@research-engineering/agentic-proofkit 0.8.0 → 0.9.0

package/docs/proofkit-contract-map.md

@@ -10,6 +10,8 @@ This map helps consuming repositories choose the smallest Proofkit CLI command
 or JSON contract without loading the full README or source tree. It is not an
 exhaustive schema reference. The canonical command inventory is
 `proofkit/cli-contract.v2.json`.
+Its `commandRouteGrammar.omittedRoutePolicy` field owns how consumers expand a
+command record that omits an explicit `route`.
 
 Formal rule:
 
@@ -39,7 +41,8 @@ owner boundaries. It is not a second command-family inventory.
 
 | Family | Main commands | Caller provides | Proofkit owns | Consumer owns | Output authority |
 |---|---|---|---|---|---|
-| Agent workflow planning | `change-workflow-plan`, `native-evidence-guidance` | explicit checkpoint, completed stage ids, bounded context refs, governing authority ref, and required context ref ids | optional built-in `proofkit.reviewed-change.v1` checkpoint relation, reference-closed next-stage context, deterministic agent prompts, bounded text/JSON/envelope projections, and repository-neutral native-evidence guidance with closed applicability classes | custom workflow topology, repository state discovery, stage execution, native witness semantics, evidence collection, review conclusions, merge, release, deployment, and rollout authority | next-action plan, terminal workflow report, bounded agent envelope, or guidance catalog |
+| Project state navigation | `status`, `next` | explicit repository root | bounded transaction-first materialized-project inspection, normalized observation identity, deterministic project-state classification, and one non-executable next action; admitted in-bound records bind exact content digests, while unread out-of-bound records intentionally identify only their invalid class | repository policy, byte identity for unread out-of-bound records, witness execution, receipt trust/currentness/scope, merge, release, deployment, rollout, and production readiness | project-status report, next-action packet, or bounded text projection |
+| Agent workflow planning | `change plan`, `native-evidence-guidance` | explicit checkpoint, completed stage ids, bounded context refs, governing authority ref, and required context ref ids | optional built-in `proofkit.reviewed-change.v1` checkpoint relation, reference-closed next-stage context, deterministic agent prompts, bounded text/JSON/envelope projections, and repository-neutral native-evidence guidance with closed applicability classes | custom workflow topology, repository state discovery, stage execution, native witness semantics, evidence collection, review conclusions, merge, release, deployment, and rollout authority | next-action plan, terminal workflow report, bounded agent envelope, or guidance catalog |
 | Adoption and scaffolding | `adopt plan`, `adopt materialize plan`, `adopt materialize apply`, `adopt materialize recover`, `repository-inventory`, `adoption-contract-envelope`, `adoption-workflow-plan`, `adoption-checklist`, `adoption-doctor`, `gradual-adoption`, `gradual-adoption-bootstrap`, `gradual-adoption-guidance`, `capability-map-admission`, `pilot-admission`, `scaffold-profile-plan`, `scaffold-project-structure`, `stack-preset` | explicit repository root, explicit fresh/code-baseline/audit-from-code intent, optional stack hint, owner-reviewed candidate packet, expected transaction and desired-state identities, recovery action, aggregate adoption contract envelope, checklist facts, target paths, owner routes, caller-extracted stale authority vocabulary facts, explicit pre-spec capability observations, and pilot records | bounded fixed-catalog root inventory, candidate-only front-door tasks, owner-closed read-only materialization plans, confined transactional apply and recovery receipts, aggregate contract-envelope admission, deterministic starter plans, checklist/report admission, bounded guidance envelopes, dry-run manifests, pre-spec trust-mode admission, adoption gap and stale-authority classification, and pilot shape admission | stack selection, arbitrary source inspection, candidate review, final requirement meaning, proof adequacy, rollout policy, text extraction, code observation extraction, and pilot truth | inventory, candidate-only plan, transaction-bound materialization plan or receipt, selected child output, report, seed packet, or agent envelope |
 | Requirement source | `capability-map-admission`, `requirement-authoring-plan`, `requirement-source-admission`, `requirement-source-transition`, `spec-overview-claims`, `requirement-spec-tree`, `requirement-spec-tree-view`, `requirement-source-view`, `requirement-browser-server` | `requirements.v1.json`, caller-owned capability maps, caller-owned authoring facts, overview claim extraction, explicit spec hierarchy, view options | candidate seed admission, candidate-only authoring packets, source-shape admission, lifecycle checks, explicit tree topology/source-ref admission, shared safe renderer fragments, presentation-only views | requirement meaning, extraction completeness, Markdown extraction completeness, hierarchy ownership, proof adequacy, file materialization | capability map report, authoring packet, source report, spec-tree report, rendered view, or browser presentation |
 | Requirement proof binding | `requirement-bindings`, `binding-partition`, `proof-slice`, `evidence-graph`, `requirement-proof-resolver`, `requirement-proof-source-set`, `requirement-proof-view`, `spec-proof-bundle-admission` | requirement records, bindings, witness commands, source-set facts, receipt reports, partition policy | graph validation, binding partition projection, compact slices, declaration-only compact route projection with full binding identity and role-qualified witness routes, resolver projection, bundle linkage checks | selector resolution, oracle quality, witness execution, mutation adequacy, finding completeness, proof freshness, trust, assurance, merge policy | proof report, partition report, slice, declaration lookup graph, or view |
@@ -128,8 +131,9 @@ Semantic context routes are `requirement-context-compose`,
 
 | State or goal | Next Proofkit route | Stop or escalation condition |
 |---|---|---|
+| The repository may already contain a materialized Proofkit project. | `status --repo-root <caller-selected-root>` for the full bounded classification or `next --repo-root <caller-selected-root>` for its single action projection. | Treat `verification_required` as a request to run repository-owned verification, never as completion or approval. Stop on blocked or recovery-required states; the packet does not execute its route or own policy. |
 | The agent does not know where to start. | `adopt plan --mode <mode> --repo-root <caller-selected-root>`, where mode is `fresh`, `code-baseline`, or `audit-from-code` | Choose the trust intent explicitly. Treat the fixed-catalog inventory and tasks as a read-only candidate plan; stop before arbitrary source inspection, writing files, or making requirements authoritative. |
-| An agent needs a bounded, deterministic stage transition for an engineering change. | `change-workflow-plan` selects the optional built-in `proofkit.reviewed-change.v1` profile; use `--agent-envelope` for the compact work packet and `native-evidence-guidance` when the consuming repository has not yet materialized repository-specific evidence instructions. | Supply only explicit current checkpoint, completed stages, and admitted context references. Apply conditional guidance slots only when their applicability class matches a declared consumer mechanism. Stop before treating the profile, plan, or guidance as repository policy or as proof that a stage ran, evidence exists, review passed, or merge/release is authorized. |
+| An agent needs a bounded, deterministic stage transition for an engineering change. | `change plan` selects the optional built-in `proofkit.reviewed-change.v1` profile; use `--agent-envelope` for the compact work packet and `native-evidence-guidance` when the consuming repository has not yet materialized repository-specific evidence instructions. | Supply only explicit current checkpoint, completed stages, and admitted context references. Apply conditional guidance slots only when their applicability class matches a declared consumer mechanism. Stop before treating the profile, plan, or guidance as repository policy or as proof that a stage ran, evidence exists, review passed, or merge/release is authorized. |
 | No admitted spec/profile exists and the caller has explicit capability observations. | `capability-map-admission`; use `trustMode: "code_baseline"` only when maintainers intentionally freeze current code, otherwise use `trustMode: "audit_from_code"`. | Stop before treating seeds as stable requirements. The consumer owns observation extraction, materialization, requirement meaning, and proof adequacy. |
 | No admitted spec/profile exists and no capability observations exist. | Start with `adopt plan --mode fresh --repo-root <caller-selected-root>`; use `scaffold-project-structure`, `adoption-workflow-plan`, or `stack-preset` only as later specialist routes when an owner has selected them. | Treat front-door tasks as candidate-only. Stop before writing files; the consumer owns materialization, overwrite policy, and final requirement text. |
 | Owner-reviewed candidate requirement sources, proof bindings, and test inventory are ready for repository materialization. | Use command ID `adopt-materialize-plan` through route `adopt materialize plan --input <candidate-packet> --repo-root <caller-selected-root>`, review the exact transaction and desired-state identities, then use command ID `adopt-materialize-apply` through route `adopt materialize apply` with both expected identities. Use `adopt materialize recover` only for the exact observed transaction and state-compatible `resume` or `rollback` action. | Stop on stale state, unknown ownership, path-role collision, pending transaction, identity mismatch, or recovery-required output. A plan or receipt does not prove requirement meaning, witness truth, proof adequacy, merge approval, rollout, or production readiness. |

package/docs/specs/proofkit-agent-workflow/overview.md

@@ -7,7 +7,7 @@ witnesses, merge, release, rollout, or production-readiness decisions.
 
 The public capability is deliberately small:
 
-1. `change-workflow-plan` admits explicit JSON and projects one next action for
+1. `change plan` admits explicit JSON and projects one next action for
    the optional built-in profile `proofkit.reviewed-change.v1`, whose ordered
    stages are `architecture`, `design`, `implementation_plan`,
    `implementation`, `verification`, `pull_request`, and `closeout`.
@@ -19,12 +19,19 @@ The public capability is deliberately small:
    the consuming witness declares the named mechanism.
 3. Existing descriptors, dispatch, command families, root-shape CLI contracts,
    agent envelopes, and package gates provide public-surface closure.
+4. `status --repo-root` classifies only a bounded normalized
+   materialized-project observation, and `next --repo-root` projects one
+   bounded action. Admitted in-bound records bind exact content digests;
+   unread out-of-bound records bind only their invalid class. Neither command
+   claims native execution or proof completion.
 
-Neither workflow command scans a repository. Both command cores are stateless
-pure projections with no filesystem, Git, process, environment, clock, random,
-network, container, or provider dependency. Neither workflow command adds a
-setup facade, hidden route policy, external prompt resource, persisted
-experiment state, or second source codec. Agent-route brief and full
+The change planner and evidence-guidance cores are stateless pure projections.
+Project status reads only an explicit repository root, the conventional routing
+manifest, its declared children, and transaction control state through bounded
+owner-admitted transport. No workflow command executes Git, native witnesses,
+network, containers, or providers. No workflow command adds a setup facade,
+hidden route policy, external prompt resource, persisted experiment state,
+generic report interpreter, or second source codec. Agent-route brief and full
 projections remain independently owned by the spec-proof-core package.
 
 ## Requirements
@@ -69,6 +76,22 @@ projections remain independently owned by the spec-proof-core package.
   descriptor/dispatcher/family/help/root-contract/witness/generated/package
   surfaces, with npm-only non-runtime specification docs and cross-channel
   runtime behavior proof.
+- `REQ-PROOFKIT-WORKFLOW-012`: one truthful project-state owner, exhaustive
+  precedence, existing child and cross-record closure owners, and no promotion
+  of source declarations or caller status into execution evidence.
+- `REQ-PROOFKIT-WORKFLOW-013`: one application-write-free root-bound inspection
+  lease, cooperative writer exclusion, descriptor-relative exact-path
+  traversal, bounded content-cohort validation, fail-closed partial control
+  observations, one bounded retry, and a portable non-disclosing
+  normalized-observation identity.
+  Filesystem-owned read metadata such as access time is outside that guarantee.
+- `REQ-PROOFKIT-WORKFLOW-014`: one total state-to-action table, one bounded
+  next action, explicit owner decisions, and no embedded route universe.
+- `REQ-PROOFKIT-WORKFLOW-015`: status/next CLI channel and exit semantics,
+  checkpointed pre-emission failure discipline, one bounded stdout write
+  without claiming cancellation rollback or atomicity from an external sink,
+  and a versioned breaking replacement
+  of the flat change route by `change plan` across source and installed carriers.
 
 Shared stable-JSON/diagnostic hardening is owned by the supply-chain-quality
 spec. Typed local-reference closure is owned by the existing agent-envelope

package/docs/specs/proofkit-agent-workflow/requirements.v1.json

@@ -147,6 +147,62 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-012",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Project status consumes only one explicit repository root, the conventional digest-routed project manifest, its exact manifest-declared canonical children, and one repository-transaction control projection; it delegates child admission and cross-record closure to the adoption-materialization owner, publishes exactly one state from uninitialized, recovery_required, blocked, stale, and verification_required through one exhaustive precedence table, and never promotes source declarations, binding commands, caller-owned passed labels, or caller-declared workflow completion into native execution, receipt currentness, trust, merge, release, rollout, deployment, or production-readiness evidence.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-012"],
+      "nonClaims": ["Project status classifies the observed materialized-project snapshot and can become stale immediately after emission; it does not prove native witness execution or complete any declared proof scope."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-013",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Project inspection is explicit, root-confined, application-write-free, symlink-denying, byte-bounded, and normalized-observation-bound: Proofkit performs no repository mutation operation; one inspection lease pins one repository root for the whole attempt, exports only exact read-only file capabilities, and, when the transaction control namespace exists, holds its native cooperative writer lock; transaction control is projected by its native owner as clean, recoverable with an exact transaction identity, or invalid with a portable content-bound observation epoch only after the entire namespace is observed within canonical entry, file, aggregate, depth, and file-type bounds, while overflow or unsupported shape fails without a partial packet; every manifest and child route is traversed component by component from the pinned root with exact-name admission, no symlink following, descriptor identity checks, regular-file admission, per-file one-MiB and per-pass aggregate eight-MiB limits before semantic decoding; the root identity and transaction observation are equal before and after the read and a second bounded digest pass over the manifest and every routed child equals the admitted first-pass cohort, or the operation performs at most one complete retry and then fails as concurrent change; every public state receives a snapshot identity over one total tagged observation whose admitted in-bound records bind exact content digests, whose unread out-of-bound records intentionally bind only their invalid class, whose project is unknown or admitted, whose manifest is absent, invalid with an optional bounded content digest, or admitted with identity and content digest, whose transaction carries its tagged state and epoch, whose children are ordered kind/state/expected/observed digest records, and whose cross-record closure state is explicit, without exposing raw bytes, repository paths, or caller text.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-013"],
+      "nonClaims": ["A coherent read snapshot does not prevent later filesystem mutation, authenticate repository ownership, provide power-loss or multi-reader atomicity, exclude a same-user writer that bypasses the repository transaction owner, identify unread out-of-bound record bytes beyond their normalized invalid class, or prevent the filesystem from updating read-side metadata such as access time."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-014",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "Project next-action output is a deterministic bounded projection of the admitted project status through one total state-to-action table: blocked maps to non-executable repair, recovery_required maps to a non-executable recovery-direction decision bound to the transaction identity, uninitialized maps to a non-executable source-trust-mode decision, stale maps to rematerialization, and verification_required maps to repository-owned native verification; it emits exactly one action, at most sixteen stable non-disclosing issue codes, no route universe, no inferred trust mode, recovery direction, command success, or owner decision, and stable JSON within 32768 bytes plus text within 4096 UTF-8 bytes and sixteen lines that preserves exactly projectState, actionClass, executable, commandRoute, contextRef, requiredDecision, and issueCodes while intentionally omitting JSON-only packetId, snapshotId, statusRef, and nonClaims.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-014"],
+      "nonClaims": ["A next-action packet is derived guidance; it does not execute, authorize, or prove the proposed action."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-015",
+      "ownerId": "proofkit.agent-workflow",
+      "invariant": "The public status and next commands require exactly one explicit --repo-root, default to stable ANSI-free JSON, admit text and terminal-only color through the shared presentation contract, return exit zero for every successfully classified project state, including bounded project-record decoding or admission failure, and return exit one without beginning output emission for invocation, confinement, inspection-bound, concurrent-change, cleanup, serialization, or cancellation observed at bounded operation checkpoints and the final pre-emission checkpoint; successful serialization reaches stdout through one bounded write, and a transport failure returns exit one without claiming atomic behavior from a writer that accepted a prefix before failing; the same versioned breaking public edge adds both commands, replaces the flat change-workflow-plan route with change plan without adding a route-alias registry or second implementation, rejects the retired route, admits the hierarchical route, and closes descriptor, help, CLI contract, command family, contract map, ABI, source witness, installed npm, and installed wheel surfaces.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-WORKFLOW-015"],
+      "nonClaims": [
+        "A caller-provided stdout writer that accepts a prefix and then fails does not provide an atomic sink, so Proofkit does not claim that such a transport leaves stdout empty.",
+        "CLI surface closure does not prove registry publication, provider ingestion, consumer migration, native witness truth, rollout, or production readiness.",
+        "Cancellation racing after the final pre-emission checkpoint cannot retract bytes subsequently accepted by an external writer."
+      ],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.agent-workflow", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ],
   "nonClaims": [

package/docs/specs/proofkit-spec-proof-core/overview.md

@@ -199,6 +199,12 @@ execution receipts, and merge policy.
 - `REQ-PROOFKIT-SPEC-034`: the pre-materialization-to-transactional-
   materialization public version edge binds all three transactional
   materialization routes and their exact public contracts to a compatible
+  byte-frozen predecessor release record without coupling the historical edge
+  to the live release record or reinterpreting the frozen prior edge.
+- `REQ-PROOFKIT-SPEC-035`: the project-state public version edge binds the exact
+  raw ABI identities, proves the complete semantic ABI difference after
+  normalizing only native-source digests, and binds status, next, the
+  change-plan route replacement, and omitted-route policy to one breaking
   release record without reinterpreting the frozen prior edge.
 
 ## Non-Claims

package/docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -689,7 +689,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-034",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "The 0.7.0-to-0.8.0 public version edge binds the exact previous and current public ABI digests; the exact addition of adopt materialize plan, apply, and recover with their public routes and input/output contract identities and digests; an explicit added-command selection policy; and the complete ordered additive inventory to one digest-bound current release change record. The edge is compatible, contains no breaking changes or migration steps, and does not mutate or reinterpret the frozen 0.6.0-to-0.7.0 edge.",
+      "invariant": "The byte-frozen 0.7.0-to-0.8.0 public version edge binds the exact previous and released 0.8.0 public ABI digests; the exact addition of adopt materialize plan, apply, and recover with their public routes and input/output contract identities and digests; an explicit added-command selection policy; and the complete ordered additive inventory to one digest-bound archived 0.8.0 release change record. The edge is compatible, contains no breaking changes or migration steps, and later releases cannot mutate, reinterpret, or bind it to the live current release record or live command metadata.",
       "claimLevel": "blocking",
       "riskClass": "high",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],
@@ -698,6 +698,19 @@
       "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
       "deferral": null,
       "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-035",
+      "ownerId": "proofkit.spec-proof-core",
+      "invariant": "The 0.8.0-to-0.9.0 public version edge binds the exact raw previous and current public ABI digests and proves their complete semantic difference: status and next are the only added commands; their public routes and output contract identities and digests are exact; the flat change-workflow-plan route is replaced by change plan while preserving one internal implementation and the input/output contract identities and digests; every predecessor command is otherwise identical after normalizing only native-source canonical digests; every predecessor contract definition remains exact; added definitions are exactly the transitive closure of the added commands; and omitted-route policy is the only process-contract addition. Native-source digest churn remains bound by the raw edge digests rather than being misclassified as wire-semantic change. The complete ordered breaking, additive, and migration inventories bind to one digest-bound current release change record; the edge rejects the retired route, admits the hierarchical route, and cannot mutate or reinterpret the byte-frozen 0.7.0-to-0.8.0 edge.",
+      "claimLevel": "blocking",
+      "riskClass": "high",
+      "proofBindingRefs": ["proofkit/requirement-bindings.json"],
+      "nonClaimRefs": ["NC-PROOFKIT-SPEC-035"],
+      "nonClaims": ["A source-bound version edge does not authenticate registry publication, provider ingestion, consumer migration, native witness truth, rollout, or production readiness."],
+      "lifecycle": {"state": "active", "replacementRequirementIds": [], "evidenceRefs": []},
+      "deferral": null,
+      "updatePolicy": {"reviewOwnerId": "proofkit.spec-proof-core", "requiresImpactDeclaration": true, "requiresProofBindingReview": true}
     }
   ],
   "nonClaims": [

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@research-engineering/agentic-proofkit",
   "description": "Reusable proof profile, report, graph, and witness-planning primitives.",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "type": "module",
   "license": "MIT",
   "sideEffects": false,

package/proofkit/cli-contract.v2.json

@@ -12,7 +12,8 @@
       "maximumTokens": 4,
       "separator": " ",
       "tokenPattern": "^[a-z0-9]+(?:-[a-z0-9]+)*$",
-      "ambiguityPolicy": "no_route_is_prefix_of_another"
+      "ambiguityPolicy": "no_route_is_prefix_of_another",
+      "omittedRoutePolicy": "command_id"
     },
     "globalOptions": {
       "jsonLayout": {
@@ -111,7 +112,7 @@
         "rootDefinitionDigest": "sha256:3dbf760a8f8b0a4093c1dd4edc23367c5ef8027b31c18a01490afb657fcc03ad",
         "nativeSource": {
           "path": "internal/command/adoptionmaterialization",
-          "canonicalDigest": "sha256:25fde227d9a26bc6fac85be5963b4f227e5cac06b876b14565a863ff45b40f11",
+          "canonicalDigest": "sha256:2940a39db54e51167e3f3373aa38525fc734fddc3902ac7d7ed1fdf326066cfe",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -142,17 +143,17 @@
         "nativeSources": [
           {
             "path": "internal/app",
-            "canonicalDigest": "sha256:0195a152392ad4cecd99a2d0c147ee8e25a034a32e4f730033766399a030c5c3",
+            "canonicalDigest": "sha256:7fa037cfe6147827468954667d103b27796ff43c1d1f74d81be1f545d7534a8e",
             "evidenceClass": "source_checkout"
           },
           {
             "path": "internal/command/adoptionmaterialization",
-            "canonicalDigest": "sha256:25fde227d9a26bc6fac85be5963b4f227e5cac06b876b14565a863ff45b40f11",
+            "canonicalDigest": "sha256:2940a39db54e51167e3f3373aa38525fc734fddc3902ac7d7ed1fdf326066cfe",
             "evidenceClass": "source_checkout"
           },
           {
             "path": "internal/kernel/repositorytransaction",
-            "canonicalDigest": "sha256:a0c1d96df99382bd334cd7ddaa3de2d191c5c7f166ece0c720e3791fec87350f",
+            "canonicalDigest": "sha256:fd549a1f5795524d4f7feed3a4ebcef03e3d6fe53d6ce7e8e24ff5014de9a9cd",
             "evidenceClass": "source_checkout"
           }
         ],
@@ -249,7 +250,7 @@
         "rootDefinitionDigest": "sha256:c18995fb310dbde102bea231d83ec3756ffdf863199acbc88237471d06278c9e",
         "nativeSource": {
           "path": "internal/command/adoptionmaterialization",
-          "canonicalDigest": "sha256:25fde227d9a26bc6fac85be5963b4f227e5cac06b876b14565a863ff45b40f11",
+          "canonicalDigest": "sha256:2940a39db54e51167e3f3373aa38525fc734fddc3902ac7d7ed1fdf326066cfe",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -280,17 +281,17 @@
         "nativeSources": [
           {
             "path": "internal/app",
-            "canonicalDigest": "sha256:0195a152392ad4cecd99a2d0c147ee8e25a034a32e4f730033766399a030c5c3",
+            "canonicalDigest": "sha256:7fa037cfe6147827468954667d103b27796ff43c1d1f74d81be1f545d7534a8e",
             "evidenceClass": "source_checkout"
           },
           {
             "path": "internal/command/adoptionmaterialization",
-            "canonicalDigest": "sha256:25fde227d9a26bc6fac85be5963b4f227e5cac06b876b14565a863ff45b40f11",
+            "canonicalDigest": "sha256:2940a39db54e51167e3f3373aa38525fc734fddc3902ac7d7ed1fdf326066cfe",
             "evidenceClass": "source_checkout"
           },
           {
             "path": "internal/kernel/repositorytransaction",
-            "canonicalDigest": "sha256:a0c1d96df99382bd334cd7ddaa3de2d191c5c7f166ece0c720e3791fec87350f",
+            "canonicalDigest": "sha256:fd549a1f5795524d4f7feed3a4ebcef03e3d6fe53d6ce7e8e24ff5014de9a9cd",
             "evidenceClass": "source_checkout"
           }
         ],
@@ -394,17 +395,17 @@
         "nativeSources": [
           {
             "path": "internal/app",
-            "canonicalDigest": "sha256:0195a152392ad4cecd99a2d0c147ee8e25a034a32e4f730033766399a030c5c3",
+            "canonicalDigest": "sha256:7fa037cfe6147827468954667d103b27796ff43c1d1f74d81be1f545d7534a8e",
             "evidenceClass": "source_checkout"
           },
           {
             "path": "internal/command/adoptionmaterialization",
-            "canonicalDigest": "sha256:25fde227d9a26bc6fac85be5963b4f227e5cac06b876b14565a863ff45b40f11",
+            "canonicalDigest": "sha256:2940a39db54e51167e3f3373aa38525fc734fddc3902ac7d7ed1fdf326066cfe",
             "evidenceClass": "source_checkout"
           },
           {
             "path": "internal/kernel/repositorytransaction",
-            "canonicalDigest": "sha256:a0c1d96df99382bd334cd7ddaa3de2d191c5c7f166ece0c720e3791fec87350f",
+            "canonicalDigest": "sha256:fd549a1f5795524d4f7feed3a4ebcef03e3d6fe53d6ce7e8e24ff5014de9a9cd",
             "evidenceClass": "source_checkout"
           }
         ],
@@ -1185,7 +1186,7 @@
         "nativeSources": [
           {
             "path": "internal/app",
-            "canonicalDigest": "sha256:0195a152392ad4cecd99a2d0c147ee8e25a034a32e4f730033766399a030c5c3",
+            "canonicalDigest": "sha256:7fa037cfe6147827468954667d103b27796ff43c1d1f74d81be1f545d7534a8e",
             "evidenceClass": "source_checkout"
           },
           {
@@ -1423,6 +1424,10 @@
     },
     {
       "command": "change-workflow-plan",
+      "route": [
+        "change",
+        "plan"
+      ],
       "input": "required",
       "stdin": true,
       "inputPointer": true,
@@ -2728,6 +2733,95 @@
         }
       }
     },
+    {
+      "command": "next",
+      "input": "none",
+      "stdin": false,
+      "inputPointer": false,
+      "scopeClass": "explicit_filesystem_scan",
+      "outputModes": [
+        "json",
+        "text"
+      ],
+      "allowedFlags": [
+        "--color",
+        "--format",
+        "--repo-root"
+      ],
+      "requiredFlags": [
+        "--repo-root"
+      ],
+      "singleOccurrenceFlags": [
+        "--color",
+        "--format",
+        "--repo-root"
+      ],
+      "flagChoices": {
+        "--color": [
+          "auto",
+          "never"
+        ],
+        "--format": [
+          "json",
+          "text"
+        ]
+      },
+      "flagPresenceRequirements": [
+        {
+          "flag": "--color",
+          "requiredFlagValues": [
+            {
+              "flag": "--format",
+              "value": "text"
+            }
+          ],
+          "requiredFlags": []
+        }
+      ],
+      "outputContract": {
+        "contractId": "proofkit.next.output.v1",
+        "schemaVersion": 1,
+        "rootType": "object",
+        "closed": true,
+        "rootDefinitionRef": "proofkit.next.output.v1.root-shape",
+        "rootDefinitionDigest": "sha256:b046def1ec1d608e3c76efd84127df7cd8b0a10a920e7ad9b8b850826432d3af",
+        "nativeSource": {
+          "path": "internal/command/projectstatus",
+          "canonicalDigest": "sha256:050ff57dee13ac2cc7c71ab4f2ed94c8d9a73f945544ecb57c18c07da4ed5c13",
+          "evidenceClass": "source_checkout"
+        },
+        "nativeOutputWitnessSelector": {
+          "path": "internal/app/project_status_command_test.go",
+          "test": "TestNextOutputUsesExactRootShape",
+          "command": "go test ./internal/app -run '^TestNextOutputUsesExactRootShape$'",
+          "evidenceClass": "source_checkout"
+        },
+        "compatibilitySummary": [
+          "schemaVersion=1",
+          "one non-executable next-action projection derived from the same bounded project snapshot as status",
+          "bounded text preserves exactly projectState, actionClass, executable, commandRoute, contextRef, requiredDecision, and issueCodes; packetId, snapshotId, statusRef, and nonClaims remain JSON-only",
+          "root-shape-only definition proofkit.next.output.v1.root-shape; nested fields, types, cardinalities, and native witness execution remain native-owner claims"
+        ],
+        "ownerRequirementRefs": [
+          "REQ-PROOFKIT-PACKAGE-002",
+          "REQ-PROOFKIT-QUALITY-004",
+          "REQ-PROOFKIT-WORKFLOW-012",
+          "REQ-PROOFKIT-WORKFLOW-013",
+          "REQ-PROOFKIT-WORKFLOW-014",
+          "REQ-PROOFKIT-WORKFLOW-015"
+        ],
+        "flagChoices": {
+          "--color": [
+            "auto",
+            "never"
+          ],
+          "--format": [
+            "json",
+            "text"
+          ]
+        }
+      }
+    },
     {
       "command": "obligation-decision",
       "input": "required",
@@ -2963,7 +3057,7 @@
         "nativeSources": [
           {
             "path": "internal/app",
-            "canonicalDigest": "sha256:0195a152392ad4cecd99a2d0c147ee8e25a034a32e4f730033766399a030c5c3",
+            "canonicalDigest": "sha256:7fa037cfe6147827468954667d103b27796ff43c1d1f74d81be1f545d7534a8e",
             "evidenceClass": "source_checkout"
           },
           {
@@ -6253,7 +6347,7 @@
         "rootDefinitionDigest": "sha256:3c842174dff5361e7f83166469b832805e05aa314b073c16234b5b64e346281e",
         "nativeSource": {
           "path": "internal/app",
-          "canonicalDigest": "sha256:0195a152392ad4cecd99a2d0c147ee8e25a034a32e4f730033766399a030c5c3",
+          "canonicalDigest": "sha256:7fa037cfe6147827468954667d103b27796ff43c1d1f74d81be1f545d7534a8e",
           "evidenceClass": "source_checkout"
         },
         "nativeAdmissionWitnessSelector": {
@@ -6282,7 +6376,7 @@
         "rootDefinitionDigest": "sha256:0ea95e277ebe44cd2de42c29b47c38686ac0b6b390d8965367437b3fe138e209",
         "nativeSource": {
           "path": "internal/app",
-          "canonicalDigest": "sha256:0195a152392ad4cecd99a2d0c147ee8e25a034a32e4f730033766399a030c5c3",
+          "canonicalDigest": "sha256:7fa037cfe6147827468954667d103b27796ff43c1d1f74d81be1f545d7534a8e",
           "evidenceClass": "source_checkout"
         },
         "nativeOutputWitnessSelector": {
@@ -6505,6 +6599,96 @@
         ]
       }
     },
+    {
+      "command": "status",
+      "input": "none",
+      "stdin": false,
+      "inputPointer": false,
+      "scopeClass": "explicit_filesystem_scan",
+      "outputModes": [
+        "json",
+        "text"
+      ],
+      "allowedFlags": [
+        "--color",
+        "--format",
+        "--repo-root"
+      ],
+      "requiredFlags": [
+        "--repo-root"
+      ],
+      "singleOccurrenceFlags": [
+        "--color",
+        "--format",
+        "--repo-root"
+      ],
+      "flagChoices": {
+        "--color": [
+          "auto",
+          "never"
+        ],
+        "--format": [
+          "json",
+          "text"
+        ]
+      },
+      "flagPresenceRequirements": [
+        {
+          "flag": "--color",
+          "requiredFlagValues": [
+            {
+              "flag": "--format",
+              "value": "text"
+            }
+          ],
+          "requiredFlags": []
+        }
+      ],
+      "outputContract": {
+        "contractId": "proofkit.status.output.v1",
+        "schemaVersion": 1,
+        "rootType": "object",
+        "closed": true,
+        "rootDefinitionRef": "proofkit.status.output.v1.root-shape",
+        "rootDefinitionDigest": "sha256:4d26ca7b7f6be8120fbac40519db02d8e5ae8ba7264208c714fbb9f1cb88ef15",
+        "nativeSource": {
+          "path": "internal/command/projectstatus",
+          "canonicalDigest": "sha256:050ff57dee13ac2cc7c71ab4f2ed94c8d9a73f945544ecb57c18c07da4ed5c13",
+          "evidenceClass": "source_checkout"
+        },
+        "nativeOutputWitnessSelector": {
+          "path": "internal/app/project_status_command_test.go",
+          "test": "TestStatusOutputUsesExactRootShape",
+          "command": "go test ./internal/app -run '^TestStatusOutputUsesExactRootShape$'",
+          "evidenceClass": "source_checkout"
+        },
+        "compatibilitySummary": [
+          "schemaVersion=1",
+          "bounded read-only classification over a normalized transaction, manifest, child-currentness, child-admission, and cross-record-closure observation; admitted in-bound records bind exact content digests and unread out-of-bound records bind only their invalid class",
+          "verification_required means structurally admitted and never means complete, merge-ready, release-ready, or production-ready",
+          "bounded text preserves exactly projectState, snapshotId, nextAction.actionClass, and issueCodes; project, manifest, transaction, child, closure, action-identity, and nonClaims coordinates remain JSON-only",
+          "root-shape-only definition proofkit.status.output.v1.root-shape; nested fields, types, cardinalities, and native witness execution remain native-owner claims"
+        ],
+        "ownerRequirementRefs": [
+          "REQ-PROOFKIT-PACKAGE-002",
+          "REQ-PROOFKIT-QUALITY-004",
+          "REQ-PROOFKIT-WORKFLOW-012",
+          "REQ-PROOFKIT-WORKFLOW-013",
+          "REQ-PROOFKIT-WORKFLOW-014",
+          "REQ-PROOFKIT-WORKFLOW-015"
+        ],
+        "flagChoices": {
+          "--color": [
+            "auto",
+            "never"
+          ],
+          "--format": [
+            "json",
+            "text"
+          ]
+        }
+      }
+    },
     {
       "command": "test-evidence-inventory",
       "input": "required",
@@ -10758,6 +10942,52 @@
       },
       "canonicalDigest": "sha256:218011a133540f57ef74f8748747e00d33b6757c9f77725ecef39f45fb19423f"
     },
+    {
+      "definitionId": "proofkit.next.output.v1.root-shape",
+      "schemaVersion": 1,
+      "rootType": "object",
+      "closed": true,
+      "definitionRefs": [],
+      "fieldTree": {
+        "kind": "root_shape_only",
+        "nonClaims": [
+          "Root-shape definitions do not claim nested field shapes, leaf types, cardinalities, or semantic validity.",
+          "Root-shape definitions do not replace direct public-CLI runtime witnesses for variant selection."
+        ],
+        "variants": [
+          {
+            "allowedFields": [
+              "action",
+              "issueCodes",
+              "nonClaims",
+              "packetId",
+              "packetKind",
+              "projectState",
+              "schemaVersion",
+              "snapshotId",
+              "statusRef"
+            ],
+            "requiredFields": [
+              "action",
+              "issueCodes",
+              "nonClaims",
+              "packetId",
+              "packetKind",
+              "projectState",
+              "schemaVersion",
+              "snapshotId",
+              "statusRef"
+            ],
+            "rootKind": "object",
+            "variantId": "01-root",
+            "when": [
+              "default JSON mode"
+            ]
+          }
+        ]
+      },
+      "canonicalDigest": "sha256:b046def1ec1d608e3c76efd84127df7cd8b0a10a920e7ad9b8b850826432d3af"
+    },
     {
       "definitionId": "proofkit.obligation-decision.input.v1.root-shape",
       "schemaVersion": 1,
@@ -15373,6 +15603,54 @@
       },
       "canonicalDigest": "sha256:338f720a24bd36f4ab34cad9b14d3bd26389119e5c713146f1c4eb019f4a0637"
     },
+    {
+      "definitionId": "proofkit.status.output.v1.root-shape",
+      "schemaVersion": 1,
+      "rootType": "object",
+      "closed": true,
+      "definitionRefs": [],
+      "fieldTree": {
+        "kind": "root_shape_only",
+        "nonClaims": [
+          "Root-shape definitions do not claim nested field shapes, leaf types, cardinalities, or semantic validity.",
+          "Root-shape definitions do not replace direct public-CLI runtime witnesses for variant selection."
+        ],
+        "variants": [
+          {
+            "allowedFields": [
+              "issueCodes",
+              "manifestId",
+              "nextAction",
+              "nonClaims",
+              "projectId",
+              "projectState",
+              "reportKind",
+              "schemaVersion",
+              "snapshotId",
+              "statusId"
+            ],
+            "requiredFields": [
+              "issueCodes",
+              "manifestId",
+              "nextAction",
+              "nonClaims",
+              "projectId",
+              "projectState",
+              "reportKind",
+              "schemaVersion",
+              "snapshotId",
+              "statusId"
+            ],
+            "rootKind": "object",
+            "variantId": "01-root",
+            "when": [
+              "default JSON mode"
+            ]
+          }
+        ]
+      },
+      "canonicalDigest": "sha256:4d26ca7b7f6be8120fbac40519db02d8e5ae8ba7264208c714fbb9f1cb88ef15"
+    },
     {
       "definitionId": "proofkit.test-evidence-inventory.input.v2.root-shape",
       "schemaVersion": 2,

package/proofkit/command-families.v1.json

@@ -68,6 +68,15 @@
         "migration-plan"
       ]
     },
+    {
+      "familyId": "project-state-navigation",
+      "label": "Project state navigation",
+      "purpose": "Classify a materialized project and expose one bounded next action.",
+      "commands": [
+        "next",
+        "status"
+      ]
+    },
     {
       "familyId": "proof-artifact-governance",
       "label": "Proof artifact governance",

package/proofkit/requirement-bindings.json

@@ -776,6 +776,14 @@
       "proofState": "witness_backed",
       "nonClaims": ["A source-bound version edge does not authenticate registry publication, provider ingestion, consumer adoption, native witness truth, rollout, or production readiness."]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-035",
+      "ownerId": "proofkit.spec-proof-core",
+      "specPath": "docs/specs/proofkit-spec-proof-core/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["A source-bound version edge does not authenticate registry publication, provider ingestion, consumer migration, native witness truth, rollout, or production readiness."]
+    },
     {
       "requirementId": "REQ-PROOFKIT-WORKFLOW-001",
       "ownerId": "proofkit.agent-workflow",
@@ -863,6 +871,42 @@
       "claimLevel": "blocking",
       "proofState": "witness_backed",
       "nonClaims": ["Public-surface closure does not claim wheel documentation parity and does not prove registry publication, provider ingestion, compatibility on untested platforms, native witness truth, merge approval, rollout, or production readiness."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-012",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["Project status classifies the observed materialized-project snapshot and can become stale immediately after emission; it does not prove native witness execution or complete any declared proof scope."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-013",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["A coherent read snapshot does not prevent later filesystem mutation, authenticate repository ownership, provide power-loss or multi-reader atomicity, exclude a same-user writer that bypasses the repository transaction owner, identify unread out-of-bound record bytes beyond their normalized invalid class, or prevent the filesystem from updating read-side metadata such as access time."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-014",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": ["A next-action packet is derived guidance; it does not execute, authorize, or prove the proposed action."]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-015",
+      "ownerId": "proofkit.agent-workflow",
+      "specPath": "docs/specs/proofkit-agent-workflow/requirements.v1.json",
+      "claimLevel": "blocking",
+      "proofState": "witness_backed",
+      "nonClaims": [
+        "A caller-provided stdout writer that accepts a prefix and then fails does not provide an atomic sink, so Proofkit does not claim that such a transport leaves stdout empty.",
+        "CLI surface closure does not prove registry publication, provider ingestion, consumer migration, native witness truth, rollout, or production readiness.",
+        "Cancellation racing after the final pre-emission checkpoint cannot retract bytes subsequently accepted by an external writer."
+      ]
     }
   ],
   "bindings": [
@@ -1231,6 +1275,29 @@
         "local-go"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-PACKAGE-002",
+      "scenarioId": "proofkit.package-boundary.project-status-output-root-witnesses",
+      "witnessId": "proofkit.project-status.cli-output-root.exact-witnesses",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/project_status_command_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestNextOutputUsesExactRootShape",
+          "command": "go test ./internal/app -run '^TestNextOutputUsesExactRootShape$'"
+        },
+        {
+          "selector": "TestStatusOutputUsesExactRootShape",
+          "command": "go test ./internal/app -run '^TestStatusOutputUsesExactRootShape$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-PACKAGE-003",
       "scenarioId": "proofkit.package-boundary.outside-consumer-artifact",
@@ -2528,6 +2595,29 @@
         "local-go"
       ]
     },
+    {
+      "requirementId": "REQ-PROOFKIT-QUALITY-004",
+      "scenarioId": "proofkit.supply-chain-quality.project-status-cli-abi",
+      "witnessId": "proofkit.project-status.cli-abi.exact-output",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/project_status_command_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestNextOutputUsesExactRootShape",
+          "command": "go test ./internal/app -run '^TestNextOutputUsesExactRootShape$'"
+        },
+        {
+          "selector": "TestStatusOutputUsesExactRootShape",
+          "command": "go test ./internal/app -run '^TestStatusOutputUsesExactRootShape$'"
+        }
+      ],
+      "commandIds": [
+        "proofkit.go-test"
+      ],
+      "environmentClasses": [
+        "local-go"
+      ]
+    },
     {
       "requirementId": "REQ-PROOFKIT-QUALITY-004",
       "scenarioId": "proofkit.supply-chain-quality.cli-contract-topology",
@@ -5857,6 +5947,10 @@
           "selector": "TestGrammarBoundariesAreExact",
           "command": "go test ./internal/kernel/commandroute -run '^TestGrammarBoundariesAreExact$'"
         },
+        {
+          "selector": "TestOmittedRoutePolicyUsesStableCommandIdentity",
+          "command": "go test ./internal/kernel/commandroute -run '^TestOmittedRoutePolicyUsesStableCommandIdentity$'"
+        },
         {
           "selector": "TestParseRequiresCanonicalSeparatorAndRoundTrip",
           "command": "go test ./internal/kernel/commandroute -run '^TestParseRequiresCanonicalSeparatorAndRoundTrip$'"
@@ -6145,6 +6239,398 @@
       ],
       "commandIds": ["proofkit.go-test"],
       "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-035",
+      "scenarioId": "proofkit.spec-proof-core.project-navigation-version-edge",
+      "witnessId": "proofkit.project-navigation.version-edge-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/project_navigation_version_edge_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestProjectNavigationVersionEdgeClosesPublicRoutes",
+          "command": "go test ./internal/app -run '^TestProjectNavigationVersionEdgeClosesPublicRoutes$'"
+        },
+        {
+          "selector": "TestProjectNavigationVersionEdgeRejectsCoordinatedChangeRecordDrift",
+          "command": "go test ./internal/app -run '^TestProjectNavigationVersionEdgeRejectsCoordinatedChangeRecordDrift$'"
+        },
+        {
+          "selector": "TestProjectNavigationVersionEdgePreservesFrozenPredecessor",
+          "command": "go test ./internal/app -run '^TestProjectNavigationVersionEdgePreservesFrozenPredecessor$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-035",
+      "scenarioId": "proofkit.spec-proof-core.project-navigation-public-abi-diff",
+      "witnessId": "proofkit.project-navigation.public-abi-diff-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/project_navigation_abi_closure_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestProjectNavigationVersionEdgeClosesCompletePublicABIDiff",
+          "command": "go test ./internal/app -run '^TestProjectNavigationVersionEdgeClosesCompletePublicABIDiff$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-SPEC-035",
+      "scenarioId": "proofkit.spec-proof-core.project-navigation-public-abi-diff-mutations",
+      "witnessId": "proofkit.project-navigation.public-abi-diff-mutation-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/project_navigation_abi_mutation_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestProjectNavigationVersionEdgeRejectsUndeclaredPublicABIDrift",
+          "command": "go test ./internal/app -run '^TestProjectNavigationVersionEdgeRejectsUndeclaredPublicABIDrift$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-012",
+      "scenarioId": "proofkit.agent-workflow.project-state-total-classification",
+      "witnessId": "proofkit.project-state.total-classification-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/projectstatus/projectstatus_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestEvaluateTotalStateActionTable",
+          "command": "go test ./internal/command/projectstatus -run '^TestEvaluateTotalStateActionTable$'"
+        },
+        {
+          "selector": "TestOutputAdmissionRejectsUnreachableClosureCombination",
+          "command": "go test ./internal/command/projectstatus -run '^TestOutputAdmissionRejectsUnreachableClosureCombination$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-012",
+      "scenarioId": "proofkit.agent-workflow.project-state-child-admission-owner",
+      "witnessId": "proofkit.project-state.child-admission-owner-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/projectstatus/dependency_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestProjectStatusDelegatesChildAdmissionToMaterializationOwner",
+          "command": "go test ./internal/command/projectstatus -run '^TestProjectStatusDelegatesChildAdmissionToMaterializationOwner$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-012",
+      "scenarioId": "proofkit.agent-workflow.project-state-child-owner-delegation",
+      "witnessId": "proofkit.project-state.child-owner-delegation-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/adoptionmaterialization/project_closure_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestAdmitMaterializedProjectRoutesEveryManifestArtifactKindThroughItsOwner",
+          "command": "go test ./internal/command/adoptionmaterialization -run '^TestAdmitMaterializedProjectRoutesEveryManifestArtifactKindThroughItsOwner$'"
+        },
+        {
+          "selector": "TestMaterializedProjectRecordSnapshotDoesNotAliasCallerInput",
+          "command": "go test ./internal/command/adoptionmaterialization -run '^TestMaterializedProjectRecordSnapshotDoesNotAliasCallerInput$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-013",
+      "scenarioId": "proofkit.agent-workflow.project-state-bounded-inspection",
+      "witnessId": "proofkit.project-state.bounded-inspection-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/projectstatus/inspect_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestInspectClassifiesMaterializedProjectWithoutApplicationWrites",
+          "command": "go test ./internal/command/projectstatus -run '^TestInspectClassifiesMaterializedProjectWithoutApplicationWrites$'"
+        },
+        {
+          "selector": "TestInspectFailsClosedOnSymlinksAndBoundsWithoutDisclosure",
+          "command": "go test ./internal/command/projectstatus -run '^TestInspectFailsClosedOnSymlinksAndBoundsWithoutDisclosure$'"
+        },
+        {
+          "selector": "TestInspectRejectsCaseAliasedCanonicalRoute",
+          "command": "go test ./internal/command/projectstatus -run '^TestInspectRejectsCaseAliasedCanonicalRoute$'"
+        },
+        {
+          "selector": "TestInspectCohortValidationClosesCleanEpochABA",
+          "command": "go test ./internal/command/projectstatus -run '^TestInspectCohortValidationClosesCleanEpochABA$'"
+        },
+        {
+          "selector": "TestInspectCleanupFailureDominatesRetryableSnapshotChange",
+          "command": "go test ./internal/command/projectstatus -run '^TestInspectCleanupFailureDominatesRetryableSnapshotChange$'"
+        },
+        {
+          "selector": "TestInspectMapsRecoverableControlState",
+          "command": "go test ./internal/command/projectstatus -run '^TestInspectMapsRecoverableControlState$'"
+        },
+        {
+          "selector": "TestInspectMapsInvalidControlState",
+          "command": "go test ./internal/command/projectstatus -run '^TestInspectMapsInvalidControlState$'"
+        },
+        {
+          "selector": "TestInspectAttemptRejectsFinalRepositoryRootReplacement",
+          "command": "go test ./internal/command/projectstatus -run '^TestInspectAttemptRejectsFinalRepositoryRootReplacement$'"
+        },
+        {
+          "selector": "TestInspectRejectsAdmittedChildrenWithInvalidCrossRecordClosure",
+          "command": "go test ./internal/command/projectstatus -run '^TestInspectRejectsAdmittedChildrenWithInvalidCrossRecordClosure$'"
+        },
+        {
+          "selector": "TestInspectRejectsChangingControlEpochAcrossBothAttempts",
+          "command": "go test ./internal/command/projectstatus -run '^TestInspectRejectsChangingControlEpochAcrossBothAttempts$'"
+        },
+        {
+          "selector": "TestReadProjectFileEnforcesAggregateBoundBeforeRead",
+          "command": "go test ./internal/command/projectstatus -run '^TestReadProjectFileEnforcesAggregateBoundBeforeRead$'"
+        },
+        {
+          "selector": "TestReadProjectFileRejectsSameByteRouteReplacement",
+          "command": "go test ./internal/command/projectstatus -run '^TestReadProjectFileRejectsSameByteRouteReplacement$'"
+        },
+        {
+          "selector": "TestInspectDeduplicatesRepeatedIssueCodes",
+          "command": "go test ./internal/command/projectstatus -run '^TestInspectDeduplicatesRepeatedIssueCodes$'"
+        },
+        {
+          "selector": "TestInspectHonorsCancellationBetweenBoundedReads",
+          "command": "go test ./internal/command/projectstatus -run '^TestInspectHonorsCancellationBetweenBoundedReads$'"
+        },
+        {
+          "selector": "TestInspectHonorsCancellationAfterFinalControlObservation",
+          "command": "go test ./internal/command/projectstatus -run '^TestInspectHonorsCancellationAfterFinalControlObservation$'"
+        },
+        {
+          "selector": "TestOutOfBoundManifestIdentityIsAClassificationNotByteIdentity",
+          "command": "go test ./internal/command/projectstatus -run '^TestOutOfBoundManifestIdentityIsAClassificationNotByteIdentity$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-013",
+      "scenarioId": "proofkit.agent-workflow.project-state-application-write-free-topology",
+      "witnessId": "proofkit.project-state.application-write-free-topology-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/projectstatus/dependency_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestProjectStatusProductionTopologyForbidsRepositoryMutationCalls",
+          "command": "go test ./internal/command/projectstatus -run '^TestProjectStatusProductionTopologyForbidsRepositoryMutationCalls$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-013",
+      "scenarioId": "proofkit.agent-workflow.project-state-control-file-coherence",
+      "witnessId": "proofkit.project-state.control-file-coherence-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/repositorytransaction/control_inspection_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestInspectControlFileRejectsGrowthAfterRoutePreflight",
+          "command": "go test ./internal/kernel/repositorytransaction -run '^TestInspectControlFileRejectsGrowthAfterRoutePreflight$'"
+        },
+        {
+          "selector": "TestInspectControlFileRejectsSameByteRouteReplacement",
+          "command": "go test ./internal/kernel/repositorytransaction -run '^TestInspectControlFileRejectsSameByteRouteReplacement$'"
+        },
+        {
+          "selector": "TestInspectionLeaseDoesNotResolveAReplacementRoot",
+          "command": "go test ./internal/kernel/repositorytransaction -run '^TestInspectionLeaseDoesNotResolveAReplacementRoot$'"
+        },
+        {
+          "selector": "TestInspectionLeaseRejectsControlNamespaceCreatedAfterOpen",
+          "command": "go test ./internal/kernel/repositorytransaction -run '^TestInspectionLeaseRejectsControlNamespaceCreatedAfterOpen$'"
+        },
+        {
+          "selector": "TestInspectionLeasePinsRootAndExcludesCooperativeWriter",
+          "command": "go test ./internal/kernel/repositorytransaction -run '^TestInspectionLeasePinsRootAndExcludesCooperativeWriter$'"
+        },
+        {
+          "selector": "TestInspectionLeaseExportsOnlyReadOnlyFileCapability",
+          "command": "go test ./internal/kernel/repositorytransaction -run '^TestInspectionLeaseExportsOnlyReadOnlyFileCapability$'"
+        },
+        {
+          "selector": "TestInspectionLeaseFileCannotBeReassertedAsMutable",
+          "command": "go test ./internal/kernel/repositorytransaction -run '^TestInspectionLeaseFileCannotBeReassertedAsMutable$'"
+        },
+        {
+          "selector": "TestInspectControlStateRejectsPartialControlObservations",
+          "command": "go test ./internal/kernel/repositorytransaction -run '^TestInspectControlStateRejectsPartialControlObservations$'"
+        },
+        {
+          "selector": "TestInspectControlStateHashesSymlinkTargetsWithoutDisclosingThem",
+          "command": "go test ./internal/kernel/repositorytransaction -run '^TestInspectControlStateHashesSymlinkTargetsWithoutDisclosingThem$'"
+        },
+        {
+          "selector": "TestInspectControlStateRejectsClassificationChangeHiddenByPortableNameIdentity",
+          "command": "go test ./internal/kernel/repositorytransaction -run '^TestInspectControlStateRejectsClassificationChangeHiddenByPortableNameIdentity$'"
+        },
+        {
+          "selector": "TestInspectControlStateUsesPortableObservationFields",
+          "command": "go test ./internal/kernel/repositorytransaction -run '^TestInspectControlStateUsesPortableObservationFields$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-013",
+      "scenarioId": "proofkit.agent-workflow.project-state-exact-route-traversal",
+      "witnessId": "proofkit.project-state.exact-route-traversal-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/kernel/rootpath/exact_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestOpenExactRegularFileRejectsParentSymlinkABA",
+          "command": "go test ./internal/kernel/rootpath -run '^TestOpenExactRegularFileRejectsParentSymlinkABA$'"
+        },
+        {
+          "selector": "TestOpenExactRegularFileRejectsFinalComponentABA",
+          "command": "go test ./internal/kernel/rootpath -run '^TestOpenExactRegularFileRejectsFinalComponentABA$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-014",
+      "scenarioId": "proofkit.agent-workflow.project-next-action-output-closure",
+      "witnessId": "proofkit.project-next-action.output-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/command/projectstatus/projectstatus_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestEvaluateTotalStateActionTable",
+          "command": "go test ./internal/command/projectstatus -run '^TestEvaluateTotalStateActionTable$'"
+        },
+        {
+          "selector": "TestOutputAdmissionRejectsReidentifiedStateActionMismatch",
+          "command": "go test ./internal/command/projectstatus -run '^TestOutputAdmissionRejectsReidentifiedStateActionMismatch$'"
+        },
+        {
+          "selector": "TestTextProjectionIsBoundedAndSemanticallyDerived",
+          "command": "go test ./internal/command/projectstatus -run '^TestTextProjectionIsBoundedAndSemanticallyDerived$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-015",
+      "scenarioId": "proofkit.agent-workflow.project-navigation-public-cli",
+      "witnessId": "proofkit.project-navigation.public-cli-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/project_status_command_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestNextCLI",
+          "command": "go test ./internal/app -run '^TestNextCLI$'"
+        },
+        {
+          "selector": "TestProjectStatusCLI",
+          "command": "go test ./internal/app -run '^TestProjectStatusCLI$'"
+        },
+        {
+          "selector": "TestProjectStatusCLIHonorsCanceledContextBeforeOutput",
+          "command": "go test ./internal/app -run '^TestProjectStatusCLIHonorsCanceledContextBeforeOutput$'"
+        },
+        {
+          "selector": "TestProjectStatusOutputMatrix",
+          "command": "go test ./internal/app -run '^TestProjectStatusOutputMatrix$'"
+        },
+        {
+          "selector": "TestProjectStatusTransportFailureUsesOneBoundedWriteWithoutAtomicSinkClaim",
+          "command": "go test ./internal/app -run '^TestProjectStatusTransportFailureUsesOneBoundedWriteWithoutAtomicSinkClaim$'"
+        },
+        {
+          "selector": "TestStatusCLI",
+          "command": "go test ./internal/app -run '^TestStatusCLI$'"
+        }
+      ],
+      "commandIds": ["proofkit.command-contract-check", "proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-015",
+      "scenarioId": "proofkit.agent-workflow.project-navigation-installed-carriers",
+      "witnessId": "proofkit.project-navigation.installed-carrier-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/workflowsmoke/workflow_smoke_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestVerifyAcceptsApplicationCLI",
+          "command": "go test ./internal/tools/workflowsmoke -run '^TestVerifyAcceptsApplicationCLI$'"
+        },
+        {
+          "selector": "TestVerifyRejectsCarrierContractMutations",
+          "command": "go test ./internal/tools/workflowsmoke -run '^TestVerifyRejectsCarrierContractMutations$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test", "proofkit.package-artifact"],
+      "environmentClasses": ["local-go", "local-go-python"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-015",
+      "scenarioId": "proofkit.agent-workflow.project-navigation-installed-npm-carrier-closure",
+      "witnessId": "proofkit.project-navigation.installed-npm-carrier-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/packageverify/workflow_carrier_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestInstalledNPMWorkflowCarrierClosure",
+          "command": "go test ./internal/tools/packageverify -run '^TestInstalledNPMWorkflowCarrierClosure$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-015",
+      "scenarioId": "proofkit.agent-workflow.project-navigation-installed-wheel-carrier-closure",
+      "witnessId": "proofkit.project-navigation.installed-wheel-carrier-closure-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/tools/pythonpackage/workflow_carrier_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestInstalledPythonWorkflowCarrierClosure",
+          "command": "go test ./internal/tools/pythonpackage -run '^TestInstalledPythonWorkflowCarrierClosure$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
+    },
+    {
+      "requirementId": "REQ-PROOFKIT-WORKFLOW-015",
+      "scenarioId": "proofkit.agent-workflow.project-navigation-version-edge",
+      "witnessId": "proofkit.project-navigation.public-version-edge-falsifier",
+      "witnessKind": "contract",
+      "witnessPath": "internal/app/project_navigation_version_edge_test.go",
+      "witnessSelectors": [
+        {
+          "selector": "TestProjectNavigationVersionEdgeClosesPublicRoutes",
+          "command": "go test ./internal/app -run '^TestProjectNavigationVersionEdgeClosesPublicRoutes$'"
+        }
+      ],
+      "commandIds": ["proofkit.go-test"],
+      "environmentClasses": ["local-go"]
     }
   ],
   "witnessCommands": [