@research-engineering/agentic-proofkit 0.1.156 → 0.1.157

package/docs/specs/proofkit-spec-proof-core/overview.md

@@ -92,8 +92,9 @@ execution receipts, and merge policy.
   and emits only bounded candidate requirements, bindings, or owner guidance.
 - `REQ-PROOFKIT-SPEC-018`: an authored command-family catalog covers every
   public CLI command exactly once, deterministically generates the private
-  runtime navigation projection, and adds opt-in family help without changing
-  root help, per-command help, or leaf dispatch.
+  runtime navigation projection, and adds opt-in family help while preserving
+  existing help invocation forms, process channels, no-input behavior, and leaf
+  dispatch; descriptor and help truth remains owned by `REQ-PROOFKIT-QUALITY-004`.
 
 ## Non-Claims
 

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -467,7 +467,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-018",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Command family navigation projects the complete public CLI command inventory from one authored family catalog into a deterministic private runtime projection, preserves existing root and per-command help and leaf dispatch, admits only opt-in family help forms, rejects missing, duplicated, oversized, unsorted, or reserved-operand-colliding families, and does not infer command selection, execute commands through family membership, or create a second command inventory owner.",
+      "invariant": "Command family navigation projects the complete public CLI command inventory from one authored family catalog into a deterministic private runtime projection, preserves root and per-command help invocation forms, stdout and stderr channel discipline, no-input behavior, and leaf dispatch, admits only opt-in family help forms, rejects missing, duplicated, oversized, unsorted, or reserved-operand-colliding families, and does not infer command selection, execute commands through family membership, or create a second command inventory owner.",
       "claimLevel": "blocking",
       "riskClass": "medium",
       "proofBindingRefs": [
@@ -477,7 +477,7 @@
         "NC-PROOFKIT-SPEC-018"
       ],
       "nonClaims": [
-        "This requirement does not claim command recommendation, command execution through family membership, consumer policy, native witness execution, merge approval, release approval, rollout approval, or production readiness."
+        "This requirement does not claim byte-for-byte help text compatibility across owner-approved CLI contract corrections, command recommendation, command execution through family membership, consumer policy, native witness execution, merge approval, release approval, rollout approval, or production readiness."
       ],
       "lifecycle": {
         "state": "active",

package/docs/specs/proofkit-supply-chain-quality/overview.md

@@ -81,6 +81,11 @@ vulnerability absence, or consumer rollout safety by itself.
   stderr discipline, generated-source hash, owner-source parity, and exact
   explicit-input counts despite an unlisted poison file in the consumer working
   directory.
+- `REQ-PROOFKIT-QUALITY-020`: package artifact execution starts from admitted
+  candidate-owned output roots, rejects ambient provider or unowned release
+  state before mutation, stays confined to the repository across symlinks,
+  binds non-empty generated content to stable source and execution-context
+  snapshots, and emits a schema-versioned execution record.
 
 ## Non-Claims
 

package/docs/specs/proofkit-supply-chain-quality/requirements.v1.json

@@ -255,6 +255,19 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-020",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Package artifact execution rejects ambient provider evidence and unowned release state before mutating candidate outputs, removes only candidate-owned package, wheel, and release outputs through a repository-confined filesystem root without following symlinks outside that root, invalidates prior execution evidence, executes the canonical package pipeline against stable source, environment, and toolchain snapshots, requires a non-empty content-bound artifact snapshot, and emits a schema-versioned execution record.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-020"],
+      "nonClaims": ["This requirement does not claim producer authentication, hermetic or reproducible builds, registry publication, provider evidence freshness, release approval, rollout approval, production readiness, or exact artifact closure outside downstream package and release validators."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ]
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.1.156",
+  "version": "0.1.157",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,

package/proofkit/requirement-bindings.json

@@ -562,6 +562,16 @@
         "This requirement does not claim registry publication, every command's runtime behavior, execution of non-native platform binaries, provider-side install freshness, consumer dependency admission, release approval, rollout approval, or production readiness."
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-020",
+      "ownerId": "proofkit.supply-chain-quality",
+      "specPath": "docs/specs/proofkit-supply-chain-quality/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": [
+        "This requirement does not claim producer authentication, hermetic or reproducible builds, registry publication, provider evidence freshness, release approval, rollout approval, production readiness, or exact artifact closure outside downstream package and release validators."
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-017",
       "ownerId": "proofkit.spec-proof-core",
@@ -579,7 +589,7 @@
       "claimLevel": "blocking",
       "proofState": "witness_backed",
       "nonClaims": [
-        "This requirement does not claim command recommendation, command execution through family membership, consumer policy, native witness execution, merge approval, release approval, rollout approval, or production readiness."
+        "This requirement does not claim byte-for-byte help text compatibility across owner-approved CLI contract corrections, command recommendation, command execution through family membership, consumer policy, native witness execution, merge approval, release approval, rollout approval, or production readiness."
       ]
     }
   ],
@@ -1575,6 +1585,36 @@
         "local-go"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-020",
+      "scenarioId": "proofkit.supply-chain-quality.package-artifact-clean-materialization",
+      "witnessId": "proofkit.package-artifact.clean-materialization-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/packageartifact/main_test.go",
+      "commandIds": [
+        "proofkit.go-test",
+        "proofkit.package-artifact"
+      ],
+      "environmentClasses": [
+        "local-go",
+        "local-go-python"
+      ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-020",
+      "scenarioId": "proofkit.supply-chain-quality.package-artifact-output-ownership-and-confinement",
+      "witnessId": "proofkit.package-artifact.output-ownership-and-confinement-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/packageartifactrecord/record_test.go",
+      "commandIds": [
+        "proofkit.go-test",
+        "proofkit.package-artifact"
+      ],
+      "environmentClasses": [
+        "local-go",
+        "local-go-python"
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-015",
       "scenarioId": "proofkit.supply-chain-quality.release-closeout-completion-criteria",
@@ -1918,6 +1958,19 @@
         "local-go"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-018",
+      "scenarioId": "proofkit.spec-proof-core.command-family-help-compatibility",
+      "witnessId": "proofkit.command-family-navigation.help-compatibility-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/command_family_catalog_test.go",
+      "commandIds": [
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-018",
       "scenarioId": "proofkit.spec-proof-core.command-family-navigation-parity",