@research-engineering/agentic-proofkit 0.2.1 → 0.4.0

package/ADOPTION.md

@@ -163,7 +163,7 @@ caller-owned capability or test observations
 
 Use `test-evidence-inventory --projection discovery-draft` only for explicit
 caller-owned test discovery facts. The command does not scan repositories,
-execute tests, emit `semantic_falsifier` evidence, or close coverage. It emits
+execute tests, emit execution-backed semantic evidence, or close coverage. It emits
 candidate inventory guidance with a non-strict candidate authority so an agent
 can ask the right owner questions and materialize strict inventory rows later.
 Candidate inventory diagnostics are rejected by strict inventory admission until

package/docs/proofkit-contract-map.md

@@ -41,12 +41,12 @@ owner boundaries. It is not a second command-family inventory.
 |---|---|---|---|---|---|
 | Adoption and scaffolding | `init`, `adoption-contract-envelope`, `adoption-workflow-plan`, `adoption-checklist`, `adoption-doctor`, `gradual-adoption`, `gradual-adoption-bootstrap`, `gradual-adoption-guidance`, `capability-map-admission`, `pilot-admission`, `scaffold-profile-plan`, `scaffold-project-structure`, `stack-preset` | adoption intent, aggregate adoption contract envelope, checklist facts, target paths, owner routes, caller-extracted stale authority vocabulary facts, explicit pre-spec capability observations, pilot records, stack preset id, optional init preset id | dry-run route selection, aggregate contract-envelope admission, deterministic starter plans, checklist/report admission, bounded guidance envelopes, dry-run manifests, pre-spec trust-mode admission, adoption gap and stale-authority classification, pilot shape admission | final files, final requirements, rollout policy, text extraction from files, code observation extraction, pilot truth | selected child output, plan, report, seed packet, or agent envelope |
 | Requirement source | `capability-map-admission`, `requirement-authoring-plan`, `requirement-source-admission`, `requirement-source-transition`, `spec-overview-claims`, `requirement-spec-tree`, `requirement-spec-tree-view`, `requirement-source-view`, `requirement-browser-server` | `requirements.v1.json`, caller-owned capability maps, caller-owned authoring facts, overview claim extraction, explicit spec hierarchy, view options | candidate seed admission, candidate-only authoring packets, source-shape admission, lifecycle checks, explicit tree topology/source-ref admission, shared safe renderer fragments, presentation-only views | requirement meaning, extraction completeness, Markdown extraction completeness, hierarchy ownership, proof adequacy, file materialization | capability map report, authoring packet, source report, spec-tree report, rendered view, or browser presentation |
-| Requirement proof binding | `requirement-bindings`, `binding-partition`, `proof-slice`, `evidence-graph`, `requirement-proof-resolver`, `requirement-proof-source-set`, `requirement-proof-view`, `spec-proof-bundle-admission` | requirement records, bindings, witness commands, source-set facts, receipt reports, partition policy | graph validation, binding partition projection, compact slices, typed compact proof contract projections, resolver projections, bundle linkage checks | test semantics, witness execution, proof freshness, merge policy | proof report, partition report, slice, lookup graph, or view |
-| Test inventory and coverage | `test-evidence-inventory`, `test-evidence-inventory --projection discovery-draft`, `test-evidence-inventory --normalized-inventory`, `requirement-coverage-input-compose`, `requirement-coverage-view`, `requirement-browser-server --view coverage` | caller-owned direct or source-set test inventory, caller-owned explicit test discovery facts, declared quality findings, requirement source, proof binding or compact proof contract, coverage universe, optional owner-invariant registry, aggregate coverage compose input | strict inventory/source-set admission, candidate-only discovery draft projection, fail-closed normalized inventory projection, deterministic coverage-view input composition from explicit facts, weak-oracle and declared-quality classification, bounded agent action guidance, requirement/test/command/owner-invariant joins, nonsemantic command-evidence classification, stable coverage failure/warning classifications, presentation-only coverage view | inventory completeness, weak-test truth, test discovery extraction, native test execution, receipt freshness, producer trust, merge policy | candidate inventory guidance, inventory report, normalized inventory data product, coverage-view input, coverage view, or browser presentation |
-| Selective planning | `changed-path-set`, `requirement-impact-input-compose`, `impact`, `selective-gate-plan`, `selective-gate-evidence`, `selective-gate-obligation-decision-input`, `proof-obligation-algebra`, `obligation-decision` | changed paths, base/current requirement sources, base/current single-binding-per-requirement proof contracts, generated-artifact policy, local environment policy, proof-like path policy, scan obligation ownership, planned receipts, obligation routes, obligation algebra records | fail-closed impact input composition, fail-closed planning, receipt comparison, obligation algebra admission, bounded agent packets | git diff truth, repository scanning, command execution, producer trust, final admission | composed impact input, plan, evidence report, obligation algebra report, or obligation input |
+| Requirement proof binding | `requirement-bindings`, `binding-partition`, `proof-slice`, `evidence-graph`, `requirement-proof-resolver`, `requirement-proof-source-set`, `requirement-proof-view`, `spec-proof-bundle-admission` | requirement records, bindings, witness commands, source-set facts, receipt reports, partition policy | graph validation, binding partition projection, compact slices, declaration-only compact route projection with full binding identity and role-qualified witness routes, resolver projection, bundle linkage checks | selector resolution, oracle quality, witness execution, mutation adequacy, finding completeness, proof freshness, trust, assurance, merge policy | proof report, partition report, slice, declaration lookup graph, or view |
+| Test inventory and coverage | `test-evidence-inventory`, `test-evidence-inventory --projection discovery-draft`, `test-evidence-inventory --normalized-inventory`, `requirement-coverage-input-compose`, `requirement-coverage-view`, `requirement-browser-server --view coverage` | caller-owned direct or source-set test inventory, caller-owned explicit test discovery facts, declared quality findings, requirement source, proof binding or compact proof contract, coverage universe, optional owner-invariant registry, aggregate coverage compose input | strict inventory/source-set admission, candidate-only discovery draft projection, fail-closed normalized inventory projection, deterministic coverage-view input composition from explicit facts, missing declared assertion-signal and declared-quality classification, bounded agent action guidance, requirement/test/command/owner-invariant joins, nonsemantic command-evidence classification, stable coverage failure/warning classifications, presentation-only coverage view | inventory completeness, oracle quality, test quality, test discovery extraction, native test execution, receipt freshness, producer trust, merge policy | candidate inventory guidance, inventory report, normalized inventory data product, coverage-view input, coverage view, or browser presentation |
+| Selective planning | `changed-path-set`, `requirement-impact-input-compose`, `impact`, `selective-gate-plan`, `selective-gate-evidence`, `selective-gate-obligation-decision-input`, `proof-obligation-algebra`, `obligation-decision` | changed paths, base/current requirement sources, base/current declaration-only proof contracts with zero or more scenario bindings per requirement, generated-artifact policy, local environment policy, proof-like path policy, scan obligation ownership, planned receipts, obligation routes, obligation algebra records | fail-closed impact input composition, binding-aware fan-out, fail-closed planning, receipt comparison, obligation algebra admission, bounded agent packets | git diff truth, repository scanning, command execution, producer trust, final admission | composed impact input, plan, evidence report, obligation algebra report, or obligation input |
 | Receipts and producers | `proof-receipt-admission`, `receipt-producer-admission`, `receipt-currentness-scope`, `receipt-trust-class`, `producer-policy-self-proof` | receipt sets, producer policy, scope/currentness facts, trust classes | receipt shape, producer/receipt compatibility, self-proof diagnostics | producer authentication, freshness policy, CI trust roots | receipt/provenance report |
 | Release and deployment | `release-authority`, `external-consumer`, `registry-consumer-proof-input-compose`, `registry-consumer`, `deployment-evidence-admission`, `completion-criteria`, `branch-authority`, `readiness-closeout` | package facts, tarball/registry facts, explicit primitive registry/install/smoke facts, deployment evidence, criteria, branch facts | artifact/channel boundary checks, registry-consumer input composition, release diagnostics, falsifiable criteria shape | package publication, registry fetch, package-manager execution, deployment, rollback, approval | composed input, release/deployment/readiness report |
-| Supply-chain and quality | `self-check`, release workflow, `npm run release:sbom`, `npm run self:coverage`, `npm run go:actionlint`, `npm run go:bench` | release artifacts, source workflows, specs, bindings, witness plans, explicit benchmark invocation | deterministic self-check report shape, SBOM candidate evidence, coverage metrics, workflow lint routing, benchmark entrypoints | public-source provenance, vulnerability triage, license approval, CI run admission, release approval | self-check report, SBOM, metrics report, CI signal, or benchmark output |
+| Supply-chain and quality | `self-check`, release workflow, `npm run release:sbom`, `npm run self:coverage`, `npm run go:actionlint`, `npm run go:bench` | release artifacts, source workflows, specs, bindings, witness plans, command-oracle candidate inventory, independently authored counterfeit corpus, explicit benchmark invocation | deterministic self-check report shape, SBOM candidate evidence, exact-file materialized-snapshot package-scoped selected-test execution, production-owner counterfeit decisions, strict one-read and current-owner command-oracle diagnostic admission, execution-backed coverage metrics, workflow lint routing, benchmark entrypoints | assertion-branch execution, mutation adequacy, producer authentication, public-source provenance, vulnerability triage, license approval, CI run admission, release approval | self-check report, SBOM, command-oracle diagnostic, metrics report, CI signal, or benchmark output |
 
 The `npm run release:sbom`, `npm run self:coverage`, `npm run go:actionlint`,
 and `npm run go:bench` routes above are maintainer commands for a source
@@ -131,7 +131,7 @@ Semantic context routes are `requirement-context-compose`,
 | An agent needs a bounded semantic subset instead of whole specification files. | `requirement-context-compose --repo-root <caller-selected-root>` over an explicit catalog, then `requirement-context-slice` over the materialized snapshot. | The snapshot and slice are content-bound derived projections. Stop before inferring hierarchy, scanning ambient paths, treating omissions as absence, or promoting the slice to requirement, proof, freshness, or merge authority. |
 | Overview prose may contain durable claims. | `spec-overview-claims` | Escalate when normative claims are not tied to `REQ-*` records. |
 | Requirements have no verified proof route. | `requirement-bindings`, `witness-plan` from either an explicit `witness_command_catalog` or a complete `binding_witness_plan_input`, `proof-slice`, or `requirement-proof-resolver` | Stop before claiming proof adequacy; native witness semantics stay with the consumer. A binding-derived witness plan still needs caller-owned vocabulary and conservative command policy. |
-| Tests or proof evidence need inventory. | `test-evidence-inventory`; use `--projection discovery-draft` only for explicit discovered-test facts, then `requirement-coverage-input-compose` when an aggregate `coverage_compose_input` exists, then `requirement-coverage-view` when a `coverage_view_input` exists | Compose only from explicit caller-owned facts. Discovery drafts are candidate-only and cannot close coverage. Use `failureClassifications[]`, `warningClassifications[]`, and `agentActionPlan[]` for machine routing. Escalate when tests are route-only, weak-oracle, unbound, or outside the caller-owned coverage universe. |
+| Tests or proof evidence need inventory. | `test-evidence-inventory`; use `--projection discovery-draft` only for explicit discovered-test facts, then `requirement-coverage-input-compose` when an aggregate `coverage_compose_input` exists, then `requirement-coverage-view` when a `coverage_view_input` exists | Compose only from explicit caller-owned facts. Discovery drafts are candidate-only and cannot close coverage. Use `failureClassifications[]`, `warningClassifications[]`, and `agentActionPlan[]` for machine routing. Escalate when tests are route-only, lack a declared assertion signal, are unbound, or are outside the caller-owned coverage universe. Proofkit reports declared signals; the consumer owns oracle-quality and test-quality conclusions. |
 | A change set is known. | `changed-path-set`, optionally `requirement-impact-input-compose`, `impact`, then `selective-gate-plan --agent-envelope` | Raw `knownChangedPaths` in `agent-route` are diagnostic only. Materialize a caller-owned `changed_path_set`, compose a caller-owned `impact_input` before `impact`, and compose a caller-owned `selective_gate_plan_input` before `selective-gate-plan`. Use `scanObligation` to name whether a `text-policy`, `secret-scan`, or caller-owned external scanner is required. Fail closed on unknown scope, dynamic edges, missing owner routes, unbound proof-like paths, or full-gate escalation. |
 | Caller-owned file contents need secret-like text detection. | `secret-scan` | Provide explicit sorted file inventory with content. Stop before claiming repository-wide discovery, credential validity, provider ingestion, merge readiness, or replacement of GitHub secret scanning. |
 | Does a TypeScript package public API match a caller-owned manifest? | `agent-route` with `goal: "verify_typescript_public_api"` and explicit `typescript_public_api_manifest` plus `typescript_public_api_repo_root`, then `typescript-public-api-surfaces --repo-root <caller-selected-root>` | The manifest must name each referenced `package.json`, sorted-unique export conditions, and a non-JSX `.ts`, `.mts`, or `.cts` `sourcePath` whose canonical target has the same admitted extension class. The bounded scanner accepts only the fail-closed export grammar in `proofkit/cli-contract.v2.json`; it does not parse unrestricted TypeScript or TSX, infer conventional layouts, or prove compiler output provenance, checkout freshness, package-manager truth, or merge readiness. |

package/docs/release-process.md

@@ -128,7 +128,16 @@ static analysis, workflow linting, vulnerability checks, npm package artifact
 creation, package artifact verification, Python wheel artifact creation, Python
 wheel verification, release SBOM, release manifest and checksum generation,
 outside-consumer binary smoke proof, self-hosting receipt validation, and
-coverage metrics generation.
+coverage metrics generation. Coverage generation runs the exact owner-selected
+Go tests through package-scoped argv vectors from an exact-file materialized
+source snapshot, evaluates the independently authored counterfeit corpus
+through production admission owners, and emits a command-oracle diagnostic
+plus coverage metrics v2 only while the candidate, corpus, runtime, and source
+identities remain current. Release closeout re-admits that diagnostic through
+its sole strict owner, binds its digest to the same canonical byte read, and
+revalidates current producer reachability. This local cooperative execution
+does not prove assertion-branch execution, mutation adequacy, producer
+authentication, or provider admission.
 
 The dry-run package identity proves candidate tarball shape only. It does not
 prove the bytes served by the registry after publish.

package/docs/specs/proofkit-consumer-infra-retirement/overview.md

@@ -30,9 +30,11 @@ approval, rollout approval, and production decisions.
   gradual adoption, and release-channel scenarios to existing Proofkit
   primitives through bounded structured command refs.
 - `REQ-PROOFKIT-RETIRE-006`: migration parity admission validates
-  caller-provided parity evidence shape, source/target closure, typed
-  equivalence dimensions, and matched digest equality without owning evidence
-  authenticity, freshness, semantic correctness, or retirement approval.
+  caller-provided parity-claim shape, source/target closure, typed equivalence
+  dimensions, consistency between caller-declared status and supplied digests,
+  and lossless record-level non-claim projection without owning digest
+  computation, evidence authenticity, freshness, semantic correctness, or
+  retirement approval.
 - `REQ-PROOFKIT-RETIRE-007`: gradual adoption guidance keeps caller-provided
   candidate boundaries advisory, exposes owner-review questions, routes mode
   and checked-scope semantics through one private owner, and fails closed for

package/docs/specs/proofkit-consumer-infra-retirement/requirements.v1.json

@@ -143,7 +143,7 @@
     {
       "requirementId": "REQ-PROOFKIT-RETIRE-006",
       "ownerId": "proofkit.consumer-infra-retirement",
-      "invariant": "Migration parity admission validates caller-provided parity evidence shape, source/target closure, typed equivalence dimensions, and matched digest equality without owning evidence authenticity, freshness, semantic correctness, or retirement approval.",
+      "invariant": "Migration parity admission validates caller-provided parity-claim shape, source/target closure, typed equivalence dimensions, consistency between caller-declared status and caller-supplied digests, and lossless record-level non-claim projection; statuses, admitted parity claim refs, and status-derived parity counters remain explicitly caller-declared, structural and failure counts remain Proofkit-computed admission facts, and the report does not own digest computation, evidence authenticity, freshness, semantic correctness, or retirement approval.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": [

package/docs/specs/proofkit-spec-proof-core/overview.md

@@ -16,14 +16,13 @@ execution receipts, and merge policy.
   or scanning overview prose as authority; one shipped, marker-bounded example
   is parsed as bounded expansion-free literal shell words and executed through
   the installed current product as a first valid input.
-- `REQ-PROOFKIT-SPEC-002`: requirement proof binding reports validate
-  caller-owned requirement-to-witness mappings, require compact scenarios to be
-  admitted `surface_id::stable_anchor` identities, require compact witness
-  selectors to use `repo/path::stable_anchor` identities, admit caller-owned
-  source-set fragments and selected-source resolver projections, and derive
-  typed compact proof contract projections for surfaces, scenarios, witnesses,
-  commands, environment classes, conformance facts, and falsification routes
-  without executing witnesses or deciding proof freshness.
+- `REQ-PROOFKIT-SPEC-002`: compact proof route declarations preserve the full
+  requirement/surface/scenario binding identity and role-qualified witness-route
+  identity, preserve each route's JSON-safe non-negative resolution order, admit
+  declaration-only v2 contracts plus source-set v2 and fragment v3 inputs, retain
+  distinct positive and falsification roles even for one shared selector, and
+  reject legacy proof-state, synthetic evidence counts, collapsed roles, and
+  identity-loss projections without claiming execution or assurance.
 - `REQ-PROOFKIT-SPEC-003`: witness planning accepts caller-owned structured
   command metadata, scheduler constraints, environment classes, and
   binding-derived command projections only through admitted witness vocabulary
@@ -49,8 +48,21 @@ execution receipts, and merge policy.
   owners, scope widening, fabricated normalized inventory, non-strict
   discovery candidate inventory, nonsemantic command evidence, and declared
   dead zones in selected-owner or full-repository scopes, and do not treat
-  proof routes, discovery drafts, nonsemantic command evidence, normalized
-  projections, composed inputs, or rendered views as semantic test coverage.
+  caller-authored route, falsifier, oracle-signal, or falsifier-supersession
+  metadata as selector resolution, oracle review, execution, freshness, trust,
+  sensitivity, dominance proof, verified coverage, or assurance closure;
+  discovery classifies only declared assertion-signal presence and coverage
+  re-admission requires the versioned exact root and row shapes, canonical row
+  order, exact row metadata, command-owned non-claims, exact missing-inventory
+  diagnostics, owner-scoped compact scenario identities, and a coverage basis
+  that commits to selected owners, full-repository out-of-scope source
+  identities, and the complete retained inventory projection; it retains
+  complete inventory entries without selected parents, replays owner-scope and
+  inventory-owned failure semantics, and rejects missing projection fields,
+  contradictory repeated projections, one-sided retained parent references,
+  compact scenario-to-route drift, and unowned or inconsistent state/class
+  vocabulary. The coverage basis proves internal projection consistency, not
+  source authenticity or producer identity.
 - `REQ-PROOFKIT-SPEC-007`: caller-owned inputs are admitted into canonical
   immutable records before any proof, policy, route, rendering, or report
   decision consumes them.
@@ -66,11 +78,13 @@ execution receipts, and merge policy.
   serving with one exact supported-view vocabulary without accepting
   caller-owned raw HTML or making rendered output authoritative.
 - `REQ-PROOFKIT-SPEC-010`: requirement impact input composition converts
-  caller-owned base/current requirement sources, single-current-binding compact
-  proof contracts, changed-path facts, generated-artifact policy, local
-  environment policy, and proof-like path policy into a direct `impact` input
-  without scanning repositories, executing witnesses, or becoming a second
-  impact evaluator.
+  caller-owned base/current requirement sources, compact proof contracts with
+  one or more current bindings per active blocking requirement, changed-path
+  facts, generated-artifact policy, local environment policy, and proof-like
+  path policy into a direct `impact` input, treating every referenced surface
+  semantic change as a change to every referencing binding under the
+  proof-binding source-path policy, without scanning repositories, executing
+  witnesses, or becoming a second impact evaluator.
 - `REQ-PROOFKIT-SPEC-011`: adoption contract envelope admission validates a
   complete caller-owned aggregate adoption envelope, selects one child route
   through orthogonal CLI flags, rejects repeated single-value mode or pilot
@@ -80,9 +94,10 @@ execution receipts, and merge policy.
   policy.
 - `REQ-PROOFKIT-SPEC-012`: requirement authoring plans package caller-provided
   design, implementation, PR, code, test, and clarification facts into
-  candidate-only requirement updates, delegate structural checks to requirement
-  source admission and transition, and keep owner review/materialization outside
-  Proofkit.
+  candidate-only requirement updates, preserve complete canonically ordered
+  admitted authoring references, consume requirement records only through
+  canonical owner projections, delegate structural checks to requirement source
+  admission and transition, and keep owner review/materialization outside Proofkit.
 - `REQ-PROOFKIT-SPEC-013`: repeated cross-command proof vocabulary has one
   private owner for proof and selective-edge state while command-local and
   caller-owned vocabularies stay outside the shared owner.
@@ -127,6 +142,14 @@ execution receipts, and merge policy.
   evidence planes, consumes the normalized v1/v2 context boundary, and accepts
   code topology only as explicit caller-owned input with source-digest,
   parent-edge, abstraction-order, and pre-materialization budget closure.
+- `REQ-PROOFKIT-SPEC-024`: a private representation-neutral requirement-source
+  v2 model separates immutable atomic, authoring-layout, and typed-reference
+  projections, closes every metadata owner, group-member relation, and typed
+  reference under independently observed input, instantiated-scenario, and
+  expanded-output bounds with fixed budget-error precedence, and proves exact
+  package, field, representation, variant, and positive/negative relation
+  coverage without attributing correlated edits to independent field
+  causality, selecting a codec, or changing a public source boundary.
 
 ## Non-Claims
 

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -35,7 +35,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-002",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Requirement proof binding reports validate caller-owned requirement-to-witness mappings, require compact scenarios to use admitted surface_id::stable_anchor identities, require compact witness selectors to use admitted repo/path::stable_anchor identities, admit caller-owned source-set fragments and selected-source resolver projections, and derive typed compact proof contract projections for surfaces, scenarios, witnesses, commands, environment classes, conformance facts, and falsification routes without executing witnesses or deciding proof freshness.",
+      "invariant": "Requirement proof route declaration admission preserves each compact binding identity as requirementId, surfaceId, and scenarioId; preserves each witness route as bindingRecordId, role, selector, a JSON-safe non-negative resolutionOrderIndex, and witnessRouteId; admits exactly one positive and one falsification role even when both roles use the same selector; requires declaration-only v2 compact discriminators and admitted source-set v2 or fragment-v3 identities; rejects legacy proof-state, synthetic checked or finding counts, collapsed roles, and identity-loss projections; and derives only caller-owned declaration or lookup facts without executing witnesses or deciding selector resolution, oracle quality, mutation adequacy, proof freshness, trust, assurance, merge, rollout, or production readiness.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": [
@@ -45,7 +45,7 @@
         "NC-PROOFKIT-SPEC-002"
       ],
       "nonClaims": [
-        "This requirement does not claim native witness pass evidence, proof freshness, receipt authenticity, or merge approval."
+        "This requirement does not claim selector existence or resolution, oracle quality, native witness execution or pass evidence, mutation adequacy, finding completeness or absence, proof freshness, receipt authenticity, trust, assurance, merge approval, rollout approval, or production readiness."
       ],
       "lifecycle": {
         "state": "active",
@@ -143,7 +143,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-006",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Test evidence inventory, explicit test-discovery draft projections, proof-binding-derived inventory projections, normalized inventory projections, coverage-view input composition, and requirement coverage views classify or assemble caller-owned test-to-requirement, command, witness, owner-invariant, quality-finding, and declared-surface routes with stable machine-readable failure and warning classifications plus bounded agent action guidance while preserving source-set entry provenance, failing closed on structured selector/sourcePath drift, command-ref collisions, missing requirement owners, scope widening, fabricated normalized inventory, non-strict discovery candidate inventory, nonsemantic command evidence, and declared dead zones in selected-owner or full-repository scopes, and without treating proof routes, discovery drafts, nonsemantic command evidence, normalized projections, composed inputs, generated guidance, or rendered views as semantic test coverage.",
+      "invariant": "Test evidence inventory, explicit test-discovery draft projections, proof-binding-derived inventory projections, normalized inventory projections, coverage-view input composition, and requirement coverage views classify or assemble caller-owned test-to-requirement, command, witness, owner-invariant, quality-finding, and declared-surface routes with stable machine-readable failure and warning classifications plus bounded agent action guidance while preserving source-set entry provenance, failing closed on structured selector/sourcePath drift, command-ref collisions, missing requirement owners, scope widening, fabricated normalized inventory, non-strict discovery candidate inventory, nonsemantic command evidence, and declared dead zones in selected-owner or full-repository scopes; caller-authored route, falsifier, oracle-signal, and falsifier-supersession metadata emits only explicit declaration or mapping states, discovery classifies only the presence of admitted assertion-signal categories, coverage output re-admission requires the versioned exact root and row shapes, canonical row order, exact row metadata, command-owned non-claims, exact missing-inventory diagnostics, owner-scoped compact scenario identities, and a coverage basis committing to selected owners, full-repository out-of-scope source identities, and the complete retained inventory projection, retains complete inventory entries even when no selected parent references them, replays owner-scope and inventory-owned failure semantics, and rejects missing projected fields, contradictory repeated projections, one-sided retained parent references, compact scenario-to-route projection drift, and unowned or inconsistent state/class vocabulary, and no such metadata or coverage-basis commitment can emit source authenticity, producer identity, selector-resolution, oracle-review, execution, freshness, trust, sensitivity, dominance-proof, verified, covered, or assurance-closure facts.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": [
@@ -153,7 +153,7 @@
         "NC-PROOFKIT-SPEC-006"
       ],
       "nonClaims": [
-        "This requirement does not claim repository scanning, native test execution, proof freshness, receipt authenticity, merge approval, or global coverage completeness outside the caller-provided universe."
+        "This requirement does not claim repository scanning, source authenticity, producer identity, selector resolution, oracle quality, native test execution, proof freshness, receipt authenticity, trust, sensitivity, assurance closure, merge approval, or global coverage completeness outside the caller-provided universe."
       ],
       "lifecycle": {
         "state": "active",
@@ -251,7 +251,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-010",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Requirement impact input composition converts caller-owned base and current requirement sources, single-current-binding compact proof contracts, changed-path facts, generated-artifact policy, local environment policy, and proof-like path policy into a direct impact command input while preserving downstream impact semantics and without scanning repositories, executing witnesses, deciding freshness, or becoming a second impact evaluator.",
+      "invariant": "Requirement impact input composition converts caller-owned base and current requirement sources, compact proof contracts with one or more current bindings per active blocking requirement, changed-path facts, generated-artifact policy, local environment policy, and proof-like path policy into a direct impact command input; treats every referenced surface semantic change as a change to every referencing binding under the proof-binding source-path policy; preserves downstream impact semantics; and does not scan repositories, execute witnesses, decide freshness, or become a second impact evaluator.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": [
@@ -305,7 +305,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-012",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Requirement authoring plans admit caller-provided design, implementation, pull request, code, test, and clarification facts into candidate-only requirement updates, delegate candidate source and lifecycle checks to requirement-source admission and transition, and emit owner-review plans without reading repositories, writing files, inferring requirement meaning, or approving promotion.",
+      "invariant": "Requirement authoring plans admit caller-provided design, implementation, pull request, code, test, and clarification facts into candidate-only requirement updates, preserve every admitted authoring reference as a canonically ordered lossless projection of refId, kind, path, optional digest, summary, and nonClaims, consume current and candidate requirement records only through canonical requirement-source owner projections, delegate candidate source and lifecycle checks to requirement-source admission and transition, and emit owner-review plans without reading repositories, writing files, inferring requirement meaning, or approving promotion.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": [
@@ -555,6 +555,19 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "A private representation-neutral requirement-source v2 model admits one bounded source into immutable atomic, authoring-layout, and typed-reference projections; it preserves atomic requirement identity while expanding grouped statement stems and premises, preserves group-to-member relations under composite identity, assigns every effective metadata field to exactly one resolving profile or member owner, admits lifecycle, deferral, update-policy, scenario, vocabulary, non-claim, and derivation semantics through closed variants and references, applies architecture-independent input, instantiated-scenario, and expanded-materialization cardinality and text budgets in a fixed precedence before per-item semantic work, rejects both lexical and single-pass parameter-instantiated observation contradictions, normalizes admitted set-like values deterministically, emits nondisclosing diagnostics deterministically for each exact input, and preserves ordered action sequences. An independently authored exact typed-field and closed-variant manifest plus an identity-aware admitted semantic mutant corpus proves individual field projection, both metadata-owner branches, or an explicitly named referential relation with negative near-miss controls and without attributing correlated edits to independent field causality; independent structural observers prove exact package exports and direct imports, representation neutrality, exact input, instantiated-scenario, and expanded-output costs, and exact versus limit-minus-one budget behavior.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-024"],
+      "nonClaims": ["This private single-source model does not select or expose a source codec, parse or serialize a persisted source, retain a normalized mirror, establish cross-source requirement identity, authenticate derivation objects, digests, selectors, or freshness, authenticate a caller-declared sourceKind or prove its author's authority or trust class, cut over any current requirement consumer, prove requirement meaning or implementation correctness, execute native witnesses, approve merge or release, or establish rollout or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ],
   "nonClaims": [

package/docs/specs/proofkit-supply-chain-quality/overview.md

@@ -58,15 +58,20 @@ vulnerability absence, or consumer rollout safety by itself.
 - `REQ-PROOFKIT-QUALITY-009`: performance-sensitive parser and serializer
   paths expose benchmark entrypoints without making wall-clock budgets a
   required PR gate before stable baselines exist.
-- `REQ-PROOFKIT-QUALITY-010`: coverage metrics report requirement, binding,
-  witness, CLI inventory linkage, and descriptor-owned command proof-route
-  candidates from admitted test-evidence-inventory rows, while critical
-  anti-vacuity scenarios retain exact closed selector inventories. Each linkage and route
-  conjunct has an independent fail-closed falsifier, and each source-checkout
-  selector resolves to a valid function in an active Go test file with its
-  exact executable command; static route metadata, prose, source markers, test
-  existence, and failure-capable syntax never become semantic falsifier
-  evidence.
+- `REQ-PROOFKIT-QUALITY-010`: coverage metrics keep static proof-route
+  candidates separate from an execution-backed command-oracle ledger. The
+  ledger runs exact selected Go tests through package-scoped argv vectors from
+  one exact-file materialized source snapshot, joins reserved lifecycle
+  attributes to every candidate identity, terminates bounded subprocesses on
+  cancellation or output overflow, confines atomic artifact publication and
+  invalidation to non-symlink repository paths, and fails closed on incomplete
+  command coverage or event, source, selection, producer-reachability, and
+  identity drift. A versioned counterfeit corpus owns checked-in expected
+  decisions for every required policy axis, evidence class, record coordinate,
+  and substitution axis; its mutations execute the production admission and
+  lifecycle owners rather than a generated expectation copy. Passing selected
+  tests does not prove assertion-branch execution, mutation adequacy, or
+  exhaustive command semantics.
 - `REQ-PROOFKIT-QUALITY-011`: CI separates the OS-independent full
   source/package gate from macOS platform smoke, executes the complete Go
   package set through its owner command, uses explicit hosted runner labels
@@ -102,7 +107,11 @@ vulnerability absence, or consumer rollout safety by itself.
   fields after validation.
 - `REQ-PROOFKIT-QUALITY-015`: the package gate includes an admitted release
   closeout completion-criteria report so unit tests alone cannot satisfy
-  release closeout.
+  release closeout. Coverage re-admission rejects candidate-only v1, requires
+  overflow-safe exact producer relations plus the complete command inventory,
+  and binds coverage v2 to the current command-oracle diagnostic through the
+  ledger owner's one-read canonical admission, current-owner revalidation, and
+  record, candidate-set, corpus, revision, and source-snapshot digests.
 - `REQ-PROOFKIT-QUALITY-016`: release platform targets use one private owner
   that projects platform suffixes, Go build targets, npm OS/CPU metadata,
   package tar entries, Python wheel tags, PyPI candidate completeness,

package/docs/specs/proofkit-supply-chain-quality/requirements.v1.json

@@ -129,12 +129,12 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-010",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "Coverage metrics report requirement, binding, witness, CLI inventory linkage, and descriptor-owned command proof-route candidates from admitted test-evidence-inventory rows, failing closed independently for each requirement/proof linkage dead-zone class and each missing-candidate, unknown-candidate-ref, unknown-semantic-ref, contract-only, or route-only command-route class; source-checkout witness selectors must resolve to valid functions in active Go test files with exact executable commands and a failure-capable assertion candidate outside literal-dead branches, uninvoked closures, and skip-bearing helper paths, critical anti-vacuity scenarios must retain their exact closed selector inventories, and failed command-route inventory admission also fails closed, while static route metadata, prose, source markers, test existence, and failure-capable syntax remain candidate evidence and cannot satisfy semantic_falsifier coverage.",
+      "invariant": "Coverage metrics report requirement, binding, witness, CLI inventory linkage, descriptor-owned command proof-route candidates, and a separate execution-backed command-oracle ledger. The ledger must bind every candidate commandRef, selector, concrete negative case, falsification event, assertion oracle, expected public outcome, and owner invariant to one immutable exact-file materialized source snapshot; execute exactly the selected active Go tests through canonically ordered package-scoped argv vectors that cannot select same-named non-candidate tests in another package; require unique package start and pass events, unique test run and pass events, owner-reserved cooperative attributes for every candidate, bounded cancellable subprocesses, and immediate process-group termination on output-limit violation; reject missing, unknown, duplicate, skipped, failed, reordered, context-invalid, spoofed-output, cross-test, source-drift, producer-unreachable candidate projections, and correlated identity substitutions; publish and invalidate local diagnostic and metrics artifacts atomically through repository-confined non-symlink destinations; revalidate current candidate, corpus, runtime, and source identities before and after artifact publication; and fail closed when any public command lacks execution-backed evidence. An independently authored versioned counterfeit corpus must bijectively cover every shipped evidence class, required policy axis, record coordinate, and declared substitution axis with positive controls and checked-in exact expected decisions evaluated through the production admission and lifecycle owners rather than a generated expectation registry. Static route metadata, prose, legacy source markers, test existence, and failure-capable syntax remain proof-route candidates and cannot satisfy the execution-backed closure.",
       "claimLevel": "blocking",
       "riskClass": "medium",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
       "nonClaimRefs": ["NC-PROOFKIT-QUALITY-010"],
-      "nonClaims": ["This requirement does not claim semantic command coverage, line coverage, dead-code absence, exhaustive semantic completeness for any test, native witness execution, receipt freshness, or merge satisfaction."],
+      "nonClaims": ["Successful selected tests do not prove assertion-branch execution, mutation adequacy, line coverage, dead-code absence, exhaustive command semantics, malicious-test resistance, producer authentication, receipt freshness, merge satisfaction, or production readiness."],
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
@@ -194,7 +194,7 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-015",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "The package gate includes an admitted release closeout completion-criteria report that classifies package artifacts, Python wrappers, release manifest, SBOM, channel scope, and self-hosting evidence instead of allowing unit tests alone to satisfy release closeout.",
+      "invariant": "The package gate includes an admitted release closeout completion-criteria report that classifies package artifacts, Python wrappers, release manifest, SBOM, channel scope, and self-hosting evidence instead of allowing unit tests alone to satisfy release closeout; coverage-metric re-admission rejects candidate-only v1 reports, uses overflow-safe relations to require the exact producer projection between admitted entries, routes, route classes, proof-route candidates, execution-backed command-oracle entries, the complete command inventory, and commands missing declaration-only routes, compares both coverage command projections with the actual cli-contract.v2.json command inventory, and binds the coverage report to a command-oracle diagnostic admitted by its sole owner from one bounded byte read, with the digest computed from those same canonical bytes and matched by candidate-set digest, counterfeit-corpus digest, source revision, and source-snapshot digest. Release closeout additionally revalidates that the diagnostic remains reachable from the current candidate, corpus, runtime, and source owners before admitting it.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,