@research-engineering/agentic-proofkit 0.10.1 → 0.12.0

package/ADOPTION.md

@@ -217,23 +217,46 @@ Resolve the approved installed launcher for each session. An absent or
 ambiguous binding needs an owner decision, not an install, network fallback,
 package-manager default, or persisted machine-local executable path.
 
-For one manual export, first inspect the explicit repository root and every
-component of the selected path. Stop on symlinks, aliases, unknown ownership,
-local edits, or an existing target; do not overwrite it. The example below
-assumes the owner has approved the npm launcher, inspected and prepared the
-ordinary parent directories, and ensured no concurrent writer can replace
-them. Replace the example absolute root with that inspected root. The shell,
-not Proofkit, creates the file; noclobber protects an existing final file but
-does not establish race-free parent traversal or transactional installation.
+For managed installation, select the tool and root explicitly, inspect the
+plan, then apply its exact transaction and desired-state identities. The
+following example assumes a repository-approved, already installed npm
+launcher; other approved carriers expose the same logical routes. Replace the
+root and identity placeholders with the reviewed plan's values.
 
 ```bash
-(set -o noclobber; npm exec --offline -- agentic-proofkit integration source --tool codex --format text > /absolute/inspected/repository/.agents/skills/agentic-proofkit/SKILL.md)
+npm exec --offline -- agentic-proofkit integration plan --tool codex --operation install --repo-root /absolute/inspected/repository --format text
+npm exec --offline -- agentic-proofkit integration apply --tool codex --operation install --repo-root /absolute/inspected/repository --expect-transaction <reviewed-transaction-sha256-ref> --expect-desired-state <reviewed-desired-state-sha256-ref>
 npm exec --offline -- agentic-proofkit integration check --tool codex --repo-root /absolute/inspected/repository
 ```
 
-Check a failed export before treating its output as usable: shell redirection
-may leave an empty or partial new file if generation or transport fails.
-Resolve such a file manually under repository ownership; check never repairs it.
+`REQ-PROOFKIT-WORKFLOW-019` owns managed file lifecycle. Use `--operation
+update` or `--operation remove` with a fresh reviewed plan for those operations.
+The fixed bootstrap and `proofkit/integrations/<tool>.v1.json` baseline share
+one native transaction. Local byte or mode edits are conflicts, not overwrite
+permission. An exact current manually exported bootstrap can be enrolled by
+install; an unknown or stale unbaselined file requires an owner decision.
+The baseline records exact cooperative before-state, not authenticated origin.
+Removal deletes selected managed files only, leaving their directories and
+adjacent instructions. It does not archive or replace instructions with an
+empty file. Baseline-only removal can clean a valid orphan baseline.
+
+After interruption, use `integration recover --repo-root <root> --transaction
+<pending-sha256-ref> --action <resume|rollback>`. It uses the existing native
+journal, not the current bootstrap source. A completed recovery is historical
+evidence; inspect current files separately. Desired-absence journals and new
+identity-bound terminal receipts use schema v2 and require this or a later
+supporting binary. Finishing recovery alone does not establish downgrade
+compatibility; no automatic downgrade or control-state deletion is supported.
+Present-only v1 journals and historical v1 receipts remain readable. A legacy
+receipt does not bind its missing desired identity: replan before applying.
+Repeated apply checks that the retained applied transaction binds the exact
+current desired state under one native lock; pending work blocks replay.
+
+Plan and apply default to JSON. Ready plans and passed receipts exit 0;
+classified conflicts, recovery, cleanup or durability outcomes exit 1 with a
+report and empty stderr. Invocation and operational failures use stderr.
+`--format text --color auto` colors labels only on a capable TTY without
+`NO_COLOR`; the default is uncolored. Check never repairs files.
 The checker admits flags before I/O and reads only the selected fixed path
 through an application-write-free confined lease with bounded reobservation.
 Exit 0 and `current` mean exact generated-byte equality; exit 2 reports
@@ -249,8 +272,7 @@ identity when consumed projections remain unchanged. Shared native source
 digests may conservatively invalidate freshness. This is materialization
 freshness, not proof of every transitive runtime behavior.
 
-Phase5B managed install/update/remove remains open. Manual export is not an
-installer, rollback protocol, or proof of host activation. Installed npm/Python
+Managed file lifecycle is not proof of host activation. Installed npm/Python
 integration proof requires actual carrier execution; source-only tests do not
 discharge it. Native-host file discovery, body loading, and approved-launcher calls
 are separate observations requiring isolated sessions and absent/altered-file

package/docs/proofkit-contract-map.md

@@ -41,7 +41,7 @@ owner boundaries. It is not a second command-family inventory.
 
 | Family | Main commands | Caller provides | Proofkit owns | Consumer owns | Output authority |
 |---|---|---|---|---|---|
-| Agent integration generation/check | `integration source`, `integration check` | explicit `claude` or `codex` tool; explicit repository root for check only | one portable bounded bootstrap, exact consumed registered-contract identity, descriptor-owned path, and confined read-only generated-byte freshness | launcher admission, manual materialization, instruction ownership, host discovery/activation, permissions, native verification, and any future managed lifecycle | generated source or missing/current/stale/invalid freshness report; neither is installation or execution authority |
+| Agent integrations | `integration source`, `integration check`, `integration plan`, `integration apply`, `integration recover` | explicit tool for source/check/plan/apply; root for filesystem operations; operation and both reviewed identities for apply; transaction/action for recovery | one bounded renderer, read-only freshness, canonical cooperative baseline, and managed file lifecycle through the native transaction owner | launcher admission, instruction ownership, host discovery/activation, permissions and native verification | generated source, freshness classification, reviewed transaction plan or historical transaction receipt; none proves host activation |
 | Project state navigation | `status`, `next` | explicit repository root | bounded transaction-first materialized-project inspection, normalized observation identity, deterministic project-state classification, and one non-executable next action; admitted in-bound records bind exact content digests, while unread out-of-bound records intentionally identify only their invalid class | repository policy, byte identity for unread out-of-bound records, witness execution, receipt trust/currentness/scope, merge, release, deployment, rollout, and production readiness | project-status report, next-action packet, or bounded text projection |
 | Agent workflow planning | `change plan`, `native-evidence-guidance` | explicit checkpoint, completed stage ids, bounded context refs, governing authority ref, and required context ref ids | optional built-in `proofkit.reviewed-change.v1` checkpoint relation, reference-closed next-stage context, deterministic agent prompts, bounded text/JSON/envelope projections, and repository-neutral native-evidence guidance with closed applicability classes | custom workflow topology, repository state discovery, stage execution, native witness semantics, evidence collection, review conclusions, merge, release, deployment, and rollout authority | next-action plan, terminal workflow report, bounded agent envelope, or guidance catalog |
 | Adoption and scaffolding | `adopt plan`, `adopt materialize plan`, `adopt materialize apply`, `adopt materialize recover`, `repository-inventory`, `adoption-contract-envelope`, `adoption-workflow-plan`, `adoption-checklist`, `adoption-doctor`, `gradual-adoption`, `gradual-adoption-bootstrap`, `gradual-adoption-guidance`, `capability-map-admission`, `pilot-admission`, `scaffold-profile-plan`, `scaffold-project-structure`, `stack-preset` | explicit repository root, explicit fresh/code-baseline/audit-from-code intent, optional stack hint, owner-reviewed candidate packet, expected transaction and desired-state identities, recovery action, aggregate adoption contract envelope, checklist facts, target paths, owner routes, caller-extracted stale authority vocabulary facts, explicit pre-spec capability observations, and pilot records | bounded fixed-catalog root inventory, candidate-only front-door tasks, owner-closed read-only materialization plans, confined transactional apply and recovery receipts, aggregate contract-envelope admission, deterministic starter plans, checklist/report admission, bounded guidance envelopes, dry-run manifests, pre-spec trust-mode admission, adoption gap and stale-authority classification, and pilot shape admission | stack selection, arbitrary source inspection, candidate review, final requirement meaning, proof adequacy, rollout policy, text extraction, code observation extraction, and pilot truth | inventory, candidate-only plan, transaction-bound materialization plan or receipt, selected child output, report, seed packet, or agent envelope |
@@ -132,7 +132,9 @@ Semantic context routes are `requirement-context-compose`,
 
 | State or goal | Next Proofkit route | Stop or escalation condition |
 |---|---|---|
-| A repository owner requests a portable Proofkit bootstrap or its exact-byte freshness. | `integration source --tool <tool>` generates JSON or exact file bytes with `--format text`; `integration check --tool <tool> --repo-root <caller-selected-root>` checks only the selected fixed path. Select `claude` or `codex` explicitly. | Source writes nothing; neither route accepts `--output` or install. Source exits 0/1 for success/error; check exits 0 for current, 2 for missing/stale/invalid, and 1 for invocation or operation error. Current proves only generated-byte equality. Use `ADOPTION.md` for inspected manual export; Phase5B installation/update/removal and host activation remain open. |
+| A repository owner requests a portable Proofkit bootstrap or its exact-byte freshness. | `integration source --tool <tool>` generates JSON or exact file bytes with `--format text`; `integration check --tool <tool> --repo-root <caller-selected-root>` checks only the selected fixed path. Select `claude` or `codex` explicitly. | Source writes nothing; neither route accepts `--output` or install. Source exits 0/1 for success/error; check exits 0 for current, 2 for missing/stale/invalid, and 1 for invocation or operation error. Current proves only generated-byte equality. Managed lifecycle is a separate explicit route; host activation remains an independent observation. |
+| A repository owner approves managed bootstrap installation, update or removal. | `integration plan --tool <tool> --operation <operation> --repo-root <root>`; inspect both identities, then `integration apply` with the same tool/operation/root and `--expect-transaction` plus `--expect-desired-state`. | The native transaction changes only the selected bootstrap and cooperative baseline; unknown content, local edits, stale identities and invalid baselines block mutation. Ready/passed exits 0; classified conflicts or recovery states exit 1 with a report. Text/color are opt-in. |
+| A managed file transaction was interrupted. | `integration recover --repo-root <root> --transaction <pending-id> --action <action>`; select resume or rollback explicitly. | Recovery does not generate the current source or infer a tool. Its result is historical; inspect current files separately. Finish v2 desired-absence recovery before downgrading. |
 | The repository may already contain a materialized Proofkit project. | `status --repo-root <caller-selected-root>` for the full bounded classification or `next --repo-root <caller-selected-root>` for its single action projection. | Treat `verification_required` as a request to run repository-owned verification, never as completion or approval. Stop on blocked or recovery-required states; the packet does not execute its route or own policy. |
 | The agent does not know where to start. | `adopt plan --mode <mode> --repo-root <caller-selected-root>`, where mode is `fresh`, `code-baseline`, or `audit-from-code` | Choose the trust intent explicitly. Treat the fixed-catalog inventory and tasks as a read-only candidate plan; stop before arbitrary source inspection, writing files, or making requirements authoritative. |
 | An agent needs a bounded, deterministic stage transition for an engineering change. | `change plan` selects the optional built-in `proofkit.reviewed-change.v1` profile; use `--agent-envelope` for the compact work packet and `native-evidence-guidance` when the consuming repository has not yet materialized repository-specific evidence instructions. | Supply only explicit current checkpoint, completed stages, and admitted context references. Apply conditional guidance slots only when their applicability class matches a declared consumer mechanism. Stop before treating the profile, plan, or guidance as repository policy or as proof that a stage ran, evidence exists, review passed, or merge/release is authorized. |
@@ -152,6 +154,7 @@ Semantic context routes are `requirement-context-compose`,
 | Does a TypeScript package public API match a caller-owned manifest? | `agent-route` with `goal: "verify_typescript_public_api"` and explicit `typescript_public_api_manifest` plus `typescript_public_api_repo_root`, then `typescript-public-api-surfaces --repo-root <caller-selected-root>` | The manifest must name each referenced `package.json`, sorted-unique export conditions, and a non-JSX `.ts`, `.mts`, or `.cts` `sourcePath` whose canonical target has the same admitted extension class. The bounded scanner accepts only the fail-closed export grammar in `proofkit/cli-contract.v2.json`; it does not parse unrestricted TypeScript or TSX, infer conventional layouts, or prove compiler output provenance, checkout freshness, package-manager truth, or merge readiness. |
 | Receipts are available for planned checks. | `selective-gate-evidence --agent-envelope`; then materialize a caller-owned `obligation_decision_input` from the evidence output plus command routes, currentness, and trust facts; then run `selective-gate-obligation-decision-input`; then materialize the resulting `obligation_decision` input and run `obligation-decision --agent-envelope` | Escalate on missing, stale, invalid, untrusted, blocked, unavailable, or unknown-scope evidence. |
 | Human inspection, semantic comparison, or traceability navigation is needed. | `requirement-source-view`, `requirement-proof-view`, `requirement-coverage-view`, `requirement-spec-tree-view`, `requirement-semantic-diff`, `requirement-traceability-graph`, or `requirement-browser-server` | Semantic diff compares admitted owner fields rather than lines. Traceability keeps specification, proof, code, and native execution evidence planes separate. Browser and rendered outputs remain presentation only unless the consumer admits a tracked artifact freshness gate. |
+| Find a requirement in a large admitted workspace. | `requirement-browser-server --view workspace --serve --input <workspace-input>`; use Browse to select a descendant scope, owner, lifecycle, or literal search, then inspect the bounded result page. | Search covers the whole admitted cohort before paging, not just visible rows. Selection retains original source anchors; handoff adds context closure through its owner. Browse and Inspector become mutually exclusive native panels on smaller viewports. Retry preserves the failed operation, while stale snapshots require explicit reload. The browser does not execute agents or turn a lookup count into proof coverage. |
 | Temporary external document lifecycle facts, generated views, or rendered views need authority classification. | `document-lifecycle-boundary` | Treat lifecycle records as caller-owned metadata. Temporary design docs and implementation plans are not retained repository authority unless rewritten into deterministic specs, proof bindings, tests, package-public docs, or backlog rows. |
 | A JavaScript/TypeScript consumer needs less wrapper code. | `json-report-cli-adapter-source --language typescript --format json` | Generated adapter source is caller-owned after materialization. The consumer still owns package pin, binary path, repo paths, local policy, and freshness proof. It is a CLI runner adapter, not a separate SDK authority. |
 | A Python consumer needs Proofkit from Python tooling. | Install the Python package when available and invoke the same CLI/JSON contract. | The Python package is a runner wrapper over the Go CLI, not a Python SDK or alternate schema owner. |

package/docs/specs/proofkit-agent-workflow/overview.md

@@ -28,7 +28,7 @@ The public capability is deliberately small:
    bootstrap without reading repositories or writing files;
    `integration check --tool <claude|codex> --repo-root <path>` compares only
    the selected descriptor-owned file through confined read-only inspection.
-   These are generation/check targets, not managed integration support.
+   Generation/check remain read-only; separate lifecycle routes manage files.
 
 The change planner and evidence-guidance cores are stateless pure projections.
 Project status reads only an explicit repository root, the conventional routing
@@ -132,9 +132,15 @@ identity and a bounded freshness classification, never observed content, its
 digest, or caller root paths. Exit 0 means current, exit 2 means a classified
 missing/stale/invalid file, and exit 1 means an invocation or operation error.
 Source returns 0 on success and 1 on error. Neither accepts `--output` or an
-install option. Manual export guidance is owned by `ADOPTION.md`.
+install option. Managed lifecycle guidance is owned by `ADOPTION.md`.
 
-Phase5B managed installation, update, and safe removal remains explicitly open.
+`REQ-PROOFKIT-WORKFLOW-019` owns `integration plan`, `integration apply`, and
+`integration recover`. A reviewed install/update/remove changes only the
+selected bootstrap and its canonical cooperative baseline through the existing
+repository transaction owner. Both expected identities are required for apply;
+local edits or malformed baselines block mutation. Recovery uses historical
+journal state without assuming the current tool renderer. Desired absence
+selects journal v2, while present-only v1 identities and recovery remain stable.
 Host discovery, body loading, and approved-launcher invocation require separate
 isolated native-host observations; direct CLI execution cannot prove skill use.
 

package/docs/specs/proofkit-agent-workflow/requirements.v1.json

@@ -240,7 +240,7 @@
     {
       "requirementId": "REQ-PROOFKIT-WORKFLOW-018",
       "ownerId": "proofkit.agent-workflow",
-      "invariant": "Exactly two no-input commands expose Phase5A: integration-source through integration source with built_in_package_catalog scope, and integration-check through integration check with explicit_filesystem_scan scope. Both require exactly one --tool from claude/codex, admit at most one --format from json/text with JSON default, reject input transport, surplus operands, color, carrier, output-file, and install options; check additionally requires exactly one --repo-root, which source rejects. Source JSON has exactly schemaVersion, kind, tool, targetPath, integrationId, content, contentDigest, capabilityDigest, metadataBytes, bodyBytes, and nonClaims; check JSON has exactly schemaVersion, kind, tool, targetPath, integrationId, expectedContentDigest, state, and nonClaims. Both schema versions are 1; kinds are proofkit.integration-source.v1 and proofkit.integration-check.v1. Source text is the exact generated content. Source exits 0 on success and 1 on error; check exits 0 only for current, 2 for missing/stale/invalid classified reports with empty stderr, and 1 for operation or invocation error. Cancellation observed before emission and serialization/cleanup failures produce no success report. Descriptor, dispatch, help, the agent-integrations source/check-only family, root-shape definitions and their hashes, CLI contracts, contract-map routes, exact native witnesses, generated metadata, and installed npm/Python carriers must close over the same bounded invocation/output relation without a second semantic owner; native source bindings include internal/command/agentintegration. Source-carrier independence and installed-carrier execution are separate obligations. Phase5B managed install/update/remove remains open and is not discharged by generation, check, manual export, or this contract closure.",
+      "invariant": "Exactly two no-input commands expose Phase5A: integration-source through integration source with built_in_package_catalog scope, and integration-check through integration check with explicit_filesystem_scan scope. Both require exactly one --tool from claude/codex, admit at most one --format from json/text with JSON default, reject input transport, surplus operands, color, carrier, output-file, and install options; check additionally requires exactly one --repo-root, which source rejects. Source JSON has exactly schemaVersion, kind, tool, targetPath, integrationId, content, contentDigest, capabilityDigest, metadataBytes, bodyBytes, and nonClaims; check JSON has exactly schemaVersion, kind, tool, targetPath, integrationId, expectedContentDigest, state, and nonClaims. Both schema versions are 1; kinds are proofkit.integration-source.v1 and proofkit.integration-check.v1. Source text is the exact generated content. Source exits 0 on success and 1 on error; check exits 0 only for current, 2 for missing/stale/invalid classified reports with empty stderr, and 1 for operation or invocation error. Cancellation observed before emission and serialization/cleanup failures produce no success report. Descriptor, dispatch, help, the agent-integrations family, root-shape definitions and their hashes, CLI contracts, contract-map routes, exact native witnesses, generated metadata, and installed npm/Python carriers must close over the same bounded invocation/output relation without a second semantic owner; native source bindings include internal/command/agentintegration. Source-carrier independence and installed-carrier execution are separate obligations. Managed install/update/remove is a separate lifecycle contract and is not discharged by generation, check, manual export, or this contract closure.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
@@ -254,6 +254,23 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-019",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Explicit integration plan/apply/recover routes reuse the native repository transaction owner, not a second installer. Plan and apply require a selected claude/codex tool, repository root and install/update/remove operation; apply additionally binds both reviewed transaction and desired-state identities. Recognition uses only native captured before snapshots and bytes for the fixed bootstrap and proofkit/integrations/<tool>.v1.json; the baseline is bounded canonical compact JSON with one LF, exact tool/path/content digest/byte count/mode and no unknown fields. Bootstrap and baseline use mode 0644. Install creates an absent pair or enrolls exact current unbaselined bytes, but rejects unknown or stale unbaselined content and requires update for a matched older pair. Update requires a matched baseline; removal accepts a matched pair, a valid orphan baseline, or both absent. Invalid baselines, local edits, unsafe paths, stale reviewed identities and pending transactions never authorize overwrite. Both targets share one native transaction and deletion/recovery protocol; adjacent and global instructions are unchanged. Replay uses the native locked current-state replay operation. Recovery requires only root, transaction and resume/rollback action, without current source generation or tool assumptions. JSON is default; explicit text and capability-bound auto/never color preserve the same outcome. Flags, multiplicity, enumerated values and identity syntax are admitted before I/O. Ready plans and passed receipts exit 0; classified conflict, recovery, cleanup or durability reports exit 1 with empty stderr; invocation or operational errors exit 1 with non-disclosing stderr. Descriptor, help, family, machine contract, owner projections, whole-CLI tests and installed npm/Python carrier witnesses cover the same operation relation.",
+      "claimLevel": "blocking",
+      "riskClass": "critical",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-019"],
+      "nonClaims": [
+        "A completed file lifecycle does not prove host discovery, instruction loading, approved-launcher invocation, permission grants, native verification, or production readiness.",
+        "Recovery reports a historical transaction, not current installed/removed state or post-return stability; cancellation after the final effect cannot retract a committed operation.",
+        "The baseline is cooperative bookkeeping, not authenticated origin, owner approval, or protection from coordinated same-user edits or rollback."
+      ],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ],
   "nonClaims": [

package/docs/specs/proofkit-spec-proof-core/overview.md

@@ -207,6 +207,13 @@ execution receipts, and merge policy.
   change-plan route replacement, and omitted-route policy to one breaking
   release record without reinterpreting the frozen prior edge.
 
+- `REQ-PROOFKIT-SPEC-036`: full-cohort requirement lookup intersects literal
+  search, owner, lifecycle, and typed descendant scope before byte-bounded
+  paging; navigation and handoff preserve their distinct identities and closure.
+- `REQ-PROOFKIT-SPEC-037`: generation-owned requests, exact explicit Retry,
+  distinct error actions, and responsive native panels preserve keyboard
+  focus, source selection, and drafts without promoting presentation authority.
+
 ## Non-Claims
 
 - This spec does not claim consumer repository adoption.

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -676,7 +676,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-033",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "The repository-transaction owner confines every effect to one explicit repository root; freezes a bounded canonical execution plan before effects; rejects non-canonical, reserved, symlinked, case-folding, Unicode-folding, and prefix-alias target identities; keeps staged payloads, backups, ownership records, and publish temporaries in one private transaction namespace; records each created directory by exact filesystem identity; and performs each target replacement by same-filesystem atomic rename. A bounded durable journal identifies the exact before-state prefix, applied-target count, and terminal result; apply fails closed on stale state, unknown control records, and cooperative concurrency; rollback removes only transaction-owned artifacts and restores exact bytes and modes; resume and rollback are state-compatible, action-stable, cancellation-aware, and replay-idempotent; terminal receipts preserve the complete observable result until a later valid transaction replaces them. Native construction binds Apply to the complete transaction identity; public JSON re-admission remains descriptive even for empty payloads, while recovery retains its separate confined journal and staged-object admission. These guarantees cover process interruption at every injected mutation boundary but do not claim filesystem-wide atomic visibility, power-loss durability beyond successful synchronization, protection from arbitrary readers, or safety against a non-cooperative same-user process mutating the private namespace.",
+      "invariant": "The repository-transaction owner confines every effect to one explicit repository root; freezes a bounded canonical execution plan before effects; rejects non-canonical, reserved, symlinked, case-folding, Unicode-folding, and prefix-alias target identities; keeps staged payloads, backups, ownership records, and publish temporaries in one private transaction namespace; records each created directory by exact filesystem identity; and performs each target replacement by same-filesystem atomic rename. Desired absence has no mode or payload, never creates parent directories, and selects snapshot/action journal schema v2 even for unchanged absence; present-only v1 plan/journal bytes and identities remain unchanged. Delete requires exact before-image comparison, same-filesystem rollback staging, unlink, parent synchronization and observed absence; rollback must never overwrite a replacement created after deletion. Staging retains only existing changed before/after snapshots. Current-state replay requires a native unchanged plan, exact desired state, absence of pending work and the retained applied receipt binding the same desired-state identity under one existing native lock; historical terminal inspection alone cannot prove current state. New terminal receipts use schema v2 and bind desiredStateId. Legacy v1 receipts remain readable and recoverable without invented identity; acknowledgement retries require a newly reviewed plan. Interrupted terminal archival preserves the validated historical result; the current recovery action changes only the invocation projection. Retained v2 receipts require a supporting binary even after recovery completes. A bounded durable journal identifies the exact before-state prefix, applied-target count, and terminal result; apply fails closed on stale state, unknown control records, and cooperative concurrency; rollback removes only transaction-owned artifacts and restores exact bytes and modes; resume and rollback are state-compatible, action-stable, cancellation-aware, and replay-idempotent; terminal receipts preserve the complete observable result until a later valid transaction replaces them. Native construction binds Apply to the complete transaction identity; public JSON re-admission remains descriptive even for empty payloads, while recovery retains its separate confined journal and staged-object admission. These guarantees cover process interruption at every injected mutation boundary but do not claim filesystem-wide atomic visibility, power-loss durability beyond successful synchronization, protection from arbitrary readers, or safety against a non-cooperative same-user process mutating the private namespace.",
       "claimLevel": "blocking",
       "riskClass": "critical",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
@@ -711,6 +711,32 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-036",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "Workspace lookup indexes immutable admitted requirement sources once, preserves each original source digest and snapshot JSON pointer, and intersects search, owner, lifecycle, and selected-node descendant scope before stable requirement-ID paging. Scope uses only requirement-role source-ID references, never overview or path-digest aliases or inferred ancestor membership. Search applies Unicode trimming and simple lowercase independently to ID, owner, and invariant, without normalization or cross-field concatenation, after 1024-byte and 256-code-point admission bounds. Available A, matching M, and selected S counts yield filtered A-M, page-omitted M-S, and total-omitted A-S counts. Lookup does not expand lifecycle closure; handoff delegates closure to the existing context owner. Navigation projects only the root or one admitted parent's ordered child window; both lookup routes cap compact response bytes at 16 MiB without truncating invariant text and reject an unfit first row before output. Browser navigation retains at most 256 rows with explicit recovery of discarded sibling pages, while requirement paging returns to actual visited offsets rather than assuming fixed response length.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-036"],
+      "nonClaims": ["Lookup fragments do not establish source completeness outside the admitted snapshot, lifecycle-closed context, proof coverage, native execution, provider freshness, merge approval, or production readiness. Private browser HTTP routes are not a separately supported public SDK."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-037",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "The workspace has one content-generation owner and independent identity-bound navigation requests. Superseded, aborted, or collapsed-branch replies cannot replace current content, selection, focus, or request authority. Retry requires explicit activation and repeats the immutable failed method, route, snapshot, and complete query with a new request ID; unsent form edits do not alter it. Sanitized errors distinguish correction (400), denied and locked without Retry (403), stale and locked with explicit reload (409), explicit Retry for transport/429/5xx, and optional versus required unavailability (404). Responsive panels use one native modal at a time at or below 64rem, restore visible opener focus on close, and release modality on desktop resize while preserving the question draft. Inspector entry commits source selection before moving focus; content transitions clear targets and displayed packets. Navigation render commits preserve a focused node/action identity and derive protected-control state from current authority. Native page focus stays inside the open modal without trapping browser chrome. Invariants precede lazily expanded owner/non-claim details and remain source-bound through Unicode selection and handoff.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-037"],
+      "nonClaims": ["Browser runtime witnesses cover the admitted Playwright Chromium, Firefox, and WebKit scenarios, not all browser preferences, assistive technologies, operating-system themes, branded Safari behavior, complete WCAG conformance, annotation persistence, agent execution, or provider delivery."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ],
   "nonClaims": [

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.10.1",
+  "version": "0.12.0",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,
@@ -36,7 +36,7 @@
     "build": "go run ./internal/tools/packagebuild",
     "check": "npm run npm:version && npm run source-hygiene && npm run command-contract:check && npm run command-family:check && npm run text-policy && npm run mermaid:check && npm run go:check && npm run browser:check && npm run package:artifact && npm run self:receipt && npm run self:coverage && npm run release:closeout",
     "browser:check": "npm run browser:static-check && npm run browser:test",
-    "browser:static-check": "tsc -p tsconfig.browser.json && node --test scripts/browser-proof-execution.test.mjs scripts/browser-proof-inputs.test.mjs scripts/browser-selection-authority.test.mjs scripts/diagnostic-entrypoints.test.mjs scripts/stable-json.test.mjs",
+    "browser:static-check": "tsc -p tsconfig.browser.json && node --test scripts/browser-proof-execution.test.mjs scripts/browser-proof-inputs.test.mjs scripts/browser-selection-authority.test.mjs scripts/browser-workspace-requests.test.mjs scripts/diagnostic-entrypoints.test.mjs scripts/stable-json.test.mjs",
     "browser:test": "go run ./internal/tools/browserproofverify --run",
     "command-family:check": "go run ./internal/tools/commandfamilygen --check",
     "go:actionlint": "go tool actionlint",