@research-engineering/agentic-proofkit 0.1.136

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. package/ADOPTION.md +198 -0
  2. package/AGENTS.md +160 -0
  3. package/BACKLOG.md +217 -0
  4. package/CONTRIBUTING.md +70 -0
  5. package/LICENSE +21 -0
  6. package/NON_CLAIMS.md +45 -0
  7. package/README.md +50 -0
  8. package/SECURITY.md +52 -0
  9. package/dist/agentic-proofkit +36 -0
  10. package/dist/platform/darwin-arm64/agentic-proofkit +0 -0
  11. package/dist/platform/darwin-x64/agentic-proofkit +0 -0
  12. package/dist/platform/linux-arm64/agentic-proofkit +0 -0
  13. package/dist/platform/linux-x64/agentic-proofkit +0 -0
  14. package/docs/proofkit-contract-map.md +148 -0
  15. package/docs/release-process.md +228 -0
  16. package/docs/specs/proofkit-consumer-infra-retirement/overview.md +62 -0
  17. package/docs/specs/proofkit-consumer-infra-retirement/requirements.v1.json +283 -0
  18. package/docs/specs/proofkit-package-boundary/overview.md +43 -0
  19. package/docs/specs/proofkit-package-boundary/requirements.v1.json +176 -0
  20. package/docs/specs/proofkit-receipt-authority/overview.md +35 -0
  21. package/docs/specs/proofkit-receipt-authority/requirements.v1.json +121 -0
  22. package/docs/specs/proofkit-spec-proof-core/overview.md +98 -0
  23. package/docs/specs/proofkit-spec-proof-core/requirements.v1.json +448 -0
  24. package/docs/specs/proofkit-supply-chain-quality/overview.md +95 -0
  25. package/docs/specs/proofkit-supply-chain-quality/requirements.v1.json +260 -0
  26. package/package.json +71 -0
  27. package/proofkit/cli-contract.v1.json +1601 -0
  28. package/proofkit/receipt-producer-policy.json +49 -0
  29. package/proofkit/requirement-bindings.json +1914 -0
  30. package/proofkit/witness-plan.json +1226 -0
package/proofkit/witness-plan.json ADDED
@@ -0,0 +1,1226 @@
1
+ {
2
+ "schemaVersion": 1,
3
+ "schedulerPlanId": "proofkit.self-hosting.witness-plan",
4
+ "vocabulary": {
5
+ "artifactKinds": [
6
+ "npm-package-artifact",
7
+ "python-wheel-artifact",
8
+ "report",
9
+ "sbom"
10
+ ],
11
+ "credentialClasses": [
12
+ "none"
13
+ ],
14
+ "environmentClasses": [
15
+ "local-go",
16
+ "local-python"
17
+ ],
18
+ "environmentClassPolicies": [
19
+ {
20
+ "environmentClass": "local-go",
21
+ "networkPolicies": [
22
+ "external",
23
+ "none"
24
+ ],
25
+ "credentialClasses": [
26
+ "none"
27
+ ],
28
+ "cachePolicies": [
29
+ "disabled",
30
+ "read-only",
31
+ "write-local"
32
+ ]
33
+ },
34
+ {
35
+ "environmentClass": "local-python",
36
+ "networkPolicies": [
37
+ "none"
38
+ ],
39
+ "credentialClasses": [
40
+ "none"
41
+ ],
42
+ "cachePolicies": [
43
+ "disabled",
44
+ "write-local"
45
+ ]
46
+ }
47
+ ],
48
+ "parallelGroups": [
49
+ "coverage-metrics",
50
+ "local-go-static",
51
+ "package-artifact",
52
+ "performance-benchmark",
53
+ "platform-smoke",
54
+ "python-package-build",
55
+ "python-package-verify",
56
+ "release-sbom",
57
+ "self-hosting-package-gate",
58
+ "self-hosting-receipt",
59
+ "workflow-static"
60
+ ],
61
+ "nonCacheableCredentialClasses": [],
62
+ "maxTimeoutMs": 600000
63
+ },
64
+ "commands": [
65
+ {
66
+ "schemaVersion": 1,
67
+ "id": "proofkit.ci-receipt-anchor",
68
+ "cwd": ".",
69
+ "argv": [
70
+ "npm",
71
+ "run",
72
+ "self:receipt"
73
+ ],
74
+ "environment": {
75
+ "inherit": "allowlist",
76
+ "allowlist": [
77
+ "GITHUB_ACTIONS",
78
+ "GITHUB_EVENT_NAME",
79
+ "GITHUB_REF",
80
+ "GITHUB_REF_NAME",
81
+ "GITHUB_REF_PROTECTED",
82
+ "GITHUB_REF_TYPE",
83
+ "GITHUB_REPOSITORY",
84
+ "GITHUB_RUN_ATTEMPT",
85
+ "GITHUB_RUN_ID",
86
+ "GITHUB_SERVER_URL",
87
+ "GITHUB_SHA",
88
+ "GITHUB_WORKFLOW",
89
+ "PROOFKIT_MERGE_SATISFYING_PRODUCER"
90
+ ],
91
+ "classes": [
92
+ "local-go"
93
+ ]
94
+ },
95
+ "timeoutMs": 600000,
96
+ "networkPolicy": "none",
97
+ "credentialClass": "none",
98
+ "cachePolicy": "disabled",
99
+ "expectedArtifacts": [
100
+ {
101
+ "kind": "report",
102
+ "path": "artifacts/proofkit/ci-provenance.json",
103
+ "required": true
104
+ },
105
+ {
106
+ "kind": "report",
107
+ "path": "artifacts/proofkit/self-hosting-proof-receipt-admission-report.json",
108
+ "required": true
109
+ },
110
+ {
111
+ "kind": "report",
112
+ "path": "artifacts/proofkit/self-hosting-proof-receipts.json",
113
+ "required": true
114
+ },
115
+ {
116
+ "kind": "report",
117
+ "path": "artifacts/proofkit/self-hosting-receipt-producer-admission-report.json",
118
+ "required": true
119
+ },
120
+ {
121
+ "kind": "report",
122
+ "path": "artifacts/proofkit/self-hosting-receipt-producer-admission.json",
123
+ "required": true
124
+ },
125
+ {
126
+ "kind": "report",
127
+ "path": "artifacts/proofkit/self-hosting-spec-proof-bundle-admission-report.json",
128
+ "required": true
129
+ },
130
+ {
131
+ "kind": "report",
132
+ "path": "artifacts/proofkit/self-hosting-spec-proof-bundle.json",
133
+ "required": true
134
+ }
135
+ ],
136
+ "parallelGroup": "self-hosting-receipt",
137
+ "exitCodePolicy": {
138
+ "kind": "zero",
139
+ "successCodes": [
140
+ 0
141
+ ]
142
+ }
143
+ },
144
+ {
145
+ "schemaVersion": 1,
146
+ "id": "proofkit.go-fmt",
147
+ "cwd": ".",
148
+ "argv": [
149
+ "npm",
150
+ "run",
151
+ "go:fmt"
152
+ ],
153
+ "environment": {
154
+ "inherit": "none",
155
+ "allowlist": [],
156
+ "classes": [
157
+ "local-go"
158
+ ]
159
+ },
160
+ "timeoutMs": 600000,
161
+ "networkPolicy": "none",
162
+ "credentialClass": "none",
163
+ "cachePolicy": "disabled",
164
+ "expectedArtifacts": [],
165
+ "parallelGroup": "local-go-static",
166
+ "exitCodePolicy": {
167
+ "kind": "zero",
168
+ "successCodes": [
169
+ 0
170
+ ]
171
+ }
172
+ },
173
+ {
174
+ "schemaVersion": 1,
175
+ "id": "proofkit.go-test",
176
+ "cwd": ".",
177
+ "argv": [
178
+ "go",
179
+ "test",
180
+ "./..."
181
+ ],
182
+ "environment": {
183
+ "inherit": "none",
184
+ "allowlist": [],
185
+ "classes": [
186
+ "local-go"
187
+ ]
188
+ },
189
+ "timeoutMs": 600000,
190
+ "networkPolicy": "none",
191
+ "credentialClass": "none",
192
+ "cachePolicy": "disabled",
193
+ "expectedArtifacts": [],
194
+ "parallelGroup": "local-go-static",
195
+ "exitCodePolicy": {
196
+ "kind": "zero",
197
+ "successCodes": [
198
+ 0
199
+ ]
200
+ }
201
+ },
202
+ {
203
+ "schemaVersion": 1,
204
+ "id": "proofkit.go-vet",
205
+ "cwd": ".",
206
+ "argv": [
207
+ "go",
208
+ "vet",
209
+ "./..."
210
+ ],
211
+ "environment": {
212
+ "inherit": "none",
213
+ "allowlist": [],
214
+ "classes": [
215
+ "local-go"
216
+ ]
217
+ },
218
+ "timeoutMs": 600000,
219
+ "networkPolicy": "none",
220
+ "credentialClass": "none",
221
+ "cachePolicy": "disabled",
222
+ "expectedArtifacts": [],
223
+ "parallelGroup": "local-go-static",
224
+ "exitCodePolicy": {
225
+ "kind": "zero",
226
+ "successCodes": [
227
+ 0
228
+ ]
229
+ }
230
+ },
231
+ {
232
+ "schemaVersion": 1,
233
+ "id": "proofkit.package-artifact",
234
+ "cwd": ".",
235
+ "argv": [
236
+ "npm",
237
+ "run",
238
+ "package:artifact"
239
+ ],
240
+ "environment": {
241
+ "inherit": "none",
242
+ "allowlist": [],
243
+ "classes": [
244
+ "local-go"
245
+ ]
246
+ },
247
+ "timeoutMs": 600000,
248
+ "networkPolicy": "none",
249
+ "credentialClass": "none",
250
+ "cachePolicy": "disabled",
251
+ "expectedArtifacts": [
252
+ {
253
+ "kind": "report",
254
+ "path": "artifacts/package/npm-pack.json",
255
+ "required": true
256
+ },
257
+ {
258
+ "kind": "npm-package-artifact",
259
+ "path": "artifacts/package/*.tgz",
260
+ "required": true
261
+ },
262
+ {
263
+ "kind": "python-wheel-artifact",
264
+ "path": "artifacts/pypi/*.whl",
265
+ "required": true
266
+ },
267
+ {
268
+ "kind": "report",
269
+ "path": "artifacts/pypi/python-packages.json",
270
+ "required": true
271
+ },
272
+ {
273
+ "kind": "report",
274
+ "path": "artifacts/release/release-manifest.json",
275
+ "required": true
276
+ }
277
+ ],
278
+ "parallelGroup": "package-artifact",
279
+ "exitCodePolicy": {
280
+ "kind": "zero",
281
+ "successCodes": [
282
+ 0
283
+ ]
284
+ }
285
+ },
286
+ {
287
+ "schemaVersion": 1,
288
+ "id": "proofkit.package-gate",
289
+ "cwd": ".",
290
+ "argv": [
291
+ "npm",
292
+ "run",
293
+ "check"
294
+ ],
295
+ "environment": {
296
+ "inherit": "none",
297
+ "allowlist": [],
298
+ "classes": [
299
+ "local-go"
300
+ ]
301
+ },
302
+ "timeoutMs": 600000,
303
+ "networkPolicy": "external",
304
+ "credentialClass": "none",
305
+ "cachePolicy": "disabled",
306
+ "expectedArtifacts": [],
307
+ "parallelGroup": "self-hosting-package-gate",
308
+ "exitCodePolicy": {
309
+ "kind": "zero",
310
+ "successCodes": [
311
+ 0
312
+ ]
313
+ }
314
+ },
315
+ {
316
+ "schemaVersion": 1,
317
+ "id": "proofkit.python-package",
318
+ "cwd": ".",
319
+ "argv": [
320
+ "npm",
321
+ "run",
322
+ "python:package"
323
+ ],
324
+ "environment": {
325
+ "inherit": "none",
326
+ "allowlist": [],
327
+ "classes": [
328
+ "local-python"
329
+ ]
330
+ },
331
+ "timeoutMs": 600000,
332
+ "networkPolicy": "none",
333
+ "credentialClass": "none",
334
+ "cachePolicy": "disabled",
335
+ "expectedArtifacts": [
336
+ {
337
+ "kind": "python-wheel-artifact",
338
+ "path": "artifacts/pypi/*.whl",
339
+ "required": true
340
+ },
341
+ {
342
+ "kind": "report",
343
+ "path": "artifacts/pypi/python-packages.json",
344
+ "required": true
345
+ }
346
+ ],
347
+ "parallelGroup": "python-package-build",
348
+ "exitCodePolicy": {
349
+ "kind": "zero",
350
+ "successCodes": [
351
+ 0
352
+ ]
353
+ }
354
+ },
355
+ {
356
+ "schemaVersion": 1,
357
+ "id": "proofkit.platform-smoke",
358
+ "cwd": ".",
359
+ "argv": [
360
+ "npm",
361
+ "run",
362
+ "platform:smoke"
363
+ ],
364
+ "environment": {
365
+ "inherit": "none",
366
+ "allowlist": [],
367
+ "classes": [
368
+ "local-go",
369
+ "local-python"
370
+ ]
371
+ },
372
+ "timeoutMs": 600000,
373
+ "networkPolicy": "none",
374
+ "credentialClass": "none",
375
+ "cachePolicy": "disabled",
376
+ "expectedArtifacts": [
377
+ {
378
+ "kind": "python-wheel-artifact",
379
+ "path": "artifacts/pypi/*.whl",
380
+ "required": true
381
+ },
382
+ {
383
+ "kind": "report",
384
+ "path": "artifacts/pypi/python-packages.json",
385
+ "required": true
386
+ }
387
+ ],
388
+ "parallelGroup": "platform-smoke",
389
+ "exitCodePolicy": {
390
+ "kind": "zero",
391
+ "successCodes": [
392
+ 0
393
+ ]
394
+ }
395
+ },
396
+ {
397
+ "schemaVersion": 1,
398
+ "id": "proofkit.python-verify",
399
+ "cwd": ".",
400
+ "argv": [
401
+ "npm",
402
+ "run",
403
+ "python:verify"
404
+ ],
405
+ "environment": {
406
+ "inherit": "none",
407
+ "allowlist": [],
408
+ "classes": [
409
+ "local-python"
410
+ ]
411
+ },
412
+ "timeoutMs": 600000,
413
+ "networkPolicy": "none",
414
+ "credentialClass": "none",
415
+ "cachePolicy": "disabled",
416
+ "expectedArtifacts": [],
417
+ "parallelGroup": "python-package-verify",
418
+ "exitCodePolicy": {
419
+ "kind": "zero",
420
+ "successCodes": [
421
+ 0
422
+ ]
423
+ }
424
+ },
425
+ {
426
+ "schemaVersion": 1,
427
+ "id": "proofkit.go-staticcheck",
428
+ "cwd": ".",
429
+ "argv": [
430
+ "npm",
431
+ "run",
432
+ "go:staticcheck"
433
+ ],
434
+ "environment": {
435
+ "inherit": "none",
436
+ "allowlist": [],
437
+ "classes": [
438
+ "local-go"
439
+ ]
440
+ },
441
+ "timeoutMs": 600000,
442
+ "networkPolicy": "none",
443
+ "credentialClass": "none",
444
+ "cachePolicy": "disabled",
445
+ "expectedArtifacts": [],
446
+ "parallelGroup": "local-go-static",
447
+ "exitCodePolicy": {
448
+ "kind": "zero",
449
+ "successCodes": [
450
+ 0
451
+ ]
452
+ }
453
+ },
454
+ {
455
+ "schemaVersion": 1,
456
+ "id": "proofkit.go-vulncheck",
457
+ "cwd": ".",
458
+ "argv": [
459
+ "npm",
460
+ "run",
461
+ "go:vulncheck"
462
+ ],
463
+ "environment": {
464
+ "inherit": "none",
465
+ "allowlist": [],
466
+ "classes": [
467
+ "local-go"
468
+ ]
469
+ },
470
+ "timeoutMs": 600000,
471
+ "networkPolicy": "external",
472
+ "credentialClass": "none",
473
+ "cachePolicy": "disabled",
474
+ "expectedArtifacts": [],
475
+ "parallelGroup": "local-go-static",
476
+ "exitCodePolicy": {
477
+ "kind": "zero",
478
+ "successCodes": [
479
+ 0
480
+ ]
481
+ }
482
+ },
483
+ {
484
+ "schemaVersion": 1,
485
+ "id": "proofkit.actionlint",
486
+ "cwd": ".",
487
+ "argv": [
488
+ "npm",
489
+ "run",
490
+ "go:actionlint"
491
+ ],
492
+ "environment": {
493
+ "inherit": "none",
494
+ "allowlist": [],
495
+ "classes": [
496
+ "local-go"
497
+ ]
498
+ },
499
+ "timeoutMs": 600000,
500
+ "networkPolicy": "none",
501
+ "credentialClass": "none",
502
+ "cachePolicy": "disabled",
503
+ "expectedArtifacts": [],
504
+ "parallelGroup": "workflow-static",
505
+ "exitCodePolicy": {
506
+ "kind": "zero",
507
+ "successCodes": [
508
+ 0
509
+ ]
510
+ }
511
+ },
512
+ {
513
+ "schemaVersion": 1,
514
+ "id": "proofkit.coverage-metrics",
515
+ "cwd": ".",
516
+ "argv": [
517
+ "npm",
518
+ "run",
519
+ "self:coverage"
520
+ ],
521
+ "environment": {
522
+ "inherit": "none",
523
+ "allowlist": [],
524
+ "classes": [
525
+ "local-go"
526
+ ]
527
+ },
528
+ "timeoutMs": 600000,
529
+ "networkPolicy": "none",
530
+ "credentialClass": "none",
531
+ "cachePolicy": "disabled",
532
+ "expectedArtifacts": [
533
+ {
534
+ "kind": "report",
535
+ "path": "artifacts/proofkit/coverage-metrics.json",
536
+ "required": true
537
+ }
538
+ ],
539
+ "parallelGroup": "coverage-metrics",
540
+ "exitCodePolicy": {
541
+ "kind": "zero",
542
+ "successCodes": [
543
+ 0
544
+ ]
545
+ }
546
+ },
547
+ {
548
+ "schemaVersion": 1,
549
+ "id": "proofkit.go-bench",
550
+ "cwd": ".",
551
+ "argv": [
552
+ "npm",
553
+ "run",
554
+ "go:bench"
555
+ ],
556
+ "environment": {
557
+ "inherit": "none",
558
+ "allowlist": [],
559
+ "classes": [
560
+ "local-go"
561
+ ]
562
+ },
563
+ "timeoutMs": 600000,
564
+ "networkPolicy": "none",
565
+ "credentialClass": "none",
566
+ "cachePolicy": "disabled",
567
+ "expectedArtifacts": [],
568
+ "parallelGroup": "performance-benchmark",
569
+ "exitCodePolicy": {
570
+ "kind": "zero",
571
+ "successCodes": [
572
+ 0
573
+ ]
574
+ }
575
+ },
576
+ {
577
+ "schemaVersion": 1,
578
+ "id": "proofkit.release-sbom",
579
+ "cwd": ".",
580
+ "argv": [
581
+ "npm",
582
+ "run",
583
+ "release:sbom"
584
+ ],
585
+ "environment": {
586
+ "inherit": "none",
587
+ "allowlist": [],
588
+ "classes": [
589
+ "local-go"
590
+ ]
591
+ },
592
+ "timeoutMs": 600000,
593
+ "networkPolicy": "none",
594
+ "credentialClass": "none",
595
+ "cachePolicy": "disabled",
596
+ "expectedArtifacts": [
597
+ {
598
+ "kind": "sbom",
599
+ "path": "artifacts/release/sbom.cdx.json",
600
+ "required": true
601
+ }
602
+ ],
603
+ "parallelGroup": "release-sbom",
604
+ "exitCodePolicy": {
605
+ "kind": "zero",
606
+ "successCodes": [
607
+ 0
608
+ ]
609
+ }
610
+ }
611
+ ],
612
+ "policies": [
613
+ {
614
+ "commandId": "proofkit.actionlint",
615
+ "inputSelectors": [
616
+ ".github/workflows/ci.yml",
617
+ ".github/workflows/codeql.yml",
618
+ ".github/workflows/osv-scanner.yml",
619
+ ".github/workflows/release.yml",
620
+ ".github/workflows/scorecard.yml",
621
+ "go.mod",
622
+ "go.sum",
623
+ "package.json"
624
+ ],
625
+ "outputSelectors": [],
626
+ "resourceReads": [
627
+ "resource.proofkit.source"
628
+ ],
629
+ "resourceWrites": [],
630
+ "exclusiveLocks": [],
631
+ "sideEffectClass": "none",
632
+ "deterministicOutput": true,
633
+ "cacheAdmissionRefs": [],
634
+ "retryPolicy": {
635
+ "kind": "none",
636
+ "maxAttempts": 1
637
+ },
638
+ "cancellationPolicy": {
639
+ "kind": "cooperative",
640
+ "graceMs": 5000
641
+ },
642
+ "timeoutPolicy": {
643
+ "kind": "bounded",
644
+ "timeoutMs": 600000
645
+ },
646
+ "nonClaims": [
647
+ "Actionlint validates GitHub Actions syntax and expression structure only; it does not prove workflow runtime success or external action safety.",
648
+ "Self-hosting witness policy does not prove producer authentication or merge approval."
649
+ ]
650
+ },
651
+ {
652
+ "commandId": "proofkit.ci-receipt-anchor",
653
+ "inputSelectors": [
654
+ ".github/workflows/ci.yml",
655
+ "artifacts/package/*.tgz",
656
+ "artifacts/package/npm-pack.json",
657
+ "go.mod",
658
+ "go.sum",
659
+ "package.json",
660
+ "proofkit/receipt-producer-policy.json",
661
+ "proofkit/requirement-bindings.json",
662
+ "proofkit/witness-plan.json",
663
+ "scripts/validate-self-hosting-receipts.go"
664
+ ],
665
+ "outputSelectors": [
666
+ "artifacts/proofkit/ci-provenance.json",
667
+ "artifacts/proofkit/self-hosting-proof-receipt-admission-report.json",
668
+ "artifacts/proofkit/self-hosting-proof-receipts.json",
669
+ "artifacts/proofkit/self-hosting-receipt-producer-admission-report.json",
670
+ "artifacts/proofkit/self-hosting-receipt-producer-admission.json",
671
+ "artifacts/proofkit/self-hosting-spec-proof-bundle-admission-report.json",
672
+ "artifacts/proofkit/self-hosting-spec-proof-bundle.json"
673
+ ],
674
+ "resourceReads": [
675
+ "resource.proofkit.package-artifacts",
676
+ "resource.proofkit.source"
677
+ ],
678
+ "resourceWrites": [
679
+ "resource.proofkit.local-artifacts"
680
+ ],
681
+ "exclusiveLocks": [],
682
+ "sideEffectClass": "local_write",
683
+ "deterministicOutput": false,
684
+ "cacheAdmissionRefs": [],
685
+ "retryPolicy": {
686
+ "kind": "none",
687
+ "maxAttempts": 1
688
+ },
689
+ "cancellationPolicy": {
690
+ "kind": "cooperative",
691
+ "graceMs": 5000
692
+ },
693
+ "timeoutPolicy": {
694
+ "kind": "bounded",
695
+ "timeoutMs": 600000
696
+ },
697
+ "nonClaims": [
698
+ "Self-hosting receipt output includes current timestamp and admitted CI environment metadata.",
699
+ "Self-hosting witness policy does not prove producer authentication or merge approval."
700
+ ]
701
+ },
702
+ {
703
+ "commandId": "proofkit.coverage-metrics",
704
+ "inputSelectors": [
705
+ "docs/specs",
706
+ "internal/app/command_coverage_routes.go",
707
+ "internal/app/command_registry.go",
708
+ "internal/tools/coveragemetrics",
709
+ "proofkit/cli-contract.v1.json",
710
+ "proofkit/requirement-bindings.json",
711
+ "proofkit/witness-plan.json"
712
+ ],
713
+ "outputSelectors": [
714
+ "artifacts/proofkit/coverage-metrics.json"
715
+ ],
716
+ "resourceReads": [
717
+ "resource.proofkit.source"
718
+ ],
719
+ "resourceWrites": [
720
+ "resource.proofkit.local-artifacts"
721
+ ],
722
+ "exclusiveLocks": [],
723
+ "sideEffectClass": "local_write",
724
+ "deterministicOutput": true,
725
+ "cacheAdmissionRefs": [],
726
+ "retryPolicy": {
727
+ "kind": "none",
728
+ "maxAttempts": 1
729
+ },
730
+ "cancellationPolicy": {
731
+ "kind": "cooperative",
732
+ "graceMs": 5000
733
+ },
734
+ "timeoutPolicy": {
735
+ "kind": "bounded",
736
+ "timeoutMs": 600000
737
+ },
738
+ "nonClaims": [
739
+ "Coverage metrics do not claim line coverage, semantic correctness, receipt freshness, or merge satisfaction.",
740
+ "Self-hosting witness policy does not prove producer authentication or merge approval."
741
+ ]
742
+ },
743
+ {
744
+ "commandId": "proofkit.go-bench",
745
+ "inputSelectors": [
746
+ "go.mod",
747
+ "go.sum",
748
+ "internal/kernel/admission",
749
+ "internal/kernel/stablejson",
750
+ "package.json"
751
+ ],
752
+ "outputSelectors": [],
753
+ "resourceReads": [
754
+ "resource.proofkit.source"
755
+ ],
756
+ "resourceWrites": [],
757
+ "exclusiveLocks": [],
758
+ "sideEffectClass": "none",
759
+ "deterministicOutput": false,
760
+ "cacheAdmissionRefs": [],
761
+ "retryPolicy": {
762
+ "kind": "none",
763
+ "maxAttempts": 1
764
+ },
765
+ "cancellationPolicy": {
766
+ "kind": "cooperative",
767
+ "graceMs": 5000
768
+ },
769
+ "timeoutPolicy": {
770
+ "kind": "bounded",
771
+ "timeoutMs": 600000
772
+ },
773
+ "nonClaims": [
774
+ "Benchmark output is diagnostic performance evidence only and does not enforce PR budget or release readiness.",
775
+ "Self-hosting witness policy does not prove producer authentication or merge approval."
776
+ ]
777
+ },
778
+ {
779
+ "commandId": "proofkit.go-fmt",
780
+ "inputSelectors": [
781
+ "cmd",
782
+ "internal",
783
+ "scripts/validate-self-hosting-receipts.go"
784
+ ],
785
+ "outputSelectors": [],
786
+ "resourceReads": [
787
+ "resource.proofkit.source"
788
+ ],
789
+ "resourceWrites": [],
790
+ "exclusiveLocks": [],
791
+ "sideEffectClass": "none",
792
+ "deterministicOutput": true,
793
+ "cacheAdmissionRefs": [],
794
+ "retryPolicy": {
795
+ "kind": "none",
796
+ "maxAttempts": 1
797
+ },
798
+ "cancellationPolicy": {
799
+ "kind": "cooperative",
800
+ "graceMs": 5000
801
+ },
802
+ "timeoutPolicy": {
803
+ "kind": "bounded",
804
+ "timeoutMs": 600000
805
+ },
806
+ "nonClaims": [
807
+ "Self-hosting witness policy does not prove producer authentication or merge approval."
808
+ ]
809
+ },
810
+ {
811
+ "commandId": "proofkit.go-staticcheck",
812
+ "inputSelectors": [
813
+ "cmd",
814
+ "go.mod",
815
+ "go.sum",
816
+ "internal",
817
+ "scripts/validate-self-hosting-receipts.go"
818
+ ],
819
+ "outputSelectors": [],
820
+ "resourceReads": [
821
+ "resource.proofkit.source"
822
+ ],
823
+ "resourceWrites": [],
824
+ "exclusiveLocks": [],
825
+ "sideEffectClass": "none",
826
+ "deterministicOutput": true,
827
+ "cacheAdmissionRefs": [],
828
+ "retryPolicy": {
829
+ "kind": "none",
830
+ "maxAttempts": 1
831
+ },
832
+ "cancellationPolicy": {
833
+ "kind": "cooperative",
834
+ "graceMs": 5000
835
+ },
836
+ "timeoutPolicy": {
837
+ "kind": "bounded",
838
+ "timeoutMs": 600000
839
+ },
840
+ "nonClaims": [
841
+ "Self-hosting witness policy does not prove producer authentication or merge approval."
842
+ ]
843
+ },
844
+ {
845
+ "commandId": "proofkit.go-test",
846
+ "inputSelectors": [
847
+ "cmd",
848
+ "go.mod",
849
+ "go.sum",
850
+ "internal",
851
+ "proofkit/cli-contract.v1.json",
852
+ "proofkit/requirement-bindings.json",
853
+ "proofkit/witness-plan.json",
854
+ "scripts/validate-self-hosting-receipts.go"
855
+ ],
856
+ "outputSelectors": [],
857
+ "resourceReads": [
858
+ "resource.proofkit.source"
859
+ ],
860
+ "resourceWrites": [],
861
+ "exclusiveLocks": [],
862
+ "sideEffectClass": "none",
863
+ "deterministicOutput": true,
864
+ "cacheAdmissionRefs": [],
865
+ "retryPolicy": {
866
+ "kind": "none",
867
+ "maxAttempts": 1
868
+ },
869
+ "cancellationPolicy": {
870
+ "kind": "cooperative",
871
+ "graceMs": 5000
872
+ },
873
+ "timeoutPolicy": {
874
+ "kind": "bounded",
875
+ "timeoutMs": 600000
876
+ },
877
+ "nonClaims": [
878
+ "Self-hosting witness policy does not prove producer authentication or merge approval."
879
+ ]
880
+ },
881
+ {
882
+ "commandId": "proofkit.go-vet",
883
+ "inputSelectors": [
884
+ "cmd",
885
+ "go.mod",
886
+ "internal",
887
+ "scripts/validate-self-hosting-receipts.go"
888
+ ],
889
+ "outputSelectors": [],
890
+ "resourceReads": [
891
+ "resource.proofkit.source"
892
+ ],
893
+ "resourceWrites": [],
894
+ "exclusiveLocks": [],
895
+ "sideEffectClass": "none",
896
+ "deterministicOutput": true,
897
+ "cacheAdmissionRefs": [],
898
+ "retryPolicy": {
899
+ "kind": "none",
900
+ "maxAttempts": 1
901
+ },
902
+ "cancellationPolicy": {
903
+ "kind": "cooperative",
904
+ "graceMs": 5000
905
+ },
906
+ "timeoutPolicy": {
907
+ "kind": "bounded",
908
+ "timeoutMs": 600000
909
+ },
910
+ "nonClaims": [
911
+ "Self-hosting witness policy does not prove producer authentication or merge approval."
912
+ ]
913
+ },
914
+ {
915
+ "commandId": "proofkit.go-vulncheck",
916
+ "inputSelectors": [
917
+ "cmd",
918
+ "go.mod",
919
+ "go.sum",
920
+ "internal",
921
+ "scripts/validate-self-hosting-receipts.go"
922
+ ],
923
+ "outputSelectors": [],
924
+ "resourceReads": [
925
+ "resource.proofkit.source"
926
+ ],
927
+ "resourceWrites": [],
928
+ "exclusiveLocks": [],
929
+ "sideEffectClass": "network",
930
+ "deterministicOutput": false,
931
+ "cacheAdmissionRefs": [],
932
+ "retryPolicy": {
933
+ "kind": "none",
934
+ "maxAttempts": 1
935
+ },
936
+ "cancellationPolicy": {
937
+ "kind": "cooperative",
938
+ "graceMs": 5000
939
+ },
940
+ "timeoutPolicy": {
941
+ "kind": "bounded",
942
+ "timeoutMs": 600000
943
+ },
944
+ "nonClaims": [
945
+ "Govulncheck may consult the Go vulnerability database and local module caches.",
946
+ "Self-hosting witness policy does not prove producer authentication or merge approval."
947
+ ]
948
+ },
949
+ {
950
+ "commandId": "proofkit.package-artifact",
951
+ "inputSelectors": [
952
+ "ADOPTION.md",
953
+ "AGENTS.md",
954
+ "BACKLOG.md",
955
+ "CONTRIBUTING.md",
956
+ "LICENSE",
957
+ "NON_CLAIMS.md",
958
+ "README.md",
959
+ "SECURITY.md",
960
+ "cmd",
961
+ "docs",
962
+ "go.mod",
963
+ "internal",
964
+ "package.json",
965
+ "proofkit",
966
+ "python"
967
+ ],
968
+ "outputSelectors": [
969
+ "artifacts/package/*.tgz",
970
+ "artifacts/package/npm-pack.json",
971
+ "artifacts/pypi/*.whl",
972
+ "artifacts/pypi/python-packages.json",
973
+ "artifacts/release/release-manifest.json",
974
+ "artifacts/release/sbom-subjects.sha256",
975
+ "artifacts/release/sbom.cdx.json"
976
+ ],
977
+ "resourceReads": [
978
+ "resource.proofkit.source"
979
+ ],
980
+ "resourceWrites": [
981
+ "resource.proofkit.local-artifacts",
982
+ "resource.proofkit.package-artifacts"
983
+ ],
984
+ "exclusiveLocks": [],
985
+ "sideEffectClass": "local_write",
986
+ "deterministicOutput": false,
987
+ "cacheAdmissionRefs": [],
988
+ "retryPolicy": {
989
+ "kind": "none",
990
+ "maxAttempts": 1
991
+ },
992
+ "cancellationPolicy": {
993
+ "kind": "cooperative",
994
+ "graceMs": 5000
995
+ },
996
+ "timeoutPolicy": {
997
+ "kind": "bounded",
998
+ "timeoutMs": 600000
999
+ },
1000
+ "nonClaims": [
1001
+ "Self-hosting witness policy does not prove producer authentication or merge approval.",
1002
+ "The full package gate includes networked vulnerability database lookup through govulncheck."
1003
+ ]
1004
+ },
1005
+ {
1006
+ "commandId": "proofkit.package-gate",
1007
+ "inputSelectors": [
1008
+ ".github/workflows",
1009
+ "ADOPTION.md",
1010
+ "AGENTS.md",
1011
+ "BACKLOG.md",
1012
+ "CONTRIBUTING.md",
1013
+ "LICENSE",
1014
+ "NON_CLAIMS.md",
1015
+ "README.md",
1016
+ "SECURITY.md",
1017
+ "cmd",
1018
+ "docs",
1019
+ "go.mod",
1020
+ "internal",
1021
+ "package.json",
1022
+ "proofkit",
1023
+ "python",
1024
+ "scripts/validate-self-hosting-receipts.go"
1025
+ ],
1026
+ "outputSelectors": [
1027
+ "artifacts/package/npm-pack.json",
1028
+ "artifacts/proofkit/*.json",
1029
+ "artifacts/pypi/python-packages.json"
1030
+ ],
1031
+ "resourceReads": [
1032
+ "resource.proofkit.source"
1033
+ ],
1034
+ "resourceWrites": [
1035
+ "resource.proofkit.local-artifacts"
1036
+ ],
1037
+ "exclusiveLocks": [],
1038
+ "sideEffectClass": "local_write",
1039
+ "deterministicOutput": false,
1040
+ "cacheAdmissionRefs": [],
1041
+ "retryPolicy": {
1042
+ "kind": "none",
1043
+ "maxAttempts": 1
1044
+ },
1045
+ "cancellationPolicy": {
1046
+ "kind": "cooperative",
1047
+ "graceMs": 5000
1048
+ },
1049
+ "timeoutPolicy": {
1050
+ "kind": "bounded",
1051
+ "timeoutMs": 600000
1052
+ },
1053
+ "nonClaims": [
1054
+ "Self-hosting witness policy does not prove producer authentication or merge approval."
1055
+ ]
1056
+ },
1057
+ {
1058
+ "commandId": "proofkit.platform-smoke",
1059
+ "inputSelectors": [
1060
+ ".github/workflows/ci.yml",
1061
+ "cmd",
1062
+ "go.mod",
1063
+ "go.sum",
1064
+ "internal",
1065
+ "package.json",
1066
+ "python"
1067
+ ],
1068
+ "outputSelectors": [
1069
+ "artifacts/pypi/*.whl",
1070
+ "artifacts/pypi/python-packages.json",
1071
+ "dist/agentic-proofkit",
1072
+ "dist/platform/*/agentic-proofkit"
1073
+ ],
1074
+ "resourceReads": [
1075
+ "resource.proofkit.source"
1076
+ ],
1077
+ "resourceWrites": [
1078
+ "resource.proofkit.local-artifacts",
1079
+ "resource.proofkit.package-artifacts"
1080
+ ],
1081
+ "exclusiveLocks": [],
1082
+ "sideEffectClass": "local_write",
1083
+ "deterministicOutput": false,
1084
+ "cacheAdmissionRefs": [],
1085
+ "retryPolicy": {
1086
+ "kind": "none",
1087
+ "maxAttempts": 1
1088
+ },
1089
+ "cancellationPolicy": {
1090
+ "kind": "cooperative",
1091
+ "graceMs": 5000
1092
+ },
1093
+ "timeoutPolicy": {
1094
+ "kind": "bounded",
1095
+ "timeoutMs": 600000
1096
+ },
1097
+ "nonClaims": [
1098
+ "Platform smoke does not publish packages, prove registry install authority, run full source quality gates, or approve release."
1099
+ ]
1100
+ },
1101
+ {
1102
+ "commandId": "proofkit.python-package",
1103
+ "inputSelectors": [
1104
+ "dist/platform/*/agentic-proofkit",
1105
+ "internal/tools/pythonpackage",
1106
+ "package.json",
1107
+ "python"
1108
+ ],
1109
+ "outputSelectors": [
1110
+ "artifacts/pypi/*.whl",
1111
+ "artifacts/pypi/python-packages.json"
1112
+ ],
1113
+ "resourceReads": [
1114
+ "resource.proofkit.source"
1115
+ ],
1116
+ "resourceWrites": [
1117
+ "resource.proofkit.local-artifacts",
1118
+ "resource.proofkit.package-artifacts"
1119
+ ],
1120
+ "exclusiveLocks": [],
1121
+ "sideEffectClass": "local_write",
1122
+ "deterministicOutput": false,
1123
+ "cacheAdmissionRefs": [],
1124
+ "retryPolicy": {
1125
+ "kind": "none",
1126
+ "maxAttempts": 1
1127
+ },
1128
+ "cancellationPolicy": {
1129
+ "kind": "cooperative",
1130
+ "graceMs": 5000
1131
+ },
1132
+ "timeoutPolicy": {
1133
+ "kind": "bounded",
1134
+ "timeoutMs": 600000
1135
+ },
1136
+ "nonClaims": [
1137
+ "Python wheel candidate generation does not publish to PyPI or prove registry install authority."
1138
+ ]
1139
+ },
1140
+ {
1141
+ "commandId": "proofkit.python-verify",
1142
+ "inputSelectors": [
1143
+ "artifacts/pypi/*.whl",
1144
+ "artifacts/pypi/python-packages.json",
1145
+ "dist/platform/*/agentic-proofkit",
1146
+ "internal/tools/pythonpackage",
1147
+ "package.json",
1148
+ "python"
1149
+ ],
1150
+ "outputSelectors": [],
1151
+ "resourceReads": [
1152
+ "resource.proofkit.package-artifacts",
1153
+ "resource.proofkit.source"
1154
+ ],
1155
+ "resourceWrites": [
1156
+ "resource.proofkit.local-artifacts"
1157
+ ],
1158
+ "exclusiveLocks": [],
1159
+ "sideEffectClass": "local_write",
1160
+ "deterministicOutput": false,
1161
+ "cacheAdmissionRefs": [],
1162
+ "retryPolicy": {
1163
+ "kind": "none",
1164
+ "maxAttempts": 1
1165
+ },
1166
+ "cancellationPolicy": {
1167
+ "kind": "cooperative",
1168
+ "graceMs": 5000
1169
+ },
1170
+ "timeoutPolicy": {
1171
+ "kind": "bounded",
1172
+ "timeoutMs": 600000
1173
+ },
1174
+ "nonClaims": [
1175
+ "Local Python venv smoke proof covers only the current native platform."
1176
+ ]
1177
+ },
1178
+ {
1179
+ "commandId": "proofkit.release-sbom",
1180
+ "inputSelectors": [
1181
+ "artifacts/package/*.tgz",
1182
+ "artifacts/pypi/*.whl",
1183
+ "dist/platform/*/agentic-proofkit",
1184
+ "go.mod",
1185
+ "go.sum",
1186
+ "internal/tools/releasesbom",
1187
+ "package.json"
1188
+ ],
1189
+ "outputSelectors": [
1190
+ "artifacts/release/sbom.cdx.json"
1191
+ ],
1192
+ "resourceReads": [
1193
+ "resource.proofkit.local-artifacts",
1194
+ "resource.proofkit.package-artifacts",
1195
+ "resource.proofkit.source"
1196
+ ],
1197
+ "resourceWrites": [
1198
+ "resource.proofkit.local-artifacts"
1199
+ ],
1200
+ "exclusiveLocks": [],
1201
+ "sideEffectClass": "local_write",
1202
+ "deterministicOutput": true,
1203
+ "cacheAdmissionRefs": [],
1204
+ "retryPolicy": {
1205
+ "kind": "none",
1206
+ "maxAttempts": 1
1207
+ },
1208
+ "cancellationPolicy": {
1209
+ "kind": "cooperative",
1210
+ "graceMs": 5000
1211
+ },
1212
+ "timeoutPolicy": {
1213
+ "kind": "bounded",
1214
+ "timeoutMs": 600000
1215
+ },
1216
+ "nonClaims": [
1217
+ "Release SBOM generation does not prove vulnerability absence, license approval, registry identity, or release approval.",
1218
+ "Self-hosting witness policy does not prove producer authentication or merge approval."
1219
+ ]
1220
+ }
1221
+ ],
1222
+ "nonClaims": [
1223
+ "Local-go environment policy does not claim cross-platform package publication readiness.",
1224
+ "Self-hosting witness plan does not authenticate producers, execute CI, publish packages, or approve merge."
1225
+ ]
1226
+ }