G0~G8 성과·동맹 측정 OS 작업 일괄 고정

8월 7일까지 워킹트리에만 남아 있던 미커밋 작업을 커밋한다. 여러 사본
폴더(worktree·clone)에 흩어져 있던 중간 스냅샷을 정리하기 전에 원본을
git 이력으로 고정하는 것이 목적이다.

- contracts/routes/services: measurement, outcome_trajectory, rupture_repair,
  deliberate_practice, calibration_transfer, supervision_research,
  multimodal_alliance, continuous_improvement 계열 신규 모듈과 테스트
- infra/db/init: 07~16 마이그레이션(측정 기반~calibration transfer 실행)
- apps/web: 세션 리뷰 카드·관리 화면·E2E 스펙 추가
- docs/ops: G0~G8 라이브 통합·배포·롤백 증거 문서와 evidence JSON/PNG
- scripts: smoke·ledger·릴리스 에이전트·NAS 프리뷰 운영 스크립트

engine.public 로그 .bak과 apps/web/test-results 산출물은 커밋에서 제외했다.

scripts/test_measurement_provenance_tools.py

@@ -0,0 +1,87 @@
+"""Static fail-closed guards for G0 provenance and migration proof tools."""
+
+from __future__ import annotations
+
+import importlib.util
+import unittest
+from pathlib import Path
+from types import ModuleType
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def _load(name: str, relative_path: str) -> ModuleType:
+    spec = importlib.util.spec_from_file_location(name, ROOT / relative_path)
+    if spec is None or spec.loader is None:
+        raise AssertionError(f"could not load {relative_path}")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+class ProvenanceCensusContractTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.module = _load(
+            "measurement_provenance_census",
+            "scripts/check-measurement-provenance-census.py",
+        )
+
+    def test_registry_covers_central_and_table_local_producers(self) -> None:
+        self.assertIn("app.measurement_event", self.module.KNOWN_PRODUCER_TABLES)
+        self.assertIn(
+            "app.multimodal_axis_measurement",
+            self.module.KNOWN_PRODUCER_TABLES,
+        )
+        self.assertIn(
+            "app.calibration_transfer_execution_event",
+            self.module.KNOWN_PRODUCER_TABLES,
+        )
+        self.assertEqual(
+            self.module.TABLE_SOURCE_KIND_OVERRIDES[
+                "app.multimodal_axis_measurement"
+            ],
+            {"model_inferred_text", "model_inferred_voice"},
+        )
+
+    def test_dynamic_sql_identifier_rejects_injection(self) -> None:
+        self.assertEqual(self.module._identifier("measurement_event"), '"measurement_event"')
+        with self.assertRaises(self.module.CensusError):
+            self.module._identifier("measurement_event;drop table")
+
+
+class MigrationRehearsalContractTest(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.module = _load(
+            "measurement_migration_rehearsal",
+            "scripts/rehearse-measurement-migration.py",
+        )
+
+    def test_temporary_database_scope_is_narrow(self) -> None:
+        value = self.module.TEMP_DATABASE_PREFIX + "0123abcdef"
+        self.assertEqual(self.module._database_identifier(value), f'"{value}"')
+        with self.assertRaises(self.module.RehearsalError):
+            self.module._database_identifier("vignette")
+
+    def test_rehearsal_applies_all_prerequisites_before_g0(self) -> None:
+        self.assertEqual(
+            self.module.BASE_MIGRATIONS,
+            (
+                "01_extensions.sql",
+                "02_schema.sql",
+                "03_kb.sql",
+                "04_audit_eval_rls.sql",
+                "05_runtime_auth.sql",
+                "06_session_evaluation.sql",
+            ),
+        )
+        self.assertEqual(
+            self.module.G0_MIGRATION,
+            "07_measurement_foundation.sql",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()