Ship the reconciliation exfiltration demo and capability-ratchet conformance fixtures

[dinpd]

Parent: #78
Depends on: all core capability-state implementation issues under #78
Related: #7, #54, #55, #56, #57

Outcome

Provide the user-visible completion proof for the monotonic task capability milestone and portable fixtures for equivalent runtime behavior.

Scenario

A scheduled finance reconciliation task may initially read a processor report, query two ledgers, use a vendor-support operation, and post one narrowly typed finance summary. Reading the protected report removes processor/support/external paths before the result reaches the model. Injected ledger text attempts to upload account history through vendor support; both the action gate and required network adapter deny it while the typed finance output succeeds.

Scope

• Runnable local demonstration.
• Hosted integration demonstration.
• Trusted classification and opaque typed-output adapter.
• Parallel stale-call scenario.
• Approval-after-removal scenario.
• Portable positive and negative fixtures.
• Audit/evidence timeline.
• Operator and threat-model documentation.

Non-goals

• Claiming prevention outside declared mediation boundaries.
• General DLP or arbitrary semantic output validation.
• Multiplayer access control.
• Production certification.

Acceptance criteria

• Baseline capabilities match the documented task template.
• The protected report is held until the restricted transition commits.
• Support and external destinations are removed before release.
• Prompt-injection-style support/export attempts are denied.
• A parallel call carrying the old state version is denied or cancelled.
• Approval cannot restore the removed path.
• The typed finance summary accepts only a task-bound opaque result reference and fixed schema.
• The provider mutation/output occurs exactly once under retry.
• Local and hosted fixtures produce compatible state and reason codes.
• The evidence timeline contains no protected report contents, injected text, credentials, or reusable grants.
• Automated tests and operator steps reproduce the full scenario.

Security considerations

The demonstration must state its mediation boundary and remaining risks: compromised approved destinations, overbroad typed output, classification errors, and unmediated paths.