Add HO-DET-001 runtime truth spine contract

[raylee-hawkins]

Summary

Adds the HO-DET-001 Runtime Truth Spine v0 contract sample/schema and fail-closed verifier support.

Boundary

• Preserves CONTROLLED_TEST_VALIDATED.
• Preserves NOT_PUBLIC_SAFE.
• Keeps PUBLIC_RUNTIME_BLOCKED.
• Keeps AI support-only and not authority.
• Does not change detection logic, website copy, dependencies, runtime systems, or raw/private evidence.

Validation

• python scripts/verify-ho-det-001-runtime-contract.py
• python -m json.tool contracts/examples/ho-det-001-runtime-contract.sample.json
• python -m json.tool contracts/schemas/ho-det-001-runtime-contract.schema.json
• git diff --check

[raylee-hawkins]

Human governance review: I reviewed this PR as a platform contract/guardrail change only. It preserves CONTROLLED_TEST_VALIDATED, keeps PUBLIC_RUNTIME_BLOCKED and NOT_PUBLIC_SAFE, and does not authorize runtime-active, public signal-observed, production-ready, autonomous SOC, AI-approved, or analyst-approved claims. Approved for contract tracking only, not public runtime promotion.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1f1e507dc7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[raylee-hawkins]

Correction/clarification on final scope review:

The final follow-up commit b25acc3c6d15326ecb56ddf79dddede58606c504 changed only scripts/verify-ho-det-001-runtime-contract.py.

The PR as a whole intentionally includes the Runtime Truth Spine platform contract scope:

• contracts/examples/ho-det-001-runtime-contract.sample.json
• contracts/schemas/ho-det-001-runtime-contract.schema.json
• scripts/verify-ho-det-001-runtime-contract.py

I reviewed this as the intended PR-level scope. The schema/sample contract files are part of the original platform runtime contract addition, while the final verifier-only commit resolved the review-thread blockers. The proof ceiling, public-safe status, runtime-claim boundary, and AI-not-authority boundary remain unchanged.