scientific(coverage): bind shard provenance before calibration evidence assembly #734

Finding

#733 now provides an owner-issued per-replication executor, bounded shard execution, and final schema-v4 evidence assembly. The remaining execution/recovery gap is between those two boundaries: execute_coverage_calibration_shard(...) returns only a bare Vec<CoverageCalibrationReplicationOutcome>, while assemble_coverage_calibration_evidence_v1(...) accepts a bare outcome slice plus a caller-supplied source_head.

That means a long-running/resumed 10,000-DGP study can persist or concatenate shard results without carrying the source/scenario provenance that produced each shard. A caller can therefore mix otherwise valid ordinal outcomes produced by different source heads (or an earlier scenario implementation), then pass one current source_head at final assembly. Exact ordinal/permutation validation and the outcome digest still pass because neither can prove that all outcomes came from the claimed execution provenance.

This is not merely external storage authentication. The application owner itself currently discards execution provenance before the resume/persistence boundary, so the final record can state a source/scenario identity that was never bound to each constituent shard.

Required RED / repair

• introduce a typed shard result owned by analysis_engine that carries a versioned shard schema, half-open ordinal range, simulation scenario ID/fingerprint, exact lowercase source head, and the indexed outcomes produced for that range;
• make the shard constructor/executor derive scenario identity/fingerprint from CoverageCalibrationSimulationDesign rather than accepting caller strings;
• validate source-head shape before execution/persistence and require the returned outcome identities to match the declared half-open range exactly;
• provide deterministic JSON serialization and an immutable digest for the shard record so resumed/distributed execution can compare persisted shard identity without relying on filenames or completion order;
• change final v1 evidence assembly to consume shard records, reject mixed source heads/scenario identities/fingerprints, reject overlapping/gapped/out-of-range shard ranges, and only then flatten the exact indexed outcomes into the existing validation_core evidence owner;
• keep validation_core as the owner of full 0..N permutation, denominator, coverage, MCSE, percentile, and final evidence arithmetic; do not duplicate those calculations in analysis_engine;
• do not claim that a digest authenticates external storage or the build environment. It is an immutable application-level provenance binding only.

Acceptance boundary

This repair makes the declared 10,000-DGP study shard/resume path scientifically reconstructable. It does not execute the study, define a post-hoc numerical-failure threshold, replace artifact signing/attestation, satisfy hosted gates, promote #680, or create a release.

Refs #639 #680 #725 #726 #728 #731 #732 #733.