feat(core): rebuild governance core to the plan's decision model

The evaluator was a skeleton with invented thresholds (5/3/10/5) and two
unimplemented branches. Rebuild it against the migration plan's spec and the
behavior characterized from the pinned reference commit.

Core:
- four independent decision dimensions (ranking, visibility, interaction,
  transaction) with severity ladders and max-merge composition
- stable reason identifiers replacing free-text strings
- structured evidence, redacted unless a profile opts in
- administrative-state reduction with capability filtering at merge time, so
  revoking a role drops that actor's entries immediately
- protected actors stripped from every denial set
- snapshot fingerprints for cache invalidation
- generic policy engine: applications supply profiles and category thresholds;
  the core carries none of its own

Characterization:
- 34 generated fixtures covering every behavior the plan's Phase 0 requires
- conformance suite that actually evaluates them, replacing a placeholder that
  asserted a list's length
- reference thresholds (3/3/20/5, 60-day mute window) live in bitvid-compat as
  an application profile, not as engine defaults

Fixes found while building:
- reduceAdminState accepted malformed target identifiers, because getTargetKey
  formats anything it is given
- community-user-deny fired for any contributor rather than only for
  community-curated sources

273 tests pass; typecheck and the reference-import guard are clean.

packages/testing/test/conformance.test.js

@@ -1,42 +1,154 @@
-// Test the conformance utilities
-import { describe, it, expect } from "vitest";
-import { createFixture, runConformanceTest } from "../src/conformance.js";
+import { describe, expect, it } from "vitest";
 
-describe("conformance utilities", () => {
-  it("creates valid fixture objects", () => {
-    const fixture = createFixture(
-      "test-fixture",
-      {
-        adminState: { editors: [] },
-        trust: {},
-        reports: [],
-        trustedMutes: [],
-        overrides: {},
+import { createPolicyDefinition } from "@nostr-governance/core";
+
+import { buildSnapshot, diffExpectation, evaluateFixture, runConformanceCase } from "../src/conformance.js";
+
+const ROOT = "a1".repeat(32);
+const MODERATOR = "b2".repeat(32);
+const CREATOR = "d4".repeat(32);
+const TRUSTED = "01".repeat(32);
+
+const POLICY = createPolicyDefinition({
+  id: "harness",
+  version: "1.0.0",
+  defaultProfile: "feed",
+  profiles: {
+    feed: {
+      name: "feed",
+      administrativeDeny: { visibility: "hide", interaction: "deny" },
+      reports: { default: { restrict: 1 } },
+      mutes: {},
+    },
+  },
+});
+
+const baseFixture = () => ({
+  name: "sample",
+  profile: "feed",
+  now: 1_750_000_000,
+  authority: {
+    root: ROOT,
+    actors: { [ROOT]: ["super_admin"], [MODERATOR]: ["moderator"] },
+    protectedActors: [ROOT],
+  },
+  target: { type: "user", pubkey: CREATOR },
+  expect: {
+    visibility: { effect: "allow" },
+    interaction: { effect: "allow" },
+  },
+});
+
+describe("buildSnapshot", () => {
+  it("reduces contributions through the authority state", () => {
+    const fixture = {
+      ...baseFixture(),
+      contributions: [
+        { actor: MODERATOR, kind: "user-deny", targets: [{ type: "user", pubkey: CREATOR }] },
+      ],
+    };
+    const { snapshot } = buildSnapshot(fixture);
+    expect(snapshot.admin.userDeny.has(`user:${CREATOR}`)).toBe(true);
+  });
+
+  it("converts viewer arrays into sets and maps", () => {
+    const fixture = {
+      ...baseFixture(),
+      viewer: {
+        blocks: [CREATOR],
+        mutes: [MODERATOR],
+        overrides: [{ key: `user:${CREATOR}`, visibility: "allow" }],
       },
-      { type: "user", pubkey: "test" },
-      { visibility: "allow" }
-    );
-    
-    expect(fixture.name).toBe("test-fixture");
-    expect(fixture.state.adminState.editors).toEqual([]);
-    expect(fixture.target).toEqual({ type: "user", pubkey: "test" });
-    expect(fixture.expectation).toEqual({ visibility: "allow" });
+    };
+    const { viewer } = buildSnapshot(fixture);
+    expect(viewer.blocks?.has(CREATOR)).toBe(true);
+    expect(viewer.mutes?.has(MODERATOR)).toBe(true);
+    expect(viewer.overrides?.get(`user:${CREATOR}`)).toEqual({
+      visibility: "allow",
+      reason: undefined,
+    });
   });
-  
-  it("runs conformance tests", () => {
-    const fixture = createFixture(
-      "test-fixture",
-      {},
-      { type: "user", pubkey: "test" },
-      { visibility: "allow" }
-    );
-    
-    // Mock evaluator that always returns the expectation
-    const mockEvaluator = () => ({ visibility: "allow" });
-    
-    const result = runConformanceTest(fixture, mockEvaluator);
-    expect(result.passed).toBe(true);
-    expect(result.actual).toEqual({ visibility: "allow" });
-    expect(result.expected).toEqual({ visibility: "allow" });
+
+  it("defaults every optional section", () => {
+    const { snapshot, viewer } = buildSnapshot(baseFixture());
+    expect(snapshot.reports?.size).toBe(0);
+    expect(snapshot.trustedMutes?.size).toBe(0);
+    expect(viewer.blocks?.size).toBe(0);
   });
-});
+});
+
+describe("evaluateFixture", () => {
+  it("evaluates against the fixture's profile", () => {
+    const decision = evaluateFixture(baseFixture(), POLICY);
+    expect(decision.policyProfile).toBe("feed");
+    expect(decision.visibility.effect).toBe("allow");
+  });
+});
+
+describe("diffExpectation", () => {
+  const decision = () => evaluateFixture(baseFixture(), POLICY);
+
+  it("reports no mismatches when the expectation holds", () => {
+    expect(diffExpectation(decision(), { visibility: { effect: "allow" } })).toEqual([]);
+  });
+
+  it("reports a visibility mismatch", () => {
+    const [mismatch] = diffExpectation(decision(), { visibility: { effect: "hide" } });
+    expect(mismatch).toMatch(/visibility.effect: expected "hide", got "allow"/);
+  });
+
+  it("reports a ranking weight mismatch", () => {
+    const [mismatch] = diffExpectation(decision(), { ranking: { effect: "normal", weight: 3 } });
+    expect(mismatch).toMatch(/ranking.weight/);
+  });
+
+  it("compares reasons order-insensitively", () => {
+    const fixture = {
+      ...baseFixture(),
+      contributions: [
+        { actor: MODERATOR, kind: "user-deny", targets: [{ type: "user", pubkey: CREATOR }] },
+      ],
+    };
+    const result = evaluateFixture(fixture, POLICY);
+    expect(diffExpectation(result, { reasons: ["admin-user-deny"] })).toEqual([]);
+  });
+
+  it("reports a missing transaction dimension", () => {
+    const [mismatch] = diffExpectation(decision(), { transaction: { effect: "deny" } });
+    expect(mismatch).toMatch(/\(absent\)/);
+  });
+
+  it("compares evidence fields", () => {
+    const fixture = {
+      ...baseFixture(),
+      trust: { contacts: [TRUSTED] },
+      reports: {
+        [`user:${CREATOR}`]: [{ reporter: TRUSTED, category: "spam", createdAt: 1_749_000_000 }],
+      },
+    };
+    const result = evaluateFixture(fixture, POLICY);
+    expect(diffExpectation(result, { evidence: { trustedReportTotal: 1 } })).toEqual([]);
+    expect(diffExpectation(result, { evidence: { trustedReportTotal: 5 } })).toHaveLength(1);
+  });
+
+  it("compares pubkey lists by length via the Count suffix", () => {
+    const result = decision();
+    expect(diffExpectation(result, { evidence: { trustedReporterPubkeysCount: 0 } })).toEqual([]);
+    expect(diffExpectation(result, { evidence: { trustedReporterPubkeysCount: 2 } })).toHaveLength(1);
+  });
+});
+
+describe("runConformanceCase", () => {
+  it("passes a fixture whose expectation holds", () => {
+    const { passed, mismatches } = runConformanceCase(baseFixture(), POLICY);
+    expect(passed).toBe(true);
+    expect(mismatches).toEqual([]);
+  });
+
+  it("fails a fixture whose expectation does not hold", () => {
+    const fixture = { ...baseFixture(), expect: { visibility: { effect: "deny" } } };
+    const { passed, mismatches } = runConformanceCase(fixture, POLICY);
+    expect(passed).toBe(false);
+    expect(mismatches).toHaveLength(1);
+  });
+});