feat: gateway service with Verified Completions M0 (/v1/verify, #83) - #105

What

The gateway becomes a real deployable AND implements Verified Completions M0 (#83): POST /v1/verify extracts a conversation into typed claims - always bound to a registry ontology, never open-domain - runs them through the ontology's rules in an ephemeral knowledge graph, and returns findings with quoted spans.

The service

• Separate binary (inputlayer-gateway), separate container (ghcr.io/inputlayer/inputlayer-gateway), separate env surface. Only the gateway holds ANTHROPIC_API_KEY; the engine never sees it.
• At startup the gateway loads EVERY ontology published in the registry index, pinned by version and digest for the process lifetime - a registry update never changes a running gateway. There is no allowlist and no default: every request must select an ontology (x-il-ontology header or il_ontology body field), optionally asserting name@version, which must match the pin. No selection, unknown name, or version mismatch: 400 before any model call.
• Fail-open: extraction or engine trouble returns status: "unverified" with a reason instead of failing caller traffic. Missing model key or empty registry: 503.
• /v1/chat/completions stays honest 501 until M1 (Verified Completions M1: OpenAI-compatible /v1/chat/completions proxy (annotate + enforce) #84).

The M0 pipeline (issue #83)

1. Extract: Anthropic Messages API with structured outputs, prompt and JSON schema come from the selected ontology pack (schema normalized: additionalProperties: false recursively). Truncated output is refused, never partially ingested.
2. Validate: quote gate drops any row whose quote is not verbatim in the message it cites - including malformed types (stringly msg, empty surface). Extraction noise becomes a missed finding, never a false one.
3. Map: manifest-driven templates translate rows to IQL. Slots are typed by the template: quoted slots escape strings and reject control characters; bare slots accept only integers. Model output cannot break out of a literal or split the statement batch.
4. Verify: ephemeral per-request KG (unique name: content hash + pid + sequence - concurrent identical requests cannot race), rules deployed atomically, engine soft errors on deploy AND insert bail to unverified (a rejected insert may be exactly the conflicting claim; reporting verified over a partial fact base would be a false verification).
5. Report: watch views queried, symmetric mirror pairs deduped, titles rendered, spans attached.

Restructure

• New workspace crate inputlayer-ontology-client (registry resolution + engine WS client), moved out of src/bin/il/ and shared by the il CLI and the gateway. Publishable on crates.io; publish.yml publishes it before the root crate (version-pinned path dep).
• Gateway is lib+bin so the integration test exercises the exact code the binary runs.
• Env prefix consolidation, complete: every IL_-prefixed variable is now INPUTLAYER_ - the user-facing registry vars plus all internal knobs (INPUTLAYER_DEBUG, INPUTLAYER_DEBUG_SESSION, INPUTLAYER_TRACE, INPUTLAYER_TRACE_JSON, INPUTLAYER_TRACE_LEVEL, INPUTLAYER_TRACE_FILE, INPUTLAYER_SERVER_LOG). No aliases (pre-1.0). Closes Consolidate internal debug env vars from IL_ to INPUTLAYER_ prefix #112.
• Makefile CI targets widened to --workspace - previously the gateway crate was invisible to CI (a deliberately injected syntax error passed cargo check).
• Dockerfile: builder copies ontology-client/, dep-cache stage covers it, mtime touch extended. Compose: registry env passthrough (empty values treated as unset) and a named volume for the ontology cache.

Adversarially reviewed

Three independent reviews (request path, pipeline correctness, build/infra) on the working tree; every confirmed finding fixed and covered by a unit test where applicable:

• IQL injection via bare template slots and control characters (blocker) -> typed slots
• Quote-gate bypass via malformed msg types, empty-surface bypass (blocker/major) -> hardened gate
• False verified on partial insert failure (major) -> bail to unverified
• Concurrent-request KG race producing false verified (major) -> unique KG names
• Dockerfile missing ontology-client COPY, both image targets unbuildable (blocker) -> fixed, verified with a real docker build
• CI blind to the gateway crate (major) -> --workspace Makefile targets
• cargo publish silently broken by version-less path dep (major) -> publishable crate, ordered publish
• Empty-string env vars from compose (${VAR:-}) treated as set (blocker class) -> trimmed/filtered everywhere
• Impossible dates minting ordinals that fabricate order conflicts (major) -> range-checked
• Registry pack defect found during review filed as ontology-registry#1 (violation_src arity mismatch)

Tested

• 3290 workspace tests green; gateway unit tests cover mapper injection/coercion, quote gate, schema normalization, numeric mirror edge cases, and the extra-template drift path.
• Env-gated live integration test (gateway/tests/live_pipeline.rs): real engine + real digest-verified registry entry + canned extraction; asserts the Geneva conflict is found, deduped to one finding with both spans, and the non-verbatim quote dropped.
• Live HTTP surface: startup loads the full index pinned with digest, no-selection/empty-header/unknown/version-mismatch all 400, missing key 503, model failure fails open as unverified, body-field selection works.
• Full-stack E2E with a real model (claude-haiku-4-5): contradiction caught with verbatim spans, clean conversation verified, origin-gated constraint violation flagged, prompt injection contained. See the PR comment for details.
• The getting-started guide was executed literally as printed: its compose YAML (extracted byte-for-byte from the mdx) brought up both containers (locally built from this branch under the GHCR names - the published images arrive at merge), the logged pin and health JSON match the guide's output blocks, and the guide's verify request returned the documented conflict through the containerized stack. The install command (cargo install --git ... --bin il inputlayer) was run against this branch and the installed binary exercised against the live registry.
• Both docker targets build; fmt/clippy --workspace (Rust 1.98)/doc --workspace/snapshot suite/il delegation tests all clean.

Known limitations (reviewed, consciously not fixed in this PR)

• /v1/verify has no request auth or rate limit; fine behind Caddy on a private network, must get auth before any public deploy (M1 territory, Verified Completions M1: OpenAI-compatible /v1/chat/completions proxy (annotate + enforce) #84).
• The symmetric-dedup key sorts all row cells; a model reusing one claim id across two real claims could in theory collide two distinct findings. Claim-id uniqueness is not enforced anywhere yet.
• .kg create failure tolerance matches the substring "exist" (loose, but a masked error is still caught by the subsequent .kg use).
• Bare-slot coercion takes the leading integer of unit-bearing strings ("2000 EUR" -> 2000), so "12 34" silently becomes 12. Deliberate: it matches the pack's numeric_mirror convention and only ever emits a parsed i64.

Requires after merge (the guide's remaining steps activate here)

1. Main-push docker workflow publishes both GHCR images (first run with the two-component matrix - watch the manifest merge).
2. A version tag to publish inputlayer-ontology-client then inputlayer to crates.io - the inputlayer crate has NEVER been published, so the guide's cargo install inputlayer note only becomes true at that point. cargo publish --dry-run verified for ontology-client; the root crate's dry-run fails only on the not-yet-published dep, which the workflow's publish ordering handles.

Notes

• The registry repo is public, so anonymous access works out of the box (verified: the container loads and digest-verifies the pack with no token). INPUTLAYER_REGISTRY_TOKEN remains available for private registries.

Closes #83. Closes #112.