@research-engineering/agentic-proofkit 0.1.142 → 0.1.144

package/BACKLOG.md

@@ -65,74 +65,35 @@ only when these criteria are satisfied or explicitly retired by owner decision:
 | DONE | IMPORT-04 | Adoption and backlog owner surfaces | Public-ready adoption and backlog routing were added without stale private release facts or consumer-specific claims. |
 | DONE | IMPORT-05 | Historical design and plan cleanup | Durable claims from pre-cutover design and implementation-plan work are represented by deterministic specs, proof bindings, tests, package-public docs, or open backlog rows. No source-repository design documents or implementation plans are retained as current authority. |
 | DONE | IMPORT-06 | Remaining source-local code delta audit | Non-document source comparison found no old source file missing from the public source tree. Old source bytes remain candidate evidence only and are not imported over current hardening. |
-| DONE | RELEASE-01 | Public source release | `v0.1.135` was published from this public repository through npm Trusted Publisher, post-publish npm registry identity was captured, root-only installed-package proof passed, and GitHub Release assets were published. PyPI publication and GitHub artifact attestations were skipped by explicit optional-channel policy and are not claimed. |
-| DONE | RELEASE-02 | Scoped npm package identity | `@research-engineering/agentic-proofkit@0.1.138` was published from this public repository through the scoped npm Trusted Publisher path. Post-publish scoped npm registry identity was captured, root-only installed-package JSON CLI ABI proof passed, and GitHub Release assets were published. The `agentic-proofkit` CLI binary and Python package identities remain unchanged. The previous unscoped npm package remains a compatibility artifact, not the preferred dependency identity. |
+| DONE | RELEASE-01 | Public source release | A public-source npm release path was admitted through Trusted Publisher, post-publish registry identity capture, root-only installed-package proof, and GitHub Release assets. PyPI publication and GitHub artifact attestations were skipped by explicit optional-channel policy and are not claimed. |
+| DONE | RELEASE-02 | Scoped npm package identity | The organization-scoped npm package identity is the preferred release channel and is admitted through the scoped npm Trusted Publisher path, post-publish registry capture, root-only installed-package JSON CLI ABI proof, and GitHub Release assets. The `agentic-proofkit` CLI binary and Python package identities remain unchanged. The previous unscoped npm package remains a compatibility artifact, not the preferred dependency identity. |
 | DONE | SECURITY-01 | Provider security settings | Repository is public with collaborator-only PR creation, public issues, squash-only merges, branch protection on `main`, strict required CI, CodeQL, OSV source advisory scanning, Scorecard, Dependabot security updates, secret scanning, and push protection. Non-provider secret patterns and validity checks remain unavailable or disabled under the current provider plan and are not claimed. |
-| DONE | CONSUMER-01 | Public-package consumer proof | A private first consumer repository consumed exact public npm `agentic-proofkit@0.1.134` through its repository-owned external-consumer gate. The proof installed the package into an isolated temporary consumer, matched the admitted tarball integrity and shasum, proved lockfile resolution was not workspace based, ran installed CLI `self-check`, `witness-plan`, and `release-authority`, proved rollback by removing the dependency from the temporary lockfile, and preserved consumer-owned native witness authority. |
+| DONE | CONSUMER-01 | Public-package consumer proof | A private first consumer repository consumed the public npm package through its repository-owned external-consumer gate. The proof installed the package into an isolated temporary consumer, matched the admitted package identity, proved lockfile resolution was not workspace based, ran installed CLI `self-check`, `witness-plan`, and `release-authority`, proved rollback by removing the dependency from the temporary lockfile, and preserved consumer-owned native witness authority. |
 | DONE | CONSUMER-02 | Second-consumer pilot | A private topology-distinct Python/FastAPI consumer module was run through explicit-input warn-mode `gradual-adoption-guidance` and `--agent-envelope` pilot records. Proofkit admitted the caller-owned route, reported one advisory candidate boundary, reported two missing proof-binding rule IDs as warnings, emitted route/bind/modernize/verify/promote agent actions, and kept enforcement blocked until consumer owners admit stable requirements and proof bindings. No generic Proofkit blocker was confirmed. |
 
-## Release Evidence
+## Release Evidence Model
 
-`RELEASE-01` was admitted on 2026-07-03 from public repository
-`research-engineering/agentic-proofkit` at commit
-`2bbc36607734589f9e49191b4dc03eb37c65115b` and tag `v0.1.135`.
+This backlog records release-channel completion state, not immutable per-version
+provider facts. Exact package versions, source refs, workflow run identities,
+tarball URLs, integrity strings, shasums, release assets, and registry
+post-publish facts are owned by npm registry records, GitHub Release artifacts,
+and generated release manifests for each tag.
 
-Provider run:
+Do not copy exact post-publish provider facts into package-public source docs:
+package bytes are immutable, while those facts are known only after the package
+candidate has been built and published. The package verifier rejects shipped
+Markdown that reintroduces exact release versions, provider run URLs, registry
+tarball URLs, or raw release hash evidence.
 
-```text
-https://github.com/research-engineering/agentic-proofkit/actions/runs/28677195127
-```
-
-The release workflow completed successfully. It ran the release candidate
-package gate, publish readiness, npm Trusted Publisher publish, post-publish
-registry capture, root-only installed-package JSON CLI ABI proof, final release
-metadata generation, and GitHub Release asset publication. The npm registry now
-reports `agentic-proofkit@0.1.135` with repository URL
-`git+https://github.com/research-engineering/agentic-proofkit.git`,
-tarball
-`https://registry.npmjs.org/agentic-proofkit/-/agentic-proofkit-0.1.135.tgz`,
-integrity
-`sha512-GrLDm3P67JeWiEHCO5m/y1KiJ8hUSzZdQk7rM/Vgrqx3gphc21PQO27HwODFUDp4Gb62l1FpJ8v6b4i7dfY43A==`,
-shasum `41722c3fa35dfa7cdea3d78e2aa940fb7d5cbcf3`, and license `MIT`.
-
-The npm Trusted Publisher relationship for `agentic-proofkit` was moved from
-the old source repository to GitHub Actions repository
-`research-engineering/agentic-proofkit`, workflow file `release.yml`,
-environment `npm-production`. PyPI publication was disabled for this release,
-therefore PyPI registry identity is not claimed. GitHub artifact attestations
-were skipped by current repository policy, therefore artifact attestation is
-not claimed.
-
-`RELEASE-02` was admitted on 2026-07-03 from public repository
-`research-engineering/agentic-proofkit` at commit
-`d9398ec76ae672470d8c3f946cb7693cb134fb7c` and tag `v0.1.138`.
-
-Provider run:
-
-```text
-https://github.com/research-engineering/agentic-proofkit/actions/runs/28683622996
-```
-
-The release workflow completed successfully. It ran the release candidate
-package gate, publish readiness, scoped npm Trusted Publisher publish,
-post-publish registry capture, root-only installed-package JSON CLI ABI proof,
-final release metadata generation, and GitHub Release asset publication. The
-npm registry reports `@research-engineering/agentic-proofkit@0.1.138` with
-repository URL
-`git+https://github.com/research-engineering/agentic-proofkit.git`, tarball
-`https://registry.npmjs.org/@research-engineering/agentic-proofkit/-/agentic-proofkit-0.1.138.tgz`,
-integrity
-`sha512-6t9B7i+6gFW2s9zXGFankO7KnpWzSqgdcUlyOAVQFDzre5Y/wuJKDyJiKyiPAb+5CcgUuoiWo78lceyQ8JLvnA==`,
-shasum `e89fa467a34f3731c0540c86e3c482a3d7df522e`, and license `MIT`.
-The GitHub Release is
-`https://github.com/research-engineering/agentic-proofkit/releases/tag/v0.1.138`.
-PyPI publication remained disabled, and GitHub artifact attestations remained
-skipped by current repository policy.
+PyPI publication is not claimed unless the release workflow enables the PyPI
+channel and records post-publish PyPI registry identity. GitHub artifact
+attestations are not claimed unless the release workflow records provider
+attestation evidence for the published assets.
 
 ## Consumer Evidence
 
-`CONSUMER-01` was admitted on 2026-07-03 from a private first consumer
-repository checkout at `4cecdf8` using these consumer-owned gates:
+`CONSUMER-01` was admitted from a private first consumer repository using these
+consumer-owned gates:
 
 ```bash
 bun run verify:proofkit-external-consumer
@@ -146,10 +107,8 @@ bun run verify:proofkit-requirement-coverage
 
 The machine report for `bun scripts/report-proofkit-external-consumer.ts
 --format json` emitted `reportKind: proofkit.registry-consumer`, `state:
-passed`, `packageName: agentic-proofkit`, `packageVersion: 0.1.134`,
-`registryUrl: https://registry.npmjs.org`, `tarballShasum:
-6029a30b232c87f9aff659b4d8d5dbb4536a0d25`, `frozenLockUsesWorkspace:
-false`, `releaseAuthorityReportKind: proofkit.release-authority`,
+passed`, a public npm registry URL, non-workspace lockfile resolution,
+`releaseAuthorityReportKind: proofkit.release-authority`,
 `releaseAuthorityState: passed`, and `rollbackLockContainsPackage: false`.
 
 This evidence does not claim npm publication from this public source

package/README.md

@@ -15,8 +15,8 @@ packets without copying verifier logic between projects.
 | Source visibility | Public |
 | Current layer | Public source with admitted scoped npm release evidence |
 | Runtime implementation | Go CLI with npm and Python wrapper packaging |
-| Package release | `@research-engineering/agentic-proofkit@0.1.138` is admitted; `agentic-proofkit@0.1.135` remains the previous unscoped release |
-| Public-source provenance | Admitted for `v0.1.138` |
+| Package release | Scoped npm release channel admitted; exact version and registry identity are owned by npm and GitHub Release artifacts |
+| Public-source provenance | Admitted through release artifacts and registry evidence, not by this overview |
 | License | MIT |
 
 ## Project Boundary

package/docs/proofkit-contract-map.md

@@ -36,7 +36,7 @@ No command may infer ambient repository truth from the current directory.
 | Adoption and scaffolding | `adoption-contract-envelope`, `adoption-workflow-plan`, `adoption-doctor`, `gradual-adoption`, `gradual-adoption-bootstrap`, `gradual-adoption-guidance`, `scaffold-profile-plan`, `scaffold-project-structure`, `stack-preset` | adoption intent, aggregate adoption contract envelope, target paths, owner routes, caller-extracted stale authority vocabulary facts, stack preset id | aggregate contract-envelope admission, deterministic starter plans, bounded guidance envelopes, dry-run manifests, adoption gap and stale-authority classification | final files, final requirements, rollout policy, text extraction from files | selected child output, plan, report, or agent envelope |
 | Requirement source | `requirement-authoring-plan`, `requirement-source-admission`, `requirement-source-transition`, `spec-overview-claims`, `requirement-spec-tree`, `requirement-spec-tree-view`, `requirement-source-view`, `requirement-browser-server` | `requirements.v1.json`, caller-owned authoring facts, overview claim extraction, explicit spec hierarchy, view options | candidate-only authoring packets, source-shape admission, lifecycle checks, explicit tree topology/source-ref admission, shared safe renderer fragments, presentation-only views | requirement meaning, extraction completeness, Markdown extraction completeness, hierarchy ownership, proof adequacy, file materialization | authoring packet, source report, spec-tree report, rendered view, or browser presentation |
 | Requirement proof binding | `requirement-bindings`, `proof-slice`, `evidence-graph`, `requirement-proof-resolver`, `requirement-proof-source-set`, `requirement-proof-view`, `spec-proof-bundle-admission` | requirement records, bindings, witness commands, source-set facts, receipt reports | graph validation, compact slices, typed compact proof contract projections, resolver projections, bundle linkage checks | test semantics, witness execution, proof freshness, merge policy | proof report, slice, lookup graph, or view |
-| Test inventory and coverage | `test-evidence-inventory`, `test-evidence-inventory --normalized-inventory`, `requirement-coverage-input-compose`, `requirement-coverage-view`, `requirement-browser-server --view coverage` | caller-owned direct or source-set test inventory, declared quality findings, requirement source, proof binding or compact proof contract, coverage universe, optional owner-invariant registry | strict inventory/source-set admission, fail-closed normalized inventory projection, deterministic coverage-view input composition from explicit facts, weak-oracle and declared-quality classification, requirement/test/command/owner-invariant joins, nonsemantic command-evidence classification, stable coverage failure/warning classifications, presentation-only coverage view | inventory completeness, weak-test truth, native test execution, receipt freshness, producer trust, merge policy | inventory report, normalized inventory data product, coverage-view input, coverage view, or browser presentation |
+| Test inventory and coverage | `test-evidence-inventory`, `test-evidence-inventory --normalized-inventory`, `requirement-coverage-input-compose`, `requirement-coverage-view`, `requirement-browser-server --view coverage` | caller-owned direct or source-set test inventory, declared quality findings, requirement source, proof binding or compact proof contract, coverage universe, optional owner-invariant registry | strict inventory/source-set admission, fail-closed normalized inventory projection, deterministic coverage-view input composition from explicit facts, weak-oracle and declared-quality classification, bounded agent action guidance, requirement/test/command/owner-invariant joins, nonsemantic command-evidence classification, stable coverage failure/warning classifications, presentation-only coverage view | inventory completeness, weak-test truth, native test execution, receipt freshness, producer trust, merge policy | inventory report, normalized inventory data product, coverage-view input, coverage view, or browser presentation |
 | Selective planning | `changed-path-set`, `requirement-impact-input-compose`, `impact`, `selective-gate-plan`, `selective-gate-evidence`, `selective-gate-obligation-decision-input`, `obligation-decision` | changed paths, base/current requirement sources, base/current single-binding-per-requirement proof contracts, generated-artifact policy, local environment policy, proof-like path policy, planned receipts, obligation routes | fail-closed impact input composition, fail-closed planning, receipt comparison, bounded agent packets | git diff truth, repository scanning, command execution, producer trust, final admission | composed impact input, plan, evidence report, or obligation input |
 | Receipts and producers | `proof-receipt-admission`, `receipt-producer-admission`, `receipt-currentness-scope`, `receipt-trust-class`, `producer-policy-self-proof` | receipt sets, producer policy, scope/currentness facts, trust classes | receipt shape, producer/receipt compatibility, self-proof diagnostics | producer authentication, freshness policy, CI trust roots | receipt/provenance report |
 | Release and deployment | `release-authority`, `external-consumer`, `registry-consumer-proof-input-compose`, `registry-consumer`, `deployment-evidence-admission`, `completion-criteria`, `branch-authority`, `readiness-closeout` | package facts, tarball/registry facts, explicit primitive registry/install/smoke facts, deployment evidence, criteria, branch facts | artifact/channel boundary checks, registry-consumer input composition, release diagnostics, falsifiable criteria shape | package publication, registry fetch, package-manager execution, deployment, rollback, approval | composed input, release/deployment/readiness report |
@@ -105,7 +105,7 @@ Decision tree:
 | Humans or agents need meta/module/submodule navigation. | `requirement-spec-tree`, then `requirement-spec-tree-view` or `requirement-browser-server --view spec-tree` from the same caller-owned tree input. | Stop before inferring hierarchy from paths. The consumer owns source hierarchy; CLI/browser outputs remain presentation only and are not committed by default. |
 | Overview prose may contain durable claims. | `spec-overview-claims` | Escalate when normative claims are not tied to `REQ-*` records. |
 | Requirements have no verified proof route. | `requirement-bindings`, `witness-plan`, `proof-slice`, or `requirement-proof-resolver` | Stop before claiming proof adequacy; native witness semantics stay with the consumer. |
-| Tests or proof evidence need inventory. | `test-evidence-inventory`, optionally `requirement-coverage-input-compose`, then `requirement-coverage-view` | Compose only from explicit caller-owned facts. Use `failureClassifications[]` and `warningClassifications[]` for machine routing. Escalate when tests are route-only, weak-oracle, unbound, or outside the caller-owned coverage universe. |
+| Tests or proof evidence need inventory. | `test-evidence-inventory`, optionally `requirement-coverage-input-compose`, then `requirement-coverage-view` | Compose only from explicit caller-owned facts. Use `failureClassifications[]`, `warningClassifications[]`, and `agentActionPlan[]` for machine routing. Escalate when tests are route-only, weak-oracle, unbound, or outside the caller-owned coverage universe. |
 | A change set is known. | `changed-path-set`, optionally `requirement-impact-input-compose`, `impact`, then `selective-gate-plan --agent-envelope` | Raw `knownChangedPaths` in `agent-route` are diagnostic only. Materialize a caller-owned `changed_path_set`, compose a caller-owned `impact_input` before `impact`, and compose a caller-owned `selective_gate_plan_input` before `selective-gate-plan`. Fail closed on unknown scope, dynamic edges, missing owner routes, unbound proof-like paths, or full-gate escalation. |
 | Does a TypeScript package public API match a caller-owned manifest? | `agent-route` with `goal: "verify_typescript_public_api"` and explicit `typescript_public_api_manifest` plus `typescript_public_api_repo_root`, then `typescript-public-api-surfaces --repo-root <caller-selected-root>` | This is an explicit filesystem scanner. Stop before guessing `repo-root`, claiming checkout freshness, package-manager truth, or merge readiness. |
 | Receipts are available for planned checks. | `selective-gate-evidence --agent-envelope`, then `obligation-decision --agent-envelope` | Escalate on missing, stale, invalid, untrusted, blocked, unavailable, or unknown-scope evidence. |

package/docs/specs/proofkit-package-boundary/overview.md

@@ -29,6 +29,9 @@ denial, and package artifact behavior only.
   wrapper over the same Go CLI, with wheel-safe package metadata, wheel tags,
   embedded binary identity, local install smoke proof, and explicit non-claims
   until PyPI publication.
+- `REQ-PROOFKIT-PACKAGE-007`: package-public Markdown records release-channel
+  state only and must not embed exact per-version provider facts that are owned
+  by immutable registry, release, and manifest artifacts.
 
 ## Non-Claims
 

package/docs/specs/proofkit-package-boundary/requirements.v1.json

@@ -166,6 +166,33 @@
         "requiresImpactDeclaration": true,
         "requiresProofBindingReview": true
       }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-PACKAGE-007",
+      "ownerId": "proofkit.package-boundary",
+      "invariant": "Package-public Markdown records release-channel completion state only and must not embed exact package versions, source refs, provider run URLs, registry tarball URLs, integrity strings, shasums, or other per-version release facts that are owned by immutable registry records, GitHub Release artifacts, and generated release manifests.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-PACKAGE-007"
+      ],
+      "nonClaims": [
+        "This requirement does not claim registry publication, provider-run success, PyPI publication, GitHub artifact attestation, release approval, or that already-published immutable package versions can be corrected in place."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.package-boundary",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
     }
   ],
   "nonClaims": [

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -143,7 +143,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-006",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Test evidence inventory, proof-binding-derived inventory projections, normalized inventory projections, coverage-view input composition, and requirement coverage views classify or assemble caller-owned test-to-requirement, command, witness, owner-invariant, quality-finding, and declared-surface routes with stable machine-readable failure and warning classifications while preserving source-set entry provenance, failing closed on structured selector/sourcePath drift, command-ref collisions, missing requirement owners, scope widening, fabricated normalized inventory, nonsemantic command evidence, and declared dead zones in selected-owner or full-repository scopes, and without treating proof routes, nonsemantic command evidence, normalized projections, composed inputs, or rendered views as semantic test coverage.",
+      "invariant": "Test evidence inventory, proof-binding-derived inventory projections, normalized inventory projections, coverage-view input composition, and requirement coverage views classify or assemble caller-owned test-to-requirement, command, witness, owner-invariant, quality-finding, and declared-surface routes with stable machine-readable failure and warning classifications plus bounded agent action guidance while preserving source-set entry provenance, failing closed on structured selector/sourcePath drift, command-ref collisions, missing requirement owners, scope widening, fabricated normalized inventory, nonsemantic command evidence, and declared dead zones in selected-owner or full-repository scopes, and without treating proof routes, nonsemantic command evidence, normalized projections, composed inputs, generated guidance, or rendered views as semantic test coverage.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": [

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.1.142",
+  "version": "0.1.144",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,

package/proofkit/cli-contract.v1.json

@@ -1352,6 +1352,11 @@
             "sourceDiagnosticKey": "warnings"
           }
         },
+        "agentActionPlan": {
+          "sourceDiagnosticKeys": ["failures", "warnings"],
+          "decisionOwner": "consumer_repository",
+          "nonClaim": "Agent actions are deterministic guidance over admitted caller-owned inventory facts and do not execute tests, approve merge, or decide semantic truth."
+        },
         "classificationIds": [
           "declared_duplicate_falsifier",
           "duplicate_falsifier_candidate",

package/proofkit/requirement-bindings.json

@@ -62,6 +62,16 @@
         "This requirement does not claim PyPI publication, PyPI registry install authority, a Python SDK contract, consumer rollout, or execution for non-native wheel platforms."
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-PACKAGE-007",
+      "ownerId": "proofkit.package-boundary",
+      "specPath": "docs/specs/proofkit-package-boundary/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": [
+        "This requirement does not claim registry publication, provider-run success, PyPI publication, GitHub artifact attestation, release approval, or that already-published immutable package versions can be corrected in place."
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-001",
       "ownerId": "proofkit.spec-proof-core",
@@ -568,6 +578,20 @@
         "local-go"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-PACKAGE-007",
+      "scenarioId": "proofkit.package-boundary.package-public-docs-no-mutable-release-facts",
+      "witnessId": "proofkit.packageverify.package-public-docs-no-mutable-release-facts",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/packageverify/main_test.go",
+      "commandIds": [
+        "proofkit.go-test",
+        "proofkit.package-artifact"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-PACKAGE-002",
       "scenarioId": "proofkit.package-boundary.cli-deterministic-report-boundary",