@research-engineering/agentic-proofkit 0.4.0 → 0.5.0

package/docs/proofkit-contract-map.md

@@ -39,6 +39,7 @@ owner boundaries. It is not a second command-family inventory.
 
 | Family | Main commands | Caller provides | Proofkit owns | Consumer owns | Output authority |
 |---|---|---|---|---|---|
+| Agent workflow planning | `change-workflow-plan`, `native-evidence-guidance` | explicit checkpoint, completed stage ids, bounded context refs, governing authority ref, and required context ref ids | optional built-in `proofkit.reviewed-change.v1` checkpoint relation, reference-closed next-stage context, deterministic agent prompts, bounded text/JSON/envelope projections, and repository-neutral native-evidence guidance with closed applicability classes | custom workflow topology, repository state discovery, stage execution, native witness semantics, evidence collection, review conclusions, merge, release, deployment, and rollout authority | next-action plan, terminal workflow report, bounded agent envelope, or guidance catalog |
 | Adoption and scaffolding | `init`, `adoption-contract-envelope`, `adoption-workflow-plan`, `adoption-checklist`, `adoption-doctor`, `gradual-adoption`, `gradual-adoption-bootstrap`, `gradual-adoption-guidance`, `capability-map-admission`, `pilot-admission`, `scaffold-profile-plan`, `scaffold-project-structure`, `stack-preset` | adoption intent, aggregate adoption contract envelope, checklist facts, target paths, owner routes, caller-extracted stale authority vocabulary facts, explicit pre-spec capability observations, pilot records, stack preset id, optional init preset id | dry-run route selection, aggregate contract-envelope admission, deterministic starter plans, checklist/report admission, bounded guidance envelopes, dry-run manifests, pre-spec trust-mode admission, adoption gap and stale-authority classification, pilot shape admission | final files, final requirements, rollout policy, text extraction from files, code observation extraction, pilot truth | selected child output, plan, report, seed packet, or agent envelope |
 | Requirement source | `capability-map-admission`, `requirement-authoring-plan`, `requirement-source-admission`, `requirement-source-transition`, `spec-overview-claims`, `requirement-spec-tree`, `requirement-spec-tree-view`, `requirement-source-view`, `requirement-browser-server` | `requirements.v1.json`, caller-owned capability maps, caller-owned authoring facts, overview claim extraction, explicit spec hierarchy, view options | candidate seed admission, candidate-only authoring packets, source-shape admission, lifecycle checks, explicit tree topology/source-ref admission, shared safe renderer fragments, presentation-only views | requirement meaning, extraction completeness, Markdown extraction completeness, hierarchy ownership, proof adequacy, file materialization | capability map report, authoring packet, source report, spec-tree report, rendered view, or browser presentation |
 | Requirement proof binding | `requirement-bindings`, `binding-partition`, `proof-slice`, `evidence-graph`, `requirement-proof-resolver`, `requirement-proof-source-set`, `requirement-proof-view`, `spec-proof-bundle-admission` | requirement records, bindings, witness commands, source-set facts, receipt reports, partition policy | graph validation, binding partition projection, compact slices, declaration-only compact route projection with full binding identity and role-qualified witness routes, resolver projection, bundle linkage checks | selector resolution, oracle quality, witness execution, mutation adequacy, finding completeness, proof freshness, trust, assurance, merge policy | proof report, partition report, slice, declaration lookup graph, or view |
@@ -122,6 +123,7 @@ Semantic context routes are `requirement-context-compose`,
 | State or goal | Next Proofkit route | Stop or escalation condition |
 |---|---|---|
 | The agent does not know where to start. | `init`, or `init --preset` with `fresh`, `code-baseline`, `code-audit`, `legacy`, or `change-set` | Treat output as dry-run route guidance only. Stop before scanning, writing files, or making requirements authoritative. |
+| An agent needs a bounded, deterministic stage transition for an engineering change. | `change-workflow-plan` selects the optional built-in `proofkit.reviewed-change.v1` profile; use `--agent-envelope` for the compact work packet and `native-evidence-guidance` when the consuming repository has not yet materialized repository-specific evidence instructions. | Supply only explicit current checkpoint, completed stages, and admitted context references. Apply conditional guidance slots only when their applicability class matches a declared consumer mechanism. Stop before treating the profile, plan, or guidance as repository policy or as proof that a stage ran, evidence exists, review passed, or merge/release is authorized. |
 | No admitted spec/profile exists and the caller has explicit capability observations. | `capability-map-admission`; use `trustMode: "code_baseline"` only when maintainers intentionally freeze current code, otherwise use `trustMode: "audit_from_code"`. | Stop before treating seeds as stable requirements. The consumer owns observation extraction, materialization, requirement meaning, and proof adequacy. |
 | No admitted spec/profile exists and no capability observations exist. | `scaffold-project-structure`, `adoption-workflow-plan`, or `stack-preset` | Stop before writing files; the consumer owns materialization, overwrite policy, and final requirement text. |
 | Candidate boundary is uncertain. | `adoption-doctor` or `gradual-adoption-guidance --agent-envelope` | Escalate to owner review when the boundary is advisory, ambiguous, or missing native witnesses. |

package/docs/specs/proofkit-agent-workflow/overview.md

@@ -0,0 +1,86 @@
+# Proofkit Agent Workflow Spec
+
+This spec owns Proofkit's generic support for planning one engineering-change
+snapshot and for teaching a consuming repository to define executable native
+evidence. It does not own consumer product meaning, repository policy,
+witnesses, merge, release, rollout, or production-readiness decisions.
+
+The public capability is deliberately small:
+
+1. `change-workflow-plan` admits explicit JSON and projects one next action for
+   the optional built-in profile `proofkit.reviewed-change.v1`, whose ordered
+   stages are `architecture`, `design`, `implementation_plan`,
+   `implementation`, `verification`, `pull_request`, and `closeout`.
+2. `native-evidence-guidance` exposes one versioned 22-slot template for
+   repository-owned falsifiers, oracles, bounds, lifecycle, and non-claims.
+   Every slot names one closed applicability class: `always`,
+   `declared_input_channels`, `environment_or_network_access`,
+   `external_process`, or `mutable_artifacts`. The latter four apply only when
+   the consuming witness declares the named mechanism.
+3. Existing descriptors, dispatch, command families, root-shape CLI contracts,
+   agent envelopes, and package gates provide public-surface closure.
+
+Neither command scans a repository. Both command cores are stateless pure
+projections with no filesystem, Git, process, environment, clock, random,
+network, container, or provider dependency. No setup facade, agent-route extension,
+external prompt resource, persisted experiment state, or second source codec is
+introduced.
+
+## Requirements
+
+- `REQ-PROOFKIT-WORKFLOW-001`: one-time typed admission, pure deterministic
+  projection, and derived-output authority boundary.
+- `REQ-PROOFKIT-WORKFLOW-002`: named optional built-in profile, exact
+  seven-stage order, prefix/checkpoint biconditional, and a disjoint terminal
+  output.
+- `REQ-PROOFKIT-WORKFLOW-003`: 28 active state rows, one terminal row,
+  authority- and witness-gated executable envelope transitions, closed
+  blockers and clarifications when those preconditions are absent, exact
+  accepted-subject carry into each nonterminal successor, and an explicit
+  terminal stop packet.
+- `REQ-PROOFKIT-WORKFLOW-004`: typed subject/finding resolution, incoming
+  subject identity on every noninitial stage, and internally consistent
+  caller-declared digests.
+- `REQ-PROOFKIT-WORKFLOW-005`: shared 256-byte stable-ID admission before work,
+  global candidate-dependency resolution, one explicit nullable
+  governing-authority reference, role-preserving bounded least dependency
+  closure over explicit seeds, exact omission accounting, and output-byte
+  limits.
+- `REQ-PROOFKIT-WORKFLOW-006`: only existing launcher and presentation
+  capabilities outside explicit input, with no ambient repository authority,
+  setup facade, hidden policy, or agent-route extension.
+- `REQ-PROOFKIT-WORKFLOW-007`: pure deterministic repository-neutral
+  native-evidence guidance from one versioned typed table with five closed
+  applicability classes, explicit absent-channel decisions, and finite
+  nondisclosure corpora.
+- `REQ-PROOFKIT-WORKFLOW-008`: display-safe caller admission, no-leak denial,
+  exact retained-or-missing witness projection, bounded actionable and
+  terminal text with required coordinates and exact rendered successor delta,
+  and no styling of caller values.
+- `REQ-PROOFKIT-WORKFLOW-009`: explicit text/color selection and confinement of
+  ANSI to eligible terminal stdout.
+- `REQ-PROOFKIT-WORKFLOW-010`: one production catalog owner for stage,
+  checkpoint-schema, action-prerequisite, and successor semantics,
+  independently authored semantic and literal-duplication oracles, and an
+  AST-checked two-command carrier topology with no runtime experiment or
+  external template residue.
+- `REQ-PROOFKIT-WORKFLOW-011`: a finite factorized CLI relation closed across
+  descriptor/dispatcher/family/help/root-contract/witness/generated/package
+  surfaces, with npm-only non-runtime specification docs and cross-channel
+  runtime behavior proof.
+
+Shared stable-JSON/diagnostic hardening is owned by the supply-chain-quality
+spec. Typed local-reference closure is owned by the existing agent-envelope
+requirement. This workflow spec consumes those owners without duplicating them.
+
+## Non-Claims
+
+- Generated prompts are not authenticated and need not be obeyed or adequate.
+- The built-in reviewed-change profile is optional guidance, not universal
+  consuming-repository process policy or a custom workflow-graph engine.
+- Static prompt bytes do not prove provider token use or model reasoning.
+- Least dependency closure does not prove context truth, freshness, semantic
+  sufficiency, or global minimality.
+- A finite pilot does not prove universal repository fit.
+- This spec does not select a persisted requirement-source codec.
+- This spec does not approve merge, release, rollout, or production readiness.

package/docs/specs/proofkit-agent-workflow/requirements.v1.json

@@ -0,0 +1,157 @@
+{
+  "schemaVersion": 1,
+  "sourceId": "proofkit.agent-workflow.requirements",
+  "specPackagePath": "docs/specs/proofkit-agent-workflow",
+  "overviewPath": "docs/specs/proofkit-agent-workflow/overview.md",
+  "requirementsPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+  "requirements": [
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-001",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Change-workflow planning admits one explicit caller snapshot into an immutable typed projection, decides only from that projection, and deterministically returns one derived non-authoritative plan without executing or supervising agents, witnesses, repository operations, providers, CI, merge, release, rollout, or deployment; no prompt, report, envelope, view, test, or generated record becomes a second semantic owner.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-001"],
+      "nonClaims": ["The planner does not authenticate caller assertions or prove that a planned action was executed, correct, reviewed, or completed."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-002",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "The optional built-in workflow profile proofkit.reviewed-change.v1 owns exactly the ordered stages architecture, design, implementation_plan, implementation, verification, pull_request, and closeout; every non-envelope plan names that profile, completedStageIds is exactly one prefix of that order, every incomplete prefix has a non-null checkpoint and an active stage equal to the first stage outside the prefix, and the complete prefix has a null checkpoint if and only if the output is the disjoint workflow_complete variant with no active-stage, action, checkpoint-state, or prompt field.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-002"],
+      "nonClaims": ["Stage ordering does not prove the semantic adequacy of any architecture, design, plan, implementation, verification, pull request, or closeout artifact."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-003",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "The active checkpoint is exactly one closed discriminated variant not_started, ready_for_review, review_findings, or review_passed; one independently enumerable total non-overlapping relation maps the 28 active stage/checkpoint rows to exactly one stage-specific first action, review, repair, or accept_stage, the twenty-ninth complete-prefix row maps only to workflow_complete, an active agent envelope emits its single next_action only when a governing authority ref is retained and the verify action additionally retains at least one caller-owned witness ref, otherwise it emits no executable action plus closed blockers and clarification questions, every accept_stage plan and emitted envelope action declares exactly one equal successorStateDelta containing only completedStageIds and checkpoint, a nonterminal delta carries the accepted subjectRefId and subjectDigest into the next stage's not_started checkpoint while the terminal delta has a null checkpoint, applying that delta by replacing only those two input fields while preserving schemaVersion, governingAuthorityRefId, contextRefs, and requiredContextRefIds produces exactly one legal successor snapshot, the terminal envelope names workflow_complete and an explicit stop action without a successor delta, and every surplus, missing, or otherwise illegal field combination fails closed.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-003"],
+      "nonClaims": ["The snapshot relation does not own pending work, elapsed time, predecessor history, waiver, abort, reopen, or external task-state transitions."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-004",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Every noninitial not_started, ready_for_review, review_findings, and review_passed checkpoint binds the caller-declared stage artifact through one subjectRefId that resolves exactly one artifact context reference and one equal lowercase SHA-256 subject digest; the initial architecture/not_started checkpoint alone has no incoming subject, assessed variants require an equal assessmentSubjectDigest, review_findings resolves each findingRef exactly once to a finding context reference, and a malformed, absent, surplus, unresolved, wrong-kind, or mismatched identity fails before an action is projected.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-004"],
+      "nonClaims": ["Digest equality proves only internal equality of caller-declared identity fields and does not bind actual bytes, authenticate the reviewer, establish currentness or trust, or prove assessment quality."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-005",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "The planner admits 0 to 48 strictly refId-sorted unique candidate context references; every candidate ID, nullable governingAuthorityRefId, required seed ID, dependency ID, subject ID, and finding ID is first admitted by the shared stable RuleID owner with a 256 UTF-8 byte maximum before sorting, indexing, closure, or projection; every dependency of every candidate resolves exactly once before seed selection or closure, including dependencies of candidates that the final closure omits; the governingAuthorityRefId when present resolves exactly one authority reference; it admits 0 to 12 required seed IDs, at most 12 finding references, at most 8 dependencies per candidate, at most 384 UTF-8 bytes per artifact path, and at most 18432 aggregate candidate-path bytes; it returns the unique least dependency-closed subset containing the governing authority, required, subject, and finding seeds, fails closed above 24 retained references or 9216 retained-path bytes, derives the exact sorted candidate-minus-retained omission set, summarizes that set once in an envelope, classifies only the selected governing authority as semantic_owner while other authority, artifact, finding, and witness references remain owner_surface, evidence, review_finding, and proof_binding respectively, and fails JSON, envelope, and text outputs above 128 KiB, 128 KiB, and 8192 bytes before partial output.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-005"],
+      "nonClaims": ["Structural least closure relative to caller-declared seeds and edges does not prove context truth, freshness, semantic sufficiency, global minimality, or provider token usage."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-006",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "After existing bounded CLI transport, immutable installed-launcher profile admission, and immutable presentation-capability capture, the semantic planner accepts no repository root, caller prompt, caller-selected bound, command, environment, receipt body, or external authority field and has no filesystem, Git, process, environment, clock, random, network, container, or provider dependency; the CLI reads only the explicit input transport, the existing launcher-profile and optional Python-executable transport capabilities, and startup TTY/NO_COLOR presence needed by requested presentation, and the capability adds no setup facade, ambient scan, hidden repository policy, consumer-specific route, or agent-route extension.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-006"],
+      "nonClaims": ["Explicit caller input does not establish repository identity, policy, source meaning, authorization to mutate, or the truth of observations made outside Proofkit."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-007",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Native-evidence guidance has exactly one versioned repository-neutral semantic owner that emits exactly the declared semantic owner, subject/currentness, execution root/source snapshot, exact argv, stdin/input bytes, toolchain/platform/locale/timezone/dependencies, positive control, independent near-miss falsifier, executable oracle, input/work bounds, environment/network policy, CPU/memory/disk/file-descriptor/PID bounds, output-channel bounds, timeout/process-group/detached-child policy, exit mapping, nondisclosure, cleanup/crash inventory, receipt identity, currentness/trust, escalation, retirement, and non-claim slots; every slot carries exactly one closed applicability class from always, declared_input_channels, environment_or_network_access, external_process, and mutable_artifacts so mechanism-specific decisions are conditional on the corresponding declared consumer mechanism; always-applicable output and receipt slots require each present channel to be bounded and identity-bound while each absent channel is explicitly not_applicable, nondisclosure selects one finite exact corpus and one finite explicitly derived fragment list rather than an unbounded fragment claim; every admitted CLI delivery is deterministically bound to that owner, and JSON and text are derived without input, mutable shared state, filesystem, Git, process, environment, clock, random, network, container, provider, or other ambient dependency.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-007"],
+      "nonClaims": ["The template does not generate, execute, approve, authenticate, or prove adequacy of a consuming repository's script, witness, oracle, receipt, policy, or cleanup implementation."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-008",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Every workflow caller-visible value is admitted through its typed owner; display-safe values reject malformed UTF-8, secret-shaped content, ASCII controls, DEL, Unicode Cc, Cf, Zl, and Zp without echo; every active prompt packet projects observed fact, uncertainty, the resolved governingAuthorityRefId or a closed missing-owner escalation target, exact admitted coordinates, candidate action, one closed proof-availability state distinguishing a missing consumer witness from exact retained witness refs, non-claim, stop condition, and expected successor from command-owned tables, and when governingAuthorityRefId is null the packet forbids repository mutation until the caller supplies it; planner text contains the state, active stage and action when present, checkpoint, owner or escalation, stop condition, expected successor, omission count, and one non-claim within 24 lines and 8192 bytes, and an accept_stage projection additionally renders the exact successor completed-stage set, checkpoint state, subject ref, and subject digest while the terminal variant renders explicit consumer owner, stop condition, and no successor; guidance text contains every slot ID, applicability class, required decision, and completion criterion within 48 lines and 16384 bytes; caller-owned values are never terminal-styled.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-008"],
+      "nonClaims": ["Bounded nondisclosure admission does not prove absence of every possible sensitive value or every terminal interpretation."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-009",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Workflow commands default to JSON and color never; text and color auto require explicit flags, auto is eligible only for terminal stdout when immutable startup capabilities report a TTY and no NO_COLOR setting, admitted style tokens strip exactly to canonical plain text, and JSON, stderr, redirected stdout, files, prompts, envelopes, reports, receipts, and generated records remain ANSI-free.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-009"],
+      "nonClaims": ["Terminal styling is presentation only and does not claim identical rendering across terminal emulators."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-010",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "The production capability has exactly one workflow catalog declaration owning stage order, incoming-subject policy, checkpoint field schemas, checkpoint-action relations, action prerequisites, successor-emission policy, and action profiles, and exactly one guidance-table declaration owning evidence slots; descriptor closure exposes exactly one required-input planner carrier and one no-input guidance carrier in one coherent command family, a source-topology oracle rejects duplicate or retired production owners, duplicated catalog vocabulary, and runtime guidance resources, and independent literal state, action-profile, successor, and slot oracles falsify semantic drift without becoming production owners; the capability adds no persisted experiment matrix, candidate receipt, source-codec variant, external prompt duplicate, repository adapter, setup state, or generic agent executor.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-010"],
+      "nonClaims": ["Structural minimality does not prove universal usability, open-world optimality, lower provider token use, or lower cognitive cost for every user and repository."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-011",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Every admitted workflow command, option, and runtime guidance resource participates in one finite factorized relation over carrier identity, global-option position/cardinality/value, command-option cardinality/value, help exclusivity, positional-operand count, input transport, output mode, envelope, and presentation capability; that relation is closed across descriptor, dedicated dispatcher, command family, help, contract-map route, root-shape CLI input/output summary, positive whole-process witness, independent negative falsifier, generated contract projection, breaking version-edge wire observation, and supported installed npm and wheel smokes for each admitted CLI carrier that exercise required input, pre-read input-pointer admission, JSON layout, agent envelope, text, color denial, exclusive help, surplus positional operands, and no-input guidance classes as applicable; the npm package admits the durable workflow specification as channel-specific non-runtime documentation through its existing docs projection, every runtime-required resource remains closed in each package channel, the selected topology adds no external runtime or template resource, and omission, surplus, cross-wire, or stale projection fails the repository gate.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-011"],
+      "nonClaims": ["Public-surface closure does not claim wheel documentation parity and does not prove registry publication, provider ingestion, compatibility on untested platforms, native witness truth, merge approval, rollout, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    }
+  ],
+  "nonClaims": [
+    "Generated plans, prompts, templates, envelopes, views, reports, and patches remain derived guidance and are not semantic, proof, merge, release, rollout, or readiness authority.",
+    "Proofkit does not own consuming-repository requirement meaning, engineering policy, witnesses, merge decisions, release decisions, rollout decisions, or production-readiness decisions.",
+    "This source neither selects nor authorizes a persisted requirement-source codec or a migration away from the current requirement source."
+  ]
+}

package/docs/specs/proofkit-spec-proof-core/overview.md

@@ -35,9 +35,13 @@ execution receipts, and merge policy.
   candidates explicit, keep merge approval consumer-owned, and fail closed for
   unknown or unmatched proof inputs.
 - `REQ-PROOFKIT-SPEC-005`: rendered proof views and agent envelopes remain
-  bounded, reference-closed derived presentations over structured source,
-  count each semantic omission once, and never become canonical proof or
-  requirement authority.
+  bounded, reference-closed derived presentations over structured source and
+  never become canonical proof or requirement authority; agent envelopes also
+  admit lossless safe local identities before display sanitization, omit unsafe
+  identities without turning a redaction label into a lookup key, count each
+  semantic omission once, and use unique, pairwise-disjoint local target-ID
+  domains so each retained untyped local reference resolves to at most one
+  target in their union.
 - `REQ-PROOFKIT-SPEC-006`: test evidence inventory, explicit test-discovery
   draft projections, proof-binding-derived inventory projections, normalized
   inventory projections, coverage-view input composition, and requirement

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -116,9 +116,9 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-005",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Rendered proof views and agent envelopes remain bounded, reference-closed derived presentations over structured source, count each semantic omission once, and never become canonical proof or requirement authority.",
+      "invariant": "Rendered proof views and agent envelopes remain bounded, reference-closed derived presentations over structured source and never become canonical proof or requirement authority; agent envelopes additionally admit local target IDs and untyped local references as lossless safe identities before display sanitization, omit unsafe identities without using a replacement label as a lookup key, count each semantic omission once, and require target IDs to be unique within each local domain and pairwise disjoint across local domains so every retained untyped local reference resolves to at most one target in their union.",
       "claimLevel": "blocking",
-      "riskClass": "medium",
+      "riskClass": "high",
       "proofBindingRefs": [
         "proofkit/requirement-bindings.json"
       ],

package/docs/specs/proofkit-supply-chain-quality/overview.md

@@ -160,10 +160,16 @@ vulnerability absence, or consumer rollout safety by itself.
   failed attempts retain attempt-scoped action, DOM, network, and source traces
   without continuous screenshot capture plus a bounded best-effort failure
   screenshot, without creating passed proof.
-- `REQ-PROOFKIT-QUALITY-023`: Python wheels independently bind advertised
-  platform compatibility to decoded executable bytes, and the wheel set rejects
-  version, identity, presence, and digest drift; wheels carry Core Metadata 2.4
-  plus an exact, RECORD-closed repository license payload.
+- `REQ-PROOFKIT-QUALITY-023`: npm platform binaries and Python wheels
+  independently bind to the same release binary for every target; a separate
+  bounded decoder also compares the final tar and wheel members directly,
+  without a mutable intermediate; package-set wheel and embedded-binary digest
+  claims, including npm SHA-1/SRI, must equal bytes decoded from one immutable
+  snapshot and release closeout recomputes them through repository-confined,
+  bounded, identity-checked non-symlink handles; wheels bind advertised platform
+  compatibility to decoded executable bytes, reject version, identity,
+  presence, and digest drift, and carry Core Metadata 2.4 plus an exact,
+  RECORD-closed repository license payload.
 - `REQ-PROOFKIT-QUALITY-024`: a closed version-bound machine record binds the
   exact previous/current SemVer pair and compatible/breaking class, declares the
   exact complete current breaking, addition, and migration inventories
@@ -180,6 +186,18 @@ vulnerability absence, or consumer rollout safety by itself.
   commit identities, admitted status expressions, the required aggregate shell
   program, and read-only treatment of an existing release are source-oracle
   invariants.
+- `REQ-PROOFKIT-QUALITY-026`: every public or retained-evidence stable JSON
+  implementation accepts only the repository-pinned Unicode scalar set and matches one
+  preimplementation byte corpus for the pinned control, format, and separator
+  table without changing decoded values.
+- `REQ-PROOFKIT-QUALITY-027`: report-visible diagnostics and structural text
+  apply the same scalar, Unicode-whitespace, control/format, and split-secret
+  taxonomy, replace rejected caller values as a whole without echoing any
+	  fragment, bound diagnostic output, and own dynamic Go/JavaScript error
+	  projection plus failure-only bounded child-process diagnostics for repository
+	  tools. On supported Unix hosts, an installed-carrier success additionally
+	  requires confirmed process-group absence after the parent is reaped; cleanup
+	  timeout is an explicit failure rather than a successful terminal result.
 
 ## Non-Claims
 

package/docs/specs/proofkit-supply-chain-quality/requirements.v1.json

@@ -298,7 +298,7 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-023",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "Each Python wheel binds its embedded executable to the release binary digest, and the wheel-set verifier independently rejects version drift, duplicate identities, missing files, and SHA drift; each wheel independently decodes Darwin Mach-O bytes so an advertised macOS platform minimum is never lower than the executable minimum, uses Core Metadata 2.4 License-Expression and License-File fields, carries an exact repository LICENSE copy under the wheel licenses directory, and closes every payload entry through RECORD.",
+      "invariant": "Every npm platform-binary tar entry and every Python wheel independently binds its embedded executable bytes to the same release-platform binary, and release metadata generation admits every final npm tarball, wheel, and SBOM exactly once into one bounded regular non-symlink immutable snapshot, derives npm pack SHA-1 and SRI claims, final carrier decoding, direct chunked binary equality, wheel and embedded-binary digests, release checksums, and SBOM-subject checksums only from that epoch, requires every npm pack and Python package-set digest claim to equal those decoded bytes, and revalidates every source identity before metadata persistence without relying on a mutable intermediate dist directory or claimed digests; release closeout independently reopens every declared repository-confined npm tarball and wheel through bounded identity-checked non-symlink handles, recomputes npm SHA-1 and SRI plus both wheel and embedded-binary digests, and rejects unsafe or duplicate archive topology before accepting package evidence; both tar and wheel decoders reject duplicate entry names and require exact release-platform closure; the wheel-set verifier independently rejects version drift, duplicate identities, missing files, and SHA drift; each wheel independently decodes Darwin Mach-O bytes so an advertised macOS platform minimum is never lower than the executable minimum, uses Core Metadata 2.4 License-Expression and License-File fields, carries an exact repository LICENSE copy under the wheel licenses directory, and closes every payload entry through RECORD.",
       "claimLevel": "blocking",
       "riskClass": "critical",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
@@ -333,6 +333,32 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-026",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Every repository-owned stable JSON implementation used by a public or retained-evidence path accepts only Unicode 15.0.0 scalar strings, rejecting malformed UTF-8 byte strings and unpaired UTF-16 surrogates as applicable, emits the same deterministic semantic-preserving JSON escapes for the pinned Cc, Cf, Zl, and Zp range table, preserves ordinary decoded values, and remains byte-compatible with one versioned owner-authored literal range corpus whose Go projection is exhaustively checked against the Unicode 15.0.0 category oracle and whose JavaScript and generated TypeScript projections are exhaustively checked over the scalar domain.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-026"],
+      "nonClaims": ["This bounded encoding policy does not prove terminal-rendering equivalence or safety of arbitrary downstream decoders."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-027",
+      "ownerId": "proofkit.supply-chain-quality",
+      "invariant": "Every report-visible diagnostic and structural-text sanitizer accepts only Unicode 15.0.0 scalar strings, recognizes one explicit Unicode whitespace alphabet plus the pinned Cc, Cf, Zl, and Zp range table and contiguous or control-split secret-shaped values through one shared taxonomy, replaces any rejected caller-owned value as a whole with one fixed command-owned label without emitting its bytes, code points, prefix, suffix, or caller-controlled replacement text, and bounds admitted diagnostic projection to 512 Unicode scalars; every Go and JavaScript repository tool entrypoint routes dynamic errors through that owner, failed child-process stderr that enters this diagnostic boundary is captured under a fixed byte limit before whole-value sanitization while successful child stderr is not projected, direct child stderr wiring is rejected, and the installed-carrier smoke adapter bounds stdout, stderr, time, and cleanup; on supported Unix hosts, a successful installed-carrier result requires confirmed process-group absence after the command parent is reaped, while cleanup timeout or probe failure is an explicit failed operation rather than a successful terminal result.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-QUALITY-027"],
+      "nonClaims": ["This bounded diagnostic taxonomy does not prove confidentiality of values outside its admitted secret and control classes or claim that every repository-internal tool invocation uses the installed-carrier timeout policy."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.supply-chain-quality", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ]
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,
@@ -36,7 +36,7 @@
     "build": "go run ./internal/tools/packagebuild",
     "check": "npm run npm:version && npm run source-hygiene && npm run command-contract:check && npm run command-family:check && npm run text-policy && npm run mermaid:check && npm run go:check && npm run browser:check && npm run package:artifact && npm run self:receipt && npm run self:coverage && npm run release:closeout",
     "browser:check": "npm run browser:static-check && npm run browser:test",
-    "browser:static-check": "tsc -p tsconfig.browser.json && node --test scripts/browser-proof-execution.test.mjs scripts/browser-proof-inputs.test.mjs scripts/browser-selection-authority.test.mjs scripts/stable-json.test.mjs",
+    "browser:static-check": "tsc -p tsconfig.browser.json && node --test scripts/browser-proof-execution.test.mjs scripts/browser-proof-inputs.test.mjs scripts/browser-selection-authority.test.mjs scripts/diagnostic-entrypoints.test.mjs scripts/stable-json.test.mjs",
     "browser:test": "go run ./internal/tools/browserproofverify --run",
     "command-family:check": "go run ./internal/tools/commandfamilygen --check",
     "go:actionlint": "go tool actionlint",