Make server codec counterfactual proofs declarative

[rmcdaniel]

Problem

Server codec counterfactual validation currently accepts candidate-authored PHP proof tests after scanning them with a partial tokenizer and denylists for branching, callbacks, process APIs, reflection, and other capabilities. Each newly discovered PHP execution shape can require another policy exception or blacklist entry even though the evidence contract only needs a fixed operation: invoke one claimed server boundary and assert the candidate/base/sentinel/revert outcomes. This couples regression-evidence integrity to incomplete PHP source classification and makes the guard costly to extend safely.

How to fix

Define a constrained, versioned counterfactual proof format or generate the executable proof from trusted validator-owned inputs. The validator-owned harness should select the fixture, instrument the claimed boundary, collect attestation, and run candidate, base, causality-sentinel, and boundary-revert checks without using arbitrary candidate-authored PHP control flow as the proof contract. Keep untrusted pull-request isolation at the CI runner boundary.

Acceptance criteria

• A versioned declarative proof describes the fixture, claimed boundary, invocation, and expected assertion without arbitrary proof-side branching or dynamic dispatch.
• A trusted generated or shared PHP harness owns fixture substitution and boundary attestation for every counterfactual revision.
• Proof acceptance no longer depends on enumerating PHP callback APIs, process classes, reflection entry points, or other executable capabilities.
• Candidate/base, causality-sentinel, boundary-revert, one-proof-per-boundary, executable-inventory parity, and fixture/proof immutability checks remain fail closed.
• Focused policy tests show that an unrelated newly available PHP callable cannot change proof attribution and does not require a new denylist entry.

Delete when server codec counterfactual evidence is expressed through the constrained versioned contract and the validator no longer source-classifies arbitrary candidate-authored PHP to establish causality.

[rmcdaniel]

Product-owner scope decision: defer this proof-contract redesign until after 2.0 stable. The current release gate is bounded to the reproduced causality cases, which are covered by focused tests, while arbitrary untrusted-code isolation remains the disposable CI runner boundary. Reopen for implementation when extending the counterfactual proof format or when a concrete attribution bypass is reproduced; do not enumerate additional PHP capabilities speculatively.