@research-engineering/agentic-proofkit 0.8.0 → 0.10.0

package/ADOPTION.md

@@ -196,6 +196,67 @@ the proof binding already contains safe witness command facts and the caller
 provides witness command vocabulary. The projection avoids duplicated command
 identity; native execution and command freshness remain caller-owned.
 
+## Portable Agent Bootstrap
+
+`REQ-PROOFKIT-WORKFLOW-016` through `REQ-PROOFKIT-WORKFLOW-018` own the bounded
+Phase5A generation/check contract. Use `integration source --tool codex` or
+`integration source --tool claude` through a repository-approved, already
+installed launcher. JSON is the default and includes the exact generated
+content, descriptor-owned target path, materialization identity, content and
+consumed-capability digests, and separate metadata/body byte counts. Text is
+the exact file content. The limits are 512 metadata bytes and 4096 body bytes,
+not tokenizer-specific token counts.
+
+The fixed repository paths are `.agents/skills/agentic-proofkit/SKILL.md` for
+`codex` and `.claude/skills/agentic-proofkit/SKILL.md` for `claude`. Neither tool
+is selected implicitly; selecting one does not inspect the other location.
+The generator reads no repository files, writes nothing, and has no `--output`
+or install option. Generated instructions contain no hooks or permission grants
+and delegate policy, planning, and evidence semantics to current owners.
+Resolve the approved installed launcher for each session. An absent or
+ambiguous binding needs an owner decision, not an install, network fallback,
+package-manager default, or persisted machine-local executable path.
+
+For one manual export, first inspect the explicit repository root and every
+component of the selected path. Stop on symlinks, aliases, unknown ownership,
+local edits, or an existing target; do not overwrite it. The example below
+assumes the owner has approved the npm launcher, inspected and prepared the
+ordinary parent directories, and ensured no concurrent writer can replace
+them. Replace the example absolute root with that inspected root. The shell,
+not Proofkit, creates the file; noclobber protects an existing final file but
+does not establish race-free parent traversal or transactional installation.
+
+```bash
+(set -o noclobber; npm exec --offline -- agentic-proofkit integration source --tool codex --format text > /absolute/inspected/repository/.agents/skills/agentic-proofkit/SKILL.md)
+npm exec --offline -- agentic-proofkit integration check --tool codex --repo-root /absolute/inspected/repository
+```
+
+Check a failed export before treating its output as usable: shell redirection
+may leave an empty or partial new file if generation or transport fails.
+Resolve such a file manually under repository ownership; check never repairs it.
+The checker admits flags before I/O and reads only the selected fixed path
+through an application-write-free confined lease with bounded reobservation.
+Exit 0 and `current` mean exact generated-byte equality; exit 2 reports
+`missing`, `stale`, or `invalid`; exit 1 reports an invocation or operational
+error, including denied reads, ambiguous paths, observed changes, cancellation,
+or cleanup failure. It never prints observed bytes, their digest, or caller
+root paths. Source exits 0 on successful generation and 1 on error.
+
+Generated identity binds the shared template, selected descriptor, and exact
+consumed registered public invocation contracts. Package version is absent
+from the generated bytes; version-only or unrelated-command changes preserve
+identity when consumed projections remain unchanged. Shared native source
+digests may conservatively invalidate freshness. This is materialization
+freshness, not proof of every transitive runtime behavior.
+
+Phase5B managed install/update/remove remains open. Manual export is not an
+installer, rollback protocol, or proof of host activation. Installed npm/Python
+integration proof requires actual carrier execution; source-only tests do not
+discharge it. Native-host file discovery, body loading, and approved-launcher calls
+are separate observations requiring isolated sessions and absent/altered-file
+controls; a prompt directly requesting CLI execution is not skill-use evidence.
+Removing a file does not revoke instructions already loaded into host context.
+
 ## Requirement, Contract, And Test Order
 
 The durable semantic source is the repository-owned requirement package:

package/NON_CLAIMS.md

@@ -36,6 +36,24 @@ This repository state does not claim:
 Consuming repositories must keep their own specifications, proof bindings,
 native witnesses, CI gates, rollback policy, and rollout decisions.
 
+Phase5A integration source/check implements only bounded portable generation
+and read-only generated-byte freshness. It does not install, update, remove,
+repair, activate host instructions, grant tool permissions, or authorize native
+execution. Phase5B managed lifecycle remains open; manual shell export does not
+close it. `current` neither proves semantic full proof nor guarantees stability
+after return. Consumed registered-contract identity is not complete transitive
+native-semantic identity, and byte budgets are not token counts.
+
+Declared witness routes do not prove execution. Installed npm/Python integration
+smokes and final frozen-tree closure require actual execution against the named
+source and artifacts. Native-host discovery, body loading, and approved-launcher
+invocation require separate isolated evidence; direct CLI calls cannot prove
+skill use. Removing an on-disk file does not revoke already-loaded instructions.
+Read-only checks do not suppress filesystem-owned access metadata updates or
+exclude uncooperative writers. Cancellation after the final pre-emission check
+cannot retract bytes accepted by an external stdout writer, and prefix-accepting
+transport failure does not imply an atomic sink.
+
 Reference infrastructure boundary:
 
 ```text

package/docs/proofkit-contract-map.md

@@ -10,6 +10,8 @@ This map helps consuming repositories choose the smallest Proofkit CLI command
 or JSON contract without loading the full README or source tree. It is not an
 exhaustive schema reference. The canonical command inventory is
 `proofkit/cli-contract.v2.json`.
+Its `commandRouteGrammar.omittedRoutePolicy` field owns how consumers expand a
+command record that omits an explicit `route`.
 
 Formal rule:
 
@@ -39,7 +41,9 @@ owner boundaries. It is not a second command-family inventory.
 
 | Family | Main commands | Caller provides | Proofkit owns | Consumer owns | Output authority |
 |---|---|---|---|---|---|
-| Agent workflow planning | `change-workflow-plan`, `native-evidence-guidance` | explicit checkpoint, completed stage ids, bounded context refs, governing authority ref, and required context ref ids | optional built-in `proofkit.reviewed-change.v1` checkpoint relation, reference-closed next-stage context, deterministic agent prompts, bounded text/JSON/envelope projections, and repository-neutral native-evidence guidance with closed applicability classes | custom workflow topology, repository state discovery, stage execution, native witness semantics, evidence collection, review conclusions, merge, release, deployment, and rollout authority | next-action plan, terminal workflow report, bounded agent envelope, or guidance catalog |
+| Agent integration generation/check | `integration source`, `integration check` | explicit `claude` or `codex` tool; explicit repository root for check only | one portable bounded bootstrap, exact consumed registered-contract identity, descriptor-owned path, and confined read-only generated-byte freshness | launcher admission, manual materialization, instruction ownership, host discovery/activation, permissions, native verification, and any future managed lifecycle | generated source or missing/current/stale/invalid freshness report; neither is installation or execution authority |
+| Project state navigation | `status`, `next` | explicit repository root | bounded transaction-first materialized-project inspection, normalized observation identity, deterministic project-state classification, and one non-executable next action; admitted in-bound records bind exact content digests, while unread out-of-bound records intentionally identify only their invalid class | repository policy, byte identity for unread out-of-bound records, witness execution, receipt trust/currentness/scope, merge, release, deployment, rollout, and production readiness | project-status report, next-action packet, or bounded text projection |
+| Agent workflow planning | `change plan`, `native-evidence-guidance` | explicit checkpoint, completed stage ids, bounded context refs, governing authority ref, and required context ref ids | optional built-in `proofkit.reviewed-change.v1` checkpoint relation, reference-closed next-stage context, deterministic agent prompts, bounded text/JSON/envelope projections, and repository-neutral native-evidence guidance with closed applicability classes | custom workflow topology, repository state discovery, stage execution, native witness semantics, evidence collection, review conclusions, merge, release, deployment, and rollout authority | next-action plan, terminal workflow report, bounded agent envelope, or guidance catalog |
 | Adoption and scaffolding | `adopt plan`, `adopt materialize plan`, `adopt materialize apply`, `adopt materialize recover`, `repository-inventory`, `adoption-contract-envelope`, `adoption-workflow-plan`, `adoption-checklist`, `adoption-doctor`, `gradual-adoption`, `gradual-adoption-bootstrap`, `gradual-adoption-guidance`, `capability-map-admission`, `pilot-admission`, `scaffold-profile-plan`, `scaffold-project-structure`, `stack-preset` | explicit repository root, explicit fresh/code-baseline/audit-from-code intent, optional stack hint, owner-reviewed candidate packet, expected transaction and desired-state identities, recovery action, aggregate adoption contract envelope, checklist facts, target paths, owner routes, caller-extracted stale authority vocabulary facts, explicit pre-spec capability observations, and pilot records | bounded fixed-catalog root inventory, candidate-only front-door tasks, owner-closed read-only materialization plans, confined transactional apply and recovery receipts, aggregate contract-envelope admission, deterministic starter plans, checklist/report admission, bounded guidance envelopes, dry-run manifests, pre-spec trust-mode admission, adoption gap and stale-authority classification, and pilot shape admission | stack selection, arbitrary source inspection, candidate review, final requirement meaning, proof adequacy, rollout policy, text extraction, code observation extraction, and pilot truth | inventory, candidate-only plan, transaction-bound materialization plan or receipt, selected child output, report, seed packet, or agent envelope |
 | Requirement source | `capability-map-admission`, `requirement-authoring-plan`, `requirement-source-admission`, `requirement-source-transition`, `spec-overview-claims`, `requirement-spec-tree`, `requirement-spec-tree-view`, `requirement-source-view`, `requirement-browser-server` | `requirements.v1.json`, caller-owned capability maps, caller-owned authoring facts, overview claim extraction, explicit spec hierarchy, view options | candidate seed admission, candidate-only authoring packets, source-shape admission, lifecycle checks, explicit tree topology/source-ref admission, shared safe renderer fragments, presentation-only views | requirement meaning, extraction completeness, Markdown extraction completeness, hierarchy ownership, proof adequacy, file materialization | capability map report, authoring packet, source report, spec-tree report, rendered view, or browser presentation |
 | Requirement proof binding | `requirement-bindings`, `binding-partition`, `proof-slice`, `evidence-graph`, `requirement-proof-resolver`, `requirement-proof-source-set`, `requirement-proof-view`, `spec-proof-bundle-admission` | requirement records, bindings, witness commands, source-set facts, receipt reports, partition policy | graph validation, binding partition projection, compact slices, declaration-only compact route projection with full binding identity and role-qualified witness routes, resolver projection, bundle linkage checks | selector resolution, oracle quality, witness execution, mutation adequacy, finding completeness, proof freshness, trust, assurance, merge policy | proof report, partition report, slice, declaration lookup graph, or view |
@@ -128,8 +132,10 @@ Semantic context routes are `requirement-context-compose`,
 
 | State or goal | Next Proofkit route | Stop or escalation condition |
 |---|---|---|
+| A repository owner requests a portable Proofkit bootstrap or its exact-byte freshness. | `integration source --tool <tool>` generates JSON or exact file bytes with `--format text`; `integration check --tool <tool> --repo-root <caller-selected-root>` checks only the selected fixed path. Select `claude` or `codex` explicitly. | Source writes nothing; neither route accepts `--output` or install. Source exits 0/1 for success/error; check exits 0 for current, 2 for missing/stale/invalid, and 1 for invocation or operation error. Current proves only generated-byte equality. Use `ADOPTION.md` for inspected manual export; Phase5B installation/update/removal and host activation remain open. |
+| The repository may already contain a materialized Proofkit project. | `status --repo-root <caller-selected-root>` for the full bounded classification or `next --repo-root <caller-selected-root>` for its single action projection. | Treat `verification_required` as a request to run repository-owned verification, never as completion or approval. Stop on blocked or recovery-required states; the packet does not execute its route or own policy. |
 | The agent does not know where to start. | `adopt plan --mode <mode> --repo-root <caller-selected-root>`, where mode is `fresh`, `code-baseline`, or `audit-from-code` | Choose the trust intent explicitly. Treat the fixed-catalog inventory and tasks as a read-only candidate plan; stop before arbitrary source inspection, writing files, or making requirements authoritative. |
-| An agent needs a bounded, deterministic stage transition for an engineering change. | `change-workflow-plan` selects the optional built-in `proofkit.reviewed-change.v1` profile; use `--agent-envelope` for the compact work packet and `native-evidence-guidance` when the consuming repository has not yet materialized repository-specific evidence instructions. | Supply only explicit current checkpoint, completed stages, and admitted context references. Apply conditional guidance slots only when their applicability class matches a declared consumer mechanism. Stop before treating the profile, plan, or guidance as repository policy or as proof that a stage ran, evidence exists, review passed, or merge/release is authorized. |
+| An agent needs a bounded, deterministic stage transition for an engineering change. | `change plan` selects the optional built-in `proofkit.reviewed-change.v1` profile; use `--agent-envelope` for the compact work packet and `native-evidence-guidance` when the consuming repository has not yet materialized repository-specific evidence instructions. | Supply only explicit current checkpoint, completed stages, and admitted context references. Apply conditional guidance slots only when their applicability class matches a declared consumer mechanism. Stop before treating the profile, plan, or guidance as repository policy or as proof that a stage ran, evidence exists, review passed, or merge/release is authorized. |
 | No admitted spec/profile exists and the caller has explicit capability observations. | `capability-map-admission`; use `trustMode: "code_baseline"` only when maintainers intentionally freeze current code, otherwise use `trustMode: "audit_from_code"`. | Stop before treating seeds as stable requirements. The consumer owns observation extraction, materialization, requirement meaning, and proof adequacy. |
 | No admitted spec/profile exists and no capability observations exist. | Start with `adopt plan --mode fresh --repo-root <caller-selected-root>`; use `scaffold-project-structure`, `adoption-workflow-plan`, or `stack-preset` only as later specialist routes when an owner has selected them. | Treat front-door tasks as candidate-only. Stop before writing files; the consumer owns materialization, overwrite policy, and final requirement text. |
 | Owner-reviewed candidate requirement sources, proof bindings, and test inventory are ready for repository materialization. | Use command ID `adopt-materialize-plan` through route `adopt materialize plan --input <candidate-packet> --repo-root <caller-selected-root>`, review the exact transaction and desired-state identities, then use command ID `adopt-materialize-apply` through route `adopt materialize apply` with both expected identities. Use `adopt materialize recover` only for the exact observed transaction and state-compatible `resume` or `rollback` action. | Stop on stale state, unknown ownership, path-role collision, pending transaction, identity mismatch, or recovery-required output. A plan or receipt does not prove requirement meaning, witness truth, proof adequacy, merge approval, rollout, or production readiness. |

package/docs/specs/proofkit-agent-workflow/overview.md

@@ -7,7 +7,7 @@ witnesses, merge, release, rollout, or production-readiness decisions.
 
 The public capability is deliberately small:
 
-1. `change-workflow-plan` admits explicit JSON and projects one next action for
+1. `change plan` admits explicit JSON and projects one next action for
    the optional built-in profile `proofkit.reviewed-change.v1`, whose ordered
    stages are `architecture`, `design`, `implementation_plan`,
    `implementation`, `verification`, `pull_request`, and `closeout`.
@@ -19,12 +19,24 @@ The public capability is deliberately small:
    the consuming witness declares the named mechanism.
 3. Existing descriptors, dispatch, command families, root-shape CLI contracts,
    agent envelopes, and package gates provide public-surface closure.
+4. `status --repo-root` classifies only a bounded normalized
+   materialized-project observation, and `next --repo-root` projects one
+   bounded action. Admitted in-bound records bind exact content digests;
+   unread out-of-bound records bind only their invalid class. Neither command
+   claims native execution or proof completion.
+5. `integration source --tool <claude|codex>` emits one portable static
+   bootstrap without reading repositories or writing files;
+   `integration check --tool <claude|codex> --repo-root <path>` compares only
+   the selected descriptor-owned file through confined read-only inspection.
+   These are generation/check targets, not managed integration support.
 
-Neither workflow command scans a repository. Both command cores are stateless
-pure projections with no filesystem, Git, process, environment, clock, random,
-network, container, or provider dependency. Neither workflow command adds a
-setup facade, hidden route policy, external prompt resource, persisted
-experiment state, or second source codec. Agent-route brief and full
+The change planner and evidence-guidance cores are stateless pure projections.
+Project status reads only an explicit repository root, the conventional routing
+manifest, its declared children, and transaction control state through bounded
+owner-admitted transport. No workflow command executes Git, native witnesses,
+network, containers, or providers. No workflow command adds a setup facade,
+hidden route policy, external prompt resource, persisted experiment state,
+generic report interpreter, or second source codec. Agent-route brief and full
 projections remain independently owned by the spec-proof-core package.
 
 ## Requirements
@@ -69,11 +81,63 @@ projections remain independently owned by the spec-proof-core package.
   descriptor/dispatcher/family/help/root-contract/witness/generated/package
   surfaces, with npm-only non-runtime specification docs and cross-channel
   runtime behavior proof.
+- `REQ-PROOFKIT-WORKFLOW-012`: one truthful project-state owner, exhaustive
+  precedence, existing child and cross-record closure owners, and no promotion
+  of source declarations or caller status into execution evidence.
+- `REQ-PROOFKIT-WORKFLOW-013`: one application-write-free root-bound inspection
+  lease, cooperative writer exclusion, descriptor-relative exact-path
+  traversal, bounded content-cohort validation, fail-closed partial control
+  observations, one bounded retry, and a portable non-disclosing
+  normalized-observation identity.
+  Filesystem-owned read metadata such as access time is outside that guarantee.
+- `REQ-PROOFKIT-WORKFLOW-014`: one total state-to-action table, one bounded
+  next action, explicit owner decisions, and no embedded route universe.
+- `REQ-PROOFKIT-WORKFLOW-015`: status/next CLI channel and exit semantics,
+  checkpointed pre-emission failure discipline, one bounded stdout write
+  without claiming cancellation rollback or atomicity from an external sink,
+  and a versioned breaking replacement
+  of the flat change route by `change plan` across source and installed carriers.
+- `REQ-PROOFKIT-WORKFLOW-016`: one private descriptor/template owner, portable
+  approved-launcher guidance, 512-byte metadata and 4096-byte body limits, and
+  identity over exactly consumed registered invocation contracts rather than
+  package version or the entire command universe.
+- `REQ-PROOFKIT-WORKFLOW-017`: pre-I/O invocation admission, a confined
+  application-write-free two-observation check with an 8192-byte read bound per
+  observation, distinct missing/current/stale/invalid states, non-disclosing
+  operational failures, and independent cancellation/cleanup outcomes.
+- `REQ-PROOFKIT-WORKFLOW-018`: exact source/check CLI flags, JSON root shapes,
+  exit semantics, one source/check-only command family, and source, generated,
+  and installed-carrier closure obligations. A binding is not an execution
+  receipt; final frozen-tree and installed-carrier integration proof requires
+  actual execution against the named source and artifacts.
 
 Shared stable-JSON/diagnostic hardening is owned by the supply-chain-quality
 spec. Typed local-reference closure is owned by the existing agent-envelope
 requirement. This workflow spec consumes those owners without duplicating them.
 
+## Thin Integration Boundary
+
+The production owner is `internal/command/agentintegration`. The descriptor
+alone selects `.agents/skills/agentic-proofkit/SKILL.md` for `codex` or
+`.claude/skills/agentic-proofkit/SKILL.md` for `claude`. Source and check share
+the same renderer. Common name/description frontmatter and static Markdown
+delegate to the current CLI instead of embedding schemas or workflow policy.
+The bootstrap persists logical routes, not machine-local executable paths;
+an absent or ambiguous repository-approved installed launcher needs an owner
+decision, never an implicit package manager, install, or network fallback.
+
+The source contract's default JSON includes exact content and its digest;
+`--format text` emits those file bytes. Check returns only expected generated
+identity and a bounded freshness classification, never observed content, its
+digest, or caller root paths. Exit 0 means current, exit 2 means a classified
+missing/stale/invalid file, and exit 1 means an invocation or operation error.
+Source returns 0 on success and 1 on error. Neither accepts `--output` or an
+install option. Manual export guidance is owned by `ADOPTION.md`.
+
+Phase5B managed installation, update, and safe removal remains explicitly open.
+Host discovery, body loading, and approved-launcher invocation require separate
+isolated native-host observations; direct CLI execution cannot prove skill use.
+
 ## Non-Claims
 
 - Generated prompts are not authenticated and need not be obeyed or adequate.
@@ -83,5 +147,9 @@ requirement. This workflow spec consumes those owners without duplicating them.
 - Least dependency closure does not prove context truth, freshness, semantic
   sufficiency, or global minimality.
 - A finite pilot does not prove universal repository fit.
+- Bootstrap byte bounds are not token counts, and consumed registered-contract
+  identity is not complete transitive semantic proof.
+- Generated-byte freshness does not install, activate, authorize, or grant
+  permissions. File removal does not revoke instructions already in host context.
 - This spec does not select a persisted requirement-source codec.
 - This spec does not approve merge, release, rollout, or production readiness.

package/docs/specs/proofkit-agent-workflow/requirements.v1.json

@@ -147,6 +147,113 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-012",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Project status consumes only one explicit repository root, the conventional digest-routed project manifest, its exact manifest-declared canonical children, and one repository-transaction control projection; it delegates child admission and cross-record closure to the adoption-materialization owner, publishes exactly one state from uninitialized, recovery_required, blocked, stale, and verification_required through one exhaustive precedence table, and never promotes source declarations, binding commands, caller-owned passed labels, or caller-declared workflow completion into native execution, receipt currentness, trust, merge, release, rollout, deployment, or production-readiness evidence.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-012"],
+      "nonClaims": ["Project status classifies the observed materialized-project snapshot and can become stale immediately after emission; it does not prove native witness execution or complete any declared proof scope."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-013",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Project inspection is explicit, root-confined, application-write-free, symlink-denying, byte-bounded, and normalized-observation-bound: Proofkit performs no repository mutation operation; one inspection lease pins one repository root for the whole attempt, exports only exact read-only file capabilities, and, when the transaction control namespace exists, holds its native cooperative writer lock; transaction control is projected by its native owner as clean, recoverable with an exact transaction identity, or invalid with a portable content-bound observation epoch only after the entire namespace is observed within canonical entry, file, aggregate, depth, and file-type bounds, while overflow or unsupported shape fails without a partial packet; every manifest and child route is traversed component by component from the pinned root with exact-name admission, no symlink following, descriptor identity checks, regular-file admission, per-file one-MiB and per-pass aggregate eight-MiB limits before semantic decoding; the root identity and transaction observation are equal before and after the read and a second bounded digest pass over the manifest and every routed child equals the admitted first-pass cohort, or the operation performs at most one complete retry and then fails as concurrent change; every public state receives a snapshot identity over one total tagged observation whose admitted in-bound records bind exact content digests, whose unread out-of-bound records intentionally bind only their invalid class, whose project is unknown or admitted, whose manifest is absent, invalid with an optional bounded content digest, or admitted with identity and content digest, whose transaction carries its tagged state and epoch, whose children are ordered kind/state/expected/observed digest records, and whose cross-record closure state is explicit, without exposing raw bytes, repository paths, or caller text.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-013"],
+      "nonClaims": ["A coherent read snapshot does not prevent later filesystem mutation, authenticate repository ownership, provide power-loss or multi-reader atomicity, exclude a same-user writer that bypasses the repository transaction owner, identify unread out-of-bound record bytes beyond their normalized invalid class, or prevent the filesystem from updating read-side metadata such as access time."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-014",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Project next-action output is a deterministic bounded projection of the admitted project status through one total state-to-action table: blocked maps to non-executable repair, recovery_required maps to a non-executable recovery-direction decision bound to the transaction identity, uninitialized maps to a non-executable source-trust-mode decision, stale maps to rematerialization, and verification_required maps to repository-owned native verification; it emits exactly one action, at most sixteen stable non-disclosing issue codes, no route universe, no inferred trust mode, recovery direction, command success, or owner decision, and stable JSON within 32768 bytes plus text within 4096 UTF-8 bytes and sixteen lines that preserves exactly projectState, actionClass, executable, commandRoute, contextRef, requiredDecision, and issueCodes while intentionally omitting JSON-only packetId, snapshotId, statusRef, and nonClaims.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-014"],
+      "nonClaims": ["A next-action packet is derived guidance; it does not execute, authorize, or prove the proposed action."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-015",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "The public status and next commands require exactly one explicit --repo-root, default to stable ANSI-free JSON, admit text and terminal-only color through the shared presentation contract, return exit zero for every successfully classified project state, including bounded project-record decoding or admission failure, and return exit one without beginning output emission for invocation, confinement, inspection-bound, concurrent-change, cleanup, serialization, or cancellation observed at bounded operation checkpoints and the final pre-emission checkpoint; successful serialization reaches stdout through one bounded write, and a transport failure returns exit one without claiming atomic behavior from a writer that accepted a prefix before failing; the same versioned breaking public edge adds both commands, replaces the flat change-workflow-plan route with change plan without adding a route-alias registry or second implementation, rejects the retired route, admits the hierarchical route, and closes descriptor, help, CLI contract, command family, contract map, ABI, source witness, installed npm, and installed wheel surfaces.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-015"],
+      "nonClaims": [
+        "A caller-provided stdout writer that accepts a prefix and then fails does not provide an atomic sink, so Proofkit does not claim that such a transport leaves stdout empty.",
+        "CLI surface closure does not prove registry publication, provider ingestion, consumer migration, native witness truth, rollout, or production readiness.",
+        "Cancellation racing after the final pre-emission checkpoint cannot retract bytes subsequently accepted by an external writer."
+      ],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-016",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "One private production owner in internal/command/agentintegration holds the finite tool/path descriptor table and one shared static bootstrap renderer consumed by both source and check; explicit codex selects .agents/skills/agentic-proofkit/SKILL.md and explicit claude selects .claude/skills/agentic-proofkit/SKILL.md, without a default tool or access to the other location. Generation is a deterministic repository-read-free and application-write-free projection with only name/description frontmatter, at most 512 UTF-8 metadata bytes and 4096 UTF-8 body bytes, exact file bytes in text mode, and no hooks, shell injection, permission grants, persona, background process, package installation, copied schema, state/action table, or independent workflow policy. The shared body delegates status, next, adoption/change planning, brief agent-route and existing detail retrieval, help, and native-evidence-guidance to current CLI owners. Identity binds the template, selected descriptor, and exact consumed registered routes and invocation contracts from existing app descriptors and generated input/output contract metadata; package version is absent from generated bytes, and version-only or unconsumed-command changes preserve bytes and identity when consumed registered projections are unchanged. Consumed contract or route changes invalidate identity; shared native source digests may conservatively invalidate freshness. Persist logical routes only, resolve the repository-approved already-installed launcher at invocation time, and stop for an owner decision when its binding is absent or ambiguous; tool, distribution channel, launcher profile, and concrete interpreter remain distinct coordinates without a persistent carrier option or network fallback.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-016"],
+      "nonClaims": [
+        "Byte budgets do not prove tokenizer-specific token cost or model behavior.",
+        "Generation does not install instructions, activate a host skill, grant permissions, authorize execution, or prove native verification.",
+        "Materialization identity binds consumed registered invocation contracts, not complete schemas or every transitive native semantic behavior."
+      ],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-017",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Integration freshness admits explicit tool, root, format, and flag cardinality before filesystem I/O, obtains expected bytes and the fixed selected path only from the integration source owner, and performs no application writes to selected, other-tool, adjacent, or global instructions. Reuse one read-only repository inspection lease and exact component-wise non-symlink regular-file traversal; check file kind before any content read and never read FIFO/device contents. Each of two complete observations reads at most 8192 bytes; reobserve the complete bounded state and bytes, verify file/route and pinned-root identity, and fail operationally on observed change. Exact entry or ordinary parent absence is missing; bounded regular UTF-8 text equal to generated bytes is current; differing bounded regular UTF-8 text, including unknown or old content, is stale; non-regular entry, symlink component, oversized file, NUL, or invalid UTF-8 is invalid. Permission, I/O, cleanup, portable-alias, changed-root/route, or cancellation failure is an operation error, never a classified success. Cancellation and file/lease cleanup outcomes participate independently in every result and dominate classification. Public reports and diagnostics disclose neither observed content, its digest, nor caller root paths; fixed descriptor-owned relative target paths and expected generated identities are public. A marker or stored digest never substitutes for checking actual bounded bytes.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-017"],
+      "nonClaims": [
+        "Application-write-free inspection does not prevent filesystem-owned read metadata updates, exclude an uncooperative same-user writer, or identify unread oversized-file bytes beyond the bounded observation.",
+        "Current means exact generated-byte freshness only, not installation, host activation, approved-launcher invocation, native execution, semantic proof completion, or stability after return."
+      ],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-018",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Exactly two no-input commands expose Phase5A: integration-source through integration source with built_in_package_catalog scope, and integration-check through integration check with explicit_filesystem_scan scope. Both require exactly one --tool from claude/codex, admit at most one --format from json/text with JSON default, reject input transport, surplus operands, color, carrier, output-file, and install options; check additionally requires exactly one --repo-root, which source rejects. Source JSON has exactly schemaVersion, kind, tool, targetPath, integrationId, content, contentDigest, capabilityDigest, metadataBytes, bodyBytes, and nonClaims; check JSON has exactly schemaVersion, kind, tool, targetPath, integrationId, expectedContentDigest, state, and nonClaims. Both schema versions are 1; kinds are proofkit.integration-source.v1 and proofkit.integration-check.v1. Source text is the exact generated content. Source exits 0 on success and 1 on error; check exits 0 only for current, 2 for missing/stale/invalid classified reports with empty stderr, and 1 for operation or invocation error. Cancellation observed before emission and serialization/cleanup failures produce no success report. Descriptor, dispatch, help, the agent-integrations source/check-only family, root-shape definitions and their hashes, CLI contracts, contract-map routes, exact native witnesses, generated metadata, and installed npm/Python carriers must close over the same bounded invocation/output relation without a second semantic owner; native source bindings include internal/command/agentintegration. Source-carrier independence and installed-carrier execution are separate obligations. Phase5B managed install/update/remove remains open and is not discharged by generation, check, manual export, or this contract closure.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-018"],
+      "nonClaims": [
+        "Cancellation after the final pre-emission checkpoint cannot retract accepted output, and a caller-provided writer that accepts a prefix before failure is not an atomic sink.",
+        "Installed CLI behavior does not prove native-host file discovery, body loading, approved-launcher calls, registry publication, consumer migration, or host instruction revocation after file removal.",
+        "Phase5A is generation/check only, not managed installation, update, removal, host activation, permission grant, semantic full proof, merge approval, or production readiness.",
+        "Witness selectors declare exact verification routes, not executed or passed proof; installed npm/Python integration witnesses and final frozen-tree closure require actual execution against the named source and artifacts."
+      ],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ],
   "nonClaims": [

package/docs/specs/proofkit-spec-proof-core/overview.md

@@ -199,6 +199,12 @@ execution receipts, and merge policy.
 - `REQ-PROOFKIT-SPEC-034`: the pre-materialization-to-transactional-
   materialization public version edge binds all three transactional
   materialization routes and their exact public contracts to a compatible
+  byte-frozen predecessor release record without coupling the historical edge
+  to the live release record or reinterpreting the frozen prior edge.
+- `REQ-PROOFKIT-SPEC-035`: the project-state public version edge binds the exact
+  raw ABI identities, proves the complete semantic ABI difference after
+  normalizing only native-source digests, and binds status, next, the
+  change-plan route replacement, and omitted-route policy to one breaking
   release record without reinterpreting the frozen prior edge.
 
 ## Non-Claims

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -689,7 +689,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-034",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "The 0.7.0-to-0.8.0 public version edge binds the exact previous and current public ABI digests; the exact addition of adopt materialize plan, apply, and recover with their public routes and input/output contract identities and digests; an explicit added-command selection policy; and the complete ordered additive inventory to one digest-bound current release change record. The edge is compatible, contains no breaking changes or migration steps, and does not mutate or reinterpret the frozen 0.6.0-to-0.7.0 edge.",
+      "invariant": "The byte-frozen 0.7.0-to-0.8.0 public version edge binds the exact previous and released 0.8.0 public ABI digests; the exact addition of adopt materialize plan, apply, and recover with their public routes and input/output contract identities and digests; an explicit added-command selection policy; and the complete ordered additive inventory to one digest-bound archived 0.8.0 release change record. The edge is compatible, contains no breaking changes or migration steps, and later releases cannot mutate, reinterpret, or bind it to the live current release record or live command metadata.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
@@ -698,6 +698,19 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-035",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "The 0.8.0-to-0.9.0 public version edge binds the exact raw previous and current public ABI digests and proves their complete semantic difference: status and next are the only added commands; their public routes and output contract identities and digests are exact; the flat change-workflow-plan route is replaced by change plan while preserving one internal implementation and the input/output contract identities and digests; every predecessor command is otherwise identical after normalizing only native-source canonical digests; every predecessor contract definition remains exact; added definitions are exactly the transitive closure of the added commands; and omitted-route policy is the only process-contract addition. Native-source digest churn remains bound by the raw edge digests rather than being misclassified as wire-semantic change. The complete ordered breaking, additive, and migration inventories bind to one digest-bound current release change record; the edge rejects the retired route, admits the hierarchical route, and cannot mutate or reinterpret the byte-frozen 0.7.0-to-0.8.0 edge.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-035"],
+      "nonClaims": ["A source-bound version edge does not authenticate registry publication, provider ingestion, consumer migration, native witness truth, rollout, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ],
   "nonClaims": [

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,