Implement the Echo Target IR semantic verifier component

[flyingrobots]

Purpose

Implement Echo's exact edict:target-provider/verifier@1.0.0 component so Echo, not Edict, proves that provider-produced Target IR faithfully realizes the declared Core obligations.

Acceptance criteria

• Component bytes carry the exact digest-covered verifier contract attestation and no ambient capability imports.
• Verification binds the exact Core, target profile, semantic closure, and echo.span-ir/v1 artifact identities.
• It validates allowed intrinsics, pre-effect guard order, obstruction mappings, footprint translation, budget translation, generated-artifact bindings, and target-domain ownership.
• It rejects wrong domain/profile, unsupported intrinsic, dropped obstruction, changed guard order, changed footprint/budget, introduced claim, and silent loss with stable structured outcomes.
• Successful output is a canonical, schema-valid, bounded verifier report suitable for semantic bundle identity.
• Repeat and cross-process verification are equal.
• Tests prove Wasmtime decoding success alone is never treated as semantic admission.

Boundaries

The verifier does not resolve artifacts, mutate Echo state, admit a participant, execute Target IR, or mint a runtime receipt.

Blocked by #651 and #652; it may proceed in parallel with #653.
Parent: #650

[coderabbitai]

🔗 Related PRs

#323 - Witnessed suffix admission evaluator [merged]
#329 - Stack Witness 0001 fixture-backed jedit walking skeleton [merged]
#344 - feat(wesley): consume canonical requirements artifacts [merged]
#365 - feat(wesley): emit query observer host helpers [merged]
#582 - docs: define the Echo 1.0 release contract and move live planning to GitHub [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!