Publish the Aletheia-facing identity and refusal contract and require non-vacuous consumer conformance

[forkwright]

Scope

Priority: P1 before provider integration; bounded contract/qualification child of #150. Define the producer-owned model identity, capability and refusal wire contract that Aletheia is currently waiting for, and make consumer conformance fail rather than silently skip when invoked as a Logismos qualification gate.

This issue does not demand that the entire future server or every planned modality be implemented at once. It owns the first text/embedding/rerank contract and the evidence needed before an intentional provider transition.

Evidence

• crates/hermeneus/src/lib.rs:1-33 is explicitly a scaffold. It names chat/SSE, embeddings, rerank and model discovery, with admission delegated to sched; no executable protocol definition is present at audited Logismos commit bb1e7468c3397d2c74ec27f5798d69bb9df3bd81.
• Aletheia crates/hermeneus/tests/wire_conformance.rs explicitly lists Logismos NotResident, CapacityExceeded, StaleGrant and PrivacyMismatch wire shapes as undefined and pending the producer. It correctly declines to invent them client-side.
• That consumer suite separates chat, embedding and rerank endpoints and currently treats an unavailable endpoint as a reported skip followed by a successful test return. That is useful optional development behavior, but is not proof that Logismos served any request.
• Aletheia crates/nous/src/config.rs tracks the producer-dependent move from a bare served model name to artifact-bound model identity in forkwright/aletheia#7223.
• Logismos already has richer internal facts: verified artifact/tokenizer identities, typed native errors, scheduler grant identity and operation state. These should be translated, not independently reconstructed in each client.

Why this matters

An OpenAI-shaped success response is not enough to establish replacement equivalence. A served alias can select different bytes; equal embedding dimensions can represent different spaces; a rerank score can mean a raw logit difference rather than a probability; an arbitrary retryable HTTP status can cause the consumer to repeat work after a semantic refusal.

A passing optional suite with every live request skipped also cannot authorize a cutover. The consumer's deliberate pending state is a concrete integration dependency, not an invitation to guess the producer's protocol.

Required contract

• One versioned producer schema for served identity, exact artifact/tokenizer/template identity where applicable, supported operations and explicit limits. Reports remain observations, not transferable execution capabilities.
• Stable semantic refusals with defined transport representation and retry/recovery meaning. Distinguish unknown/unsupported model or format, not resident, capacity refused, stale grant and privacy mismatch from transport failure and internal failure.
• Explicitly advertised text-only/greedy or other currently supported generation capabilities; unsupported sampling, tools, structured output, streaming or modalities must not be silently ignored.
• Exact embedding dimension/normalization and semantic-space identity; rerank output ordering and score meaning must match the chosen consumer contract. Changing a space requires the separate reindex/rollback decision, not just a model-alias update.
• Aletheia keeps workload/session/privacy ownership and its existing deployment-target policy. Logismos cannot relax that policy based on a request hint or a local-looking URL. Host service lifecycle remains external.
• Shared semantics across any implemented transports, rather than a second admission/error/model registry per transport.

Done when

• Aletheia can implement its identity/refusal mapping from a producer-owned contract, with an explicit compatibility/version policy and no guessed status codes.
• Hardware-free consumer/provider fixtures exercise supported responses, every semantic refusal, unknown contract versions and identity mismatches through the real client mapping.
• A dedicated required qualification mode fails on an absent endpoint, wrong model identity, missing operation or skipped live assertion. Optional developer-mode skipping may remain, but produces a different evidence class.
• Chat/SSE termination and cancellation, embedding batch/dimension contracts and rerank order/score semantics are checked for the exact advertised capabilities. Unimplemented capabilities fail explicitly rather than being treated as successful compatibility.
• The qualification receipt identifies the tested endpoint/producer revision, exact selected artifacts and actual checks executed; it contains no credentials or private prompts.
• Running this suite never starts/stops a service, retargets a provider, changes a host mode or automatically promotes the candidate.

Related work

#173 owns backend-qualified resource admission and execution authorization; #174 selective residency retirement; #46 GPU GDN; #10/#11 legacy Stella performance/provenance. This issue coordinates with Aletheia's existing consumer work rather than creating a second provider client or copying private deployment inventory into this repository.