@research-engineering/agentic-proofkit 0.1.155 → 0.1.157

package/docs/proofkit-contract-map.md

@@ -29,7 +29,13 @@ Scanner commands require caller-selected roots or scopes.
 No command may infer ambient repository truth from the current directory.
 ```
 
-## Families
+## Capability Routes
+
+Exact, non-overlapping CLI navigation membership is owned by
+`proofkit/command-families.v1.json` and exposed through `help families` and
+`help family <family-id>`. The table below is a cross-cutting capability map:
+commands may appear in more than one row because a workflow can cross several
+owner boundaries. It is not a second command-family inventory.
 
 | Family | Main commands | Caller provides | Proofkit owns | Consumer owns | Output authority |
 |---|---|---|---|---|---|
@@ -149,6 +155,25 @@ Decision tree:
 7. Treat candidate boundaries from imperfect repositories as advisory until the
    consuming repository commits stable requirement records and proof bindings.
 
+## Contract Classification
+
+Contract ceremony is determined by independent consumer-owned dimensions, not
+by an inferred universal tier:
+
+| Dimension | Cardinality | Typical values |
+|---|---|---|
+| `authorityClasses[]` | sorted set | `trust_boundary`, `public_contract`, `internal_behavior`, `derived_artifact` |
+| `stabilityClass` | exactly one | `durable`, `evolutionary`, `local`, `generated` |
+| `enforcementClass` | exactly one | `blocking`, `advisory`, `derived` |
+| `evidenceClasses[]` | sorted set | `dedicated_binding`, `shared_native_test`, `rendered_freshness` |
+
+Set-valued classes may coexist: a public API can also be a trust boundary, and
+a generated view can also be a public contract. Proofkit admits explicit facts
+and mechanics; it does not infer requirement meaning, a contract profile, or
+ceremony from prose, `riskClass`, `claimLevel`, or code layout. A future
+machine-readable classification field requires its own versioned caller-owned
+contract and producer-to-consumer round-trip proof.
+
 ## Omitted Surfaces
 
 This map intentionally omits exhaustive per-field schema documentation,

package/docs/specs/proofkit-spec-proof-core/overview.md

@@ -87,11 +87,14 @@ execution receipts, and merge policy.
 - `REQ-PROOFKIT-SPEC-016`: requirement source transition reports validate
   caller-provided previous and next source snapshots so lifecycle changes are
   monotonic, evidence-backed, package-boundary-stable, and repository-neutral.
-- `REQ-PROOFKIT-SPEC-017`: test evidence inventory discovery-draft reports
-  convert explicit caller-owned repository and test discovery facts into
-  candidate-only inventory guidance with strict nested test title admission,
-  source guidance, and non-claims that prevent draft guidance from becoming
-  semantic coverage.
+- `REQ-PROOFKIT-SPEC-017`: capability map admission validates caller-owned
+  pre-spec observations under explicit code-baseline or code-audit trust modes
+  and emits only bounded candidate requirements, bindings, or owner guidance.
+- `REQ-PROOFKIT-SPEC-018`: an authored command-family catalog covers every
+  public CLI command exactly once, deterministically generates the private
+  runtime navigation projection, and adds opt-in family help while preserving
+  existing help invocation forms, process channels, no-input behavior, and leaf
+  dispatch; descriptor and help truth remains owned by `REQ-PROOFKIT-QUALITY-004`.
 
 ## Non-Claims
 

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -463,6 +463,33 @@
         "requiresImpactDeclaration": true,
         "requiresProofBindingReview": true
       }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-018",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "Command family navigation projects the complete public CLI command inventory from one authored family catalog into a deterministic private runtime projection, preserves root and per-command help invocation forms, stdout and stderr channel discipline, no-input behavior, and leaf dispatch, admits only opt-in family help forms, rejects missing, duplicated, oversized, unsorted, or reserved-operand-colliding families, and does not infer command selection, execute commands through family membership, or create a second command inventory owner.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": [
+        "proofkit/requirement-bindings.json"
+      ],
+      "nonClaimRefs": [
+        "NC-PROOFKIT-SPEC-018"
+      ],
+      "nonClaims": [
+        "This requirement does not claim byte-for-byte help text compatibility across owner-approved CLI contract corrections, command recommendation, command execution through family membership, consumer policy, native witness execution, merge approval, release approval, rollout approval, or production readiness."
+      ],
+      "lifecycle": {
+        "state": "active",
+        "replacementRequirementIds": [],
+        "evidenceRefs": []
+      },
+      "deferral": null,
+      "updatePolicy": {
+        "reviewOwnerId": "proofkit.spec-proof-core",
+        "requiresImpactDeclaration": true,
+        "requiresProofBindingReview": true
+      }
     }
   ],
   "nonClaims": [
@@ -470,6 +497,7 @@
     "Proofkit spec-proof core requirements describe reusable infrastructure primitives only.",
     "Proofkit spec-proof core requirements do not approve document deletion or infer document meaning from Markdown prose.",
     "Proofkit spec-proof core requirements do not discover source diffs or approve requirement deletion.",
+    "Proofkit spec-proof core requirements do not infer command selection from command family membership.",
     "Proofkit spec-proof core requirements do not make capability-map seeds stable requirement truth.",
     "Proofkit spec-proof core requirements do not prove overview-claim extractor completeness."
   ]

package/docs/specs/proofkit-supply-chain-quality/overview.md

@@ -39,17 +39,11 @@ vulnerability absence, or consumer rollout safety by itself.
   paths expose benchmark entrypoints without making wall-clock budgets a
   required PR gate before stable baselines exist.
 - `REQ-PROOFKIT-QUALITY-010`: coverage metrics report requirement, binding,
-  witness, CLI inventory linkage, and descriptor-owned command semantic-route
-  coverage from admitted test-evidence-inventory rows, failing closed on
-  explicit requirement/proof linkage dead zones, failed command-route
-  inventory admission, command semantic routes without owner-declared proof
-  identities, route-index-derived semantic proof identities, direct app
-  semantic routes outside the command-scoped app test, package-level semantic
-  routes outside the descriptor-owned command package, semantic command routes
-  whose parsed Go test body lacks the source-owned executable oracle marker for
-  the exact emitted command route fact, and missing matching semantic command
-  evidence without claiming line coverage or exhaustive test semantic
-  completeness.
+  witness, CLI inventory linkage, and descriptor-owned command proof-route
+  candidates from admitted test-evidence-inventory rows. The gate fails closed
+  on linkage dead zones, failed inventory admission, missing candidates,
+  unknown command refs, contract-only commands, or route-only commands. Static
+  route metadata and source syntax never become semantic falsifier evidence.
 - `REQ-PROOFKIT-QUALITY-011`: CI separates the OS-independent full
   source/package gate from macOS platform smoke, uses explicit hosted runner
   labels instead of floating latest labels, and exposes one fail-closed
@@ -87,6 +81,11 @@ vulnerability absence, or consumer rollout safety by itself.
   stderr discipline, generated-source hash, owner-source parity, and exact
   explicit-input counts despite an unlisted poison file in the consumer working
   directory.
+- `REQ-PROOFKIT-QUALITY-020`: package artifact execution starts from admitted
+  candidate-owned output roots, rejects ambient provider or unowned release
+  state before mutation, stays confined to the repository across symlinks,
+  binds non-empty generated content to stable source and execution-context
+  snapshots, and emits a schema-versioned execution record.
 
 ## Non-Claims
 

package/docs/specs/proofkit-supply-chain-quality/requirements.v1.json

@@ -129,12 +129,12 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-010",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "Coverage metrics report requirement, binding, witness, CLI inventory linkage, and descriptor-owned command semantic-route coverage from admitted test-evidence-inventory rows, failing closed on explicit requirement/proof linkage dead zones, failed command-route inventory admission, command semantic routes without owner-declared proof identities, route-index-derived semantic proof identities, direct app semantic routes outside the command-scoped app test, package-level semantic routes outside the descriptor-owned command package, semantic command routes whose parsed Go test body lacks the source-owned executable oracle marker for the exact emitted command ref, selector, source path, falsifier ids, oracle id, and expected public outcome, or missing matching semantic command evidence without claiming line coverage or exhaustive test semantic completeness.",
+      "invariant": "Coverage metrics report requirement, binding, witness, CLI inventory linkage, and descriptor-owned command proof-route candidates from admitted test-evidence-inventory rows, failing closed on explicit requirement/proof linkage dead zones, failed command-route inventory admission, missing candidate routes, unknown command refs, contract-only commands, or route-only commands; static route metadata, prose, source markers, test existence, and failure-capable syntax remain candidate evidence and cannot satisfy semantic_falsifier coverage.",
       "claimLevel": "blocking",
       "riskClass": "medium",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
       "nonClaimRefs": ["NC-PROOFKIT-QUALITY-010"],
-      "nonClaims": ["This requirement does not claim line coverage, dead-code absence, exhaustive semantic completeness for every test, native witness execution, receipt freshness, or merge satisfaction."],
+      "nonClaims": ["This requirement does not claim semantic command coverage, line coverage, dead-code absence, exhaustive semantic completeness for any test, native witness execution, receipt freshness, or merge satisfaction."],
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
@@ -255,6 +255,19 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-020",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Package artifact execution rejects ambient provider evidence and unowned release state before mutating candidate outputs, removes only candidate-owned package, wheel, and release outputs through a repository-confined filesystem root without following symlinks outside that root, invalidates prior execution evidence, executes the canonical package pipeline against stable source, environment, and toolchain snapshots, requires a non-empty content-bound artifact snapshot, and emits a schema-versioned execution record.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-020"],
+      "nonClaims": ["This requirement does not claim producer authentication, hermetic or reproducible builds, registry publication, provider evidence freshness, release approval, rollout approval, production readiness, or exact artifact closure outside downstream package and release validators."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ]
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.1.155",
+  "version": "0.1.157",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,
@@ -36,7 +36,8 @@
   ],
   "scripts": {
     "build": "go run ./internal/tools/packagebuild",
-    "check": "npm run npm:version && npm run source-hygiene && npm run text-policy && npm run mermaid:check && npm run go:check && npm run package:artifact && npm run self:receipt && npm run self:coverage && npm run release:closeout",
+    "check": "npm run npm:version && npm run source-hygiene && npm run command-family:check && npm run text-policy && npm run mermaid:check && npm run go:check && npm run package:artifact && npm run self:receipt && npm run self:coverage && npm run release:closeout",
+    "command-family:check": "go run ./internal/tools/commandfamilygen --check",
     "go:actionlint": "go tool actionlint",
     "go:bench": "go test ./internal/kernel/admission ./internal/kernel/stablejson -run '^$' -bench . -benchmem -count=10",
     "go:check": "npm run go:fmt && npm run go:test && npm run go:vet && npm run go:staticcheck && npm run go:actionlint && npm run go:vulncheck",
@@ -44,7 +45,8 @@
     "go:test": "go test ./...",
     "go:vet": "go vet ./...",
     "npm:version": "node -e \"const {execFileSync}=require('node:child_process'); const expected=require('./package.json').packageManager.split('@').at(-1); const actual=execFileSync('npm',['--version'],{encoding:'utf8'}).trim(); if(actual!==expected){throw new Error('expected npm '+expected+', got '+actual)}\"",
-    "package:artifact": "npm run build && go run ./internal/tools/packagepack && go run ./internal/tools/packageverify && npm run python:package && npm run python:verify && npm run release:manifest",
+    "package:artifact": "go run ./internal/tools/packageartifact",
+    "package:artifact:steps": "npm run build && go run ./internal/tools/packagepack && go run ./internal/tools/packageverify && npm run python:package && npm run python:verify && npm run release:manifest",
     "platform:smoke": "go run ./internal/tools/packagebuild current && ./dist/agentic-proofkit --help >/dev/null && go run ./internal/tools/pythonpackage build-current && go run ./internal/tools/pythonpackage verify-current",
     "python:package": "go run ./internal/tools/pythonpackage build",
     "python:verify": "go run ./internal/tools/pythonpackage verify",

package/proofkit/cli-contract.v1.json

@@ -6,7 +6,14 @@
     "successExitCode": 0,
     "failureExitCode": 1,
     "stdout": "Successful JSON commands write exactly one JSON value to stdout unless an admitted explicit output-file flag writes that JSON value to the selected path and leaves stdout empty. Successful text or help commands write text to stdout unless an admitted explicit output-file flag writes the selected representation to the selected path and leaves stdout empty. Commands do not write stderr on success.",
-    "stderr": "Argument parsing, unsupported command, input admission, and output serialization failures write human diagnostics to stderr. Failed report commands may still write a machine-readable failed report to stdout when admission succeeds. Opt-in agent-envelope repair packets may write deterministic invalid-input JSON to stdout with exit code 1 and empty stderr."
+    "stderr": "Argument parsing, unsupported command, input admission, and output serialization failures write human diagnostics to stderr. Failed report commands may still write a machine-readable failed report to stdout when admission succeeds. Opt-in agent-envelope repair packets may write deterministic invalid-input JSON to stdout with exit code 1 and empty stderr.",
+    "helpGrammar": {
+      "rootHelpFlags": ["--help", "-h"],
+      "commandHelpFlags": ["--help", "-h"],
+      "helpCommandPositionalTarget": "optional_supported_command",
+      "helpCatalogFormsSource": "proofkit/command-families.v1.json",
+      "helpReadsCommandInput": false
+    }
   },
   "commands": [
     {
@@ -42,6 +49,9 @@
         "--mode",
         "--pilot",
         "--touched-rule-id"
+      ],
+      "requiredFlags": [
+        "--mode"
       ]
     },
     {
@@ -108,6 +118,7 @@
                   "binding_witness_plan_input",
                   "capability_map",
                   "changed_path_set",
+                  "compact_proof_binding",
                   "coverage_compose_input",
                   "coverage_view_input",
                   "deployment_evidence_input",
@@ -329,6 +340,22 @@
         "--list",
         "--profile",
         "--verify"
+      ],
+      "exactlyOneOfFlagGroups": [
+        [
+          "--list",
+          "--profile",
+          "--verify"
+        ]
+      ],
+      "flagValueRequirements": [
+        {
+          "flag": "--format",
+          "requiredFlags": [
+            "--profile"
+          ],
+          "value": "markdown"
+        }
       ]
     },
     {
@@ -535,6 +562,9 @@
         "--format",
         "--language"
       ],
+      "requiredFlags": [
+        "--language"
+      ],
       "outputContract": {
         "contractId": "proofkit.json-report-cli-adapter-source.output.v1",
         "schemaVersion": 1,
@@ -945,6 +975,9 @@
         "--scope",
         "--serve",
         "--view"
+      ],
+      "requiredFlags": [
+        "--view"
       ]
     },
     {
@@ -1145,6 +1178,12 @@
         "--input",
         "--input-pointer",
         "--local-environment-class"
+      ],
+      "exactlyOneOfFlagGroups": [
+        [
+          "--empty-local-environment-policy",
+          "--local-environment-class"
+        ]
       ]
     },
     {
@@ -1290,6 +1329,11 @@
       "stdin": true,
       "inputPointer": true,
       "scopeClass": "explicit_caller_input",
+      "inputContract": {
+        "schemaVersion": 2,
+        "requiredFields": ["schemaVersion", "treeId", "rootNodeId", "callerAnnotations", "nodes", "edges", "overlays"],
+        "callerTextAuthority": "callerAnnotations fields are untrusted presentation annotations and never command-owned nonClaims"
+      },
       "outputModes": [
         "json"
       ],
@@ -1304,6 +1348,11 @@
       "stdin": true,
       "inputPointer": true,
       "scopeClass": "explicit_caller_input",
+      "inputContract": {
+        "schemaVersion": 2,
+        "requiredFields": ["schemaVersion", "treeId", "rootNodeId", "callerAnnotations", "nodes", "edges", "overlays"],
+        "callerTextAuthority": "callerAnnotations fields are untrusted presentation annotations and never command-owned nonClaims"
+      },
       "outputModes": [
         "html",
         "json",
@@ -1316,9 +1365,10 @@
         "--output"
       ],
       "outputContract": {
-        "contractId": "proofkit.requirement-spec-tree-view.output.v1",
-        "schemaVersion": 1,
+        "contractId": "proofkit.requirement-spec-tree-view.output.v2",
+        "schemaVersion": 2,
         "authority": "requirement spec tree view output contract",
+        "nonJsonFormats": ["html", "markdown"],
         "requiredFields": [
           "authority",
           "nodeCount",
@@ -1567,6 +1617,9 @@
       ],
       "allowedFlags": [
         "--preset"
+      ],
+      "requiredFlags": [
+        "--preset"
       ]
     },
     {
@@ -1666,7 +1719,11 @@
                 "value": 1
               }
             },
-            "nonClaim": "This projection input does not make Proofkit the owner of requirement meaning, native test execution, repository scanning, proof freshness, or merge policy."
+            "candidateOutput": {
+              "evidenceClass": "proof_route_candidate",
+              "semanticCoverage": "not_satisfied_until_owner_materialized"
+            },
+            "nonClaim": "This projection input does not make Proofkit the owner of requirement meaning, native test execution, semantic coverage, repository scanning, proof freshness, or merge policy."
           },
           "strict-inventory": {
             "authority": "caller-owned strict test inventory admission",
@@ -1678,6 +1735,7 @@
         "nonClaims": [
           "Projection modes are closed vocabulary: proof-binding-derived or discovery-draft.",
           "Discovery draft candidate output must be materialized into strict inventory before it can affect coverage.",
+          "Proof-binding-derived routes remain proof_route_candidate entries until a consumer owner materializes an executable semantic oracle.",
           "The derived inventory remains caller-owned input for downstream coverage views."
         ]
       },
@@ -1718,6 +1776,7 @@
           "missing_semantic_anchor",
           "mock_tests_mock",
           "over_broad_integration",
+          "proof_route_candidate",
           "routing_smoke_only",
           "selector_fragility",
           "snapshot_without_oracle",
@@ -1774,6 +1833,9 @@
         "--input",
         "--input-pointer",
         "--repo-root"
+      ],
+      "requiredFlags": [
+        "--repo-root"
       ]
     },
     {

package/proofkit/command-families.v1.json

@@ -0,0 +1,205 @@
+{
+  "schemaVersion": 1,
+  "catalogId": "proofkit.command-families.v1",
+  "families": [
+    {
+      "familyId": "adoption-lifecycle",
+      "label": "Adoption lifecycle",
+      "purpose": "Select and assess repository adoption stages.",
+      "commands": [
+        "adoption-checklist",
+        "adoption-doctor",
+        "adoption-workflow-plan",
+        "gradual-adoption",
+        "gradual-adoption-bootstrap",
+        "gradual-adoption-guidance",
+        "init",
+        "pilot-admission"
+      ]
+    },
+    {
+      "familyId": "cli-metadata-and-conformance",
+      "label": "CLI metadata and conformance",
+      "purpose": "Expose, route, generate, and self-check CLI contract surfaces.",
+      "commands": [
+        "agent-route",
+        "conformance-profile",
+        "help",
+        "json-report-cli-adapter-source",
+        "self-check"
+      ]
+    },
+    {
+      "familyId": "deployment-and-readiness",
+      "label": "Deployment and readiness",
+      "purpose": "Admit deployment evidence and bounded closeout decisions.",
+      "commands": [
+        "branch-authority",
+        "completion-criteria",
+        "deployment-evidence-admission",
+        "readiness-closeout"
+      ]
+    },
+    {
+      "familyId": "migration-and-retirement",
+      "label": "Migration and retirement",
+      "purpose": "Prove parity and plan retirement of consumer-local infrastructure.",
+      "commands": [
+        "migration-parity-admission",
+        "migration-plan"
+      ]
+    },
+    {
+      "familyId": "proof-artifact-governance",
+      "label": "Proof artifact governance",
+      "purpose": "Govern custom rules, document lifecycle, freshness, and witness plans.",
+      "commands": [
+        "custom-rule-boundary",
+        "document-lifecycle-boundary",
+        "rendered-artifact-freshness",
+        "witness-plan",
+        "witness-scheduler-plan"
+      ]
+    },
+    {
+      "familyId": "proof-binding-topology",
+      "label": "Proof binding topology",
+      "purpose": "Admit, resolve, partition, and inspect requirement proof topology.",
+      "commands": [
+        "binding-partition",
+        "evidence-graph",
+        "proof-slice",
+        "requirement-bindings",
+        "requirement-proof-resolver",
+        "requirement-proof-source-set",
+        "spec-proof-bundle-admission"
+      ]
+    },
+    {
+      "familyId": "receipt-authority",
+      "label": "Receipt authority",
+      "purpose": "Admit receipts, producer compatibility, currentness, and trust classes.",
+      "commands": [
+        "producer-policy-self-proof",
+        "proof-receipt-admission",
+        "receipt-currentness-scope",
+        "receipt-producer-admission",
+        "receipt-trust-class"
+      ]
+    },
+    {
+      "familyId": "release-artifact-consumption",
+      "label": "Release artifact consumption",
+      "purpose": "Check package release facts and external or registry consumption.",
+      "commands": [
+        "external-consumer",
+        "registry-consumer",
+        "registry-consumer-proof-input-compose",
+        "release-authority"
+      ]
+    },
+    {
+      "familyId": "repository-facts-and-scanning",
+      "label": "Repository facts and scanning",
+      "purpose": "Admit explicit repository facts and bounded policy scans.",
+      "commands": [
+        "repo-profile-admission",
+        "secret-scan",
+        "text-policy",
+        "typescript-public-api-surfaces",
+        "workspace-manifest-facts"
+      ]
+    },
+    {
+      "familyId": "requirement-navigation-and-rendering",
+      "label": "Requirement navigation and rendering",
+      "purpose": "Build and present requirement, proof, and coverage views.",
+      "commands": [
+        "requirement-browser-server",
+        "requirement-coverage-view",
+        "requirement-proof-view",
+        "requirement-source-view",
+        "requirement-spec-tree",
+        "requirement-spec-tree-view"
+      ]
+    },
+    {
+      "familyId": "requirement-source-lifecycle",
+      "label": "Requirement source lifecycle",
+      "purpose": "Author, admit, transition, and check requirement source claims.",
+      "commands": [
+        "requirement-authoring-plan",
+        "requirement-source-admission",
+        "requirement-source-transition",
+        "spec-overview-claims"
+      ]
+    },
+    {
+      "familyId": "scaffolding-and-capability-capture",
+      "label": "Scaffolding and capability capture",
+      "purpose": "Produce candidate adoption structures and capability seeds.",
+      "commands": [
+        "adoption-contract-envelope",
+        "capability-map-admission",
+        "scaffold-profile-plan",
+        "scaffold-project-structure",
+        "stack-preset"
+      ]
+    },
+    {
+      "familyId": "selective-evidence-and-obligations",
+      "label": "Selective evidence and obligations",
+      "purpose": "Admit selective evidence and decide proof obligations.",
+      "commands": [
+        "obligation-decision",
+        "proof-obligation-algebra",
+        "selective-gate-evidence",
+        "selective-gate-obligation-decision-input"
+      ]
+    },
+    {
+      "familyId": "selective-impact-planning",
+      "label": "Selective impact planning",
+      "purpose": "Convert explicit change facts into bounded verification plans.",
+      "commands": [
+        "changed-path-set",
+        "impact",
+        "requirement-impact-input-compose",
+        "selective-gate-plan"
+      ]
+    },
+    {
+      "familyId": "test-evidence-and-coverage-input",
+      "label": "Test evidence and coverage input",
+      "purpose": "Admit test evidence and compose coverage inputs.",
+      "commands": [
+        "requirement-coverage-input-compose",
+        "test-evidence-inventory"
+      ]
+    },
+    {
+      "familyId": "workspace-topology-and-package-policy",
+      "label": "Workspace topology and package policy",
+      "purpose": "Model workspace topology, shards, and package runtime policy.",
+      "commands": [
+        "package-runtime-dependency-admission",
+        "workspace-changed-package-plan",
+        "workspace-registry",
+        "workspace-shard-partition"
+      ]
+    }
+  ],
+  "helpForms": [
+    "help families",
+    "help family <family-id>"
+  ],
+  "reservedHelpOperands": [
+    "families",
+    "family"
+  ],
+  "nonClaims": [
+    "Command families do not change leaf command dispatch or execution authority.",
+    "Command families do not infer which command a caller should execute.",
+    "Command families group the public command inventory for navigation only."
+  ]
+}

package/proofkit/receipt-producer-policy.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "policyId": "proofkit.receipt-producer-policy",
   "receiptKinds": [
-    "proofkit.package-gate"
+    "proofkit.package-artifact"
   ],
   "environmentClasses": [
     "local-go-python"
@@ -13,7 +13,7 @@
       "owner": "proofkit.package-boundary",
       "admissionLevel": "advisory",
       "receiptKinds": [
-        "proofkit.package-gate"
+        "proofkit.package-artifact"
       ],
       "environmentClasses": [
         "local-go-python"
@@ -28,7 +28,7 @@
       "owner": "proofkit.package-boundary",
       "admissionLevel": "advisory",
       "receiptKinds": [
-        "proofkit.package-gate"
+        "proofkit.package-artifact"
       ],
       "environmentClasses": [
         "local-go-python"

package/proofkit/requirement-bindings.json

@@ -469,7 +469,7 @@
       "claimLevel": "blocking",
       "proofState": "witness_backed",
       "nonClaims": [
-        "This requirement does not claim line coverage, dead-code absence, exhaustive semantic completeness for every test, native witness execution, receipt freshness, or merge satisfaction."
+        "This requirement does not claim semantic command coverage, line coverage, dead-code absence, exhaustive semantic completeness for any test, native witness execution, receipt freshness, or merge satisfaction."
       ]
     },
     {
@@ -562,6 +562,16 @@
         "This requirement does not claim registry publication, every command's runtime behavior, execution of non-native platform binaries, provider-side install freshness, consumer dependency admission, release approval, rollout approval, or production readiness."
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-020",
+      "ownerId": "proofkit.supply-chain-quality",
+      "specPath": "docs/specs/proofkit-supply-chain-quality/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": [
+        "This requirement does not claim producer authentication, hermetic or reproducible builds, registry publication, provider evidence freshness, release approval, rollout approval, production readiness, or exact artifact closure outside downstream package and release validators."
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-017",
       "ownerId": "proofkit.spec-proof-core",
@@ -571,6 +581,16 @@
       "nonClaims": [
         "This requirement does not claim repository scanning, code correctness, extraction completeness, final requirement meaning, proof-binding adequacy, native witness execution, proof freshness, merge approval, release approval, rollout approval, or production readiness."
       ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-018",
+      "ownerId": "proofkit.spec-proof-core",
+      "specPath": "docs/specs/proofkit-spec-proof-core/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": [
+        "This requirement does not claim byte-for-byte help text compatibility across owner-approved CLI contract corrections, command recommendation, command execution through family membership, consumer policy, native witness execution, merge approval, release approval, rollout approval, or production readiness."
+      ]
     }
   ],
   "bindings": [
@@ -585,7 +605,8 @@
         "proofkit.package-artifact"
       ],
       "environmentClasses": [
-        "local-go"
+        "local-go",
+        "local-go-python"
       ]
     },
     {
@@ -599,7 +620,8 @@
         "proofkit.package-artifact"
       ],
       "environmentClasses": [
-        "local-go"
+        "local-go",
+        "local-go-python"
       ]
     },
     {
@@ -690,7 +712,7 @@
         "proofkit.package-artifact"
       ],
       "environmentClasses": [
-        "local-go"
+        "local-go-python"
       ]
     },
     {
@@ -1563,6 +1585,36 @@
         "local-go"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-020",
+      "scenarioId": "proofkit.supply-chain-quality.package-artifact-clean-materialization",
+      "witnessId": "proofkit.package-artifact.clean-materialization-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/packageartifact/main_test.go",
+      "commandIds": [
+        "proofkit.go-test",
+        "proofkit.package-artifact"
+      ],
+      "environmentClasses": [
+        "local-go",
+        "local-go-python"
+      ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-020",
+      "scenarioId": "proofkit.supply-chain-quality.package-artifact-output-ownership-and-confinement",
+      "witnessId": "proofkit.package-artifact.output-ownership-and-confinement-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/packageartifactrecord/record_test.go",
+      "commandIds": [
+        "proofkit.go-test",
+        "proofkit.package-artifact"
+      ],
+      "environmentClasses": [
+        "local-go",
+        "local-go-python"
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-015",
       "scenarioId": "proofkit.supply-chain-quality.release-closeout-completion-criteria",
@@ -1602,7 +1654,8 @@
         "proofkit.package-artifact"
       ],
       "environmentClasses": [
-        "local-go"
+        "local-go",
+        "local-go-python"
       ]
     },
     {
@@ -1616,7 +1669,8 @@
         "proofkit.package-artifact"
       ],
       "environmentClasses": [
-        "local-go"
+        "local-go",
+        "local-go-python"
       ]
     },
     {
@@ -1751,7 +1805,8 @@
         "proofkit.package-artifact"
       ],
       "environmentClasses": [
-        "local-go"
+        "local-go",
+        "local-go-python"
       ]
     },
     {
@@ -1793,7 +1848,8 @@
         "proofkit.package-artifact"
       ],
       "environmentClasses": [
-        "local-go"
+        "local-go",
+        "local-go-python"
       ]
     },
     {
@@ -1820,7 +1876,8 @@
         "proofkit.package-artifact"
       ],
       "environmentClasses": [
-        "local-go"
+        "local-go",
+        "local-go-python"
       ]
     },
     {
@@ -1900,6 +1957,32 @@
       "environmentClasses": [
         "local-go"
       ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-018",
+      "scenarioId": "proofkit.spec-proof-core.command-family-help-compatibility",
+      "witnessId": "proofkit.command-family-navigation.help-compatibility-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/command_family_catalog_test.go",
+      "commandIds": [
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-018",
+      "scenarioId": "proofkit.spec-proof-core.command-family-navigation-parity",
+      "witnessId": "proofkit.command-family-navigation.parity-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/commandfamilygen/main_test.go",
+      "commandIds": [
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
     }
   ],
   "witnessCommands": [
@@ -1936,7 +2019,7 @@
     {
       "commandId": "proofkit.package-artifact",
       "command": "npm run package:artifact",
-      "environmentClass": "local-go"
+      "environmentClass": "local-go-python"
     },
     {
       "commandId": "proofkit.package-gate",

package/proofkit/witness-plan.json

@@ -257,7 +257,7 @@
         "inherit": "none",
         "allowlist": [],
         "classes": [
-          "local-go"
+          "local-go-python"
         ]
       },
       "timeoutMs": 600000,
@@ -275,6 +275,11 @@
           "path": "artifacts/package/*.tgz",
           "required": true
         },
+        {
+          "kind": "report",
+          "path": "artifacts/proofkit/package-artifact-execution.json",
+          "required": true
+        },
         {
           "kind": "python-wheel-artifact",
           "path": "artifacts/pypi/*.whl",