WallGuard clean-room synthesis path

[mdheller]

Parent: SocioProphet/sociosphere#392
Depends on: SocioProphet/policy-fabric#86
Related: SocioProphet/sherlock-search#60

Purpose

Define and implement the Holmes-side clean-room synthesis path for WallGuard.

Holmes may synthesize across sources only when WallGuard permits the source/destination combination. When direct use is forbidden, Holmes should support clean-room release patterns that preserve permitted abstractions while blocking restricted source leakage.

Required behaviors

• consume wall-filtered retrieval results only
• preserve source/resource labels through investigation state
• refuse cross-wall synthesis when policy denies it
• produce clean-room release requests when sanitized output is possible
• emit/reference WallDecisionReceipts for sensitive synthesis decisions

Fixtures

• same-wall synthesis allowed with receipt reference
• cross-wall synthesis denied
• clean-room summary generated from permitted abstractions only
• contaminated investigation state cannot be reused in unrelated matter
• missing wall context fails closed for restricted synthesis

Acceptance criteria

• Holmes never treats semantic similarity as permission.
• Holmes does not become policy authority.
• Clean-room output includes source-label and decision-receipt metadata.
• No dependency on noncanonical or unlicensed repos.

[mdheller]

Completed by merged PR #13.

Evidence:

• PR: Add WallGuard clean-room synthesis contract #13 — Add WallGuard clean-room synthesis contract
• Merge SHA: beb2f63fd25c00a36f0e09549eb36d17da498c01
• Verified head: 0e62c88d2a28f18ea144dc482bb087b9677689fc
• Scope: contract/fixture validation only; no live synthesis, runtime policy evaluation, model invocation, or artifact export
• CI: validate succeeded before merge

Landed surfaces:

• schemas/wallguard-clean-room-synthesis.schema.json
• examples/wallguard-clean-room-synthesis.valid.json
• examples/wallguard-clean-room-synthesis.cross-wall.rejected.json
• examples/wallguard-clean-room-synthesis.bad-clean-room.rejected.json
• tools/validate_wallguard_clean_room_synthesis.py
• make validate-wallguard-clean-room-synthesis