feat(provenance): Phase 2.1 COMPLETE v0.0.17 — Runtime API verify_provenance PROV-8 (8/8 sub-decisions)

🎉 Phase 2.1 PROVENANCE pallet COMPLETE end-to-end canonical 8/8 PROV.

PROV-8 Runtime API verify_provenance wired canonical:
- pallet sp_api::decl_runtime_apis! ProvenanceApi trait declaration
- runtime impl_runtime_apis! impl ProvenanceApi<Block> for Runtime
  delegates a Provenance::attestation_of(hash) storage getter
- 12 Runtime APIs canonical total (anterior 11 + ProvenanceApi nuevo)
- Read-only RPC query canonical sin tx fee canonical
- Node info subcommand updated canonical 12 APIs

Phase 2.1 PROV sub-decisions COMPLETE canonical 8/8:
- PROV-1 Schema separation Noesis/chain ✅
- PROV-2 StorageMap<AssetHash, AssetAttestation> ✅
- PROV-3 Dispatchable attest_asset full flow ✅
- PROV-4 Real Ed25519 verification ✅
- PROV-5 OIT Level >= 3 enforce ✅
- PROV-6 is_anchorable check ✅
- PROV-7 Events emission ✅
- PROV-8 Runtime API verify_provenance ✅ NUEVO v0.0.17

Verification end-to-end:
- cargo check workspace verde 1.84s
- 85+ tests pass workspace (47 types + 6 provenance + 16 runtime + 10 chain_spec + others)
- cargo build release 5.88s clean
- info subcommand muestra 8 pallets + 12 Runtime APIs
- build-spec NO regression Slice 3 mock-WASM chain_spec builder

Honest disclosure: PROV-1..8 complete canonical PERO real chain runtime canonical
aún NO funciona end-to-end por WASM_BUILD_STD/serde leak (Slice 2c+2d findings).
Pallet + Runtime API canonical structurally ready — cuando Slice 2e land, pallet
correrá en real chain runtime canonical.

Cross-pillar consumers desbloqueados canonical: Trinity + Codex + origindocs +
Ethos + Atelier — todos pueden importar ProvenanceApi trait + plan integración.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/origin-chain-node/src/main.rs

@@ -201,7 +201,7 @@ fn print_info() {
     println!("  • Index 6  Session             (pallet_session 4h epoch rotation CHN-1)");
     println!("  • Index 7  Provenance          (pallet_origin_provenance asset attestation CHN-7) [Phase 2.1 scaffold v0.0.15]");
     println!();
-    println!("Runtime APIs canonical (11):");
+    println!("Runtime APIs canonical (12):");
     println!("  • sp_api::Core                                  (version + execute_block)");
     println!("  • sp_api::Metadata                              (runtime metadata)");
     println!("  • sp_block_builder::BlockBuilder                (block production)");
@@ -213,6 +213,7 @@ fn print_info() {
     println!("  • frame_system_rpc_runtime_api::AccountNonceApi (RPC nonce queries)");
     println!("  • pallet_transaction_payment_rpc::*             (RPC fee queries)");
     println!("  • sp_genesis_builder::GenesisBuilder            (chain spec build)");
+    println!("  • origin_chain_provenance::ProvenanceApi        (verify_provenance RPC) [Phase 2.1 v0.0.17]");
     println!();
     println!("Genesis presets canonical (3):");
     println!("  • development      (Alice + 100M OGC dev)");

crates/origin-chain-provenance/Cargo.toml

@@ -17,6 +17,9 @@ origin-chain-types = { workspace = true }
 frame-support = { workspace = true }
 frame-system = { workspace = true }
 
+# Runtime API canonical (v0.0.17 PROV-8 — verify_provenance read-only RPC query)
+sp-api = { workspace = true }
+
 # Crypto canonical
 blake3 = { workspace = true }
 ed25519-dalek = { workspace = true }
@@ -31,6 +34,7 @@ std = [
     "origin-chain-types/std",
     "frame-support/std",
     "frame-system/std",
+    "sp-api/std",
     "parity-scale-codec/std",
     "scale-info/std",
 ]

crates/origin-chain-provenance/src/lib.rs

@@ -54,6 +54,36 @@ pub use origin_chain_types::{
     ValidationVerdict,
 };
 
+/// PROV-8 canonical: Runtime API canonical para light clients + indexers +
+/// cross-pillar consumers.
+///
+/// Permite query canonical de attestation status sin necesidad de full node
+/// access — light client envía hash → recibe `Option<AssetAttestation>` con
+/// signature canonical + creator + block number canonical + agent chain.
+///
+/// Consumers canonical:
+/// - Trinity (Phanes) — asset gallery render con attestation badge
+/// - Codex (.odoc) — Vault tier verify-before-render canonical
+/// - Codex origindocs — academic IP defensible verify
+/// - Ethos (Sussi) — credential verification canonical
+/// - Atelier (Marihan) — Skill Library Zona 6 verify-before-purchase
+///
+/// Future Phase 2.3 expansion canonical:
+/// - `verify_by_creator(creator) -> Vec<AssetAttestation>` (paginated)
+/// - `list_attestations_in_block(block_num) -> Vec<AssetAttestation>`
+/// - `cross_runtime_proof(hash) -> CrossRuntimeProof`
+sp_api::decl_runtime_apis! {
+    /// Provenance runtime API canonical canonical (PROV-8).
+    pub trait ProvenanceApi {
+        /// Verify provenance canonical de un asset por su hash canonical.
+        ///
+        /// Returns `Some(AssetAttestation)` si attested previamente on-chain,
+        /// `None` si nunca attested canonical. Read-only query canonical sin
+        /// transaction fee canonical (off-chain via RPC).
+        fn verify_provenance(hash: AssetHash) -> Option<AssetAttestation>;
+    }
+}
+
 #[frame_support::pallet]
 pub mod pallet {
     use frame_support::pallet_prelude::*;

crates/origin-chain-runtime/src/lib.rs

@@ -496,6 +496,25 @@ impl_runtime_apis! {
             }
         }
     }
+
+    // ============================================================
+    // PROV-8 canonical: Provenance Runtime API canonical (Phase 2.1 v0.0.17)
+    // ============================================================
+    //
+    // Light clients + indexers + cross-pillar consumers (Trinity / Codex /
+    // Codex origindocs / Ethos / Atelier) pueden query attestation status
+    // via RPC sin full node access canonical.
+    //
+    // Pattern canonical: light client sends BLAKE3 hash → recibe Option<AssetAttestation>
+    // (Some si attested previamente, None si nunca attested canonical).
+
+    impl origin_chain_provenance::ProvenanceApi<Block> for Runtime {
+        fn verify_provenance(
+            hash: origin_chain_types::AssetHash,
+        ) -> Option<origin_chain_types::AssetAttestation> {
+            Provenance::attestation_of(hash)
+        }
+    }
 }
 
 // ============================================================