Module composition_conformance 

Composition conformance (SPEC.md §11.1) — the suite a downstream host can run against its own composition layer.

run_host_conformance drives contextgraph_host::Host itself, so it certifies the reference host and nothing else. That leaves a real gap, because Host::query_all is not the whole host: it audits budget honesty per provider, and then hands back a fan-out. Something above it has to turn N providers’ accepted frames into the one frame set that reaches a prompt, and that step is where a host makes its own decisions — which frames win a shared budget, what happens to the losers, and in what order the survivors render.

That step is not covered by the per-provider audit, and the gap is not theoretical. Three providers each returning one honest 400-token frame against a 1000-token query are individually conformant — no token_cost lie, no frame flood — and FanOut::accepted_frames() yields all three, for 1200 tokens. Whether the prompt ends up over budget, and whether anyone is told which evidence was dropped to keep it under, is entirely up to the composing host. A downstream host that got this wrong would pass every check in the provider suite and every check in the host suite.

So this module inverts the dependency: instead of driving a fixed host, it takes a ComposingHost — anything that can answer “given these providers and this query, what reaches the prompt, and what did you drop getting there?” — and holds it to the rules that bind that answer. The reference implementation is compose_for_prompt, which passes; a downstream host with its own merge (stella’s recall_via_host is the known one) implements the trait and gets the same audit.

The rules checked

• CCHECK_BUDGET_BOUND — the admitted set’s summed token cost does not exceed the query’s max_tokens, including when every individual provider was honest and only the sum overflows (§7).
• CCHECK_TOTAL_PARTITION — every frame the host was offered is either admitted or reported as dropped. A frame that is neither has been silently truncated, which is the one outcome an evidence audit cannot tolerate (issue #15’s total-partition requirement).
• CCHECK_QUARANTINE — frames from a provider the host’s own audit rejected never reach the prompt. A composing host that reads raw provider results instead of accepted_frames() re-admits exactly what B2/B4 dropped.
• CCHECK_DETERMINISM — the same frame set composes to the same admitted sequence twice running. This is the prompt-cache guarantee (docs/context-reuse.md §1): a turn whose underlying frames did not change must emit byte-identical text, so selection may depend on score but rendering must not.

Every check is adversarial by construction, the same discipline host_conformance uses: each one points the host at input that tries to make it fail and at a well-behaved counterpart it must accept, so a check can only pass if the host discriminates. A host that admitted nothing at all, or reported every frame as dropped, would fail its counterpart rather than passing vacuously.

Honest residual

This suite sees a host’s composition as a black box over frames: it cannot check rendering (R3 fencing is [host_conformance]’s host-content-quoting, against the reference renderer), and it cannot check that a host’s stated drop reason is the true one — only that a drop is reported at all. A host that reported every over-budget drop as a duplicate would pass. Reason fidelity needs a vocabulary this trait deliberately does not impose, because a downstream host’s drop reasons are its own (stella has FrameCount, TokenBudget, RequiredOverBudget; the reference has Duplicate and OverBudget).

Structs

Composition

What a composing host did with a fan-out: what reaches the prompt, and what it dropped getting there.

ExcludedFrame

One frame a composing host declined to admit.

ReferenceComposingHost

The reference composing host: Host::query_all for the fan-out and audit, then compose_for_prompt for the shared-budget pack.

Constants

CCHECK_BUDGET_BOUND

§7 — the admitted set fits the query’s token budget, including when only the cross-provider sum overflows.

CCHECK_DETERMINISM

docs/context-reuse.md §1 — an unchanged frame set composes identically.

CCHECK_QUARANTINE

§7 B2/B4 — frames the host’s own audit rejected never reach the prompt.

CCHECK_TOTAL_PARTITION

Issue #15 — every offered frame is admitted or reported dropped, never silently truncated.

Traits

ComposingHost

A host’s composition layer, as this suite needs to see it.

Functions

run_composition_conformance

Run every composition check against host, returning a typed ConformanceReport.