P1: Host conformance: add the H3 version-rejection and crash-isolation scenarios

[macanderson]

Problem

The conformance suite tests providers only — run_conformance (contextgraph-conformance/src/lib.rs:75) drives a provider through handshake/query/shutdown. But read the conformance tables in docs/protocol-surface.md: the highest-stakes rules bind the host:

• C1/C2 — the host MUST NOT auto-enable egress providers or transmit payloads pre-consent
• C4 — the host's HTTP transport MUST force egress
• B2 — the host MUST drop and loudly report budget liars
• H3 — version mismatch MUST be a named error, never a hang
• R3 — frame content MUST be treated as untrusted data, never instructions

Today, "conformant host" means "is contextgraph-host, or trusted to behave like it" — which is precisely the self-attestation model the project rejects for providers (docs/protocol-advantages.md §6: "Documentation is advisory; conformance is verifiable"). The moment a second host exists (a TypeScript agent embedding CGP, say), there is no way to verify it honors the consent gate — and the consent gate is the security story.

Proposal

Grow contextgraph-conformance a host harness: an adversarial reference provider (extending the --misbehave machinery) that the host-under-test is pointed at, plus a scripted scenario runner that asserts observable host behavior:

1. Consent (C1/C2): harness declares egress: true; asserts no query envelope ever arrives before the scenario grants consent. The observable is on the provider side — the harness records what reached it, which is the only trustworthy witness that the payload never left. — landed in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60
2. Budget audit (B2): harness returns frames summing over budget; scenario asserts the host's composed output excludes them and its report names the provider. — landed in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60 (B4 flood-frames and C6 receipts shipped alongside)
3. Version rejection (H3): harness acks with contextgraph/2.0; assert a named error, no hang (bounded by timeout). — still missing
4. Crash isolation: harness dies mid-query; assert the host's overall fan-out still completes. — still missing
5. R3 (untrusted content): full prompt-rendering can't be black-box tested, but the harness can serve frames containing instruction-shaped content and the scenario can assert the host's compose API (see the prompt-composition issue) delimits rather than inlines. Document the residual gap honestly. — landed in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60 as the R3-delimiting check; the R3-breakout residual is honestly recorded in SPEC §11.1 and tracked in P2: Reference prompt-composition module: global budget, cross-provider dedup, injection-resistant rendering #15

This directly serves the GOVERNANCE.md freeze criterion ("checks are agreed to fully enforce the documented conformance requirements" — impossible while host-binding rules have no check) and makes multi-host adoption safe.

Acceptance criteria

• contextgraph-conformance exposes a host-harness mode (contextgraph-inspect --as-provider or a library API) — landed in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60 as run_host_conformance plus a contextgraph-inspect host --json subcommand. The --as-provider framing was superseded: the harness drives adversarial providers in process rather than inverting the CLI, which is what makes the "no envelope ever arrived" observation trustworthy.
• Scenarios for C1/C2, B2, H3, crash isolation, with per-check evidence strings — six checks landed in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60 (B2, B4, C1/C2, C6, F5-bytes, R3-delimiting), each asserting the host catches a bad provider and accepts a good one. H3 version-rejection and crash-isolation are the two survivors — this issue is now exactly those.
• contextgraph-host itself runs green in CI — the reference host proves its own claims — landed in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60 (host-conformance.sh, wired into the workflow)
• Spec's conformance section marks each host rule with its now-existing check — landed in Pre-freeze: normative completeness + enforcement + host conformance (top-10 build) #60 (SPEC §11.1, which also narrows the residual honestly to C4/C7/C8 transport — see P1: Implement C7/C8 in the reference HTTP transport: auth-carrying connect API, TLS refusal, credential redaction #13 — and R3-breakout)

[macanderson]

Re-verified 2026-07-26 against origin/main @ 1ee9b1c.

What landed (PR #60): the core of it. run_host_conformance, an inspect host --json subcommand, and a CI-wired script, with SPEC §11.1 naming the check behind each rule. Six checks exist, so "conformant host" is now a checkable claim rather than an assertion.

What survives: the proposed H3 version-rejection scenario and the crash-isolation scenario are both absent, and C4/C7/C8 remain self-declared rather than probed — which is the same self-attestation pattern §11.1 rejects, still present in the host suite.

Recommended scope: those two scenarios plus the self-declared C4/C7/C8 residual. Drop the --as-provider framing from the body — the in-process host-harness design that shipped supersedes it.