OPT-GOV Phase 1 — edge distiller (one concept with boss edge) + geo-SCM scheduler into F4

Branch: claude/opt-gov-phase1-edge-geo · Session: 7pjhmg · Date: 2026-08-22 Authority: OPT-GOV_PRE_APPROVAL_2026-08-21 (standing GATE-1, conditions verified below) + owner in-session triple release 2026-08-22. This phase adds the last two pre-approved flags — EDGE_INFERENCE_SERVE and MMM_PRIOR_WRITEBACK, both default-false by source-pinned test. GATE-2 flips remain owner-only.

BUILD 1 — edge distiller: src/shared/edge_distillation/ (reconciled, not duplicated)

One edge concept, not two — the boss lane (miz-oki-adk-agents/boss/edge_inference_integration.py) keeps THE EdgeModelRegistry (mandatory artifact signing, A/B routing, evidence-only invariant, ENABLE_EDGE_INFERENCE for boss-side serving). This package is the producer seam that lane lacked, and a source-scan test enforces the relationship both ways (no registry class defined here, no boss import, package docstring names the boss module and its flag):

• Distiller: deterministic pure-Python CART over the parent model's predictions (injected rows; no parent is called). Deterministic holdout slice measures fidelity as R² agreement; the fidelity floor is DECLARED by the caller in (0, 1] — no module default (the bar is the lane owner's stated decision). Below floor ⇒ refused_fidelity, no artifact ships — no flag or kwarg converts the refusal. Known-structure recovery and the irreducible-pattern refusal are both pinned.
• Registry-parent provenance + demotion: every artifact carries its parent's id/version/source + predictions hash; check_provenance DEMOTES a distillate whose parent is no longer the registry's current version — demoted is never offered, flag or no flag (pinned).
• SENSE-side evaluator: fidelity re-measured on fresh parent-scored rows; below-floor agreement yields demote_recommended evidence — drift caught by measurement, observe-only.
• EDGE_INFERENCE_SERVE default False (source literal, fail-if-flipped): dark ⇒ shadow record with registration_request offered as None — nothing actionable leaves a dark flag; armed ⇒ the boss-registry registration REQUEST rides in-band, naming the operator steps still required (ONNX export — a labeled follow-on, no onnx dependency here — and sha256 signing, which the boss registry refuses to waive). Emission only through the injected record seam.

BUILD 2 — geo-SCM scheduler INTO f4_calibration (extend-in-place)

scheduler.py joins the existing engine (candidate ranking, donor selection, SCM weight fitting, approval-gated reservations, estimator, priors — all untouched) and adds exactly the seams the lane lacked:

• Pre-period diagnostics at SELECTION time: the estimator's own guard (PRE_RMSPE_RATIO_MAX, same constant — one concept, pinned) applied to each ranked candidate before any reservation exists: a geo whose synthetic control cannot track its own pre-period (e.g. perfect correlation at 10× the donor scale — simplex weights cannot reach it) is refused at selection, not after money moved. no_trackable_candidate names every untracked geo with its ratio.
• Holdout-before-submit as code order: the Cell 36 registration request (/v1/causal/holdouts:assign, unit geo) is built and emitted through the REQUIRED register_holdout seam; without a returned registered holdout the reservation is NOT submitted (holdout_not_registered, seam payloads empty — pinned three ways). The submitted payload cites f4-holdout:<id> in its signal refs. No activation without a pre-exposure registered holdout — canon as mechanics, not prose. The package still holds no HTTP client; the seam owner wires the governed cell36 client.
• Propose-only dark: with F4_CALIBRATION off (shipped default), flag_dark records SHOW what would be scheduled (candidate + diagnostics) but register no holdout and submit nothing — dark means observable and side-effect-free (pinned: the register seam is never called). F4-unset ⇒ not_configured. Approval posture, unregistered f4-geo-reservation actuator, and spend caps all ride the existing engine unchanged.
• MMM prior proposal bridge: mmm_prior_proposal turns an EARNED posterior (≥ 1 clean-cycle update with named evidence ids — an unearned one is REFUSED: proposing it would launder the declared prior into "measured") into a proposal record behind MMM_PRIOR_WRITEBACK default False (source-pinned): dark ⇒ shadow with writeback_payload None; armed ⇒ payload in-band; the writeback itself stays an operator-owned external step. The fuller Meridian/Robyn MMM remains the labeled follow-on.
• New store f4_schedule_records posture-registered (machine-derived scan enforces it).

Flag ledger for the lane (all four pre-approved flags now accounted for)

Gate results (pre-push, fresh venv)

governance suite 493 passed (462 baseline + 31 new: scheduler diagnostics/invariants/dark + distiller fidelity/provenance/flag/reconciliation) · remediation 294 passed · edge-hardening neighbor 19 passed / 1 skipped (designed importorskip on the optional onnx dependency — pre-existing, and the dependency this package deliberately excludes) · skill_sync --audit, both parity checkers, canon-status, V1–V3 greps, memory strict: see commit gate line · no protected or site-visible paths · no new service or ingress surface.