feat: auto-attestation pipeline — write trail records when verification passes

[alfonsosastre]

Manifesto alignment

Section IV of the Trust Without Comprehension manifesto states attestation chains should replace human code review. Currently lex-trail exists and is queryable, but nothing writes attestation records automatically when verification passes. The attestation chain is read-only from the agent's perspective.

Problem

When lex_check passes, lex_spec_check passes, or lex_test passes — these verification events produce no attestation record. The review agent can call attestation_query but finds nothing, because no prior agent populated the chain. Human code review remains the trust anchor.

Design

New tool: attest_fn

attest_fn(
  fn_name: Str,
  kind: Str,          # "type_check" | "spec_check" | "test" | "review"
  evidence: Str,      # output from the verification run
  project_root: Str
) -> AttestResult

Implementation: shell out to lex trail append (or write directly to .lex/trail.db) with the event kind verified.type_check / verified.spec_check / verified.test.

Prompt changes

Build agent — after lex_check passes on a function, call:

attest_fn(fn_name, "type_check", lex_check_output, project_root)

Spec agent — after lex_spec_check passes:

attest_fn(fn_name, "spec_check", spec_check_output, project_root)

Test agent — after lex_test passes:

attest_fn(fn_name, "test", test_output, project_root)

Review agent — after completing a review:

attest_fn(fn_name, "review", review_summary, project_root)

Permission changes

Add "attest_fn" to build_permission(), spec_permission(), test_permission(), review_permission().

Acceptance

• After build agent successfully checks a function, attestation_query returns a verified.type_check record
• After spec agent passes lex_spec_check, attestation_query returns verified.spec_check
• After test agent passes lex_test, attestation_query returns verified.test
• Review agent prompt references the attestation chain as the primary trust signal
• lex check --strict src/ passes