@research-engineering/agentic-proofkit 0.1.150 → 0.1.152

package/README.md

@@ -12,8 +12,8 @@ packets without copying verifier logic between projects.
 
 | Surface | State |
 |---|---|
-| Source visibility | Public |
-| Current layer | Public source; release evidence is version-specific |
+| Source repository | Declared in package metadata; provider visibility is a live GitHub fact |
+| Current layer | Public-source workflow; release evidence is version-specific |
 | Runtime implementation | Go CLI with npm and Python wrapper packaging |
 | Package release | Scoped npm release channel configured; exact version and registry identity are owned by npm and GitHub Release artifacts |
 | Public-source provenance | Claimed only for a version whose release assets, registry identity, and checksum manifests are artifact-closed |

package/docs/specs/proofkit-supply-chain-quality/overview.md

@@ -45,9 +45,11 @@ vulnerability absence, or consumer rollout safety by itself.
   inventory admission, command semantic routes without owner-declared proof
   identities, route-index-derived semantic proof identities, direct app
   semantic routes outside the command-scoped app test, package-level semantic
-  routes outside the descriptor-owned command package, and missing matching
-  semantic command evidence without claiming line coverage or exhaustive test
-  semantic completeness.
+  routes outside the descriptor-owned command package, semantic command routes
+  whose parsed Go test body lacks the source-owned executable oracle marker for
+  the exact emitted command route fact, and missing matching semantic command
+  evidence without claiming line coverage or exhaustive test semantic
+  completeness.
 - `REQ-PROOFKIT-QUALITY-011`: CI separates the OS-independent full
   source/package gate from macOS platform smoke, uses explicit hosted runner
   labels instead of floating latest labels, and exposes one fail-closed

package/docs/specs/proofkit-supply-chain-quality/requirements.v1.json

@@ -129,7 +129,7 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-010",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "Coverage metrics report requirement, binding, witness, CLI inventory linkage, and descriptor-owned command semantic-route coverage from admitted test-evidence-inventory rows, failing closed on explicit requirement/proof linkage dead zones, failed command-route inventory admission, command semantic routes without owner-declared proof identities, route-index-derived semantic proof identities, direct app semantic routes outside the command-scoped app test, package-level semantic routes outside the descriptor-owned command package, or missing matching semantic command evidence without claiming line coverage or exhaustive test semantic completeness.",
+      "invariant": "Coverage metrics report requirement, binding, witness, CLI inventory linkage, and descriptor-owned command semantic-route coverage from admitted test-evidence-inventory rows, failing closed on explicit requirement/proof linkage dead zones, failed command-route inventory admission, command semantic routes without owner-declared proof identities, route-index-derived semantic proof identities, direct app semantic routes outside the command-scoped app test, package-level semantic routes outside the descriptor-owned command package, semantic command routes whose parsed Go test body lacks the source-owned executable oracle marker for the exact emitted command ref, selector, source path, falsifier ids, oracle id, and expected public outcome, or missing matching semantic command evidence without claiming line coverage or exhaustive test semantic completeness.",
       "claimLevel": "blocking",
       "riskClass": "medium",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.1.150",
+  "version": "0.1.152",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,
@@ -23,7 +23,6 @@
   "files": [
     "ADOPTION.md",
     "AGENTS.md",
-    "BACKLOG.md",
     "CONTRIBUTING.md",
     "LICENSE",
     "NON_CLAIMS.md",

package/proofkit/witness-plan.json

@@ -719,8 +719,12 @@
       "commandId": "proofkit.coverage-metrics",
       "inputSelectors": [
         "docs/specs",
+        "internal/app",
         "internal/app/command_coverage_routes.go",
+        "internal/app/command_coverage_source.go",
         "internal/app/command_registry.go",
+        "internal/command",
+        "internal/testsupport/commandcoverage",
         "internal/tools/coveragemetrics",
         "proofkit/cli-contract.v1.json",
         "proofkit/requirement-bindings.json",

package/BACKLOG.md

@@ -1,56 +0,0 @@
-# Proofkit Backlog
-
-This file is the canonical active-work ledger for
-`research-engineering/agentic-proofkit`.
-
-It tracks only current `NEXT`, `BLOCKED`, or `DEFERRED` work. It is not a
-roadmap, release log, proof registry, architecture document, CLI manual, or
-historical completion archive.
-
-## Current State
-
-Active work is limited to the rows below.
-
-The public source cutover, scoped npm channel, optional PyPI channel, provider
-security setup, first-consumer proof, and second-consumer pilot have all been
-closed. Durable rules and reusable architecture now live in their owner
-surfaces:
-
-- `README.md` for human orientation;
-- `ADOPTION.md` for adoption, distribution, rendering, requirement, contract,
-  test, and agent-guidance models;
-- `NON_CLAIMS.md` for boundary denials;
-- `docs/proofkit-contract-map.md` for command-family routing and agent
-  decision procedure;
-- `docs/release-process.md` for release-channel evidence and publication
-  process;
-- `docs/specs/**/requirements.v1.json` for durable machine requirements;
-- `proofkit/*.json` for shipped machine contracts and proof routes;
-- source, tests, package metadata, and workflows for executable behavior.
-
-## Admission Rules
-
-Add a row only when new work is accepted and cannot be represented more
-precisely by an existing owner surface.
-
-Every row must be falsifiable and include:
-
-- `Status`: `NEXT`, `BLOCKED`, or `DEFERRED`;
-- `ID`: stable owner-scoped identifier;
-- `Scope`: one bounded reason to change;
-- `Completion condition`: objective proof or explicit retirement condition.
-
-When a row is completed, remove it from this active backlog after its durable
-rule, evidence, or behavior is represented by the owning source, test,
-contract, release artifact, provider record, or documentation surface. Do not
-retain completed rows here as history.
-
-Historical evidence belongs in pull requests, release artifacts, registry
-records, generated release manifests, or the owning docs named above.
-
-## Open Rows
-
-| Status | ID | Scope | Completion condition |
-|---|---|---|---|
-| BLOCKED | RELEASE-01 | Decide whether normalized post-create GitHub Release facts need durable public evidence beyond retained workflow artifacts under immutable GitHub Releases. | Either keep `github-release.json` as retained workflow evidence with explicit non-claims, or design a provider-compatible public evidence channel that does not require post-create Release asset mutation. Completion requires a release-proof design and live provider proof; direct backfill/upload is blocked by immutable Release upload rejection. |
-| BLOCKED | RELEASE-02 | Resolve or explicitly retire the immutable historical GitHub Release asset-closure gap where release metadata references a notes asset that the published release does not contain. | Either attach the exact checksum-matching notes asset if provider policy allows, or record the provider-impossible closure in the release evidence model and prove future releases cannot repeat the gap. Completion requires live provider proof; direct backfill is currently blocked by immutable Release upload rejection. |