feat: catalog-to-proof pipeline + loop-engine domain generalization (Phase A, U9–U10)

[wjlgatech]

Summary

Two phases of work land together on this branch:

Catalog-to-proof pipeline (plan-003, U1–U8) — turns real clianything.cc /
printingpress.dev CLIs into verified before/after loop proofs by adopting them
as refine-only baselines, proving the loop's own value (not the generators it
wraps). Includes the SHA-pinned, credential-pruned catalog adopter; the
refine-only loop entrypoint; the ProofPack builder + store-backed compounder;
the demo proof CLI; arxiv/hackernews/wikipedia proof targets; and a
provider-agnostic fallback-chain LLM refiner (NIM/Groq/Gemini/Ollama) for
quota-free refine.

Loop-engine domain generalization, Phase A (plan-004, U9–U10) — widens the
loop core so a target can be any domain, not just code, with no new states
or branches in loop/controller.py:

• U9 — new Domain plugin protocol (binds Factory|adopt-baseline + Judge
  per target); persisted nullable iterations.score column threaded through the
  store + controller. Every domain projects onto both score (primary) and a
  non-null grade letter, so the controller / LoopOutcome / NOT-NULL schema
  are untouched (KTD1).
• U10 — Budget.target_score score-based convergence with a per-domain
  variance band: safety stays first and unbypassable; a score target skips the
  letter ladder; is_improvement decides on the score delta inside a letter
  band; is_plateaued(on_score=) ranks the persisted score (gated, so the
  software letter path is byte-identical, R2).

Invariants preserved

• Wrap, don't fork · protocol-only controller (untouched) · safety is
  unbypassable (score path is reached only past the BLOCKED_SAFETY gate).

Testing

pytest -q → 190 passed, 2 skipped (the 2 skips are the gated sim/quota
e2e). Regression-critical test_router.py / test_convergence.py /
test_loop_controller.py / test_memory_store.py stay green.

🤖 Generated with Claude Code

[wjlgatech]

Update: refine is no longer gated on the `claude -p` quota

Added a provider-agnostic, claude-free refiner so a real before/after proof can run today on a free backend (no waiting for the 2026-07-01 quota window).

• src/loopeng/adapters/llm_refiner.py — FallbackLLMRefiner: any OpenAI-compatible endpoint with a free-tier fallback chain (NVIDIA NIM → Groq → Gemini → local Ollama, per the free-llm design), stdlib urllib (no new dependency). Edits applied as jailed full-file rewrites (within_workspace); model output never executed.
• loop-anything demo proof <id> --refiner claude|llm. Preflight's refine gate drops the compound-engineering requirement for llm; the gated e2e accepts LOOPENG_PROOF_REFINER=llm with a free provider key.
• The Refiner is a protocol, so the controller is unchanged — compound-engineering stays the documented default; the LLM refiner is an opt-in quota-free alternative.

Decision record: docs/solutions/pluggable-refiner.md. Tests: +12 (LLM refiner + refine-gate). Suite: 167 passing, 2 skipped.