Milestone 3: implement canonical Python and OPA path

[anthfuller]

F7-LAS Pull Request

Summary

Implements Milestone 3: one deterministic, offline, fail-closed Python + OPA workflow across F7-LAS Layers 1–7. The workflow emits the canonical v1 records, executes one bounded synthetic read-only action, preserves denial evidence, and enforces policy obligations and complete action binding.

Reviewed head: 2a2f051d4c10516664f2087e5e96a5626509aebe.

Alignment With F7-LAS

• Layer 1 — System Prompt
• Layer 2 — RAG / Grounding
• Layer 3 — Planner / Controller
• Layer 4 — Tools & Integrations
• Layer 5 — Policy Engine
• Layer 6 — Sandboxed Execution
• Layer 7 — Monitoring & Evaluation
• Supplemental Layer S — Supply Chain
• Documentation / Examples
• Appendix / Supporting Materials

Justification

Adds the roadmap's canonical executable reference path using real offline OPA 1.20.2 evaluation. OPA and the executor enforce the action digest, arguments, complete target, decision reference, and supported obligations. Permit succeeds with exit status 0; denial preserves a valid evidence set and returns exit status 3.

Testing / Validation

• Official OPA 1.20.2 strict policy validation passed.
• 32 tests passed, including real permit/deny evaluation and negative binding/obligation cases.
• Prompt, policy, allowlist, settings, and canonical-contract validators passed.
• Golden dataset: 4 scenarios, 1.00 success rate.
• CFF, Markdown links/fences, workflow YAML, and whitespace checks passed.
• Whitepaper hash remains unchanged.

Risks / Considerations

This remains a prototype reference implementation for one fixed synthetic action. Layer 6 is an in-process executor that makes no network calls; it is not an OS/container sandbox or an enforced network-isolation boundary. Explicit approval binding remains Milestone 4 scope. No production integrations or actions are included.

Additional Notes

Independent review approved this exact head for PR creation. Do not merge until GitHub Actions passes and final PR review approves the unchanged head.