@research-engineering/agentic-proofkit 0.2.0 → 0.3.0

package/proofkit/requirement-bindings.json

@@ -129,7 +129,7 @@
       "claimLevel": "blocking",
       "proofState": "witness_backed",
       "nonClaims": [
-        "This requirement does not claim repository scanning, native test execution, proof freshness, receipt authenticity, merge approval, or global coverage completeness outside the caller-provided universe."
+        "This requirement does not claim repository scanning, source authenticity, producer identity, selector resolution, oracle quality, native test execution, proof freshness, receipt authenticity, trust, sensitivity, assurance closure, merge approval, or global coverage completeness outside the caller-provided universe."
       ]
     },
     {
@@ -602,7 +602,7 @@
       "specPath": "docs/specs/proofkit-supply-chain-quality/requirements.v1.json",
       "claimLevel": "blocking",
       "proofState": "witness_backed",
-      "nonClaims": ["This requirement does not infer change-record completeness from source changes, make release notes approval authority, or prove provider publication, attestation authenticity, consumer adoption, rollout approval, or production readiness."]
+      "nonClaims": ["This requirement does not infer change-record completeness from source changes, reconstruct release-history migration data before the declared support baseline, claim a cumulative release-history planner, make release notes approval authority, or prove provider publication, attestation authenticity, consumer adoption, rollout approval, or production readiness."]
     },
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-025",
@@ -988,6 +988,10 @@
           "selector": "TestAdoptionContractEnvelopeCLIABI",
           "command": "go test ./internal/app -run '^TestAdoptionContractEnvelopeCLIABI$'"
         },
+        {
+          "selector": "TestRequirementAuthoringPlanOutputUsesVersionedRootShape",
+          "command": "go test ./internal/app -run '^TestRequirementAuthoringPlanOutputUsesVersionedRootShape$'"
+        },
         {
           "selector": "TestSelfCheckOutputUsesExactRootShape",
           "command": "go test ./internal/app -run '^TestSelfCheckOutputUsesExactRootShape$'"
@@ -1035,6 +1039,10 @@
         {
           "selector": "TestReceiptIDKeepsLocalAndCIIdentitiesDistinct",
           "command": "go test ./scripts -run '^TestReceiptIDKeepsLocalAndCIIdentitiesDistinct$'"
+        },
+        {
+          "selector": "TestRunInvokesEveryRequiredSelfHostingAdmissionBoundary",
+          "command": "go test ./scripts -run '^TestRunInvokesEveryRequiredSelfHostingAdmissionBoundary$'"
         }
       ],
       "commandIds": [
@@ -1448,7 +1456,53 @@
       "scenarioId": "proofkit.spec-proof-core.test-inventory-and-coverage-view",
       "witnessId": "proofkit.test-inventory-and-coverage-view.boundary",
       "witnessKind": "contract",
-      "witnessPath": "internal/command/requirementcoverageview/requirementcoverageview_test.go",
+      "witnessPath": "internal/command/requirementcoverageview/output_closure_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestAdmitOutputRejectsCompactProjectionDrift",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRejectsCompactProjectionDrift$'"
+        },
+        {
+          "selector": "TestAdmitOutputRejectsMissingInverseParentProjection",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRejectsMissingInverseParentProjection$'"
+        },
+        {
+          "selector": "TestAdmitOutputRejectsNonCanonicalWireProjectionText",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRejectsNonCanonicalWireProjectionText$'"
+        },
+        {
+          "selector": "TestAdmitOutputRejectsRemovedValidUnmappedInventoryEntry",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRejectsRemovedValidUnmappedInventoryEntry$'"
+        },
+        {
+          "selector": "TestAdmitOutputReplaysFailedInventoryQualitySemantics",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputReplaysFailedInventoryQualitySemantics$'"
+        },
+        {
+          "selector": "TestAdmitOutputReplaysFullRepositorySourceOwnerScopeFailures",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputReplaysFullRepositorySourceOwnerScopeFailures$'"
+        },
+        {
+          "selector": "TestAdmitOutputReplaysOwnerScopeFailures",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputReplaysOwnerScopeFailures$'"
+        },
+        {
+          "selector": "TestAdmitOutputRequiresEveryCoverageBasisField",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRequiresEveryCoverageBasisField$'"
+        },
+        {
+          "selector": "TestAdmitOutputRequiresEveryDeclaredRootField",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRequiresEveryDeclaredRootField$'"
+        },
+        {
+          "selector": "TestAdmitOutputRetainsFailedInventoryEntriesWithoutProjectedParents",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRetainsFailedInventoryEntriesWithoutProjectedParents$'"
+        },
+        {
+          "selector": "TestAdmitOutputValidatesEveryCoverageRowMetadataField",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputValidatesEveryCoverageRowMetadataField$'"
+        }
+      ],
       "commandIds": [
         "proofkit.go-test"
       ],
@@ -1469,12 +1523,56 @@
         "local-go"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-006",
+      "scenarioId": "proofkit.spec-proof-core.declared-route-mapping-without-assurance",
+      "witnessId": "proofkit.requirement-coverage.declared-route-mapping-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementcoverageview/requirementcoverageview_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildJSONMissingSelectorRemainsMappingOnly",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestBuildJSONMissingSelectorRemainsMappingOnly$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-007",
+      "scenarioId": "proofkit.spec-proof-core.canonical-command-input-admission",
+      "witnessId": "proofkit.app.required-input-command-admission",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/command_coverage_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestRequiredInputCommandsRejectMalformedCallerRecords",
+          "command": "go test ./internal/app -run '^TestRequiredInputCommandsRejectMalformedCallerRecords$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-007",
       "scenarioId": "proofkit.spec-proof-core.canonical-input-admission",
       "witnessId": "proofkit.admission.decode-typed-json-canonical-record",
       "witnessKind": "contract",
       "witnessPath": "internal/kernel/admission/json_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestDecodeTypedJSONUsesStrictAdmission",
+          "command": "go test ./internal/kernel/admission -run '^TestDecodeTypedJSONUsesStrictAdmission$'"
+        }
+      ],
       "commandIds": [
         "proofkit.go-test"
       ],
@@ -1643,6 +1741,25 @@
         "local-go"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-012",
+      "scenarioId": "proofkit.spec-proof-core.requirement-authoring-ref-provenance",
+      "witnessId": "proofkit.requirement-authoring-plan.authoring-ref-provenance-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementauthoringplan/requirement_authoring_plan_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildPreservesDigestBoundAuthoringRefIdentity",
+          "command": "go test ./internal/command/requirementauthoringplan -run '^TestBuildPreservesDigestBoundAuthoringRefIdentity$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-013",
       "scenarioId": "proofkit.spec-proof-core.private-proof-vocabulary-owner",
@@ -1701,6 +1818,12 @@
       "witnessId": "proofkit.receipt-trust-status-vocabulary.command-admission",
       "witnessKind": "contract",
       "witnessPath": "internal/command/receipttrustclass/receipt_trust_class_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildRejectsHigherRankThatWeakensMinimumTrustSemantics",
+          "command": "go test ./internal/command/receipttrustclass -run '^TestBuildRejectsHigherRankThatWeakensMinimumTrustSemantics$'"
+        }
+      ],
       "commandIds": [
         "proofkit.go-test"
       ],
@@ -1908,7 +2031,13 @@
       "scenarioId": "proofkit.consumer-infra-retirement.migration-parity-admission",
       "witnessId": "proofkit.migration-parity-admission.boundary",
       "witnessKind": "contract",
-      "witnessPath": "internal/app/self_hosting_semantics_test.go",
+      "witnessPath": "internal/command/migrationparityadmission/migrationparityadmission_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildProjectsEveryCallerDeclaredStatusAndSummaryField",
+          "command": "go test ./internal/command/migrationparityadmission -run '^TestBuildProjectsEveryCallerDeclaredStatusAndSummaryField$'"
+        }
+      ],
       "commandIds": [
         "proofkit.go-test"
       ],
@@ -2033,6 +2162,10 @@
           "selector": "TestAdoptionContractEnvelopeCLIABI",
           "command": "go test ./internal/app -run '^TestAdoptionContractEnvelopeCLIABI$'"
         },
+        {
+          "selector": "TestRequirementAuthoringPlanOutputUsesVersionedRootShape",
+          "command": "go test ./internal/app -run '^TestRequirementAuthoringPlanOutputUsesVersionedRootShape$'"
+        },
         {
           "selector": "TestRequirementBrowserOneShotCLIOutputVariants",
           "command": "go test ./internal/app -run '^TestRequirementBrowserOneShotCLIOutputVariants$'"
@@ -2132,7 +2265,13 @@
       "scenarioId": "proofkit.supply-chain-quality.cli-output-schema-evolution",
       "witnessId": "proofkit.cli-contract.output-schema-evolution",
       "witnessKind": "contract",
-      "witnessPath": "internal/app/app_test.go",
+      "witnessPath": "internal/app/cli_contract_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestRequirementCoverageViewBreakingRootUsesVersionedOutputContract",
+          "command": "go test ./internal/app -run '^TestRequirementCoverageViewBreakingRootUsesVersionedOutputContract$'"
+        }
+      ],
       "commandIds": [
         "proofkit.go-test"
       ],
@@ -2243,6 +2382,10 @@
           "selector": "TestBindingWitnessSelectorsRejectNonTestAndBuildExcludedFiles",
           "command": "go test ./internal/tools/coveragemetrics -run '^TestBindingWitnessSelectorsRejectNonTestAndBuildExcludedFiles$'"
         },
+        {
+          "selector": "TestBindingWitnessSelectorsRejectVacuousTestBody",
+          "command": "go test ./internal/tools/coveragemetrics -run '^TestBindingWitnessSelectorsRejectVacuousTestBody$'"
+        },
         {
           "selector": "TestBindingWitnessSelectorsRequireExactCriticalInventories",
           "command": "go test ./internal/tools/coveragemetrics -run '^TestBindingWitnessSelectorsRequireExactCriticalInventories$'"
@@ -2492,6 +2635,12 @@
       "witnessId": "proofkit.release-closeout.completion-criteria-gate",
       "witnessKind": "contract",
       "witnessPath": "internal/tools/releasecloseoutinput/main_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildInputFailsClosedForEachBlockingEvidenceClass",
+          "command": "go test ./internal/tools/releasecloseoutinput -run '^TestBuildInputFailsClosedForEachBlockingEvidenceClass$'"
+        }
+      ],
       "commandIds": [
         "proofkit.go-test",
         "proofkit.package-gate"
@@ -2790,11 +2939,46 @@
       ]
     },
     {
-      "requirementId": "REQ-PROOFKIT-QUALITY-019",
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
       "scenarioId": "proofkit.supply-chain-quality.release-manifest-json-abi-registry-evidence",
       "witnessId": "proofkit.release-manifest.json-abi-registry-evidence",
       "witnessKind": "contract",
       "witnessPath": "internal/tools/releasemanifest/main_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestNPMRegistryPublicationRequiresTypedAuthorityEvidence",
+          "command": "go test ./internal/tools/releasemanifest -run '^TestNPMRegistryPublicationRequiresTypedAuthorityEvidence$'"
+        },
+        {
+          "selector": "TestNPMRegistryAuthorityFlowsFromAdmittedFileToPublishedChannel",
+          "command": "go test ./internal/tools/releasemanifest -run '^TestNPMRegistryAuthorityFlowsFromAdmittedFileToPublishedChannel$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.go-test",
+        "proofkit.package-artifact"
+      ],
+      "environmentClasses": [
+        "local-go",
+        "local-go-python"
+      ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "scenarioId": "proofkit.supply-chain-quality.npm-registry-authority-producer",
+      "witnessId": "proofkit.npm-registry.authority-producer",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/npmregistry/main_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestRunBuildsCanonicalTypedRegistryEvidence",
+          "command": "go test ./internal/tools/npmregistry -run '^TestRunBuildsCanonicalTypedRegistryEvidence$'"
+        },
+        {
+          "selector": "TestRunRejectsRegistryPackageSetSubstitution",
+          "command": "go test ./internal/tools/npmregistry -run '^TestRunRejectsRegistryPackageSetSubstitution$'"
+        }
+      ],
       "commandIds": [
         "proofkit.go-test",
         "proofkit.package-artifact"
@@ -2804,6 +2988,26 @@
         "local-go-python"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "scenarioId": "proofkit.supply-chain-quality.npm-registry-workflow-delegation",
+      "witnessId": "proofkit.release-workflow.npm-registry-owner-delegation",
+      "witnessKind": "contract",
+      "witnessPath": "scripts/validate-self-hosting-receipts_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestReleaseWorkflowDelegatesNPMRegistryEvidenceToRepositoryOwner",
+          "command": "go test ./scripts -run '^TestReleaseWorkflowDelegatesNPMRegistryEvidenceToRepositoryOwner$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.actionlint",
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-003",
       "scenarioId": "proofkit.supply-chain-quality.fuzz-property-boundaries",
@@ -2837,6 +3041,10 @@
       "witnessKind": "contract",
       "witnessPath": "scripts/workflow_security_scanner_oracles_test.go",
       "witnessSelectors": [
+        {
+          "selector": "TestOSVSourceScanFailsForEveryNonzeroScannerStatus",
+          "command": "go test ./scripts -run '^TestOSVSourceScanFailsForEveryNonzeroScannerStatus$'"
+        },
         {
           "selector": "TestSecurityScannerWorkflowsSeparateProviderPublicationPermissions",
           "command": "go test ./scripts -run '^TestSecurityScannerWorkflowsSeparateProviderPublicationPermissions$'"
@@ -2853,16 +3061,48 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-001",
       "scenarioId": "proofkit.supply-chain-quality.release-attestation-wiring",
-      "witnessId": "proofkit.release-workflow.attestation-wiring",
-      "witnessKind": "technical",
-      "witnessPath": ".github/workflows/release.yml",
+      "witnessId": "proofkit.release-workflow.attestation-and-retention-wiring",
+      "witnessKind": "contract",
+      "witnessPath": "scripts/validate-self-hosting-receipts_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestReleaseWorkflowRetainsReleaseAssetAndPostCreateEvidenceClosure",
+          "command": "go test ./scripts -run '^TestReleaseWorkflowRetainsReleaseAssetAndPostCreateEvidenceClosure$'"
+        }
+      ],
       "commandIds": [
-        "proofkit.actionlint"
+        "proofkit.actionlint",
+        "proofkit.go-test"
       ],
       "environmentClasses": [
         "local-go"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-001",
+      "scenarioId": "proofkit.supply-chain-quality.retained-evidence-manifest",
+      "witnessId": "proofkit.retained-evidence.downloadable-topology",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/retainedevidence/manifest_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestManifestRejectsUnboundAttestationAndSymlink",
+          "command": "go test ./internal/tools/retainedevidence -run '^TestManifestRejectsUnboundAttestationAndSymlink$'"
+        },
+        {
+          "selector": "TestManifestUsesDownloadableArtifactPaths",
+          "command": "go test ./internal/tools/retainedevidence -run '^TestManifestUsesDownloadableArtifactPaths$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.go-test",
+        "proofkit.package-artifact"
+      ],
+      "environmentClasses": [
+        "local-go",
+        "local-go-python"
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-002",
       "scenarioId": "proofkit.supply-chain-quality.release-sbom",
@@ -3144,6 +3384,12 @@
       "witnessId": "proofkit.retained-evidence.download-layout-falsifier",
       "witnessKind": "contract",
       "witnessPath": "internal/tools/retainedevidence/manifest_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestVerifyRejectsManifestAddressDrift",
+          "command": "go test ./internal/tools/retainedevidence -run '^TestVerifyRejectsManifestAddressDrift$'"
+        }
+      ],
       "commandIds": ["proofkit.go-test"],
       "environmentClasses": ["local-go"]
     },
@@ -3153,6 +3399,46 @@
       "witnessId": "proofkit.release-closeout.change-record-falsifier",
       "witnessKind": "contract",
       "witnessPath": "internal/tools/releasecloseoutinput/main_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildInputFailsClosedForEachBlockingEvidenceClass",
+          "command": "go test ./internal/tools/releasecloseoutinput -run '^TestBuildInputFailsClosedForEachBlockingEvidenceClass$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "scenarioId": "proofkit.supply-chain-quality.release-predecessor-lineage",
+      "witnessId": "proofkit.release-preflight.predecessor-lineage-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/releasepreflight/main_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestValidateNPMReleaseLineage",
+          "command": "go test ./internal/tools/releasepreflight -run '^TestValidateNPMReleaseLineage$'"
+        },
+        {
+          "selector": "TestRunNPMLineageUsesAdmittedRecordAndProviderIdentity",
+          "command": "go test ./internal/tools/releasepreflight -run '^TestRunNPMLineageUsesAdmittedRecordAndProviderIdentity$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-024",
+      "scenarioId": "proofkit.supply-chain-quality.release-predecessor-lineage-workflow",
+      "witnessId": "proofkit.release-workflow.predecessor-lineage-oracle",
+      "witnessKind": "contract",
+      "witnessPath": "scripts/validate-self-hosting-receipts_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestReleaseWorkflowCandidateEvidenceAllowsExistingNPMByteMatch",
+          "command": "go test ./scripts -run '^TestReleaseWorkflowCandidateEvidenceAllowsExistingNPMByteMatch$'"
+        }
+      ],
       "commandIds": ["proofkit.go-test"],
       "environmentClasses": ["local-go"]
     },

package/proofkit/witness-plan.json

@@ -771,6 +771,7 @@
         "internal/kernel/compactproofcontract",
         "internal/kernel/digest",
         "internal/kernel/markdownfmt",
+        "internal/kernel/proofvocab",
         "internal/kernel/report",
         "internal/kernel/secretjson",
         "internal/kernel/stablejson",
@@ -935,7 +936,7 @@
       ],
       "exclusiveLocks": [],
       "sideEffectClass": "local_write",
-      "deterministicOutput": true,
+      "deterministicOutput": false,
       "cacheAdmissionRefs": [],
       "retryPolicy": {
         "kind": "none",