@research-engineering/agentic-proofkit 0.1.136

package/docs/specs/proofkit-consumer-infra-retirement/requirements.v1.json

@@ -0,0 +1,283 @@
+{
+  "schemaVersion": 1,
+  "sourceId": "proofkit.consumer-infra-retirement.requirements",
+  "specPackagePath": "docs/specs/proofkit-consumer-infra-retirement",
+  "overviewPath": "docs/specs/proofkit-consumer-infra-retirement/overview.md",
+  "requirementsPath": "docs/specs/proofkit-consumer-infra-retirement/requirements.v1.json",
+  "requirements": [
+    {
+      "requirementId": "REQ-PROOFKIT-RETIRE-001",
+      "ownerId": "proofkit.consumer-infra-retirement",
+      "invariant": "Migration plans keep old and new proof owners explicit and block retirement unless caller-provided parity evidence and post-retirement validation commands exist.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RETIRE-001"
+      ],
+      "nonClaims": [
+        "This requirement does not claim file deletion, parity authenticity, native witness execution, proof freshness, merge approval, release approval, or rollout approval."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.consumer-infra-retirement",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-RETIRE-002",
+      "ownerId": "proofkit.consumer-infra-retirement",
+      "invariant": "Package runtime dependency admission validates caller-provided installed package identity and location facts without reading package manager state or resolving packages.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RETIRE-002"
+      ],
+      "nonClaims": [
+        "This requirement does not claim package resolution, manifest reads, lockfile reads, registry authentication, package-manager authority, native execution, proof freshness, merge approval, or rollout approval."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.consumer-infra-retirement",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-RETIRE-003",
+      "ownerId": "proofkit.consumer-infra-retirement",
+      "invariant": "Workspace registry admission validates caller-provided script, dependency, and lockfile facts against caller policy without owning repository command policy or lockfile freshness.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RETIRE-003"
+      ],
+      "nonClaims": [
+        "This requirement does not claim script execution, lockfile generation, lockfile freshness, registry authentication, package-manager behavior, CI scheduling, merge approval, or rollout approval."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.consumer-infra-retirement",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-RETIRE-004",
+      "ownerId": "proofkit.consumer-infra-retirement",
+      "invariant": "Repo-profile structural and command admission validates caller-owned profile, path, command, and environment facts without scanning repositories or approving native proof coverage.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RETIRE-004"
+      ],
+      "nonClaims": [
+        "This requirement does not claim repository scanning, tracked-file freshness, command execution, native proof coverage, CI readiness, merge approval, release approval, or rollout approval."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.consumer-infra-retirement",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-RETIRE-005",
+      "ownerId": "proofkit.consumer-infra-retirement",
+      "invariant": "Adoption workflow plans route legacy migration, gradual adoption, and release-channel scenarios to existing Proofkit primitives through bounded structured command refs.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RETIRE-005"
+      ],
+      "nonClaims": [
+        "This requirement does not claim scenario appropriateness, repository scanning, command execution, receipt authentication, proof freshness, merge approval, release approval, or rollout approval."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.consumer-infra-retirement",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-RETIRE-006",
+      "ownerId": "proofkit.consumer-infra-retirement",
+      "invariant": "Migration parity admission validates caller-provided parity evidence shape, source/target closure, typed equivalence dimensions, and matched digest equality without owning evidence authenticity, freshness, semantic correctness, or retirement approval.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RETIRE-006"
+      ],
+      "nonClaims": [
+        "This requirement does not claim parity authenticity, digest computation, native witness execution, proof freshness, semantic correctness, proof coverage adequacy, old-owner deletion approval, merge approval, release approval, or rollout approval."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.consumer-infra-retirement",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-RETIRE-007",
+      "ownerId": "proofkit.consumer-infra-retirement",
+      "invariant": "Gradual adoption guidance keeps caller-provided candidate semantic boundaries advisory, exposes owner-review questions and bounded agent routes, validates adoption mode and checked-scope semantics through one private vocabulary owner, and fails closed for enforcement modes until the consumer admits stable requirements and proof bindings.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RETIRE-007"
+      ],
+      "nonClaims": [
+        "This requirement does not claim repository scanning, semantic boundary correctness, automatic requirement extraction, native witness execution, proof freshness, owner approval, merge approval, release approval, or rollout approval."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.consumer-infra-retirement",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-RETIRE-008",
+      "ownerId": "proofkit.consumer-infra-retirement",
+      "invariant": "Adoption doctor reports classify caller-provided imperfect-repository migration gaps, non-passing child reports, and stale current authority vocabulary facts into advisory, failed, or blocked states, and emit bounded owner-specific agent guidance without scanning repositories or owning semantic boundary decisions.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RETIRE-008"
+      ],
+      "nonClaims": [
+        "This requirement does not claim repository scanning, text extraction from files, semantic boundary correctness, automatic requirement extraction, native witness execution, receipt authenticity, proof freshness, owner approval, merge approval, release approval, rollout approval, or old proof-owner retirement approval."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.consumer-infra-retirement",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-RETIRE-009",
+      "ownerId": "proofkit.consumer-infra-retirement",
+      "invariant": "Workspace manifest fact projection admits explicit caller-owned package manifest records and emits registry-compatible root/package facts, package-universe facts, and workspace planning inputs without reading manifest paths, interpreting package-manager policy, executing commands, or owning script/dependency policy.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RETIRE-009"
+      ],
+      "nonClaims": [
+        "This requirement does not claim repository scanning, manifest freshness, workspace glob expansion, package-manager authority, dependency version policy, script policy, native command execution, lockfile freshness, CI scheduling, merge approval, release approval, rollout approval, or production readiness."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.consumer-infra-retirement",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-RETIRE-010",
+      "ownerId": "proofkit.consumer-infra-retirement",
+      "invariant": "Registry consumer proof input composition admits explicit caller-owned registry metadata, registry pack comparison, lock, smoke, rollback, precondition, and release-authority facts, emits a registry-consumer input only when those facts are complete and aligned, and preserves registry-consumer as the final proof-schema owner.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RETIRE-010"
+      ],
+      "nonClaims": [
+        "This requirement does not claim registry metadata authenticity, package publication, package access-control, package-manager execution, native smoke execution, rollback execution, release-authority producer trust, proof freshness, merge approval, release approval, rollout approval, or production readiness."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.consumer-infra-retirement",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    }
+  ],
+  "nonClaims": [
+    "Consumers still own old proof surfaces, new Proofkit inputs, parity evidence, native witness execution, command policy, receipts, CI admission, merge approval, release approval, rollout approval, and production decisions.",
+    "Proofkit consumer infrastructure retirement requirements describe reusable planning and admission primitives only."
+  ]
+}

package/docs/specs/proofkit-package-boundary/overview.md

@@ -0,0 +1,43 @@
+# Proofkit Package Boundary Spec
+
+This spec owns the first self-hosted Proofkit package-boundary requirements.
+It is intentionally narrow: it covers package CLI/report boundary, module import
+denial, and package artifact behavior only.
+
+## Requirements
+
+- `REQ-PROOFKIT-PACKAGE-001`: the package artifact set exposes the supported
+  CLI through one root package with embedded platform binaries while denying
+  root imports, source imports, generated JavaScript imports, and deep internal
+  package paths as public contract.
+- `REQ-PROOFKIT-PACKAGE-002`: the CLI builds deterministic reports, plans,
+  generated source artifacts, and policy-admission results from explicit
+  caller-owned JSON, declared no-input command parameters, or declared explicit
+  scanner scope classes without executing native witnesses, scanning implicit
+  repository state, deciding proof freshness, or accepting broad caller-supplied
+  phrase suppressors that can hide readiness overclaims.
+- `REQ-PROOFKIT-PACKAGE-003`: the root package remains installable and
+  executable by an outside consumer on the current native platform without
+  claiming registry publication.
+- `REQ-PROOFKIT-PACKAGE-004`: CI package-gate receipts used as merge evidence
+  are admitted through a declared producer policy and proof-receipt shape
+  validator instead of current-build output alone.
+- `REQ-PROOFKIT-PACKAGE-005`: the Go source, static analysis, package gate,
+  and vulnerability gates remain the native merge-critical quality floor for
+  the current Proofkit source tree.
+- `REQ-PROOFKIT-PACKAGE-006`: Python/uv distribution is a platform wheel
+  wrapper over the same Go CLI, with wheel-safe package metadata, wheel tags,
+  embedded binary identity, local install smoke proof, and explicit non-claims
+  until PyPI publication.
+
+## Non-Claims
+
+- This spec does not claim consumer repository adoption.
+- This spec does not claim registry publication.
+- This spec does not claim PyPI publication.
+- This spec does not claim runtime execution for non-native embedded platform
+  binaries unless CI supplies that native OS and CPU tuple.
+- This spec does not claim proof freshness, merge approval, rollout approval,
+  or production readiness.
+- This spec does not make current-build Proofkit output sufficient to admit the
+  same current build.

package/docs/specs/proofkit-package-boundary/requirements.v1.json

@@ -0,0 +1,176 @@
+{
+  "schemaVersion": 1,
+  "sourceId": "proofkit.package-boundary.requirements",
+  "specPackagePath": "docs/specs/proofkit-package-boundary",
+  "overviewPath": "docs/specs/proofkit-package-boundary/overview.md",
+  "requirementsPath": "docs/specs/proofkit-package-boundary/requirements.v1.json",
+  "requirements": [
+    {
+      "requirementId": "REQ-PROOFKIT-PACKAGE-001",
+      "ownerId": "proofkit.package-boundary",
+      "invariant": "The package artifact set exposes the supported CLI through one root package with embedded platform binaries while denying root imports, source imports, generated JavaScript imports, and deep internal package paths as public contract.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-PACKAGE-001"
+      ],
+      "nonClaims": [
+        "This requirement does not claim consumer adoption, registry publication, rollout approval, or production readiness."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.package-boundary",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-PACKAGE-002",
+      "ownerId": "proofkit.package-boundary",
+      "invariant": "The CLI builds deterministic reports, plans, generated source artifacts, and policy-admission results from explicit caller-owned JSON, declared no-input command parameters, or declared explicit scanner scope classes without executing native witnesses, scanning implicit repository state, deciding proof freshness, or accepting broad caller-supplied phrase suppressors that can hide readiness overclaims.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-PACKAGE-002"
+      ],
+      "nonClaims": [
+        "This requirement does not claim native witness execution, producer authentication, proof freshness, or merge approval."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.package-boundary",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-PACKAGE-003",
+      "ownerId": "proofkit.package-boundary",
+      "invariant": "The root package remains installable and executable by an outside consumer on the current native platform without claiming registry publication.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-PACKAGE-003"
+      ],
+      "nonClaims": [
+        "This requirement does not claim registry publication, registry consumer installation, execution for non-native platform binaries, or rollout readiness."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.package-boundary",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-PACKAGE-004",
+      "ownerId": "proofkit.package-boundary",
+      "invariant": "CI package-gate receipts used as merge evidence are admitted through a declared producer policy and proof-receipt shape validator instead of current-build output alone.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-PACKAGE-004"
+      ],
+      "nonClaims": [
+        "This requirement does not authenticate GitHub Actions, compute proof freshness, approve merge, approve release, or make local advisory receipts merge-satisfying evidence."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.package-boundary",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-PACKAGE-005",
+      "ownerId": "proofkit.package-boundary",
+      "invariant": "The Go source, formatting, static analysis, vet, test, package artifact, and vulnerability gates remain the native merge-critical quality floor for the current Proofkit source tree.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-PACKAGE-005"
+      ],
+      "nonClaims": [
+        "This requirement does not claim semantic completeness, release approval, registry publication, consumer rollout, or production readiness."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.package-boundary",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-PACKAGE-006",
+      "ownerId": "proofkit.package-boundary",
+      "invariant": "Python/uv distribution is a platform wheel wrapper over the same Go CLI, with wheel-safe package metadata, wheel tags, embedded binary identity, local install smoke proof, and explicit non-claims until PyPI publication.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-PACKAGE-006"
+      ],
+      "nonClaims": [
+        "This requirement does not claim PyPI publication, PyPI registry install authority, a Python SDK contract, consumer rollout, or execution for non-native wheel platforms."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.package-boundary",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    }
+  ],
+  "nonClaims": [
+    "Proofkit requirement source admission validates record shape only; it does not own requirement meaning.",
+    "Proofkit self-hosting records do not replace native package tests, release evidence, or registry publication proof.",
+    "Python wheel candidate artifacts do not prove PyPI publication."
+  ]
+}

package/docs/specs/proofkit-receipt-authority/overview.md

@@ -0,0 +1,35 @@
+# Proofkit Receipt Authority Spec
+
+This spec owns Proofkit's reusable receipt authority primitives: proof receipt
+shape admission, receipt producer policy linkage, producer-policy self-proof
+guards, and spec-proof bundle linkage between requirements, witness plans,
+producer admission, and receipts.
+
+It is intentionally infrastructure-only. Consumers authenticate producers,
+define trust roots, execute native witnesses, compute freshness, match current
+obligations, and decide merge, release, rollout, and production policy.
+
+## Requirements
+
+- `REQ-PROOFKIT-RECEIPT-001`: proof receipt admission validates caller-provided
+  receipt shape, digests, timestamps, selectors, evidence refs, artifact refs,
+  status, and provenance fields without authenticating producers or computing
+  freshness.
+- `REQ-PROOFKIT-RECEIPT-002`: receipt producer admission validates
+  caller-owned producer policy and receipt metadata linkage without proving that
+  the producer actually created the receipt.
+- `REQ-PROOFKIT-RECEIPT-003`: producer-policy self-proof detects when
+  merge-obligation receipts depend on trust tuples newly admitted by the same
+  policy change without approving or rejecting the policy change itself.
+- `REQ-PROOFKIT-RECEIPT-004`: spec-proof bundle admission validates linkage
+  across requirement bindings, witness plans, producer admission, and receipt
+  admission without executing native witnesses or approving merge.
+
+## Non-Claims
+
+- This spec does not authenticate CI, local runners, or receipt producers.
+- This spec does not compute receipt freshness or current-obligation
+  satisfaction.
+- This spec does not execute commands or verify native command pass evidence.
+- This spec does not approve merge, release, registry publication, rollout, or
+  production readiness.

package/docs/specs/proofkit-receipt-authority/requirements.v1.json

@@ -0,0 +1,121 @@
+{
+  "schemaVersion": 1,
+  "sourceId": "proofkit.receipt-authority.requirements",
+  "specPackagePath": "docs/specs/proofkit-receipt-authority",
+  "overviewPath": "docs/specs/proofkit-receipt-authority/overview.md",
+  "requirementsPath": "docs/specs/proofkit-receipt-authority/requirements.v1.json",
+  "requirements": [
+    {
+      "requirementId": "REQ-PROOFKIT-RECEIPT-001",
+      "ownerId": "proofkit.receipt-authority",
+      "invariant": "Proof receipt admission validates caller-provided receipt shape, digests, timestamps, selectors, evidence refs, artifact refs, status, and provenance fields without authenticating producers or computing freshness.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RECEIPT-001"
+      ],
+      "nonClaims": [
+        "This requirement does not claim producer authentication, receipt freshness, native command execution, command result correctness, current-obligation matching, or merge approval."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.receipt-authority",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-RECEIPT-002",
+      "ownerId": "proofkit.receipt-authority",
+      "invariant": "Receipt producer admission validates caller-owned producer policy and receipt metadata linkage without proving that the producer actually created the receipt.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RECEIPT-002"
+      ],
+      "nonClaims": [
+        "This requirement does not claim producer authentication, receipt freshness, command execution, command result correctness, CI log authority, or merge approval."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.receipt-authority",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-RECEIPT-003",
+      "ownerId": "proofkit.receipt-authority",
+      "invariant": "Producer-policy self-proof detects when merge-obligation receipts depend on trust tuples newly admitted by the same policy change without approving or rejecting the policy change itself.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RECEIPT-003"
+      ],
+      "nonClaims": [
+        "This requirement does not claim producer authentication, receipt freshness, policy digest provenance, policy-diff discovery, migration exception approval, or merge approval."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.receipt-authority",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-RECEIPT-004",
+      "ownerId": "proofkit.receipt-authority",
+      "invariant": "Spec-proof bundle admission validates linkage across requirement bindings, witness plans, producer admission, and receipt admission without executing native witnesses or approving merge.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-RECEIPT-004"
+      ],
+      "nonClaims": [
+        "This requirement does not claim native witness execution, producer authentication, proof freshness, command result correctness, merge approval, release approval, or rollout approval."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.receipt-authority",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
+    }
+  ],
+  "nonClaims": [
+    "Consumers still own producer trust roots, native witness execution, receipt freshness, current-obligation matching, CI admission, merge policy, and rollout decisions.",
+    "Proofkit receipt authority requirements describe reusable receipt shape and linkage primitives only."
+  ]
+}