Feature: Freeze authority-facts canonical CBOR ABI #157

Cohesive Capability

Edict owns a portable edict.authority-facts/v1 byte contract that runtime-owned generators can emit and the compiler can consume without a JSON-only compatibility gap. The contract is canonical CBOR constrained by normative CDDL and decodes into the existing validated AuthorityFactsDocument / CompilerContext path.

Cross-repo prerequisite for flyingrobots/echo#651 and the generated provider artifacts in flyingrobots/echo#652.

Scope

• Add an Edict-owned edict.authority-facts/v1 CDDL root using the shared typed SHA-256 digest representation.
• Define the canonical value shape for source identity, operation-profile facts, effect write-class facts, and budget facts.
• Decode edict.canonical-cbor/v1 bytes with stable authority-facts ABI failure categories.
• Reuse the existing semantic validation and compiler_context_from_authority_facts merge path after structural decoding.
• Check in a reviewed canonical fixture and executable decode/compiler compatibility evidence.
• Document ordering, uniqueness, JSON review-rendering compatibility, and non-goals in the authority-facts topic shelf.

Acceptance Criteria

• Canonical bytes accepted by the ABI decode to the same AuthorityFactsDocument meaning as the current JSON review form.
• The decoded document contributes operation profile, write-class, effect, and budget facts through the existing deterministic CompilerContext path.
• Non-canonical CBOR, wrong roots/types, unknown fields, invalid typed digests, duplicate fact coordinates, and invalid semantic values reject with stable structured kinds before a context is returned.
• Set-like fact collections have one canonical representation independent of generator insertion order.
• CDDL, fixture bytes, fixture digest/review rendering, tests, requirements, changelog, and authority-facts shelf agree.

Boundaries

• Do not remove or reinterpret the explicit JSON file loader.
• No registry, filesystem discovery, network access, signatures, trust policy, or participant governance.
• No Echo-specific facts or handwritten Echo provider artifacts in Edict.
• No full lawpack or target-profile manifest validator.

Dependency Graph

• Blocks: Freeze Echo provider semantic-source and artifact-domain contract echo#651 and Generate Echo Edict lawpack, target profile, authority facts, and provenance echo#652
• Related: Feature: Provider generated-artifact provenance contract #139, Feature: WIT provider host alpha #141, Feature: Add generation-provenance provider artifact kind #155