feat(artifacts): add open personal Artifact core and v1 interchange

[jmagar]

Summary

Build the first coherent W19 slice of Labby's AGPLv3 open personal Artifact + MCP/runtime Gateway. This freezes the Rust-side dinglebear.artifact-interchange/v1 contract and adds the modern local Artifact subsystem without resurrecting retired Stash/Marketplace/Fleet/Deploy surfaces.

Included

• multi-file Artifact/package model
• exact Depot G0 ArtifactInterchange v1 fixture parity
• canonical JSON + SHA-256 component/revision identity
• provenance, license/redistribution, publication, and fork/upstream lineage state
• immutable revision store + separate editable workspace
• bounded/path-safe local import
• verified, secret-aware local export
• per-Artifact advisory locks
• basic fork and explicit upstream observation without silent byte updates
• Agent Skills compatibility adapter over the existing SEP-2640 validation/digest path
• spec, contract, implementation plan, progress tracking, and runtime ownership guidance

Cross-repo contract

Depot commit 25de725 is the canonical G0 owner for dinglebear.artifact-interchange/v1. Labby copies the exact artifact-interchange-v1.json fixture and verifies byte-canonical round-trip plus the frozen revision digest sha256:feda49490988a21b01ea9d6548f2c893a7cea6c4e9834322985c28d82280c13f.

Important frozen semantics preserved:

• revision content hashing sorts components by {path, id}
• revision ID defaults to the content digest but may be an explicit opaque/reference ID
• provenance is evidence, not trust
• license/redistribution state is separate and defaults unknown
• byte publication requires explicit redistributable/forkable rights
• following an upstream records intent only and never silently rewrites local bytes
• Skills are Artifact kind = skill, not a parallel storage universe

Safety / adversarial review

Addressed during review:

• exact frozen Artifact secret-key semantics instead of Labby's broader generic redactor
• nested same-name Skill Artifact identity collision
• fail-closed provenance schema versions
• symlink substitution across hashed store/revision/files/lock paths
• private Unix store/lock permissions
• store creation ancestor validation before mutation
• export/store path overlap rejection
• directory depth/entry traversal budgets
• bounded internal record/revision JSON reads
• bounded revision-history growth
• stored file size/digest verification before export/fork

Residual hardening is documented: the shared path-safety helpers are path/canonicalization based and have a concurrent local-filesystem TOCTOU window. The first slice targets the personal trusted local-store threat model; FD-relative/openat-style no-follow traversal should precede claiming hostile concurrent local filesystem mutation support.

Verification

Final evidence after rebase onto origin/main fc4d3a1c2:

• cargo fmt --all -- --check ✅
• git diff --check origin/main...HEAD ✅
• cargo test -p labby-runtime --all-features -- --nocapture ✅ 182 passed, 0 failed
  • 160 unit
  • 1 agent-error schema
  • 2 ArtifactInterchange conformance
  • 11 SEP-2640 URI conformance
  • 8 Skills contract conformance
• cargo clippy -p labby-runtime --all-features --all-targets -- -D warnings ✅
• RUSTFLAGS='-D warnings' cargo check -p labby-runtime --all-features --all-targets ✅

No migration is added because this is a new local Artifact store with no published current-state format to migrate. Current Gateway, Skills, Loadouts, and Code Mode behavior remain preserved; transport projections are intentionally deferred to later W19 phases over this shared layer.

[jmagar]

W19 CI stabilization checkpoint pushed at a4b3d2223.

Root cause: compile-heavy jobs were not failing tests or lints; rustc/clippy processes were being killed with SIGKILL under runner memory pressure when cold normal labby/gateway libraries overlapped with lib-test/all-target harnesses. Current main reproduces the same Test/MCP/gateway SIGKILL class.

Mitigation keeps coverage and native build parallelism intact: warm ordinary product targets first, then run all-target/test harness phases at the same Cargo concurrency. No job-wide CARGO_BUILD_JOBS and no command-local -j 1.

Local evidence on the pushed workflow:

• exact staged Clippy: status 0; phases 32.56s / 16.37s / 1m30s; no SIGKILL or lint errors
• gateway slice: warm compile 1m05s; all-target compile 1m00s; 1,272/1,272 tests passed, 3 skipped
• fs slice: warm/all-target compile passed; focused proxy preflight 6/6 passed
• pinned fleet policy: passed
• pinned fleet repository contract (218eba19..., rust profile): passed
• pinned Actionlint + forbidden ARM/QEMU scan: passed
• workflow contract test: 1 passed, 0 failed
• rustfmt, diff check, and docs link check: passed; 347 local links verified

The W19 Artifact v1 contract/runtime behavior itself is unchanged by this checkpoint.

[jmagar]

Final conductor landing evidence:

• base ea07f3609926879da146ea6e3e3afdd65784a73a
• head a4b3d2223b23f6bbe4f37585e445c9106b70f6ee
• clean worktree and exact main ancestry
• mergeability CLEAN, non-draft, no outstanding review threads from prior review
• 34 successful checks, zero failures, aggregate ci-gate green
• previously failing fs/gateway/MCP/Test/Clippy family recovered with narrowly scoped CI phase separation; frozen Artifact v1 fixtures and merged feat(skills): add shared MCP compatibility facade #456 Skills behavior preserved.

Landing W19 personal Artifact core + v1 interchange now.