Publish capability: core.consent-purpose-check@1.0.0 (#500)

[dk5488]

Summary

Publish core.consent-purpose-check version 1.0.0 (Closes #500), providing a pure, deterministic decision procedure for consent and purpose binding evaluation under caller-supplied consent records, policy version, and reference timestamp.

Includes:

• Contract definition at capabilities/core/core.consent-purpose-check/1.0.0/contract.json
• Deterministic no_std Rust implementation at capability-src/core-consent-purpose-check/
• 100% function and >95% line/region test coverage via host unit tests
• ECCA capability inventory registration in contracts/governance/ecca-capability-inventory.json
• Artifact: core-consent-purpose-check.wasm.zip

Maintainer Note: Mirror-Before-Green (.wasm Artifact)

Per CONTRIBUTING.md#mirror-before-green, this PR originates from a contributor fork where release creation permissions on traverse-framework/registry are not available.

The WASM binary has been built locally and verified from source:

• Build target: wasm32-unknown-unknown (cargo build --release --target wasm32-unknown-unknown)
• Asset name: core-consent-purpose-check.wasm
• Asset size: 39,753 bytes (38.8 KB)
• SHA-256 digest: sha256:c6b7b3f10c0d2c4911391b72180837eed0470ea05ce5ab1d8d2da6d924923689 (matches contract.json#artifact.digest)
• Target release tag: artifacts/core.consent-purpose-check-1.0.0
• Target asset URL: https://github.com/traverse-framework/registry/releases/download/artifacts/core.consent-purpose-check-1.0.0/core-consent-purpose-check.wasm

For Maintainers: Please mirror/upload the compiled core-consent-purpose-check.wasm (built from capability-src/core-consent-purpose-check/ or attached in this PR) to release artifacts/core.consent-purpose-check-1.0.0 so that capability-validation turns green.

Governing Spec

• 001-registry-foundation
• 006-public-scope-and-identity
• 007-artifact-hosting
• 014-extraction-compatibility
• 018-capability-test-coverage
• 023-authoring-assurance
• 024-capability-risk-classification-adoption
• 025-capability-licensing-metadata

Project Item

• Issue Publish capability: core.consent-purpose-check (consent / purpose binding check) #500
• Project 3: Capability Publishing

Definition of Done

• Schema-compliant contract.json created under capabilities/core/core.consent-purpose-check/1.0.0/
• authoring.method declared as llm-assisted with test evidence and review metadata (spec 023)
• licensing declared with Apache-2.0 SPDX expression and maintainer-declared verification (spec 025)
• risk metadata declared with pure_read effect class and deterministic classification (spec 024)
• Persona references resolve and scenarios adhere to user story format (spec 017)
• Rust source implemented under capability-src/core-consent-purpose-check/ (spec 018)
• Mandatory test coverage achieved: 100% functions, >=95% lines and regions
• Compiled wasm32-unknown-unknown binary verified against declared SHA-256 digest
• ECCA capability inventory registered as no-event-required (spec 016/014)
• Deterministic CI capability validation gates pass locally (pending maintainer release mirror)

Validation

• cargo test --manifest-path capability-src/core-consent-purpose-check/Cargo.toml (13 tests passing)
• cargo llvm-cov --manifest-path capability-src/core-consent-purpose-check/Cargo.toml (100% functions, 99.31% lines, 98.06% regions)
• cargo build --release --target wasm32-unknown-unknown --manifest-path capability-src/core-consent-purpose-check/Cargo.toml (built cleanly; SHA-256 verified)
• python scripts/ci/capability_validation.py <BASE_SHA> <HEAD_SHA> (passes; artifact 404 mirror note expected)
• bash scripts/ci/spec_alignment_check.sh <pr-body> (passed)

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[dk5488]

I have read the CLA Document and I hereby sign the CLA

[dk5488]

recheck

[enricopiovesan]

@dk5488 thanks — CLA is signed and the PR is in (Closes #500). The .wasm release mirror is a maintainer step (fork contributors can't create the artifacts/core.consent-purpose-check-1.0.0 release), so that queue is on our side. Once the digest URL is live, capability-validation should be able to see the artifact; eng review follows. No further action needed from you unless CI flags something else after the mirror.

If the project's been useful, a star on https://github.com/traverse-framework/traverse helps others find it — optional, no pressure.