@research-engineering/agentic-proofkit 0.1.153 → 0.1.155

package/NON_CLAIMS.md

@@ -7,7 +7,8 @@ This repository state does not claim:
 
 - runtime implementation readiness;
 - package publication readiness;
-- public-source provenance for a package version unless that version's release
+- public-source provenance for a package version unless that version was
+  released from an intentionally public source repository and its release
   assets, registry identity, and checksum manifests are artifact-closed;
 - source-code completeness;
 - production readiness;

package/docs/proofkit-contract-map.md

@@ -76,7 +76,7 @@ Route ambiguous modernization work through the smallest matching family:
 | Does a `REQ-*` have a route to execution? | `requirement-bindings` or `proof-slice` | Proof bindings own route closure, while tests own executable behavior. |
 | Tests were discovered from an existing repository but are not yet admitted proof evidence. | `test-evidence-inventory --projection discovery-draft` | It accepts explicit caller-owned discovery facts and emits candidate-only inventory guidance with a non-strict candidate authority. Stop before treating candidates as semantic coverage; the consumer must materialize strict test inventory rows. |
 | Which checks should run for a change? | `selective-gate-plan` then `selective-gate-evidence` | Planning and receipt comparison stay separate from command execution. |
-| Does the selective plan need a text or secret scan? | Prefer `scanObligation` with `commandOwnership: "proofkit_text_policy"` for `text-policy`, `commandOwnership: "proofkit_secret_scan"` for `secret-scan`, or `commandOwnership: "caller_owned_external"` for an external scanner; legacy `secretScan` is a compatibility alias only. | Stop before treating any inventory command as repository-wide discovery. Proofkit admits scan obligations but does not execute scanner commands or prove repository-wide credential absence. |
+| Does the selective plan need a text or secret scan? | Use `scanObligation` with `commandOwnership: "proofkit_text_policy"` for `text-policy`, `commandOwnership: "proofkit_secret_scan"` for `secret-scan`, or `commandOwnership: "caller_owned_external"` for an external scanner. | Stop before treating any inventory command as repository-wide discovery. Proofkit admits scan obligations but does not execute scanner commands or prove repository-wide credential absence. `secret-scan` suppressions must match exact finding class, path, and line; stale suppressions fail closed. |
 
 ## Agent Decision Procedure
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.1.153",
+  "version": "0.1.155",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,

package/proofkit/cli-contract.v1.json

@@ -569,7 +569,21 @@
       "allowedFlags": [
         "--input",
         "--input-pointer"
-      ]
+      ],
+      "inputContract": {
+        "contractId": "proofkit.migration-parity-admission.input.v1",
+        "schemaVersion": 1,
+        "authority": "caller-owned migration parity evidence",
+        "requiredFields": [
+          "nonClaims",
+          "parityRecords",
+          "paritySetId",
+          "schemaVersion",
+          "sourceProofOwners",
+          "targetProofkitRefs"
+        ],
+        "nonClaim": "Migration parity admission does not approve old-owner deletion, execute native witnesses, authenticate evidence, or prove semantic equivalence."
+      }
     },
     {
       "command": "migration-plan",
@@ -583,7 +597,24 @@
       "allowedFlags": [
         "--input",
         "--input-pointer"
-      ]
+      ],
+      "inputContract": {
+        "contractId": "proofkit.migration-plan.input.v1",
+        "schemaVersion": 1,
+        "authority": "caller-owned migration retirement planning facts",
+        "requiredFields": [
+          "followUpCommands",
+          "migrationId",
+          "nonClaims",
+          "parityEvidenceRefs",
+          "retainedOwners",
+          "retirementCandidates",
+          "schemaVersion",
+          "sourceProofOwners",
+          "targetProofkitRefs"
+        ],
+        "nonClaim": "Migration plans route caller-owned review work only and do not edit files, delete old owners, approve merge, or prove proof freshness."
+      }
     },
     {
       "command": "obligation-decision",
@@ -613,7 +644,35 @@
       "allowedFlags": [
         "--input",
         "--input-pointer"
-      ]
+      ],
+      "inputContract": {
+        "contractId": "proofkit.package-runtime-dependency-admission.input.v1",
+        "schemaVersion": 1,
+        "authority": "caller-owned runtime dependency resolution and lockfile identity facts",
+        "requiredFields": [
+          "admissibleLocations",
+          "expectedDependencySpec",
+          "expectedLockfileIntegrity",
+          "expectedPackageName",
+          "expectedPackageVersion",
+          "nonClaims",
+          "packageResolution",
+          "reportId",
+          "schemaVersion"
+        ],
+        "packageResolutionRequiredFields": [
+          "dependencySpec",
+          "lockfileEntryPresent",
+          "lockfileIntegrity",
+          "packageName",
+          "packageRoot",
+          "packageVersion",
+          "realPackageRoot",
+          "resolvedEntryPoint"
+        ],
+        "lockfileIntegrity": "npm-style sha256, sha384, or sha512 integrity string admitted from caller-owned lockfile facts",
+        "nonClaim": "The command does not read lockfiles, resolve packages, authenticate registry access, execute witnesses, or prove proof freshness."
+      }
     },
     {
       "command": "pilot-admission",
@@ -1344,6 +1403,21 @@
             "missing files must not include contentBase64"
           ]
         },
+        "suppressionRecord": {
+          "optional": true,
+          "requiredFields": [
+            "findingClass",
+            "line",
+            "path",
+            "reason",
+            "suppressionId"
+          ],
+          "rules": [
+            "suppressions match exact findingClass, path, and line",
+            "unused suppressions fail closed",
+            "suppression reason is report-visible caller text and is admitted through secret-like text rejection"
+          ]
+        },
         "nonClaim": "Secret scan does not discover repository files or replace provider secret scanning."
       },
       "outputContract": {
@@ -1355,6 +1429,10 @@
           "line",
           "path"
         ],
+        "suppressionFields": [
+          "suppressedFindings",
+          "unusedSuppressions"
+        ],
         "redactionRule": "matched secret-like values are never emitted to stdout reports",
         "nonClaim": "Findings are pattern detections, not credential validity proof."
       }
@@ -1428,7 +1506,11 @@
             "text_policy",
             "external_secret_scan"
           ],
-          "legacyAlias": "secretScan",
+          "relationRules": [
+            "proofkit_text_policy requires commandId text-policy and reason text_policy",
+            "proofkit_secret_scan requires commandId secret-scan and reason secret_scan",
+            "caller_owned_external requires reason external_secret_scan and must not use Proofkit-owned command ids text-policy or secret-scan"
+          ],
           "nonClaim": "Selective gate planning admits scan obligations but does not execute scanner commands or prove repository-wide credential absence."
         }
       }