P1: Prove Kertas client conformance against an independent runtime

[wms2537]

Parent

• Epic Epic: Implement the kertas.runtime/v1alpha1 ManagedSession contract #31
• Ordered work item 6

Dependencies

• Depends on P1: Publish machine-readable existing Run API and event schemas #49, P1: Add runtime contract discovery and compatibility policy #50, P1: Implement ManagedSession storage and active-Run admission #51, and P1: Implement idempotent ordered ManagedSession inbound events #52
• First-class artifacts and bounded delegated results are supplied by closed issues P1: Promote runtime outputs to first-class artifact resources #27 and P1: Return bounded delegated results and queryable lineage #28

Scope

Prove a Kertas-shaped integration against an independently deployed runtime using only the published HTTP contract and immutable artifact/snapshot references.

Required behavior

• The client discovers versions before use and never imports runtime stores, migrations, or internal domain modules.
• It creates/resumes a ManagedSession, delivers a future event, observes ordered resource events, and reads Runs/artifacts/child-result projections through public APIs.
• Runtime completion is reported only as execution disposition; the client owns its separate outcome/release decision.
• The deployed test uses authenticated tenant isolation and a non-loopback endpoint.
• The receipt records exact server/client commits, image digest, contract versions, and cleanup.

Public seams under test

• independently deployed authenticated HTTP API
• published machine-readable schemas and standalone client
• content-addressed artifact/snapshot handoff

Acceptance criteria

• one complete Kertas integration uses only the public contract
• a forbidden-import check prevents runtime-internal coupling
• current and target compatibility modes are exercised according to policy
• retained exact-commit deployment evidence is redacted and digest-bound
• independent review and post-merge main evidence pass

[wms2537]

Closed by PR #58. Exact candidate commit 686582578a87eb2d6bba2e607b91fe75906db059 passed the standalone public-client conformance and two independent reviews. Squash merge c80dc55b2bc216f1f8ab9d93a242d93e4271f619 passed the post-merge main controlled-alpha gate in run 29906593069, including the image smoke and standalone Kertas conformance path.