@marinjursic/prc-linux-arm64 0.1.0

package/bin/docs/scanner/ai-control-review.md

@@ -0,0 +1,208 @@
+# Safe AI review of all controls
+
+`prc scan` always puts all 10,042 controls in the report. By default it checks
+only facts that the local scanner can prove safely. Broad questions stay
+`needs_review` instead of being guessed.
+
+An optional AI review can add advice for those broad questions. You choose
+Codex or Claude Code. The AI result is extra information; it cannot change the
+scanner's real pass, fail, blocked, or review state, and it never fixes files.
+
+## Before you start
+
+Install one supported command-line tool:
+
+- `codex` for Codex; or
+- `claude` for Claude Code.
+
+Sign in once through the scanner. This launches the provider's official login flow but
+stores its credentials in a private scanner-only directory:
+
+```bash
+prc login codex
+# or: prc login claude
+
+prc auth
+```
+
+The scanner does not reuse the provider's normal user configuration, sessions,
+instructions, plugins, hooks, or MCP servers. A scan uses the scanner-only login
+with a fresh temporary home and a small runtime environment allowlist. Use
+`prc logout codex` or `prc logout claude` to remove the saved scanner login.
+
+Supported API-key environment variables remain an alternative: Codex accepts
+`OPENAI_API_KEY` or `CODEX_API_KEY`; Claude accepts `ANTHROPIC_API_KEY`,
+`ANTHROPIC_AUTH_TOKEN`, or `CLAUDE_CODE_OAUTH_TOKEN`. Only the selected
+credential is forwarded. Remove a temporary variable from the shell after use.
+
+AI review can send source excerpts to a remote model and can cost money. Read
+the provider's data and billing rules first. The short `--ai` option is explicit
+permission for screened source processing. The advanced form requires the
+separate `--allow-remote-source-processing` switch.
+
+## Try one control first
+
+The shortest full-review command is:
+
+```bash
+prc full codex
+```
+
+Use `prc full claude` for Claude Code. `prc scan --ai codex|claude` remains an
+equivalent advanced-friendly spelling. To test only one control first, use the
+advanced form:
+
+```bash
+prc scan /path/to/project \
+  --review-provider codex \
+  --review-control PRC-02-001 \
+  --allow-remote-source-processing
+```
+
+For Claude Code, replace the provider name:
+
+```bash
+prc scan /path/to/project \
+  --review-provider claude \
+  --review-control PRC-02-001 \
+  --allow-remote-source-processing
+```
+
+Open the `Detailed report:` path printed at the end. Find `PRC-02-001`. Its
+normal scanner state is still present. The AI section separately shows:
+
+- its suggested result;
+- whether it thinks the rule applies;
+- confidence;
+- reason and advice;
+- exact excerpt lines it used;
+- separate citation-location and claim verification states; and
+- what it could not prove.
+
+`snapshot_location_validated` means the path and line existed in the exact
+screened snapshot bound to the task. It does not mean the line supports the AI
+sentence. The claim therefore remains `advisory_unverified` until an independent
+typed verifier or a qualified person proves it.
+
+## Review all 10,042 controls
+
+The short commands review all active controls:
+
+```bash
+prc full codex
+prc full claude
+```
+
+Use the advanced form only when changing defaults, for example Codex `xhigh`
+effort:
+
+```bash
+prc scan /path/to/project \
+  --review-provider codex \
+  --review-effort xhigh \
+  --allow-remote-source-processing
+```
+
+This is deliberately slow and expensive. The scanner makes batches of at most
+eight controls. For each batch, it tells the top AI process to create exactly
+one separate subagent per control, wait for all of them, and return exactly one
+result per control. With 10,042 active controls and the default batch size,
+expect about 1,256 provider calls and 10,042 subagent reviews. The exact token
+and money cost depends on the chosen provider and model.
+
+The scanner can require this orchestration in the sealed task and verify that
+one final result returns for every control. Current provider output does not
+offer trustworthy proof of each internal subagent call, so the scanner does not
+treat claimed orchestration as evidence. A provider that skips a requested
+subagent can at most produce untrusted advisory text, never a verified Pass.
+
+Completed batches are stored privately outside the target project. If a later
+batch fails or the run is stopped, run the same command again. Matching finished
+batches are checked and reused. The report is written only after every requested
+batch has a valid result.
+
+## What is sent to the provider
+
+The scanner first creates a temporary, private copy of selected text files. It:
+
+- uses the exact files and hashes from the local inventory;
+- does not follow symlinks;
+- skips `.env`, `.npmrc`, credentials, private-key files, AI instruction files,
+  and similar sensitive names;
+- rejects known high-confidence token and private-key shapes before any provider
+  starts;
+- skips binary and invalid text;
+- limits each copied file, the total copy, path list, excerpt size, file count,
+  and provider output size; and
+- removes the temporary copy at the end.
+
+The provider gets a sealed JSON task containing control text, deterministic
+check context, repository paths, and selected excerpts. Repository text is
+marked as untrusted data. A file that says “ignore the scanner” is not treated
+as an instruction.
+
+The scanner never gives the provider the source workspace path. For Codex it
+disables shell, web search, apps, browser, computer use, MCP servers, and project
+rules, uses a read-only sandbox, and allows only subagent coordination. For
+Claude Code it allows only the `Agent` tool and blocks Bash, Read, Glob, Grep,
+Write, Edit, web tools, and questions. Provider output must match a strict JSON
+schema, the sealed task ID, every requested control in order, safe evidence
+paths and real line numbers, and fixed size limits.
+
+This screen is a safety layer, not a complete secret scanner. Do not opt in with
+source that you are not allowed to send to the selected provider.
+
+The scanner stops if it can see local Claude managed settings because those can
+force hooks, plugins, or MCP policy that an ordinary setting cannot override.
+It cannot inspect every policy delivered by a provider's server. The provider
+binary and remote service therefore remain trusted dependencies even though
+they receive no target path or general-purpose workspace tools.
+
+## Result meanings
+
+AI review uses candidate words on purpose:
+
+| AI value | Simple meaning |
+| --- | --- |
+| `advisory_pass_candidate` | The shown excerpts look consistent with the rule, but this is not a verified Pass. |
+| `advisory_fail_candidate` | The shown excerpts suggest a problem worth fixing or checking. |
+| `needs_evidence` | Source excerpts cannot prove the rule. Runtime, production, legal, company, or human proof may be needed. |
+| `not_applicable_candidate` | The AI thinks the trigger is absent. A trusted check or person must still make the final decision. |
+
+Folder structure is a good example. The AI may explain that a surprising layout
+makes ownership or navigation unclear, but it must not require universal names
+such as `src`, `components`, or `services`. Advice must fit the project's real
+language, build system, size, boundaries, and conventions.
+
+## Useful controls
+
+| Option | Default | Meaning |
+| --- | ---: | --- |
+| `--ai` | off | Short form: choose `codex` or `claude` and explicitly allow screened remote processing. |
+| `--review-provider` | `none` | Choose `codex` or `claude`. No AI starts by default. |
+| `--review-control ID` | all active | Review one named control; repeat for a small test set. |
+| `--review-batch-size` | `8` | Provider calls contain 1–8 controls; every control still gets its own subagent. |
+| `--review-workers` | `1` | Run 1–4 provider calls at once. One is safer for cost and rate limits. |
+| `--review-timeout` | `30m` | Limit for each resumable batch. |
+| `--review-effort` | `high` | Codex supports `high` or `xhigh`; Claude uses `high`. |
+| `--review-model` | provider default | Pin a provider model when needed. |
+| `--review-state-dir` | user cache | Choose a private resume directory outside the target. |
+| `--review-max-cost-usd` | no limit | Claude-only cost limit for each batch. Codex does not expose the same hard CLI limit. |
+
+More workers can finish sooner but increase simultaneous cost and the chance of
+provider rate limits. More controls per call reduce top-level calls but make the
+coordinator's job larger. The defaults favor correctness and easy resuming.
+
+## What stops the run
+
+The run stops with an execution error if:
+
+- a secret-like value is found before remote review;
+- the provider is missing, changes during the run, times out, or exits badly;
+- the schema changes during the run;
+- output is too large, malformed, incomplete, reordered, duplicated, or cites
+  a path or line outside the screened copy; or
+- a saved batch does not match its sealed task.
+
+Valid completed batches remain saved. No target file is changed, and no partial
+AI result is allowed to make a scanner rule pass.

package/bin/docs/scanner/benchmarks.md

@@ -0,0 +1,122 @@
+# Scanner benchmarks and quality budgets
+
+The benchmark runner measures scanner behavior on small, labeled fixture
+repositories. It is a release-regression tool, not a readiness score and not a
+claim that an assertion is accurate outside the represented fixture classes.
+
+The checked-in `core-native` suite currently covers deterministic examples of:
+
+- Pass and Fail results;
+- Not Applicable planning;
+- Blocked adapter evidence;
+- Manual Review evidence requirements; and
+- malformed-input execution errors.
+
+Each case binds its target inventory digest and is scanned twice at one fixed
+evaluation time. The report fails its quality gate if expected assessment or
+execution states drift, repeated runs differ, precision or recall falls below
+the suite budget, or the false-positive rate exceeds it. The content-addressed
+corpus digest combines the normalized suite definition with every fixture
+inventory digest.
+
+Run the suite locally:
+
+```bash
+prc benchmark run \
+  --catalog-root . \
+  --suite fixtures/benchmarks/core-native/suite.yaml \
+  --format human
+```
+
+Emit the versioned report used by CI:
+
+```bash
+prc benchmark run \
+  --catalog-root . \
+  --suite fixtures/benchmarks/core-native/suite.yaml \
+  --evaluated-at 2026-08-23T12:00:00Z \
+  --format json > benchmark-report.json
+```
+
+`--evaluated-at` makes the evidence timestamps and run identities reproducible
+for a controlled comparison. It does not override target content, catalog, or
+fixture identity.
+
+## Interpreting the metrics
+
+For benchmark metrics, an expected `fail` is the positive class. Precision is
+the fraction of reported failures that were labeled failures; recall is the
+fraction of labeled failures detected; the false-positive rate is measured
+against all labeled non-failure outcomes. Exact-state matching remains stricter
+than the binary metrics: confusing Blocked, Error, Manual Review, Not
+Applicable, or Pass still fails the suite even when it does not change the
+failure-class confusion matrix.
+
+The initial suite is deliberately small. Its perfect budget protects known
+behavior but does not establish broad real-world accuracy. New assertions need
+representative Pass, Fail, unsupported or Not Applicable, and execution-error
+fixtures before they can support a default release gate. Cross-platform,
+adversarial, performance, and tool-update differential suites remain required
+as coverage grows.
+
+## Validated packs
+
+A pack is a versioned distribution claim over a measured subset of the
+catalog. The `core-foundation` pack binds each included assertion to its exact
+catalog implementation and declares only the outcomes present in the pinned
+benchmark suite. Validation fails on catalog drift, suite digest drift,
+undeclared profile membership, or overstated outcome coverage:
+
+```bash
+prc pack validate \
+  --catalog-root . \
+  --file packs/core-foundation.yaml \
+  --format human
+```
+
+The smaller `core-foundation` pack contains three assertions and remains a
+fast contract test. The `core-native` pack binds all 40 assertions in the core
+profile to a 31-case, 139-expectation fixture corpus:
+
+```bash
+prc benchmark run \
+  --catalog-root . \
+  --suite fixtures/benchmarks/core-native/suite-comprehensive.yaml \
+  --evaluated-at 2026-08-23T12:00:00Z
+prc pack validate \
+  --catalog-root . \
+  --file packs/core-native.yaml
+```
+
+The v0.2 benchmark contract can materialize five bounded fixture conditions in
+a temporary copy: exact text-token replacement, final-newline removal, file
+truncation, permission-mode changes, and a synthetic immutable Git HEAD. It
+never executes target code, follows symlinks, or modifies the checked-in
+fixture. This gives each deterministic native assertion both its relevant
+positive and negative outcome; manual and adapter-backed assertions remain
+measured only in their fail-closed states. All limitations are part of the pack
+manifest and therefore its digest.
+
+Intentionally unsafe container, Terraform, Kubernetes, Go, private-key, merge
+conflict, file-mode, and malformed-source states exist only in materialized
+temporary copies. Their checked-in templates are valid and non-violating. A
+regression test scans the complete source fixture tree and rejects a negative
+fixture that would pollute a real scan of this repository.
+
+Pack membership does not authorize adapter execution and does not change gate
+semantics. Detached, scoped Ed25519 verification is supported through an
+explicit [publisher trust store](../architecture/publisher-trust.md). The
+repository does not yet publish an official release trust store or signed pack,
+so checked-in packs remain local integrity contracts rather than a remote trust
+channel.
+
+## Adapter release fixtures
+
+Repository benchmarks measure assertion decisions over project inventories.
+Recorded adapter fixtures instead measure the untrusted-tool boundary: parser
+limits, protocol rejection, manifest-declared output kinds, incomplete statuses,
+and determinism. Run the separate gate with `prc adapter fixture-validate`.
+Passing it is necessary for an adapter release but never substitutes for a
+tool-specific detection benchmark. See the
+[sandboxed adapter protocol](../architecture/adapters.md#inspect-and-validate)
+for the exact contract and limitations.

package/bin/docs/scanner/cli-contract.md

@@ -0,0 +1,130 @@
+# CLI and exit-code contract
+
+The scanner uses one stable process exit-code table across commands. Automation
+must inspect both the exit code and the versioned report; it must never interpret
+“a process ran” as “the profile passed.”
+
+| Code | Meaning |
+| ---: | --- |
+| `0` | The command completed and the selected gate passed. |
+| `1` | An active assessment gate failed (`no_go`). |
+| `2` | The assessment or requested environment check is incomplete or blocked. |
+| `3` | CLI input, project configuration, catalog, target, or state-location configuration is invalid. |
+| `4` | An adapter, provider, or execution protocol failed. |
+| `5` | Policy denied the requested operation or stopped it at a capability/change budget. |
+| `6` | An internal invariant, canonical-state operation, serialization, or output operation failed. |
+| `7` | The operation was cancelled. |
+| `8` | A candidate patch was produced but failed independent acceptance. |
+
+Codes are never borrowed directly from a child tool. An adapter maps its own
+process behavior into the scanner protocol; the scanner then decides whether
+the tool completed, found something, was partial, was unsupported, or failed.
+Requesting a live adapter without the explicit `--mode verify-local` capability
+grant returns `5` before the adapter runtime is resolved or invoked.
+Registry revocation, lifecycle, and trust-policy denials also return `5` before
+the runtime is selected. A malformed registry is a configuration failure.
+
+Errors are written to stderr with their stable class, for example:
+
+```text
+error [PRC-EXIT-5]: adapter ... is not authorized by an applicable assertion
+```
+
+Machine-readable reports remain on stdout. A completed assessment that does not
+pass is still a valid report and normally has no stderr error.
+
+`prc version` emits a human-readable build identity. `prc version --format json`
+emits `prc.version/v0.1`, including the semantic scanner version, exact source
+revision, reproducible source timestamp, and Go toolchain. Development builds
+report `unknown` for identity fields that were not injected by the release
+builder; consumers must not treat that as release provenance.
+
+`adapter fixture-validate` also uses `1` when its versioned fixture report is
+valid but one or more recorded expectations or determinism checks fail. Invalid
+suite structure, unsafe paths, manifest digest drift, or an attempted limit
+increase use `3`; the command never executes the adapter.
+
+## Scan policy
+
+`prc scan` inspects the current directory; `prc scan /path/to/project` inspects
+one explicit project. Scan options may appear before or after that path. The
+equivalent advanced `--target` flag remains available, but it cannot be combined
+with the positional project path.
+
+`prc quick` selects the 18-assertion `prc/quick` local profile. `prc scan`
+selects the 40-assertion core local profile. `prc full codex` and
+`prc full claude` select the core profile plus advisory AI review of every
+active control. `quick` rejects AI-provider flags, and both aliases reject a
+profile override so their meaning cannot be silently changed. Every mode still
+includes all 10,042 controls in the complete report.
+
+Human output creates one detailed standalone HTML report by default. The file is
+created privately outside the target, its absolute path is printed, and an
+existing file is never overwritten. `--report PATH` chooses a new file;
+`--no-report` disables the automatic report. JSON, Markdown, HTML, SARIF, and
+JUnit stdout formats do not create an extra report unless `--report` is also
+given. Report creation is output generation, not remediation: `scan` never
+invokes `fix`, `remediate`, or a write-capable target process.
+
+Human output uses `--color auto` by default. `--color always` and
+`--color never` are explicit alternatives. A nonempty `NO_COLOR` environment
+variable and `TERM=dumb` disable color. Color is never the only meaning: every
+line keeps a symbol and a Pass, Fail, Blocked, Manual, N/A, or Error word.
+Machine formats reject the human-only `--color` option and never contain ANSI
+bytes. Untrusted paths and messages are escaped to one printable line before
+terminal rendering.
+
+Every complete scan includes all 10,042 registered controls. Broad controls
+without complete proof remain `needs_review`; narrow passing assertions produce
+only `partially_verified`. `prc full codex|claude` and the equivalent
+`--ai codex|claude` form acknowledge screened remote source processing. The advanced form uses
+`--review-provider` plus `--allow-remote-source-processing`. Those providers add
+strict-schema advisory candidates and cannot change the authoritative
+disposition. Cited paths and lines are snapshot-location validated, while the
+AI claims remain explicitly `advisory_unverified`. Provider launch,
+timeout, secret-screening, or protocol failures return `4`. See
+[safe AI control review](ai-control-review.md).
+
+The default `--exit-policy profile` maps `profile_satisfied` to `0`, `no_go` to
+`1`, and incomplete, blocked, or manual-evidence states to `2`. A policy or
+budget terminal state maps to `5`.
+
+`--exit-policy no-go` does not convert incomplete evidence, blocked execution,
+or scanner errors into success. It is retained for gate-policy compatibility as
+profiles gain more non-no-go completed-failure states.
+
+`--exit-policy never` is an explicit report-generation override: after a scan
+has completed and emitted its canonical result it returns `0` regardless of the
+terminal assessment state. It does not alter that state, rewrite a finding, or
+hide a pre-report configuration, adapter, policy, cancellation, or internal
+error. Do not use `never` as a release gate.
+
+## Remediation policy
+
+One-shot `remediate` and `remediate-proposal` commands return `0` only for an
+accepted candidate and `8` for a fully reported but rejected candidate. A
+request that exceeds an allowed remediation class, protected-path rule, or
+configured capability budget returns `5`.
+
+The `fix` loop returns `0` only for `profile_satisfied`, `8` when candidate
+acceptance stops the loop, and `5` when policy or budget stops it. A configured
+provider launch, timeout, or protocol failure is recorded as `provider_failed`
+and returns `4`; a valid provider
+`unable` or `needs_escalation` response is recorded as `provider_stopped` and
+returns `2`. Explicit caller cancellation remains code `7` even though its
+failure evidence is preserved. Otherwise the embedded assessment gate maps through the scan table,
+so machine work ending with manual or unavailable evidence is `2`, not a
+production-readiness claim.
+
+`doctor` returns `2` when a requested required capability is unavailable. Its
+JSON report still distinguishes each passing, warning, and failing probe.
+
+## MCP stdio process
+
+`mcp serve` returns `0` after a clean stdin close. Invalid locked paths,
+configuration, catalog, or profile fail startup with `3`; an unreadable or
+oversized stdio transport message terminates with `4`. Individual valid
+JSON-RPC protocol and tool errors are returned on stdout using MCP error
+objects, so the process can continue serving later messages without converting
+an error into a readiness result. See the
+[read-only MCP agent integration](mcp-agent-integration.md).

package/bin/docs/scanner/configuration.md

@@ -0,0 +1,101 @@
+# Declared project configuration
+
+Repository discovery cannot safely infer release scope, risk, deployed features,
+data classes, or execution authority. `production-readiness.yaml` is the
+versioned declaration for those facts and for the scanner's local capability
+budget.
+
+The current `prc.config/v0.1` contract is deliberately restrictive. Inventory,
+plan, and scan commands accept it through `--config`. The scanner binds its
+canonical digest and declarations into the inventory and plan identity.
+Declaring a feature or environment is applicability context, not proof that the
+feature is deployed or behaves correctly.
+
+## Validate a configuration
+
+Start from the checked-in
+[`fixtures/config/production-readiness.yaml`](https://github.com/MarinJursic/production-readiness-checklist/blob/main/fixtures/config/production-readiness.yaml)
+example, then run:
+
+```bash
+prc config validate --file production-readiness.yaml
+prc config validate --file production-readiness.yaml --format json
+```
+
+The JSON output includes a SHA-256 digest over the canonical decoded document.
+Mapping-key order does not change the digest. Security-relevant lists must be
+sorted and duplicate-free so equivalent inputs have one representation.
+
+## Scope declarations
+
+The document records:
+
+- stable project identity and risk profile;
+- selected scanner profile, exact source revision, artifact digests, and target
+  environments;
+- included component roots and reviewed exclusions with rationales;
+- feature flags that discovery cannot establish safely;
+- data classifications, regulatory-context tags, and evidence classes that must
+  never be retained; and
+- execution and remediation budgets.
+
+Paths are repository-relative, normalized slash paths. Absolute paths,
+backslashes, traversal, duplicate paths, and unsorted declarations are rejected.
+Excluding a component does not delete it or cause the inventory walker to ignore
+it in v0.1. A configuration inside the target must match the exact regular file
+captured by inventory. An external configuration is also reopened and compared
+by both raw-source and canonical digests. A change after validation fails the
+run in either case.
+
+```bash
+prc inventory --target . --config production-readiness.yaml --format json
+prc plan --target . --catalog-root . --config production-readiness.yaml
+prc scan --target . --catalog-root . --config production-readiness.yaml
+```
+
+When `--profile` is omitted, plan and scan use the configured profile. An
+explicitly selected profile must match it. Declared components are additive;
+they do not erase discovered components or facts.
+
+`source_ref` must be empty or a lowercase 40–64 character hexadecimal revision.
+When supplied, it must equal the Git revision inventoried from the target; an
+unresolved variable, branch name, missing Git identity, or mismatch fails closed.
+Git metadata is read only when its directory and references remain inside the
+target root. A symlinked `.git` entry or a linked-worktree `gitdir` outside the
+target is not followed, so that target has no inferred Git identity and cannot
+satisfy a nonempty `source_ref`.
+
+## Capability boundary
+
+Configuration v0.1 accepts only deny-by-default capabilities and bounded resource
+declarations:
+
+- `network: deny`;
+- an empty `allow_commands` list;
+- `production_connected: false`;
+- bounded parallelism and duration declarations;
+- bounded remediation attempts, files, and changed lines; and
+- a nonempty protected-path list.
+
+A request for network access, target commands, or production connectivity fails
+validation instead of being accepted and ignored. Future configuration versions
+may add capabilities only together with an enforceable runner and threat-model
+update.
+
+The native scanner currently evaluates serially, so it remains below
+`max_parallel`. `max_duration_seconds` is enforced for configured live adapter
+execution and as the total `fix` loop deadline, including provider and verifier
+child processes. Native file discovery uses fixed internal size and traversal
+limits but is not yet interrupted by this setting. `remediate`,
+`remediate-proposal`, and `provider seal-task` also accept `--config`.
+Remediation must be enabled; configured duration, file, line, and attempt
+ceilings cannot be raised by command-line flags; configured protected paths and
+an in-target configuration source are always added to the immutable guard set.
+
+## Parser and file safety
+
+The loader accepts one regular YAML file no larger than 1 MiB. It rejects
+symlinks, missing or unknown fields, duplicate keys, null values, YAML aliases,
+multiple YAML documents, unsafe paths, unsupported enum values, capability
+expansion, and out-of-range budgets. The JSON Schema and Go semantic validator
+are both exercised in CI.

package/bin/docs/scanner/control-contracts.md

@@ -0,0 +1,47 @@
+# Control contracts
+
+The checklist contains broad objectives. A broad objective is not automatically
+an executable test. `catalog/control-contracts.json` gives every registered
+control a compact machine-readable triage contract without pretending that a
+generated classification is an expert-approved acceptance test.
+
+Every contract records:
+
+- whether repository, environment, human, or mixed evidence is expected;
+- whether deterministic checking or AI advice may be useful;
+- whether the wording appears compound, conditional, negative, absolute, or
+  dependent on a project-specific threshold;
+- the evidence authority that a future assertion may require;
+- the proof needed before Not Applicable may be proposed; and
+- whether the contract is generated and unreviewed or expert reviewed.
+
+Exact duplicate statements keep separate stable IDs but point to one canonical
+control ID. This is an alias, not permission to silently merge controls with
+different scope or meaning.
+
+Generated contracts are routing and review data only. They cannot produce a
+Pass. Before a contract becomes executable, a control owner must split compound
+promises, define measurable applicability and evidence, approve technology-
+neutral acceptance criteria, and add positive, negative, Not Applicable,
+unusual-layout, and adversarial fixtures.
+
+Every `prc.run/v0.12` complete scan binds the SHA-256 of this whole contract
+document and the individual contract SHA-256 on each of its 10,042 control
+results. A missing, stale, reordered, or edited contract file stops the scan.
+The ordinary local profile still executes only its explicitly registered narrow
+assertions. Optional AI review receives the contract as a routing hint and must
+keep repository, environment, and human evidence authority separate.
+
+The generated
+[`research/control-acceptance-criteria/README.md`](https://github.com/MarinJursic/production-readiness-checklist/blob/main/research/control-acceptance-criteria/README.md)
+indexes bounded parts that list proposed acceptance criteria, today's real
+scanner behavior, future check method, and wording warnings for every control.
+It is a review queue, not a claim that 10,042 expert-approved acceptance tests
+already exist.
+
+Regenerate and verify the file with:
+
+```bash
+python3 scripts/control_contracts.py generate
+python3 scripts/control_contracts.py check
+```