@research-engineering/agentic-proofkit 0.1.159 → 0.1.160

package/README.md

@@ -42,6 +42,8 @@ Python consumers use the Python package as a runner wrapper over the same Go
 CLI, not as a Python SDK. Python projects should still treat CLI/JSON records,
 exit codes, and package metadata as the public contract.
 
+Published Darwin binary distributions require macOS 12.0 or later.
+
 ## Project Boundary
 
 `agentic-proofkit` is intended to provide reusable proof-workflow mechanics for

package/docs/release-process.md

@@ -42,7 +42,11 @@ Go source
   -> GitHub Release assets with checksums and SBOM for provenance lookup
 ```
 
-The repository-owned `release:manifest` tool creates `release-manifest.json`,
+The committed `release/change-record.v1.json` owns the reviewed, version-bound
+declaration of the public-contract delta, migration decision, platform
+requirements, known limitations, and rollback strategy. It does not infer
+change completeness from the source diff. The repository-owned
+`release:manifest` tool admits that record and creates `release-manifest.json`,
 `checksums.sha256`, `metadata-checksums.sha256`, `sbom-subjects.sha256`,
 release notes, and deterministic SBOM candidate evidence from explicit package,
 registry, and release evidence. `checksums.sha256` covers distributable archive
@@ -77,18 +81,21 @@ Before publishing a version:
 
 1. The source tree is clean.
 2. `package.json` contains the exact new version.
-3. `package.json` repository, license, bin, exports, files, and publishConfig
+3. `release/change-record.v1.json` contains the same version and explicitly
+   classifies breaking changes, additions, migration, platform requirements,
+   known limitations, and rollback.
+4. `package.json` repository, license, bin, exports, files, and publishConfig
    match the intended public package contract.
-4. The npm account has verified email and write-protective 2FA, or the package
+5. The npm account has verified email and write-protective 2FA, or the package
    uses an admitted Trusted Publisher configuration.
-5. When `PROOFKIT_ENABLE_PYPI_PUBLISH=true`, the PyPI account has a normal or
+6. When `PROOFKIT_ENABLE_PYPI_PUBLISH=true`, the PyPI account has a normal or
    pending Trusted Publisher configured for project `agentic-proofkit`,
    repository `research-engineering/agentic-proofkit`, workflow `release.yml`, and
    environment `pypi`.
-6. The release workflow is configured for the package, public npm registry, and
+7. The release workflow is configured for the package, public npm registry, and
    release environments. PyPI release configuration is required only when the
    PyPI channel is explicitly enabled.
-7. `npm run check` passes locally or the release candidate workflow provides
+8. `npm run check` passes locally or the release candidate workflow provides
    equivalent current-head evidence.
 
 ## Candidate Proof
@@ -156,7 +163,10 @@ The `release` workflow must:
 14. retain normalized GitHub Release metadata as workflow release evidence at
     `artifacts/release/github-release.json` after byte-for-byte asset
     verification, and bind it plus any attestation record with
-    `artifacts/release/retained-evidence-checksums.sha256`. The release
+    `artifacts/retained-evidence-checksums.sha256`. The checksum manifest lives
+    at the retained artifact root and uses exact `release/...` and
+    `attestations/...` paths, so standard checksum verification executes against
+    the downloaded artifact layout without path rewriting. The release
     manifest records GitHub Release channel data as candidate/archive inventory;
     `github-release.json` owns post-create GitHub Release facts only inside
     retained workflow evidence, not as a public release asset.

package/docs/specs/proofkit-spec-proof-core/overview.md

@@ -108,10 +108,13 @@ execution receipts, and merge policy.
   boundaries, and non-claims, then emits a bounded source-bound question packet
   only after explicit user submission.
 - `REQ-PROOFKIT-SPEC-022`: semantic diff compares admitted requirement fields
-  by owner-declared scalar, set, and map semantics rather than textual order.
-- `REQ-PROOFKIT-SPEC-023`: traceability graphs preserve specification, proof,
-  code traceability, and native execution as distinct evidence planes and
-  accept code topology only as explicit caller-owned input.
+  by owner-declared scalar, set, map, and lifecycle semantics, covers entity
+  additions and removals, and remains closed under output re-admission.
+- `REQ-PROOFKIT-SPEC-023`: traceability graph input schema v2 preserves
+  specification, proof, code traceability, and native execution as distinct
+  evidence planes and accepts code topology only as explicit caller-owned input
+  with source-digest, parent-edge, abstraction-order, and pre-materialization
+  budget closure.
 
 ## Non-Claims
 

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -533,7 +533,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-022",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Requirement semantic diff compares two admitted context snapshots by stable requirement identity and owner-declared scalar, set, and map field classes, producing deterministic added, removed, and modified facts without textual diff, inferred move semantics, or authority over requirement meaning.",
+      "invariant": "Requirement semantic diff compares two admitted context snapshots by stable requirement identity and owner-declared scalar, set, map, and lifecycle field classes, producing canonically ordered added, removed, and modified facts that remain closed under output re-admission without textual diff, inferred move semantics, or authority over requirement meaning.",
       "claimLevel": "blocking",
       "riskClass": "medium",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
@@ -546,7 +546,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-023",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Requirement traceability graph deterministically projects admitted specification and proof topology plus explicit caller-owned code topology while preserving specification, proof, code traceability, and native execution as distinct evidence planes and rejecting dangling topology references.",
+      "invariant": "Requirement traceability graph input schema v2 deterministically projects admitted specification and proof topology plus explicit caller-owned code topology while preserving specification, proof, code traceability, and native execution as distinct evidence planes; one typed topology validator rejects dangling endpoints, enforces the bijection between non-root parentNodeId facts and contains edges with broader parent abstraction, verifies every supplied code-source digest, and applies node, edge, and source-byte budgets before per-item semantic materialization.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],

package/docs/specs/proofkit-supply-chain-quality/overview.md

@@ -98,6 +98,14 @@ vulnerability absence, or consumer rollout safety by itself.
   routes, bounded server cleanup, repository-confined non-symlink proof
   artifacts, and machine-admitted per-project rendered engine evidence without
   runtime dependencies or a production bundler.
+- `REQ-PROOFKIT-QUALITY-023`: Python wheels independently bind advertised
+  platform compatibility to decoded executable bytes and carry Core Metadata
+  2.4 plus an exact, RECORD-closed repository license payload.
+- `REQ-PROOFKIT-QUALITY-024`: a version-bound machine record declares the
+  reviewed public-contract change set and owns release-note content, while one
+  retained-evidence owner builds and verifies checksums against exact
+  downloadable artifact-relative paths without inferring change completeness
+  from the source diff.
 
 ## Non-Claims
 

package/docs/specs/proofkit-supply-chain-quality/requirements.v1.json

@@ -294,6 +294,32 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-023",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Each Python wheel binds its embedded executable to the release binary digest, independently decodes Darwin Mach-O bytes so an advertised macOS platform minimum is never lower than the executable minimum, uses Core Metadata 2.4 License-Expression and License-File fields, carries an exact repository LICENSE copy under the wheel licenses directory, and closes every payload entry through RECORD.",
+      "claimLevel": "blocking",
+      "riskClass": "critical",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-023"],
+      "nonClaims": ["This requirement does not claim execution on every accepted operating-system version, legal approval, registry publication, release approval, rollout approval, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Release metadata generation admits one version-bound machine-readable declaration of the reviewed public-contract change set and renders release notes as its exact projection, while one repository-owned retained-evidence builder and verifier checksum the exact final downloadable artifact topology with artifact-relative paths, reject unbound evidence files and symlink substitution, and fail release closeout on record, note, path, or digest drift.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-024"],
+      "nonClaims": ["This requirement does not infer change-record completeness from source changes, make release notes approval authority, or prove provider publication, attestation authenticity, consumer adoption, rollout approval, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ]
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.1.159",
+  "version": "0.1.160",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,

package/proofkit/requirement-bindings.json

@@ -588,6 +588,22 @@
       "proofState": "witness_backed",
       "nonClaims": ["This requirement does not claim full WCAG conformance, every branded browser, provider CI ingestion, registry publication, release approval, rollout approval, or production readiness."]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-023",
+      "ownerId": "proofkit.supply-chain-quality",
+      "specPath": "docs/specs/proofkit-supply-chain-quality/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This requirement does not claim execution on every accepted operating-system version, legal approval, registry publication, release approval, rollout approval, or production readiness."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "ownerId": "proofkit.supply-chain-quality",
+      "specPath": "docs/specs/proofkit-supply-chain-quality/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This requirement does not infer change-record completeness from source changes, make release notes approval authority, or prove provider publication, attestation authenticity, consumer adoption, rollout approval, or production readiness."]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-017",
       "ownerId": "proofkit.spec-proof-core",
@@ -2257,6 +2273,51 @@
       "commandIds": ["proofkit.browser-check"],
       "environmentClasses": ["local-node-browser"]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-023",
+      "scenarioId": "proofkit.supply-chain-quality.python-wheel-platform-byte-compatibility",
+      "witnessId": "proofkit.python-package.macho-platform-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/pythonpackage/metadata_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-023",
+      "scenarioId": "proofkit.supply-chain-quality.python-wheel-license-closure",
+      "witnessId": "proofkit.python-package.license-payload-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/pythonpackage/metadata_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "scenarioId": "proofkit.supply-chain-quality.release-change-record-projection",
+      "witnessId": "proofkit.release-change.versioned-projection-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/releasechange/record_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "scenarioId": "proofkit.supply-chain-quality.retained-evidence-artifact-topology",
+      "witnessId": "proofkit.retained-evidence.download-layout-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/retainedevidence/manifest_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "scenarioId": "proofkit.supply-chain-quality.release-closeout-change-record",
+      "witnessId": "proofkit.release-closeout.change-record-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/releasecloseoutinput/main_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-019",
       "scenarioId": "proofkit.spec-proof-core.requirement-context-composition",
@@ -2266,6 +2327,15 @@
       "commandIds": ["proofkit.go-test"],
       "environmentClasses": ["local-go"]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-019",
+      "scenarioId": "proofkit.spec-proof-core.requirement-context-composition-whole-cli",
+      "witnessId": "proofkit.app.requirement-context-compose-cli-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/requirement_context_cli_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-020",
       "scenarioId": "proofkit.spec-proof-core.requirement-context-slicing",
@@ -2275,6 +2345,15 @@
       "commandIds": ["proofkit.go-test"],
       "environmentClasses": ["local-go"]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-020",
+      "scenarioId": "proofkit.spec-proof-core.requirement-context-slicing-whole-cli",
+      "witnessId": "proofkit.app.requirement-context-slice-cli-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/requirement_context_cli_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-021",
       "scenarioId": "proofkit.spec-proof-core.requirement-browser-workspace-handoff",
@@ -2302,6 +2381,15 @@
       "commandIds": ["proofkit.go-test"],
       "environmentClasses": ["local-go"]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-021",
+      "scenarioId": "proofkit.spec-proof-core.requirement-browser-one-shot-cleanup",
+      "witnessId": "proofkit.requirement-browser.one-shot-cleanup-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementbrowser/server_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-022",
       "scenarioId": "proofkit.spec-proof-core.requirement-semantic-diff",
@@ -2311,6 +2399,24 @@
       "commandIds": ["proofkit.go-test"],
       "environmentClasses": ["local-go"]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-022",
+      "scenarioId": "proofkit.spec-proof-core.requirement-semantic-diff-complete-algebra",
+      "witnessId": "proofkit.requirement-semantic-diff.complete-algebra-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementdiff/requirementdiff_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-022",
+      "scenarioId": "proofkit.spec-proof-core.requirement-semantic-diff-whole-cli",
+      "witnessId": "proofkit.app.requirement-semantic-diff-cli-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/requirement_context_cli_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-023",
       "scenarioId": "proofkit.spec-proof-core.requirement-traceability-evidence-planes",
@@ -2320,6 +2426,24 @@
       "commandIds": ["proofkit.go-test"],
       "environmentClasses": ["local-go"]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-023",
+      "scenarioId": "proofkit.spec-proof-core.requirement-traceability-topology-closure",
+      "witnessId": "proofkit.requirement-traceability.topology-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementgraph/requirementgraph_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-023",
+      "scenarioId": "proofkit.spec-proof-core.requirement-traceability-whole-cli",
+      "witnessId": "proofkit.app.requirement-traceability-cli-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/requirement_context_cli_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-021",
       "scenarioId": "proofkit.spec-proof-core.requirement-browser-rendered-runtime",
@@ -2329,6 +2453,15 @@
       "commandIds": ["proofkit.browser-check"],
       "environmentClasses": ["local-node-browser"]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-021",
+      "scenarioId": "proofkit.spec-proof-core.requirement-browser-unicode-code-point-selection",
+      "witnessId": "proofkit.requirement-browser.unicode-selection-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "tests/browser/workspace.spec.mjs",
+      "commandIds": ["proofkit.browser-check"],
+      "environmentClasses": ["local-node-browser"]
+    },
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-022",
       "scenarioId": "proofkit.supply-chain-quality.browser-static-and-runtime-proof",