@research-engineering/agentic-proofkit 0.1.143 → 0.1.144
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/BACKLOG.md
CHANGED
|
@@ -65,74 +65,35 @@ only when these criteria are satisfied or explicitly retired by owner decision:
|
|
|
65
65
|
| DONE | IMPORT-04 | Adoption and backlog owner surfaces | Public-ready adoption and backlog routing were added without stale private release facts or consumer-specific claims. |
|
|
66
66
|
| DONE | IMPORT-05 | Historical design and plan cleanup | Durable claims from pre-cutover design and implementation-plan work are represented by deterministic specs, proof bindings, tests, package-public docs, or open backlog rows. No source-repository design documents or implementation plans are retained as current authority. |
|
|
67
67
|
| DONE | IMPORT-06 | Remaining source-local code delta audit | Non-document source comparison found no old source file missing from the public source tree. Old source bytes remain candidate evidence only and are not imported over current hardening. |
|
|
68
|
-
| DONE | RELEASE-01 | Public source release |
|
|
69
|
-
| DONE | RELEASE-02 | Scoped npm package identity |
|
|
68
|
+
| DONE | RELEASE-01 | Public source release | A public-source npm release path was admitted through Trusted Publisher, post-publish registry identity capture, root-only installed-package proof, and GitHub Release assets. PyPI publication and GitHub artifact attestations were skipped by explicit optional-channel policy and are not claimed. |
|
|
69
|
+
| DONE | RELEASE-02 | Scoped npm package identity | The organization-scoped npm package identity is the preferred release channel and is admitted through the scoped npm Trusted Publisher path, post-publish registry capture, root-only installed-package JSON CLI ABI proof, and GitHub Release assets. The `agentic-proofkit` CLI binary and Python package identities remain unchanged. The previous unscoped npm package remains a compatibility artifact, not the preferred dependency identity. |
|
|
70
70
|
| DONE | SECURITY-01 | Provider security settings | Repository is public with collaborator-only PR creation, public issues, squash-only merges, branch protection on `main`, strict required CI, CodeQL, OSV source advisory scanning, Scorecard, Dependabot security updates, secret scanning, and push protection. Non-provider secret patterns and validity checks remain unavailable or disabled under the current provider plan and are not claimed. |
|
|
71
|
-
| DONE | CONSUMER-01 | Public-package consumer proof | A private first consumer repository consumed
|
|
71
|
+
| DONE | CONSUMER-01 | Public-package consumer proof | A private first consumer repository consumed the public npm package through its repository-owned external-consumer gate. The proof installed the package into an isolated temporary consumer, matched the admitted package identity, proved lockfile resolution was not workspace based, ran installed CLI `self-check`, `witness-plan`, and `release-authority`, proved rollback by removing the dependency from the temporary lockfile, and preserved consumer-owned native witness authority. |
|
|
72
72
|
| DONE | CONSUMER-02 | Second-consumer pilot | A private topology-distinct Python/FastAPI consumer module was run through explicit-input warn-mode `gradual-adoption-guidance` and `--agent-envelope` pilot records. Proofkit admitted the caller-owned route, reported one advisory candidate boundary, reported two missing proof-binding rule IDs as warnings, emitted route/bind/modernize/verify/promote agent actions, and kept enforcement blocked until consumer owners admit stable requirements and proof bindings. No generic Proofkit blocker was confirmed. |
|
|
73
73
|
|
|
74
|
-
## Release Evidence
|
|
74
|
+
## Release Evidence Model
|
|
75
75
|
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
76
|
+
This backlog records release-channel completion state, not immutable per-version
|
|
77
|
+
provider facts. Exact package versions, source refs, workflow run identities,
|
|
78
|
+
tarball URLs, integrity strings, shasums, release assets, and registry
|
|
79
|
+
post-publish facts are owned by npm registry records, GitHub Release artifacts,
|
|
80
|
+
and generated release manifests for each tag.
|
|
79
81
|
|
|
80
|
-
|
|
82
|
+
Do not copy exact post-publish provider facts into package-public source docs:
|
|
83
|
+
package bytes are immutable, while those facts are known only after the package
|
|
84
|
+
candidate has been built and published. The package verifier rejects shipped
|
|
85
|
+
Markdown that reintroduces exact release versions, provider run URLs, registry
|
|
86
|
+
tarball URLs, or raw release hash evidence.
|
|
81
87
|
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
The release workflow completed successfully. It ran the release candidate
|
|
87
|
-
package gate, publish readiness, npm Trusted Publisher publish, post-publish
|
|
88
|
-
registry capture, root-only installed-package JSON CLI ABI proof, final release
|
|
89
|
-
metadata generation, and GitHub Release asset publication. The npm registry now
|
|
90
|
-
reports `agentic-proofkit@0.1.135` with repository URL
|
|
91
|
-
`git+https://github.com/research-engineering/agentic-proofkit.git`,
|
|
92
|
-
tarball
|
|
93
|
-
`https://registry.npmjs.org/agentic-proofkit/-/agentic-proofkit-0.1.135.tgz`,
|
|
94
|
-
integrity
|
|
95
|
-
`sha512-GrLDm3P67JeWiEHCO5m/y1KiJ8hUSzZdQk7rM/Vgrqx3gphc21PQO27HwODFUDp4Gb62l1FpJ8v6b4i7dfY43A==`,
|
|
96
|
-
shasum `41722c3fa35dfa7cdea3d78e2aa940fb7d5cbcf3`, and license `MIT`.
|
|
97
|
-
|
|
98
|
-
The npm Trusted Publisher relationship for `agentic-proofkit` was moved from
|
|
99
|
-
the old source repository to GitHub Actions repository
|
|
100
|
-
`research-engineering/agentic-proofkit`, workflow file `release.yml`,
|
|
101
|
-
environment `npm-production`. PyPI publication was disabled for this release,
|
|
102
|
-
therefore PyPI registry identity is not claimed. GitHub artifact attestations
|
|
103
|
-
were skipped by current repository policy, therefore artifact attestation is
|
|
104
|
-
not claimed.
|
|
105
|
-
|
|
106
|
-
`RELEASE-02` was admitted on 2026-07-03 from public repository
|
|
107
|
-
`research-engineering/agentic-proofkit` at commit
|
|
108
|
-
`d9398ec76ae672470d8c3f946cb7693cb134fb7c` and tag `v0.1.138`.
|
|
109
|
-
|
|
110
|
-
Provider run:
|
|
111
|
-
|
|
112
|
-
```text
|
|
113
|
-
https://github.com/research-engineering/agentic-proofkit/actions/runs/28683622996
|
|
114
|
-
```
|
|
115
|
-
|
|
116
|
-
The release workflow completed successfully. It ran the release candidate
|
|
117
|
-
package gate, publish readiness, scoped npm Trusted Publisher publish,
|
|
118
|
-
post-publish registry capture, root-only installed-package JSON CLI ABI proof,
|
|
119
|
-
final release metadata generation, and GitHub Release asset publication. The
|
|
120
|
-
npm registry reports `@research-engineering/agentic-proofkit@0.1.138` with
|
|
121
|
-
repository URL
|
|
122
|
-
`git+https://github.com/research-engineering/agentic-proofkit.git`, tarball
|
|
123
|
-
`https://registry.npmjs.org/@research-engineering/agentic-proofkit/-/agentic-proofkit-0.1.138.tgz`,
|
|
124
|
-
integrity
|
|
125
|
-
`sha512-6t9B7i+6gFW2s9zXGFankO7KnpWzSqgdcUlyOAVQFDzre5Y/wuJKDyJiKyiPAb+5CcgUuoiWo78lceyQ8JLvnA==`,
|
|
126
|
-
shasum `e89fa467a34f3731c0540c86e3c482a3d7df522e`, and license `MIT`.
|
|
127
|
-
The GitHub Release is
|
|
128
|
-
`https://github.com/research-engineering/agentic-proofkit/releases/tag/v0.1.138`.
|
|
129
|
-
PyPI publication remained disabled, and GitHub artifact attestations remained
|
|
130
|
-
skipped by current repository policy.
|
|
88
|
+
PyPI publication is not claimed unless the release workflow enables the PyPI
|
|
89
|
+
channel and records post-publish PyPI registry identity. GitHub artifact
|
|
90
|
+
attestations are not claimed unless the release workflow records provider
|
|
91
|
+
attestation evidence for the published assets.
|
|
131
92
|
|
|
132
93
|
## Consumer Evidence
|
|
133
94
|
|
|
134
|
-
`CONSUMER-01` was admitted
|
|
135
|
-
|
|
95
|
+
`CONSUMER-01` was admitted from a private first consumer repository using these
|
|
96
|
+
consumer-owned gates:
|
|
136
97
|
|
|
137
98
|
```bash
|
|
138
99
|
bun run verify:proofkit-external-consumer
|
|
@@ -146,10 +107,8 @@ bun run verify:proofkit-requirement-coverage
|
|
|
146
107
|
|
|
147
108
|
The machine report for `bun scripts/report-proofkit-external-consumer.ts
|
|
148
109
|
--format json` emitted `reportKind: proofkit.registry-consumer`, `state:
|
|
149
|
-
passed`,
|
|
150
|
-
`
|
|
151
|
-
6029a30b232c87f9aff659b4d8d5dbb4536a0d25`, `frozenLockUsesWorkspace:
|
|
152
|
-
false`, `releaseAuthorityReportKind: proofkit.release-authority`,
|
|
110
|
+
passed`, a public npm registry URL, non-workspace lockfile resolution,
|
|
111
|
+
`releaseAuthorityReportKind: proofkit.release-authority`,
|
|
153
112
|
`releaseAuthorityState: passed`, and `rollbackLockContainsPackage: false`.
|
|
154
113
|
|
|
155
114
|
This evidence does not claim npm publication from this public source
|
package/README.md
CHANGED
|
@@ -15,8 +15,8 @@ packets without copying verifier logic between projects.
|
|
|
15
15
|
| Source visibility | Public |
|
|
16
16
|
| Current layer | Public source with admitted scoped npm release evidence |
|
|
17
17
|
| Runtime implementation | Go CLI with npm and Python wrapper packaging |
|
|
18
|
-
| Package release |
|
|
19
|
-
| Public-source provenance | Admitted
|
|
18
|
+
| Package release | Scoped npm release channel admitted; exact version and registry identity are owned by npm and GitHub Release artifacts |
|
|
19
|
+
| Public-source provenance | Admitted through release artifacts and registry evidence, not by this overview |
|
|
20
20
|
| License | MIT |
|
|
21
21
|
|
|
22
22
|
## Project Boundary
|
|
@@ -29,6 +29,9 @@ denial, and package artifact behavior only.
|
|
|
29
29
|
wrapper over the same Go CLI, with wheel-safe package metadata, wheel tags,
|
|
30
30
|
embedded binary identity, local install smoke proof, and explicit non-claims
|
|
31
31
|
until PyPI publication.
|
|
32
|
+
- `REQ-PROOFKIT-PACKAGE-007`: package-public Markdown records release-channel
|
|
33
|
+
state only and must not embed exact per-version provider facts that are owned
|
|
34
|
+
by immutable registry, release, and manifest artifacts.
|
|
32
35
|
|
|
33
36
|
## Non-Claims
|
|
34
37
|
|
|
@@ -166,6 +166,33 @@
|
|
|
166
166
|
"requiresImpactDeclaration": true,
|
|
167
167
|
"requiresProofBindingReview": true
|
|
168
168
|
}
|
|
169
|
+
},
|
|
170
|
+
{
|
|
171
|
+
"requirementId": "REQ-PROOFKIT-PACKAGE-007",
|
|
172
|
+
"ownerId": "proofkit.package-boundary",
|
|
173
|
+
"invariant": "Package-public Markdown records release-channel completion state only and must not embed exact package versions, source refs, provider run URLs, registry tarball URLs, integrity strings, shasums, or other per-version release facts that are owned by immutable registry records, GitHub Release artifacts, and generated release manifests.",
|
|
174
|
+
"claimLevel": "blocking",
|
|
175
|
+
"riskClass": "medium",
|
|
176
|
+
"proofBindingRefs": [
|
|
177
|
+
"proofkit/requirement-bindings.json"
|
|
178
|
+
],
|
|
179
|
+
"nonClaimRefs": [
|
|
180
|
+
"NC-PROOFKIT-PACKAGE-007"
|
|
181
|
+
],
|
|
182
|
+
"nonClaims": [
|
|
183
|
+
"This requirement does not claim registry publication, provider-run success, PyPI publication, GitHub artifact attestation, release approval, or that already-published immutable package versions can be corrected in place."
|
|
184
|
+
],
|
|
185
|
+
"lifecycle": {
|
|
186
|
+
"state": "active",
|
|
187
|
+
"replacementRequirementIds": [],
|
|
188
|
+
"evidenceRefs": []
|
|
189
|
+
},
|
|
190
|
+
"deferral": null,
|
|
191
|
+
"updatePolicy": {
|
|
192
|
+
"reviewOwnerId": "proofkit.package-boundary",
|
|
193
|
+
"requiresImpactDeclaration": true,
|
|
194
|
+
"requiresProofBindingReview": true
|
|
195
|
+
}
|
|
169
196
|
}
|
|
170
197
|
],
|
|
171
198
|
"nonClaims": [
|
package/package.json
CHANGED
|
@@ -62,6 +62,16 @@
|
|
|
62
62
|
"This requirement does not claim PyPI publication, PyPI registry install authority, a Python SDK contract, consumer rollout, or execution for non-native wheel platforms."
|
|
63
63
|
]
|
|
64
64
|
},
|
|
65
|
+
{
|
|
66
|
+
"requirementId": "REQ-PROOFKIT-PACKAGE-007",
|
|
67
|
+
"ownerId": "proofkit.package-boundary",
|
|
68
|
+
"specPath": "docs/specs/proofkit-package-boundary/requirements.v1.json",
|
|
69
|
+
"claimLevel": "blocking",
|
|
70
|
+
"proofState": "witness_backed",
|
|
71
|
+
"nonClaims": [
|
|
72
|
+
"This requirement does not claim registry publication, provider-run success, PyPI publication, GitHub artifact attestation, release approval, or that already-published immutable package versions can be corrected in place."
|
|
73
|
+
]
|
|
74
|
+
},
|
|
65
75
|
{
|
|
66
76
|
"requirementId": "REQ-PROOFKIT-SPEC-001",
|
|
67
77
|
"ownerId": "proofkit.spec-proof-core",
|
|
@@ -568,6 +578,20 @@
|
|
|
568
578
|
"local-go"
|
|
569
579
|
]
|
|
570
580
|
},
|
|
581
|
+
{
|
|
582
|
+
"requirementId": "REQ-PROOFKIT-PACKAGE-007",
|
|
583
|
+
"scenarioId": "proofkit.package-boundary.package-public-docs-no-mutable-release-facts",
|
|
584
|
+
"witnessId": "proofkit.packageverify.package-public-docs-no-mutable-release-facts",
|
|
585
|
+
"witnessKind": "contract",
|
|
586
|
+
"witnessPath": "internal/tools/packageverify/main_test.go",
|
|
587
|
+
"commandIds": [
|
|
588
|
+
"proofkit.go-test",
|
|
589
|
+
"proofkit.package-artifact"
|
|
590
|
+
],
|
|
591
|
+
"environmentClasses": [
|
|
592
|
+
"local-go"
|
|
593
|
+
]
|
|
594
|
+
},
|
|
571
595
|
{
|
|
572
596
|
"requirementId": "REQ-PROOFKIT-PACKAGE-002",
|
|
573
597
|
"scenarioId": "proofkit.package-boundary.cli-deterministic-report-boundary",
|