
-npm run build
+```sh
+si fort run --repo agentic-language-development --env dev \
+  --keys ALD_RUN_SIGNER_SEEDS_JSON --mode files -- \
+  pnpm run test:mode-r-study
 ```
+
+The encrypted value must authorize each exact study run id. The qualification
+command can run without credentials using ephemeral in-memory signers, but that
+path is explicitly non-confirmatory. Simulated funding removes the wallet/RPC
+dependency; it does not remove the persistent per-run signer or registration gates.