@research-engineering/agentic-proofkit 0.1.158 → 0.1.160

package/CONTRIBUTING.md

@@ -25,10 +25,16 @@ admission, and rollout approval belong in consuming repositories.
 Run before proposing a non-trivial change:
 
 ```bash
+npm ci --ignore-scripts
+npx playwright install chromium firefox webkit
 npm run check
 git diff --check
 ```
 
+The browser engine installation is a one-time prerequisite for the pinned
+rendered-runtime gate. CI installs the same engines with their Linux system
+dependencies before running that gate.
+
 If your local project uses Bun, `bun run check` is acceptable as a convenience
 runner only when it invokes the same scripts and leaves `npm run check`
 equivalent. Release and package-authority proof remains npm-owned.

package/README.md

@@ -42,6 +42,8 @@ Python consumers use the Python package as a runner wrapper over the same Go
 CLI, not as a Python SDK. Python projects should still treat CLI/JSON records,
 exit codes, and package metadata as the public contract.
 
+Published Darwin binary distributions require macOS 12.0 or later.
+
 ## Project Boundary
 
 `agentic-proofkit` is intended to provide reusable proof-workflow mechanics for
@@ -154,7 +156,7 @@ agentic-proofkit repo-profile-admission --help
 
 Command-specific help is derived from the private command descriptor table and
 does not read stdin. The full machine-readable command inventory remains
-`proofkit/cli-contract.v1.json`; the human route map is
+`proofkit/cli-contract.v2.json`; the human route map is
 `docs/proofkit-contract-map.md`.
 
 | Repository state | Minimal first route | Stop condition |
@@ -165,6 +167,16 @@ does not read stdin. The full machine-readable command inventory remains
 | Current code must be audited before it becomes a contract | `capability-map-admission` with `trustMode: "audit_from_code"` | Stop at owner questions and candidate-only records |
 | Legacy repository has local proof infrastructure | `migration-parity-admission`, then `migration-plan` | Stop before deleting local proof owners without parity evidence |
 | A change set needs bounded checks | `changed-path-set`, optional `impact`, then `selective-gate-plan` and `selective-gate-evidence` | Stop on unknown scope, missing routes, or stale receipts |
+| An agent needs only one specification subtree | `requirement-context-compose --repo-root . --input context-catalog.json`, then `requirement-context-slice` | Stop before treating a bounded slice as complete repository truth |
+| A human needs semantic navigation, comparison, or traceability | `requirement-browser-server --view workspace --serve` over an admitted workspace input | Browser output, annotations, diff, and graph remain derived and non-authoritative |
+
+JSON commands default to readable output. Agents can request the same JSON
+value with lower transport overhead by placing the process option before the
+command:
+
+```bash
+agentic-proofkit --json-layout compact requirement-context-slice --input slice-input.json
+```
 
 Use `secret-scan` only when the caller provides an explicit file inventory with
 content. It is a dedicated secret-like text detector for admitted inventory

package/docs/proofkit-contract-map.md

@@ -9,7 +9,7 @@ Owner: `proofkit`.
 This map helps consuming repositories choose the smallest Proofkit CLI command
 or JSON contract without loading the full README or source tree. It is not an
 exhaustive schema reference. The canonical command inventory is
-`proofkit/cli-contract.v1.json`.
+`proofkit/cli-contract.v2.json`.
 
 Formal rule:
 
@@ -92,7 +92,7 @@ returns deterministic JSON from explicit caller-owned facts; the envelope is an
 opt-in derived projection over the same report. This map explains the route
 families without becoming an execution, freshness, or merge decision.
 The exact route input vocabulary is machine-readable in
-`proofkit/cli-contract.v1.json` under `agent-route.inputContract`; the Go
+`proofkit/cli-contract.v2.json` under `agent-route.inputContract`; the Go
 admission implementation and shipped CLI contract are parity-tested.
 
 Formal rule:
@@ -107,6 +107,10 @@ goal plus caller-owned state
 
 Decision tree:
 
+Semantic context routes are `requirement-context-compose`,
+`requirement-context-slice`, `requirement-semantic-diff`, and
+`requirement-traceability-graph`.
+
 | State or goal | Next Proofkit route | Stop or escalation condition |
 |---|---|---|
 | The agent does not know where to start. | `init` or `init --preset fresh|code-baseline|code-audit|legacy|change-set` | Treat output as dry-run route guidance only. Stop before scanning, writing files, or making requirements authoritative. |
@@ -116,14 +120,15 @@ Decision tree:
 | Temporary external design, implementation-plan, PR, code, or test observations may contain durable requirements. | `requirement-authoring-plan` | Treat output as candidate-only; stop before writing `requirements.v1.json`, retaining temporary documents, or claiming requirement meaning. |
 | Requirement records exist. | `requirement-source-admission`; use `requirement-source-transition` for lifecycle changes. | Escalate when blocking requirements lack proof routes or lifecycle replacement ids are incomplete. |
 | Humans or agents need meta/module/submodule navigation. | `requirement-spec-tree`, then `requirement-spec-tree-view` or `requirement-browser-server --view spec-tree` from the same caller-owned tree input. | Stop before inferring hierarchy from paths. The consumer owns source hierarchy; CLI/browser outputs remain presentation only and are not committed by default. |
+| An agent needs a bounded semantic subset instead of whole specification files. | `requirement-context-compose --repo-root <caller-selected-root>` over an explicit catalog, then `requirement-context-slice` over the materialized snapshot. | The snapshot and slice are content-bound derived projections. Stop before inferring hierarchy, scanning ambient paths, treating omissions as absence, or promoting the slice to requirement, proof, freshness, or merge authority. |
 | Overview prose may contain durable claims. | `spec-overview-claims` | Escalate when normative claims are not tied to `REQ-*` records. |
 | Requirements have no verified proof route. | `requirement-bindings`, `witness-plan` from either an explicit `witness_command_catalog` or a complete `binding_witness_plan_input`, `proof-slice`, or `requirement-proof-resolver` | Stop before claiming proof adequacy; native witness semantics stay with the consumer. A binding-derived witness plan still needs caller-owned vocabulary and conservative command policy. |
 | Tests or proof evidence need inventory. | `test-evidence-inventory`; use `--projection discovery-draft` only for explicit discovered-test facts, then `requirement-coverage-input-compose` when an aggregate `coverage_compose_input` exists, then `requirement-coverage-view` when a `coverage_view_input` exists | Compose only from explicit caller-owned facts. Discovery drafts are candidate-only and cannot close coverage. Use `failureClassifications[]`, `warningClassifications[]`, and `agentActionPlan[]` for machine routing. Escalate when tests are route-only, weak-oracle, unbound, or outside the caller-owned coverage universe. |
 | A change set is known. | `changed-path-set`, optionally `requirement-impact-input-compose`, `impact`, then `selective-gate-plan --agent-envelope` | Raw `knownChangedPaths` in `agent-route` are diagnostic only. Materialize a caller-owned `changed_path_set`, compose a caller-owned `impact_input` before `impact`, and compose a caller-owned `selective_gate_plan_input` before `selective-gate-plan`. Use `scanObligation` to name whether a `text-policy`, `secret-scan`, or caller-owned external scanner is required. Fail closed on unknown scope, dynamic edges, missing owner routes, unbound proof-like paths, or full-gate escalation. |
 | Caller-owned file contents need secret-like text detection. | `secret-scan` | Provide explicit sorted file inventory with content. Stop before claiming repository-wide discovery, credential validity, provider ingestion, merge readiness, or replacement of GitHub secret scanning. |
-| Does a TypeScript package public API match a caller-owned manifest? | `agent-route` with `goal: "verify_typescript_public_api"` and explicit `typescript_public_api_manifest` plus `typescript_public_api_repo_root`, then `typescript-public-api-surfaces --repo-root <caller-selected-root>` | The manifest must name each referenced `package.json`, sorted-unique export conditions, and a non-JSX `.ts`, `.mts`, or `.cts` `sourcePath` whose canonical target has the same admitted extension class. The bounded scanner accepts only the fail-closed export grammar in `proofkit/cli-contract.v1.json`; it does not parse unrestricted TypeScript or TSX, infer conventional layouts, or prove compiler output provenance, checkout freshness, package-manager truth, or merge readiness. |
+| Does a TypeScript package public API match a caller-owned manifest? | `agent-route` with `goal: "verify_typescript_public_api"` and explicit `typescript_public_api_manifest` plus `typescript_public_api_repo_root`, then `typescript-public-api-surfaces --repo-root <caller-selected-root>` | The manifest must name each referenced `package.json`, sorted-unique export conditions, and a non-JSX `.ts`, `.mts`, or `.cts` `sourcePath` whose canonical target has the same admitted extension class. The bounded scanner accepts only the fail-closed export grammar in `proofkit/cli-contract.v2.json`; it does not parse unrestricted TypeScript or TSX, infer conventional layouts, or prove compiler output provenance, checkout freshness, package-manager truth, or merge readiness. |
 | Receipts are available for planned checks. | `selective-gate-evidence --agent-envelope`; then materialize a caller-owned `obligation_decision_input` from the evidence output plus command routes, currentness, and trust facts; then run `selective-gate-obligation-decision-input`; then materialize the resulting `obligation_decision` input and run `obligation-decision --agent-envelope` | Escalate on missing, stale, invalid, untrusted, blocked, unavailable, or unknown-scope evidence. |
-| Human inspection is needed. | `requirement-source-view`, `requirement-proof-view`, `requirement-coverage-view`, `requirement-spec-tree-view`, or `requirement-browser-server` | `agent-route` emits browser commands as plan-only by default. Use `browserMode: "serve_local_view"` for `--serve` and `openBrowser: true` for `--open`. Rendered HTML and Markdown are presentation only unless the consumer admits a tracked artifact freshness gate. |
+| Human inspection, semantic comparison, or traceability navigation is needed. | `requirement-source-view`, `requirement-proof-view`, `requirement-coverage-view`, `requirement-spec-tree-view`, `requirement-semantic-diff`, `requirement-traceability-graph`, or `requirement-browser-server` | Semantic diff compares admitted owner fields rather than lines. Traceability keeps specification, proof, code, and native execution evidence planes separate. Browser and rendered outputs remain presentation only unless the consumer admits a tracked artifact freshness gate. |
 | Temporary external document lifecycle facts, generated views, or rendered views need authority classification. | `document-lifecycle-boundary` | Treat lifecycle records as caller-owned metadata. Temporary design docs and implementation plans are not retained repository authority unless rewritten into deterministic specs, proof bindings, tests, package-public docs, or backlog rows. |
 | A JavaScript/TypeScript consumer needs less wrapper code. | `json-report-cli-adapter-source --language typescript --format json` | Generated adapter source is caller-owned after materialization. The consumer still owns package pin, binary path, repo paths, local policy, and freshness proof. It is a CLI runner adapter, not a separate SDK authority. |
 | A Python consumer needs Proofkit from Python tooling. | Install the Python package when available and invoke the same CLI/JSON contract. | The Python package is a runner wrapper over the Go CLI, not a Python SDK or alternate schema owner. |
@@ -133,7 +138,7 @@ Decision tree:
 
 ## Routing Rules
 
-1. Start from `proofkit/cli-contract.v1.json` when a machine needs the exact
+1. Start from `proofkit/cli-contract.v2.json` when a machine needs the exact
    command, flags, input mode, output mode, scope class, or `agent-route` input
    contract.
 2. Start from this map when a human or agent only needs the correct command

package/docs/release-process.md

@@ -42,7 +42,11 @@ Go source
   -> GitHub Release assets with checksums and SBOM for provenance lookup
 ```
 
-The repository-owned `release:manifest` tool creates `release-manifest.json`,
+The committed `release/change-record.v1.json` owns the reviewed, version-bound
+declaration of the public-contract delta, migration decision, platform
+requirements, known limitations, and rollback strategy. It does not infer
+change completeness from the source diff. The repository-owned
+`release:manifest` tool admits that record and creates `release-manifest.json`,
 `checksums.sha256`, `metadata-checksums.sha256`, `sbom-subjects.sha256`,
 release notes, and deterministic SBOM candidate evidence from explicit package,
 registry, and release evidence. `checksums.sha256` covers distributable archive
@@ -77,18 +81,21 @@ Before publishing a version:
 
 1. The source tree is clean.
 2. `package.json` contains the exact new version.
-3. `package.json` repository, license, bin, exports, files, and publishConfig
+3. `release/change-record.v1.json` contains the same version and explicitly
+   classifies breaking changes, additions, migration, platform requirements,
+   known limitations, and rollback.
+4. `package.json` repository, license, bin, exports, files, and publishConfig
    match the intended public package contract.
-4. The npm account has verified email and write-protective 2FA, or the package
+5. The npm account has verified email and write-protective 2FA, or the package
    uses an admitted Trusted Publisher configuration.
-5. When `PROOFKIT_ENABLE_PYPI_PUBLISH=true`, the PyPI account has a normal or
+6. When `PROOFKIT_ENABLE_PYPI_PUBLISH=true`, the PyPI account has a normal or
    pending Trusted Publisher configured for project `agentic-proofkit`,
    repository `research-engineering/agentic-proofkit`, workflow `release.yml`, and
    environment `pypi`.
-6. The release workflow is configured for the package, public npm registry, and
+7. The release workflow is configured for the package, public npm registry, and
    release environments. PyPI release configuration is required only when the
    PyPI channel is explicitly enabled.
-7. `npm run check` passes locally or the release candidate workflow provides
+8. `npm run check` passes locally or the release candidate workflow provides
    equivalent current-head evidence.
 
 ## Candidate Proof
@@ -156,7 +163,10 @@ The `release` workflow must:
 14. retain normalized GitHub Release metadata as workflow release evidence at
     `artifacts/release/github-release.json` after byte-for-byte asset
     verification, and bind it plus any attestation record with
-    `artifacts/release/retained-evidence-checksums.sha256`. The release
+    `artifacts/retained-evidence-checksums.sha256`. The checksum manifest lives
+    at the retained artifact root and uses exact `release/...` and
+    `attestations/...` paths, so standard checksum verification executes against
+    the downloaded artifact layout without path rewriting. The release
     manifest records GitHub Release channel data as candidate/archive inventory;
     `github-release.json` owns post-create GitHub Release facts only inside
     retained workflow evidence, not as a public release asset.

package/docs/specs/proofkit-spec-proof-core/overview.md

@@ -97,6 +97,24 @@ execution receipts, and merge policy.
   runtime navigation projection, and adds opt-in family help while preserving
   existing help invocation forms, process channels, no-input behavior, and leaf
   dispatch; descriptor and help truth remains owned by `REQ-PROOFKIT-QUALITY-004`.
+- `REQ-PROOFKIT-SPEC-019`: explicit catalogs compose content-bound semantic
+  context snapshots through existing source, tree, proof, and coverage owners
+  without ambient repository discovery.
+- `REQ-PROOFKIT-SPEC-020`: bounded context queries select parent-before-child,
+  role-aware, reference-closed semantic subsets by stable identity and report
+  each active bound without treating bounded absence as source absence.
+- `REQ-PROOFKIT-SPEC-021`: the loopback workspace progressively presents
+  immutable context, semantic diff, traceability trust states, authority
+  boundaries, and non-claims, then emits a bounded source-bound question packet
+  only after explicit user submission.
+- `REQ-PROOFKIT-SPEC-022`: semantic diff compares admitted requirement fields
+  by owner-declared scalar, set, map, and lifecycle semantics, covers entity
+  additions and removals, and remains closed under output re-admission.
+- `REQ-PROOFKIT-SPEC-023`: traceability graph input schema v2 preserves
+  specification, proof, code traceability, and native execution as distinct
+  evidence planes and accepts code topology only as explicit caller-owned input
+  with source-digest, parent-edge, abstraction-order, and pre-materialization
+  budget closure.
 
 ## Non-Claims
 

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -490,6 +490,71 @@
         "requiresImpactDeclaration": true,
         "requiresProofBindingReview": true
       }
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-019",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "Requirement context composition reads only caller-selected repository-relative catalog paths through a confined filesystem root, admits each source through its semantic owner, records current and optional expected digests, and emits one bounded content-bound derived snapshot without ambient scanning or new requirement, proof, coverage, freshness, or merge authority.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-019"],
+      "nonClaims": ["This requirement does not claim ambient repository discovery, later-checkout freshness, requirement meaning, proof adequacy, native witness execution, merge approval, release approval, rollout approval, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-020",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "Requirement context slicing strictly re-admits snapshot identity, applies closed profiles and intersecting stable-id selectors under deterministic bounds, rejects unknown explicit targets, retains selected ancestors before descendants, preserves source-role and lifecycle reference closure, and distinctly reports depth, node-count, and requirement-count omissions without treating bounded absence as source absence.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-020"],
+      "nonClaims": ["This requirement does not claim source completeness outside the admitted snapshot, product meaning, proof freshness, native execution, merge approval, release approval, rollout approval, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-021",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "The loopback requirement workspace visibly preserves presentation-only authority boundaries, non-claims, snapshot and baseline identity, and trust-significant graph states while rendering immutable admitted context, optional semantic diff, and optional traceability graph through exact allowlisted routes, a per-process capability, same-origin handoff admission, source-digest and JSON-pointer anchors, Unicode code-point quote coordinates, bounded browser-session question packets after explicit UI submission across the admitted tree domain subject to explicit packet byte bounds, and terminal one-shot concurrent session semantics without persistence, command execution, provider access, or authority promotion.",
+      "claimLevel": "blocking",
+      "riskClass": "critical",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-021"],
+      "nonClaims": ["This requirement does not authenticate the surrounding browser profile or operating-system user and does not claim remote access, annotation persistence, agent execution, provider delivery, proof freshness, merge approval, release approval, rollout approval, branded Safari behavior, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-022",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "Requirement semantic diff compares two admitted context snapshots by stable requirement identity and owner-declared scalar, set, map, and lifecycle field classes, producing canonically ordered added, removed, and modified facts that remain closed under output re-admission without textual diff, inferred move semantics, or authority over requirement meaning.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-022"],
+      "nonClaims": ["This requirement does not claim textual equivalence, inferred moves, product meaning, proof freshness, merge approval, release approval, rollout approval, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-023",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "Requirement traceability graph input schema v2 deterministically projects admitted specification and proof topology plus explicit caller-owned code topology while preserving specification, proof, code traceability, and native execution as distinct evidence planes; one typed topology validator rejects dangling endpoints, enforces the bijection between non-root parentNodeId facts and contains edges with broader parent abstraction, verifies every supplied code-source digest, and applies node, edge, and source-byte budgets before per-item semantic materialization.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-023"],
+      "nonClaims": ["This requirement does not infer code topology, line or branch coverage, native execution, proof freshness, merge approval, release approval, rollout approval, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ],
   "nonClaims": [

package/docs/specs/proofkit-supply-chain-quality/overview.md

@@ -89,6 +89,23 @@ vulnerability absence, or consumer rollout safety by itself.
   state before mutation, stays confined to the repository across symlinks,
   binds non-empty generated content to stable source and execution-context
   snapshots, and emits a schema-versioned execution record.
+- `REQ-PROOFKIT-QUALITY-021`: CLI contract v2 owns one leading pretty or
+  compact JSON layout option through a descriptor-aware token-role
+  preclassification at process output boundaries while canonical identity
+  serialization remains unchanged.
+- `REQ-PROOFKIT-QUALITY-022`: the requirement workspace uses an explicit
+  embedded asset set, strict authored-JavaScript type checking, exact secured
+  routes, bounded server cleanup, repository-confined non-symlink proof
+  artifacts, and machine-admitted per-project rendered engine evidence without
+  runtime dependencies or a production bundler.
+- `REQ-PROOFKIT-QUALITY-023`: Python wheels independently bind advertised
+  platform compatibility to decoded executable bytes and carry Core Metadata
+  2.4 plus an exact, RECORD-closed repository license payload.
+- `REQ-PROOFKIT-QUALITY-024`: a version-bound machine record declares the
+  reviewed public-contract change set and owns release-note content, while one
+  retained-evidence owner builds and verifies checksums against exact
+  downloadable artifact-relative paths without inferring change completeness
+  from the source diff.
 
 ## Non-Claims
 

package/docs/specs/proofkit-supply-chain-quality/requirements.v1.json

@@ -268,6 +268,58 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-021",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "The public CLI v2 process contract admits one leading pretty or compact JSON layout option, preserves pretty as the default, classifies descriptor-admitted flag and value token roles before output policy so option-shaped values cannot alter output classification, emits sorted valid JSON with one trailing LF in both layouts, applies the selected layout only at JSON stdout or admitted JSON file sinks, and leaves canonical digest and identity serialization unchanged.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-021"],
+      "nonClaims": ["This requirement does not change canonical source storage, semantic selection, stable identity, text output, help output, browser sessions, merge approval, release approval, or rollout readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-022",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Authored requirement workspace JavaScript and CSS are embedded through an explicit compile-time asset set, served only by exact routes with restrictive response headers, strictly type-checked without a production bundler, and covered by Go lifecycle, concurrent terminal-state, HTTP security, and repository-confined non-symlink artifact falsifiers plus a machine-admitted per-project execution report proving the same non-empty passed test identities in pinned Chromium, Firefox, and Playwright WebKit, with bounded browser-server cleanup and no added runtime package dependencies.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-022"],
+      "nonClaims": ["This requirement does not claim full WCAG conformance, every branded browser, provider CI ingestion, registry publication, release approval, rollout approval, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-023",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Each Python wheel binds its embedded executable to the release binary digest, independently decodes Darwin Mach-O bytes so an advertised macOS platform minimum is never lower than the executable minimum, uses Core Metadata 2.4 License-Expression and License-File fields, carries an exact repository LICENSE copy under the wheel licenses directory, and closes every payload entry through RECORD.",
+      "claimLevel": "blocking",
+      "riskClass": "critical",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-023"],
+      "nonClaims": ["This requirement does not claim execution on every accepted operating-system version, legal approval, registry publication, release approval, rollout approval, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Release metadata generation admits one version-bound machine-readable declaration of the reviewed public-contract change set and renders release notes as its exact projection, while one repository-owned retained-evidence builder and verifier checksum the exact final downloadable artifact topology with artifact-relative paths, reject unbound evidence files and symlink substitution, and fail release closeout on record, note, path, or digest drift.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-024"],
+      "nonClaims": ["This requirement does not infer change-record completeness from source changes, make release notes approval authority, or prove provider publication, attestation authenticity, consumer adoption, rollout approval, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ]
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.1.158",
+  "version": "0.1.160",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,
@@ -36,7 +36,10 @@
   ],
   "scripts": {
     "build": "go run ./internal/tools/packagebuild",
-    "check": "npm run npm:version && npm run source-hygiene && npm run command-family:check && npm run text-policy && npm run mermaid:check && npm run go:check && npm run package:artifact && npm run self:receipt && npm run self:coverage && npm run release:closeout",
+    "check": "npm run npm:version && npm run source-hygiene && npm run command-family:check && npm run text-policy && npm run mermaid:check && npm run browser:check && npm run go:check && npm run package:artifact && npm run self:receipt && npm run self:coverage && npm run release:closeout",
+    "browser:check": "npm run browser:static-check && npm run browser:test",
+    "browser:static-check": "tsc -p tsconfig.browser.json && node --test scripts/browser-proof-execution.test.mjs scripts/browser-proof-inputs.test.mjs scripts/browser-selection-authority.test.mjs",
+    "browser:test": "go run ./internal/tools/browserproofverify --run",
     "command-family:check": "go run ./internal/tools/commandfamilygen --check",
     "go:actionlint": "go tool actionlint",
     "go:bench": "go test ./internal/kernel/admission ./internal/kernel/stablejson -run '^$' -bench . -benchmem -count=10",
@@ -69,5 +72,10 @@
   "cpu": [
     "arm64",
     "x64"
-  ]
+  ],
+  "devDependencies": {
+    "@axe-core/playwright": "4.12.1",
+    "@playwright/test": "1.61.1",
+    "typescript": "7.0.2"
+  }
 }

package/proofkit/{cli-contract.v1.json → cli-contract.v2.json}

@@ -1,15 +1,33 @@
 {
-  "schemaVersion": 1,
-  "contractId": "proofkit.cli-contract.v1",
+  "schemaVersion": 2,
+  "contractId": "proofkit.cli-contract.v2",
   "packageName": "@research-engineering/agentic-proofkit",
   "processContract": {
     "successExitCode": 0,
     "failureExitCode": 1,
     "stdout": "Successful JSON commands write exactly one JSON value to stdout unless an admitted explicit output-file flag writes that JSON value to the selected path and leaves stdout empty. Successful text or help commands write text to stdout unless an admitted explicit output-file flag writes the selected representation to the selected path and leaves stdout empty. Commands do not write stderr on success.",
     "stderr": "Argument parsing, unsupported command, input admission, and output serialization failures write human diagnostics to stderr. Failed report commands may still write a machine-readable failed report to stdout when admission succeeds. Opt-in agent-envelope repair packets may write deterministic invalid-input JSON to stdout with exit code 1 and empty stderr.",
+    "globalOptions": {
+      "jsonLayout": {
+        "flag": "--json-layout",
+        "position": "before_command",
+        "values": [
+          "compact",
+          "pretty"
+        ],
+        "default": "pretty",
+        "scope": "json_output_only"
+      }
+    },
     "helpGrammar": {
-      "rootHelpFlags": ["--help", "-h"],
-      "commandHelpFlags": ["--help", "-h"],
+      "rootHelpFlags": [
+        "--help",
+        "-h"
+      ],
+      "commandHelpFlags": [
+        "--help",
+        "-h"
+      ],
       "helpCommandPositionalTarget": "optional_supported_command",
       "helpCatalogFormsSource": "proofkit/command-families.v1.json",
       "helpReadsCommandInput": false
@@ -132,8 +150,14 @@
                   "readiness_closeout_input",
                   "registry_consumer_input",
                   "release_authority_input",
+                  "requirement_context_catalog",
+                  "requirement_context_repo_root",
+                  "requirement_context_slice_input",
+                  "requirement_semantic_diff_input",
                   "requirement_source",
                   "requirement_source_transition",
+                  "requirement_traceability_graph_input",
+                  "requirement_workspace_input",
                   "scaffold_profile_plan",
                   "scaffold_project_structure",
                   "selective_evidence",
@@ -170,11 +194,14 @@
               "check_overview_claims",
               "decide_obligations",
               "inspect_coverage",
+              "inspect_requirement_context",
+              "inspect_requirement_traceability",
               "inventory_tests",
               "plan_selective_checks",
               "release_or_deploy_evidence",
               "render_human_view",
               "retire_local_infrastructure",
+              "review_requirement_change",
               "scaffold_first_module",
               "unknown",
               "validate_requirement_source",
@@ -1017,10 +1044,82 @@
         "--port",
         "--scope",
         "--serve",
+        "--session-mode",
+        "--session-timeout-seconds",
         "--view"
       ],
       "requiredFlags": [
         "--view"
+      ],
+      "flagValueRequirements": [
+        {
+          "flag": "--session-mode",
+          "requiredFlags": [
+            "--open",
+            "--serve",
+            "--view"
+          ],
+          "value": "one-shot-question"
+        }
+      ],
+      "inputContract": {
+        "schemaVersion": 1,
+        "workspaceRequiredFields": [
+          "context",
+          "schemaVersion",
+          "workspaceId"
+        ],
+        "workspaceOptionalFields": [
+          "diffInput",
+          "graphInput"
+        ],
+        "sessionModeValues": [
+          "browse",
+          "one-shot-question"
+        ],
+        "sessionTimeoutSeconds": {
+          "minimum": 1,
+          "maximum": 7200,
+          "requiresSessionMode": "one-shot-question"
+        },
+        "oneShotRequirements": {
+          "open": true,
+          "serve": true,
+          "view": "workspace"
+        },
+        "jsonLayoutRule": "allowed for non-serving JSON plans; serving and one-shot modes reject the global layout option because one-shot terminal packets are fixed compact JSON"
+      }
+    },
+    {
+      "command": "requirement-context-compose",
+      "input": "required",
+      "stdin": true,
+      "inputPointer": true,
+      "scopeClass": "explicit_filesystem_scan",
+      "outputModes": [
+        "json"
+      ],
+      "allowedFlags": [
+        "--input",
+        "--input-pointer",
+        "--repo-root"
+      ],
+      "requiredFlags": [
+        "--repo-root"
+      ]
+    },
+    {
+      "command": "requirement-context-slice",
+      "input": "required",
+      "stdin": true,
+      "inputPointer": true,
+      "scopeClass": "explicit_caller_input",
+      "outputModes": [
+        "json"
+      ],
+      "allowedFlags": [
+        "--input",
+        "--input-pointer"
       ]
     },
     {
@@ -1321,6 +1420,20 @@
         "--scope"
       ]
     },
+    {
+      "command": "requirement-semantic-diff",
+      "input": "required",
+      "stdin": true,
+      "inputPointer": true,
+      "scopeClass": "explicit_caller_input",
+      "outputModes": [
+        "json"
+      ],
+      "allowedFlags": [
+        "--input",
+        "--input-pointer"
+      ]
+    },
     {
       "command": "requirement-source-admission",
       "input": "required",
@@ -1374,7 +1487,15 @@
       "scopeClass": "explicit_caller_input",
       "inputContract": {
         "schemaVersion": 2,
-        "requiredFields": ["schemaVersion", "treeId", "rootNodeId", "callerAnnotations", "nodes", "edges", "overlays"],
+        "requiredFields": [
+          "schemaVersion",
+          "treeId",
+          "rootNodeId",
+          "callerAnnotations",
+          "nodes",
+          "edges",
+          "overlays"
+        ],
         "callerTextAuthority": "callerAnnotations fields are untrusted presentation annotations and never command-owned nonClaims"
       },
       "outputModes": [
@@ -1393,7 +1514,15 @@
       "scopeClass": "explicit_caller_input",
       "inputContract": {
         "schemaVersion": 2,
-        "requiredFields": ["schemaVersion", "treeId", "rootNodeId", "callerAnnotations", "nodes", "edges", "overlays"],
+        "requiredFields": [
+          "schemaVersion",
+          "treeId",
+          "rootNodeId",
+          "callerAnnotations",
+          "nodes",
+          "edges",
+          "overlays"
+        ],
         "callerTextAuthority": "callerAnnotations fields are untrusted presentation annotations and never command-owned nonClaims"
       },
       "outputModes": [
@@ -1411,7 +1540,10 @@
         "contractId": "proofkit.requirement-spec-tree-view.output.v2",
         "schemaVersion": 2,
         "authority": "requirement spec tree view output contract",
-        "nonJsonFormats": ["html", "markdown"],
+        "nonJsonFormats": [
+          "html",
+          "markdown"
+        ],
         "requiredFields": [
           "authority",
           "nodeCount",
@@ -1425,6 +1557,20 @@
         ]
       }
     },
+    {
+      "command": "requirement-traceability-graph",
+      "input": "required",
+      "stdin": true,
+      "inputPointer": true,
+      "scopeClass": "explicit_caller_input",
+      "outputModes": [
+        "json"
+      ],
+      "allowedFlags": [
+        "--input",
+        "--input-pointer"
+      ]
+    },
     {
       "command": "scaffold-profile-plan",
       "input": "required",

package/proofkit/command-families.v1.json

@@ -110,6 +110,17 @@
         "workspace-manifest-facts"
       ]
     },
+    {
+      "familyId": "requirement-context-and-traceability",
+      "label": "Requirement context and traceability",
+      "purpose": "Compose bounded semantic context and derive diff and traceability projections.",
+      "commands": [
+        "requirement-context-compose",
+        "requirement-context-slice",
+        "requirement-semantic-diff",
+        "requirement-traceability-graph"
+      ]
+    },
     {
       "familyId": "requirement-navigation-and-rendering",
       "label": "Requirement navigation and rendering",

package/proofkit/requirement-bindings.json

@@ -572,6 +572,38 @@
         "This requirement does not claim producer authentication, hermetic or reproducible builds, registry publication, provider evidence freshness, release approval, rollout approval, production readiness, or exact artifact closure outside downstream package and release validators."
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-021",
+      "ownerId": "proofkit.supply-chain-quality",
+      "specPath": "docs/specs/proofkit-supply-chain-quality/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This requirement does not change canonical source storage, semantic selection, stable identity, text output, help output, browser sessions, merge approval, release approval, or rollout readiness."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-022",
+      "ownerId": "proofkit.supply-chain-quality",
+      "specPath": "docs/specs/proofkit-supply-chain-quality/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This requirement does not claim full WCAG conformance, every branded browser, provider CI ingestion, registry publication, release approval, rollout approval, or production readiness."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-023",
+      "ownerId": "proofkit.supply-chain-quality",
+      "specPath": "docs/specs/proofkit-supply-chain-quality/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This requirement does not claim execution on every accepted operating-system version, legal approval, registry publication, release approval, rollout approval, or production readiness."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "ownerId": "proofkit.supply-chain-quality",
+      "specPath": "docs/specs/proofkit-supply-chain-quality/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This requirement does not infer change-record completeness from source changes, make release notes approval authority, or prove provider publication, attestation authenticity, consumer adoption, rollout approval, or production readiness."]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-017",
       "ownerId": "proofkit.spec-proof-core",
@@ -591,6 +623,46 @@
       "nonClaims": [
         "This requirement does not claim byte-for-byte help text compatibility across owner-approved CLI contract corrections, command recommendation, command execution through family membership, consumer policy, native witness execution, merge approval, release approval, rollout approval, or production readiness."
       ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-019",
+      "ownerId": "proofkit.spec-proof-core",
+      "specPath": "docs/specs/proofkit-spec-proof-core/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This requirement does not claim ambient repository discovery, later-checkout freshness, requirement meaning, proof adequacy, native witness execution, merge approval, release approval, rollout approval, or production readiness."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-020",
+      "ownerId": "proofkit.spec-proof-core",
+      "specPath": "docs/specs/proofkit-spec-proof-core/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This requirement does not claim source completeness outside the admitted snapshot, product meaning, proof freshness, native execution, merge approval, release approval, rollout approval, or production readiness."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-021",
+      "ownerId": "proofkit.spec-proof-core",
+      "specPath": "docs/specs/proofkit-spec-proof-core/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This requirement does not authenticate the surrounding browser profile or operating-system user and does not claim remote access, annotation persistence, agent execution, provider delivery, proof freshness, merge approval, release approval, rollout approval, branded Safari behavior, or production readiness."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-022",
+      "ownerId": "proofkit.spec-proof-core",
+      "specPath": "docs/specs/proofkit-spec-proof-core/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This requirement does not claim textual equivalence, inferred moves, product meaning, proof freshness, merge approval, release approval, rollout approval, or production readiness."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-023",
+      "ownerId": "proofkit.spec-proof-core",
+      "specPath": "docs/specs/proofkit-spec-proof-core/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This requirement does not infer code topology, line or branch coverage, native execution, proof freshness, merge approval, release approval, rollout approval, or production readiness."]
     }
   ],
   "bindings": [
@@ -2128,9 +2200,284 @@
       "environmentClasses": [
         "local-go"
       ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-021",
+      "scenarioId": "proofkit.supply-chain-quality.cli-json-layout-parity",
+      "witnessId": "proofkit.stablejson.layout-parity-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/stablejson/stablejson_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-021",
+      "scenarioId": "proofkit.supply-chain-quality.cli-json-layout-process-boundary",
+      "witnessId": "proofkit.app.json-layout-process-boundary-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/app_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-021",
+      "scenarioId": "proofkit.supply-chain-quality.cli-json-layout-file-boundary",
+      "witnessId": "proofkit.app.json-layout-file-boundary-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/cli_abi_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-022",
+      "scenarioId": "proofkit.supply-chain-quality.browser-asset-and-security-boundary",
+      "witnessId": "proofkit.requirement-browser.workspace-security-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementbrowser/workspace_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-022",
+      "scenarioId": "proofkit.supply-chain-quality.browser-project-execution-evidence",
+      "witnessId": "proofkit.requirement-browser.project-execution-evidence-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/browserproofverify/playwright_report_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-022",
+      "scenarioId": "proofkit.supply-chain-quality.browser-proof-artifact-confinement",
+      "witnessId": "proofkit.requirement-browser.proof-artifact-confinement-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/browserproofverify/artifact_paths_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-022",
+      "scenarioId": "proofkit.supply-chain-quality.browser-terminal-concurrency",
+      "witnessId": "proofkit.requirement-browser.terminal-concurrency-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementbrowser/workspace_handoff_boundary_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-022",
+      "scenarioId": "proofkit.supply-chain-quality.browser-process-lifecycle",
+      "witnessId": "proofkit.requirement-browser.process-lifecycle-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "scripts/browser-proof-execution.test.mjs",
+      "commandIds": ["proofkit.browser-check"],
+      "environmentClasses": ["local-node-browser"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-023",
+      "scenarioId": "proofkit.supply-chain-quality.python-wheel-platform-byte-compatibility",
+      "witnessId": "proofkit.python-package.macho-platform-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/pythonpackage/metadata_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-023",
+      "scenarioId": "proofkit.supply-chain-quality.python-wheel-license-closure",
+      "witnessId": "proofkit.python-package.license-payload-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/pythonpackage/metadata_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "scenarioId": "proofkit.supply-chain-quality.release-change-record-projection",
+      "witnessId": "proofkit.release-change.versioned-projection-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/releasechange/record_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "scenarioId": "proofkit.supply-chain-quality.retained-evidence-artifact-topology",
+      "witnessId": "proofkit.retained-evidence.download-layout-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/retainedevidence/manifest_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "scenarioId": "proofkit.supply-chain-quality.release-closeout-change-record",
+      "witnessId": "proofkit.release-closeout.change-record-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/releasecloseoutinput/main_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-019",
+      "scenarioId": "proofkit.spec-proof-core.requirement-context-composition",
+      "witnessId": "proofkit.requirement-context.compose-round-trip-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementcontext/requirementcontext_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-019",
+      "scenarioId": "proofkit.spec-proof-core.requirement-context-composition-whole-cli",
+      "witnessId": "proofkit.app.requirement-context-compose-cli-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/requirement_context_cli_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-020",
+      "scenarioId": "proofkit.spec-proof-core.requirement-context-slicing",
+      "witnessId": "proofkit.requirement-context.slice-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementcontext/slice_closure_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-020",
+      "scenarioId": "proofkit.spec-proof-core.requirement-context-slicing-whole-cli",
+      "witnessId": "proofkit.app.requirement-context-slice-cli-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/requirement_context_cli_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-021",
+      "scenarioId": "proofkit.spec-proof-core.requirement-browser-workspace-handoff",
+      "witnessId": "proofkit.requirement-browser.workspace-handoff-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementbrowser/workspace_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-021",
+      "scenarioId": "proofkit.spec-proof-core.requirement-browser-tree-domain-closure",
+      "witnessId": "proofkit.requirement-browser.tree-domain-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementbrowser/workspace_handoff_boundary_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-021",
+      "scenarioId": "proofkit.spec-proof-core.requirement-browser-packet-bounds",
+      "witnessId": "proofkit.requirement-browser.packet-bounds-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementbrowser/handoff_bounds_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-021",
+      "scenarioId": "proofkit.spec-proof-core.requirement-browser-one-shot-cleanup",
+      "witnessId": "proofkit.requirement-browser.one-shot-cleanup-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementbrowser/server_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-022",
+      "scenarioId": "proofkit.spec-proof-core.requirement-semantic-diff",
+      "witnessId": "proofkit.requirement-semantic-diff.owner-field-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementdiff/requirementdiff_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-022",
+      "scenarioId": "proofkit.spec-proof-core.requirement-semantic-diff-complete-algebra",
+      "witnessId": "proofkit.requirement-semantic-diff.complete-algebra-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementdiff/requirementdiff_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-022",
+      "scenarioId": "proofkit.spec-proof-core.requirement-semantic-diff-whole-cli",
+      "witnessId": "proofkit.app.requirement-semantic-diff-cli-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/requirement_context_cli_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-023",
+      "scenarioId": "proofkit.spec-proof-core.requirement-traceability-evidence-planes",
+      "witnessId": "proofkit.requirement-traceability.evidence-plane-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementgraph/requirementgraph_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-023",
+      "scenarioId": "proofkit.spec-proof-core.requirement-traceability-topology-closure",
+      "witnessId": "proofkit.requirement-traceability.topology-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementgraph/requirementgraph_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-023",
+      "scenarioId": "proofkit.spec-proof-core.requirement-traceability-whole-cli",
+      "witnessId": "proofkit.app.requirement-traceability-cli-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/requirement_context_cli_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-021",
+      "scenarioId": "proofkit.spec-proof-core.requirement-browser-rendered-runtime",
+      "witnessId": "proofkit.requirement-browser.rendered-runtime-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "tests/browser/workspace.spec.mjs",
+      "commandIds": ["proofkit.browser-check"],
+      "environmentClasses": ["local-node-browser"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-021",
+      "scenarioId": "proofkit.spec-proof-core.requirement-browser-unicode-code-point-selection",
+      "witnessId": "proofkit.requirement-browser.unicode-selection-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "tests/browser/workspace.spec.mjs",
+      "commandIds": ["proofkit.browser-check"],
+      "environmentClasses": ["local-node-browser"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-022",
+      "scenarioId": "proofkit.supply-chain-quality.browser-static-and-runtime-proof",
+      "witnessId": "proofkit.requirement-browser.static-runtime-proof-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "tests/browser/workspace.spec.mjs",
+      "commandIds": ["proofkit.browser-check"],
+      "environmentClasses": ["local-node-browser"]
     }
   ],
   "witnessCommands": [
+    {
+      "commandId": "proofkit.browser-check",
+      "command": "npm run browser:check",
+      "environmentClass": "local-node-browser"
+    },
     {
       "commandId": "proofkit.ci-receipt-anchor",
       "command": "npm run self:receipt",

package/proofkit/witness-plan.json

@@ -14,6 +14,7 @@
     "environmentClasses": [
       "local-go",
       "local-go-python",
+      "local-node-browser",
       "local-python"
     ],
     "environmentClassPolicies": [
@@ -47,6 +48,18 @@
           "write-local"
         ]
       },
+      {
+        "environmentClass": "local-node-browser",
+        "networkPolicies": [
+          "none"
+        ],
+        "credentialClasses": [
+          "none"
+        ],
+        "cachePolicies": [
+          "disabled"
+        ]
+      },
       {
         "environmentClass": "local-python",
         "networkPolicies": [
@@ -62,6 +75,7 @@
       }
     ],
     "parallelGroups": [
+      "browser-runtime",
       "coverage-metrics",
       "local-go-static",
       "package-artifact",
@@ -628,6 +642,41 @@
           0
         ]
       }
+    },
+    {
+      "schemaVersion": 1,
+      "id": "proofkit.browser-check",
+      "cwd": ".",
+      "argv": [
+        "npm",
+        "run",
+        "browser:check"
+      ],
+      "environment": {
+        "inherit": "none",
+        "allowlist": [],
+        "classes": [
+          "local-node-browser"
+        ]
+      },
+      "timeoutMs": 600000,
+      "networkPolicy": "none",
+      "credentialClass": "none",
+      "cachePolicy": "disabled",
+      "expectedArtifacts": [
+        {
+          "kind": "report",
+          "path": "artifacts/proofkit/browser-runtime-proof.json",
+          "required": true
+        }
+      ],
+      "parallelGroup": "browser-runtime",
+      "exitCodePolicy": {
+        "kind": "zero",
+        "successCodes": [
+          0
+        ]
+      }
     }
   ],
   "policies": [
@@ -669,6 +718,80 @@
         "Self-hosting witness policy does not prove producer authentication or merge approval."
       ]
     },
+    {
+      "commandId": "proofkit.browser-check",
+      "inputSelectors": [
+        "go.mod",
+        "go.sum",
+        "internal/command/requirementbinding",
+        "internal/command/requirementbrowser",
+        "internal/command/requirementcontext",
+        "internal/command/requirementcoverageview",
+        "internal/command/requirementdiff",
+        "internal/command/requirementgraph",
+        "internal/command/requirementproofview",
+        "internal/command/requirementsourceadmission",
+        "internal/command/requirementsourceview",
+        "internal/command/requirementspectree",
+        "internal/command/testevidenceinventory",
+        "internal/kernel/admission",
+        "internal/kernel/admit",
+        "internal/kernel/agentenvelope",
+        "internal/kernel/browserdoc",
+        "internal/kernel/compactproofcontract",
+        "internal/kernel/digest",
+        "internal/kernel/markdownfmt",
+        "internal/kernel/report",
+        "internal/kernel/secretjson",
+        "internal/kernel/stablejson",
+        "internal/kernel/witnesscommand",
+        "internal/testsupport/browserfixture",
+        "internal/tools/browserproofverify",
+        "internal/tools/browsertestserver",
+        "package-lock.json",
+        "package.json",
+        "playwright.config.mjs",
+        "proofkit/witness-plan.json",
+        "scripts/browser-proof-execution.mjs",
+        "scripts/browser-proof-execution.test.mjs",
+        "scripts/browser-proof-inputs.mjs",
+        "scripts/browser-proof-inputs.test.mjs",
+        "scripts/browser-runtime-proof-inputs.v1.json",
+        "scripts/browser-selection-authority.test.mjs",
+        "scripts/write-browser-proof.mjs",
+        "tests/browser",
+        "tsconfig.browser.json"
+      ],
+      "outputSelectors": [
+        "artifacts/proofkit/browser-runtime-proof.json"
+      ],
+      "resourceReads": [
+        "resource.proofkit.source"
+      ],
+      "resourceWrites": [
+        "resource.proofkit.local-artifacts"
+      ],
+      "exclusiveLocks": [],
+      "sideEffectClass": "local_write",
+      "deterministicOutput": false,
+      "cacheAdmissionRefs": [],
+      "retryPolicy": {
+        "kind": "none",
+        "maxAttempts": 1
+      },
+      "cancellationPolicy": {
+        "kind": "cooperative",
+        "graceMs": 5000
+      },
+      "timeoutPolicy": {
+        "kind": "bounded",
+        "timeoutMs": 600000
+      },
+      "nonClaims": [
+        "Browser runtime proof does not prove registry publication, rollout, or production readiness.",
+        "Pinned Playwright engines are not branded browser compatibility proof."
+      ]
+    },
     {
       "commandId": "proofkit.ci-receipt-anchor",
       "inputSelectors": [
@@ -731,7 +854,7 @@
         "internal/command",
         "internal/testsupport/commandcoverage",
         "internal/tools/coveragemetrics",
-        "proofkit/cli-contract.v1.json",
+        "proofkit/cli-contract.v2.json",
         "proofkit/requirement-bindings.json",
         "proofkit/witness-plan.json"
       ],
@@ -873,9 +996,11 @@
         "go.mod",
         "go.sum",
         "internal",
-        "proofkit/cli-contract.v1.json",
+        "package.json",
+        "proofkit/cli-contract.v2.json",
         "proofkit/requirement-bindings.json",
         "proofkit/witness-plan.json",
+        "scripts/browser-runtime-proof-inputs.v1.json",
         "scripts/validate-self-hosting-receipts.go"
       ],
       "outputSelectors": [],