@research-engineering/agentic-proofkit 0.1.136

package/docs/specs/proofkit-supply-chain-quality/requirements.v1.json

@@ -0,0 +1,260 @@
+{
+  "schemaVersion": 1,
+  "sourceId": "proofkit.supply-chain-quality.requirements",
+  "specPackagePath": "docs/specs/proofkit-supply-chain-quality",
+  "overviewPath": "docs/specs/proofkit-supply-chain-quality/overview.md",
+  "requirementsPath": "docs/specs/proofkit-supply-chain-quality/requirements.v1.json",
+  "nonClaims": [
+    "Proofkit supply-chain quality requirements do not claim vulnerability absence, license approval, public-source provenance, provider setting enforcement, release approval, consumer adoption, rollout readiness, or production readiness.",
+    "Provider-run security signals remain advisory until their provider evidence is admitted by the repository release or governance owner."
+  ],
+  "requirements": [
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-001",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Release artifacts carry deterministic digest inventory and optional GitHub artifact attestations without claiming public-source provenance before a public-source tag release exists.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-001"],
+      "nonClaims": ["This requirement does not claim public-source provenance, release approval, registry identity, consumer adoption, or rollout readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-002",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Release evidence includes a deterministic SBOM for package, wheel, binary, and Go module inventory without claiming vulnerability absence or license approval.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-002"],
+      "nonClaims": ["This requirement does not claim vulnerability absence, exploitability assessment, license approval, consumer deployment safety, or public-source provenance."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-003",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Pure parser and canonicalization boundaries have fuzz/property tests that prove no-panic and round-trip stability without fuzzing side-effecting CLI or filesystem flows.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-003"],
+      "nonClaims": ["This requirement does not claim exhaustive input-space proof, CLI fuzzing, filesystem fuzzing, server lifecycle fuzzing, or release readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-004",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Public CLI ABI has a small golden corpus and canonical ABI hash covering command topology, exit code, stdout and stderr channel discipline, JSON parseability, stable public diagnostics, and descriptor/contract/help parity without making private descriptors a public API.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-004"],
+      "nonClaims": ["This requirement does not claim exhaustive command semantic completeness beyond the declared route inventory or byte-for-byte stability for diagnostics outside the public CLI ABI."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-005",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "CodeQL workflow source is admitted as an independent semantic security analysis signal for Go source without replacing native Go static gates.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-005"],
+      "nonClaims": ["This requirement does not claim provider-run success, CodeQL vulnerability absence, or replacement of go test, go vet, staticcheck, or govulncheck."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-006",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "OSV workflow source is admitted as an advisory multi-ecosystem dependency signal without replacing govulncheck reachable-code evidence.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-006"],
+      "nonClaims": ["This requirement does not claim provider-run success, vulnerability absence, exploitability assessment, reachable-code proof, license approval, or merge approval."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-007",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Scorecard workflow source is admitted as an advisory repository hygiene signal without claiming branch protection or provider settings that the repository cannot prove from source.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-007"],
+      "nonClaims": ["This requirement does not claim provider-run success, branch-protection enforcement, required-review enforcement, provider settings completeness, merge approval, or release approval."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-008",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "GitHub Actions workflow syntax and expression semantics are checked by actionlint in the local package gate.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-008"],
+      "nonClaims": ["This requirement does not claim workflow runtime success, external action safety, branch protection, or release approval."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-009",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Performance-sensitive parser and serializer paths expose benchmark entrypoints without making wall-clock budgets a required PR gate before stable baselines exist.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-009"],
+      "nonClaims": ["This requirement does not claim current performance maximum, CI wall-clock budget enforcement, or regression absence without benchmark evidence."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-010",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Coverage metrics report requirement, binding, witness, CLI inventory linkage, and descriptor-owned command semantic-route coverage from admitted test-evidence-inventory rows, failing closed on explicit requirement/proof linkage dead zones, failed command-route inventory admission, command semantic routes without owner-declared proof identities, route-index-derived semantic proof identities, direct app semantic routes outside the command-scoped app test, package-level semantic routes outside the descriptor-owned command package, or missing matching semantic command evidence without claiming line coverage or exhaustive test semantic completeness.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-010"],
+      "nonClaims": ["This requirement does not claim line coverage, dead-code absence, exhaustive semantic completeness for every test, native witness execution, receipt freshness, or merge satisfaction."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-011",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "CI separates the OS-independent full source/package gate from the platform-specific macOS execution smoke so parallel runners do not duplicate proof classes while preserving release-relevant platform evidence.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-011"],
+      "nonClaims": ["This requirement does not claim provider-run success, Windows support, performance budget enforcement, or release approval."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-012",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Release and adoption channel identifiers are admitted by one canonical authority vocabulary that separates authorityChannel values from display labels, publisher environments, statuses, registry sub-vocabulary, and candidate evidence classes.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-012"],
+      "nonClaims": ["This requirement does not claim provider-run success, registry publication, GitHub Release creation, consumer adoption, rollout approval, or release approval."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-013",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Self-hosting workflow package-gate evidence is checked by a typed workflow oracle that proves the package gate is reachable, exact, advisory, success-gated for always-running downstream jobs and required evidence-publication steps, and ordered before evidence publication instead of relying on workflow text search.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-013"],
+      "nonClaims": ["This requirement does not claim full GitHub Actions interpretation, provider-run success, branch-protection enforcement, required-check enforcement, external action safety, registry publication, release approval, or rollout approval."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-014",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Release authority consumers compare downstream policy against the admitted typed release-authority projection and admitted report digest instead of rereading caller-owned raw releaseAuthorityInput fields after validation.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-014"],
+      "nonClaims": ["This requirement does not claim public SDK stability, registry publication, package installation, consumer dependency policy, rollout approval, merge approval, provider provenance, proof freshness, or native witness execution."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-015",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "The package gate includes an admitted release closeout completion-criteria report that classifies package artifacts, Python wrappers, release manifest, SBOM, channel scope, and self-hosting evidence instead of allowing unit tests alone to satisfy release closeout.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-015"],
+      "nonClaims": ["This requirement does not claim registry publication, provider authentication, GitHub artifact attestation, release approval, rollout approval, production readiness, or consumer adoption."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-016",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Release platform targets have one private owner that projects exact platform suffixes, Go build targets, npm OS/CPU metadata, package tar binary entries, Python wheel tags, PyPI candidate completeness, and SBOM binary subjects without turning the platform matrix into public API.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-016"],
+      "nonClaims": ["This requirement does not claim Windows support, execution of non-native platform binaries, registry publication, artifact attestation, public SDK stability, consumer rollout, or release approval."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-017",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Report-visible secret-shaped JSON traversal uses one private kernel owner for deterministic JSON paths, finding kinds, URL-credential detection, and secret-shaped key redaction, while command packages only map admitted findings to command-local report policy.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-017"],
+      "nonClaims": ["This requirement does not claim repository-wide secret scanning, file traversal, credential validity detection, merge approval, release approval, rollout approval, or replacement of dedicated provider secret-scanning tools."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-018",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Release metadata retains an admitted Trusted Publisher identity tuple for npm and PyPI channels whose publication mode includes workflow publication, including the exact release workflow ref for the current version tag, and release closeout rejects such publication claims when the tuple is absent or mismatched.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-018"],
+      "nonClaims": ["This requirement does not claim provider UI configuration, provider-side OIDC acceptance, registry publication, artifact attestation, GitHub Release publication, release approval, rollout approval, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-019",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Installed package smoke proof verifies the package-managed binary can process explicit JSON input for one successful report command and one failed-report command, preserving report kind, report id, state, explicit input counts, exit code, stdout JSON, and stderr channel discipline without admitting unlisted consumer working-directory files in addition to help discoverability.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-019"],
+      "nonClaims": ["This requirement does not claim registry publication, every command's runtime behavior, execution of non-native platform binaries, provider-side install freshness, consumer dependency admission, release approval, rollout approval, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    }
+  ]
+}

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "@research-engineering/agentic-proofkit",
+  "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
+  "version": "0.1.136",
+  "type": "module",
+  "license": "MIT",
+  "sideEffects": false,
+  "packageManager": "npm@11.18.0",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "bin": {
+    "agentic-proofkit": "dist/agentic-proofkit"
+  },
+  "exports": {
+    "./package.json": "./package.json"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/research-engineering/agentic-proofkit.git"
+  },
+  "files": [
+    "ADOPTION.md",
+    "AGENTS.md",
+    "BACKLOG.md",
+    "CONTRIBUTING.md",
+    "LICENSE",
+    "NON_CLAIMS.md",
+    "README.md",
+    "SECURITY.md",
+    "dist/**",
+    "docs/proofkit-contract-map.md",
+    "docs/release-process.md",
+    "docs/specs/**/*",
+    "proofkit/*.json"
+  ],
+  "scripts": {
+    "build": "go run ./internal/tools/packagebuild",
+    "check": "npm run npm:version && npm run source-hygiene && npm run text-policy && npm run go:check && npm run package:artifact && npm run self:receipt && npm run self:coverage && npm run release:closeout",
+    "go:actionlint": "go tool actionlint",
+    "go:bench": "go test ./internal/kernel/admission ./internal/kernel/stablejson -run '^$' -bench . -benchmem -count=10",
+    "go:check": "npm run go:fmt && npm run go:test && npm run go:vet && npm run go:staticcheck && npm run go:actionlint && npm run go:vulncheck",
+    "go:fmt": "test -z \"$(gofmt -l cmd internal scripts)\"",
+    "go:test": "go test ./...",
+    "go:vet": "go vet ./...",
+    "npm:version": "node -e \"const {execFileSync}=require('node:child_process'); const expected=require('./package.json').packageManager.split('@').at(-1); const actual=execFileSync('npm',['--version'],{encoding:'utf8'}).trim(); if(actual!==expected){throw new Error('expected npm '+expected+', got '+actual)}\"",
+    "package:artifact": "npm run build && go run ./internal/tools/packagepack && go run ./internal/tools/packageverify && npm run python:package && npm run python:verify && npm run release:manifest",
+    "platform:smoke": "go run ./internal/tools/packagebuild current && ./dist/agentic-proofkit --help >/dev/null && go run ./internal/tools/pythonpackage build-current && go run ./internal/tools/pythonpackage verify-current",
+    "python:package": "go run ./internal/tools/pythonpackage build",
+    "python:verify": "go run ./internal/tools/pythonpackage verify",
+    "pypi:registry": "go run ./internal/tools/pypiregistry",
+    "release:manifest": "npm run release:sbom && go run ./internal/tools/releasemanifest",
+    "release:closeout": "go run ./internal/tools/releasecloseoutinput | go run ./cmd/agentic-proofkit completion-criteria --input -",
+    "release:sbom": "go run ./internal/tools/releasesbom",
+    "self:receipt": "go run ./scripts/validate-self-hosting-receipts.go",
+    "self:coverage": "go run ./internal/tools/coveragemetrics",
+    "source-hygiene": "node scripts/source-hygiene.mjs",
+    "text-policy": "go run ./internal/tools/textpolicyinput | go run ./cmd/agentic-proofkit text-policy --input -",
+    "go:staticcheck": "go tool staticcheck ./...",
+    "go:vulncheck": "go tool govulncheck ./..."
+  },
+  "os": [
+    "darwin",
+    "linux"
+  ],
+  "cpu": [
+    "arm64",
+    "x64"
+  ]
+}