devrites 5.14.0 → 5.14.1

package/engine/internal/overhaul/bench/stats.go

@@ -0,0 +1,154 @@
+package bench
+
+import (
+	"math"
+	"sort"
+)
+
+// uNull returns P(U = u) for u = 0..n*m under the Mann-Whitney null with arm
+// sizes n and m, from the generating function prod_i (1-q^(m+i))/(1-q^i).
+// Cancellation leaves the upper half inaccurate; only the lower tail is read.
+func uNull(n, m int) []float64 {
+	c := make([]float64, n*m+1)
+	c[0] = 1
+	for i := 1; i <= n; i++ {
+		for u := len(c) - 1; u >= m+i; u-- {
+			c[u] -= c[u-m-i]
+		}
+		for u := i; u < len(c); u++ {
+			c[u] += c[u-i]
+		}
+	}
+	total := 0.0
+	for _, v := range c {
+		total += v
+	}
+	for i := range c {
+		c[i] /= total
+	}
+	return c
+}
+
+// exactLimit bounds the arm sizes for the exact null distribution, well inside
+// float64 range and cheap to compute; beyond it the (slightly conservative)
+// normal approximation takes over.
+const exactLimit = 400
+
+// maxPairs caps n*m for the pairwise differences, which are held in memory.
+const maxPairs = 4_000_000
+
+// tailCount returns the largest k with P(U <= k-1) <= alpha/2: the pairwise
+// differences D_(1..k-1) and D_(nm-k+2..nm) fall outside a (1-alpha) interval,
+// whose endpoints are D_(k) and D_(nm+1-k). Zero means no finite interval.
+func tailCount(n, m int, alpha float64) int {
+	if n+m <= exactLimit {
+		p, cum, k := uNull(n, m), 0.0, 0
+		for u := range p {
+			if cum += p[u]; cum > alpha/2 {
+				break
+			}
+			k = u + 1
+		}
+		return k
+	}
+	mean := float64(n*m) / 2
+	sd := math.Sqrt(float64(n*m*(n+m+1)) / 12)
+	return max(0, int(math.Floor(mean-normalQuantile(1-alpha/2)*sd-0.5))+1)
+}
+
+// hlRatio is the Hodges-Lehmann ratio estimate exp(median(ln x_i - ln y_j))
+// with its distribution-free (1-alpha) bounds. ok is false when a sample is
+// not positive or the arms are too small for a finite interval.
+func hlRatio(x, y []float64, alpha float64) (est, lo, hi float64, ok bool) {
+	if len(x)*len(y) > maxPairs {
+		return 0, 0, 0, false
+	}
+	z := make([]float64, 0, len(x)*len(y))
+	for _, a := range x {
+		for _, b := range y {
+			if a <= 0 || b <= 0 {
+				return 0, 0, 0, false
+			}
+			z = append(z, math.Log(a)-math.Log(b))
+		}
+	}
+	k := tailCount(len(x), len(y), alpha)
+	if k == 0 {
+		return 0, 0, 0, false
+	}
+	sort.Float64s(z)
+	return math.Exp(median(z)), math.Exp(z[k-1]), math.Exp(z[len(z)-k]), true
+}
+
+// quantileBounds returns one-sided (1-alpha) distribution-free bounds for the
+// p-quantile of xs from its order statistics; a missing bound is ±Inf. With
+// F(j) = P(Bin(n, p) <= j), the upper bound is x_(k) for the smallest k with
+// F(k-1) >= 1-alpha and the lower bound x_(j) for the largest j with
+// F(j-1) <= alpha.
+func quantileBounds(xs []float64, p, alpha float64) (lcb, ucb float64) {
+	s := append([]float64(nil), xs...)
+	sort.Float64s(s)
+	n := len(s)
+	lcb, ucb = math.Inf(-1), math.Inf(1)
+	lg := func(k int) float64 { v, _ := math.Lgamma(float64(k) + 1); return v }
+	cdf := 0.0
+	for i := 0; i < n; i++ { // cdf = F(i) after this step
+		cdf += math.Exp(lg(n) - lg(i) - lg(n-i) + float64(i)*math.Log(p) + float64(n-i)*math.Log1p(-p))
+		if cdf <= alpha {
+			lcb = s[i] // j = i+1
+		}
+		if cdf >= 1-alpha {
+			ucb = s[i] // k = i+1
+			break
+		}
+	}
+	return lcb, ucb
+}
+
+// quantile7 is the linearly interpolated sample quantile (Hyndman-Fan type 7).
+func quantile7(xs []float64, p float64) float64 {
+	s := append([]float64(nil), xs...)
+	sort.Float64s(s)
+	h := p * float64(len(s)-1)
+	i := int(math.Floor(h))
+	if i+1 >= len(s) {
+		return s[len(s)-1]
+	}
+	return s[i] + (h-float64(i))*(s[i+1]-s[i])
+}
+
+// wilson returns the Wilson score interval for e events in n trials.
+func wilson(p float64, n, z float64) (lo, hi float64) {
+	d := 1 + z*z/n
+	c := (p + z*z/(2*n)) / d
+	h := z * math.Sqrt(p*(1-p)/n+z*z/(4*n*n)) / d
+	return max(0, c-h), min(1, c+h)
+}
+
+// newcombe returns the hybrid score interval (Newcombe 1998, method 10) for
+// p1 - p2 from proportions over n1 and n2 trials.
+func newcombe(p1, n1, p2, n2, z float64) (lo, hi float64) {
+	l1, u1 := wilson(p1, n1, z)
+	l2, u2 := wilson(p2, n2, z)
+	d := p1 - p2
+	return d - math.Sqrt((p1-l1)*(p1-l1)+(u2-p2)*(u2-p2)), d + math.Sqrt((u1-p1)*(u1-p1)+(p2-l2)*(p2-l2))
+}
+
+// normalQuantile is the standard normal inverse CDF (Acklam's rational
+// approximation, relative error below 1.2e-9).
+func normalQuantile(p float64) float64 {
+	a := []float64{-3.969683028665376e+01, 2.209460984245205e+02, -2.759285104469687e+02, 1.383577518672690e+02, -3.066479806614716e+01, 2.506628277459239e+00}
+	b := []float64{-5.447609879822406e+01, 1.615858368580409e+02, -1.556989798598866e+02, 6.680131188771972e+01, -1.328068155288572e+01}
+	c := []float64{-7.784894002430293e-03, -3.223964580411365e-01, -2.400758277161838e+00, -2.549732539343734e+00, 4.374664141464968e+00, 2.938163982698783e+00}
+	d := []float64{7.784695709041462e-03, 3.224671290700398e-01, 2.445134137142996e+00, 3.754408661907416e+00}
+	switch {
+	case p < 0.02425:
+		q := math.Sqrt(-2 * math.Log(p))
+		return (((((c[0]*q+c[1])*q+c[2])*q+c[3])*q+c[4])*q + c[5]) / ((((d[0]*q+d[1])*q+d[2])*q+d[3])*q + 1)
+	case p > 1-0.02425:
+		return -normalQuantile(1 - p)
+	}
+	q := p - 0.5
+	r := q * q
+	return (((((a[0]*r+a[1])*r+a[2])*r+a[3])*r+a[4])*r + a[5]) * q / (((((b[0]*r+b[1])*r+b[2])*r+b[3])*r+b[4])*r + 1)
+}

package/engine/internal/overhaul/ovio/ovio.go

@@ -156,3 +156,7 @@ func Truthy(v any) bool {
 	}
 	return true
 }
+
+// Domains is the fixed set of score domains in their documented order. Findings,
+// receipts, the applicability matrix and the rubric all use these keys.
+var Domains = []string{"correctness", "security", "reliability", "performance", "tests", "architecture", "ux", "operations"}

package/engine/internal/overhaul/records/check.go

@@ -580,6 +580,9 @@ func Check(run, genDir, prevDir string) ([]string, error) {
 			add("run.json: readiness_verdict differs from scorecard.json")
 		}
 	}
+	if err := consistency(run, genDir, R, add); err != nil {
+		return nil, err
+	}
 	ap := ovio.List(R["approval.json"]["events"])
 	uniq(ap, idKey, "approval", add)
 	stopAt := -1

package/engine/internal/overhaul/records/consistency.go

@@ -0,0 +1,217 @@
+package records
+
+import (
+	"encoding/json"
+	"slices"
+
+	"github.com/devrites/devrites/internal/overhaul/ovio"
+)
+
+var (
+	jsonZero      = any(json.Number("0"))
+	domains       = set(ovio.Domains...)
+	cellStates    = set("applicable", "not-applicable", "blocked")
+	rangeStates   = set("inventoried", "tool-scanned", "semantically-reviewed", "cross-boundary-reviewed", "verified", "excluded", "blocked")
+	reviewedRange = set("semantically-reviewed", "cross-boundary-reviewed", "verified", "excluded")
+	openFinding   = set("confirmed", "approved-for-fix", "in-progress", "fixed-unverified", "deferred", "accepted-risk")
+	serious       = set("critical", "high")
+)
+
+// consistency checks that findings, the coverage ledger, the applicability
+// matrix, the control results and the recorded gates agree with each other, so
+// a gate or control cannot claim PASS against the run's own records.
+func consistency(run, genDir string, R map[string]map[string]any, add func(string, ...any)) error {
+	controls, err := rubricControls(run, R["run.json"])
+	if err != nil {
+		return err
+	}
+	fs := ovio.List(R["findings.json"]["findings"])
+	for _, it := range fs {
+		f := ovio.Obj(it)
+		fid := PyStr(f["id"])
+		if !domains[str(f, "domain")] {
+			add("finding %s: domain must be one of %s", fid, Repr(ovio.Domains))
+		}
+		if controls == nil {
+			continue
+		}
+		cs := ovio.List(f["controls"])
+		if len(cs) == 0 && severityOK[str(f, "status")] {
+			add("finding %s: a confirmed finding names the rubric controls it fails", fid)
+		}
+		for _, c := range cs {
+			if !controls.has(c) {
+				add("finding %s: unknown control %s", fid, PyStr(c))
+			}
+		}
+	}
+
+	cov := R["coverage.json"]
+	cells := ovio.List(cov["applicability"])
+	seen := vset{}
+	for _, it := range cells {
+		c := ovio.Obj(it)
+		key := Repr([]any{c["domain"], c["component"], c["lane"]})
+		if seen.has(key) {
+			add("applicability %s: duplicate cell", key)
+		}
+		seen.add(key)
+		if !domains[str(c, "domain")] || str(c, "component") == "" || str(c, "lane") == "" {
+			add("applicability %s: needs a known domain, a component and a lane", key)
+		}
+		st := str(c, "state")
+		if !cellStates[st] {
+			add("applicability %s: state must be applicable, not-applicable or blocked", key)
+		}
+		if st != "applicable" && !ovio.Truthy(c["reason"]) {
+			add("applicability %s: %s needs a reason", key, st)
+		}
+		for _, r := range ovio.List(c["receipts"]) {
+			if p := ovio.Str(r); p == "" || !inside(run, p) || !isFile(join(run, p)) {
+				add("applicability %s: receipt %s missing or outside the run dir", key, PyStr(r))
+			}
+		}
+	}
+	for _, it := range ovio.List(cov["files"]) {
+		for _, r := range ovio.List(ovio.Obj(it)["ranges"]) {
+			if st := str(ovio.Obj(r), "state"); !rangeStates[st] {
+				add("coverage %s: range state %s is not a coverage state", PyStr(ovio.Obj(it)["path"]), Repr(st))
+			}
+		}
+	}
+
+	results := ""
+	for _, name := range []string{"results-candidate.json", "results-baseline.json"} {
+		if isFile(join(genDir, name)) {
+			results = name
+			break
+		}
+	}
+	if results != "" {
+		doc, err := ovio.LoadObject(join(genDir, results))
+		if err != nil {
+			return err
+		}
+		res := ovio.Obj(doc["results"])
+		for _, it := range fs {
+			f := ovio.Obj(it)
+			if !openFinding[str(f, "status")] {
+				continue
+			}
+			for _, c := range ovio.List(f["controls"]) {
+				if str(ovio.Obj(res[ovio.Str(c)]), "status") == "PASS" {
+					add("finding %s: control %s is PASS in %s while the finding is %s",
+						PyStr(f["id"]), PyStr(c), results, str(f, "status"))
+				}
+			}
+		}
+	}
+
+	scp := join(genDir, "scorecard.json")
+	if !isFile(scp) {
+		return nil
+	}
+	sc, err := ovio.LoadObject(scp)
+	if err != nil {
+		return err
+	}
+	gates := ovio.Obj(sc["gates"])
+	claims := func(g string) bool { return str(gates, g) == "PASS" }
+	for _, it := range fs {
+		f := ovio.Obj(it)
+		fid, status := PyStr(f["id"]), str(f, "status")
+		if claims("G-NO-CRITICAL-HIGH") && openFinding[status] && serious[str(f, "severity")] {
+			add("scorecard: G-NO-CRITICAL-HIGH is PASS but finding %s is %s %s", fid, status, str(f, "severity"))
+		}
+		if claims("G-NO-OPEN-SERIOUS-LEAD") && (status == "candidate" || status == "needs-validation") &&
+			serious[str(f, "potential_impact")] {
+			add("scorecard: G-NO-OPEN-SERIOUS-LEAD is PASS but lead %s is open with potential impact %s", fid, str(f, "potential_impact"))
+		}
+	}
+	if !claims("G-COVERAGE") {
+		return nil
+	}
+	admitted := map[string]bool{}
+	for _, it := range ovio.List(R["dispatch.json"]["attempts"]) {
+		if x := ovio.Obj(it); str(x, "status") == "admitted" {
+			admitted[str(x, "receipt")] = true
+		}
+	}
+	if len(cells) == 0 {
+		add("scorecard: G-COVERAGE is PASS without an applicability matrix in coverage.json")
+	}
+	for _, it := range cells {
+		c := ovio.Obj(it)
+		key := Repr([]any{c["domain"], c["component"], c["lane"]})
+		switch str(c, "state") {
+		case "blocked":
+			add("scorecard: G-COVERAGE is PASS but applicability %s is blocked", key)
+		case "applicable":
+			if !checkedBy(run, str(c, "domain"), ovio.List(c["receipts"]), admitted) {
+				add("scorecard: G-COVERAGE is PASS but no admitted, non-gap receipt of applicability %s lists %s in domains_checked", key, str(c, "domain"))
+			}
+		}
+	}
+	for _, it := range ovio.List(cov["files"]) {
+		f := ovio.Obj(it)
+		if !ovio.Truthy(f["eligible"]) {
+			continue
+		}
+		rs := ovio.List(f["ranges"])
+		done := len(rs) > 0 || eq(f["lines"], jsonZero)
+		for _, r := range rs {
+			done = done && reviewedRange[str(ovio.Obj(r), "state")]
+		}
+		if !done {
+			add("scorecard: G-COVERAGE is PASS but eligible file %s has unreviewed ranges", PyStr(f["path"]))
+		}
+	}
+	return nil
+}
+
+// checkedBy reports whether any admitted, non-gap receipt records domain in
+// domains_checked.
+func checkedBy(run, domain string, receipts []any, admitted map[string]bool) bool {
+	for _, r := range receipts {
+		p := ovio.Str(r)
+		if !admitted[p] || !inside(run, p) || !isFile(join(run, p)) {
+			continue
+		}
+		rc, err := ovio.LoadObject(join(run, p))
+		if err != nil || str(rc, "outcome") == "gap" {
+			continue
+		}
+		if slices.ContainsFunc(ovio.List(rc["domains_checked"]), func(d any) bool { return d == any(domain) }) {
+			return true
+		}
+	}
+	return false
+}
+
+// rubricControls returns the control IDs of the run's rubric (revisions.rubric,
+// else the plan's pinned rubric), or nil when no rubric is frozen yet.
+func rubricControls(run string, rj map[string]any) (vset, error) {
+	revs := ovio.Obj(rj["revisions"])
+	rf := str(ovio.Obj(revs["rubric"]), "file")
+	if rf == "" {
+		if pf := str(ovio.Obj(revs["plan"]), "file"); pf != "" && inside(run, pf) && isFile(join(run, pf)) {
+			plan, err := ovio.LoadObject(join(run, pf))
+			if err != nil {
+				return nil, err
+			}
+			rf = str(ovio.Obj(plan["rubric"]), "file")
+		}
+	}
+	if rf == "" || !inside(run, rf) || !isFile(join(run, rf)) {
+		return nil, nil
+	}
+	doc, err := ovio.LoadObject(join(run, rf))
+	if err != nil {
+		return nil, err
+	}
+	ids := vset{}
+	for _, c := range ovio.List(doc["controls"]) {
+		ids.add(ovio.Obj(c)["id"])
+	}
+	return ids, nil
+}

package/engine/internal/overhaul/records/records_test.go

@@ -80,6 +80,7 @@ func (f *fixture) records() map[string]J {
 		"coverage.json": {"schema": "overhaul.coverage/1", "files": L{J{"path": "src/a.py", "eligible": true}}},
 		"findings.json": {"schema": "overhaul.findings/1", "findings": L{J{"id": "F-1", "fingerprint": "fp-1",
 			"kind": "defect", "scope_origin": "pre-existing", "status": "confirmed", "severity": "high",
+			"domain": "correctness", "controls": L{"C-1"},
 			"evidence": L{"E-1"}, "locations": L{J{"path": "src/a.py", "start": 1, "end": 1},
 				J{"path": "mobile-app:src/api.ts", "external": true}},
 			"history": L{J{"status": "candidate"}, J{"status": "confirmed"}}}}},
@@ -186,6 +187,25 @@ func TestPublishThenValidate(t *testing.T) {
 	}
 }
 
+func cell(r map[string]J) J { return r["coverage.json"]["applicability"].(L)[0].(J) }
+
+// scorecard records a scorecard with the given gates and points run.json at its rubric.
+func scorecard(r map[string]J, gates J) {
+	r["run.json"]["revisions"].(J)["rubric"] = J{"rev": 1, "file": "revisions/rubric-r1.json"}
+	r["scorecard.json"] = J{"schema": "overhaul.scorecard/1", "gates": gates}
+}
+
+// reviewed records one applicability cell in state st, backed by a receipt that
+// checked its domain, and a fully reviewed range for the fixture's file.
+func reviewed(f *fixture, r map[string]J, st string) {
+	write(f.t, filepath.Join(f.run, "receipts/R-dom.json"), J{"outcome": "no-findings", "domains_checked": L{"correctness"}})
+	addAttempt(r, J{"task_id": "W-1", "attempt_id": "A1", "role": "reviewer", "status": "admitted", "receipt": "receipts/R-dom.json"})
+	r["coverage.json"]["applicability"] = L{J{"domain": "correctness", "component": "api", "lane": "backend",
+		"state": st, "reason": "no GUI", "receipts": L{"receipts/R-dom.json"}}}
+	r["coverage.json"]["files"] = L{J{"path": "src/a.py", "eligible": true,
+		"ranges": L{J{"start": 1, "end": 1, "state": "semantically-reviewed"}}}}
+}
+
 func TestSingleGenerationRules(t *testing.T) {
 	verifiedHistory := L{J{"status": "candidate"}, J{"status": "confirmed"}, J{"status": "approved-for-fix"},
 		J{"status": "in-progress"}, J{"status": "fixed-unverified"}, J{"status": "verified"}}
@@ -370,6 +390,67 @@ func TestSingleGenerationRules(t *testing.T) {
 		{"ineligible coverage without reason", func(f *fixture, r map[string]J) {
 			r["coverage.json"]["files"] = L{J{"path": "src/a.py", "eligible": false}}
 		}, "coverage src/a.py: ineligible without an exclusion reason"},
+		{"finding without domain", func(f *fixture, r map[string]J) { delete(finding(r), "domain") }, "finding F-1: domain must be one of"},
+		{"confirmed finding without controls", func(f *fixture, r map[string]J) { delete(finding(r), "controls") },
+			"finding F-1: a confirmed finding names the rubric controls it fails"},
+		{"finding with unknown control", func(f *fixture, r map[string]J) { finding(r)["controls"] = L{"C-9"} }, "finding F-1: unknown control C-9"},
+		{"open finding with passing control", func(f *fixture, r map[string]J) {
+			r["results-candidate.json"] = J{"schema": "overhaul.results/1", "results": J{"C-1": J{"status": "PASS"}}}
+		}, "finding F-1: control C-1 is PASS in results-candidate.json while the finding is confirmed"},
+		{"critical-high gate against open finding", func(f *fixture, r map[string]J) {
+			scorecard(r, J{"G-NO-CRITICAL-HIGH": "PASS"})
+		}, "G-NO-CRITICAL-HIGH is PASS but finding F-1 is confirmed high"},
+		{"serious-lead gate against open lead", func(f *fixture, r map[string]J) {
+			r["findings.json"]["findings"] = append(r["findings.json"]["findings"].(L), J{"id": "F-2", "fingerprint": "fp-2",
+				"kind": "defect", "scope_origin": "pre-existing", "status": "candidate", "domain": "security",
+				"potential_impact": "critical", "history": L{J{"status": "candidate"}}})
+			scorecard(r, J{"G-NO-OPEN-SERIOUS-LEAD": "PASS"})
+		}, "G-NO-OPEN-SERIOUS-LEAD is PASS but lead F-2 is open with potential impact critical"},
+		{"coverage gate without matrix", func(f *fixture, r map[string]J) { scorecard(r, J{"G-COVERAGE": "PASS"}) },
+			"G-COVERAGE is PASS without an applicability matrix"},
+		{"coverage gate with blocked cell", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "blocked")
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, "applicability ['correctness', 'api', 'backend'] is blocked"},
+		{"coverage gate with unchecked domain", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "applicable")
+			cell(r)["receipts"] = L{"receipts/R-1.json"}
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, "no admitted, non-gap receipt of applicability ['correctness', 'api', 'backend'] lists correctness in domains_checked"},
+		{"coverage gate with unreviewed range", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "applicable")
+			r["coverage.json"]["files"] = L{J{"path": "src/a.py", "eligible": true, "ranges": L{J{"start": 1, "end": 1, "state": "tool-scanned"}}}}
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, "eligible file src/a.py has unreviewed ranges"},
+		{"coverage gate with rejected receipt", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "applicable")
+			attempts(r)[len(attempts(r))-1].(J)["status"] = "rejected"
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, "no admitted, non-gap receipt of applicability"},
+		{"coverage gate with gap receipt", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "applicable")
+			write(f.t, filepath.Join(f.run, "receipts/R-dom.json"), J{"outcome": "gap", "domains_checked": L{"correctness"}})
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, "no admitted, non-gap receipt of applicability"},
+		{"coverage gate counts empty files", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "applicable")
+			r["coverage.json"]["files"] = L{J{"path": "src/a.py", "eligible": true, "lines": 0}}
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, ""},
+		{"coverage gate backed by records", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "applicable")
+			scorecard(r, J{"G-COVERAGE": "PASS"})
+		}, ""},
+		{"unknown applicability state", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "maybe")
+		}, "state must be applicable, not-applicable or blocked"},
+		{"not-applicable cell without reason", func(f *fixture, r map[string]J) {
+			reviewed(f, r, "not-applicable")
+			delete(cell(r), "reason")
+		}, "not-applicable needs a reason"},
+		{"unknown range state", func(f *fixture, r map[string]J) {
+			r["coverage.json"]["files"] = L{J{"path": "src/a.py", "eligible": true, "ranges": L{J{"start": 1, "end": 1, "state": "done"}}}}
+		}, "range state 'done' is not a coverage state"},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {

package/engine/internal/overhaul/records/run.go

@@ -339,7 +339,7 @@ func publish(run string, stdout, stderr io.Writer) (int, error) {
 	}
 	manifest := map[string]any{"schema": "overhaul.manifest/1", "generation": gen, "previous": previous,
 		"files": files, "revisions": revs}
-	if err := ovio.WriteJSON(join(tmp, "manifest.json"), manifest, 0o666); err != nil {
+	if err := ovio.WriteJSON(join(tmp, "manifest.json"), manifest, 0o644); err != nil {
 		return 0, err
 	}
 	if err := os.Rename(tmp, join(run, gen)); err != nil {

package/engine/internal/overhaul/render/run.go

@@ -731,6 +731,8 @@ func build(run, gen string) (*built, error) {
 	}
 	S = append(S,
 		section{"coverage", "Coverage ledger", []string{"path", "eligible", "lanes", "ranges (state)", "exclusion"}, covRows},
+		section{"applicability", "Applicability matrix (a cell without a receipt is not checked)", []string{"domain", "component", "lane", "state", "reason", "receipts"},
+			rowsOf(objs(R["coverage"]["applicability"]), "domain", "component", "lane", "state", "reason", "receipts")},
 		section{"profiles", "Stack profiles", []string{"id", "revision", "status", "file", "sha256"},
 			rowsOf(objs(R["stack-profiles"]["profiles"]), "id", "rev", "status", "file", "sha256")},
 		section{"contracts", "Contracts and boundaries", []string{"id", "producer", "consumers", "version", "evidence", "open questions"},

package/engine/internal/overhaul/render/run_test.go

@@ -73,7 +73,8 @@ func fixture(t *testing.T, withPlan bool) (run, gen string) {
 		obj{"path": fakeHome + "/proj/a.go", "eligible": true, "lanes": []any{"backend"},
 			"ranges": []any{obj{"start": 1, "end": 9, "state": "verified"}}},
 		obj{"path": "vendor/x.js", "eligible": false, "exclusion": obj{"reason": hostile}},
-	}})
+	}, "applicability": []any{obj{"domain": "operations", "component": "api", "lane": "backend", "state": "blocked",
+		"reason": "no container runtime"}}})
 	writeJSON(t, filepath.Join(gen, "findings.json"), obj{"findings": []any{
 		obj{"id": "F-1", "title": hostile, "kind": "defect", "severity": "high", "status": "confirmed",
 			"failing_scenario": "nil deref"},
@@ -259,6 +260,9 @@ func TestSectionContents(t *testing.T) {
 	if !strings.Contains(sectionHTML(t, h, "approvals"), "QUOTE-approve r1") {
 		t.Fatal("approval quote missing")
 	}
+	if !strings.Contains(sectionHTML(t, h, "applicability"), "no container runtime") {
+		t.Fatal("blocked applicability cell missing from the report")
+	}
 }
 
 func TestPlanMarkdown(t *testing.T) {

package/engine/internal/overhaul/score/run.go

@@ -31,11 +31,16 @@ var (
 	repairGates = []string{"G-APPROVAL", "G-TASKS-COMPLETE", "G-ORACLES", "G-NO-REGRESSION", "G-PERF-TARGETS",
 		"G-PRESERVATION", "G-FINGERPRINTS", "G-OWNERSHIP", "G-FINAL-CHALLENGE"}
 	mayBeNA = set("G-PERF-TARGETS", "G-LANE-RECEIPTS", "G-CONCURRENCY")
-	// domainOrder is the fixed domain set in its documented order, which also
-	// orders the per-domain threshold rows.
-	domainOrder   = []string{"correctness", "security", "reliability", "performance", "tests", "architecture", "ux", "operations"}
-	defaultPolicy = [][2]string{{"global_min", "9.7"}, {"lane_min", "9.7"}, {"domain_min", "9.0"}, {"lane_domain_min", "9.0"}}
-	transitions   = map[[2]string]string{
+	// domainOrder also orders the per-domain threshold rows.
+	domainOrder = ovio.Domains
+	// defaultDomainWeights is the documented default weight table; a rubric
+	// that deviates records the reason and the approval in weight_deviations.
+	defaultDomainWeights = map[string]int64{"correctness": 20, "security": 20, "reliability": 15, "performance": 15,
+		"tests": 10, "architecture": 10, "ux": 5, "operations": 5}
+	controlWeights = set("1", "3", "5")
+	evaluations    = set("executed", "static", "source-proof", "human")
+	defaultPolicy  = [][2]string{{"global_min", "9.7"}, {"lane_min", "9.7"}, {"domain_min", "9.0"}, {"lane_domain_min", "9.0"}}
+	transitions    = map[[2]string]string{
 		{"FAIL", "PASS"}:    "fixed-or-newly-proven",
 		{"UNKNOWN", "PASS"}: "evidence-only",
 		{"PASS", "FAIL"}:    "regression-or-new-failure",
@@ -69,10 +74,15 @@ func run(args []string) (string, error) {
 		if err != nil {
 			return "", err
 		}
-		docs, _, err := load(o["--rubric"], o["--baseline"], o["--candidate"])
+		docs, digs, err := load(o["--rubric"], o["--baseline"], o["--candidate"])
 		if err != nil {
 			return "", err
 		}
+		for i, arm := range []string{"baseline", "candidate"} {
+			if err := sameRubric(docs[i+1], digs[0], arm); err != nil {
+				return "", err
+			}
+		}
 		res, err := compare(docs[0], docs[1], docs[2])
 		if err != nil {
 			return "", err
@@ -88,8 +98,8 @@ func run(args []string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	if d := docs[1]["rubric_digest"]; d != nil && d != any(digs[0]) {
-		return "", fmt.Errorf("results were produced for a different rubric digest")
+	if err := sameRubric(docs[1], digs[0], "results"); err != nil {
+		return "", err
 	}
 	out, err := score(docs[0], docs[1], docs[2])
 	if err != nil {
@@ -110,6 +120,18 @@ func run(args []string) (string, error) {
 	return fmt.Sprintf("%s -> %s\n", out["readiness_verdict"], path), nil
 }
 
+// sameRubric requires results to name the digest of the rubric they were
+// produced for, so two scorecards are only comparable on one rubric revision.
+func sameRubric(results map[string]any, digest, what string) error {
+	switch d := results["rubric_digest"]; {
+	case d == nil:
+		return fmt.Errorf("%s: rubric_digest is required", what)
+	case d != any(digest):
+		return fmt.Errorf("%s were produced for a different rubric digest", what)
+	}
+	return nil
+}
+
 // flags parses "--name value" pairs; every required flag must be present and
 // no other flag is accepted.
 func flags(args, required, optional []string) (map[string]string, error) {
@@ -181,6 +203,7 @@ func needReason(v any, what string) error {
 
 type control struct {
 	id, domain      string
+	evaluation      string
 	lanes           []string
 	weight          *big.Rat
 	na, hard, indep bool
@@ -224,12 +247,27 @@ func checkRubric(r map[string]any) (*rubricSpec, error) {
 			return nil, errPolicy
 		}
 	}
+	deviations := map[string]bool{}
+	for _, e := range ovio.List(r["weight_deviations"]) {
+		m := ovio.Obj(e)
+		d, _ := m["domain"].(string)
+		if d == "" || !ovio.Truthy(m["reason"]) || !ovio.Truthy(m["approval"]) {
+			return nil, fmt.Errorf("weight deviation %q needs a domain, a reason and an approval reference", d)
+		}
+		if _, known := defaultDomainWeights[d]; !known || deviations[d] {
+			return nil, fmt.Errorf("weight deviation %q names an unknown or repeated domain", d)
+		}
+		deviations[d] = true
+	}
 	doms := ovio.Obj(r["domains"])
 	for _, d := range slices.Sorted(maps.Keys(doms)) {
 		w, err := num(doms[d], "domain weight "+d)
 		if err != nil {
 			return nil, err
 		}
+		if def, ok := defaultDomainWeights[d]; ok && w.Cmp(big.NewRat(def, 1)) != 0 && !deviations[d] {
+			return nil, fmt.Errorf("domain weight %s is %s, not the default %d, without a weight_deviations entry", d, w.RatString(), def)
+		}
 		sp.dw[d] = w
 	}
 	for _, e := range ovio.List(r["domain_exclusions"]) {
@@ -310,8 +348,15 @@ func checkRubric(r map[string]any) (*rubricSpec, error) {
 		if err != nil {
 			return nil, err
 		}
+		if !controlWeights[w.RatString()] {
+			return nil, fmt.Errorf("%s: weight must be 1, 3 or 5, got %s", id, w.RatString())
+		}
+		ev, _ := c["evaluation"].(string)
+		if !evaluations[ev] {
+			return nil, fmt.Errorf("%s: evaluation must be executed, static, source-proof or human, got %v", id, c["evaluation"])
+		}
 		sp.controls = append(sp.controls, control{id: id, domain: dom, lanes: lanes, weight: w, na: na != nil,
-			hard: ovio.Truthy(c["hard_gate"]), indep: ovio.Truthy(c["independent_verification"])})
+			hard: ovio.Truthy(c["hard_gate"]), indep: ovio.Truthy(c["independent_verification"]), evaluation: ev})
 	}
 	return sp, nil
 }
@@ -331,6 +376,10 @@ func credit(c control, res map[string]any, notes *[]any) (string, error) {
 		*notes = append(*notes, map[string]any{"control": c.id, "from": "PASS", "to": "UNKNOWN", "reason": "no evidence"})
 		st = "UNKNOWN"
 	}
+	if st == "PASS" && c.domain == "performance" && c.evaluation == "static" {
+		*notes = append(*notes, map[string]any{"control": c.id, "from": "PASS", "to": "UNKNOWN", "reason": "static inspection establishes no performance metric"})
+		st = "UNKNOWN"
+	}
 	if st == "PASS" && c.indep && !ovio.Truthy(res["verified_by"]) {
 		*notes = append(*notes, map[string]any{"control": c.id, "from": "PASS", "to": "UNKNOWN", "reason": "no independent verification"})
 		st = "UNKNOWN"