feat: add the gate-standard local qualification campaign

Rebuild the qualification campaign fixture to the production gate standard
(three trials per task x condition, explicit silent-incorrect-success and
over-halt counts, and three uncertain-delivery fault conditions that return
RECONCILIATION_REQUIRED with zero blind retries and zero replay dispatches).

The harness reuses the bounded synthetic campaign pattern proven by the
real-RDP multi-window campaign on a fully local substrate: Pillow-rendered
pixels, a SQLite system of record plus an independent input-event surface,
and the unmodified governed runtime (Recorder, compiler, Standard-profile run
gate, qualification case authority, Replayer, independent effect verifiers).
Every delivered input edge carries its own exact one-write effect contract,
so duplicate or phantom edges fail independent verification.

The counted summary refuses to write without every required counter, and the
harness fails closed on a diverged condition contract. tests/
test_qualification_gate_campaign.py runs the 33-trial campaign once and
asserts the full gate standard on its counted results; results.json retains
the local acceptance run.

Author: abrichr

benchmark/qualification_gate/README.md

@@ -0,0 +1,75 @@
+# Qualification gate campaign (local, deterministic)
+
+A counted qualification campaign rebuilt to the production gate standard
+(`AGENTS.md` §2): **three trials per task x condition**, an explicit counted
+summary that exposes `silent_incorrect_successes` and `over_halts`, and at
+least three expected uncertain-delivery fault conditions whose trials end in
+`RECONCILIATION_REQUIRED` — or in a contract-proven `VERIFIED` after
+uncertainty — with zero blind retries and zero replay dispatches.
+
+It follows the structure and fail-closed conventions proven by the real-RDP
+multi-window campaign (`benchmark/rdp_multiapp`, PR #327): a machine-readable
+condition contract (`campaign.json`), a harness whose summary refuses to run
+without every required counter, per-trial fault evidence, and one accepted
+subset verdict for the whole matrix.
+
+## Honest scope label
+
+This is a **DETERMINISTIC LOCAL STAND-IN substrate**. It drives the unmodified
+governed runtime (Recorder -> compiler -> Standard-profile run gate ->
+qualification case authority -> Replayer -> independent SQLite effect
+verifiers) against Pillow-rendered pixels and a local SQLite system of record.
+
+It does NOT exercise FreeRDP or Citrix transports, real window managers,
+hosted browsers, or multi-monitor topologies. Those remain bound to the hosted
+campaigns (`benchmark/rdp_multiapp` on hosted Linux with Docker + FreeRDP;
+the Citrix ICA/HDX lane's real-protocol acceptance). Hosted-only parts are
+exactly the transport-level faults: window/session identity, focus theft
+across windows, and codec behavior are qualified by those campaigns, not this
+one. What this campaign qualifies is the substrate-independent gate behavior:
+verified healthy effects, safe halts before consequential input on identity /
+ambiguity / render faults, and exactly-once uncertain-delivery reconciliation.
+
+## Conditions and expectations
+
+See `campaign.json`. Summary of the implemented matrix (3 trials each):
+
+| Condition | Expectation |
+| --- | --- |
+| `healthy` | verified |
+| `row_reordered` | verified |
+| `moderate_display_drift` | verified_or_safe_halt |
+| `severe_display_drift` | safe_halt |
+| `duplicate_save_control` | safe_halt |
+| `partial_render` | safe_halt |
+| `wrong_record_before_write` | safe_halt |
+| `stale_identity_before_write` | safe_halt |
+| `uncertain_delivery_write_lost` | reconciliation_required |
+| `uncertain_delivery_write_kept_timeout` | verified_after_uncertainty_or_reconciliation_required |
+| `uncertain_delivery_oracle_unreachable` | reconciliation_required |
+
+Every delivered input edge carries its own exact one-write effect contract on
+an independent persisted event surface (`input_events`) beside the qualified
+business surface (`records`), so duplicate or phantom edges fail independent
+verification rather than relying on screen state.
+
+## Run
+
+```bash
+python3 benchmark/qualification_gate/run_campaign.py \
+    --output benchmark/qualification_gate/results.json
+```
+
+No Docker, no network, no browser, no model calls. The harness fails closed:
+a missing required metric, a diverged condition contract, any wrong-record
+write, duplicate effect, silent incorrect success, over-halt, blind retry,
+replay dispatch, or model call makes the campaign refuse acceptance
+(non-zero exit). `tests/test_qualification_gate_campaign.py` runs the same
+campaign once and asserts the full gate standard on the counted results.
+
+## Recorded result
+
+`results.json` retains the counted 33-trial local run (2026-08-22, exact
+branch head): 12 verified outcomes, 15 safe halts, 18 reconciliation-required
+outcomes, and zeros for silent incorrect successes, over-halts, wrong-record
+writes, duplicate effects, model calls, blind retries, and replay dispatches.

benchmark/qualification_gate/campaign.json

@@ -0,0 +1,86 @@
+{
+  "schema_version": "openadapt.qualification-gate-campaign.v1",
+  "task": "Select one synthetic patient record, enter a triage note parameter, and prove both the exact persisted record and every delivered input edge on independent read-only SQLite surfaces through a deterministic pixel fixture.",
+  "trials_per_condition": 3,
+  "required_metrics": [
+    "verified_outcomes",
+    "safe_halts",
+    "reconciliation_required_outcomes",
+    "silent_incorrect_successes",
+    "over_halts",
+    "wrong_record_writes",
+    "duplicate_effects",
+    "model_calls",
+    "blind_retries",
+    "replay_dispatches"
+  ],
+  "minimum_uncertain_delivery_conditions": 3,
+  "conditions": [
+    {
+      "id": "healthy",
+      "expect": "verified",
+      "fault": "none",
+      "oracle": ["records", "input_events"]
+    },
+    {
+      "id": "row_reordered",
+      "expect": "verified",
+      "fault": "The target record row renders at a different vertical position.",
+      "oracle": ["records", "input_events"]
+    },
+    {
+      "id": "moderate_display_drift",
+      "expect": "verified_or_safe_halt",
+      "fault": "A bounded scale, contrast, and compression change keeps text legible.",
+      "oracle": ["records", "input_events"]
+    },
+    {
+      "id": "severe_display_drift",
+      "expect": "safe_halt",
+      "fault": "Heavy downscale, inverted luminance, posterization, blur, and recompression remove reliable target detail.",
+      "oracle": ["records", "input_events"]
+    },
+    {
+      "id": "duplicate_save_control",
+      "expect": "safe_halt",
+      "fault": "Two competing Save controls render inside the recorded target region, defeating template match and retained-evidence disambiguation.",
+      "oracle": ["records", "input_events"]
+    },
+    {
+      "id": "partial_render",
+      "expect": "safe_halt",
+      "fault": "The Save control is absent when its action is due.",
+      "oracle": ["records", "input_events"]
+    },
+    {
+      "id": "wrong_record_before_write",
+      "expect": "safe_halt",
+      "fault": "The active record changes to a different patient before the consequential click.",
+      "oracle": ["records", "input_events"]
+    },
+    {
+      "id": "stale_identity_before_write",
+      "expect": "safe_halt",
+      "fault": "The identity band is replaced by a loading placeholder before the consequential click.",
+      "oracle": ["records", "input_events"]
+    },
+    {
+      "id": "uncertain_delivery_write_lost",
+      "expect": "reconciliation_required",
+      "fault": "Delivery certainty is lost after the input edge and the application rolls its commit back.",
+      "oracle": ["records", "input_events"]
+    },
+    {
+      "id": "uncertain_delivery_write_kept_timeout",
+      "expect": "verified_after_uncertainty_or_reconciliation_required",
+      "fault": "Delivery certainty is lost after the input edge and the write persists; only the contract may confirm it.",
+      "oracle": ["records", "input_events"]
+    },
+    {
+      "id": "uncertain_delivery_oracle_unreachable",
+      "expect": "reconciliation_required",
+      "fault": "Delivery certainty is lost after the input edge and the system of record becomes unreachable before proof.",
+      "oracle": ["records", "input_events"]
+    }
+  ]
+}