feat(core): migrationAttestation as structural precondition on ConstraintEnvelope

[pshkv]

Summary

Follow-through on the commitment made in aeoess/agent-governance-vocabulary#8 — adds migrationAttestation as a structural precondition on ConstraintEnvelope. When present, the envelope only validates if continuityVerified === true with all four shape fields populated. This makes entity_continuity a scope-grant gate rather than an advisory signal.

Why this shape

• Matches the SBR-002 (Soulbound Robots) reference schema for embodied-AI migrations (body swaps, wallet rotations, runtime handoffs).
• Validation is applied regardless of envelope version — the field is forward-compatible and its presence always demands the full shape.
• Fits the existing validateConstraintEnvelope surface without introducing a new "activation gate" concept — invalid envelope = no scope grant, which is functionally equivalent.

Changes

• packages/core/src/types/protocol.ts — new ConstraintEnvelopeMigrationAttestation interface; optional migrationAttestation field added to ConstraintEnvelope
• packages/core/src/constraint-language.ts — 5 validation rules on the migration-attestation block
• packages/core/__tests__/constraint-language.test.ts — 8 new test cases

Test plan

• Typecheck: pnpm --filter @sint/core run typecheck — passes
• Tests: pnpm --filter @sint/core test — 61 passed (previously 53)
• Downstream: bridge-a2a uses ConstraintEnvelope — additive-only change, no breaking surface. Running downstream tests recommended before merge.

Follow-ups (not in this PR)

1. Crosswalk update — aeoess/agent-governance-vocabulary/crosswalk/sint.yaml adds entity_continuity (no_mapping + composition note pointing at this field) and consent_provenance (close_match + gap note). Separate PR against that repo.
2. Spec version bump — docs/specs/sint-protocol-v1.0.md should document the new field in a v1.1 section (coordinated with the v1.0 → v1.1 promotion from #168 canonical-signing clarifications).
3. Descriptor-extension PR in vocab repo — per aeoess's sequencing: seven new descriptor enum values land before any new signal-type merge.

Refs

• aeoess/agent-governance-vocabulary#8 — drove this
• SBR-002 schema — reference shape

[aeoess]

Illya, shipped the crosswalk follow-up you flagged in the Follow-ups section of this PR.

aeoess/agent-governance-vocabulary#45 merged, promoting entity_continuity from proposed_signal_type_alignment to signal_types with match: structural, citing this PR as the reference implementation. The composition framing is explicit: when a SINT ConstraintEnvelope is attached to a delegation, the migration-attestation check becomes a precondition on every action the envelope governs. That gives APS issuers a clean primitive to compose against.

consent_provenance stays in proposed_signal_type_alignment for now. It's not yet canonical in vocabulary.yaml, so upgrading it there would be premature. Left the v1.1 path via #168 as a note.

Not touched in this PR but worth flagging: descriptor-extension work from the seven new descriptors you referenced in the #178 Follow-ups is still open. Some of those overlap with what nutstrut proposed in vocab PR #43 (measurement_point) for which I requested a restructure today. If any of your seven are the same dimension named differently, it would help to land them together rather than in parallel PRs that later need reconciliation. Happy to coordinate sequencing when you're ready to push that work.

Reference: aeoess/agent-governance-vocabulary#45

[pshkv]

Helpful update, thank you.

Promoting entity_continuity while keeping consent_provenance in proposed alignment is the right split. The composition note is exactly what I wanted the field to mean: once a ConstraintEnvelope carries migrationAttestation, continuity stops being advisory context and becomes a precondition on governed actions.

Your sequencing note on descriptor extension also lands. I'm intentionally biasing the repo toward a narrower production-readiness pass right now rather than widening the surface again, so I'm not going to push those seven descriptors in parallel with overlapping vocab work. When I pick that thread back up, I'll do it as one coordinated batch against the current vocabulary state instead of creating another reconciliation problem.

[pshkv]

Rebased this PR onto current main and removed the three unrelated v0.3 ancestor commits (including the stray .claude/worktrees entry). The PR now contains only the migration-attestation type, validation, and tests. Verified: @pshkv/core 61/61 tests pass, core build passes, and git diff --check passes.