docs(spec): admit incremental mediation as a §12.1 exception

[MohammadHaroonAbuomar]

Summary

The streaming comparison study (agent-control-spec analysis/streaming-acs-vs-maf.md, R6) audited incremental stream mediation against the enforcement lessons of the MAF agent-hooks integration — verdict-before-durability, observer channels on the wrong side of the gate, retry attempts escaping a single covering verdict, abandoned streams leaving no audit outcome — and found a conformance tension on our side: §12.1 mandates assemble-before-post_model_call with no exception, while §12.1a already reserves buffered_output: false for hosts that stream to their caller. A host mediating incrementally under a sound accounting discipline such as ACS §18.1 (already in our CLAIMS table) therefore read as §12.1-non-conformant and could not make a coherent claim. These changes encode enforcement lessons from the agent-hooks integration review in microsoft/agent-framework#7515, and the wording was validated against the merged MAF implementation as the reference buffered_output: true host.

What this prevents

Without the exception, the only conformant postures were full buffering or a blanket stream_incomplete deny — so a latency-sensitive host either abandoned the claim or claimed while quietly violating §12.1, hiding exactly the exposures the study catalogued. The exception makes the incremental posture claimable only under a bounded-exposure accounting discipline: verdict-covered release within a declared exposure bound, a deny that terminates the stream and withholds the unreleased remainder (content an earlier emission permitted included), fail-closed residue at end of stream with host_error:streaming_unsupported, and §6.1-gated durability that also covers withheld-but-permitted content. The §12.1a declaration and §13.3 claim must state the exposure bound, so the claim says what can egress ahead of its verdict instead of leaving it implied.

The MAF cross-validation added four hardenings: §12.1 distinguishes an errored model call (handled per §6.1 — no post_model_call, zero egress/durability) from the stream_incomplete shape, which is for hosts that cannot buffer; exception item 4 extends durability gating to content an earlier emission permitted but the host never released; §12.1a pins released-content identity on the buffered path (released content is the verdicted, post-transform content — no rewriting between verdict and release); and §12.1a defines the caller as any consumer outside the enforcement boundary, observers, callbacks, and preview channels included, matching the clause ACS PR responsibleai/agent-control-spec#30 adds to §18.1.

Scope

Deliberately minimal and capability-shaped (not the full R7 CTK surface): buffered_output remains declaration-only, each incremental emission stays an ordinary post_model_call under §4–§7, and conformance vectors exercising the accounting discipline against a mocked stream are noted as future work. CLAIMS.md, HARNESS.md, THREAT-MODEL.md (TM-11), PRODUCTION.md, and the CHANGELOG are updated to match. Additive; no version bump.

Test plan

• scripts/check-version-consistency.py — version surfaces agree (0.1.0-alpha.4).
• No schema, vector, SDK, or workflow changes; the schema-lint and SDK CI jobs are unaffected by this diff.