[EPIC] Define and enforce strict kernel boundary

[Cubits11]

Purpose

Define the trusted core of CC-Framework: the files that must be typed, tested, deterministic, and mathematically unambiguous.

The strict kernel is not an OS kernel. It is the research/software trust boundary of this repository.

Strict Kernel Candidates

• src/cc/core/models.py
• src/cc/core/metrics.py
• src/cc/core/stats.py
• src/cc/cartographer/bounds.py
• src/cc/cartographer/intervals.py
• src/cc/cartographer/audit.py
• src/cc/core/evidence_bundle.py
• src/cc/core/audit_runner.py maybe Tier 1b / compatibility

Current Contract Gaps

• ROC J vs two-world J naming ambiguity
• CC denominator policy mismatch
• FH scalar vs diagnostic return ambiguity
• Composition literal normalization
• Audit JSON strictness
• Evidence bundle / audit runner duplication

Definition of Done

• docs/architecture/STRICT_KERNEL_CONTRACT.md exists
• Tier 1 / Tier 1b / relaxed / legacy layers are defined
• Each Tier 1 file has a clear ownership role
• Known contract gaps are listed
• First invariant-test issue is created

Child Issues

• Create strict kernel contract doc
• Add model invariant tests
• Add interval invariant tests
• Add bounds invariant tests
• Add audit invariant tests

Notes

This epic is the repo constitution. It should guide future cleanup rather than directly refactor the code.