feat(apex): add role-separated orchestration foundation

apexcode/Cargo.toml

@@ -3,5 +3,6 @@ members = [
  "apex-policy",
  "apex-task-state",
  "apex-evidence",
+ "apex-orchestrator",
 ]
 resolver = "3"

apexcode/apex-evidence/src/lib.rs

@@ -373,12 +373,20 @@ mod tests {
 
  struct FixtureVerifier;
 
+ struct RejectingVerifier;
+
  impl SourceVerifier for FixtureVerifier {
  fn verify(&self, _task_id: &str, _task_revision: u64, _source_revision: &str) -> bool {
  true
  }
  }
 
+ impl SourceVerifier for RejectingVerifier {
+ fn verify(&self, _task_id: &str, _task_revision: u64, _source_revision: &str) -> bool {
+ false
+ }
+ }
+
  fn subject(task_id: &str, revision: u64, source: &str) -> EvidenceSubject {
  EvidenceSubject::new(task_id, revision, source)
  .unwrap()
@@ -602,6 +610,16 @@ mod tests {
  );
  }
 
+ #[test]
+ fn failed_verification_does_not_upgrade_subject() {
+ let subject = EvidenceSubject::new("task-a", 7, "abc123").unwrap();
+ assert_eq!(
+ subject.clone().verify_with(&RejectingVerifier),
+ Err(EvidenceError::VerificationFailed)
+ );
+ assert!(!subject.is_verified());
+ }
+
  #[test]
  fn safe_requires_security_evidence() {
  let expected = subject("task-a", 7, "abc123");

apexcode/apex-orchestrator/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "apex-orchestrator"
+version = "0.1.0"
+edition = "2024"
+license = "Apache-2.0"
+description = "Role-separated orchestration and release decisions for ApexCode"
+publish = false
+
+[lib]
+path = "src/lib.rs"
+
+[dependencies]
+apex-evidence = { path = "../apex-evidence" }
+apex-policy = { path = "../apex-policy" }
+apex-task-state = { path = "../apex-task-state" }