FFI completion: crypto-integrity (remove Idris stubs + link libochrance.so), blake3Hash ABI, ECHIDNA

[hyperpolymath]

Relegated from the proof thread. Recorded in .machine_readable/agent_instructions/debt.a2ml.

P1 — Crypto-integrity gate

The verification flow still falls back to Idris-side stubs (hashPairStub / blake3Stub / ed25519VerifyStub in ochrance-core/Ochrance/FFI/Crypto.idr) and libochrance.so is not built + linked into the flow. Until both are done, no cryptographic-integrity claim can be made — the structure proofs hold, but binding does not (CLAUDE.md rule 4). The real crypto already exists in ffi/zig/src/main.zig (BLAKE3 / SHA-256 / SHA3-256 / Ed25519, KAT-tested); wire it in and remove the stubs.

blake3Hash ABI stub

src/abi/Ochrance/ABI/Foreign.idr blake3Hash is covering + returns replicate 32 0 — wire to the real Zig BLAKE3.

ECHIDNA FFI

ochrance-core/Ochrance/FFI/Echidna.idr echidnaProve returns Left "FFI not yet implemented" — implement against libechidna.so.

Ties to proof Stage 1 / D2 (the CollisionResistant binding argument needs the real hash in the flow). See docs/PROOFS.adoc.

https://claude.ai/code/session_011z2t8zAxfcCNLJzU7YdpBQ

[hyperpolymath]

PR #67 lands the toolchain half of this: build.zig migrated to Zig 0.15 (0.11 API was dead — the library could not build on a current Zig), CI pin bumped to 0.15.2, and the never-compiling {{project}} template integration_test.zig replaced with a real 17-test C-ABI suite linked against libochrance.a. Verified end-to-end locally: zig build test 24/24, dlopen link test PASS, tests/ffi/run_ffi_test.sh 6/6 (production Merkle root is the real BLAKE3 fold across the Idris→Zig boundary, ≠ XOR spec root). Remaining in this issue: blake3Hash ABI surface + ECHIDNA FFI.