OIC-SEMANTIC-001: bounded synthetic candidate extraction

[veraxis-protocol]

Scope

Implements the first owner-authorized bounded semantic slice: deterministic
Source → Candidate Normative Unit extraction for the three synthetic Northstar
sources only.

• Base: 914830ceec70bde17004d2ccbbb13218ca44a89b
• Initial producer commit: dddb0ab93165a2f1e098a3c02b114180eaabf373
• Final producer head: bad78b81e584a5d48c67bbd8eeefc67cbc3b9296
• Synthetic merge composition: 087f88667c0ea8c3be7561ab91ea07b544d28f69
• Owner decision: docs/decisions/OIC-OWNER-DECISION-004.md
• Authorized production path: src/oic/candidate_extraction.py
• Sources: SYN-NS-GOV-1, SYN-NS-PROC-1, SYN-NS-AMEND-2

Observed bounded result

• CandidateNormativeUnit count: 14
• Per source: 11 / 1 / 2
• All candidates: interpretation_state=extracted,
  epistemic_state=uncertain, confidence=null
• Current-source candidates: lifecycle_state=proposed
• Stale P1: visible with lifecycle_state=superseded
• G5 and A1 retain distinct source anchors and unit IDs
• CA-3 is not semantically processed
• Unsupported normative-looking text yields an explicit diagnostic and no unit

The expected fixture is owner-specified preimplementation expectation, not an
observed benchmark result and not independently adjudicated.

Local evidence

• make verify: schema 9/9; bootstrap 52/52; owner-open gate verified;
  manifest remains INCOMPLETE / exit 3
• focused SEMANTIC-001/gate tests: 39 passed
• full pytest: 1272 passed, 1 intentional missing-local-receipt skip
• make falsify: 4/4 actual selected tests passed
• mypy: success
• Ruff lint and format: success
• pip check: success
• pip-audit: no known vulnerabilities (editable OIC distribution skipped)
• SBOM generation: success; no committed SBOM drift
• isolated wheel build/install/import/CLI smoke: success
• git diff --check: clean
• local compose: not run because Docker is unavailable; GitHub compose-validation
  supplies the required final evidence

GitHub evidence

• PR CI run: 33227057131
• Run URL: https://github.com/veraxis-protocol/Institutional-Compiler/actions/runs/33227057131
• Bound head: bad78b81e584a5d48c67bbd8eeefc67cbc3b9296
• Bound base: 914830ceec70bde17004d2ccbbb13218ca44a89b
• Executed synthetic merge composition: 087f88667c0ea8c3be7561ab91ea07b544d28f69
• Final jobs: advisory-scan, typecheck, dependency-review, sbom, test,
  schema-validation, lint, compose-validation, bootstrap-integrity — all SUCCESS
• GitHub pytest: 1272 passed, 1 intentional missing-local-receipt skip
• Global manifest: INCOMPLETE / exit 3, as required

Explicit boundaries

Institutional admission, Institutional IR, OCE, Rego/policy-target generation,
runtime authorization, OPA/Cedar/OpenFGA/Cerbos invocation, ZTL runtime, VEIP
runtime, CA-3 extraction, network/model/API dependencies, production claims,
benchmark claims, licensing changes, and corpus-rights changes are absent and
unauthorized. Global manifest status remains INCOMPLETE.

CI GREEN IS EVIDENCE, NOT ACCEPTANCE

NOT SELF-ADJUDICATED