@research-engineering/agentic-proofkit 0.3.0 → 0.5.0

package/proofkit/requirement-bindings.json

@@ -89,7 +89,7 @@
       "claimLevel": "blocking",
       "proofState": "witness_backed",
       "nonClaims": [
-        "This requirement does not claim native witness pass evidence, proof freshness, receipt authenticity, or merge approval."
+        "This requirement does not claim selector existence or resolution, oracle quality, native witness execution or pass evidence, mutation adequacy, finding completeness or absence, proof freshness, receipt authenticity, trust, assurance, merge approval, rollout approval, or production readiness."
       ]
     },
     {
@@ -469,7 +469,7 @@
       "claimLevel": "blocking",
       "proofState": "witness_backed",
       "nonClaims": [
-        "This requirement does not claim semantic command coverage, line coverage, dead-code absence, exhaustive semantic completeness for any test, native witness execution, receipt freshness, or merge satisfaction."
+        "Successful selected tests do not prove assertion-branch execution, mutation adequacy, line coverage, dead-code absence, exhaustive command semantics, malicious-test resistance, producer authentication, receipt freshness, merge satisfaction, or production readiness."
       ]
     },
     {
@@ -612,6 +612,22 @@
       "proofState": "witness_backed",
       "nonClaims": ["This requirement does not claim external action safety, tag equivalence, provider execution, branch-protection configuration, release publication, or provider-side asset immutability."]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-026",
+      "ownerId": "proofkit.supply-chain-quality",
+      "specPath": "docs/specs/proofkit-supply-chain-quality/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This bounded encoding policy does not prove terminal-rendering equivalence or safety of arbitrary downstream decoders."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "ownerId": "proofkit.supply-chain-quality",
+      "specPath": "docs/specs/proofkit-supply-chain-quality/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This bounded diagnostic taxonomy does not prove confidentiality of values outside its admitted secret and control classes or claim that every repository-internal tool invocation uses the installed-carrier timeout policy."]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-017",
       "ownerId": "proofkit.spec-proof-core",
@@ -671,6 +687,102 @@
       "claimLevel": "blocking",
       "proofState": "witness_backed",
       "nonClaims": ["Expected-digest coverage does not authenticate a producer, baseline, checkout, or freshness; this requirement also does not infer code topology, line or branch coverage, native execution, merge approval, release approval, rollout approval, or production readiness."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "ownerId": "proofkit.spec-proof-core",
+      "specPath": "docs/specs/proofkit-spec-proof-core/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This private single-source model does not select or expose a source codec, parse or serialize a persisted source, retain a normalized mirror, establish cross-source requirement identity, authenticate derivation objects, digests, selectors, or freshness, authenticate a caller-declared sourceKind or prove its author's authority or trust class, cut over any current requirement consumer, prove requirement meaning or implementation correctness, execute native witnesses, approve merge or release, or establish rollout or production readiness."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-001",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["The planner does not authenticate caller assertions or prove that a planned action was executed, correct, reviewed, or completed."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-002",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["Stage ordering does not prove the semantic adequacy of any architecture, design, plan, implementation, verification, pull request, or closeout artifact."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-003",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["The snapshot relation does not own pending work, elapsed time, predecessor history, waiver, abort, reopen, or external task-state transitions."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-004",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["Digest equality proves only internal equality of caller-declared identity fields and does not bind actual bytes, authenticate the reviewer, establish currentness or trust, or prove assessment quality."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-005",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["Structural least closure relative to caller-declared seeds and edges does not prove context truth, freshness, semantic sufficiency, global minimality, or provider token usage."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-006",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["Explicit caller input does not establish repository identity, policy, source meaning, authorization to mutate, or the truth of observations made outside Proofkit."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-007",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["The template does not generate, execute, approve, authenticate, or prove adequacy of a consuming repository's script, witness, oracle, receipt, policy, or cleanup implementation."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-008",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["Bounded nondisclosure admission does not prove absence of every possible sensitive value or every terminal interpretation."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-009",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["Terminal styling is presentation only and does not claim identical rendering across terminal emulators."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-010",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["Structural minimality does not prove universal usability, open-world optimality, lower provider token use, or lower cognitive cost for every user and repository."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-011",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["Public-surface closure does not claim wheel documentation parity and does not prove registry publication, provider ingestion, compatibility on untested platforms, native witness truth, merge approval, rollout, or production readiness."]
     }
   ],
   "bindings": [
@@ -1405,6 +1517,16 @@
       "witnessId": "proofkit.agent-envelope.reference-closure",
       "witnessKind": "contract",
       "witnessPath": "internal/kernel/agentenvelope/agentenvelope_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildPrunesReferencesToTruncatedLocalTargets",
+          "command": "go test ./internal/kernel/agentenvelope -run '^TestBuildPrunesReferencesToTruncatedLocalTargets$'"
+        },
+        {
+          "selector": "TestBuildPrunesCommandIDsWithoutRetainedCommands",
+          "command": "go test ./internal/kernel/agentenvelope -run '^TestBuildPrunesCommandIDsWithoutRetainedCommands$'"
+        }
+      ],
       "commandIds": [
         "proofkit.go-test"
       ],
@@ -1412,6 +1534,37 @@
         "local-go"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-005",
+      "scenarioId": "proofkit.spec-proof-core.agent-envelope-local-identity-admission",
+      "witnessId": "proofkit.agent-envelope.local-identity-admission-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/agentenvelope/reference_identity_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildRejectsDuplicateAndCrossDomainLocalIdentities",
+          "command": "go test ./internal/kernel/agentenvelope -run '^TestBuildRejectsDuplicateAndCrossDomainLocalIdentities$'"
+        },
+        {
+          "selector": "TestBuildPrunesAmbiguousIdentityFromEveryReferenceContainer",
+          "command": "go test ./internal/kernel/agentenvelope -run '^TestBuildPrunesAmbiguousIdentityFromEveryReferenceContainer$'"
+        },
+        {
+          "selector": "TestBuildOmitsUnsafeTargetsAndReferencesBeforeDisplaySanitization",
+          "command": "go test ./internal/kernel/agentenvelope -run '^TestBuildOmitsUnsafeTargetsAndReferencesBeforeDisplaySanitization$'"
+        },
+        {
+          "selector": "TestBuildCountsStandaloneUnsafeReferenceOmissions",
+          "command": "go test ./internal/kernel/agentenvelope -run '^TestBuildCountsStandaloneUnsafeReferenceOmissions$'"
+        },
+        {
+          "selector": "TestBuildPreservesUniqueLocalAndSafeExternalReferences",
+          "command": "go test ./internal/kernel/agentenvelope -run '^TestBuildPreservesUniqueLocalAndSafeExternalReferences$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-006",
       "scenarioId": "proofkit.spec-proof-core.test-inventory-normalized-output",
@@ -2335,6 +2488,38 @@
         "local-go"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-010",
+      "scenarioId": "proofkit.supply-chain-quality.artifact-file-boundary",
+      "witnessId": "proofkit.artifact-file.boundary",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/artifactfile/file_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestOperationsRejectFinalSymlinkWithoutTargetMutation",
+          "command": "go test ./internal/tools/artifactfile -run '^TestOperationsRejectFinalSymlinkWithoutTargetMutation$'"
+        },
+        {
+          "selector": "TestOperationsRejectSymlinkComponentsWithoutOutsideMutation",
+          "command": "go test ./internal/tools/artifactfile -run '^TestOperationsRejectSymlinkComponentsWithoutOutsideMutation$'"
+        },
+        {
+          "selector": "TestReadBoundedRejectsUnrepresentableLimit",
+          "command": "go test ./internal/tools/artifactfile -run '^TestReadBoundedRejectsUnrepresentableLimit$'"
+        },
+        {
+          "selector": "TestWriteReadAndRemoveRoundTrip",
+          "command": "go test ./internal/tools/artifactfile -run '^TestWriteReadAndRemoveRoundTrip$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.coverage-metrics",
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-010",
       "scenarioId": "proofkit.supply-chain-quality.coverage-metrics",
@@ -2349,6 +2534,126 @@
         {
           "selector": "TestEachLinkageDeadZoneConjunctHasIndependentFalsifier",
           "command": "go test ./internal/tools/coveragemetrics -run '^TestEachLinkageDeadZoneConjunctHasIndependentFalsifier$'"
+        },
+        {
+          "selector": "TestInvalidateMetricsFileRejectsSymlinkParentWithoutDeletingOutsideFile",
+          "command": "go test ./internal/tools/coveragemetrics -run '^TestInvalidateMetricsFileRejectsSymlinkParentWithoutDeletingOutsideFile$'"
+        },
+        {
+          "selector": "TestWriteMetricsFileRejectsSymlinkEscapeWithoutMutation",
+          "command": "go test ./internal/tools/coveragemetrics -run '^TestWriteMetricsFileRejectsSymlinkEscapeWithoutMutation$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.coverage-metrics",
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-010",
+      "scenarioId": "proofkit.supply-chain-quality.command-oracle-counterfeit-corpus",
+      "witnessId": "proofkit.command-oracle.counterfeit-corpus",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/commandoracle/corpus_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestCounterfeitCorpusClosesRequiredAxes",
+          "command": "go test ./internal/tools/commandoracle -run '^TestCounterfeitCorpusClosesRequiredAxes$'"
+        },
+        {
+          "selector": "TestCounterfeitCorpusClosureRejectsMissingRequiredAxes",
+          "command": "go test ./internal/tools/commandoracle -run '^TestCounterfeitCorpusClosureRejectsMissingRequiredAxes$'"
+        },
+        {
+          "selector": "TestEachCounterfeitCaseProducesItsCheckedInDecision",
+          "command": "go test ./internal/tools/commandoracle -run '^TestEachCounterfeitCaseProducesItsCheckedInDecision$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.coverage-metrics",
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-010",
+      "scenarioId": "proofkit.supply-chain-quality.command-oracle-execution-ledger",
+      "witnessId": "proofkit.command-oracle.execution-ledger",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/commandoracle/execute_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestExecuteBindsMaterializedSourceCandidatesAndRuntimeEvents",
+          "command": "go test ./internal/tools/commandoracle -run '^TestExecuteBindsMaterializedSourceCandidatesAndRuntimeEvents$'"
+        },
+        {
+          "selector": "TestRunGoTestsTerminatesOnContextDeadline",
+          "command": "go test ./internal/tools/commandoracle -run '^TestRunGoTestsTerminatesOnContextDeadline$'"
+        },
+        {
+          "selector": "TestRunGoTestCommandTerminatesImmediatelyWhenStderrExceedsBound",
+          "command": "go test ./internal/tools/commandoracle -run '^TestRunGoTestCommandTerminatesImmediatelyWhenStderrExceedsBound$'"
+        },
+        {
+          "selector": "TestRunGoTestsDoesNotExecuteCrossPackageNameMatches",
+          "command": "go test ./internal/tools/commandoracle -run '^TestRunGoTestsDoesNotExecuteCrossPackageNameMatches$'"
+        },
+        {
+          "selector": "TestValidateCurrentRejectsProducerUnreachableCandidateProjection",
+          "command": "go test ./internal/tools/commandoracle -run '^TestValidateCurrentRejectsProducerUnreachableCandidateProjection$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.coverage-metrics",
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-010",
+      "scenarioId": "proofkit.supply-chain-quality.command-oracle-source-snapshot",
+      "witnessId": "proofkit.command-oracle.source-snapshot",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/repositorysnapshot/snapshot_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestCaptureContextTerminatesCanceledGitProcessGroup",
+          "command": "go test ./internal/tools/repositorysnapshot -run '^TestCaptureContextTerminatesCanceledGitProcessGroup$'"
+        },
+        {
+          "selector": "TestCaptureContextTerminatesGitProcessGroupOnOutputOverflow",
+          "command": "go test ./internal/tools/repositorysnapshot -run '^TestCaptureContextTerminatesGitProcessGroupOnOutputOverflow$'"
+        },
+        {
+          "selector": "TestCaptureRejectsSuccessfulGitDiagnosticsWithoutEcho",
+          "command": "go test ./internal/tools/repositorysnapshot -run '^TestCaptureRejectsSuccessfulGitDiagnosticsWithoutEcho$'"
+        },
+        {
+          "selector": "TestMaterializeBindsCopiedBytesAndRejectsLiveMutation",
+          "command": "go test ./internal/tools/repositorysnapshot -run '^TestMaterializeBindsCopiedBytesAndRejectsLiveMutation$'"
+        },
+        {
+          "selector": "TestMaterializeRejectsSymlinkAndNonEmptyDestination",
+          "command": "go test ./internal/tools/repositorysnapshot -run '^TestMaterializeRejectsSymlinkAndNonEmptyDestination$'"
+        },
+        {
+          "selector": "TestMaterializeRejectsSymlinkedDestinationInsideSource",
+          "command": "go test ./internal/tools/repositorysnapshot -run '^TestMaterializeRejectsSymlinkedDestinationInsideSource$'"
+        },
+        {
+          "selector": "TestValidRevisionAdmitsOnlyGitObjectIdentityAndOptionalSnapshotDigest",
+          "command": "go test ./internal/tools/repositorysnapshot -run '^TestValidRevisionAdmitsOnlyGitObjectIdentityAndOptionalSnapshotDigest$'"
+        },
+        {
+          "selector": "TestValidateMaterializedRejectsSurplusFile",
+          "command": "go test ./internal/tools/repositorysnapshot -run '^TestValidateMaterializedRejectsSurplusFile$'"
         }
       ],
       "commandIds": [
@@ -2639,6 +2944,14 @@
         {
           "selector": "TestBuildInputFailsClosedForEachBlockingEvidenceClass",
           "command": "go test ./internal/tools/releasecloseoutinput -run '^TestBuildInputFailsClosedForEachBlockingEvidenceClass$'"
+        },
+        {
+          "selector": "TestSelfEvidenceInvokesCurrentCommandOracleOwner",
+          "command": "go test ./internal/tools/releasecloseoutinput -run '^TestSelfEvidenceInvokesCurrentCommandOracleOwner$'"
+        },
+        {
+          "selector": "TestSelfEvidenceRejectsProducerUnreachableCommandOracleRef",
+          "command": "go test ./internal/tools/releasecloseoutinput -run '^TestSelfEvidenceRejectsProducerUnreachableCommandOracleRef$'"
         }
       ],
       "commandIds": [
@@ -3319,6 +3632,74 @@
       "commandIds": ["proofkit.browser-check"],
       "environmentClasses": ["local-node-browser"]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-023",
+      "scenarioId": "proofkit.supply-chain-quality.npm-python-carrier-binary-byte-identity",
+      "witnessId": "proofkit.package-verifier.platform-binary-byte-identity-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/packageverify/main_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestPackedPlatformBinariesMatchReleaseBinaryBytes",
+          "command": "go test ./internal/tools/packageverify -run '^TestPackedPlatformBinariesMatchReleaseBinaryBytes$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-023",
+      "scenarioId": "proofkit.supply-chain-quality.final-cross-carrier-binary-byte-identity",
+      "witnessId": "proofkit.release-manifest.cross-carrier-byte-identity-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/releasemanifest/carrier_identity_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestCrossCarrierBinaryIdentityReadsFinalArchives",
+          "command": "go test ./internal/tools/releasemanifest -run '^TestCrossCarrierBinaryIdentityReadsFinalArchives$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-023",
+      "scenarioId": "proofkit.supply-chain-quality.release-closeout-npm-byte-admission",
+      "witnessId": "proofkit.release-closeout.npm-byte-admission-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/releasecloseoutinput/main_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildInputFailsClosedForEachBlockingEvidenceClass",
+          "command": "go test ./internal/tools/releasecloseoutinput -run '^TestBuildInputFailsClosedForEachBlockingEvidenceClass$'"
+        },
+        {
+          "selector": "TestPackRecordBytesMatchEnforcesByteLimit",
+          "command": "go test ./internal/tools/releasecloseoutinput -run '^TestPackRecordBytesMatchEnforcesByteLimit$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-023",
+      "scenarioId": "proofkit.supply-chain-quality.release-artifact-immutable-snapshot",
+      "witnessId": "proofkit.release-manifest.immutable-artifact-epoch-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/releasemanifest/artifact_snapshot_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestReleaseArtifactSnapshotOwnsOneImmutableEpoch",
+          "command": "go test ./internal/tools/releasemanifest -run '^TestReleaseArtifactSnapshotOwnsOneImmutableEpoch$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-023",
       "scenarioId": "proofkit.supply-chain-quality.python-wheel-platform-byte-compatibility",
@@ -3466,24 +3847,297 @@
       "environmentClasses": ["local-go"]
     },
     {
-      "requirementId": "REQ-PROOFKIT-SPEC-019",
-      "scenarioId": "proofkit.spec-proof-core.requirement-context-composition",
-      "witnessId": "proofkit.requirement-context.compose-round-trip-falsifier",
+      "requirementId": "REQ-PROOFKIT-QUALITY-026",
+      "scenarioId": "proofkit.supply-chain-quality.unicode-scalar-policy",
+      "witnessId": "proofkit.unicode-policy.scalar-table-falsifier",
       "witnessKind": "contract",
-      "witnessPath": "internal/command/requirementcontext/requirementcontext_test.go",
+      "witnessPath": "internal/kernel/unicodepolicy/unicodepolicy_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestUnsafeScalarTableMatchesVersionedOwnerCorpus",
+          "command": "go test ./internal/kernel/unicodepolicy -run '^TestUnsafeScalarTableMatchesVersionedOwnerCorpus$'"
+        },
+        {
+          "selector": "TestUnsafeScalarTableMatchesEveryUnicode15Scalar",
+          "command": "go test ./internal/kernel/unicodepolicy -run '^TestUnsafeScalarTableMatchesEveryUnicode15Scalar$'"
+        },
+        {
+          "selector": "TestValidScalarStringRejectsMalformedUTF8",
+          "command": "go test ./internal/kernel/unicodepolicy -run '^TestValidScalarStringRejectsMalformedUTF8$'"
+        }
+      ],
       "commandIds": ["proofkit.go-test"],
       "environmentClasses": ["local-go"]
     },
     {
-      "requirementId": "REQ-PROOFKIT-SPEC-019",
-      "scenarioId": "proofkit.spec-proof-core.requirement-context-composition-whole-cli",
-      "witnessId": "proofkit.app.requirement-context-compose-cli-falsifier",
+      "requirementId": "REQ-PROOFKIT-QUALITY-026",
+      "scenarioId": "proofkit.supply-chain-quality.go-stable-json-unicode-parity",
+      "witnessId": "proofkit.stable-json.go-unicode-falsifier",
       "witnessKind": "contract",
-      "witnessPath": "internal/app/requirement_context_cli_test.go",
-      "commandIds": ["proofkit.go-test"],
-      "environmentClasses": ["local-go"]
-    },
-    {
+      "witnessPath": "internal/kernel/stablejson/stablejson_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestUnicodePolicyCorpus",
+          "command": "go test ./internal/kernel/stablejson -run '^TestUnicodePolicyCorpus$'"
+        },
+        {
+          "selector": "TestMarshalRejectsEveryMalformedUTF8Class",
+          "command": "go test ./internal/kernel/stablejson -run '^TestMarshalRejectsEveryMalformedUTF8Class$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-026",
+      "scenarioId": "proofkit.supply-chain-quality.javascript-stable-json-unicode-parity",
+      "witnessId": "proofkit.stable-json.javascript-unicode-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "scripts/stable_json_selector_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestStableJSONJavaScriptUnicodePredicates",
+          "command": "go test ./scripts -run '^TestStableJSONJavaScriptUnicodePredicates$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-026",
+      "scenarioId": "proofkit.supply-chain-quality.generated-typescript-stable-json-unicode-parity",
+      "witnessId": "proofkit.generated-typescript-adapter.unicode-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/jsonreportcliadaptersource/json_report_cli_adapter_source_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestGeneratedTypeScriptAdapterExecutesCoreSemantics",
+          "command": "go test ./internal/command/jsonreportcliadaptersource -run '^TestGeneratedTypeScriptAdapterExecutesCoreSemantics$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "scenarioId": "proofkit.supply-chain-quality.dynamic-stderr-diagnostic-owner",
+      "witnessId": "proofkit.tool-diagnostic.dynamic-stderr-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "scripts/diagnostic_boundary_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestToolDiagnosticBoundaryRejectsDirectDynamicStderrWrites",
+          "command": "go test ./scripts -run '^TestToolDiagnosticBoundaryRejectsDirectDynamicStderrWrites$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "scenarioId": "proofkit.supply-chain-quality.go-bounded-diagnostic-capture",
+      "witnessId": "proofkit.diagnostic.bounded-capture-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/diagnostic/diagnostic_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestDiagnosticTextEnforcesWholeValueSafetyAndRuneBound",
+          "command": "go test ./internal/kernel/diagnostic -run '^TestDiagnosticTextEnforcesWholeValueSafetyAndRuneBound$'"
+        },
+        {
+          "selector": "TestStderrCaptureSanitizesWholeValuesAndBoundsMemory",
+          "command": "go test ./internal/kernel/diagnostic -run '^TestStderrCaptureSanitizesWholeValuesAndBoundsMemory$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "scenarioId": "proofkit.supply-chain-quality.javascript-entrypoint-diagnostic-owner",
+      "witnessId": "proofkit.javascript-entrypoint.diagnostic-owner-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "scripts/diagnostic-entrypoints.test.mjs",
+      "commandIds": ["proofkit.browser-check"],
+      "environmentClasses": ["local-node-browser"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "scenarioId": "proofkit.supply-chain-quality.browser-proof-writer-diagnostic-nondisclosure",
+      "witnessId": "proofkit.browser-proof-writer.diagnostic-nondisclosure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "scripts/diagnostic_boundary_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBrowserProofWriterRedactsInvalidResolution",
+          "command": "go test ./scripts -run '^TestBrowserProofWriterRedactsInvalidResolution$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "scenarioId": "proofkit.supply-chain-quality.source-hygiene-diagnostic-nondisclosure",
+      "witnessId": "proofkit.source-hygiene.diagnostic-nondisclosure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "scripts/source_hygiene_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestSourceHygieneRedactsSecretShapedTrackedPath",
+          "command": "go test ./scripts -run '^TestSourceHygieneRedactsSecretShapedTrackedPath$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "scenarioId": "proofkit.supply-chain-quality.go-report-visible-whole-value-redaction",
+      "witnessId": "proofkit.admit.whole-value-redaction-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/admit/fields_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestRedactDiagnosticValueReplacesRejectedValuesAsAWhole",
+          "command": "go test ./internal/kernel/admit -run '^TestRedactDiagnosticValueReplacesRejectedValuesAsAWhole$'"
+        },
+        {
+          "selector": "TestReportVisibleRedactionMatrixRejectsSplitSecretsWithoutDisclosure",
+          "command": "go test ./internal/kernel/admit -run '^TestReportVisibleRedactionMatrixRejectsSplitSecretsWithoutDisclosure$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "scenarioId": "proofkit.supply-chain-quality.javascript-report-visible-whole-value-redaction",
+      "witnessId": "proofkit.stable-json.javascript-redaction-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "scripts/stable_json_selector_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestStableJSONJavaScriptDiagnosticWholeValueRedaction",
+          "command": "go test ./scripts -run '^TestStableJSONJavaScriptDiagnosticWholeValueRedaction$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "scenarioId": "proofkit.supply-chain-quality.generated-typescript-report-visible-whole-value-redaction",
+      "witnessId": "proofkit.generated-typescript-adapter.redaction-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/jsonreportcliadaptersource/json_report_cli_adapter_source_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestGeneratedTypeScriptAdapterExecutesCoreSemantics",
+          "command": "go test ./internal/command/jsonreportcliadaptersource -run '^TestGeneratedTypeScriptAdapterExecutesCoreSemantics$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "scenarioId": "proofkit.supply-chain-quality.shared-diagnostic-writer-whole-value-redaction",
+      "witnessId": "proofkit.diagnostic.whole-value-redaction-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/diagnostic/diagnostic_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestWriteErrorPreservesSafeTextAndRedactsRejectedValuesAsAWhole",
+          "command": "go test ./internal/kernel/diagnostic -run '^TestWriteErrorPreservesSafeTextAndRedactsRejectedValuesAsAWhole$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "scenarioId": "proofkit.supply-chain-quality.package-verifier-diagnostic-nondisclosure",
+      "witnessId": "proofkit.package-verifier.diagnostic-nondisclosure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/packageverify/main_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestPackageVerifierDiagnosticNondisclosure",
+          "command": "go test ./internal/tools/packageverify -run '^TestPackageVerifierDiagnosticNondisclosure$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "scenarioId": "proofkit.supply-chain-quality.browser-proof-verifier-diagnostic-nondisclosure",
+      "witnessId": "proofkit.browser-proof-verifier.diagnostic-nondisclosure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/browserproofverify/main_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestDiagnosticsDoNotLeakArtifactValues",
+          "command": "go test ./internal/tools/browserproofverify -run '^TestDiagnosticsDoNotLeakArtifactValues$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "scenarioId": "proofkit.supply-chain-quality.installed-carrier-process-bounds",
+      "witnessId": "proofkit.workflow-smoke.process-bounds-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/workflowsmoke/workflow_smoke_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestRunProcessRejectsTimeout",
+          "command": "go test ./internal/tools/workflowsmoke -run '^TestRunProcessRejectsTimeout$'"
+        },
+        {
+          "selector": "TestRunProcessRejectsOutputOverflow",
+          "command": "go test ./internal/tools/workflowsmoke -run '^TestRunProcessRejectsOutputOverflow$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "scenarioId": "proofkit.supply-chain-quality.installed-carrier-process-group-cleanup",
+      "witnessId": "proofkit.workflow-smoke.process-group-cleanup-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/workflowsmoke/process_unix_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestRunProcessTerminatesDescendantsAfterSuccessfulParentExit",
+          "command": "go test ./internal/tools/workflowsmoke -run '^TestRunProcessTerminatesDescendantsAfterSuccessfulParentExit$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-019",
+      "scenarioId": "proofkit.spec-proof-core.requirement-context-composition",
+      "witnessId": "proofkit.requirement-context.compose-round-trip-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/requirementcontext/requirementcontext_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-019",
+      "scenarioId": "proofkit.spec-proof-core.requirement-context-composition-whole-cli",
+      "witnessId": "proofkit.app.requirement-context-compose-cli-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/requirement_context_cli_test.go",
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
       "requirementId": "REQ-PROOFKIT-SPEC-019",
       "scenarioId": "proofkit.spec-proof-core.requirement-context-digest-coverage-migration",
       "witnessId": "proofkit.requirement-context.digest-coverage-adapter-falsifier",
@@ -3632,6 +4286,297 @@
       "commandIds": ["proofkit.go-test"],
       "environmentClasses": ["local-go"]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-v2-normalization-closure",
+      "witnessId": "proofkit.requirement-source-v2.normalization-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcemodel/model_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestNormalizeBuildsDeterministicSeparatedProjections",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeBuildsDeterministicSeparatedProjections$'"
+        },
+        {
+          "selector": "TestNormalizeRejectsInvalidReferenceAndMetadataPartitions",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeRejectsInvalidReferenceAndMetadataPartitions$'"
+        },
+        {
+          "selector": "TestNormalizeBuildsEveryTypedReferenceRole",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeBuildsEveryTypedReferenceRole$'"
+        },
+        {
+          "selector": "TestModelAccessorsDoNotExposeMutableOwnerState",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestModelAccessorsDoNotExposeMutableOwnerState$'"
+        },
+        {
+          "selector": "TestNormalizeRejectsBudgetBeforeMemberSemantics",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeRejectsBudgetBeforeMemberSemantics$'"
+        },
+        {
+          "selector": "TestNormalizeEnforcesExactInputTextBudgetBeforeElementSemantics",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeEnforcesExactInputTextBudgetBeforeElementSemantics$'"
+        },
+        {
+          "selector": "TestNormalizeRejectsExpandedProjectionBudgetsBeforeMemberSemantics",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeRejectsExpandedProjectionBudgetsBeforeMemberSemantics$'"
+        },
+        {
+          "selector": "TestNormalizeRejectsContradictoryScenarioObservations",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeRejectsContradictoryScenarioObservations$'"
+        },
+        {
+          "selector": "TestNormalizeReportsUnreferencedDefinitionsDeterministically",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeReportsUnreferencedDefinitionsDeterministically$'"
+        },
+        {
+          "selector": "TestNormalizeDiagnosticsDoNotEchoCallerText",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeDiagnosticsDoNotEchoCallerText$'"
+        },
+        {
+          "selector": "TestNormalizeRejectsNestedCollectionBudgetBeforeElementSemantics",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeRejectsNestedCollectionBudgetBeforeElementSemantics$'"
+        },
+        {
+          "selector": "TestNormalizeSeparatesAuthoringLayoutFromAtomicSemantics",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeSeparatesAuthoringLayoutFromAtomicSemantics$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-v2-variant-closure",
+      "witnessId": "proofkit.requirement-source-v2.variant-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcemodel/variants_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestNormalizeAdmitsEveryDeclaredEnumVariantThroughWholeModel",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeAdmitsEveryDeclaredEnumVariantThroughWholeModel$'"
+        },
+        {
+          "selector": "TestNormalizeProjectsEveryManifestVariantThroughWholeModel",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeProjectsEveryManifestVariantThroughWholeModel$'"
+        },
+        {
+          "selector": "TestNormalizeAdmitsAndProjectsMetadataEnumVariantsFromEachOwner",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeAdmitsAndProjectsMetadataEnumVariantsFromEachOwner$'"
+        },
+        {
+          "selector": "TestNormalizeRejectsUnknownEnumVariantsThroughWholeModel",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeRejectsUnknownEnumVariantsThroughWholeModel$'"
+        },
+        {
+          "selector": "TestNormalizePreservesEveryDeclaredPresenceVariant",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizePreservesEveryDeclaredPresenceVariant$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-v2-instantiated-scenario-closure",
+      "witnessId": "proofkit.requirement-source-v2.instantiated-scenario-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcemodel/scenario_evaluation_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestNormalizeRejectsContradictoryInstantiatedObservations",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeRejectsContradictoryInstantiatedObservations$'"
+        },
+        {
+          "selector": "TestScenarioEvaluationBudgetMatchesIndependentInstantiation",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestScenarioEvaluationBudgetMatchesIndependentInstantiation$'"
+        },
+        {
+          "selector": "TestScenarioParameterValuesAreSubstitutedOnce",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestScenarioParameterValuesAreSubstitutedOnce$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-v2-identity-aware-mutation-closure",
+      "witnessId": "proofkit.requirement-source-v2.identity-aware-mutation-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcemodel/draft_observation_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestChangedDraftFieldIDsIsIdentityAware",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestChangedDraftFieldIDsIsIdentityAware$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-v2-metadata-owner-closure",
+      "witnessId": "proofkit.requirement-source-v2.metadata-owner-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcemodel/metadata_ownership_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestNormalizePreservesExactMetadataOwnershipMatrix",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizePreservesExactMetadataOwnershipMatrix$'"
+        },
+        {
+          "selector": "TestNormalizeClosesEveryOriginOwnerReference",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeClosesEveryOriginOwnerReference$'"
+        },
+        {
+          "selector": "TestNormalizeRejectsOverlapAndGapForEveryMetadataField",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestNormalizeRejectsOverlapAndGapForEveryMetadataField$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-v2-expanded-budget-closure",
+      "witnessId": "proofkit.requirement-source-v2.expanded-budget-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcemodel/projection_budget_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestExpandedProjectionBudgetMatchesIndependentMaterialization",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestExpandedProjectionBudgetMatchesIndependentMaterialization$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-v2-enum-inventory-closure",
+      "witnessId": "proofkit.requirement-source-v2.enum-inventory-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcemodel/variant_inventory_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestIndependentManifestMatchesExactProductionEnumInventory",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestIndependentManifestMatchesExactProductionEnumInventory$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-v2-field-projection-closure",
+      "witnessId": "proofkit.requirement-source-v2.field-projection-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcemodel/completeness_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestIndependentManifestClosesEveryFieldThroughRealMutants",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestIndependentManifestClosesEveryFieldThroughRealMutants$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-v2-typed-field-inventory-closure",
+      "witnessId": "proofkit.requirement-source-v2.typed-field-inventory-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcemodel/field_inventory_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestIndependentManifestMatchesExactTypedInputFieldInventory",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestIndependentManifestMatchesExactTypedInputFieldInventory$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-v2-input-budget-closure",
+      "witnessId": "proofkit.requirement-source-v2.input-budget-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcemodel/input_budget_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestInputCollectionBudgetMatchesIndependentObserver",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestInputCollectionBudgetMatchesIndependentObserver$'"
+        },
+        {
+          "selector": "TestInputTextBudgetUsesArchitectureIndependentWidth",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestInputTextBudgetUsesArchitectureIndependentWidth$'"
+        },
+        {
+          "selector": "TestLimitConfigurationRejectsEveryInvalidBoundary",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestLimitConfigurationRejectsEveryInvalidBoundary$'"
+        },
+        {
+          "selector": "TestPreflightBudgetErrorPrecedence",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestPreflightBudgetErrorPrecedence$'"
+        },
+        {
+          "selector": "TestPreflightCardinalityBudgetsHaveExactTransitions",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestPreflightCardinalityBudgetsHaveExactTransitions$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-v2-manifest-admission-closure",
+      "witnessId": "proofkit.requirement-source-v2.manifest-admission-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcemodel/completeness_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestCompletenessRecordsUseExactStrictJSONAdmission",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestCompletenessRecordsUseExactStrictJSONAdmission$'"
+        },
+        {
+          "selector": "TestIndependentManifestClosesEnumAndPresenceVariants",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestIndependentManifestClosesEnumAndPresenceVariants$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-v2-package-boundary-closure",
+      "witnessId": "proofkit.requirement-source-v2.package-boundary-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcemodel/package_boundary_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestRepresentationNeutralPackageBoundaryIsExact",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestRepresentationNeutralPackageBoundaryIsExact$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-024",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-v2-relation-negative-closure",
+      "witnessId": "proofkit.requirement-source-v2.relation-negative-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcemodel/mutant_relation_negative_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestMutantRelationPredicatesRejectNearMisses",
+          "command": "go test ./internal/kernel/requirementsourcemodel -run '^TestMutantRelationPredicatesRejectNearMisses$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-023",
       "scenarioId": "proofkit.spec-proof-core.requirement-traceability-topology-closure",
@@ -3691,6 +4636,288 @@
       "witnessPath": "tests/browser/workspace.spec.mjs",
       "commandIds": ["proofkit.browser-check"],
       "environmentClasses": ["local-node-browser"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-001",
+      "scenarioId": "proofkit.agent-workflow.pure-single-admission-owner",
+      "witnessId": "proofkit.agent-workflow.pure-single-admission-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "internal/command/changeworkflowplan/change_workflow_plan_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestWorkflowPurityPredicates",
+          "command": "go test ./internal/command/changeworkflowplan -run '^TestWorkflowPurityPredicates$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-002",
+      "scenarioId": "proofkit.agent-workflow.stage-prefix-and-terminal-relation",
+      "witnessId": "proofkit.agent-workflow.stage-prefix-terminal-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "internal/command/changeworkflowplan/state_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestWorkflowStatePredicates",
+          "command": "go test ./internal/command/changeworkflowplan -run '^TestWorkflowStatePredicates$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-003",
+      "scenarioId": "proofkit.agent-workflow.total-checkpoint-successor-relation",
+      "witnessId": "proofkit.agent-workflow.checkpoint-successor-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "internal/command/changeworkflowplan/state_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestWorkflowCheckpointPredicates",
+          "command": "go test ./internal/command/changeworkflowplan -run '^TestWorkflowCheckpointPredicates$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-004",
+      "scenarioId": "proofkit.agent-workflow.review-identity-closure",
+      "witnessId": "proofkit.agent-workflow.review-identity-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "internal/command/changeworkflowplan/admission_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestWorkflowIdentityPredicates",
+          "command": "go test ./internal/command/changeworkflowplan -run '^TestWorkflowIdentityPredicates$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-005",
+      "scenarioId": "proofkit.agent-workflow.reference-closed-bounded-context",
+      "witnessId": "proofkit.agent-workflow.context-closure-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "internal/command/changeworkflowplan/context_closure_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestWorkflowClosurePredicates",
+          "command": "go test ./internal/command/changeworkflowplan -run '^TestWorkflowClosurePredicates$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-006",
+      "scenarioId": "proofkit.agent-workflow.no-ambient-authority",
+      "witnessId": "proofkit.agent-workflow.no-ambient-authority-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "internal/command/changeworkflowplan/dependency_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestWorkflowAmbientAuthorityPredicates",
+          "command": "go test ./internal/command/changeworkflowplan -run '^TestWorkflowAmbientAuthorityPredicates$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-007",
+      "scenarioId": "proofkit.agent-workflow.native-evidence-guidance-slot-closure",
+      "witnessId": "proofkit.agent-workflow.guidance-slot-closure-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "internal/command/nativeevidenceguidance/guidance_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestGuidanceSlotPredicates",
+          "command": "go test ./internal/command/nativeevidenceguidance -run '^TestGuidanceSlotPredicates$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-007",
+      "scenarioId": "proofkit.agent-workflow.native-evidence-guidance-purity",
+      "witnessId": "proofkit.agent-workflow.guidance-purity-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "internal/command/nativeevidenceguidance/dependency_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestGuidanceNoAmbientDependencyPredicates",
+          "command": "go test ./internal/command/nativeevidenceguidance -run '^TestGuidanceNoAmbientDependencyPredicates$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-008",
+      "scenarioId": "proofkit.agent-workflow.prompt-coordinate-and-escalation-closure",
+      "witnessId": "proofkit.agent-workflow.prompt-coordinate-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "internal/command/changeworkflowplan/prompt_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestWorkflowPromptPredicates",
+          "command": "go test ./internal/command/changeworkflowplan -run '^TestWorkflowPromptPredicates$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-008",
+      "scenarioId": "proofkit.agent-workflow.bounded-safe-text",
+      "witnessId": "proofkit.agent-workflow.bounded-safe-text-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "internal/command/changeworkflowplan/text_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestWorkflowTerminalTextIsOperationallyComplete",
+          "command": "go test ./internal/command/changeworkflowplan -run '^TestWorkflowTerminalTextIsOperationallyComplete$'"
+        },
+        {
+          "selector": "TestWorkflowTextPredicates",
+          "command": "go test ./internal/command/changeworkflowplan -run '^TestWorkflowTextPredicates$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-009",
+      "scenarioId": "proofkit.agent-workflow.cli-presentation-capability-product",
+      "witnessId": "proofkit.agent-workflow.cli-presentation-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/agent_workflow_command_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestAgentWorkflowCLITruthTable",
+          "command": "go test ./internal/app -run '^TestAgentWorkflowCLITruthTable$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-009",
+      "scenarioId": "proofkit.agent-workflow.style-strip-parity",
+      "witnessId": "proofkit.agent-workflow.style-strip-parity-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "internal/command/changeworkflowplan/text_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestWorkflowTextProjectionParity",
+          "command": "go test ./internal/command/changeworkflowplan -run '^TestWorkflowTextProjectionParity$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-010",
+      "scenarioId": "proofkit.agent-workflow.catalog-prerequisite-causality",
+      "witnessId": "proofkit.agent-workflow.catalog-prerequisite-causality-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/changeworkflowplan/state_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestWorkflowStatePredicates",
+          "command": "go test ./internal/command/changeworkflowplan -run '^TestWorkflowStatePredicates$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-010",
+      "scenarioId": "proofkit.agent-workflow.semantic-owner-minimality",
+      "witnessId": "proofkit.agent-workflow.semantic-owner-minimality-falsifier",
+      "witnessKind": "technical",
+      "witnessPath": "internal/command/nativeevidenceguidance/guidance_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestGuidancePurityPredicates",
+          "command": "go test ./internal/command/nativeevidenceguidance -run '^TestGuidancePurityPredicates$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-010",
+      "scenarioId": "proofkit.agent-workflow.semantic-owner-topology",
+      "witnessId": "proofkit.agent-workflow.semantic-owner-topology-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/agent_workflow_topology_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestAgentWorkflowSemanticOwnerTopology",
+          "command": "go test ./internal/app -run '^TestAgentWorkflowSemanticOwnerTopology$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-011",
+      "scenarioId": "proofkit.agent-workflow.public-cli-relation-closure",
+      "witnessId": "proofkit.agent-workflow.public-cli-relation-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/agent_workflow_command_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestAgentWorkflowCLITruthTable",
+          "command": "go test ./internal/app -run '^TestAgentWorkflowCLITruthTable$'"
+        }
+      ],
+      "commandIds": ["proofkit.command-contract-check", "proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-011",
+      "scenarioId": "proofkit.agent-workflow.installed-carrier-smoke-closure",
+      "witnessId": "proofkit.agent-workflow.installed-carrier-smoke-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/workflowsmoke/workflow_smoke_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestVerifyAcceptsApplicationCLI",
+          "command": "go test ./internal/tools/workflowsmoke -run '^TestVerifyAcceptsApplicationCLI$'"
+        },
+        {
+          "selector": "TestVerifyRejectsCarrierContractMutations",
+          "command": "go test ./internal/tools/workflowsmoke -run '^TestVerifyRejectsCarrierContractMutations$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test", "proofkit.package-artifact"],
+      "environmentClasses": ["local-go", "local-go-python"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-011",
+      "scenarioId": "proofkit.agent-workflow.version-edge-wire-observation",
+      "witnessId": "proofkit.agent-workflow.version-edge-wire-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/agent_workflow_version_edge_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestAgentWorkflowVersionEdgeClosesPublicWireAdditions",
+          "command": "go test ./internal/app -run '^TestAgentWorkflowVersionEdgeClosesPublicWireAdditions$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
     }
   ],
   "witnessCommands": [