[FLO-13.3] Prove compatibility, artifact, and provider-failure scenarios #30

Parent: #13
Depends on: #28, #29, #25
Coordinates with: #3

Outcome

Use the versioned scenario contract and hermetic provider kit to prove Flow fails closed across compatibility, contract, artifact, and provider-evidence boundaries.

This checkpoint covers acceptance and refusal around one execution boundary. Lifecycle recovery and resume are owned by the next checkpoint.

Required scenario families

Compatibility and contract

• compatible, unavailable, missing, stale, future, and mismatched provider/capability versions;
• valid and invalid manifests, provider locks, execution reports, provenance, output declarations, and schema versions;
• configuration, publisher, executable, capability, authorization, and integrity disagreement;
• deterministic conflict and fallback behavior, with fallback forbidden after invocation begins.

Artifact acceptance

• complete, partial, missing, extra, stale, corrupt, and contradictory artifact sets;
• absolute paths, parent traversal, path escape, symlinks, file/directory mismatch, duplicate identity, digest conflict, and undeclared output;
• provider success or exit zero followed by failed Flow-owned validation.

Diagnostics and privacy

• typed, actionable explanations naming the failing boundary;
• bounded and redacted operational evidence;
• canaries proving argv, environment, secrets, and private content do not leak into portable results.

Acceptance criteria

• Every scenario has a stable ID, deterministic input, expected typed outcome, and inspectable normalized evidence.
• Invalid provider or artifact evidence cannot construct accepted execution.
• Observed empty, unavailable, incomplete, unsupported, invalid, and failed states remain distinct.
• Fallback and conflict behavior match the accepted [Extensions] Define the federated plugin, adapter, and hook contract #7/[FLO-3.2] Specify external process transport and provider trust boundaries #25 contracts.
• Diagnostics identify the recovery boundary without exposing sensitive raw evidence.
• Positive and negative fixtures run hermetically in the PR tier with explicit budgets.
• Scenario coverage and residual gaps are machine-readable and documented.

Non-goals

• Durable interruption, retry, checkpoint, or resume.
• Real provider algorithms or broad raw-format coverage.
• Publication, upload, signing, or destructive mutation.

Verified closeout — 2026-09-25

PR #61 merged as dfb16b347975e3292dc2928c8c48463f51dcf6d1. Default-branch CI passed on that exact commit. The 81-case acceptance suite, two fresh-workspace repetitions, Rust 1.85/stable checks, and repository validators are complete. #49 now supplies durable state before #31 extends lifecycle coverage. #62 owns the later documentation showcase.