G0~G8 성과·동맹 측정 OS 작업 일괄 고정

8월 7일까지 워킹트리에만 남아 있던 미커밋 작업을 커밋한다. 여러 사본
폴더(worktree·clone)에 흩어져 있던 중간 스냅샷을 정리하기 전에 원본을
git 이력으로 고정하는 것이 목적이다.

- contracts/routes/services: measurement, outcome_trajectory, rupture_repair,
  deliberate_practice, calibration_transfer, supervision_research,
  multimodal_alliance, continuous_improvement 계열 신규 모듈과 테스트
- infra/db/init: 07~16 마이그레이션(측정 기반~calibration transfer 실행)
- apps/web: 세션 리뷰 카드·관리 화면·E2E 스펙 추가
- docs/ops: G0~G8 라이브 통합·배포·롤백 증거 문서와 evidence JSON/PNG
- scripts: smoke·ledger·릴리스 에이전트·NAS 프리뷰 운영 스크립트

engine.public 로그 .bak과 apps/web/test-results 산출물은 커밋에서 제외했다.

scripts/test_outcome_os_release_manifest.py

@@ -0,0 +1,93 @@
+"""Fail-closed unit tests for Outcome OS release artifact binding."""
+
+from __future__ import annotations
+
+import importlib.util
+import unittest
+from pathlib import Path
+
+
+CHECKER_PATH = Path(__file__).with_name("check-outcome-os-release-manifest.py")
+
+
+def load_checker():
+    spec = importlib.util.spec_from_file_location(
+        "check_outcome_os_release_manifest",
+        CHECKER_PATH,
+    )
+    if spec is None or spec.loader is None:
+        raise RuntimeError("release manifest checker could not be loaded")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+class ReleaseManifestArtifactBindingTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.checker = load_checker()
+
+    def test_counts_each_git_file_section(self) -> None:
+        patch = (
+            b"diff --git a/one.txt b/one.txt\n"
+            b"--- a/one.txt\n+++ b/one.txt\n"
+            b"diff --git a/two.txt b/two.txt\n"
+            b"--- a/two.txt\n+++ b/two.txt\n"
+        )
+        self.assertEqual(2, self.checker.count_patch_files(patch))
+
+    def test_satisfied_gate_rejects_stale_patch_sha(self) -> None:
+        current_sha = "a" * 64
+        stale_sha = "b" * 64
+        errors: list[str] = []
+        self.checker.validate_satisfied_gate_evidence(
+            {
+                "mixed-files-cleared": {
+                    "evidence": f"SHA-256 {stale_sha}; clean apply passed",
+                },
+            },
+            {"patch_sha256": current_sha},
+            errors,
+        )
+        self.assertEqual(
+            [
+                "release gate mixed-files-cleared evidence does not reference "
+                "the current release_assembly.patch_sha256"
+            ],
+            errors,
+        )
+
+    def test_satisfied_gate_accepts_current_patch_sha(self) -> None:
+        current_sha = "c" * 64
+        errors: list[str] = []
+        self.checker.validate_satisfied_gate_evidence(
+            {
+                "mixed-files-cleared": {
+                    "evidence": f"SHA-256 {current_sha}; clean apply passed",
+                },
+            },
+            {"patch_sha256": current_sha},
+            errors,
+        )
+        self.assertEqual([], errors)
+
+    def test_public_gates_require_evidence(self) -> None:
+        self.assertEqual(
+            {
+                "mixed-files-cleared": "satisfied-by-verified-release-patch",
+                "g8-agentic-runtime-promotion": "satisfied-by-isolated-nas-release",
+                "g8-public-proof": "satisfied-by-public-release",
+                "aos-011-public-deployment-proof": "satisfied-by-public-release",
+                "aos-012-final-ssot-sync": "satisfied-by-final-checkers",
+            },
+            self.checker.REQUIRED_SATISFIED_GATES,
+        )
+        self.assertEqual("g7-external-proof", self.checker.G7_GATE_ID)
+        self.assertEqual(
+            {"blocked", "satisfied-by-validated-g7-proof"},
+            self.checker.G7_ALLOWED_STATUSES,
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()