@research-engineering/agentic-proofkit 0.3.0 → 0.4.0

package/docs/proofkit-contract-map.md

@@ -41,12 +41,12 @@ owner boundaries. It is not a second command-family inventory.
 |---|---|---|---|---|---|
 | Adoption and scaffolding | `init`, `adoption-contract-envelope`, `adoption-workflow-plan`, `adoption-checklist`, `adoption-doctor`, `gradual-adoption`, `gradual-adoption-bootstrap`, `gradual-adoption-guidance`, `capability-map-admission`, `pilot-admission`, `scaffold-profile-plan`, `scaffold-project-structure`, `stack-preset` | adoption intent, aggregate adoption contract envelope, checklist facts, target paths, owner routes, caller-extracted stale authority vocabulary facts, explicit pre-spec capability observations, pilot records, stack preset id, optional init preset id | dry-run route selection, aggregate contract-envelope admission, deterministic starter plans, checklist/report admission, bounded guidance envelopes, dry-run manifests, pre-spec trust-mode admission, adoption gap and stale-authority classification, pilot shape admission | final files, final requirements, rollout policy, text extraction from files, code observation extraction, pilot truth | selected child output, plan, report, seed packet, or agent envelope |
 | Requirement source | `capability-map-admission`, `requirement-authoring-plan`, `requirement-source-admission`, `requirement-source-transition`, `spec-overview-claims`, `requirement-spec-tree`, `requirement-spec-tree-view`, `requirement-source-view`, `requirement-browser-server` | `requirements.v1.json`, caller-owned capability maps, caller-owned authoring facts, overview claim extraction, explicit spec hierarchy, view options | candidate seed admission, candidate-only authoring packets, source-shape admission, lifecycle checks, explicit tree topology/source-ref admission, shared safe renderer fragments, presentation-only views | requirement meaning, extraction completeness, Markdown extraction completeness, hierarchy ownership, proof adequacy, file materialization | capability map report, authoring packet, source report, spec-tree report, rendered view, or browser presentation |
-| Requirement proof binding | `requirement-bindings`, `binding-partition`, `proof-slice`, `evidence-graph`, `requirement-proof-resolver`, `requirement-proof-source-set`, `requirement-proof-view`, `spec-proof-bundle-admission` | requirement records, bindings, witness commands, source-set facts, receipt reports, partition policy | graph validation, binding partition projection, compact slices, typed compact proof contract projections, resolver projections, bundle linkage checks | test semantics, witness execution, proof freshness, merge policy | proof report, partition report, slice, lookup graph, or view |
+| Requirement proof binding | `requirement-bindings`, `binding-partition`, `proof-slice`, `evidence-graph`, `requirement-proof-resolver`, `requirement-proof-source-set`, `requirement-proof-view`, `spec-proof-bundle-admission` | requirement records, bindings, witness commands, source-set facts, receipt reports, partition policy | graph validation, binding partition projection, compact slices, declaration-only compact route projection with full binding identity and role-qualified witness routes, resolver projection, bundle linkage checks | selector resolution, oracle quality, witness execution, mutation adequacy, finding completeness, proof freshness, trust, assurance, merge policy | proof report, partition report, slice, declaration lookup graph, or view |
 | Test inventory and coverage | `test-evidence-inventory`, `test-evidence-inventory --projection discovery-draft`, `test-evidence-inventory --normalized-inventory`, `requirement-coverage-input-compose`, `requirement-coverage-view`, `requirement-browser-server --view coverage` | caller-owned direct or source-set test inventory, caller-owned explicit test discovery facts, declared quality findings, requirement source, proof binding or compact proof contract, coverage universe, optional owner-invariant registry, aggregate coverage compose input | strict inventory/source-set admission, candidate-only discovery draft projection, fail-closed normalized inventory projection, deterministic coverage-view input composition from explicit facts, missing declared assertion-signal and declared-quality classification, bounded agent action guidance, requirement/test/command/owner-invariant joins, nonsemantic command-evidence classification, stable coverage failure/warning classifications, presentation-only coverage view | inventory completeness, oracle quality, test quality, test discovery extraction, native test execution, receipt freshness, producer trust, merge policy | candidate inventory guidance, inventory report, normalized inventory data product, coverage-view input, coverage view, or browser presentation |
-| Selective planning | `changed-path-set`, `requirement-impact-input-compose`, `impact`, `selective-gate-plan`, `selective-gate-evidence`, `selective-gate-obligation-decision-input`, `proof-obligation-algebra`, `obligation-decision` | changed paths, base/current requirement sources, base/current single-binding-per-requirement proof contracts, generated-artifact policy, local environment policy, proof-like path policy, scan obligation ownership, planned receipts, obligation routes, obligation algebra records | fail-closed impact input composition, fail-closed planning, receipt comparison, obligation algebra admission, bounded agent packets | git diff truth, repository scanning, command execution, producer trust, final admission | composed impact input, plan, evidence report, obligation algebra report, or obligation input |
+| Selective planning | `changed-path-set`, `requirement-impact-input-compose`, `impact`, `selective-gate-plan`, `selective-gate-evidence`, `selective-gate-obligation-decision-input`, `proof-obligation-algebra`, `obligation-decision` | changed paths, base/current requirement sources, base/current declaration-only proof contracts with zero or more scenario bindings per requirement, generated-artifact policy, local environment policy, proof-like path policy, scan obligation ownership, planned receipts, obligation routes, obligation algebra records | fail-closed impact input composition, binding-aware fan-out, fail-closed planning, receipt comparison, obligation algebra admission, bounded agent packets | git diff truth, repository scanning, command execution, producer trust, final admission | composed impact input, plan, evidence report, obligation algebra report, or obligation input |
 | Receipts and producers | `proof-receipt-admission`, `receipt-producer-admission`, `receipt-currentness-scope`, `receipt-trust-class`, `producer-policy-self-proof` | receipt sets, producer policy, scope/currentness facts, trust classes | receipt shape, producer/receipt compatibility, self-proof diagnostics | producer authentication, freshness policy, CI trust roots | receipt/provenance report |
 | Release and deployment | `release-authority`, `external-consumer`, `registry-consumer-proof-input-compose`, `registry-consumer`, `deployment-evidence-admission`, `completion-criteria`, `branch-authority`, `readiness-closeout` | package facts, tarball/registry facts, explicit primitive registry/install/smoke facts, deployment evidence, criteria, branch facts | artifact/channel boundary checks, registry-consumer input composition, release diagnostics, falsifiable criteria shape | package publication, registry fetch, package-manager execution, deployment, rollback, approval | composed input, release/deployment/readiness report |
-| Supply-chain and quality | `self-check`, release workflow, `npm run release:sbom`, `npm run self:coverage`, `npm run go:actionlint`, `npm run go:bench` | release artifacts, source workflows, specs, bindings, witness plans, explicit benchmark invocation | deterministic self-check report shape, SBOM candidate evidence, coverage metrics, workflow lint routing, benchmark entrypoints | public-source provenance, vulnerability triage, license approval, CI run admission, release approval | self-check report, SBOM, metrics report, CI signal, or benchmark output |
+| Supply-chain and quality | `self-check`, release workflow, `npm run release:sbom`, `npm run self:coverage`, `npm run go:actionlint`, `npm run go:bench` | release artifacts, source workflows, specs, bindings, witness plans, command-oracle candidate inventory, independently authored counterfeit corpus, explicit benchmark invocation | deterministic self-check report shape, SBOM candidate evidence, exact-file materialized-snapshot package-scoped selected-test execution, production-owner counterfeit decisions, strict one-read and current-owner command-oracle diagnostic admission, execution-backed coverage metrics, workflow lint routing, benchmark entrypoints | assertion-branch execution, mutation adequacy, producer authentication, public-source provenance, vulnerability triage, license approval, CI run admission, release approval | self-check report, SBOM, command-oracle diagnostic, metrics report, CI signal, or benchmark output |
 
 The `npm run release:sbom`, `npm run self:coverage`, `npm run go:actionlint`,
 and `npm run go:bench` routes above are maintainer commands for a source

package/docs/release-process.md

@@ -128,7 +128,16 @@ static analysis, workflow linting, vulnerability checks, npm package artifact
 creation, package artifact verification, Python wheel artifact creation, Python
 wheel verification, release SBOM, release manifest and checksum generation,
 outside-consumer binary smoke proof, self-hosting receipt validation, and
-coverage metrics generation.
+coverage metrics generation. Coverage generation runs the exact owner-selected
+Go tests through package-scoped argv vectors from an exact-file materialized
+source snapshot, evaluates the independently authored counterfeit corpus
+through production admission owners, and emits a command-oracle diagnostic
+plus coverage metrics v2 only while the candidate, corpus, runtime, and source
+identities remain current. Release closeout re-admits that diagnostic through
+its sole strict owner, binds its digest to the same canonical byte read, and
+revalidates current producer reachability. This local cooperative execution
+does not prove assertion-branch execution, mutation adequacy, producer
+authentication, or provider admission.
 
 The dry-run package identity proves candidate tarball shape only. It does not
 prove the bytes served by the registry after publish.

package/docs/specs/proofkit-spec-proof-core/overview.md

@@ -16,14 +16,13 @@ execution receipts, and merge policy.
   or scanning overview prose as authority; one shipped, marker-bounded example
   is parsed as bounded expansion-free literal shell words and executed through
   the installed current product as a first valid input.
-- `REQ-PROOFKIT-SPEC-002`: requirement proof binding reports validate
-  caller-owned requirement-to-witness mappings, require compact scenarios to be
-  admitted `surface_id::stable_anchor` identities, require compact witness
-  selectors to use `repo/path::stable_anchor` identities, admit caller-owned
-  source-set fragments and selected-source resolver projections, and derive
-  typed compact proof contract projections for surfaces, scenarios, witnesses,
-  commands, environment classes, conformance facts, and falsification routes
-  without executing witnesses or deciding proof freshness.
+- `REQ-PROOFKIT-SPEC-002`: compact proof route declarations preserve the full
+  requirement/surface/scenario binding identity and role-qualified witness-route
+  identity, preserve each route's JSON-safe non-negative resolution order, admit
+  declaration-only v2 contracts plus source-set v2 and fragment v3 inputs, retain
+  distinct positive and falsification roles even for one shared selector, and
+  reject legacy proof-state, synthetic evidence counts, collapsed roles, and
+  identity-loss projections without claiming execution or assurance.
 - `REQ-PROOFKIT-SPEC-003`: witness planning accepts caller-owned structured
   command metadata, scheduler constraints, environment classes, and
   binding-derived command projections only through admitted witness vocabulary
@@ -79,11 +78,13 @@ execution receipts, and merge policy.
   serving with one exact supported-view vocabulary without accepting
   caller-owned raw HTML or making rendered output authoritative.
 - `REQ-PROOFKIT-SPEC-010`: requirement impact input composition converts
-  caller-owned base/current requirement sources, single-current-binding compact
-  proof contracts, changed-path facts, generated-artifact policy, local
-  environment policy, and proof-like path policy into a direct `impact` input
-  without scanning repositories, executing witnesses, or becoming a second
-  impact evaluator.
+  caller-owned base/current requirement sources, compact proof contracts with
+  one or more current bindings per active blocking requirement, changed-path
+  facts, generated-artifact policy, local environment policy, and proof-like
+  path policy into a direct `impact` input, treating every referenced surface
+  semantic change as a change to every referencing binding under the
+  proof-binding source-path policy, without scanning repositories, executing
+  witnesses, or becoming a second impact evaluator.
 - `REQ-PROOFKIT-SPEC-011`: adoption contract envelope admission validates a
   complete caller-owned aggregate adoption envelope, selects one child route
   through orthogonal CLI flags, rejects repeated single-value mode or pilot
@@ -141,6 +142,14 @@ execution receipts, and merge policy.
   evidence planes, consumes the normalized v1/v2 context boundary, and accepts
   code topology only as explicit caller-owned input with source-digest,
   parent-edge, abstraction-order, and pre-materialization budget closure.
+- `REQ-PROOFKIT-SPEC-024`: a private representation-neutral requirement-source
+  v2 model separates immutable atomic, authoring-layout, and typed-reference
+  projections, closes every metadata owner, group-member relation, and typed
+  reference under independently observed input, instantiated-scenario, and
+  expanded-output bounds with fixed budget-error precedence, and proves exact
+  package, field, representation, variant, and positive/negative relation
+  coverage without attributing correlated edits to independent field
+  causality, selecting a codec, or changing a public source boundary.
 
 ## Non-Claims
 

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -35,7 +35,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-002",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Requirement proof binding reports validate caller-owned requirement-to-witness mappings, require compact scenarios to use admitted surface_id::stable_anchor identities, require compact witness selectors to use admitted repo/path::stable_anchor identities, admit caller-owned source-set fragments and selected-source resolver projections, and derive typed compact proof contract projections for surfaces, scenarios, witnesses, commands, environment classes, conformance facts, and falsification routes without executing witnesses or deciding proof freshness.",
+      "invariant": "Requirement proof route declaration admission preserves each compact binding identity as requirementId, surfaceId, and scenarioId; preserves each witness route as bindingRecordId, role, selector, a JSON-safe non-negative resolutionOrderIndex, and witnessRouteId; admits exactly one positive and one falsification role even when both roles use the same selector; requires declaration-only v2 compact discriminators and admitted source-set v2 or fragment-v3 identities; rejects legacy proof-state, synthetic checked or finding counts, collapsed roles, and identity-loss projections; and derives only caller-owned declaration or lookup facts without executing witnesses or deciding selector resolution, oracle quality, mutation adequacy, proof freshness, trust, assurance, merge, rollout, or production readiness.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": [
@@ -45,7 +45,7 @@
         "NC-PROOFKIT-SPEC-002"
       ],
       "nonClaims": [
-        "This requirement does not claim native witness pass evidence, proof freshness, receipt authenticity, or merge approval."
+        "This requirement does not claim selector existence or resolution, oracle quality, native witness execution or pass evidence, mutation adequacy, finding completeness or absence, proof freshness, receipt authenticity, trust, assurance, merge approval, rollout approval, or production readiness."
       ],
       "lifecycle": {
         "state": "active",
@@ -251,7 +251,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-010",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Requirement impact input composition converts caller-owned base and current requirement sources, single-current-binding compact proof contracts, changed-path facts, generated-artifact policy, local environment policy, and proof-like path policy into a direct impact command input while preserving downstream impact semantics and without scanning repositories, executing witnesses, deciding freshness, or becoming a second impact evaluator.",
+      "invariant": "Requirement impact input composition converts caller-owned base and current requirement sources, compact proof contracts with one or more current bindings per active blocking requirement, changed-path facts, generated-artifact policy, local environment policy, and proof-like path policy into a direct impact command input; treats every referenced surface semantic change as a change to every referencing binding under the proof-binding source-path policy; preserves downstream impact semantics; and does not scan repositories, execute witnesses, decide freshness, or become a second impact evaluator.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": [
@@ -555,6 +555,19 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "A private representation-neutral requirement-source v2 model admits one bounded source into immutable atomic, authoring-layout, and typed-reference projections; it preserves atomic requirement identity while expanding grouped statement stems and premises, preserves group-to-member relations under composite identity, assigns every effective metadata field to exactly one resolving profile or member owner, admits lifecycle, deferral, update-policy, scenario, vocabulary, non-claim, and derivation semantics through closed variants and references, applies architecture-independent input, instantiated-scenario, and expanded-materialization cardinality and text budgets in a fixed precedence before per-item semantic work, rejects both lexical and single-pass parameter-instantiated observation contradictions, normalizes admitted set-like values deterministically, emits nondisclosing diagnostics deterministically for each exact input, and preserves ordered action sequences. An independently authored exact typed-field and closed-variant manifest plus an identity-aware admitted semantic mutant corpus proves individual field projection, both metadata-owner branches, or an explicitly named referential relation with negative near-miss controls and without attributing correlated edits to independent field causality; independent structural observers prove exact package exports and direct imports, representation neutrality, exact input, instantiated-scenario, and expanded-output costs, and exact versus limit-minus-one budget behavior.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-024"],
+      "nonClaims": ["This private single-source model does not select or expose a source codec, parse or serialize a persisted source, retain a normalized mirror, establish cross-source requirement identity, authenticate derivation objects, digests, selectors, or freshness, authenticate a caller-declared sourceKind or prove its author's authority or trust class, cut over any current requirement consumer, prove requirement meaning or implementation correctness, execute native witnesses, approve merge or release, or establish rollout or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ],
   "nonClaims": [

package/docs/specs/proofkit-supply-chain-quality/overview.md

@@ -58,15 +58,20 @@ vulnerability absence, or consumer rollout safety by itself.
 - `REQ-PROOFKIT-QUALITY-009`: performance-sensitive parser and serializer
   paths expose benchmark entrypoints without making wall-clock budgets a
   required PR gate before stable baselines exist.
-- `REQ-PROOFKIT-QUALITY-010`: coverage metrics report requirement, binding,
-  witness, CLI inventory linkage, and descriptor-owned command proof-route
-  candidates from admitted test-evidence-inventory rows, while critical
-  anti-vacuity scenarios retain exact closed selector inventories. Each linkage and route
-  conjunct has an independent fail-closed falsifier, and each source-checkout
-  selector resolves to a valid function in an active Go test file with its
-  exact executable command; static route metadata, prose, source markers, test
-  existence, and failure-capable syntax never become semantic falsifier
-  evidence.
+- `REQ-PROOFKIT-QUALITY-010`: coverage metrics keep static proof-route
+  candidates separate from an execution-backed command-oracle ledger. The
+  ledger runs exact selected Go tests through package-scoped argv vectors from
+  one exact-file materialized source snapshot, joins reserved lifecycle
+  attributes to every candidate identity, terminates bounded subprocesses on
+  cancellation or output overflow, confines atomic artifact publication and
+  invalidation to non-symlink repository paths, and fails closed on incomplete
+  command coverage or event, source, selection, producer-reachability, and
+  identity drift. A versioned counterfeit corpus owns checked-in expected
+  decisions for every required policy axis, evidence class, record coordinate,
+  and substitution axis; its mutations execute the production admission and
+  lifecycle owners rather than a generated expectation copy. Passing selected
+  tests does not prove assertion-branch execution, mutation adequacy, or
+  exhaustive command semantics.
 - `REQ-PROOFKIT-QUALITY-011`: CI separates the OS-independent full
   source/package gate from macOS platform smoke, executes the complete Go
   package set through its owner command, uses explicit hosted runner labels
@@ -102,12 +107,11 @@ vulnerability absence, or consumer rollout safety by itself.
   fields after validation.
 - `REQ-PROOFKIT-QUALITY-015`: the package gate includes an admitted release
   closeout completion-criteria report so unit tests alone cannot satisfy
-  release closeout, and coverage-metric re-admission uses overflow-safe exact
-  producer relations plus the complete command inventory, and compares both
-  coverage command projections with the actual `cli-contract.v2.json` command
-  inventory from the same source snapshot, so neither an impossible count
-  partition nor a coordinated same-size command substitution can satisfy
-  closeout.
+  release closeout. Coverage re-admission rejects candidate-only v1, requires
+  overflow-safe exact producer relations plus the complete command inventory,
+  and binds coverage v2 to the current command-oracle diagnostic through the
+  ledger owner's one-read canonical admission, current-owner revalidation, and
+  record, candidate-set, corpus, revision, and source-snapshot digests.
 - `REQ-PROOFKIT-QUALITY-016`: release platform targets use one private owner
   that projects platform suffixes, Go build targets, npm OS/CPU metadata,
   package tar entries, Python wheel tags, PyPI candidate completeness,

package/docs/specs/proofkit-supply-chain-quality/requirements.v1.json

@@ -129,12 +129,12 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-010",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "Coverage metrics report requirement, binding, witness, CLI inventory linkage, and descriptor-owned command proof-route candidates from admitted test-evidence-inventory rows, failing closed independently for each requirement/proof linkage dead-zone class and each missing-candidate, unknown-candidate-ref, unknown-declared-semantic-route-ref, contract-only, or route-only command-route class; source-checkout witness selectors must resolve to valid functions in active Go test files with exact executable commands and a failure-capable assertion candidate outside literal-dead branches, uninvoked closures, and skip-bearing helper paths, critical anti-vacuity scenarios must retain their exact closed selector inventories, and failed command-route inventory admission also fails closed, while static route metadata, prose, source markers, test existence, and failure-capable syntax remain candidate evidence and cannot become execution-backed semantic evidence.",
+      "invariant": "Coverage metrics report requirement, binding, witness, CLI inventory linkage, descriptor-owned command proof-route candidates, and a separate execution-backed command-oracle ledger. The ledger must bind every candidate commandRef, selector, concrete negative case, falsification event, assertion oracle, expected public outcome, and owner invariant to one immutable exact-file materialized source snapshot; execute exactly the selected active Go tests through canonically ordered package-scoped argv vectors that cannot select same-named non-candidate tests in another package; require unique package start and pass events, unique test run and pass events, owner-reserved cooperative attributes for every candidate, bounded cancellable subprocesses, and immediate process-group termination on output-limit violation; reject missing, unknown, duplicate, skipped, failed, reordered, context-invalid, spoofed-output, cross-test, source-drift, producer-unreachable candidate projections, and correlated identity substitutions; publish and invalidate local diagnostic and metrics artifacts atomically through repository-confined non-symlink destinations; revalidate current candidate, corpus, runtime, and source identities before and after artifact publication; and fail closed when any public command lacks execution-backed evidence. An independently authored versioned counterfeit corpus must bijectively cover every shipped evidence class, required policy axis, record coordinate, and declared substitution axis with positive controls and checked-in exact expected decisions evaluated through the production admission and lifecycle owners rather than a generated expectation registry. Static route metadata, prose, legacy source markers, test existence, and failure-capable syntax remain proof-route candidates and cannot satisfy the execution-backed closure.",
       "claimLevel": "blocking",
       "riskClass": "medium",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
       "nonClaimRefs": ["NC-PROOFKIT-QUALITY-010"],
-      "nonClaims": ["This requirement does not claim semantic command coverage, line coverage, dead-code absence, exhaustive semantic completeness for any test, native witness execution, receipt freshness, or merge satisfaction."],
+      "nonClaims": ["Successful selected tests do not prove assertion-branch execution, mutation adequacy, line coverage, dead-code absence, exhaustive command semantics, malicious-test resistance, producer authentication, receipt freshness, merge satisfaction, or production readiness."],
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
@@ -194,7 +194,7 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-015",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "The package gate includes an admitted release closeout completion-criteria report that classifies package artifacts, Python wrappers, release manifest, SBOM, channel scope, and self-hosting evidence instead of allowing unit tests alone to satisfy release closeout; coverage-metric re-admission uses overflow-safe relations to require the exact producer projection between admitted entries, routes, route classes, proof-route candidates, the complete command inventory, and commands missing declaration-only routes, and compares both coverage command projections with the actual cli-contract.v2.json command inventory from the same source snapshot.",
+      "invariant": "The package gate includes an admitted release closeout completion-criteria report that classifies package artifacts, Python wrappers, release manifest, SBOM, channel scope, and self-hosting evidence instead of allowing unit tests alone to satisfy release closeout; coverage-metric re-admission rejects candidate-only v1 reports, uses overflow-safe relations to require the exact producer projection between admitted entries, routes, route classes, proof-route candidates, execution-backed command-oracle entries, the complete command inventory, and commands missing declaration-only routes, compares both coverage command projections with the actual cli-contract.v2.json command inventory, and binds the coverage report to a command-oracle diagnostic admitted by its sole owner from one bounded byte read, with the digest computed from those same canonical bytes and matched by candidate-set digest, counterfeit-corpus digest, source revision, and source-snapshot digest. Release closeout additionally revalidates that the diagnostic remains reachable from the current candidate, corpus, runtime, and source owners before admitting it.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,