@research-engineering/agentic-proofkit 0.5.1 → 0.7.0

package/ADOPTION.md

@@ -151,7 +151,23 @@ check. Durable truth still starts only after the consumer commits and admits
 ## First Adoption Loop
 
 Proofkit can reduce initial adoption glue, but it must not turn observation into
-truth. The first loop is:
+truth. Start with one explicit trust intent:
+
+```bash
+npm exec --offline -- agentic-proofkit adopt plan --mode fresh --repo-root .
+npm exec --offline -- agentic-proofkit adopt plan --mode code-baseline --repo-root .
+npm exec --offline -- agentic-proofkit adopt plan --mode audit-from-code --repo-root .
+```
+
+The command validates its arguments before filesystem access, scans only a
+fixed catalog of recognized files at the selected root, and emits a
+candidate-only task sequence plus a compact reference to the native-evidence
+guidance owner. It does not parse those files, infer a stack, inspect arbitrary
+source code, generate product requirements, write files, or run witnesses.
+An optional `--stack <preset-id>` records a caller-selected suggestion and
+cannot alter source trust or task semantics.
+
+Continue the first loop as follows:
 
 ```text
 caller-owned capability or test observations

package/README.md

@@ -50,7 +50,7 @@ CLI, not as a Python SDK. Python projects should still treat CLI/JSON records,
 exit codes, and package metadata as the public contract.
 
 <!-- proofkit:platform-python:start -->
-Supported binary targets are macOS 12 or later on arm64 or x64.
+Supported binary targets are macOS 13 or later on arm64 or x64.
 Linux manylinux 2.17 or later is supported on arm64 or x64. Windows is unsupported. The Python
 runner requires Python 3.9 or later and wraps the same Go CLI; it is not a
 Python SDK.
@@ -144,19 +144,22 @@ truth unless the consumer explicitly admits them.
 
 ### Invariant Authoring Loop
 
-For a repository with no specification, Proofkit can guide an agent through two
-different starting modes:
+For a repository with no specification, Proofkit can guide an agent through
+three explicit starting modes:
 
 ```mermaid
 flowchart TB
     Start["Code, docs, tests, issues, and maintainer intent"] --> Mode["Choose trust mode"]
+    Mode --> Fresh["Fresh authoring mode"]
     Mode --> Baseline["Code baseline mode"]
     Mode --> Audit["Code audit mode"]
+    Fresh --> Contract["Owner-authored product contract"]
     Baseline --> Observations["Caller-owned capability observations"]
     Audit --> Observations
     Observations --> Seeds["Candidate invariants and requirement seeds"]
     Seeds --> Review["Owner review and promotion"]
     Review --> Specs["Repo-owned requirements.v1.json"]
+    Contract --> Specs
     Specs --> Obligations["Proof obligations"]
     Obligations --> Evidence["Proof bindings and test inventory"]
     Evidence --> Admission["Proofkit admission and coverage"]
@@ -164,10 +167,11 @@ flowchart TB
 
 | Mode | Use when | Result |
 |---|---|---|
+| Fresh authoring | No existing code or specification is accepted as product truth | Owner-authored behavior statements that remain candidates until admitted as repository requirements |
 | Code baseline | Current behavior is accepted as the starting contract | Candidate requirements and bindings that preserve current behavior until owners review them |
 | Code audit | Current behavior may be wrong or incomplete | Untrusted observations and questions that must be promoted by a repository owner before becoming requirements |
 
-In both modes, generated records remain candidates until the consuming
+In all three modes, generated records remain candidates until the consuming
 repository admits them as repo-owned requirements, proof bindings, and witness
 plans. Proofkit can structure and validate candidate packets, but it does not
 extract complete behavior from arbitrary source code, invent product policy, or
@@ -179,7 +183,8 @@ Use the CLI help route before reading source:
 
 ```bash
 npm exec --offline -- agentic-proofkit help
-npm exec --offline -- agentic-proofkit init
+npm exec --offline -- agentic-proofkit adopt plan --mode fresh --repo-root .
+npm exec --offline -- agentic-proofkit help adopt plan
 npm exec --offline -- agentic-proofkit help repo-profile-admission
 npm exec --offline -- agentic-proofkit repo-profile-admission --help
 ```
@@ -189,12 +194,18 @@ does not read stdin. The full machine-readable command inventory remains
 `proofkit/cli-contract.v2.json`; the human route map is
 `docs/proofkit-contract-map.md`.
 
+`adopt plan` is the read-only front door. It inventories only a fixed catalog
+of recognized files at the explicit repository root, validates all arguments
+before filesystem access, and returns candidate-authoring tasks. It does not
+infer a stack, parse arbitrary source semantics, generate requirements, write
+files, or execute evidence. `--stack` is an optional caller-selected hint and
+cannot change the selected trust mode.
+
 | Repository state | Minimal first route | Stop condition |
 |---|---|---|
-| Unknown starting point | `init` | Stop before reading repository files, writing files, or treating route guidance as proof |
-| Fresh repository with no specs and no extracted observations | `init --preset fresh`, then `scaffold-project-structure` or `gradual-adoption-bootstrap` | Stop before writing files or inventing requirement meaning |
-| Current code is trusted as the initial contract | `capability-map-admission` with `trustMode: "code_baseline"` | Stop before treating generated seeds as admitted requirements |
-| Current code must be audited before it becomes a contract | `capability-map-admission` with `trustMode: "audit_from_code"` | Stop at owner questions and candidate-only records |
+| Fresh repository with no specification | `adopt plan --mode fresh --repo-root .` | Stop before writing files or inventing requirement meaning |
+| Current code is intentionally accepted as the initial baseline | `adopt plan --mode code-baseline --repo-root .` | The flag is a caller declaration, not evidence that the code is correct; stop before promoting candidate observations |
+| Current code must be audited before it becomes a contract | `adopt plan --mode audit-from-code --repo-root .` | Stop at explicit observations, owner questions, and candidate-only records |
 | Legacy repository has local proof infrastructure | `migration-parity-admission`, then `migration-plan` | Stop before deleting local proof owners without parity evidence |
 | A change set needs bounded checks | `changed-path-set`, optional `impact`, then `selective-gate-plan` and `selective-gate-evidence` | Stop on unknown scope, missing routes, or stale receipts |
 | An agent needs only one specification subtree | `requirement-context-compose --repo-root . --input context-catalog.json`, then `requirement-context-slice` | Stop before treating a bounded slice as complete repository truth |

package/docs/proofkit-contract-map.md

@@ -40,7 +40,7 @@ owner boundaries. It is not a second command-family inventory.
 | Family | Main commands | Caller provides | Proofkit owns | Consumer owns | Output authority |
 |---|---|---|---|---|---|
 | Agent workflow planning | `change-workflow-plan`, `native-evidence-guidance` | explicit checkpoint, completed stage ids, bounded context refs, governing authority ref, and required context ref ids | optional built-in `proofkit.reviewed-change.v1` checkpoint relation, reference-closed next-stage context, deterministic agent prompts, bounded text/JSON/envelope projections, and repository-neutral native-evidence guidance with closed applicability classes | custom workflow topology, repository state discovery, stage execution, native witness semantics, evidence collection, review conclusions, merge, release, deployment, and rollout authority | next-action plan, terminal workflow report, bounded agent envelope, or guidance catalog |
-| Adoption and scaffolding | `init`, `adoption-contract-envelope`, `adoption-workflow-plan`, `adoption-checklist`, `adoption-doctor`, `gradual-adoption`, `gradual-adoption-bootstrap`, `gradual-adoption-guidance`, `capability-map-admission`, `pilot-admission`, `scaffold-profile-plan`, `scaffold-project-structure`, `stack-preset` | adoption intent, aggregate adoption contract envelope, checklist facts, target paths, owner routes, caller-extracted stale authority vocabulary facts, explicit pre-spec capability observations, pilot records, stack preset id, optional init preset id | dry-run route selection, aggregate contract-envelope admission, deterministic starter plans, checklist/report admission, bounded guidance envelopes, dry-run manifests, pre-spec trust-mode admission, adoption gap and stale-authority classification, pilot shape admission | final files, final requirements, rollout policy, text extraction from files, code observation extraction, pilot truth | selected child output, plan, report, seed packet, or agent envelope |
+| Adoption and scaffolding | `adopt plan`, `repository-inventory`, `adoption-contract-envelope`, `adoption-workflow-plan`, `adoption-checklist`, `adoption-doctor`, `gradual-adoption`, `gradual-adoption-bootstrap`, `gradual-adoption-guidance`, `capability-map-admission`, `pilot-admission`, `scaffold-profile-plan`, `scaffold-project-structure`, `stack-preset` | explicit repository root, explicit fresh/code-baseline/audit-from-code intent, optional stack hint, aggregate adoption contract envelope, checklist facts, target paths, owner routes, caller-extracted stale authority vocabulary facts, explicit pre-spec capability observations, and pilot records | bounded fixed-catalog root inventory, candidate-only front-door tasks, aggregate contract-envelope admission, deterministic starter plans, checklist/report admission, bounded guidance envelopes, dry-run manifests, pre-spec trust-mode admission, adoption gap and stale-authority classification, and pilot shape admission | stack selection, arbitrary source inspection, final files, final requirements, rollout policy, text extraction, code observation extraction, and pilot truth | inventory, candidate-only plan, selected child output, report, seed packet, or agent envelope |
 | Requirement source | `capability-map-admission`, `requirement-authoring-plan`, `requirement-source-admission`, `requirement-source-transition`, `spec-overview-claims`, `requirement-spec-tree`, `requirement-spec-tree-view`, `requirement-source-view`, `requirement-browser-server` | `requirements.v1.json`, caller-owned capability maps, caller-owned authoring facts, overview claim extraction, explicit spec hierarchy, view options | candidate seed admission, candidate-only authoring packets, source-shape admission, lifecycle checks, explicit tree topology/source-ref admission, shared safe renderer fragments, presentation-only views | requirement meaning, extraction completeness, Markdown extraction completeness, hierarchy ownership, proof adequacy, file materialization | capability map report, authoring packet, source report, spec-tree report, rendered view, or browser presentation |
 | Requirement proof binding | `requirement-bindings`, `binding-partition`, `proof-slice`, `evidence-graph`, `requirement-proof-resolver`, `requirement-proof-source-set`, `requirement-proof-view`, `spec-proof-bundle-admission` | requirement records, bindings, witness commands, source-set facts, receipt reports, partition policy | graph validation, binding partition projection, compact slices, declaration-only compact route projection with full binding identity and role-qualified witness routes, resolver projection, bundle linkage checks | selector resolution, oracle quality, witness execution, mutation adequacy, finding completeness, proof freshness, trust, assurance, merge policy | proof report, partition report, slice, declaration lookup graph, or view |
 | Test inventory and coverage | `test-evidence-inventory`, `test-evidence-inventory --projection discovery-draft`, `test-evidence-inventory --normalized-inventory`, `requirement-coverage-input-compose`, `requirement-coverage-view`, `requirement-browser-server --view coverage` | caller-owned direct or source-set test inventory, caller-owned explicit test discovery facts, declared quality findings, requirement source, proof binding or compact proof contract, coverage universe, optional owner-invariant registry, aggregate coverage compose input | strict inventory/source-set admission, candidate-only discovery draft projection, fail-closed normalized inventory projection, deterministic coverage-view input composition from explicit facts, missing declared assertion-signal and declared-quality classification, bounded agent action guidance, requirement/test/command/owner-invariant joins, nonsemantic command-evidence classification, stable coverage failure/warning classifications, presentation-only coverage view | inventory completeness, oracle quality, test quality, test discovery extraction, native test execution, receipt freshness, producer trust, merge policy | candidate inventory guidance, inventory report, normalized inventory data product, coverage-view input, coverage view, or browser presentation |
@@ -57,7 +57,7 @@ must use the public `agentic-proofkit` CLI routes declared in
 `proofkit/cli-contract.v2.json`.
 | Repository structure | `repo-profile-admission`, `workspace-manifest-facts`, `workspace-registry`, `workspace-changed-package-plan`, `workspace-shard-partition`, `typescript-public-api-surfaces`, `text-policy`, `secret-scan`, `package-runtime-dependency-admission` | explicit repo/profile facts, caller-owned manifest records, caller-owned roots, caller-owned text file inventories, explicit TypeScript package-manifest and per-condition source paths, optional `environmentClassPolicies` tuples | structural admission, manifest-to-workspace fact projection, workspace graph projections, bounded TypeScript package public API checks over referenced files, text policy admission, explicit-inventory secret-like text detection, shard plans | repository freshness, git/file discovery, compiler output provenance, command policy, package manager truth, provider secret scanning | structural, fact, policy, or planning report |
 | Custom and generated artifacts | `custom-rule-boundary`, `document-lifecycle-boundary`, `rendered-artifact-freshness`, `conformance-profile`, `json-report-cli-adapter-source`, `witness-plan`, `witness-scheduler-plan` | custom rule metadata, document lifecycle records, artifact digests, profile manifests, command metadata, adapter language | boundary checks, generated-view freshness shape, deterministic adapter source generation, scheduler metadata checks | rule execution, document meaning, cache contents, CI scheduling, committed generated-source freshness | boundary report, generated source artifact, or scheduler report |
-| CLI metadata | `help` | optional command name or help flag | built-in command catalog and help text routing | command selection, semantic proof, freshness, merge policy | text help only |
+| CLI metadata | `help` | optional full public command route or help flag | built-in command catalog and help text routing | command selection, semantic proof, freshness, merge policy | text help only |
 
 ## Migrating Repository Route
 
@@ -80,7 +80,7 @@ Route ambiguous modernization work through the smallest matching family:
 |---|---|---|
 | No specs exist and current code should be frozen as the first baseline. | `capability-map-admission` with `trustMode: "code_baseline"` | It admits caller-owned capability observations and emits bounded candidate requirement/proof-binding seeds only when scenarios have candidate ids and executable anchors. |
 | No specs exist and current code is not trusted. | `capability-map-admission` with `trustMode: "audit_from_code"` | It treats code observations as hypotheses, keeps missing anchors as owner actions, and prevents code from becoming stable requirement truth without owner review. |
-| Where should adoption start? | `adoption-workflow-plan` or `scaffold-project-structure`; use `adoption-contract-envelope` when one caller-owned aggregate adoption file already exists. | They route scenario steps and first-module starter records without scanning the repository; the aggregate route removes consumer-local root-key projection scripts without owning rollout policy. |
+| Where should adoption start? | `adopt plan --mode <mode> --repo-root <path>`, where mode is `fresh`, `code-baseline`, or `audit-from-code`; add `--stack <preset-id>` only when the caller already selected that hint. | It validates intent before a bounded fixed-catalog root scan and emits candidate-authoring tasks. It does not infer stack identity, inspect arbitrary source semantics, write files, or promote candidates. |
 | Is a candidate module ready for gradual enforcement? | `gradual-adoption-guidance` | It reports missing source, binding, witness, blocked-precondition, and advisory candidate-boundary facts by adoption mode. |
 | What still blocks an imperfect repository from enforcement? | `adoption-doctor` | It classifies caller-provided owner routes, candidate boundaries, child reports, blocked preconditions, and stale current authority vocabulary facts without scanning repository state or owning semantic boundary decisions. |
 | Does current documentation still name a retired proof package or proof owner? | `adoption-doctor --agent-envelope` with caller-extracted `staleAuthority` facts | It fails current authority surfaces, admits only explicitly scoped historical vocabulary, and emits bounded repair actions without substring-scanning files itself. |
@@ -94,11 +94,17 @@ Route ambiguous modernization work through the smallest matching family:
 
 ## Agent Decision Procedure
 
-Agents should use `agent-route` for executable routing and
-`agent-route --agent-envelope` when a bounded work packet is needed. The command
-returns deterministic JSON from explicit caller-owned facts; the envelope is an
-opt-in derived projection over the same report. This map explains the route
-families without becoming an execution, freshness, or merge decision.
+Agents should use `agent-route` for the complete deterministic route report and
+`agent-route --agent-envelope` for the default bounded brief packet. Explicit
+`--agent-envelope-mode brief` is byte-identical to the bare envelope form;
+`--agent-envelope-mode full` preserves the complete generic agent envelope for
+debugging or demand-loaded detail. Every brief binds its source report ID and
+stable digest and admitted launcher profile in one top-level `detailAccess`
+record, so callers retain the original admitted input and launcher context and
+recompute report or full detail instead of adding a detail reference to every
+item. All three forms are derived from explicit caller-owned facts. This map
+explains route families without becoming an
+execution, freshness, or merge decision.
 The exact route input vocabulary is machine-readable in
 `proofkit/cli-contract.v2.json` under `agent-route.inputContract`; the Go
 admission implementation owns nested and semantic behavior, while the shipped
@@ -110,7 +116,7 @@ Formal rule:
 goal plus caller-owned state
   -> smallest matching command family
   -> explicit required input
-  -> deterministic report or bounded envelope
+  -> deterministic report, bounded brief, or explicit full envelope
   -> caller-owned execution, proof freshness, and merge decision
 ```
 
@@ -122,10 +128,10 @@ Semantic context routes are `requirement-context-compose`,
 
 | State or goal | Next Proofkit route | Stop or escalation condition |
 |---|---|---|
-| The agent does not know where to start. | `init`, or `init --preset` with `fresh`, `code-baseline`, `code-audit`, `legacy`, or `change-set` | Treat output as dry-run route guidance only. Stop before scanning, writing files, or making requirements authoritative. |
+| The agent does not know where to start. | `adopt plan --mode <mode> --repo-root <caller-selected-root>`, where mode is `fresh`, `code-baseline`, or `audit-from-code` | Choose the trust intent explicitly. Treat the fixed-catalog inventory and tasks as a read-only candidate plan; stop before arbitrary source inspection, writing files, or making requirements authoritative. |
 | An agent needs a bounded, deterministic stage transition for an engineering change. | `change-workflow-plan` selects the optional built-in `proofkit.reviewed-change.v1` profile; use `--agent-envelope` for the compact work packet and `native-evidence-guidance` when the consuming repository has not yet materialized repository-specific evidence instructions. | Supply only explicit current checkpoint, completed stages, and admitted context references. Apply conditional guidance slots only when their applicability class matches a declared consumer mechanism. Stop before treating the profile, plan, or guidance as repository policy or as proof that a stage ran, evidence exists, review passed, or merge/release is authorized. |
 | No admitted spec/profile exists and the caller has explicit capability observations. | `capability-map-admission`; use `trustMode: "code_baseline"` only when maintainers intentionally freeze current code, otherwise use `trustMode: "audit_from_code"`. | Stop before treating seeds as stable requirements. The consumer owns observation extraction, materialization, requirement meaning, and proof adequacy. |
-| No admitted spec/profile exists and no capability observations exist. | `scaffold-project-structure`, `adoption-workflow-plan`, or `stack-preset` | Stop before writing files; the consumer owns materialization, overwrite policy, and final requirement text. |
+| No admitted spec/profile exists and no capability observations exist. | Start with `adopt plan --mode fresh --repo-root <caller-selected-root>`; use `scaffold-project-structure`, `adoption-workflow-plan`, or `stack-preset` only as later specialist routes when an owner has selected them. | Treat front-door tasks as candidate-only. Stop before writing files; the consumer owns materialization, overwrite policy, and final requirement text. |
 | Candidate boundary is uncertain. | `adoption-doctor` or `gradual-adoption-guidance --agent-envelope` | Escalate to owner review when the boundary is advisory, ambiguous, or missing native witnesses. |
 | Temporary external design, implementation-plan, PR, code, or test observations may contain durable requirements. | `requirement-authoring-plan` | Treat output as candidate-only; stop before writing `requirements.v1.json`, retaining temporary documents, or claiming requirement meaning. |
 | Requirement records exist. | `requirement-source-admission`; use `requirement-source-transition` for lifecycle changes. | Escalate when blocking requirements lack proof routes or lifecycle replacement ids are incomplete. |
@@ -154,14 +160,19 @@ Semantic context routes are `requirement-context-compose`,
 2. Start from this map when a human or agent only needs the correct command
    family.
 3. Use `agent-route` when a coding agent needs a deterministic next-command
-   packet from explicit current state. Use `agent-route --agent-envelope` when
-   the agent needs compact context refs, blockers, command refs, and non-claims
-   instead of a plain route report. Treat `blocked_*` states as stop signals,
-   not as permission to guess missing inputs. `knownChangedPaths` are
+   report from explicit current state. Use `agent-route --agent-envelope` when
+   the agent needs exactly one next action or terminal state, bounded blockers,
+   caller-owned context refs, exact omission counts, and uniquely resolvable
+   shipped boundary-policy requirement refs instead of the full route report.
+   Resolve further detail with the packet's exact output-argument suffixes and
+   retained original input and launcher context only after checking the brief's source digest and launcher profile; request
+   `--agent-envelope-mode full` only when the generic envelope is actually
+   needed. Treat `blocked_*` states as stop signals, not as permission to guess
+   missing inputs. `knownChangedPaths` are
    diagnostic-only until the caller supplies a `changed_path_set`; browser
    server startup requires explicit `browserMode: "serve_local_view"`.
-4. Use agent-envelope output only when a coding agent needs bounded context;
-   do not expand whole proof graphs into chat.
+4. Prefer the brief packet for agent context; do not expand full route reports,
+   full envelopes, or proof graphs into chat without a specific detail need.
 5. Treat generated views and rendered HTML as presentation only. They never
    replace the structured source record.
 6. Escalate to the consuming repository's owner policy whenever Proofkit reports

package/docs/specs/proofkit-agent-workflow/overview.md

@@ -20,11 +20,12 @@ The public capability is deliberately small:
 3. Existing descriptors, dispatch, command families, root-shape CLI contracts,
    agent envelopes, and package gates provide public-surface closure.
 
-Neither command scans a repository. Both command cores are stateless pure
-projections with no filesystem, Git, process, environment, clock, random,
-network, container, or provider dependency. No setup facade, agent-route extension,
-external prompt resource, persisted experiment state, or second source codec is
-introduced.
+Neither workflow command scans a repository. Both command cores are stateless
+pure projections with no filesystem, Git, process, environment, clock, random,
+network, container, or provider dependency. Neither workflow command adds a
+setup facade, hidden route policy, external prompt resource, persisted
+experiment state, or second source codec. Agent-route brief and full
+projections remain independently owned by the spec-proof-core package.
 
 ## Requirements
 
@@ -48,7 +49,7 @@ introduced.
   limits.
 - `REQ-PROOFKIT-WORKFLOW-006`: only existing launcher and presentation
   capabilities outside explicit input, with no ambient repository authority,
-  setup facade, hidden policy, or agent-route extension.
+  setup facade, hidden policy, or ownership of agent-route projections.
 - `REQ-PROOFKIT-WORKFLOW-007`: pure deterministic repository-neutral
   native-evidence guidance from one versioned typed table with five closed
   applicability classes, explicit absent-channel decisions, and finite

package/docs/specs/proofkit-agent-workflow/requirements.v1.json

@@ -73,7 +73,7 @@
     {
       "requirementId": "REQ-PROOFKIT-WORKFLOW-006",
       "ownerId": "proofkit.agent-workflow",
-      "invariant": "After existing bounded CLI transport, immutable installed-launcher profile admission, and immutable presentation-capability capture, the semantic planner accepts no repository root, caller prompt, caller-selected bound, command, environment, receipt body, or external authority field and has no filesystem, Git, process, environment, clock, random, network, container, or provider dependency; the CLI reads only the explicit input transport, the existing launcher-profile and optional Python-executable transport capabilities, and startup TTY/NO_COLOR presence needed by requested presentation, and the capability adds no setup facade, ambient scan, hidden repository policy, consumer-specific route, or agent-route extension.",
+      "invariant": "After existing bounded CLI transport, immutable installed-launcher profile admission, and immutable presentation-capability capture, the semantic planner accepts no repository root, caller prompt, caller-selected bound, command, environment, receipt body, or external authority field and has no filesystem, Git, process, environment, clock, random, network, container, or provider dependency; the CLI reads only the explicit input transport, the existing launcher-profile and optional Python-executable transport capabilities, and startup TTY/NO_COLOR presence needed by requested presentation, and this two-command workflow capability adds no setup facade, ambient scan, hidden repository policy, consumer-specific route, or ownership of the independently specified agent-route projections.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],

package/docs/specs/proofkit-package-boundary/overview.md

@@ -39,10 +39,11 @@ denial, and package artifact behavior only.
   strict-character-reference-encoded broad caller-supplied phrase suppressors
   that can hide readiness overclaims.
 - `REQ-PROOFKIT-PACKAGE-003`: the root package remains installable and
-  executable by an outside consumer through the exact offline onboarding trace
-  on the current native platform; every generated preset command retains the
-  offline npm resolver and one exact emitted continuation is re-executed
-  without claiming registry publication.
+  executable by an outside consumer; packed launcher and platform-binary bytes
+  match source-built artifacts, npm offline transport proves package resolution
+  plus one multi-token route, and direct execution under the exact admitted npm
+  launcher profile proves exhaustive family, leaf, preset, continuation, and README
+  onboarding closure without claiming registry publication.
 - `REQ-PROOFKIT-PACKAGE-004`: CI package-gate receipts used as merge evidence
   are admitted through a declared producer policy and proof-receipt shape
   validator instead of current-build output alone, and each fixed subprocess

package/docs/specs/proofkit-package-boundary/requirements.v1.json

@@ -62,7 +62,7 @@
     {
       "requirementId": "REQ-PROOFKIT-PACKAGE-003",
       "ownerId": "proofkit.package-boundary",
-      "invariant": "The exact local root-package tarball remains installable and executable by an outside consumer on the current native platform through npm exec --offline, with a continuous root-help to family to stack-preset to every exact generated preset continuation and first-valid-input onboarding trace, including successful re-execution of one emitted self-continuation without network fallback, without claiming registry publication.",
+      "invariant": "The exact local root-package tarball remains installable and executable by an outside consumer on the current native platform. The proof opens installed package resources through one bounded package-root-confined non-symlink boundary, byte-binds the installed launcher, selected platform binary, README, and complete CLI contract to their exact packed owner bytes, admits that contract before interpreting routes or presets, verifies npm exec --offline resolution through root help and one contract-owned multi-token help route, then uses the exact admitted npm launcher profile to prove exhaustive root-help to family to leaf-help closure, stack-preset vocabulary, every generated preset continuation, one re-executed self-continuation, and the first valid README input without network fallback or a registry-publication claim.",
       "claimLevel": "blocking",
       "riskClass": "medium",
       "proofBindingRefs": [
@@ -143,7 +143,7 @@
     {
       "requirementId": "REQ-PROOFKIT-PACKAGE-006",
       "ownerId": "proofkit.package-boundary",
-      "invariant": "Python/uv distribution is a platform wheel wrapper over the same Go CLI, with wheel-safe package metadata, wheel tags, embedded binary identity, exact wheel-set version, uniqueness, presence, and SHA closure, local install smoke proof, POSIX exec process-identity and signal preservation, generated display and argv routes bound to the absolute active interpreter plus -m agentic_proofkit, successful direct-argv re-execution of an exact emitted self-continuation, the complete root-help to family-help to leaf-help chain, and an exact emitted agent-route argv with npm absent from PATH, and a marker-bounded README projection of the owned Python and platform matrix with explicit non-claims until PyPI publication.",
+      "invariant": "Python/uv distribution is a platform wheel wrapper over the same Go CLI, with wheel-safe package metadata, wheel tags, embedded binary identity, exact wheel-set version, uniqueness, presence, and SHA closure; the local consumer proof installs through an isolated offline no-dependency pip invocation, opens installed resources through one bounded package-root-confined non-symlink boundary, byte-binds and admits the exact embedded CLI contract plus executable before and after route execution, preserves POSIX exec process identity and signals, binds generated display and argv routes to the absolute active interpreter plus -m agentic_proofkit, re-executes one exact emitted self-continuation, proves the complete root-help to family-help to leaf-help chain and one exact emitted agent-route argv with npm absent from PATH, and verifies a marker-bounded README projection of the owned Python and platform matrix with explicit non-claims until PyPI publication.",
       "claimLevel": "blocking",
       "riskClass": "medium",
       "proofBindingRefs": [

package/docs/specs/proofkit-spec-proof-core/overview.md

@@ -116,13 +116,15 @@ execution receipts, and merge policy.
   caller-provided previous and next source snapshots so lifecycle changes are
   monotonic, evidence-backed, package-boundary-stable, and repository-neutral.
 - `REQ-PROOFKIT-SPEC-017`: capability map admission validates caller-owned
-  pre-spec observations under explicit code-baseline or code-audit trust modes
+  pre-spec observations under explicit code-baseline or audit-from-code trust modes
   and emits only bounded candidate requirements, bindings, or owner guidance.
 - `REQ-PROOFKIT-SPEC-018`: an authored command-family catalog covers every
   public CLI command exactly once, deterministically generates the private
-  runtime navigation projection, adds token-bounded root discovery, and projects
-  exact stack-preset IDs into help and diagnostics while preserving existing
-  help invocation forms, process channels, no-input behavior, and leaf dispatch;
+  runtime navigation projection, while one reusable bounded token grammar owns
+  native routing, the public machine contract, generated adapters, and installed
+  npm and wheel route admission. It adds root discovery and projects exact
+  stack-preset IDs into help and diagnostics while preserving existing help
+  invocation forms, process channels, no-input behavior, and leaf dispatch;
   descriptor and help truth remains owned by `REQ-PROOFKIT-QUALITY-004`.
 - `REQ-PROOFKIT-SPEC-019`: explicit catalogs compose content-bound semantic
   schema-v2 context snapshots with exact expected-digest coverage through
@@ -168,6 +170,26 @@ execution receipts, and merge policy.
   selected owner boundary without migrating current sources, exposing a new
   public CLI, proving open-world absence of undeclared equivalent parsers, or
   claiming that no future owner-approved grammar can be added.
+- `REQ-PROOFKIT-SPEC-026`: agent-route v3 emits a deterministic 3072-byte
+  brief packet by default with one canonical action or typed blockers, exact
+  omission accounting, stable source-report identity, one top-level detail
+  access record, and explicit full-envelope retrieval without repeating policy
+  prose or promoting route guidance to authority.
+- `REQ-PROOFKIT-SPEC-027`: the read-only `adopt plan` front door validates its
+  explicit trust intent, optional stack hint, repository root, and platform
+  before access, then composes only owner-admitted inventory and plan records.
+- `REQ-PROOFKIT-SPEC-028`: repository inventory confines a fixed root catalog,
+  rejects unsafe file identities, enforces exact resource bounds, discards
+  unknown names, and emits one deterministic owner-re-admissible record.
+- `REQ-PROOFKIT-SPEC-029`: adoption planning keeps stack observations separate
+  from trust, emits candidate-authoring tasks plus a digest-bound child guidance
+  reference, and never promotes inferred requirements or proof bindings.
+- `REQ-PROOFKIT-SPEC-030`: adoption JSON and bounded text are deterministic
+  projections of one admitted plan, preserve authority non-claims, and apply
+  terminal styling only through an explicit presentation capability.
+- `REQ-PROOFKIT-SPEC-031`: the adoption version edge binds exact ABI, command,
+  contract, generated-artifact, and release-change inventories while proving
+  that the retired `init` route has no remaining public owner.
 
 ## Non-Claims
 

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -467,7 +467,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-018",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "Command family navigation projects the complete public CLI command inventory from one authored family catalog into a deterministic private runtime projection, preserves root and per-command help invocation forms, stdout and stderr channel discipline, no-input behavior, and leaf dispatch, exposes one token-bounded root discovery route, and projects the exact stack-preset vocabulary from the authored CLI contract into generated runtime IDs, direct help, and invalid-ID diagnostics; it admits only opt-in family help forms, rejects missing, duplicated, oversized, unsorted, or reserved-operand-colliding families, and does not infer command selection, execute commands through family membership, or create a second command inventory owner.",
+      "invariant": "Command family navigation projects the complete public CLI command inventory from one authored family catalog into a deterministic private runtime projection, preserves root and per-command help invocation forms, stdout and stderr channel discipline, no-input behavior, and leaf dispatch, exposes one root discovery route, and projects the exact stack-preset vocabulary from the authored CLI contract into generated runtime IDs, direct help, and invalid-ID diagnostics. One reusable command-route grammar owner defines canonical token syntax, separator, cardinality, and strict no-prefix ambiguity; the public CLI contract carries its exact machine projection, contract generation rejects drift from the native owner, generated adapters consume that owner, and installed npm and wheel verifiers independently admit the shipped projection before interpreting route-bearing help. Family navigation admits only opt-in help forms, rejects missing, duplicated, oversized, unsorted, or reserved-operand-colliding families, and does not infer command selection, execute commands through family membership, or create a second command inventory owner.",
       "claimLevel": "blocking",
       "riskClass": "medium",
       "proofBindingRefs": [
@@ -581,6 +581,84 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-026",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "Agent-route output contract v3 derives every report, brief packet, and full envelope from one fully admitted immutable route input, one admitted launcher profile, and one command-owned route report: route artifact refs in both available inputs and observed reports identify materialized caller-owned artifacts and never use the stdin transport sentinel; the nested report contract preserves the exact required route-report fields, schemaVersion 3, closed route-family vocabulary, guidance-to-selected-family relation, pre-suppression available-command count, and launcher profile; a bare --agent-envelope and explicit brief mode emit the same deterministic schema-v1 proofkit.agent-route.brief root while explicit full mode preserves the prior generic envelope; a routed brief selects exactly the first canonical nextCommands entry as its sole nextAction, retains its exact command and argv identity when the 3072-byte pretty stable-JSON bound permits, otherwise removes only inline argv and marks argvState detail_required, while every blocked state emits null nextAction; blockers are projected in deterministic unknown-goal, required-input, then sorted non-passed observed-report order, retain at most four typed entries without materializing omitted blocker maps, and report the exact omitted remainder; contextRefs refer to all and only caller-owned artifact operands of the selected command through resolvable source-report JSON pointers; one top-level detailAccess record binds the source report ID, stable digest, and launcher profile, provides exact report and full output-argument suffixes for replay with the original input and launcher context, and no per-item detail reference is added; omissionSummary exactly counts pre-suppression unselected available commands, source-omitted commands, and omitted blockers; fixed uniquely resolvable shipped requirement IDs replace repeated boundary-policy prose; the complete brief is at most 3072 bytes, and unsupported modes, invalid flag values, repeated single-value flags, or a detail mode without --agent-envelope fail before input is read. Reports and envelopes remain derived route guidance and never become requirement, proof, execution, merge, release, rollout, deployment, or readiness authority.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-026"],
+      "nonClaims": ["The 3072-byte packet bound and stable source-report digest do not prove provider token consumption, semantic sufficiency, source freshness, command execution, native witness truth, or policy approval; detail retrieval requires the caller to retain the original admitted input and launcher context."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-027",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "The public read-only adoption front door is routed only as adopt plan, requires one explicit repository root and one explicit fresh, code-baseline, or audit-from-code intent, keeps an optional stack preset orthogonal to source trust, validates every argument and platform support before filesystem access, and composes its result only from an owner-admitted repository inventory and adoption plan without writing files, executing commands, or promoting candidate artifacts.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-027"],
+      "nonClaims": ["The adoption front door does not write files, execute commands or native witnesses, promote candidate artifacts, authenticate freshness, approve merge or release, or establish rollout or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-028",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "The adoption repository-inventory owner scans only a fixed root-file catalog through a confined root handle, fails before filesystem access on platforms without its nonblocking no-follow open boundary, rejects recognized symlink or non-regular substitutions, preflights root cardinality and observed file sizes before content reads, enforces per-file, actual aggregate-read, and output byte bounds, hashes only recognized regular UTF-8 file bytes, discards unrecognized root entry names immediately after bounded classification, and emits one deterministic identity-bound output that re-admits unchanged through the same owner.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-028"],
+      "nonClaims": ["Repository inventory does not inspect arbitrary source semantics, infer repository intent or stack identity, authenticate checkout freshness, or establish code correctness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-029",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "The adoption-plan owner consumes one fully admitted repository inventory, binds deterministic plan and inventory identities, emits only candidate-authoring tasks and one child-owned native-evidence guidance reference whose digest binds the complete current guidance, records code-baseline solely as an explicit caller declaration, keeps every stack hint observational so it cannot change trust or task semantics, and re-admits its output unchanged without synthesizing requirement meaning or proof bindings.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-029"],
+      "nonClaims": ["The adoption plan does not make candidate requirements, contracts, bindings, or tests authoritative and does not authenticate evidence, execute witnesses, or approve a change."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-030",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "Adoption-plan JSON and bounded text are deterministic projections of the same fully admitted typed plan, text preserves every authority non-claim and identity needed to recover the machine record, output and text byte bounds are exact, and terminal styling occurs only when explicitly requested or supported by the caller-provided presentation capability.",
+      "claimLevel": "blocking",
+      "riskClass": "medium",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-030"],
+      "nonClaims": ["The text projection is a human view, not requirement, proof, execution, merge, release, rollout, deployment, or readiness authority."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-031",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "The adoption-front-door public version edge binds the exact previous and current public ABI digests, the exact removal of init, the exact addition of adopt plan and repository-inventory, one explicit selection policy covering every command whose declared input-contract identifier changed while leaving source-bound digest churn to the enclosing ABI digests, the live current input-contract identifier and wire schema of every selected command, every changed generated artifact identity, and the ordered breaking and additive change inventories to one digest-bound release change record; the superseded init route has no active descriptor, dispatcher, CLI contract, command family, or package owner.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-031"],
+      "nonClaims": ["A source-bound version edge does not authenticate Git history, registry publication, provider ingestion, consumer migration, rollout, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ],
   "nonClaims": [

package/docs/specs/proofkit-supply-chain-quality/overview.md

@@ -124,14 +124,15 @@ vulnerability absence, or consumer rollout safety by itself.
   identity tuple with the exact version-tag workflow ref for workflow-published
   npm and PyPI channels and release closeout rejects publication claims without
   that tuple.
-- `REQ-PROOFKIT-QUALITY-019`: installed package smoke proof verifies one
-  continuous offline route through every displayed family and leaf-help
-  transition, binds each installed invocation to its ordered exact bare Usage
-  command token, requires every exact generated preset command to retain the
-  offline npm prefix, re-executes one emitted continuation, reaches the first
-  valid README input, executes one successful JSON report command and one
-  failed-report command, applies bounded expansion-free literal parsing to
-  emitted and README argv, and verifies the current
+- `REQ-PROOFKIT-QUALITY-019`: installed package smoke proof byte-binds the
+  launcher and platform binary, proves npm offline package resolution plus one
+  contract-owned multi-token argv route, then uses the exact admitted npm
+  launcher profile to exhaustively traverse displayed family and leaf-help routes,
+  bind installed invocations to ordered bare Usage tokens, require every exact
+  generated preset command to retain the offline npm prefix, re-execute one
+  emitted continuation, reach the first valid README input, execute one
+  successful JSON report command and one failed-report command, apply bounded
+  expansion-free literal parsing to emitted and README argv, and verify the current
   `json-report-cli-adapter-source` generated source artifact from the
   package-managed binary, including report identity, state, exit code, stdout,
   stderr discipline, generated-source hash, owner-source parity, and exact

package/docs/specs/proofkit-supply-chain-quality/requirements.v1.json

@@ -129,7 +129,7 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-010",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "Coverage metrics report requirement, binding, witness, CLI inventory linkage, descriptor-owned command proof-route candidates, and a separate execution-backed command-oracle ledger. The ledger must bind every candidate commandRef, selector, concrete negative case, falsification event, assertion oracle, expected public outcome, and owner invariant to one immutable exact-file materialized source snapshot; execute exactly the selected active Go tests through canonically ordered package-scoped argv vectors that cannot select same-named non-candidate tests in another package; require unique package start and pass events, unique test run and pass events, owner-reserved cooperative attributes for every candidate, bounded cancellable subprocesses, and immediate process-group termination on output-limit violation; reject missing, unknown, duplicate, skipped, failed, reordered, context-invalid, spoofed-output, cross-test, source-drift, producer-unreachable candidate projections, and correlated identity substitutions; publish and invalidate local diagnostic and metrics artifacts atomically through repository-confined non-symlink destinations; revalidate current candidate, corpus, runtime, and source identities before and after artifact publication; and fail closed when any public command lacks execution-backed evidence. An independently authored versioned counterfeit corpus must bijectively cover every shipped evidence class, required policy axis, record coordinate, and declared substitution axis with positive controls and checked-in exact expected decisions evaluated through the production admission and lifecycle owners rather than a generated expectation registry. Static route metadata, prose, legacy source markers, test existence, and failure-capable syntax remain proof-route candidates and cannot satisfy the execution-backed closure.",
+      "invariant": "Coverage metrics report requirement, binding, witness, CLI inventory linkage, descriptor-owned command proof-route candidates, and a separate execution-backed command-oracle ledger. The ledger must bind every candidate commandRef, selector, concrete negative case, falsification event, assertion oracle, expected public outcome, and owner invariant to one immutable exact-file materialized source snapshot; execute exactly the selected active Go tests through canonically ordered package-scoped argv vectors that cannot select same-named non-candidate tests in another package; require unique package start and pass events, unique test run and pass events, owner-reserved cooperative attributes for every candidate, bounded cancellable subprocesses, and immediate process-group termination on output-limit violation; reject missing, unknown, duplicate, skipped, failed, reordered, context-invalid, spoofed-output, cross-test, source-drift, producer-unreachable candidate projections, and correlated identity substitutions; publish and invalidate local diagnostic and metrics artifacts atomically through repository-confined non-symlink destinations; on supported release platforms, open retained input artifacts descriptor-first through a nonblocking no-follow boundary before type, identity, and exact byte-limit checks so named pipes, symlinks, path substitution, and post-read mutation cannot block or escape, and fail closed instead of using a weaker file-open path elsewhere; revalidate current candidate, corpus, runtime, and source identities before and after artifact publication; and fail closed when any public command lacks execution-backed evidence. An independently authored versioned counterfeit corpus must bijectively cover every shipped evidence class, required policy axis, record coordinate, and declared substitution axis with positive controls and checked-in exact expected decisions evaluated through the production admission and lifecycle owners rather than a generated expectation registry. Static route metadata, prose, legacy source markers, test existence, and failure-capable syntax remain proof-route candidates and cannot satisfy the execution-backed closure.",
       "claimLevel": "blocking",
       "riskClass": "medium",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
@@ -246,7 +246,7 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-019",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "Installed package smoke proof builds the current product, installs the exact local tarball, and verifies a continuous npm exec --offline route from root help through every displayed family and leaf-help transition, with each installed invocation exactly bound to its ordered bare Usage command token; it then verifies exact stack-preset vocabulary, requires every exact generated preset command string to retain the offline npm prefix, re-executes one emitted self-continuation, and continues to exactly one marker-bounded README command and JSON first input, with every emitted or README argv admitted through bounded expansion-free literal shell-word semantics before direct execution. It also verifies that the package-managed binary can process explicit JSON input for one successful report command and one failed-report command and emit the current json-report-cli-adapter-source artifact with source bytes equal to the generator owner source, preserving report kind, report id, state, explicit input counts, exit code, stdout JSON, generated-source hash, and stderr channel discipline without admitting unlisted consumer working-directory files.",
+      "invariant": "Installed package smoke proof builds the current product, installs the exact local tarball, byte-compares the packed launcher and platform binary with their source-built artifacts, proves npm exec --offline package resolution at root help, and proves ordered multi-token argv forwarding through one contract-owned multi-token help route. It then executes the installed platform binary under the exact admitted npm launcher profile to verify every displayed family and leaf-help transition, with each installed invocation bound to its ordered bare Usage command token; verifies exact stack-preset vocabulary; requires every exact generated preset command string to retain the offline npm prefix; re-executes one emitted self-continuation; and continues to exactly one marker-bounded README command and JSON first input, with every emitted or README argv admitted through bounded expansion-free literal shell-word semantics before execution. It also verifies that the package-managed binary can process explicit JSON input for one successful report command and one failed-report command and emit the current json-report-cli-adapter-source artifact with source bytes equal to the generator owner source, preserving report kind, report id, state, explicit input counts, exit code, stdout JSON, generated-source hash, and stderr channel discipline without admitting unlisted consumer working-directory files.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
@@ -298,7 +298,7 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-023",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "Every npm platform-binary tar entry and every Python wheel independently binds its embedded executable bytes to the same release-platform binary, and release metadata generation admits every final npm tarball, wheel, and SBOM exactly once into one bounded regular non-symlink immutable snapshot, derives npm pack SHA-1 and SRI claims, final carrier decoding, direct chunked binary equality, wheel and embedded-binary digests, release checksums, and SBOM-subject checksums only from that epoch, requires every npm pack and Python package-set digest claim to equal those decoded bytes, and revalidates every source identity before metadata persistence without relying on a mutable intermediate dist directory or claimed digests; release closeout independently reopens every declared repository-confined npm tarball and wheel through bounded identity-checked non-symlink handles, recomputes npm SHA-1 and SRI plus both wheel and embedded-binary digests, and rejects unsafe or duplicate archive topology before accepting package evidence; both tar and wheel decoders reject duplicate entry names and require exact release-platform closure; the wheel-set verifier independently rejects version drift, duplicate identities, missing files, and SHA drift; each wheel independently decodes Darwin Mach-O bytes so an advertised macOS platform minimum is never lower than the executable minimum, uses Core Metadata 2.4 License-Expression and License-File fields, carries an exact repository LICENSE copy under the wheel licenses directory, and closes every payload entry through RECORD.",
+      "invariant": "Every npm platform-binary tar entry and every Python wheel independently binds its embedded executable bytes to the same release-platform binary, while an independently asserted complete OS/architecture-to-suffix bijection proves that every launcher target selects exactly one owned platform payload. Release metadata generation admits every final npm tarball, wheel, and SBOM exactly once into one bounded regular non-symlink immutable snapshot, derives npm pack SHA-1 and SRI claims, final carrier decoding, direct chunked binary equality, wheel and embedded-binary digests, release checksums, and SBOM-subject checksums only from that epoch, requires every npm pack and Python package-set digest claim to equal those decoded bytes, and revalidates every source identity before metadata persistence without relying on a mutable intermediate dist directory or claimed digests; release closeout independently reopens every declared repository-confined npm tarball and wheel through bounded identity-checked non-symlink handles, recomputes npm SHA-1 and SRI plus both wheel and embedded-binary digests, and rejects unsafe or duplicate archive topology before accepting package evidence; both tar and wheel decoders reject duplicate entry names, preflight bounded archive and entry cardinality plus compressed and uncompressed sizes before decompression, cap every decoded payload, and require exact release-platform closure; the wheel-set verifier independently rejects version drift, duplicate identities, missing files, and SHA drift; each wheel independently decodes Darwin Mach-O bytes so an advertised macOS platform minimum is never lower than the executable minimum, uses Core Metadata 2.4 License-Expression and License-File fields, carries an exact repository LICENSE copy under the wheel licenses directory, and closes every payload entry through RECORD.",
       "claimLevel": "blocking",
       "riskClass": "critical",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
@@ -337,7 +337,7 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-026",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "Every repository-owned stable JSON implementation used by a public or retained-evidence path accepts only Unicode 15.0.0 scalar strings, rejecting malformed UTF-8 byte strings and unpaired UTF-16 surrogates as applicable, emits the same deterministic semantic-preserving JSON escapes for the pinned Cc, Cf, Zl, and Zp range table, preserves ordinary decoded values, and remains byte-compatible with one versioned owner-authored literal range corpus whose Go projection is exhaustively checked against the Unicode 15.0.0 category oracle and whose JavaScript and generated TypeScript projections are exhaustively checked over the scalar domain.",
+      "invariant": "Every repository-owned stable JSON implementation used by a public or retained-evidence path accepts only Unicode 17.0.0 scalar strings, rejecting malformed UTF-8 byte strings and unpaired UTF-16 surrogates as applicable, emits the same deterministic semantic-preserving JSON escapes for the pinned Cc, Cf, Zl, and Zp range table, preserves ordinary decoded values, and remains byte-compatible with one versioned owner-authored literal range corpus whose Go projection is exhaustively checked against the Unicode 17.0.0 category oracle and whose JavaScript and generated TypeScript projections are exhaustively checked over the scalar domain.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
@@ -350,7 +350,7 @@
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-027",
       "ownerId": "proofkit.supply-chain-quality",
-      "invariant": "Every report-visible diagnostic and structural-text sanitizer accepts only Unicode 15.0.0 scalar strings, recognizes one explicit Unicode whitespace alphabet plus the pinned Cc, Cf, Zl, and Zp range table and contiguous or control-split secret-shaped values through one shared taxonomy, replaces any rejected caller-owned value as a whole with one fixed command-owned label without emitting its bytes, code points, prefix, suffix, or caller-controlled replacement text, and bounds admitted diagnostic projection to 512 Unicode scalars; every Go and JavaScript repository tool entrypoint routes dynamic errors through that owner, failed child-process stderr that enters this diagnostic boundary is captured under a fixed byte limit before whole-value sanitization while successful child stderr is not projected, direct child stderr wiring is rejected, and the installed-carrier smoke adapter bounds stdout, stderr, time, and cleanup; on supported Unix hosts, a successful installed-carrier result requires confirmed process-group absence after the command parent is reaped, while cleanup timeout or probe failure is an explicit failed operation rather than a successful terminal result.",
+      "invariant": "Every report-visible diagnostic and structural-text sanitizer accepts only Unicode 17.0.0 scalar strings, recognizes one explicit Unicode whitespace alphabet plus the pinned Cc, Cf, Zl, and Zp range table and contiguous or control-split secret-shaped values through one shared taxonomy, replaces any rejected caller-owned value as a whole with one fixed command-owned label without emitting its bytes, code points, prefix, suffix, or caller-controlled replacement text, and bounds admitted diagnostic projection to 512 Unicode scalars; every Go and JavaScript repository tool entrypoint routes dynamic errors through that owner, failed child-process stderr that enters this diagnostic boundary is captured under a fixed byte limit before whole-value sanitization while successful child stderr is not projected, direct child stderr wiring is rejected, and the installed-carrier smoke adapter bounds stdout, stderr, time, and cleanup; on supported Unix hosts, a successful installed-carrier result requires confirmed process-group absence after the command parent is reaped, while cleanup timeout or probe failure is an explicit failed operation rather than a successful terminal result.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.5.1",
+  "version": "0.7.0",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,
-  "packageManager": "npm@11.18.0",
+  "packageManager": "npm@12.0.2",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"
@@ -74,8 +74,8 @@
     "x64"
   ],
   "devDependencies": {
-    "@playwright/test": "1.62.0",
-    "axe-core": "4.12.1",
+    "@playwright/test": "1.62.1",
+    "axe-core": "4.13.0",
     "typescript": "7.0.2"
   }
 }