@research-engineering/agentic-proofkit 0.5.0 → 0.6.0

package/README.md

@@ -50,7 +50,7 @@ CLI, not as a Python SDK. Python projects should still treat CLI/JSON records,
 exit codes, and package metadata as the public contract.
 
 <!-- proofkit:platform-python:start -->
-Supported binary targets are macOS 12 or later on arm64 or x64.
+Supported binary targets are macOS 13 or later on arm64 or x64.
 Linux manylinux 2.17 or later is supported on arm64 or x64. Windows is unsupported. The Python
 runner requires Python 3.9 or later and wraps the same Go CLI; it is not a
 Python SDK.

package/docs/proofkit-contract-map.md

@@ -94,11 +94,17 @@ Route ambiguous modernization work through the smallest matching family:
 
 ## Agent Decision Procedure
 
-Agents should use `agent-route` for executable routing and
-`agent-route --agent-envelope` when a bounded work packet is needed. The command
-returns deterministic JSON from explicit caller-owned facts; the envelope is an
-opt-in derived projection over the same report. This map explains the route
-families without becoming an execution, freshness, or merge decision.
+Agents should use `agent-route` for the complete deterministic route report and
+`agent-route --agent-envelope` for the default bounded brief packet. Explicit
+`--agent-envelope-mode brief` is byte-identical to the bare envelope form;
+`--agent-envelope-mode full` preserves the complete generic agent envelope for
+debugging or demand-loaded detail. Every brief binds its source report ID and
+stable digest and admitted launcher profile in one top-level `detailAccess`
+record, so callers retain the original admitted input and launcher context and
+recompute report or full detail instead of adding a detail reference to every
+item. All three forms are derived from explicit caller-owned facts. This map
+explains route families without becoming an
+execution, freshness, or merge decision.
 The exact route input vocabulary is machine-readable in
 `proofkit/cli-contract.v2.json` under `agent-route.inputContract`; the Go
 admission implementation owns nested and semantic behavior, while the shipped
@@ -110,7 +116,7 @@ Formal rule:
 goal plus caller-owned state
   -> smallest matching command family
   -> explicit required input
-  -> deterministic report or bounded envelope
+  -> deterministic report, bounded brief, or explicit full envelope
   -> caller-owned execution, proof freshness, and merge decision
 ```
 
@@ -154,14 +160,19 @@ Semantic context routes are `requirement-context-compose`,
 2. Start from this map when a human or agent only needs the correct command
    family.
 3. Use `agent-route` when a coding agent needs a deterministic next-command
-   packet from explicit current state. Use `agent-route --agent-envelope` when
-   the agent needs compact context refs, blockers, command refs, and non-claims
-   instead of a plain route report. Treat `blocked_*` states as stop signals,
-   not as permission to guess missing inputs. `knownChangedPaths` are
+   report from explicit current state. Use `agent-route --agent-envelope` when
+   the agent needs exactly one next action or terminal state, bounded blockers,
+   caller-owned context refs, exact omission counts, and uniquely resolvable
+   shipped boundary-policy requirement refs instead of the full route report.
+   Resolve further detail with the packet's exact output-argument suffixes and
+   retained original input and launcher context only after checking the brief's source digest and launcher profile; request
+   `--agent-envelope-mode full` only when the generic envelope is actually
+   needed. Treat `blocked_*` states as stop signals, not as permission to guess
+   missing inputs. `knownChangedPaths` are
    diagnostic-only until the caller supplies a `changed_path_set`; browser
    server startup requires explicit `browserMode: "serve_local_view"`.
-4. Use agent-envelope output only when a coding agent needs bounded context;
-   do not expand whole proof graphs into chat.
+4. Prefer the brief packet for agent context; do not expand full route reports,
+   full envelopes, or proof graphs into chat without a specific detail need.
 5. Treat generated views and rendered HTML as presentation only. They never
    replace the structured source record.
 6. Escalate to the consuming repository's owner policy whenever Proofkit reports

package/docs/specs/proofkit-agent-workflow/overview.md

@@ -20,11 +20,12 @@ The public capability is deliberately small:
 3. Existing descriptors, dispatch, command families, root-shape CLI contracts,
    agent envelopes, and package gates provide public-surface closure.
 
-Neither command scans a repository. Both command cores are stateless pure
-projections with no filesystem, Git, process, environment, clock, random,
-network, container, or provider dependency. No setup facade, agent-route extension,
-external prompt resource, persisted experiment state, or second source codec is
-introduced.
+Neither workflow command scans a repository. Both command cores are stateless
+pure projections with no filesystem, Git, process, environment, clock, random,
+network, container, or provider dependency. Neither workflow command adds a
+setup facade, hidden route policy, external prompt resource, persisted
+experiment state, or second source codec. Agent-route brief and full
+projections remain independently owned by the spec-proof-core package.
 
 ## Requirements
 
@@ -48,7 +49,7 @@ introduced.
   limits.
 - `REQ-PROOFKIT-WORKFLOW-006`: only existing launcher and presentation
   capabilities outside explicit input, with no ambient repository authority,
-  setup facade, hidden policy, or agent-route extension.
+  setup facade, hidden policy, or ownership of agent-route projections.
 - `REQ-PROOFKIT-WORKFLOW-007`: pure deterministic repository-neutral
   native-evidence guidance from one versioned typed table with five closed
   applicability classes, explicit absent-channel decisions, and finite

package/docs/specs/proofkit-agent-workflow/requirements.v1.json

@@ -73,7 +73,7 @@
     {
       "requirementId": "REQ-PROOFKIT-WORKFLOW-006",
       "ownerId": "proofkit.agent-workflow",
-      "invariant": "After existing bounded CLI transport, immutable installed-launcher profile admission, and immutable presentation-capability capture, the semantic planner accepts no repository root, caller prompt, caller-selected bound, command, environment, receipt body, or external authority field and has no filesystem, Git, process, environment, clock, random, network, container, or provider dependency; the CLI reads only the explicit input transport, the existing launcher-profile and optional Python-executable transport capabilities, and startup TTY/NO_COLOR presence needed by requested presentation, and the capability adds no setup facade, ambient scan, hidden repository policy, consumer-specific route, or agent-route extension.",
+      "invariant": "After existing bounded CLI transport, immutable installed-launcher profile admission, and immutable presentation-capability capture, the semantic planner accepts no repository root, caller prompt, caller-selected bound, command, environment, receipt body, or external authority field and has no filesystem, Git, process, environment, clock, random, network, container, or provider dependency; the CLI reads only the explicit input transport, the existing launcher-profile and optional Python-executable transport capabilities, and startup TTY/NO_COLOR presence needed by requested presentation, and this two-command workflow capability adds no setup facade, ambient scan, hidden repository policy, consumer-specific route, or ownership of the independently specified agent-route projections.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],

package/docs/specs/proofkit-spec-proof-core/overview.md

@@ -154,6 +154,25 @@ execution receipts, and merge policy.
   package, field, representation, variant, and positive/negative relation
   coverage without attributing correlated edits to independent field
   causality, selecting a codec, or changing a public source boundary.
+- `REQ-PROOFKIT-SPEC-025`: a versioned disjoint-role experiment selects one
+  admitted private v2 source-grammar owner record, grouped JSON with an
+  entity-local hybrid layout;
+  its strict bounded codec delegates meaning to the representation-neutral
+  model, binds each collection to one model-limit owner, preserves every
+  projection, metadata-presence state, and lexical source location, and emits
+  deterministic nondisclosing diagnostics. A bounded single-member traversal-,
+  symlink-, duplicate-, and trailing-data-closed archive byte-binds the exact
+  V3 screen, while independent
+  field, limit, selection, mutant, round-trip, fuzz-seed, package, and
+  admitted grammar-owner-record and package-inventory witnesses close the
+  selected owner boundary without migrating current sources, exposing a new
+  public CLI, proving open-world absence of undeclared equivalent parsers, or
+  claiming that no future owner-approved grammar can be added.
+- `REQ-PROOFKIT-SPEC-026`: agent-route v3 emits a deterministic 3072-byte
+  brief packet by default with one canonical action or typed blockers, exact
+  omission accounting, stable source-report identity, one top-level detail
+  access record, and explicit full-envelope retrieval without repeating policy
+  prose or promoting route guidance to authority.
 
 ## Non-Claims
 

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -568,6 +568,32 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "A private requirement-source codec selection admits grouped JSON with the frozen entity-local hybrid layout through one admitted v2 persisted-grammar owner record for internal/kernel/requirementsourcecodec after a versioned disjoint-role screen rejects compact and pretty JSON layouts for edit-locality failure and admits no YAML, TOML, or restricted-text parser authority. The selection record byte-binds a bounded single-member traversal-, symlink-, duplicate-, and trailing-data-closed binary archive and the exact extracted V3 evidence tree, including its method sources, fixture corpus, rendered candidates, independent token reports, review results, validation, edit rows, and decision, and its metric registry, layout order, thresholds, observations, and evaluator have exact decision closure. The selected codec maps bounded UTF-8 bytes through duplicate-, case-, unknown-, missing-, null-, integer-, and Unicode-scalar-closed structural admission into exactly one requirementsourcemodel.NormalizeWithLimits call; each wire collection names one model-limit owner; immutable atomic, authoring-layout, typed-reference, and lexical source-map projections preserve metadata absence, present-null deferral, present-record deferral, ordered actions, sorted dynamic maps, and caller wire order; and formatting re-admits the semantic model before emitting fixed-order entity-local canonical JSON with exact unsafe-scalar escaping and one final line feed. Raw-byte, UTF-8, lexical-token, nesting, representation-cardinality, model-resource, model-semantic, and canonical-output failures have fixed precedence, while diagnostic paths contain only canonical field names, numeric indexes, or placeholders and resolve synthetic model identities to exact wire spans. Independently authored field, limit-coefficient, selection, and executable mutant manifests close DTO fields and cardinalities, structural schema, resource formula, candidate roles, decision, diagnostic paths, and losing-grammar dependencies; round-trip, idempotence, source-span replay, exact-limit, fuzz-seed, admitted grammar-owner record, and exact package-inventory witnesses close the currently selected owner boundary without claiming open-world absence of undeclared semantically equivalent parsers or a ban on future owner-approved grammars.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-025"],
+      "nonClaims": ["This private codec does not migrate or rewrite current requirement sources, expose a public source extension or CLI command, retain a normalized mirror, authenticate requirement meaning or derivation provenance, generalize the frozen formatter screen beyond its byte-bound corpus, prove the open-world absence of undeclared semantically equivalent parsers, prevent a future owner-approved grammar from being added, execute native witnesses, approve merge or release, or establish rollout or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-026",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "Agent-route output contract v3 derives every report, brief packet, and full envelope from one fully admitted immutable route input, one admitted launcher profile, and one command-owned route report: route artifact refs in both available inputs and observed reports identify materialized caller-owned artifacts and never use the stdin transport sentinel; the nested report contract preserves the exact required route-report fields, schemaVersion 3, closed route-family vocabulary, guidance-to-selected-family relation, pre-suppression available-command count, and launcher profile; a bare --agent-envelope and explicit brief mode emit the same deterministic schema-v1 proofkit.agent-route.brief root while explicit full mode preserves the prior generic envelope; a routed brief selects exactly the first canonical nextCommands entry as its sole nextAction, retains its exact command and argv identity when the 3072-byte pretty stable-JSON bound permits, otherwise removes only inline argv and marks argvState detail_required, while every blocked state emits null nextAction; blockers are projected in deterministic unknown-goal, required-input, then sorted non-passed observed-report order, retain at most four typed entries without materializing omitted blocker maps, and report the exact omitted remainder; contextRefs refer to all and only caller-owned artifact operands of the selected command through resolvable source-report JSON pointers; one top-level detailAccess record binds the source report ID, stable digest, and launcher profile, provides exact report and full output-argument suffixes for replay with the original input and launcher context, and no per-item detail reference is added; omissionSummary exactly counts pre-suppression unselected available commands, source-omitted commands, and omitted blockers; fixed uniquely resolvable shipped requirement IDs replace repeated boundary-policy prose; the complete brief is at most 3072 bytes, and unsupported modes, invalid flag values, repeated single-value flags, or a detail mode without --agent-envelope fail before input is read. Reports and envelopes remain derived route guidance and never become requirement, proof, execution, merge, release, rollout, deployment, or readiness authority.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-026"],
+      "nonClaims": ["The 3072-byte packet bound and stable source-report digest do not prove provider token consumption, semantic sufficiency, source freshness, command execution, native witness truth, or policy approval; detail retrieval requires the caller to retain the original admitted input and launcher context."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ],
   "nonClaims": [

package/docs/specs/proofkit-supply-chain-quality/requirements.v1.json

@@ -337,7 +337,7 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-026",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "Every repository-owned stable JSON implementation used by a public or retained-evidence path accepts only Unicode 15.0.0 scalar strings, rejecting malformed UTF-8 byte strings and unpaired UTF-16 surrogates as applicable, emits the same deterministic semantic-preserving JSON escapes for the pinned Cc, Cf, Zl, and Zp range table, preserves ordinary decoded values, and remains byte-compatible with one versioned owner-authored literal range corpus whose Go projection is exhaustively checked against the Unicode 15.0.0 category oracle and whose JavaScript and generated TypeScript projections are exhaustively checked over the scalar domain.",
+      "invariant": "Every repository-owned stable JSON implementation used by a public or retained-evidence path accepts only Unicode 17.0.0 scalar strings, rejecting malformed UTF-8 byte strings and unpaired UTF-16 surrogates as applicable, emits the same deterministic semantic-preserving JSON escapes for the pinned Cc, Cf, Zl, and Zp range table, preserves ordinary decoded values, and remains byte-compatible with one versioned owner-authored literal range corpus whose Go projection is exhaustively checked against the Unicode 17.0.0 category oracle and whose JavaScript and generated TypeScript projections are exhaustively checked over the scalar domain.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
@@ -350,7 +350,7 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-027",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "Every report-visible diagnostic and structural-text sanitizer accepts only Unicode 15.0.0 scalar strings, recognizes one explicit Unicode whitespace alphabet plus the pinned Cc, Cf, Zl, and Zp range table and contiguous or control-split secret-shaped values through one shared taxonomy, replaces any rejected caller-owned value as a whole with one fixed command-owned label without emitting its bytes, code points, prefix, suffix, or caller-controlled replacement text, and bounds admitted diagnostic projection to 512 Unicode scalars; every Go and JavaScript repository tool entrypoint routes dynamic errors through that owner, failed child-process stderr that enters this diagnostic boundary is captured under a fixed byte limit before whole-value sanitization while successful child stderr is not projected, direct child stderr wiring is rejected, and the installed-carrier smoke adapter bounds stdout, stderr, time, and cleanup; on supported Unix hosts, a successful installed-carrier result requires confirmed process-group absence after the command parent is reaped, while cleanup timeout or probe failure is an explicit failed operation rather than a successful terminal result.",
+      "invariant": "Every report-visible diagnostic and structural-text sanitizer accepts only Unicode 17.0.0 scalar strings, recognizes one explicit Unicode whitespace alphabet plus the pinned Cc, Cf, Zl, and Zp range table and contiguous or control-split secret-shaped values through one shared taxonomy, replaces any rejected caller-owned value as a whole with one fixed command-owned label without emitting its bytes, code points, prefix, suffix, or caller-controlled replacement text, and bounds admitted diagnostic projection to 512 Unicode scalars; every Go and JavaScript repository tool entrypoint routes dynamic errors through that owner, failed child-process stderr that enters this diagnostic boundary is captured under a fixed byte limit before whole-value sanitization while successful child stderr is not projected, direct child stderr wiring is rejected, and the installed-carrier smoke adapter bounds stdout, stderr, time, and cleanup; on supported Unix hosts, a successful installed-carrier result requires confirmed process-group absence after the command parent is reaped, while cleanup timeout or probe failure is an explicit failed operation rather than a successful terminal result.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,
-  "packageManager": "npm@11.18.0",
+  "packageManager": "npm@12.0.2",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"
@@ -74,8 +74,8 @@
     "x64"
   ],
   "devDependencies": {
-    "@playwright/test": "1.62.0",
-    "axe-core": "4.12.1",
+    "@playwright/test": "1.62.1",
+    "axe-core": "4.13.0",
     "typescript": "7.0.2"
   }
 }

package/proofkit/cli-contract.v2.json

@@ -347,9 +347,30 @@
       ],
       "allowedFlags": [
         "--agent-envelope",
+        "--agent-envelope-mode",
         "--input",
         "--input-pointer"
       ],
+      "singleOccurrenceFlags": [
+        "--agent-envelope",
+        "--agent-envelope-mode",
+        "--input",
+        "--input-pointer"
+      ],
+      "flagChoices": {
+        "--agent-envelope-mode": [
+          "brief",
+          "full"
+        ]
+      },
+      "flagPresenceRequirements": [
+        {
+          "flag": "--agent-envelope-mode",
+          "requiredFlags": [
+            "--agent-envelope"
+          ]
+        }
+      ],
       "inputContract": {
         "contractId": "proofkit.agent-route.input.v1",
         "schemaVersion": 1,
@@ -400,7 +421,7 @@
                 ]
               },
               "ref": {
-                "format": "safe repo-relative caller-owned file, report ref, or scanner root ref; scanner root refs may be ."
+                "format": "safe repo-relative materialized caller-owned file, report ref, or scanner root ref; stdin sentinel - is forbidden and scanner root refs may be ."
               }
             },
             "uniqueBy": "kind"
@@ -414,7 +435,6 @@
             "nonClaim": "serve_local_view only adds --serve to requirement-browser-server routes; it does not create a public server or approve rendered artifacts."
           },
           "goal": {
-            "required": true,
             "enum": [
               "admit_receipts",
               "adopt_repository",
@@ -435,7 +455,8 @@
               "unknown",
               "validate_requirement_source",
               "verify_typescript_public_api"
-            ]
+            ],
+            "required": true
           },
           "knownChangedPaths": {
             "default": [],
@@ -443,20 +464,21 @@
             "nonClaim": "knownChangedPaths is diagnostic-only; selective routing requires a caller-owned changed_path_set input ref."
           },
           "mode": {
-            "required": true,
             "enum": [
               "enforce-all",
               "enforce-touched",
               "observe",
               "warn"
-            ]
+            ],
+            "required": true
           },
           "nonClaims": {
             "default": [],
-            "maxItems": 8,
-            "maxItemRunes": 240
+            "maxItemRunes": 240,
+            "maxItems": 8
           },
           "observedReports": {
+            "blockingSemantics": "any observed report state other than passed blocks command emission",
             "default": [],
             "item": {
               "kind": {
@@ -472,7 +494,7 @@
                 ]
               },
               "ref": {
-                "format": "safe repo-relative report ref"
+                "format": "safe repo-relative materialized caller-owned report ref; stdin sentinel - is forbidden"
               },
               "state": {
                 "enum": [
@@ -484,7 +506,6 @@
                 ]
               }
             },
-            "blockingSemantics": "any observed report state other than passed blocks command emission",
             "uniqueBy": "ref"
           },
           "openBrowser": {
@@ -492,9 +513,9 @@
             "nonClaim": "openBrowser only adds --open when browserMode is serve_local_view."
           },
           "routeId": {
-            "required": true,
             "format": "safe stable id",
-            "maxRunes": 96
+            "maxRunes": 96,
+            "required": true
           },
           "schemaVersion": {
             "required": true,
@@ -511,7 +532,7 @@
         "rootDefinitionDigest": "sha256:fd1121285d1b357ed848febc248700a75417d06619e22ed36991631d7526375b",
         "nativeSource": {
           "path": "internal/command/agentroute",
-          "canonicalDigest": "sha256:2fc5d42c6126069aad7cad9a18acf9683289ce54be3a0d2f3aef6f429e2bcbdf",
+          "canonicalDigest": "sha256:3256eac5777824ad0b7b9bce6537efdb42b75430579a1a3f160577cf8cdce379",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -536,76 +557,133 @@
         "ownerRequirementRefs": [
           "REQ-PROOFKIT-PACKAGE-002",
           "REQ-PROOFKIT-QUALITY-004",
-          "REQ-PROOFKIT-SPEC-005"
+          "REQ-PROOFKIT-SPEC-005",
+          "REQ-PROOFKIT-SPEC-026"
         ]
       },
       "outputContract": {
-        "contractId": "proofkit.agent-route.output.v2",
-        "schemaVersion": 2,
-        "authority": "deterministic route report derived from admitted agent-route input",
-        "requiredFields": [
-          "guidanceSlice",
-          "reportId",
-          "reportKind",
-          "schemaVersion",
-          "selectedRouteFamily",
-          "state"
-        ],
-        "fields": {
-          "schemaVersion": {
-            "value": 2
-          },
-          "selectedRouteFamily": {
-            "enum": [
-              "adoption",
-              "migration",
-              "release_and_deployment",
-              "rendered_views",
-              "repository_structure",
-              "requirement_proof_binding",
-              "requirement_source",
-              "selective_evidence",
-              "selective_planning",
-              "test_inventory_and_coverage",
-              "unknown"
-            ]
-          },
-          "guidanceSlice": {
-            "requiredFields": [
-              "routeFamily"
-            ],
-            "routeFamilyRule": "must equal selectedRouteFamily"
+        "contractId": "proofkit.agent-route.output.v3",
+        "schemaVersion": 3,
+        "authority": "deterministic route report, brief packet, full envelope, or invalid-input repair packet selected from the admitted invocation",
+        "reportContract": {
+          "contractId": "proofkit.agent-route.report.v3",
+          "schemaVersion": 3,
+          "requiredFields": [
+            "guidanceSlice",
+            "reportId",
+            "reportKind",
+            "schemaVersion",
+            "selectedRouteFamily",
+            "state",
+            "summary"
+          ],
+          "fields": {
+            "schemaVersion": {
+              "value": 3
+            },
+            "selectedRouteFamily": {
+              "enum": [
+                "adoption",
+                "migration",
+                "release_and_deployment",
+                "rendered_views",
+                "repository_structure",
+                "requirement_proof_binding",
+                "requirement_source",
+                "selective_evidence",
+                "selective_planning",
+                "test_inventory_and_coverage",
+                "unknown"
+              ]
+            },
+            "guidanceSlice": {
+              "requiredFields": [
+                "routeFamily"
+              ],
+              "routeFamilyRule": "must equal selectedRouteFamily"
+            },
+            "summary": {
+              "availableCommandCount": "exact count before blocked-state command suppression",
+              "launcherProfile": "exact admitted command-renderer profile that affects route argv and report identity"
+            }
           }
         },
-        "changesFromV1": [
-          "selectedFamily is replaced by selectedRouteFamily",
-          "guidanceSlice.family is replaced by guidanceSlice.routeFamily"
+        "briefPacketContract": {
+          "boundaryPolicyRefs": [
+            "REQ-PROOFKIT-SPEC-005",
+            "REQ-PROOFKIT-SPEC-026"
+          ],
+          "contractId": "proofkit.agent-route.brief.v1",
+          "fieldRules": {
+            "blockers": "unknown-goal blocker when applicable, then required-input blockers, then sorted non-passed observed-report blockers; retain at most four and count the exact remainder without materializing the omitted blocker maps",
+            "boundaryPolicyRefs": "exactly the shipped and uniquely resolvable requirement IDs REQ-PROOFKIT-SPEC-005 and REQ-PROOFKIT-SPEC-026; policy prose is not duplicated",
+            "contextRefs": "only caller-owned artifact operands of the selected next command, each addressed by an RFC 6901 pointer into the source report",
+            "detailAccess": "binds source report ID, stable digest, and launcher profile and provides exact outputArgs suffixes for report and full retrieval from the original admitted input and launcher context",
+            "nextAction": "null for blocked states; otherwise the first canonical nextCommands entry with exact command identity and inline argv unless the byte bound requires argvState=detail_required",
+            "omissionSummary": "exact counts for unselected available commands, source-omitted commands, and blockers omitted by the packet bound",
+            "packetKind": "proofkit.agent-route.brief",
+            "schemaVersion": "1"
+          },
+          "maxBlockers": 4,
+          "maxPrettyJSONBytes": 3072,
+          "nonClaims": [
+            "The brief packet is derived route guidance, not requirement, proof, execution, merge, release, rollout, deployment, or readiness authority.",
+            "The packet byte bound does not claim tokenizer-specific token consumption or semantic sufficiency."
+          ],
+          "requiredFields": [
+            "blockers",
+            "boundaryPolicyRefs",
+            "contextRefs",
+            "detailAccess",
+            "nextAction",
+            "omissionSummary",
+            "packetId",
+            "packetKind",
+            "routeFamily",
+            "schemaVersion",
+            "state"
+          ],
+          "schemaVersion": 1
+        },
+        "changesFromV2": [
+          "bare --agent-envelope emits proofkit.agent-route.brief",
+          "--agent-envelope-mode full preserves the prior generic envelope projection",
+          "route report schemaVersion advances to 3 while preserving prior route-family semantics and adding exact launcher and available-command context"
         ],
         "rootType": "object",
         "closed": true,
-        "rootDefinitionRef": "proofkit.agent-route.output.v2.root-shape",
-        "rootDefinitionDigest": "sha256:db7d5b29083a939eea0f23253632394212b0d73b5f1b6206d0811d236d6a84ca",
-        "nativeSource": {
-          "path": "internal/command/agentroute",
-          "canonicalDigest": "sha256:2fc5d42c6126069aad7cad9a18acf9683289ce54be3a0d2f3aef6f429e2bcbdf",
-          "evidenceClass": "source_checkout"
-        },
+        "rootDefinitionRef": "proofkit.agent-route.output.v3.root-shape",
+        "rootDefinitionDigest": "sha256:0881bc0765f61ea76d681a8bb2ddd915504c5a350a3a8286253e2959693be60e",
+        "nativeSources": [
+          {
+            "path": "internal/app",
+            "canonicalDigest": "sha256:3fb162add7aad5988f19c88016571f113af948190c0042f74016b7a688625386",
+            "evidenceClass": "source_checkout"
+          },
+          {
+            "path": "internal/command/agentroute",
+            "canonicalDigest": "sha256:3256eac5777824ad0b7b9bce6537efdb42b75430579a1a3f160577cf8cdce379",
+            "evidenceClass": "source_checkout"
+          }
+        ],
         "nativeOutputWitnessSelector": {
-          "path": "internal/command/agentroute/agentroute_test.go",
-          "test": "TestBuildRoutesRequirementSourceAndBlocksUnknownGoal",
-          "command": "go test ./internal/command/agentroute -run '^TestBuildRoutesRequirementSourceAndBlocksUnknownGoal$'",
+          "path": "internal/app/cli_abi_test.go",
+          "test": "TestAgentRouteEnvelopeModesUseExactRootShapes",
+          "command": "go test ./internal/app -run '^TestAgentRouteEnvelopeModesUseExactRootShapes$'",
           "evidenceClass": "source_checkout"
         },
         "compatibilitySummary": [
           "guidanceSlice",
-          "schemaVersion",
           "selectedRouteFamily",
-          "root-shape-only definition proofkit.agent-route.output.v2.root-shape; nested fields, types, and cardinalities are non-claims"
+          "schemaVersion=3",
+          "brief agent packet by default with explicit full envelope detail mode",
+          "nested proofkit.agent-route.brief.v1 contract plus root-shape definition proofkit.agent-route.output.v3.root-shape"
         ],
         "ownerRequirementRefs": [
           "REQ-PROOFKIT-PACKAGE-002",
           "REQ-PROOFKIT-QUALITY-004",
-          "REQ-PROOFKIT-SPEC-005"
+          "REQ-PROOFKIT-SPEC-005",
+          "REQ-PROOFKIT-SPEC-026"
         ]
       }
     },
@@ -1118,7 +1196,7 @@
         "rootDefinitionDigest": "sha256:b343c1093476cd9f50970f58608e43c1a6ae681a2c06b17c217ab4f22ea454e5",
         "nativeSource": {
           "path": "internal/command/conformanceprofile",
-        "canonicalDigest": "sha256:fba2ae58bf66cfc43834368dec84ca85abd11e08a541786dc59eafaf7628c322",
+          "canonicalDigest": "sha256:fba2ae58bf66cfc43834368dec84ca85abd11e08a541786dc59eafaf7628c322",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -1145,7 +1223,7 @@
         "rootDefinitionDigest": "sha256:5817a9d259deb8ff48d8dc6298b46164e7b132304ca1d865967c611d147b1793",
         "nativeSource": {
           "path": "internal/command/conformanceprofile",
-        "canonicalDigest": "sha256:fba2ae58bf66cfc43834368dec84ca85abd11e08a541786dc59eafaf7628c322",
+          "canonicalDigest": "sha256:fba2ae58bf66cfc43834368dec84ca85abd11e08a541786dc59eafaf7628c322",
           "evidenceClass": "source_checkout"
         },
         "nativeOutputWitnessSelector": {
@@ -2421,7 +2499,7 @@
         "nativeSources": [
           {
             "path": "internal/app",
-            "canonicalDigest": "sha256:af43c7dae19e019887fd3c43ddef4d453966b517880dc3fb76be5f3ed048281d",
+            "canonicalDigest": "sha256:3fb162add7aad5988f19c88016571f113af948190c0042f74016b7a688625386",
             "evidenceClass": "source_checkout"
           },
           {
@@ -5663,7 +5741,7 @@
         "rootDefinitionDigest": "sha256:3c842174dff5361e7f83166469b832805e05aa314b073c16234b5b64e346281e",
         "nativeSource": {
           "path": "internal/app",
-          "canonicalDigest": "sha256:af43c7dae19e019887fd3c43ddef4d453966b517880dc3fb76be5f3ed048281d",
+          "canonicalDigest": "sha256:3fb162add7aad5988f19c88016571f113af948190c0042f74016b7a688625386",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -5692,7 +5770,7 @@
         "rootDefinitionDigest": "sha256:0ea95e277ebe44cd2de42c29b47c38686ac0b6b390d8965367437b3fe138e209",
         "nativeSource": {
           "path": "internal/app",
-          "canonicalDigest": "sha256:af43c7dae19e019887fd3c43ddef4d453966b517880dc3fb76be5f3ed048281d",
+          "canonicalDigest": "sha256:3fb162add7aad5988f19c88016571f113af948190c0042f74016b7a688625386",
           "evidenceClass": "source_checkout"
         },
         "nativeOutputWitnessSelector": {
@@ -7706,7 +7784,7 @@
       "canonicalDigest": "sha256:fd1121285d1b357ed848febc248700a75417d06619e22ed36991631d7526375b"
     },
     {
-      "definitionId": "proofkit.agent-route.output.v2.root-shape",
+      "definitionId": "proofkit.agent-route.output.v3.root-shape",
       "schemaVersion": 1,
       "rootType": "object",
       "closed": true,
@@ -7718,6 +7796,39 @@
           "Root-shape definitions do not replace direct public-CLI runtime witnesses for variant selection."
         ],
         "variants": [
+          {
+            "allowedFields": [
+              "blockers",
+              "boundaryPolicyRefs",
+              "contextRefs",
+              "detailAccess",
+              "nextAction",
+              "omissionSummary",
+              "packetId",
+              "packetKind",
+              "routeFamily",
+              "schemaVersion",
+              "state"
+            ],
+            "requiredFields": [
+              "blockers",
+              "boundaryPolicyRefs",
+              "contextRefs",
+              "detailAccess",
+              "nextAction",
+              "omissionSummary",
+              "packetId",
+              "packetKind",
+              "routeFamily",
+              "schemaVersion",
+              "state"
+            ],
+            "rootKind": "object",
+            "variantId": "01-agent-brief",
+            "when": [
+              "--agent-envelope=present --agent-envelope-mode=absent|brief; admitted route input"
+            ]
+          },
           {
             "allowedFields": [
               "actionPlan",
@@ -7752,9 +7863,48 @@
               "sourceReport"
             ],
             "rootKind": "object",
-            "variantId": "01-agent-envelope",
+            "variantId": "02-agent-envelope-full",
             "when": [
-              "--agent-envelope"
+              "--agent-envelope=present --agent-envelope-mode=full; admitted route input"
+            ]
+          },
+          {
+            "allowedFields": [
+              "actionPlan",
+              "blockedPreconditions",
+              "bounds",
+              "clarificationQuestions",
+              "commands",
+              "contextRefs",
+              "costContract",
+              "envelopeId",
+              "nonClaims",
+              "omitted",
+              "receiptRefs",
+              "routeQuestions",
+              "schemaVersion",
+              "sourceReport"
+            ],
+            "requiredFields": [
+              "actionPlan",
+              "blockedPreconditions",
+              "bounds",
+              "clarificationQuestions",
+              "commands",
+              "contextRefs",
+              "costContract",
+              "envelopeId",
+              "nonClaims",
+              "omitted",
+              "receiptRefs",
+              "routeQuestions",
+              "schemaVersion",
+              "sourceReport"
+            ],
+            "rootKind": "object",
+            "variantId": "03-invalid-input-repair",
+            "when": [
+              "--agent-envelope=present; route input or input-pointer admission failed"
             ]
           },
           {
@@ -7795,7 +7945,7 @@
               "summary"
             ],
             "rootKind": "object",
-            "variantId": "02-routed",
+            "variantId": "04-routed",
             "when": [
               "without --agent-envelope; known goal"
             ]
@@ -7808,6 +7958,7 @@
               "guidanceSlice",
               "nextCommands",
               "nonClaims",
+              "observedReports",
               "omitted",
               "reportId",
               "reportKind",
@@ -7825,6 +7976,7 @@
               "guidanceSlice",
               "nextCommands",
               "nonClaims",
+              "observedReports",
               "omitted",
               "reportId",
               "reportKind",
@@ -7836,14 +7988,14 @@
               "summary"
             ],
             "rootKind": "object",
-            "variantId": "03-unknown-goal",
+            "variantId": "05-unknown-goal",
             "when": [
               "without --agent-envelope; goal=unknown"
             ]
           }
         ]
       },
-      "canonicalDigest": "sha256:db7d5b29083a939eea0f23253632394212b0d73b5f1b6206d0811d236d6a84ca"
+      "canonicalDigest": "sha256:0881bc0765f61ea76d681a8bb2ddd915504c5a350a3a8286253e2959693be60e"
     },
     {
       "definitionId": "proofkit.binding-partition.input.v1.root-shape",

package/proofkit/requirement-bindings.json

@@ -696,6 +696,22 @@
       "proofState": "witness_backed",
       "nonClaims": ["This private single-source model does not select or expose a source codec, parse or serialize a persisted source, retain a normalized mirror, establish cross-source requirement identity, authenticate derivation objects, digests, selectors, or freshness, authenticate a caller-declared sourceKind or prove its author's authority or trust class, cut over any current requirement consumer, prove requirement meaning or implementation correctness, execute native witnesses, approve merge or release, or establish rollout or production readiness."]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "ownerId": "proofkit.spec-proof-core",
+      "specPath": "docs/specs/proofkit-spec-proof-core/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["This private codec does not migrate or rewrite current requirement sources, expose a public source extension or CLI command, retain a normalized mirror, authenticate requirement meaning or derivation provenance, generalize the frozen formatter screen beyond its byte-bound corpus, prove the open-world absence of undeclared semantically equivalent parsers, prevent a future owner-approved grammar from being added, execute native witnesses, approve merge or release, or establish rollout or production readiness."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-026",
+      "ownerId": "proofkit.spec-proof-core",
+      "specPath": "docs/specs/proofkit-spec-proof-core/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["The 3072-byte packet bound and stable source-report digest do not prove provider token consumption, semantic sufficiency, source freshness, command execution, native witness truth, or policy approval; detail retrieval requires the caller to retain the original admitted input and launcher context."]
+    },
     {
       "requirementId": "REQ-PROOFKIT-WORKFLOW-001",
       "ownerId": "proofkit.agent-workflow",
@@ -1100,6 +1116,10 @@
           "selector": "TestAdoptionContractEnvelopeCLIABI",
           "command": "go test ./internal/app -run '^TestAdoptionContractEnvelopeCLIABI$'"
         },
+        {
+          "selector": "TestAgentRouteEnvelopeModesUseExactRootShapes",
+          "command": "go test ./internal/app -run '^TestAgentRouteEnvelopeModesUseExactRootShapes$'"
+        },
         {
           "selector": "TestRequirementAuthoringPlanOutputUsesVersionedRootShape",
           "command": "go test ./internal/app -run '^TestRequirementAuthoringPlanOutputUsesVersionedRootShape$'"
@@ -2315,6 +2335,10 @@
           "selector": "TestAdoptionContractEnvelopeCLIABI",
           "command": "go test ./internal/app -run '^TestAdoptionContractEnvelopeCLIABI$'"
         },
+        {
+          "selector": "TestAgentRouteEnvelopeModesUseExactRootShapes",
+          "command": "go test ./internal/app -run '^TestAgentRouteEnvelopeModesUseExactRootShapes$'"
+        },
         {
           "selector": "TestRequirementAuthoringPlanOutputUsesVersionedRootShape",
           "command": "go test ./internal/app -run '^TestRequirementAuthoringPlanOutputUsesVersionedRootShape$'"
@@ -3858,8 +3882,8 @@
           "command": "go test ./internal/kernel/unicodepolicy -run '^TestUnsafeScalarTableMatchesVersionedOwnerCorpus$'"
         },
         {
-          "selector": "TestUnsafeScalarTableMatchesEveryUnicode15Scalar",
-          "command": "go test ./internal/kernel/unicodepolicy -run '^TestUnsafeScalarTableMatchesEveryUnicode15Scalar$'"
+          "selector": "TestUnsafeScalarTableMatchesEveryUnicode17Scalar",
+          "command": "go test ./internal/kernel/unicodepolicy -run '^TestUnsafeScalarTableMatchesEveryUnicode17Scalar$'"
         },
         {
           "selector": "TestValidScalarStringRejectsMalformedUTF8",
@@ -4577,6 +4601,450 @@
       "commandIds": ["proofkit.go-test"],
       "environmentClasses": ["local-go"]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-selection-closure",
+      "witnessId": "proofkit.requirement-source-codec.selection-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/selection_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestSelectionRecordIsClosedAndDecisionIsReproducible",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestSelectionRecordIsClosedAndDecisionIsReproducible$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-selection-evidence-closure",
+      "witnessId": "proofkit.requirement-source-codec.selection-evidence-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/selection_evidence_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestSelectionEvidenceIsByteBoundAndProjectsDecision",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestSelectionEvidenceIsByteBoundAndProjectsDecision$'"
+        },
+        {
+          "selector": "TestScreenTreeDigestRejectsByteAndInventoryMutation",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestScreenTreeDigestRejectsByteAndInventoryMutation$'"
+        },
+        {
+          "selector": "TestScreenArchiveAdmissionRejectsUnsafeTopology",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestScreenArchiveAdmissionRejectsUnsafeTopology$'"
+        },
+        {
+          "selector": "TestScreenArchiveAdmissionRejectsTrailingCompressedData",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestScreenArchiveAdmissionRejectsTrailingCompressedData$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-decision-projection-closure",
+      "witnessId": "proofkit.requirement-source-codec.decision-projection-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/selection_projection_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestDecisionProjectionRejectsReplacementObservationDrift",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestDecisionProjectionRejectsReplacementObservationDrift$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-replacement-predicate-closure",
+      "witnessId": "proofkit.requirement-source-codec.replacement-predicate-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/selection_evaluator_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestChallengerEligibilityRequiresEveryReplacementPredicate",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestChallengerEligibilityRequiresEveryReplacementPredicate$'"
+        },
+        {
+          "selector": "TestSelectionMetricRegistrySemanticsDriveEvaluator",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestSelectionMetricRegistrySemanticsDriveEvaluator$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-package-boundary-closure",
+      "witnessId": "proofkit.requirement-source-codec.package-boundary-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/package_boundary_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestProductionPackageHasOneCodecAndNoSyntaxDependency",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestProductionPackageHasOneCodecAndNoSyntaxDependency$'"
+        },
+        {
+          "selector": "TestSelectedV2GrammarOwnerRecordIsExact",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestSelectedV2GrammarOwnerRecordIsExact$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-field-closure",
+      "witnessId": "proofkit.requirement-source-codec.field-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/field_manifest_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestFieldManifestMatchesWireDTOAndClosedShape",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestFieldManifestMatchesWireDTOAndClosedShape$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-roundtrip-closure",
+      "witnessId": "proofkit.requirement-source-codec.roundtrip-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/roundtrip_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestFormatParseRoundTripPreservesEveryProjection",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestFormatParseRoundTripPreservesEveryProjection$'"
+        },
+        {
+          "selector": "TestCanonicalFormatIsIdempotent",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestCanonicalFormatIsIdempotent$'"
+        },
+        {
+          "selector": "TestFormatPreservesMetadataAbsenceNullAndRecord",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestFormatPreservesMetadataAbsenceNullAndRecord$'"
+        },
+        {
+          "selector": "TestSourceMapReplaysKeyAndValueSpans",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestSourceMapReplaysKeyAndValueSpans$'"
+        },
+        {
+          "selector": "TestReturnedSourceMapIsImmutable",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestReturnedSourceMapIsImmutable$'"
+        },
+        {
+          "selector": "TestSourceMapIndexesLexicalWireOrderNotNormalizedOrder",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestSourceMapIndexesLexicalWireOrderNotNormalizedOrder$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-layout-closure",
+      "witnessId": "proofkit.requirement-source-codec.layout-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/format_layout_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestHybridLayoutKeepsStableSiblingEntityLinesUnchanged",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestHybridLayoutKeepsStableSiblingEntityLinesUnchanged$'"
+        },
+        {
+          "selector": "TestHybridLayoutUsesCommaFirstEntityArrays",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestHybridLayoutUsesCommaFirstEntityArrays$'"
+        },
+        {
+          "selector": "TestCanonicalStringsEscapeUnsafeScalarsWithoutHTMLEscaping",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestCanonicalStringsEscapeUnsafeScalarsWithoutHTMLEscaping$'"
+        },
+        {
+          "selector": "TestCanonicalMapKeysAreSorted",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestCanonicalMapKeysAreSorted$'"
+        },
+        {
+          "selector": "TestOrderedActionsRetainOrder",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestOrderedActionsRetainOrder$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-mutant-closure",
+      "witnessId": "proofkit.requirement-source-codec.mutant-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/mutant_manifest_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestCodecMutantManifestClosesRepresentationFailures",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestCodecMutantManifestClosesRepresentationFailures$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-resource-closure",
+      "witnessId": "proofkit.requirement-source-codec.resource-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/limits_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestRawByteBoundaryIsExactAndDominatesUTF8",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestRawByteBoundaryIsExactAndDominatesUTF8$'"
+        },
+        {
+          "selector": "TestTokenAndNestingLimitsPrecedeShapeAdmission",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestTokenAndNestingLimitsPrecedeShapeAdmission$'"
+        },
+        {
+          "selector": "TestLexicalTokenLimitDominatesNestingWhenBothFail",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestLexicalTokenLimitDominatesNestingWhenBothFail$'"
+        },
+        {
+          "selector": "TestRepresentationCollectionLimitPrecedesModelSemantics",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestRepresentationCollectionLimitPrecedesModelSemantics$'"
+        },
+        {
+          "selector": "TestDynamicMapCollectionLimitPrecedesParameterSemantics",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestDynamicMapCollectionLimitPrecedesParameterSemantics$'"
+        },
+        {
+          "selector": "TestModelResourcePreflightPrecedesSemanticValidation",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestModelResourcePreflightPrecedesSemanticValidation$'"
+        },
+        {
+          "selector": "TestCodecLimitsCannotUnderCoverModel",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestCodecLimitsCannotUnderCoverModel$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-limit-formula-closure",
+      "witnessId": "proofkit.requirement-source-codec.limit-formula-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/limit_manifest_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestLimitCoefficientManifestMatchesProductionFormula",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestLimitCoefficientManifestMatchesProductionFormula$'"
+        },
+        {
+          "selector": "TestLimitArithmeticRejectsOverflow",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestLimitArithmeticRejectsOverflow$'"
+        },
+        {
+          "selector": "TestCanonicalByteBoundCoversWorstAdmittedEscapeExpansion",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestCanonicalByteBoundCoversWorstAdmittedEscapeExpansion$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-diagnostic-closure",
+      "witnessId": "proofkit.requirement-source-codec.diagnostic-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/diagnostics_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestInvalidUTF8UsesByteOnlyCoordinates",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestInvalidUTF8UsesByteOnlyCoordinates$'"
+        },
+        {
+          "selector": "TestValidUnicodeDiagnosticsUseScalarColumns",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestValidUnicodeDiagnosticsUseScalarColumns$'"
+        },
+        {
+          "selector": "TestBareCRAndCRLFAdvanceScalarLinesOnce",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestBareCRAndCRLFAdvanceScalarLinesOnce$'"
+        },
+        {
+          "selector": "TestMultipleValueDiagnosticSpansSecondToken",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestMultipleValueDiagnosticSpansSecondToken$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-admission-closure",
+      "witnessId": "proofkit.requirement-source-codec.admission-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/admission_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestParseDiagnosticsDoNotDiscloseCallerTextOrDynamicKeys",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestParseDiagnosticsDoNotDiscloseCallerTextOrDynamicKeys$'"
+        },
+        {
+          "selector": "TestPreShapeDiagnosticsDoNotDiscloseUnknownKeys",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestPreShapeDiagnosticsDoNotDiscloseUnknownKeys$'"
+        },
+        {
+          "selector": "TestParseDiagnosticsRedactSemanticEntityIDsAndResolveExactSpan",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestParseDiagnosticsRedactSemanticEntityIDsAndResolveExactSpan$'"
+        },
+        {
+          "selector": "TestParseAcceptsValidUnicodeSurrogatePairLosslessly",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestParseAcceptsValidUnicodeSurrogatePairLosslessly$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-025",
+      "scenarioId": "proofkit.spec-proof-core.requirement-source-codec-fuzz-seed-closure",
+      "witnessId": "proofkit.requirement-source-codec.fuzz-seed-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/requirementsourcecodec/codec_fuzz_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestFuzzSeedCorpusRoundTrips",
+          "command": "go test ./internal/kernel/requirementsourcecodec -run '^TestFuzzSeedCorpusRoundTrips$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-026",
+      "scenarioId": "proofkit.spec-proof-core.agent-route-brief-cli-abi",
+      "witnessId": "proofkit.agent-route-brief.cli-abi-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/cli_abi_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestAgentRouteEnvelopeModesUseExactRootShapes",
+          "command": "go test ./internal/app -run '^TestAgentRouteEnvelopeModesUseExactRootShapes$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-026",
+      "scenarioId": "proofkit.spec-proof-core.agent-route-brief-projection",
+      "witnessId": "proofkit.agent-route-brief.projection-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/agentroute/brief_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestAgentBriefBindsLauncherContextThatAffectsReportDigest",
+          "command": "go test ./internal/command/agentroute -run '^TestAgentBriefBindsLauncherContextThatAffectsReportDigest$'"
+        },
+        {
+          "selector": "TestAgentBriefClosesEverySelectedCommandInputReference",
+          "command": "go test ./internal/command/agentroute -run '^TestAgentBriefClosesEverySelectedCommandInputReference$'"
+        },
+        {
+          "selector": "TestAgentBriefCompactsAtDeclaredByteBoundary",
+          "command": "go test ./internal/command/agentroute -run '^TestAgentBriefCompactsAtDeclaredByteBoundary$'"
+        },
+        {
+          "selector": "TestAgentBriefIsBoundedAndFullEnvelopeRemainsAvailable",
+          "command": "go test ./internal/command/agentroute -run '^TestAgentBriefIsBoundedAndFullEnvelopeRemainsAvailable$'"
+        },
+        {
+          "selector": "TestAgentBriefNamesCompleteInputBundleBlocker",
+          "command": "go test ./internal/command/agentroute -run '^TestAgentBriefNamesCompleteInputBundleBlocker$'"
+        },
+        {
+          "selector": "TestAgentBriefPreservesBlockedRouteOmissionsAndUnknownReportBlockers",
+          "command": "go test ./internal/command/agentroute -run '^TestAgentBriefPreservesBlockedRouteOmissionsAndUnknownReportBlockers$'"
+        },
+        {
+          "selector": "TestBriefBlockerBoundDominatesMapMaterialization",
+          "command": "go test ./internal/command/agentroute -run '^TestBriefBlockerBoundDominatesMapMaterialization$'"
+        },
+        {
+          "selector": "TestBuildEnvelopeCapsBlockersAndCountsOmittedDetails",
+          "command": "go test ./internal/command/agentroute -run '^TestBuildEnvelopeCapsBlockersAndCountsOmittedDetails$'"
+        },
+        {
+          "selector": "TestBuildEnvelopeCompactsOversizedArgvWithoutLosingActionIdentity",
+          "command": "go test ./internal/command/agentroute -run '^TestBuildEnvelopeCompactsOversizedArgvWithoutLosingActionIdentity$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-026",
+      "scenarioId": "proofkit.spec-proof-core.agent-route-flag-pre-read-admission",
+      "witnessId": "proofkit.agent-route.flag-pre-read-admission-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/app_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestAgentRouteModeAdmissionPrecedesInputRead",
+          "command": "go test ./internal/app -run '^TestAgentRouteModeAdmissionPrecedesInputRead$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-026",
+      "scenarioId": "proofkit.spec-proof-core.agent-route-materialized-ref-admission",
+      "witnessId": "proofkit.agent-route.materialized-ref-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/agentroute/agentroute_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestBuildRejectsStdinTransportSentinelAsArtifactReference",
+          "command": "go test ./internal/command/agentroute -run '^TestBuildRejectsStdinTransportSentinelAsArtifactReference$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-026",
+      "scenarioId": "proofkit.spec-proof-core.agent-route-report-contract-closure",
+      "witnessId": "proofkit.agent-route.report-contract-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/cli_contract_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestAgentRouteOutputContractPreservesReportSemantics",
+          "command": "go test ./internal/app -run '^TestAgentRouteOutputContractPreservesReportSemantics$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-026",
+      "scenarioId": "proofkit.spec-proof-core.agent-route-brief-version-edge",
+      "witnessId": "proofkit.agent-route-brief.version-edge-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/agent_route_version_edge_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestAgentRouteVersionEdgeClosesBriefDefaultMigration",
+          "command": "go test ./internal/app -run '^TestAgentRouteVersionEdgeClosesBriefDefaultMigration$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
     {
       "requirementId": "REQ-PROOFKIT-SPEC-023",
       "scenarioId": "proofkit.spec-proof-core.requirement-traceability-topology-closure",