Consume vidimus==0.1.2: shim the three integrity scripts (byte-transparent)

[MaxGhenis]

Makes the three integrity scripts thin shims over the published vidimus==0.1.2 package, byte-transparent, per the green-lit approach. Extraction home: TheAxiomFoundation/vidimus (the ledger's release-chain verifier + append gate were extracted from these exact scripts and proven byte-equivalent by a 57-test differential harness).

Base: codex/thesis-ledger-facts @ 1f92bf4 (after the base-gate provisioning landed in #107–#109). The three extracted scripts are byte-identical between 9dafe81 and this base, so vidimus 0.1.2 is their exact mirror.

What changes

• scripts/canonical_json.py, scripts/verify_release_chain.py, scripts/check_thesis_facts_append.py become thin shims: import vidimus + the committed pins, reproduce the exact CLI, and re-export every public name other modules/tests import (including the old no-spec signatures for existing callers; cut_release_manifest.py binds cleanly). ~2,160 lines of duplicated implementation removed.
• scripts/vidimus_pins.py (new): this repo's LEDGER_SPEC / APPEND_GATE_SPEC — trust anchors stay committed in this tree, per the package's pins-in-consumer-code rule.
• vidimus==0.1.2 added to [project.dependencies]; uv.lock pins it by version + sha256 (sdist ef0f798e…, wheel f6662a73…).
• Each shim header states the standing rule: any vidimus upgrade requires a fresh byte-equivalence proof at this repo's then-current pin before the bump lands.

How it's proven (all six of your constraints)

• (a) version+hash lockfile pin ✓, re-prove-on-upgrade rule in shim headers ✓
• (b) post-shim transparency differential — tests/test_vidimus_shim_transparency.py: the shimmed scripts produce byte-identical exit/stdout/stderr to the pre-shim originals (subprocesses) across canonical-JSON modes, verify_release_chain --full on the live chain, check_thesis_facts_append --base-ref replay, and corruption cases (only the OpenSSL per-process error-queue-id normalized). 17 passed.
• (c) your full suite is the acceptance gate — 783 passed, 16 skipped, 5 xfailed. CLI surfaces byte-preserved.
• (d) pins committed in this tree ✓
• (e) gate-class discipline — no ledger/**, releases/manifests/**, .github/workflows/**, or tests/test_thesis_append_adversarial.py changes ✓
• (f) squash-only — yours to merge.

Provenance and review

Built + self-reviewed by Sol (gpt-5.6-sol, equivalence-audit framing) in an isolated clone; an earlier attempt correctly refused when handed mismatched package hashes (integrity check working as intended). Independently verified here: transparency test 17/17, lockfile hashes match PyPI, header rule present. This is your production trust surface — it's yours to review and squash-merge. The real end-to-end proof is the next gate-class PR after this one, whose base gate provisions vidimus from this locked env.

One design point for you

The transparency test ships copies of the pre-shim originals under tests/fixtures/vidimus_shim_originals/ as its comparison reference. That keeps the test self-contained but carries the old implementations as fixtures. Alternative: have the test fetch the originals from the git base at run time. Your call — happy to switch it if you'd prefer not to carry the copies.

🤖 Generated with Claude Code