@research-engineering/agentic-proofkit 0.2.1 → 0.3.0

package/ADOPTION.md

@@ -163,7 +163,7 @@ caller-owned capability or test observations
 
 Use `test-evidence-inventory --projection discovery-draft` only for explicit
 caller-owned test discovery facts. The command does not scan repositories,
-execute tests, emit `semantic_falsifier` evidence, or close coverage. It emits
+execute tests, emit execution-backed semantic evidence, or close coverage. It emits
 candidate inventory guidance with a non-strict candidate authority so an agent
 can ask the right owner questions and materialize strict inventory rows later.
 Candidate inventory diagnostics are rejected by strict inventory admission until

package/docs/proofkit-contract-map.md

@@ -42,7 +42,7 @@ owner boundaries. It is not a second command-family inventory.
 | Adoption and scaffolding | `init`, `adoption-contract-envelope`, `adoption-workflow-plan`, `adoption-checklist`, `adoption-doctor`, `gradual-adoption`, `gradual-adoption-bootstrap`, `gradual-adoption-guidance`, `capability-map-admission`, `pilot-admission`, `scaffold-profile-plan`, `scaffold-project-structure`, `stack-preset` | adoption intent, aggregate adoption contract envelope, checklist facts, target paths, owner routes, caller-extracted stale authority vocabulary facts, explicit pre-spec capability observations, pilot records, stack preset id, optional init preset id | dry-run route selection, aggregate contract-envelope admission, deterministic starter plans, checklist/report admission, bounded guidance envelopes, dry-run manifests, pre-spec trust-mode admission, adoption gap and stale-authority classification, pilot shape admission | final files, final requirements, rollout policy, text extraction from files, code observation extraction, pilot truth | selected child output, plan, report, seed packet, or agent envelope |
 | Requirement source | `capability-map-admission`, `requirement-authoring-plan`, `requirement-source-admission`, `requirement-source-transition`, `spec-overview-claims`, `requirement-spec-tree`, `requirement-spec-tree-view`, `requirement-source-view`, `requirement-browser-server` | `requirements.v1.json`, caller-owned capability maps, caller-owned authoring facts, overview claim extraction, explicit spec hierarchy, view options | candidate seed admission, candidate-only authoring packets, source-shape admission, lifecycle checks, explicit tree topology/source-ref admission, shared safe renderer fragments, presentation-only views | requirement meaning, extraction completeness, Markdown extraction completeness, hierarchy ownership, proof adequacy, file materialization | capability map report, authoring packet, source report, spec-tree report, rendered view, or browser presentation |
 | Requirement proof binding | `requirement-bindings`, `binding-partition`, `proof-slice`, `evidence-graph`, `requirement-proof-resolver`, `requirement-proof-source-set`, `requirement-proof-view`, `spec-proof-bundle-admission` | requirement records, bindings, witness commands, source-set facts, receipt reports, partition policy | graph validation, binding partition projection, compact slices, typed compact proof contract projections, resolver projections, bundle linkage checks | test semantics, witness execution, proof freshness, merge policy | proof report, partition report, slice, lookup graph, or view |
-| Test inventory and coverage | `test-evidence-inventory`, `test-evidence-inventory --projection discovery-draft`, `test-evidence-inventory --normalized-inventory`, `requirement-coverage-input-compose`, `requirement-coverage-view`, `requirement-browser-server --view coverage` | caller-owned direct or source-set test inventory, caller-owned explicit test discovery facts, declared quality findings, requirement source, proof binding or compact proof contract, coverage universe, optional owner-invariant registry, aggregate coverage compose input | strict inventory/source-set admission, candidate-only discovery draft projection, fail-closed normalized inventory projection, deterministic coverage-view input composition from explicit facts, weak-oracle and declared-quality classification, bounded agent action guidance, requirement/test/command/owner-invariant joins, nonsemantic command-evidence classification, stable coverage failure/warning classifications, presentation-only coverage view | inventory completeness, weak-test truth, test discovery extraction, native test execution, receipt freshness, producer trust, merge policy | candidate inventory guidance, inventory report, normalized inventory data product, coverage-view input, coverage view, or browser presentation |
+| Test inventory and coverage | `test-evidence-inventory`, `test-evidence-inventory --projection discovery-draft`, `test-evidence-inventory --normalized-inventory`, `requirement-coverage-input-compose`, `requirement-coverage-view`, `requirement-browser-server --view coverage` | caller-owned direct or source-set test inventory, caller-owned explicit test discovery facts, declared quality findings, requirement source, proof binding or compact proof contract, coverage universe, optional owner-invariant registry, aggregate coverage compose input | strict inventory/source-set admission, candidate-only discovery draft projection, fail-closed normalized inventory projection, deterministic coverage-view input composition from explicit facts, missing declared assertion-signal and declared-quality classification, bounded agent action guidance, requirement/test/command/owner-invariant joins, nonsemantic command-evidence classification, stable coverage failure/warning classifications, presentation-only coverage view | inventory completeness, oracle quality, test quality, test discovery extraction, native test execution, receipt freshness, producer trust, merge policy | candidate inventory guidance, inventory report, normalized inventory data product, coverage-view input, coverage view, or browser presentation |
 | Selective planning | `changed-path-set`, `requirement-impact-input-compose`, `impact`, `selective-gate-plan`, `selective-gate-evidence`, `selective-gate-obligation-decision-input`, `proof-obligation-algebra`, `obligation-decision` | changed paths, base/current requirement sources, base/current single-binding-per-requirement proof contracts, generated-artifact policy, local environment policy, proof-like path policy, scan obligation ownership, planned receipts, obligation routes, obligation algebra records | fail-closed impact input composition, fail-closed planning, receipt comparison, obligation algebra admission, bounded agent packets | git diff truth, repository scanning, command execution, producer trust, final admission | composed impact input, plan, evidence report, obligation algebra report, or obligation input |
 | Receipts and producers | `proof-receipt-admission`, `receipt-producer-admission`, `receipt-currentness-scope`, `receipt-trust-class`, `producer-policy-self-proof` | receipt sets, producer policy, scope/currentness facts, trust classes | receipt shape, producer/receipt compatibility, self-proof diagnostics | producer authentication, freshness policy, CI trust roots | receipt/provenance report |
 | Release and deployment | `release-authority`, `external-consumer`, `registry-consumer-proof-input-compose`, `registry-consumer`, `deployment-evidence-admission`, `completion-criteria`, `branch-authority`, `readiness-closeout` | package facts, tarball/registry facts, explicit primitive registry/install/smoke facts, deployment evidence, criteria, branch facts | artifact/channel boundary checks, registry-consumer input composition, release diagnostics, falsifiable criteria shape | package publication, registry fetch, package-manager execution, deployment, rollback, approval | composed input, release/deployment/readiness report |
@@ -131,7 +131,7 @@ Semantic context routes are `requirement-context-compose`,
 | An agent needs a bounded semantic subset instead of whole specification files. | `requirement-context-compose --repo-root <caller-selected-root>` over an explicit catalog, then `requirement-context-slice` over the materialized snapshot. | The snapshot and slice are content-bound derived projections. Stop before inferring hierarchy, scanning ambient paths, treating omissions as absence, or promoting the slice to requirement, proof, freshness, or merge authority. |
 | Overview prose may contain durable claims. | `spec-overview-claims` | Escalate when normative claims are not tied to `REQ-*` records. |
 | Requirements have no verified proof route. | `requirement-bindings`, `witness-plan` from either an explicit `witness_command_catalog` or a complete `binding_witness_plan_input`, `proof-slice`, or `requirement-proof-resolver` | Stop before claiming proof adequacy; native witness semantics stay with the consumer. A binding-derived witness plan still needs caller-owned vocabulary and conservative command policy. |
-| Tests or proof evidence need inventory. | `test-evidence-inventory`; use `--projection discovery-draft` only for explicit discovered-test facts, then `requirement-coverage-input-compose` when an aggregate `coverage_compose_input` exists, then `requirement-coverage-view` when a `coverage_view_input` exists | Compose only from explicit caller-owned facts. Discovery drafts are candidate-only and cannot close coverage. Use `failureClassifications[]`, `warningClassifications[]`, and `agentActionPlan[]` for machine routing. Escalate when tests are route-only, weak-oracle, unbound, or outside the caller-owned coverage universe. |
+| Tests or proof evidence need inventory. | `test-evidence-inventory`; use `--projection discovery-draft` only for explicit discovered-test facts, then `requirement-coverage-input-compose` when an aggregate `coverage_compose_input` exists, then `requirement-coverage-view` when a `coverage_view_input` exists | Compose only from explicit caller-owned facts. Discovery drafts are candidate-only and cannot close coverage. Use `failureClassifications[]`, `warningClassifications[]`, and `agentActionPlan[]` for machine routing. Escalate when tests are route-only, lack a declared assertion signal, are unbound, or are outside the caller-owned coverage universe. Proofkit reports declared signals; the consumer owns oracle-quality and test-quality conclusions. |
 | A change set is known. | `changed-path-set`, optionally `requirement-impact-input-compose`, `impact`, then `selective-gate-plan --agent-envelope` | Raw `knownChangedPaths` in `agent-route` are diagnostic only. Materialize a caller-owned `changed_path_set`, compose a caller-owned `impact_input` before `impact`, and compose a caller-owned `selective_gate_plan_input` before `selective-gate-plan`. Use `scanObligation` to name whether a `text-policy`, `secret-scan`, or caller-owned external scanner is required. Fail closed on unknown scope, dynamic edges, missing owner routes, unbound proof-like paths, or full-gate escalation. |
 | Caller-owned file contents need secret-like text detection. | `secret-scan` | Provide explicit sorted file inventory with content. Stop before claiming repository-wide discovery, credential validity, provider ingestion, merge readiness, or replacement of GitHub secret scanning. |
 | Does a TypeScript package public API match a caller-owned manifest? | `agent-route` with `goal: "verify_typescript_public_api"` and explicit `typescript_public_api_manifest` plus `typescript_public_api_repo_root`, then `typescript-public-api-surfaces --repo-root <caller-selected-root>` | The manifest must name each referenced `package.json`, sorted-unique export conditions, and a non-JSX `.ts`, `.mts`, or `.cts` `sourcePath` whose canonical target has the same admitted extension class. The bounded scanner accepts only the fail-closed export grammar in `proofkit/cli-contract.v2.json`; it does not parse unrestricted TypeScript or TSX, infer conventional layouts, or prove compiler output provenance, checkout freshness, package-manager truth, or merge readiness. |

package/docs/specs/proofkit-consumer-infra-retirement/overview.md

@@ -30,9 +30,11 @@ approval, rollout approval, and production decisions.
   gradual adoption, and release-channel scenarios to existing Proofkit
   primitives through bounded structured command refs.
 - `REQ-PROOFKIT-RETIRE-006`: migration parity admission validates
-  caller-provided parity evidence shape, source/target closure, typed
-  equivalence dimensions, and matched digest equality without owning evidence
-  authenticity, freshness, semantic correctness, or retirement approval.
+  caller-provided parity-claim shape, source/target closure, typed equivalence
+  dimensions, consistency between caller-declared status and supplied digests,
+  and lossless record-level non-claim projection without owning digest
+  computation, evidence authenticity, freshness, semantic correctness, or
+  retirement approval.
 - `REQ-PROOFKIT-RETIRE-007`: gradual adoption guidance keeps caller-provided
   candidate boundaries advisory, exposes owner-review questions, routes mode
   and checked-scope semantics through one private owner, and fails closed for

package/docs/specs/proofkit-consumer-infra-retirement/requirements.v1.json

@@ -143,7 +143,7 @@
     {
       "requirementId": "REQ-PROOFKIT-RETIRE-006",
       "ownerId": "proofkit.consumer-infra-retirement",
-      "invariant": "Migration parity admission validates caller-provided parity evidence shape, source/target closure, typed equivalence dimensions, and matched digest equality without owning evidence authenticity, freshness, semantic correctness, or retirement approval.",
+      "invariant": "Migration parity admission validates caller-provided parity-claim shape, source/target closure, typed equivalence dimensions, consistency between caller-declared status and caller-supplied digests, and lossless record-level non-claim projection; statuses, admitted parity claim refs, and status-derived parity counters remain explicitly caller-declared, structural and failure counts remain Proofkit-computed admission facts, and the report does not own digest computation, evidence authenticity, freshness, semantic correctness, or retirement approval.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": [

package/docs/specs/proofkit-spec-proof-core/overview.md

@@ -49,8 +49,21 @@ execution receipts, and merge policy.
   owners, scope widening, fabricated normalized inventory, non-strict
   discovery candidate inventory, nonsemantic command evidence, and declared
   dead zones in selected-owner or full-repository scopes, and do not treat
-  proof routes, discovery drafts, nonsemantic command evidence, normalized
-  projections, composed inputs, or rendered views as semantic test coverage.
+  caller-authored route, falsifier, oracle-signal, or falsifier-supersession
+  metadata as selector resolution, oracle review, execution, freshness, trust,
+  sensitivity, dominance proof, verified coverage, or assurance closure;
+  discovery classifies only declared assertion-signal presence and coverage
+  re-admission requires the versioned exact root and row shapes, canonical row
+  order, exact row metadata, command-owned non-claims, exact missing-inventory
+  diagnostics, owner-scoped compact scenario identities, and a coverage basis
+  that commits to selected owners, full-repository out-of-scope source
+  identities, and the complete retained inventory projection; it retains
+  complete inventory entries without selected parents, replays owner-scope and
+  inventory-owned failure semantics, and rejects missing projection fields,
+  contradictory repeated projections, one-sided retained parent references,
+  compact scenario-to-route drift, and unowned or inconsistent state/class
+  vocabulary. The coverage basis proves internal projection consistency, not
+  source authenticity or producer identity.
 - `REQ-PROOFKIT-SPEC-007`: caller-owned inputs are admitted into canonical
   immutable records before any proof, policy, route, rendering, or report
   decision consumes them.
@@ -80,9 +93,10 @@ execution receipts, and merge policy.
   policy.
 - `REQ-PROOFKIT-SPEC-012`: requirement authoring plans package caller-provided
   design, implementation, PR, code, test, and clarification facts into
-  candidate-only requirement updates, delegate structural checks to requirement
-  source admission and transition, and keep owner review/materialization outside
-  Proofkit.
+  candidate-only requirement updates, preserve complete canonically ordered
+  admitted authoring references, consume requirement records only through
+  canonical owner projections, delegate structural checks to requirement source
+  admission and transition, and keep owner review/materialization outside Proofkit.
 - `REQ-PROOFKIT-SPEC-013`: repeated cross-command proof vocabulary has one
   private owner for proof and selective-edge state while command-local and
   caller-owned vocabularies stay outside the shared owner.

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -143,7 +143,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-006",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Test evidence inventory, explicit test-discovery draft projections, proof-binding-derived inventory projections, normalized inventory projections, coverage-view input composition, and requirement coverage views classify or assemble caller-owned test-to-requirement, command, witness, owner-invariant, quality-finding, and declared-surface routes with stable machine-readable failure and warning classifications plus bounded agent action guidance while preserving source-set entry provenance, failing closed on structured selector/sourcePath drift, command-ref collisions, missing requirement owners, scope widening, fabricated normalized inventory, non-strict discovery candidate inventory, nonsemantic command evidence, and declared dead zones in selected-owner or full-repository scopes, and without treating proof routes, discovery drafts, nonsemantic command evidence, normalized projections, composed inputs, generated guidance, or rendered views as semantic test coverage.",
+      "invariant": "Test evidence inventory, explicit test-discovery draft projections, proof-binding-derived inventory projections, normalized inventory projections, coverage-view input composition, and requirement coverage views classify or assemble caller-owned test-to-requirement, command, witness, owner-invariant, quality-finding, and declared-surface routes with stable machine-readable failure and warning classifications plus bounded agent action guidance while preserving source-set entry provenance, failing closed on structured selector/sourcePath drift, command-ref collisions, missing requirement owners, scope widening, fabricated normalized inventory, non-strict discovery candidate inventory, nonsemantic command evidence, and declared dead zones in selected-owner or full-repository scopes; caller-authored route, falsifier, oracle-signal, and falsifier-supersession metadata emits only explicit declaration or mapping states, discovery classifies only the presence of admitted assertion-signal categories, coverage output re-admission requires the versioned exact root and row shapes, canonical row order, exact row metadata, command-owned non-claims, exact missing-inventory diagnostics, owner-scoped compact scenario identities, and a coverage basis committing to selected owners, full-repository out-of-scope source identities, and the complete retained inventory projection, retains complete inventory entries even when no selected parent references them, replays owner-scope and inventory-owned failure semantics, and rejects missing projected fields, contradictory repeated projections, one-sided retained parent references, compact scenario-to-route projection drift, and unowned or inconsistent state/class vocabulary, and no such metadata or coverage-basis commitment can emit source authenticity, producer identity, selector-resolution, oracle-review, execution, freshness, trust, sensitivity, dominance-proof, verified, covered, or assurance-closure facts.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": [
@@ -153,7 +153,7 @@
         "NC-PROOFKIT-SPEC-006"
       ],
       "nonClaims": [
-        "This requirement does not claim repository scanning, native test execution, proof freshness, receipt authenticity, merge approval, or global coverage completeness outside the caller-provided universe."
+        "This requirement does not claim repository scanning, source authenticity, producer identity, selector resolution, oracle quality, native test execution, proof freshness, receipt authenticity, trust, sensitivity, assurance closure, merge approval, or global coverage completeness outside the caller-provided universe."
       ],
       "lifecycle": {
         "state": "active",
@@ -305,7 +305,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-012",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Requirement authoring plans admit caller-provided design, implementation, pull request, code, test, and clarification facts into candidate-only requirement updates, delegate candidate source and lifecycle checks to requirement-source admission and transition, and emit owner-review plans without reading repositories, writing files, inferring requirement meaning, or approving promotion.",
+      "invariant": "Requirement authoring plans admit caller-provided design, implementation, pull request, code, test, and clarification facts into candidate-only requirement updates, preserve every admitted authoring reference as a canonically ordered lossless projection of refId, kind, path, optional digest, summary, and nonClaims, consume current and candidate requirement records only through canonical requirement-source owner projections, delegate candidate source and lifecycle checks to requirement-source admission and transition, and emit owner-review plans without reading repositories, writing files, inferring requirement meaning, or approving promotion.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": [

package/docs/specs/proofkit-supply-chain-quality/overview.md

@@ -102,7 +102,12 @@ vulnerability absence, or consumer rollout safety by itself.
   fields after validation.
 - `REQ-PROOFKIT-QUALITY-015`: the package gate includes an admitted release
   closeout completion-criteria report so unit tests alone cannot satisfy
-  release closeout.
+  release closeout, and coverage-metric re-admission uses overflow-safe exact
+  producer relations plus the complete command inventory, and compares both
+  coverage command projections with the actual `cli-contract.v2.json` command
+  inventory from the same source snapshot, so neither an impossible count
+  partition nor a coordinated same-size command substitution can satisfy
+  closeout.
 - `REQ-PROOFKIT-QUALITY-016`: release platform targets use one private owner
   that projects platform suffixes, Go build targets, npm OS/CPU metadata,
   package tar entries, Python wheel tags, PyPI candidate completeness,

package/docs/specs/proofkit-supply-chain-quality/requirements.v1.json

@@ -129,7 +129,7 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-010",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "Coverage metrics report requirement, binding, witness, CLI inventory linkage, and descriptor-owned command proof-route candidates from admitted test-evidence-inventory rows, failing closed independently for each requirement/proof linkage dead-zone class and each missing-candidate, unknown-candidate-ref, unknown-semantic-ref, contract-only, or route-only command-route class; source-checkout witness selectors must resolve to valid functions in active Go test files with exact executable commands and a failure-capable assertion candidate outside literal-dead branches, uninvoked closures, and skip-bearing helper paths, critical anti-vacuity scenarios must retain their exact closed selector inventories, and failed command-route inventory admission also fails closed, while static route metadata, prose, source markers, test existence, and failure-capable syntax remain candidate evidence and cannot satisfy semantic_falsifier coverage.",
+      "invariant": "Coverage metrics report requirement, binding, witness, CLI inventory linkage, and descriptor-owned command proof-route candidates from admitted test-evidence-inventory rows, failing closed independently for each requirement/proof linkage dead-zone class and each missing-candidate, unknown-candidate-ref, unknown-declared-semantic-route-ref, contract-only, or route-only command-route class; source-checkout witness selectors must resolve to valid functions in active Go test files with exact executable commands and a failure-capable assertion candidate outside literal-dead branches, uninvoked closures, and skip-bearing helper paths, critical anti-vacuity scenarios must retain their exact closed selector inventories, and failed command-route inventory admission also fails closed, while static route metadata, prose, source markers, test existence, and failure-capable syntax remain candidate evidence and cannot become execution-backed semantic evidence.",
       "claimLevel": "blocking",
       "riskClass": "medium",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
@@ -194,7 +194,7 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-015",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "The package gate includes an admitted release closeout completion-criteria report that classifies package artifacts, Python wrappers, release manifest, SBOM, channel scope, and self-hosting evidence instead of allowing unit tests alone to satisfy release closeout.",
+      "invariant": "The package gate includes an admitted release closeout completion-criteria report that classifies package artifacts, Python wrappers, release manifest, SBOM, channel scope, and self-hosting evidence instead of allowing unit tests alone to satisfy release closeout; coverage-metric re-admission uses overflow-safe relations to require the exact producer projection between admitted entries, routes, route classes, proof-route candidates, the complete command inventory, and commands missing declaration-only routes, and compares both coverage command projections with the actual cli-contract.v2.json command inventory from the same source snapshot.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,

package/proofkit/cli-contract.v2.json

@@ -510,7 +510,7 @@
         "rootDefinitionDigest": "sha256:fd1121285d1b357ed848febc248700a75417d06619e22ed36991631d7526375b",
         "nativeSource": {
           "path": "internal/command/agentroute",
-          "canonicalDigest": "sha256:bcbf099540f203e32c0b6d9cb38dff0dc20e8018644569d647d2979d0d74ac15",
+          "canonicalDigest": "sha256:21ffaf8d53060e31f3dec92d7f39cf6e7654cc2268bde47599211d1d914acfeb",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -586,7 +586,7 @@
         "rootDefinitionDigest": "sha256:db7d5b29083a939eea0f23253632394212b0d73b5f1b6206d0811d236d6a84ca",
         "nativeSource": {
           "path": "internal/command/agentroute",
-          "canonicalDigest": "sha256:bcbf099540f203e32c0b6d9cb38dff0dc20e8018644569d647d2979d0d74ac15",
+          "canonicalDigest": "sha256:21ffaf8d53060e31f3dec92d7f39cf6e7654cc2268bde47599211d1d914acfeb",
           "evidenceClass": "source_checkout"
         },
         "nativeOutputWitnessSelector": {
@@ -1276,7 +1276,7 @@
         "rootDefinitionDigest": "sha256:7ffe236ab203cf411dbfda6008ec8c10cc15691261031d4ed9ed90d81525dc12",
         "nativeSource": {
           "path": "internal/command/requirementbinding",
-          "canonicalDigest": "sha256:90bada8c868751cef16683475839174de48dd18936e3d79a74e24febcda1e09b",
+          "canonicalDigest": "sha256:c1382a5e461974baf8e5a45d95e99552c241ea16590b1e1a781748c331cb5ffe",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -1304,7 +1304,7 @@
         "rootDefinitionDigest": "sha256:2be3545f9329bb4e4ba4971fc04bf5811959cf0087fd7ab3a7c2c8b45b8d714a",
         "nativeSource": {
           "path": "internal/command/requirementbinding",
-          "canonicalDigest": "sha256:90bada8c868751cef16683475839174de48dd18936e3d79a74e24febcda1e09b",
+          "canonicalDigest": "sha256:c1382a5e461974baf8e5a45d95e99552c241ea16590b1e1a781748c331cb5ffe",
           "evidenceClass": "source_checkout"
         },
         "nativeOutputWitnessSelector": {
@@ -1840,7 +1840,7 @@
       "inputContract": {
         "contractId": "proofkit.migration-parity-admission.input.v1",
         "schemaVersion": 1,
-        "authority": "caller-owned migration parity evidence",
+        "authority": "caller-owned migration parity claims",
         "requiredFields": [
           "nonClaims",
           "parityRecords",
@@ -1856,13 +1856,13 @@
         "rootDefinitionDigest": "sha256:a1f8ab777249d7ff613bfb3256cd96514235ac90d02ad39ce8720330cbd71d38",
         "nativeSource": {
           "path": "internal/command/migrationparityadmission",
-          "canonicalDigest": "sha256:e6d7db500dea081cbf5c50a0b56051c3f5f193d5dbcc314871cd2bae0c0b3e6a",
+          "canonicalDigest": "sha256:37ea4422b751635bfd27f1afef8e7815b3efec2a8f71f96a7074e6185a18ee5b",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
           "path": "internal/command/migrationparityadmission/migrationparityadmission_test.go",
-          "test": "TestBuildAdmitsMatchedParityAndRejectsDigestDrift",
-          "command": "go test ./internal/command/migrationparityadmission -run '^TestBuildAdmitsMatchedParityAndRejectsDigestDrift$'",
+          "test": "TestBuildAdmitsCallerDeclaredMatchAndRejectsDigestDrift",
+          "command": "go test ./internal/command/migrationparityadmission -run '^TestBuildAdmitsCallerDeclaredMatchAndRejectsDigestDrift$'",
           "evidenceClass": "source_checkout"
         },
         "compatibilitySummary": [
@@ -1888,13 +1888,13 @@
         "rootDefinitionDigest": "sha256:aaea5c7d9d12e1fbc406d080dcda5aca84351c5a2048d40535a1b3895cc37440",
         "nativeSource": {
           "path": "internal/command/migrationparityadmission",
-          "canonicalDigest": "sha256:e6d7db500dea081cbf5c50a0b56051c3f5f193d5dbcc314871cd2bae0c0b3e6a",
+          "canonicalDigest": "sha256:37ea4422b751635bfd27f1afef8e7815b3efec2a8f71f96a7074e6185a18ee5b",
           "evidenceClass": "source_checkout"
         },
         "nativeOutputWitnessSelector": {
           "path": "internal/command/migrationparityadmission/migrationparityadmission_test.go",
-          "test": "TestBuildAdmitsMatchedParityAndRejectsDigestDrift",
-          "command": "go test ./internal/command/migrationparityadmission -run '^TestBuildAdmitsMatchedParityAndRejectsDigestDrift$'",
+          "test": "TestBuildProjectsEveryCallerDeclaredStatusAndSummaryField",
+          "command": "go test ./internal/command/migrationparityadmission -run '^TestBuildProjectsEveryCallerDeclaredStatusAndSummaryField$'",
           "evidenceClass": "source_checkout"
         },
         "compatibilitySummary": [
@@ -2231,7 +2231,7 @@
         "nativeSources": [
           {
             "path": "internal/app",
-            "canonicalDigest": "sha256:0bea47d33304e528ffbe087688ea2dee07cf42e55632eda3b479732e221841d9",
+            "canonicalDigest": "sha256:b106e4c87900417f84f8bd999ddc67ac1d47bc54c2cb0bcb0e85993433761c82",
             "evidenceClass": "source_checkout"
           },
           {
@@ -2486,7 +2486,7 @@
         "rootDefinitionDigest": "sha256:71914c95c70dbace0ebce1dc4609624e3b91c994cd8c5adc20ed84d4200f0ac9",
         "nativeSource": {
           "path": "internal/command/requirementbinding",
-          "canonicalDigest": "sha256:90bada8c868751cef16683475839174de48dd18936e3d79a74e24febcda1e09b",
+          "canonicalDigest": "sha256:c1382a5e461974baf8e5a45d95e99552c241ea16590b1e1a781748c331cb5ffe",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -2514,7 +2514,7 @@
         "rootDefinitionDigest": "sha256:5fbdf25c90a2020525f97453c9d9fe5a774fe0e2eacf00d1b2aea3ff5f4fa0f0",
         "nativeSource": {
           "path": "internal/command/requirementbinding",
-          "canonicalDigest": "sha256:90bada8c868751cef16683475839174de48dd18936e3d79a74e24febcda1e09b",
+          "canonicalDigest": "sha256:c1382a5e461974baf8e5a45d95e99552c241ea16590b1e1a781748c331cb5ffe",
           "evidenceClass": "source_checkout"
         },
         "nativeOutputWitnessSelector": {
@@ -3196,7 +3196,7 @@
         "rootDefinitionDigest": "sha256:86f8f4913b5316caa63c40d79125199b282d108cbd8b9711db21c2023d1a4ca4",
         "nativeSource": {
           "path": "internal/command/requirementauthoringplan",
-          "canonicalDigest": "sha256:91d82aa48a4c10b33f89b7b2db7443182b7702de4b0c2763a8104f2b0a997bdf",
+          "canonicalDigest": "sha256:ec094da2d08e360992266402ec87fc361ef6b34023a91139015493d277bd3e76",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -3216,26 +3216,26 @@
         ]
       },
       "outputContract": {
-        "contractId": "proofkit.requirement-authoring-plan.output.v1",
-        "schemaVersion": 1,
+        "contractId": "proofkit.requirement-authoring-plan.output.v2",
+        "schemaVersion": 2,
         "rootType": "object",
         "closed": true,
-        "rootDefinitionRef": "proofkit.requirement-authoring-plan.output.v1.root-shape",
-        "rootDefinitionDigest": "sha256:019c920b72a4d2fba8f6364bff554442b0194ac42364d645d5b0b71f28df24b1",
+        "rootDefinitionRef": "proofkit.requirement-authoring-plan.output.v2.root-shape",
+        "rootDefinitionDigest": "sha256:c2264058757e40789005b7cf7417906461f064b9b9bca0c5ddda86704e3b36cc",
         "nativeSource": {
           "path": "internal/command/requirementauthoringplan",
-          "canonicalDigest": "sha256:91d82aa48a4c10b33f89b7b2db7443182b7702de4b0c2763a8104f2b0a997bdf",
+          "canonicalDigest": "sha256:ec094da2d08e360992266402ec87fc361ef6b34023a91139015493d277bd3e76",
           "evidenceClass": "source_checkout"
         },
         "nativeOutputWitnessSelector": {
-          "path": "internal/command/requirementauthoringplan/requirement_authoring_plan_test.go",
-          "test": "TestBuildRejectsCandidateSourceAdmissionFailure",
-          "command": "go test ./internal/command/requirementauthoringplan -run '^TestBuildRejectsCandidateSourceAdmissionFailure$'",
+          "path": "internal/app/cli_abi_test.go",
+          "test": "TestRequirementAuthoringPlanOutputUsesVersionedRootShape",
+          "command": "go test ./internal/app -run '^TestRequirementAuthoringPlanOutputUsesVersionedRootShape$'",
           "evidenceClass": "source_checkout"
         },
         "compatibilitySummary": [
-          "schemaVersion=1",
-          "root-shape-only definition proofkit.requirement-authoring-plan.output.v1.root-shape; nested fields, types, and cardinalities are non-claims"
+          "schemaVersion=2",
+          "root-shape-only definition proofkit.requirement-authoring-plan.output.v2.root-shape; nested fields, types, and cardinalities are non-claims"
         ],
         "ownerRequirementRefs": [
           "REQ-PROOFKIT-PACKAGE-002",
@@ -3266,7 +3266,7 @@
         "rootDefinitionDigest": "sha256:e7da70a2267f2ca13771e864bba6a1a0416132c2d56decb5db9f9694de021daf",
         "nativeSource": {
           "path": "internal/command/requirementbinding",
-          "canonicalDigest": "sha256:90bada8c868751cef16683475839174de48dd18936e3d79a74e24febcda1e09b",
+          "canonicalDigest": "sha256:c1382a5e461974baf8e5a45d95e99552c241ea16590b1e1a781748c331cb5ffe",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -3294,7 +3294,7 @@
         "rootDefinitionDigest": "sha256:f31dd686f28fce4bf74265b557dc25428179cbc282753b4bea01439cd98f73c2",
         "nativeSource": {
           "path": "internal/command/requirementbinding",
-          "canonicalDigest": "sha256:90bada8c868751cef16683475839174de48dd18936e3d79a74e24febcda1e09b",
+          "canonicalDigest": "sha256:c1382a5e461974baf8e5a45d95e99552c241ea16590b1e1a781748c331cb5ffe",
           "evidenceClass": "source_checkout"
         },
         "nativeOutputWitnessSelector": {
@@ -3878,8 +3878,8 @@
         "--format"
       ],
       "outputContract": {
-        "contractId": "proofkit.requirement-coverage-view.output.v1",
-        "schemaVersion": 1,
+        "contractId": "proofkit.requirement-coverage-view.output.v2",
+        "schemaVersion": 2,
         "authority": "requirement coverage view output contract",
         "classificationRecords": {
           "failureClassifications": {
@@ -3895,15 +3895,18 @@
           "declared_dead_zone",
           "failed_test_inventory",
           "missing_requirement_binding",
-          "missing_semantic_test",
+          "missing_declared_test_route",
           "nonsemantic_command_evidence",
           "nonsemantic_governance_evidence",
           "not_applicable_with_reason",
           "owner_scope_violation",
+          "proof_route_candidate_only",
           "routing_smoke_only",
+          "unclassified_gap",
           "unknown_reference"
         ],
         "requiredFields": [
+          "coverageBasis",
           "failureClassifications",
           "failures",
           "ownerInvariantCoverage",
@@ -3912,15 +3915,16 @@
           "warnings"
         ],
         "nonClaims": [
-          "Classification records describe Proofkit coverage diagnostics only; consumer repositories own severity policy, merge admission, escalation, and native witness execution."
+          "Classification records describe Proofkit coverage diagnostics only; consumer repositories own severity policy, merge admission, escalation, and native witness execution.",
+          "Coverage basis commitments prove internal projection consistency only; they do not authenticate source inputs or producer identity."
         ],
         "rootType": "object",
         "closed": true,
-        "rootDefinitionRef": "proofkit.requirement-coverage-view.output.v1.root-shape",
-        "rootDefinitionDigest": "sha256:697d24d12d4772b67283f24da2f265372de241bd4741ac23f7b984ca96023818",
+        "rootDefinitionRef": "proofkit.requirement-coverage-view.output.v2.root-shape",
+        "rootDefinitionDigest": "sha256:71a3a1245159e03eb3f81e2b117e1d1690c99e7e84625670a1fd42530b53684c",
         "nativeSource": {
           "path": "internal/command/requirementcoverageview",
-          "canonicalDigest": "sha256:c2a999a43db2e7b9ed65a599865bd291c7a0a4daf64973aefb40e684dee34c5a",
+          "canonicalDigest": "sha256:a6f804ad55b0101c934c782468c217ab8f3ce0cc42828975fbc35621bd43bc97",
           "evidenceClass": "source_checkout"
         },
         "nativeOutputWitnessSelector": {
@@ -3930,13 +3934,14 @@
           "evidenceClass": "source_checkout"
         },
         "compatibilitySummary": [
+          "coverageBasis",
           "failureClassifications",
           "failures",
           "ownerInvariantCoverage",
           "state",
           "warningClassifications",
           "warnings",
-          "root-shape-only definition proofkit.requirement-coverage-view.output.v1.root-shape; nested fields, types, and cardinalities are non-claims"
+          "root-shape-only definition proofkit.requirement-coverage-view.output.v2.root-shape; nested fields, types, and cardinalities are non-claims"
         ],
         "ownerRequirementRefs": [
           "REQ-PROOFKIT-PACKAGE-002",
@@ -3953,7 +3958,7 @@
         "rootDefinitionDigest": "sha256:b5ddab0a55a381f002b39ece0f5727171f7984856e553200bbb62a49821ff6ac",
         "nativeSource": {
           "path": "internal/command/requirementcoverageview",
-          "canonicalDigest": "sha256:c2a999a43db2e7b9ed65a599865bd291c7a0a4daf64973aefb40e684dee34c5a",
+          "canonicalDigest": "sha256:a6f804ad55b0101c934c782468c217ab8f3ce0cc42828975fbc35621bd43bc97",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -4111,7 +4116,7 @@
         "rootDefinitionDigest": "sha256:68ade17ac7e9fb3496ad0e7ea8ae9fbcf734afa4e6b8a44442e1af3c4f87bf15",
         "nativeSource": {
           "path": "internal/command/requirementbinding",
-          "canonicalDigest": "sha256:90bada8c868751cef16683475839174de48dd18936e3d79a74e24febcda1e09b",
+          "canonicalDigest": "sha256:c1382a5e461974baf8e5a45d95e99552c241ea16590b1e1a781748c331cb5ffe",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -4138,7 +4143,7 @@
         "rootDefinitionDigest": "sha256:750c75c08376a986a18e8739b7476d58af4133c19c40f43d216ee009607be225",
         "nativeSource": {
           "path": "internal/command/requirementbinding",
-          "canonicalDigest": "sha256:90bada8c868751cef16683475839174de48dd18936e3d79a74e24febcda1e09b",
+          "canonicalDigest": "sha256:c1382a5e461974baf8e5a45d95e99552c241ea16590b1e1a781748c331cb5ffe",
           "evidenceClass": "source_checkout"
         },
         "nativeOutputWitnessSelector": {
@@ -4464,7 +4469,7 @@
         "rootDefinitionDigest": "sha256:b2b3982ca053794da607673db6258933960a4f67653871205ff03caab2012a9f",
         "nativeSource": {
           "path": "internal/command/requirementsourceadmission",
-          "canonicalDigest": "sha256:5767016688b34b4843a4c2da3f817b354c2ade0e9dfcfae5009b8fbf7cf5f76d",
+          "canonicalDigest": "sha256:d68c56d1566166937da8ca3f2e0afe302d21a9349a0b520322a434ab88270b30",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -4491,7 +4496,7 @@
         "rootDefinitionDigest": "sha256:2527a19394b22efb4b14e39bf3b1f14283f179592c369b9c2ae34b612c7c69af",
         "nativeSource": {
           "path": "internal/command/requirementsourceadmission",
-          "canonicalDigest": "sha256:5767016688b34b4843a4c2da3f817b354c2ade0e9dfcfae5009b8fbf7cf5f76d",
+          "canonicalDigest": "sha256:d68c56d1566166937da8ca3f2e0afe302d21a9349a0b520322a434ab88270b30",
           "evidenceClass": "source_checkout"
         },
         "nativeOutputWitnessSelector": {
@@ -5465,7 +5470,7 @@
         "rootDefinitionDigest": "sha256:3c842174dff5361e7f83166469b832805e05aa314b073c16234b5b64e346281e",
         "nativeSource": {
           "path": "internal/app",
-          "canonicalDigest": "sha256:0bea47d33304e528ffbe087688ea2dee07cf42e55632eda3b479732e221841d9",
+          "canonicalDigest": "sha256:b106e4c87900417f84f8bd999ddc67ac1d47bc54c2cb0bcb0e85993433761c82",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -5494,7 +5499,7 @@
         "rootDefinitionDigest": "sha256:0ea95e277ebe44cd2de42c29b47c38686ac0b6b390d8965367437b3fe138e209",
         "nativeSource": {
           "path": "internal/app",
-          "canonicalDigest": "sha256:0bea47d33304e528ffbe087688ea2dee07cf42e55632eda3b479732e221841d9",
+          "canonicalDigest": "sha256:b106e4c87900417f84f8bd999ddc67ac1d47bc54c2cb0bcb0e85993433761c82",
           "evidenceClass": "source_checkout"
         },
         "nativeOutputWitnessSelector": {
@@ -5770,7 +5775,7 @@
               "candidateKind": "proofkit.test-inventory-discovery-draft.candidate-inventory",
               "strictInventoryAdmission": "rejected_until_owner_materialized"
             },
-            "nonClaim": "Discovery draft reports candidate-only guidance from explicit caller-owned facts; it does not scan repositories, execute tests, emit semantic_falsifier evidence, or close coverage."
+            "nonClaim": "Discovery draft reports candidate-only guidance from explicit caller-owned facts; it does not scan repositories, execute tests, emit execution-backed semantic evidence, or close coverage."
           },
           "proof-binding-derived": {
             "authority": "proof-binding-derived test inventory projection admission",
@@ -5845,14 +5850,14 @@
           },
           {
             "path": "internal/command/testevidenceinventory",
-            "canonicalDigest": "sha256:04febdd7e002567d50bb16fded119ef6ca0ce0d2eb063c92b1664312652ac395",
+            "canonicalDigest": "sha256:95618ec2824e5510d55d2c6bb86da69b057679a39404cca5f2ab5c8fd4826c6a",
             "evidenceClass": "source_checkout"
           }
         ],
         "nativeAdmissionWitnessSelector": {
           "path": "internal/command/testevidenceinventory/testevidenceinventory_test.go",
-          "test": "TestBuildRejectsWeakOracleAndDuplicateFalsifier",
-          "command": "go test ./internal/command/testevidenceinventory -run '^TestBuildRejectsWeakOracleAndDuplicateFalsifier$'",
+          "test": "TestBuildRejectsIncompleteDeclaredOracleMetadataAndDuplicateFalsifier",
+          "command": "go test ./internal/command/testevidenceinventory -run '^TestBuildRejectsIncompleteDeclaredOracleMetadataAndDuplicateFalsifier$'",
           "evidenceClass": "source_checkout"
         },
         "compatibilitySummary": [
@@ -5899,7 +5904,7 @@
           "invalid_falsifier_supersession",
           "missing_edge",
           "missing_executable_command_ref",
-          "missing_semantic_anchor",
+          "missing_declared_route_anchor",
           "mock_tests_mock",
           "over_broad_integration",
           "proof_route_candidate",
@@ -5908,7 +5913,7 @@
           "snapshot_without_oracle",
           "tautology",
           "unasserted_diagnostic",
-          "weak_or_empty_oracle",
+          "incomplete_declared_oracle_metadata",
           "wrong_boundary",
           "wrong_evidence_boundary"
         ],
@@ -5921,8 +5926,8 @@
           "severity": "failure|warning"
         },
         "oracleFields": {
-          "assertionSummary": "non-empty assertion summary for semantic_falsifier, contract_admission, and property_or_fuzz entries",
-          "expectedPublicOutcome": "non-empty expected public outcome for semantic_falsifier, contract_admission, and property_or_fuzz entries",
+          "assertionSummary": "non-empty caller-authored assertion summary for declared semantic-falsifier, contract-admission, and property-or-fuzz routes",
+          "expectedPublicOutcome": "non-empty caller-authored expected public outcome for declared semantic-falsifier, contract-admission, and property-or-fuzz routes",
           "oracleId": "stable rule id",
           "oracleKind": "stable rule id"
         },
@@ -5942,14 +5947,14 @@
           },
           {
             "path": "internal/command/testevidenceinventory",
-            "canonicalDigest": "sha256:04febdd7e002567d50bb16fded119ef6ca0ce0d2eb063c92b1664312652ac395",
+            "canonicalDigest": "sha256:95618ec2824e5510d55d2c6bb86da69b057679a39404cca5f2ab5c8fd4826c6a",
             "evidenceClass": "source_checkout"
           }
         ],
         "nativeOutputWitnessSelector": {
           "path": "internal/command/testevidenceinventory/testevidenceinventory_test.go",
-          "test": "TestBuildRejectsWeakOracleAndDuplicateFalsifier",
-          "command": "go test ./internal/command/testevidenceinventory -run '^TestBuildRejectsWeakOracleAndDuplicateFalsifier$'",
+          "test": "TestBuildRejectsIncompleteDeclaredOracleMetadataAndDuplicateFalsifier",
+          "command": "go test ./internal/command/testevidenceinventory -run '^TestBuildRejectsIncompleteDeclaredOracleMetadataAndDuplicateFalsifier$'",
           "evidenceClass": "source_checkout"
         },
         "compatibilitySummary": [
@@ -11109,8 +11114,8 @@
       "canonicalDigest": "sha256:86f8f4913b5316caa63c40d79125199b282d108cbd8b9711db21c2023d1a4ca4"
     },
     {
-      "definitionId": "proofkit.requirement-authoring-plan.output.v1.root-shape",
-      "schemaVersion": 1,
+      "definitionId": "proofkit.requirement-authoring-plan.output.v2.root-shape",
+      "schemaVersion": 2,
       "rootType": "object",
       "closed": true,
       "definitionRefs": [],
@@ -11124,6 +11129,7 @@
           {
             "allowedFields": [
               "authoringPlanId",
+              "authoringRefs",
               "candidateChangeSet",
               "mode",
               "nonAuthoritativeAdmissionPreview",
@@ -11138,6 +11144,7 @@
             ],
             "requiredFields": [
               "authoringPlanId",
+              "authoringRefs",
               "candidateChangeSet",
               "mode",
               "nonAuthoritativeAdmissionPreview",
@@ -11158,7 +11165,7 @@
           }
         ]
       },
-      "canonicalDigest": "sha256:019c920b72a4d2fba8f6364bff554442b0194ac42364d645d5b0b71f28df24b1"
+      "canonicalDigest": "sha256:c2264058757e40789005b7cf7417906461f064b9b9bca0c5ddda86704e3b36cc"
     },
     {
       "definitionId": "proofkit.requirement-bindings.input.v1.root-shape",
@@ -11886,8 +11893,8 @@
       "canonicalDigest": "sha256:b5ddab0a55a381f002b39ece0f5727171f7984856e553200bbb62a49821ff6ac"
     },
     {
-      "definitionId": "proofkit.requirement-coverage-view.output.v1.root-shape",
-      "schemaVersion": 1,
+      "definitionId": "proofkit.requirement-coverage-view.output.v2.root-shape",
+      "schemaVersion": 2,
       "rootType": "object",
       "closed": true,
       "definitionRefs": [],
@@ -11945,6 +11952,7 @@
               "commandCoverageCount",
               "completenessDeclaration",
               "contractId",
+              "coverageBasis",
               "coverageUniverseId",
               "deadZones",
               "failureClassifications",
@@ -11962,6 +11970,7 @@
               "sourceId",
               "state",
               "testInventoryId",
+              "unmappedTests",
               "viewInputId",
               "viewKind",
               "warningClassifications",
@@ -11975,6 +11984,7 @@
               "commandCoverageCount",
               "completenessDeclaration",
               "contractId",
+              "coverageBasis",
               "coverageUniverseId",
               "deadZones",
               "failureClassifications",
@@ -11992,6 +12002,7 @@
               "sourceId",
               "state",
               "testInventoryId",
+              "unmappedTests",
               "viewInputId",
               "viewKind",
               "warningClassifications",
@@ -12006,7 +12017,7 @@
           }
         ]
       },
-      "canonicalDigest": "sha256:697d24d12d4772b67283f24da2f265372de241bd4741ac23f7b984ca96023818"
+        "canonicalDigest": "sha256:71a3a1245159e03eb3f81e2b117e1d1690c99e7e84625670a1fd42530b53684c"
     },
     {
       "definitionId": "proofkit.requirement-impact-input-compose.input.v1.root-shape",

package/proofkit/requirement-bindings.json

@@ -129,7 +129,7 @@
       "claimLevel": "blocking",
       "proofState": "witness_backed",
       "nonClaims": [
-        "This requirement does not claim repository scanning, native test execution, proof freshness, receipt authenticity, merge approval, or global coverage completeness outside the caller-provided universe."
+        "This requirement does not claim repository scanning, source authenticity, producer identity, selector resolution, oracle quality, native test execution, proof freshness, receipt authenticity, trust, sensitivity, assurance closure, merge approval, or global coverage completeness outside the caller-provided universe."
       ]
     },
     {
@@ -988,6 +988,10 @@
           "selector": "TestAdoptionContractEnvelopeCLIABI",
           "command": "go test ./internal/app -run '^TestAdoptionContractEnvelopeCLIABI$'"
         },
+        {
+          "selector": "TestRequirementAuthoringPlanOutputUsesVersionedRootShape",
+          "command": "go test ./internal/app -run '^TestRequirementAuthoringPlanOutputUsesVersionedRootShape$'"
+        },
         {
           "selector": "TestSelfCheckOutputUsesExactRootShape",
           "command": "go test ./internal/app -run '^TestSelfCheckOutputUsesExactRootShape$'"
@@ -1452,7 +1456,53 @@
       "scenarioId": "proofkit.spec-proof-core.test-inventory-and-coverage-view",
       "witnessId": "proofkit.test-inventory-and-coverage-view.boundary",
       "witnessKind": "contract",
-      "witnessPath": "internal/command/requirementcoverageview/requirementcoverageview_test.go",
+      "witnessPath": "internal/command/requirementcoverageview/output_closure_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestAdmitOutputRejectsCompactProjectionDrift",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRejectsCompactProjectionDrift$'"
+        },
+        {
+          "selector": "TestAdmitOutputRejectsMissingInverseParentProjection",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRejectsMissingInverseParentProjection$'"
+        },
+        {
+          "selector": "TestAdmitOutputRejectsNonCanonicalWireProjectionText",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRejectsNonCanonicalWireProjectionText$'"
+        },
+        {
+          "selector": "TestAdmitOutputRejectsRemovedValidUnmappedInventoryEntry",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRejectsRemovedValidUnmappedInventoryEntry$'"
+        },
+        {
+          "selector": "TestAdmitOutputReplaysFailedInventoryQualitySemantics",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputReplaysFailedInventoryQualitySemantics$'"
+        },
+        {
+          "selector": "TestAdmitOutputReplaysFullRepositorySourceOwnerScopeFailures",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputReplaysFullRepositorySourceOwnerScopeFailures$'"
+        },
+        {
+          "selector": "TestAdmitOutputReplaysOwnerScopeFailures",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputReplaysOwnerScopeFailures$'"
+        },
+        {
+          "selector": "TestAdmitOutputRequiresEveryCoverageBasisField",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRequiresEveryCoverageBasisField$'"
+        },
+        {
+          "selector": "TestAdmitOutputRequiresEveryDeclaredRootField",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRequiresEveryDeclaredRootField$'"
+        },
+        {
+          "selector": "TestAdmitOutputRetainsFailedInventoryEntriesWithoutProjectedParents",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputRetainsFailedInventoryEntriesWithoutProjectedParents$'"
+        },
+        {
+          "selector": "TestAdmitOutputValidatesEveryCoverageRowMetadataField",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestAdmitOutputValidatesEveryCoverageRowMetadataField$'"
+        }
+      ],
       "commandIds": [
         "proofkit.go-test"
       ],
@@ -1473,6 +1523,25 @@
         "local-go"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-006",
+      "scenarioId": "proofkit.spec-proof-core.declared-route-mapping-without-assurance",
+      "witnessId": "proofkit.requirement-coverage.declared-route-mapping-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementcoverageview/requirementcoverageview_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildJSONMissingSelectorRemainsMappingOnly",
+          "command": "go test ./internal/command/requirementcoverageview -run '^TestBuildJSONMissingSelectorRemainsMappingOnly$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-007",
       "scenarioId": "proofkit.spec-proof-core.canonical-command-input-admission",
@@ -1672,6 +1741,25 @@
         "local-go"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-012",
+      "scenarioId": "proofkit.spec-proof-core.requirement-authoring-ref-provenance",
+      "witnessId": "proofkit.requirement-authoring-plan.authoring-ref-provenance-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementauthoringplan/requirement_authoring_plan_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildPreservesDigestBoundAuthoringRefIdentity",
+          "command": "go test ./internal/command/requirementauthoringplan -run '^TestBuildPreservesDigestBoundAuthoringRefIdentity$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-013",
       "scenarioId": "proofkit.spec-proof-core.private-proof-vocabulary-owner",
@@ -1943,7 +2031,13 @@
       "scenarioId": "proofkit.consumer-infra-retirement.migration-parity-admission",
       "witnessId": "proofkit.migration-parity-admission.boundary",
       "witnessKind": "contract",
-      "witnessPath": "internal/app/self_hosting_semantics_test.go",
+      "witnessPath": "internal/command/migrationparityadmission/migrationparityadmission_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildProjectsEveryCallerDeclaredStatusAndSummaryField",
+          "command": "go test ./internal/command/migrationparityadmission -run '^TestBuildProjectsEveryCallerDeclaredStatusAndSummaryField$'"
+        }
+      ],
       "commandIds": [
         "proofkit.go-test"
       ],
@@ -2068,6 +2162,10 @@
           "selector": "TestAdoptionContractEnvelopeCLIABI",
           "command": "go test ./internal/app -run '^TestAdoptionContractEnvelopeCLIABI$'"
         },
+        {
+          "selector": "TestRequirementAuthoringPlanOutputUsesVersionedRootShape",
+          "command": "go test ./internal/app -run '^TestRequirementAuthoringPlanOutputUsesVersionedRootShape$'"
+        },
         {
           "selector": "TestRequirementBrowserOneShotCLIOutputVariants",
           "command": "go test ./internal/app -run '^TestRequirementBrowserOneShotCLIOutputVariants$'"
@@ -2167,7 +2265,13 @@
       "scenarioId": "proofkit.supply-chain-quality.cli-output-schema-evolution",
       "witnessId": "proofkit.cli-contract.output-schema-evolution",
       "witnessKind": "contract",
-      "witnessPath": "internal/app/app_test.go",
+      "witnessPath": "internal/app/cli_contract_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestRequirementCoverageViewBreakingRootUsesVersionedOutputContract",
+          "command": "go test ./internal/app -run '^TestRequirementCoverageViewBreakingRootUsesVersionedOutputContract$'"
+        }
+      ],
       "commandIds": [
         "proofkit.go-test"
       ],
@@ -2531,6 +2635,12 @@
       "witnessId": "proofkit.release-closeout.completion-criteria-gate",
       "witnessKind": "contract",
       "witnessPath": "internal/tools/releasecloseoutinput/main_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildInputFailsClosedForEachBlockingEvidenceClass",
+          "command": "go test ./internal/tools/releasecloseoutinput -run '^TestBuildInputFailsClosedForEachBlockingEvidenceClass$'"
+        }
+      ],
       "commandIds": [
         "proofkit.go-test",
         "proofkit.package-gate"

package/proofkit/witness-plan.json

@@ -771,6 +771,7 @@
         "internal/kernel/compactproofcontract",
         "internal/kernel/digest",
         "internal/kernel/markdownfmt",
+        "internal/kernel/proofvocab",
         "internal/kernel/report",
         "internal/kernel/secretjson",
         "internal/kernel/stablejson",