docguard-cli 0.38.0 → 0.39.0

package/README.md

@@ -294,10 +294,10 @@ DocGuard ships **23 commands** (the "Daily 5" + 18 situational tools, including
 | `explain <warning\|CODE>` | Paste any warning — or a finding code like `SEC001` — to get the validator's docstring, fix path, and how to suppress |
 | `verify --semantic` | Extract documented numbers/limits/enums (retention days, rate limits, GSI/role counts, status enums) as a task list for an agent to check against code — the semantic-drift class regex/AST can't see |
 | `verify --instructions` | Audit AGENTS.md/CLAUDE.md themselves for drift: duplicate rules, never-vs-always contradictions, stale file pointers, unknown commands — plus clustered rule pairs as agent judgment tasks |
-| `feedback` | Report likely false positives back to DocGuard — local-first record + a 1-click prefilled, redacted GitHub issue (zero typing) |
+| `feedback` | Review any finding or a synthetic false-positive/false-negative/unsupported fixture; verify its opposite control, reduce it deterministically, search open and closed duplicates, and optionally emit a test-only contribution. Nothing is submitted automatically. |
 | `retire` | Find completed or superseded planning material (`--plan`/`--check`; `--fail-on-warning` gates advisory candidates) and explicitly remove clean tracked documentation from active AI context. `.docguard-archive.json` records recovery metadata and retired requirement identities, and `--retention-ref` proves the source revision remains reachable. This is separate from the Spec Kit Archive extension, which consolidates feature documents. |
 | `reconcile` | Build a read-only code↔spec review graph since a Git ref. Classifies mechanical facts, approved intent, decisions, unrelated changes, and unsupported evidence; `--write` applies only mechanical generated-section refreshes. |
-| `specs` | Maintain the versioned spec registry, preflight new specs, and apply evidence-gated completion transactions with bounded outcomes and active-context regeneration. |
+| `specs` | Maintain the versioned spec registry, preflight new specs, and apply evidence-gated completion transactions with bounded outcomes and active-context regeneration. Verified living specs can record later reviewed maintenance without reopening or duplicating the specification. |
 | `specs --check` / `specs --write` | Validate or refresh `.docguard-specs.json`, the byte-stable index of immutable spec IDs, reviewed lifecycle/lineage/scope, artifact digests, task state, explicitly scoped test evidence, and archive tombstones. Refreshes preserve the reviewed block. |
 | `specs preflight [--path <spec>]` | Before specification, print current spec lifecycle and evidence. Before planning, check the generated draft for structural blockers and report semantic overlap as review-only evidence. |
 | `mcp` | MCP server — exposes guard/score/explain/verify/report/diagnose as native tools for Claude, Cursor, and any MCP client. Stdio: `claude mcp add docguard -- npx docguard-cli mcp`. Team-shared HTTP: `docguard mcp --transport http --port 8585` (loopback by default; non-loopback binds require `--api-key`) |

package/cli/commands/feedback.mjs

@@ -12,15 +12,23 @@
  *
  * Nothing is transmitted automatically. This command never scaffolds skills
  * or edits source files. Zero npm dependencies — pure Node.js built-ins.
+ * @implements docguard.precision-evidence-loop#FR-012
+ * @implements docguard.precision-evidence-loop#FR-015
+ * @implements docguard.precision-evidence-loop#FR-016
  */
 
-import { existsSync, mkdirSync, readFileSync } from 'node:fs';
-import { resolve, dirname } from 'node:path';
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { resolve, dirname, join, relative, sep } from 'node:path';
+import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { c } from '../shared.mjs';
 import { CODES } from '../findings.mjs';
 import { safeWrite } from '../writers/generate-io.mjs';
 import { runGuardInternal } from './guard.mjs';
+import {
+  buildTestOnlyContribution, feedbackFindingIdentity, feedbackSearchUrls, parseFeedbackFixture,
+  reduceFixtureDeterministically,
+} from '../feedback-fixture.mjs';
 
 const _PKG = JSON.parse(
   readFileSync(resolve(dirname(fileURLToPath(import.meta.url)), '..', '..', 'package.json'), 'utf-8')
@@ -39,16 +47,20 @@ function shortId(str) {
 }
 
 /** Shared output deliberately excludes every source-derived string. */
-export function buildIssueUrl(finding) {
+export function buildIssueUrl(finding, context = null) {
   const code = Object.hasOwn(CODES, finding.code || '') ? finding.code : 'FINDING';
   const validator = CODES[code]?.validator || 'unknown';
-  const title = `[feedback] ${code} (${validator}): detection feedback`;
+  const classification = context?.classification || 'false_positive';
+  const title = `[feedback] ${code} (${validator}): ${classification.replaceAll('_', ' ')}`;
   const confidence = ['high', 'medium', 'low'].includes(finding.confidence) ? finding.confidence : 'unknown';
   const body = [
     `DocGuard v${CLI_VERSION}`,
     `- Code: ${code}`,
     `- Validator: ${validator}`,
     `- Confidence: ${confidence}`,
+    `- Classification: ${classification}`,
+    ...(context?.parserTier ? [`- Parser tier: ${context.parserTier}`] : []),
+    ...(context?.duplicateIdentity ? [`- Duplicate identity: ${context.duplicateIdentity}`] : []),
     '',
     'Expected behavior:',
     'Actual behavior:',
@@ -60,12 +72,139 @@ export function buildIssueUrl(finding) {
     'Generated by docguard feedback. No project paths, messages, source code, or secret values are included.',
   ].join('\n');
   const url = `${ISSUES_BASE}/new?labels=docguard-feedback&title=${encodeURIComponent(title)}&body=${encodeURIComponent(body)}`;
-  const query = `repo:raccioly/docguard ${code}`;
+  const query = context?.duplicateIdentity ? `repo:raccioly/docguard "${context.duplicateIdentity}"` : `repo:raccioly/docguard ${code}`;
   const searchUrl = `https://github.com/search?q=${encodeURIComponent(query)}&type=issues`;
   return { url: url.length <= URL_CAP ? url : `${ISSUES_BASE}/new`, title, searchUrl };
 }
 
+const FEEDBACK_CLASSES = new Set(['false_positive', 'false_negative', 'unsupported_syntax', 'ambiguous', 'policy_disagreement']);
+
+function projectFile(projectDir, value, label) {
+  if (typeof value !== 'string' || !value || value.includes('\\')) throw new Error(`${label} must be a project-relative path.`);
+  const root = resolve(projectDir);
+  const path = resolve(root, value);
+  const rel = relative(root, path);
+  if (!rel || rel.startsWith(`..${sep}`) || rel === '..' || rel.split(sep).some(part => ['.git', '.local'].includes(part.toLowerCase()))) {
+    throw new Error(`${label} must remain in the project and outside protected directories.`);
+  }
+  return path;
+}
+
+function evaluateFileSet(manifest, fileSet) {
+  const root = mkdtempSync(join(tmpdir(), 'docguard-feedback-fixture-'));
+  try {
+    for (const file of fileSet.files) {
+      const target = resolve(root, file.path);
+      mkdirSync(dirname(target), { recursive: true });
+      writeFileSync(target, file.content, 'utf8');
+    }
+    const report = runGuardInternal(root, manifest.config);
+    const validator = (report.validators || []).find(item => item.key === manifest.detector.validator);
+    return {
+      identities: (report.findings || []).filter(item => item.code === manifest.detector.code).map(feedbackFindingIdentity).sort(),
+      applicability: validator?.applicability?.status || 'unknown',
+    };
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+}
+
+function predicateMatches(manifest, result) {
+  if (manifest.interestingness.predicate === 'finding_present') return result.identities.includes(manifest.expectedIdentity);
+  if (manifest.interestingness.predicate === 'finding_absent') return !result.identities.includes(manifest.expectedIdentity);
+  return result.applicability === 'unsupported';
+}
+
+function oppositeMatches(manifest, result) {
+  if (manifest.interestingness.predicate === 'finding_present') return result.identities.includes(manifest.expectedIdentity);
+  if (manifest.interestingness.predicate === 'finding_absent') return !result.identities.includes(manifest.expectedIdentity);
+  return result.applicability === 'checked';
+}
+
+function runFixtureFeedback(projectDir, flags) {
+  let manifest;
+  try {
+    const manifestPath = projectFile(projectDir, flags.fixtureManifest, '--fixture-manifest');
+    if (!existsSync(manifestPath) || lstatSync(manifestPath).isSymbolicLink()) throw new Error('Fixture manifest must be a regular non-symlink file.');
+    const text = readFileSync(manifestPath, 'utf8');
+    if (Buffer.byteLength(text) > 262_144) throw new Error('Fixture manifest exceeds 256 KiB.');
+    manifest = parseFeedbackFixture(JSON.parse(text));
+    if (flags.classification && flags.classification !== manifest.classification) throw new Error('--classification disagrees with the fixture manifest.');
+  } catch (error) {
+    console.log(JSON.stringify({ status: 'ERROR', error: error.message }, null, 2));
+    process.exitCode = 1;
+    return;
+  }
+
+  const initial = evaluateFileSet(manifest, manifest.fixture);
+  const control = evaluateFileSet(manifest, manifest.oppositeControl);
+  const reproduced = predicateMatches(manifest, initial);
+  const controlConfirmed = oppositeMatches(manifest, control);
+  if (!reproduced || !controlConfirmed) {
+    console.log(JSON.stringify({
+      status: 'NOT_REPRODUCED', classification: manifest.classification,
+      reproductionConfirmed: reproduced, controlConfirmed,
+      message: 'The explicit predicate and opposite control must both reproduce before reduction or contribution.',
+    }, null, 2));
+    process.exitCode = 1;
+    return;
+  }
+
+  let reduction = null;
+  if (flags.reduce) {
+    reduction = reduceFixtureDeterministically(manifest, candidate => predicateMatches(candidate, evaluateFileSet(candidate, candidate.fixture)));
+    manifest = reduction.manifest;
+  }
+  const searches = feedbackSearchUrls(manifest, ISSUES_BASE);
+  const issue = buildIssueUrl({ code: manifest.detector.code, confidence: 'unknown' }, {
+    classification: manifest.classification, parserTier: manifest.parserTier, duplicateIdentity: searches.identity,
+  });
+  const feedbackDir = resolve(projectDir, '.docguard', 'feedback');
+  let record = null;
+  let contribution = null;
+  let contributionPreview = null;
+  try {
+    if (!flags.preview) {
+      record = resolve(feedbackDir, `${searches.identity}.fixture.json`);
+      safeWrite(record, `${JSON.stringify(manifest, null, 2)}\n`);
+    }
+    if (flags.contribution) {
+      if (!/^tests\/[^/]+\.test\.mjs$/.test(flags.contribution)) {
+        throw new Error('--contribution must be a direct tests/<name>.test.mjs path.');
+      }
+      contributionPreview = buildTestOnlyContribution(manifest);
+      if (!flags.preview) {
+        contribution = projectFile(projectDir, flags.contribution, '--contribution');
+        safeWrite(contribution, contributionPreview);
+      }
+    }
+  } catch (error) {
+    console.log(JSON.stringify({ status: 'ERROR', error: error.message }, null, 2));
+    process.exitCode = 1;
+    return;
+  }
+  const output = {
+    status: 'READY', preview: Boolean(flags.preview), classification: manifest.classification,
+    reproductionConfirmed: true, controlConfirmed: true, reduction: reduction ? { status: reduction.status, attempts: reduction.attempts } : null,
+    duplicateIdentity: searches.identity, searchUrls: searches, issueUrl: issue.url,
+    record: record ? relative(projectDir, record).split(sep).join('/') : null,
+    contribution: contribution ? relative(projectDir, contribution).split(sep).join('/') : null,
+    contributionPreview: flags.preview && flags.contribution ? contributionPreview : undefined,
+  };
+  console.log(JSON.stringify(output, null, 2));
+}
+
 export function runFeedback(projectDir, config, flags) {
+  if (flags.fixtureManifest) return runFixtureFeedback(projectDir, flags);
+  const classification = flags.classification || 'false_positive';
+  if (!FEEDBACK_CLASSES.has(classification) || classification === 'false_negative' || classification === 'unsupported_syntax') {
+    const error = classification === 'false_negative' || classification === 'unsupported_syntax'
+      ? 'This classification requires --fixture-manifest with an explicit expected identity and opposite control.'
+      : 'Unknown feedback classification.';
+    if (flags.format === 'json') console.log(JSON.stringify({ error, reportable: [] })); else console.error(error);
+    process.exitCode = 1;
+    return;
+  }
   const data = runGuardInternal(projectDir, config);
   const selectedCode = typeof flags.code === 'string' ? flags.code.toUpperCase() : null;
   if (flags.code !== undefined && (!selectedCode || !Object.hasOwn(CODES, selectedCode))) {
@@ -93,7 +232,7 @@ export function runFeedback(projectDir, config, flags) {
   const feedbackDir = resolve(projectDir, '.docguard', 'feedback');
   const items = reportable.map((f) => {
     const id = shortId(`${f.code}|${f.location || f.message}`);
-    const { url, title, searchUrl } = buildIssueUrl(f);
+    const { url, title, searchUrl } = buildIssueUrl(f, { classification });
     const fileName = `${(f.code || 'finding').toLowerCase()}-${id}.json`;
     const filePath = resolve(feedbackDir, fileName);
     return { finding: f, id, url, title, searchUrl, fileName, filePath, saved: false, error: null };
@@ -105,6 +244,7 @@ export function runFeedback(projectDir, config, flags) {
       if (!existsSync(feedbackDir)) mkdirSync(feedbackDir, { recursive: true });
       safeWrite(it.filePath, JSON.stringify({
         capturedBy: `docguard feedback (v${CLI_VERSION})`,
+        classification,
         finding: it.finding,
         issueUrl: it.url,
         searchUrl: it.searchUrl,
@@ -123,6 +263,7 @@ export function runFeedback(projectDir, config, flags) {
     console.log(JSON.stringify({
       version: CLI_VERSION,
       preview: Boolean(flags.preview),
+      classification,
       reportable: items.map(it => ({
         code: it.finding.code,
         location: it.finding.location,

package/cli/commands/specs.mjs

@@ -56,6 +56,13 @@ function archiveReadiness(spec, targetVerified = false) {
   return { status: 'READY', reason: 'Run the reviewed spec retirement flow after the verified state is committed and retained.' };
 }
 
+function completionTransition(spec) {
+  if (spec?.reviewed.lifecycle.delivery === 'verified') return 'verified→verified';
+  return spec?.reviewed.lifecycle.delivery === 'in_progress'
+    ? 'in_progress→implemented→verified'
+    : 'implemented→verified';
+}
+
 export function planSpecCompletion(projectDir, config, flags, options = {}) {
   const projection = projectSpecRegistry(projectDir, config);
   const loaded = readSpecRegistry(projectDir);
@@ -70,8 +77,12 @@ export function planSpecCompletion(projectDir, config, flags, options = {}) {
 
   let reconcile = null;
   if (spec) {
+    const maintenance = spec.reviewed.lifecycle.delivery === 'verified'
+      && spec.reviewed.lifecycle.persistenceModel === 'living';
     if (spec.reviewed.lifecycle.approval !== 'approved') blockers.push({ code: 'SPC002', message: 'Only an approved spec can become verified.' });
-    if (!['in_progress', 'implemented'].includes(spec.reviewed.lifecycle.delivery)) blockers.push({ code: 'SPC002', message: `Expected delivery=in_progress or implemented, found ${spec.reviewed.lifecycle.delivery}.` });
+    if (!['in_progress', 'implemented'].includes(spec.reviewed.lifecycle.delivery) && !maintenance) {
+      blockers.push({ code: 'SPC002', message: `Expected delivery=in_progress, implemented, or verified with persistenceModel=living; found ${spec.reviewed.lifecycle.delivery}/${spec.reviewed.lifecycle.persistenceModel || 'unset'}.` });
+    }
     const tasks = spec.observed.taskCompletion;
     if (!tasks.total || tasks.checked !== tasks.total) blockers.push({ code: 'SPC003', message: `All tasks must be checked (${tasks.checked}/${tasks.total}).` });
     if (spec.observed.implementationEvidence.length === 0) blockers.push({ code: 'SPC004', message: 'At least one qualified source implementation annotation is required.' });
@@ -92,6 +103,14 @@ export function planSpecCompletion(projectDir, config, flags, options = {}) {
       if (reconcile.status === 'UNSUPPORTED' || reconcile.status === 'BLOCKED') blockers.push({ code: 'SPC006', message: 'Reconciliation coverage is unsupported or blocked.' });
       const unresolved = reconcile.classifications.filter(item => item.disposition === 'unsupported_or_ambiguous');
       if (unresolved.length) blockers.push({ code: 'SPC006', message: `Unresolved changed files: ${unresolved.map(item => item.path).join(', ')}.` });
+      if (maintenance) {
+        const reviewable = reconcile.classifications.filter(item =>
+          item.specs.includes(spec.specId)
+          && ['source', 'test', 'canonical_doc', 'decision'].includes(item.kind));
+        if (revision === spec.reviewed.reconciliation.lastReviewedRevision || reviewable.length === 0) {
+          blockers.push({ code: 'SPC006', message: 'Living-spec maintenance requires a new linked source, test, canonical-document, or decision change since the last reviewed revision.' });
+        }
+      }
     }
   }
   const guard = options.guardResult || runGuardInternal(projectDir, config);
@@ -100,7 +119,7 @@ export function planSpecCompletion(projectDir, config, flags, options = {}) {
     status: blockers.length ? 'BLOCKED' : 'READY',
     specId: flags.id || null,
     revision,
-    transition: spec?.reviewed.lifecycle.delivery === 'in_progress' ? 'in_progress→implemented→verified' : 'implemented→verified',
+    transition: completionTransition(spec),
     blockers,
     reconciliation: reconcile,
     evidence: spec ? [...new Set([

package/cli/docguard.mjs

@@ -301,10 +301,10 @@ const COMMAND_HELP = {
     examples: ['docguard memory', 'docguard memory --diff'],
   },
   feedback: {
-    summary: 'Review detection feedback locally. Select any finding with --code or --all, check duplicates, and prepare a metadata-only issue URL. Nothing is submitted automatically.',
-    usage: 'docguard feedback [--code <CODE> | --all] [--preview] [--format json]',
-    flags: [['--code <CODE>', 'Select a finding regardless of confidence'], ['--all', 'Select every active finding'], ['--preview', 'Skip local feedback-record writes'], ['--format json', 'Machine-readable selected findings and issue/search URLs']],
-    examples: ['docguard feedback', 'docguard feedback --code TRC005 --preview', 'docguard feedback --all --format json'],
+    summary: 'Review detection feedback locally, or validate and reduce a synthetic fixture manifest. Duplicate searches cover open and closed work; nothing is submitted automatically.',
+    usage: 'docguard feedback [--code <CODE> | --all] [--classification <class>] [--fixture-manifest <path> [--reduce] [--contribution <path>]] [--preview] [--format json]',
+    flags: [['--code <CODE>', 'Select a finding regardless of confidence'], ['--all', 'Select every active finding'], ['--classification <class>', 'false_positive, false_negative, unsupported_syntax, ambiguous, or policy_disagreement'], ['--fixture-manifest <path>', 'Validate a reviewed synthetic fixture and opposite control'], ['--reduce', 'Deterministically reduce a reproducing fixture'], ['--contribution <path>', 'Write a test-only contribution when required evidence is present'], ['--preview', 'Skip local writes and return contribution text inline'], ['--format json', 'Machine-readable evidence and issue/search URLs']],
+    examples: ['docguard feedback', 'docguard feedback --code TRC005 --preview', 'docguard feedback --fixture-manifest feedback.json --reduce --preview --format json'],
   },
   verify: {
     summary: 'Extract the semantic claims in your canonical docs — documented numbers, limits, and enums (retention days, rate limits, GSI/role counts, status enums) — as a verification task list the agent checks against the code. This is the highest-value bug class (a doc value that drifted from code) and the one regex/AST cannot judge. DocGuard finds the claims; the LLM confirms them.',
@@ -626,6 +626,17 @@ async function main() {
       flags.all = true;
     } else if (args[i] === '--preview') {
       flags.preview = true;
+    } else if (args[i] === '--classification' && args[i + 1]) {
+      flags.classification = args[i + 1].replaceAll('-', '_');
+      i++;
+    } else if (args[i] === '--fixture-manifest' && args[i + 1]) {
+      flags.fixtureManifest = args[i + 1];
+      i++;
+    } else if (args[i] === '--reduce') {
+      flags.reduce = true;
+    } else if (args[i] === '--contribution' && args[i + 1]) {
+      flags.contribution = args[i + 1];
+      i++;
     } else if (args[i] === '--signals') {
       flags.signals = true;
     } else if (args[i] === '--debate') {

package/cli/feedback-fixture.mjs

@@ -0,0 +1,188 @@
+/**
+ * Strict, privacy-bounded feedback fixtures and deterministic reduction.
+ * @implements docguard.precision-evidence-loop#FR-011
+ * @implements docguard.precision-evidence-loop#FR-013
+ * @implements docguard.precision-evidence-loop#FR-014
+ * @implements docguard.precision-evidence-loop#FR-015
+ * @implements docguard.precision-evidence-loop#FR-016
+ */
+
+import { createHash } from 'node:crypto';
+import { extname, isAbsolute } from 'node:path';
+
+export const FEEDBACK_SCHEMA_URL = 'https://raccioly.github.io/docguard/schemas/docguard-feedback-fixture.schema.json';
+const CLASSIFICATIONS = new Set(['false_positive', 'false_negative', 'unsupported_syntax', 'ambiguous', 'policy_disagreement']);
+const PARSER_TIERS = new Set(['js-ast', 'py-ast', 'regex-fallback', 'fallback-language', 'mixed', 'not-applicable']);
+const PREDICATES = new Set(['finding_present', 'finding_absent', 'validator_unsupported']);
+const ROOT_KEYS = new Set(['$schema', 'schemaVersion', 'classification', 'detector', 'parserTier', 'config', 'expectedIdentity', 'interestingness', 'fixture', 'oppositeControl', 'provenance', 'contribution']);
+
+function object(value, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(`${label} must be an object.`);
+  return value;
+}
+
+function exactKeys(value, keys, label) {
+  const unknown = Object.keys(value).filter(key => !keys.has(key));
+  if (unknown.length) throw new Error(`${label} has unknown field(s): ${unknown.join(', ')}.`);
+}
+
+function safePath(value, label) {
+  if (typeof value !== 'string' || !value || value.includes('\\') || isAbsolute(value)) throw new Error(`${label} must be a POSIX relative path.`);
+  const parts = value.split('/');
+  if (parts.some(part => !part || part === '.' || part === '..' || ['.git', '.local'].includes(part.toLowerCase()))) {
+    throw new Error(`${label} enters a protected or escaping path.`);
+  }
+  return value;
+}
+
+function validateConfig(value, label = 'config', depth = 0) {
+  if (depth > 6) throw new Error(`${label} is too deeply nested.`);
+  if (value === null || typeof value === 'boolean' || Number.isFinite(value)) return;
+  if (typeof value === 'string') {
+    if (value.length > 10_000 || value.includes('\0') || isAbsolute(value) || /(?:^|[/\\])\.\.(?:[/\\]|$)/.test(value) || value.includes('.local') || value.includes('.git')) {
+      throw new Error(`${label} contains an unsafe value.`);
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length > 100) throw new Error(`${label} is too large.`);
+    value.forEach((item, index) => validateConfig(item, `${label}[${index}]`, depth + 1));
+    return;
+  }
+  object(value, label);
+  const keys = Object.keys(value);
+  if (keys.length > 100 || keys.some(key => ['__proto__', 'prototype', 'constructor'].includes(key))) throw new Error(`${label} has unsafe keys.`);
+  for (const key of keys) validateConfig(value[key], `${label}.${key}`, depth + 1);
+}
+
+function parseFiles(value, label) {
+  const holder = object(value, label);
+  exactKeys(holder, new Set(['files']), label);
+  if (!Array.isArray(holder.files) || holder.files.length < 1 || holder.files.length > 16) throw new Error(`${label}.files requires 1-16 files.`);
+  let bytes = 0;
+  const seen = new Set();
+  const files = holder.files.map((entry, index) => {
+    object(entry, `${label}.files[${index}]`);
+    exactKeys(entry, new Set(['path', 'content']), `${label}.files[${index}]`);
+    const path = safePath(entry.path, `${label}.files[${index}].path`);
+    if (seen.has(path)) throw new Error(`${label}.files contains duplicate path ${path}.`);
+    seen.add(path);
+    if (typeof entry.content !== 'string' || entry.content.includes('\0')) throw new Error(`${label}.files[${index}].content must be text.`);
+    bytes += Buffer.byteLength(entry.content);
+    return { path, content: entry.content };
+  });
+  if (bytes > 131_072) throw new Error(`${label} exceeds 128 KiB.`);
+  return { files };
+}
+
+function parseContribution(value) {
+  if (value === undefined) return null;
+  const contribution = object(value, 'contribution');
+  exactKeys(contribution, new Set(['testOnly', 'scopeDocumented', 'benchmarkDelta']), 'contribution');
+  const delta = object(contribution.benchmarkDelta, 'contribution.benchmarkDelta');
+  exactKeys(delta, new Set(['falsePositives', 'falseNegatives', 'unsupportedCases', 'abstainedSupportedCases']), 'contribution.benchmarkDelta');
+  for (const [key, count] of Object.entries(delta)) {
+    if (!Number.isInteger(count) || count < 0) throw new Error(`contribution.benchmarkDelta.${key} must be a non-negative integer.`);
+  }
+  return { testOnly: contribution.testOnly === true, scopeDocumented: contribution.scopeDocumented === true, benchmarkDelta: delta };
+}
+
+export function parseFeedbackFixture(value) {
+  const root = object(value, 'feedback fixture');
+  exactKeys(root, ROOT_KEYS, 'feedback fixture');
+  if (root.$schema !== FEEDBACK_SCHEMA_URL || root.schemaVersion !== 1) throw new Error('Feedback fixture uses an unsupported schema contract.');
+  if (!CLASSIFICATIONS.has(root.classification)) throw new Error('feedback fixture classification is invalid.');
+  if (!PARSER_TIERS.has(root.parserTier)) throw new Error('feedback fixture parserTier is invalid.');
+  const detector = object(root.detector, 'detector');
+  exactKeys(detector, new Set(['code', 'validator']), 'detector');
+  if (!/^[A-Z]{3}\d{3}$/.test(detector.code) || !/^[A-Za-z][A-Za-z0-9]{1,63}$/.test(detector.validator)) throw new Error('detector code or validator is invalid.');
+  const match = String(root.expectedIdentity || '').match(/^([A-Z]{3}\d{3})@(.+)$/);
+  if (!match || match[1] !== detector.code) throw new Error('expectedIdentity must use the detector code.');
+  const expectedPath = safePath(match[2], 'expectedIdentity path');
+  const interestingness = object(root.interestingness, 'interestingness');
+  exactKeys(interestingness, new Set(['predicate']), 'interestingness');
+  if (!PREDICATES.has(interestingness.predicate)) throw new Error('interestingness.predicate is invalid.');
+  const fixture = parseFiles(root.fixture, 'fixture');
+  const oppositeControl = parseFiles(root.oppositeControl, 'oppositeControl');
+  const fixturePaths = fixture.files.map(file => file.path).sort();
+  const controlPaths = oppositeControl.files.map(file => file.path).sort();
+  if (JSON.stringify(fixturePaths) !== JSON.stringify(controlPaths) || !fixturePaths.includes(expectedPath)) {
+    throw new Error('fixture and oppositeControl must share paths and include the expectedIdentity path.');
+  }
+  const provenance = object(root.provenance, 'provenance');
+  exactKeys(provenance, new Set(['synthetic', 'redactionAttested']), 'provenance');
+  if (provenance.synthetic !== true || provenance.redactionAttested !== true) throw new Error('Synthetic provenance and reviewed redaction must both be attested.');
+  validateConfig(root.config);
+  return {
+    $schema: FEEDBACK_SCHEMA_URL, schemaVersion: 1, classification: root.classification,
+    detector: { code: detector.code, validator: detector.validator }, parserTier: root.parserTier,
+    config: root.config, expectedIdentity: `${detector.code}@${expectedPath}`,
+    interestingness: { predicate: interestingness.predicate }, fixture, oppositeControl,
+    provenance: { synthetic: true, redactionAttested: true }, contribution: parseContribution(root.contribution),
+  };
+}
+
+function shape(files) {
+  return files.map(file => {
+    const normalized = file.content
+      .replace(/(['"`])(?:\\.|(?!\1).)*\1/g, ' STRING ')
+      .replace(/\b\d+(?:\.\d+)?\b/g, ' NUMBER ')
+      .replace(/\b[A-Za-z_$][\w$]*\b/g, ' ID ')
+      .replace(/\s+/g, ' ').trim();
+    return `${extname(file.path).toLowerCase()}:${normalized}`;
+  }).sort().join('|');
+}
+
+export function feedbackDuplicateIdentity(manifest) {
+  const input = [manifest.detector.code, manifest.classification, manifest.parserTier, shape(manifest.fixture.files)].join('|');
+  return `dgf-${createHash('sha256').update(input).digest('hex').slice(0, 16)}`;
+}
+
+export function feedbackFindingIdentity(finding) {
+  const raw = typeof finding.location === 'string' ? finding.location : finding.location?.file || '<project>';
+  return `${finding.code}@${raw.replace(/:\d+(?::\d+)?$/, '').replaceAll('\\', '/')}`;
+}
+
+export function feedbackSearchUrls(manifest, issuesBase = 'https://github.com/raccioly/docguard/issues') {
+  const repository = issuesBase.replace(/^https:\/\/github\.com\//, '').replace(/\/issues.*$/, '');
+  const identity = feedbackDuplicateIdentity(manifest);
+  const build = state => `https://github.com/search?q=${encodeURIComponent(`repo:${repository} "${identity}" state:${state}`)}&type=issues`;
+  return { identity, all: build('open').replace(encodeURIComponent(' state:open'), ''), open: build('open'), closed: build('closed') };
+}
+
+export function reduceFixtureDeterministically(manifest, interesting, maxAttempts = 100) {
+  let current = structuredClone(manifest);
+  let attempts = 0;
+  if (!interesting(current)) return { status: 'NOT_REPRODUCED', attempts, manifest: current };
+  for (let fileIndex = 0; fileIndex < current.fixture.files.length && attempts < maxAttempts; fileIndex++) {
+    let changed = true;
+    while (changed && attempts < maxAttempts) {
+      changed = false;
+      const lines = current.fixture.files[fileIndex].content.split('\n');
+      if (lines.length <= 1) break;
+      for (let line = 0; line < lines.length && attempts < maxAttempts; line++) {
+        const candidate = structuredClone(current);
+        candidate.fixture.files[fileIndex].content = lines.filter((_, index) => index !== line).join('\n');
+        attempts++;
+        if (interesting(candidate)) { current = candidate; changed = true; break; }
+      }
+    }
+  }
+  return { status: attempts >= maxAttempts ? 'REDUCED_LIMIT' : 'REDUCED', attempts, manifest: current };
+}
+
+export function assertContributionReady(manifest) {
+  if (!['false_positive', 'false_negative', 'unsupported_syntax'].includes(manifest.classification)) {
+    throw new Error('Ambiguous and policy-disagreement fixtures require adjudication before a test contribution.');
+  }
+  if (!manifest.contribution?.testOnly || !manifest.contribution.scopeDocumented) {
+    throw new Error('Contribution requires testOnly and scopeDocumented attestations plus benchmarkDelta.');
+  }
+  return true;
+}
+
+export function buildTestOnlyContribution(manifest) {
+  assertContributionReady(manifest);
+  const encoded = JSON.stringify(manifest);
+  return `import { test } from 'node:test';\nimport assert from 'node:assert/strict';\nimport { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { tmpdir } from 'node:os';\nimport { runGuardInternal } from '../cli/commands/guard.mjs';\nimport { feedbackFindingIdentity } from '../cli/feedback-fixture.mjs';\n\nconst manifest = ${encoded};\nfunction run(files) {\n  const root = mkdtempSync(join(tmpdir(), 'docguard-contribution-'));\n  try {\n    for (const file of files) { const target = join(root, file.path); mkdirSync(dirname(target), { recursive: true }); writeFileSync(target, file.content); }\n    return runGuardInternal(root, manifest.config);\n  } finally { rmSync(root, { recursive: true, force: true }); }\n}\n\ntest('${manifest.detector.code} ${manifest.classification} synthetic reproduction (${feedbackDuplicateIdentity(manifest)})', () => {\n  const fixture = run(manifest.fixture.files);\n  const control = run(manifest.oppositeControl.files);\n  const fixtureHas = fixture.findings.some(finding => feedbackFindingIdentity(finding) === manifest.expectedIdentity);\n  const controlHas = control.findings.some(finding => feedbackFindingIdentity(finding) === manifest.expectedIdentity);\n  const fixtureApplicability = fixture.validators.find(item => item.key === manifest.detector.validator)?.applicability?.status;\n  const controlApplicability = control.validators.find(item => item.key === manifest.detector.validator)?.applicability?.status;\n  ${manifest.classification === 'false_positive' ? 'assert.equal(fixtureHas, false); assert.equal(controlHas, true);' : manifest.classification === 'false_negative' ? 'assert.equal(fixtureHas, true); assert.equal(controlHas, false);' : `assert.notEqual(fixtureApplicability, 'unsupported'); assert.equal(controlApplicability, 'checked'); assert.equal(controlHas, false);`}\n});\n`;
+}

package/cli/validators/security.mjs

@@ -3,6 +3,7 @@
  *
  * Respects config.securityIgnore (glob patterns) and config.ignore (global).
  * Uses shared-ignore.mjs for consistent filtering (Constitution IV, v1.1.0).
+ * @implements docguard.precision-evidence-loop#FR-003
  */
 
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
@@ -35,10 +36,10 @@ const IGNORE_DIRS = new Set([
 
 // Patterns that might indicate hardcoded secrets
 const SECRET_PATTERNS = [
-  { pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]/gi, label: 'hardcoded password' },
-  { pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"][^'"]{16,}['"]/gi, label: 'hardcoded API key' },
-  { pattern: /(?:secret[_-]?key|secretkey)\s*[:=]\s*['"][^'"]{16,}['"]/gi, label: 'hardcoded secret key' },
-  { pattern: /(?:access[_-]?token|accesstoken)\s*[:=]\s*['"][^'"]{16,}['"]/gi, label: 'hardcoded access token' },
+  { pattern: /(?:password|passwd|pwd)\??\s*(?:=\s*|:\s*(?:[^'";=\n]+?=\s*)?)['"][^'"]{8,}['"]/gi, label: 'hardcoded password' },
+  { pattern: /(?:api[_-]?key|apikey)\??\s*(?:=\s*|:\s*(?:[^'";=\n]+?=\s*)?)['"][^'"]{16,}['"]/gi, label: 'hardcoded API key' },
+  { pattern: /(?:secret[_-]?key|secretkey)\??\s*(?:=\s*|:\s*(?:[^'";=\n]+?=\s*)?)['"][^'"]{16,}['"]/gi, label: 'hardcoded secret key' },
+  { pattern: /(?:access[_-]?token|accesstoken)\??\s*(?:=\s*|:\s*(?:[^'";=\n]+?=\s*)?)['"][^'"]{16,}['"]/gi, label: 'hardcoded access token' },
   { pattern: /AKIA[0-9A-Z]{16}/g, label: 'AWS Access Key ID' },
   { pattern: /(?:sk-|sk_live_|sk_test_)[a-zA-Z0-9]{20,}/g, label: 'API secret key (Stripe/OpenAI pattern)' },
 ];

package/extensions/spec-kit-docguard/extension.yml

@@ -3,7 +3,7 @@ schema_version: "1.0"
 extension:
   id: "docguard"
   name: "DocGuard — CDD Enforcement"
-  version: "0.38.0"
+  version: "0.39.0"
   description: "Canonical-Driven Development enforcement as a true spec-kit extension. LLM-first design with automated validators, 5 AI behavior skills, spec-kit skill chaining, and workflow hooks. One pinned runtime dependency (@babel/parser); pure Node.js otherwise."
   author: "Ricardo Accioly"
   repository: "https://github.com/raccioly/docguard"

package/extensions/spec-kit-docguard/skills/docguard-fix/SKILL.md

@@ -6,10 +6,10 @@ description: AI-driven documentation repair with structured research workflow, t
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.38.0
+  version: 0.39.0
   source: extensions/spec-kit-docguard/skills/docguard-fix
 ---
-<!-- docguard:version: 0.38.0 -->
+<!-- docguard:version: 0.39.0 -->
 
 # DocGuard Fix Skill
 

package/extensions/spec-kit-docguard/skills/docguard-guard/SKILL.md

@@ -7,10 +7,10 @@ description: Run DocGuard guard validation against Canonical-Driven Development
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.38.0
+  version: 0.39.0
   source: extensions/spec-kit-docguard/skills/docguard-guard
 ---
-<!-- docguard:version: 0.38.0 -->
+<!-- docguard:version: 0.39.0 -->
 
 # DocGuard Guard Skill
 

package/extensions/spec-kit-docguard/skills/docguard-review/SKILL.md

@@ -6,10 +6,10 @@ description: Cross-document consistency analysis and quality assessment. Perform
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.38.0
+  version: 0.39.0
   source: extensions/spec-kit-docguard/skills/docguard-review
 ---
-<!-- docguard:version: 0.38.0 -->
+<!-- docguard:version: 0.39.0 -->
 
 # DocGuard Review Skill
 

package/extensions/spec-kit-docguard/skills/docguard-score/SKILL.md

@@ -6,10 +6,10 @@ description: CDD maturity assessment with category-aware improvement roadmap. Ru
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.38.0
+  version: 0.39.0
   source: extensions/spec-kit-docguard/skills/docguard-score
 ---
-<!-- docguard:version: 0.38.0 -->
+<!-- docguard:version: 0.39.0 -->
 
 # DocGuard Score Skill
 

package/extensions/spec-kit-docguard/skills/docguard-sync/SKILL.md

@@ -4,10 +4,10 @@ description: Keep canonical documentation ALWAYS UP TO DATE. Refreshes code-trut
 compatibility: Requires DocGuard CLI installed (npm i -g docguard-cli or npx docguard-cli)
 metadata:
   author: docguard
-  version: 0.38.0
+  version: 0.39.0
   source: extensions/spec-kit-docguard/skills/docguard-sync
 ---
-<!-- docguard:version: 0.38.0 -->
+<!-- docguard:version: 0.39.0 -->
 
 # DocGuard Sync Skill
 

package/extensions/spec-kit-docguard/templates/github-workflows/docguard-guard.yml

@@ -35,7 +35,7 @@ jobs:
           node-version: '20'
 
       - name: Install DocGuard
-        run: npm install --global --ignore-scripts docguard-cli@0.38.0
+        run: npm install --global --ignore-scripts docguard-cli@0.39.0
 
       - name: Run DocGuard
         shell: bash

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "docguard-cli",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "description": "The enforcement tool for Canonical-Driven Development (CDD). Audit, generate, and guard your project documentation.",
   "type": "module",
   "bin": {
@@ -12,6 +12,7 @@
     "guard": "node cli/docguard.mjs guard",
     "init": "node cli/docguard.mjs init",
     "score": "node cli/docguard.mjs score",
+    "benchmark": "node benchmarks/run.mjs",
     "diff": "node cli/docguard.mjs diff",
     "generate": "node cli/docguard.mjs generate",
     "hooks": "node cli/docguard.mjs hooks",

package/schemas/docguard-benchmark.schema.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://raccioly.github.io/docguard/schemas/docguard-benchmark.schema.json",
+  "title": "DocGuard benchmark corpus",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schemaVersion", "cases"],
+  "properties": {
+    "$schema": { "const": "https://raccioly.github.io/docguard/schemas/docguard-benchmark.schema.json" },
+    "schemaVersion": { "const": 1 },
+    "cases": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/case" }
+    }
+  },
+  "$defs": {
+    "identity": { "type": "string", "pattern": "^[A-Z]{3}[0-9]{3}@[^/\\\\][^\\\\]*$" },
+    "source": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "path"],
+          "properties": {
+            "kind": { "const": "fixture" },
+            "path": { "type": "string", "pattern": "^fixtures/" }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "url", "revision", "license"],
+          "properties": {
+            "kind": { "const": "git" },
+            "url": { "type": "string", "pattern": "^https://[^@]+\\.git$" },
+            "revision": { "type": "string", "pattern": "^[0-9a-f]{40}([0-9a-f]{24})?$" },
+            "license": { "type": "string", "minLength": 1, "maxLength": 128 }
+          }
+        }
+      ]
+    },
+    "mutation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "find", "replace", "expectedOccurrences"],
+      "properties": {
+        "path": { "type": "string", "minLength": 1 },
+        "find": { "type": "string", "minLength": 1, "maxLength": 20000 },
+        "replace": { "type": "string", "maxLength": 20000 },
+        "expectedOccurrences": { "type": "integer", "minimum": 1, "maximum": 20 }
+      }
+    },
+    "case": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "split", "repositoryGroup", "causalFamily", "parserTier", "classification", "source", "scope", "expected", "forbidden", "repairOutcome"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{2,127}$" },
+        "split": { "enum": ["development", "evaluation"] },
+        "repositoryGroup": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "causalFamily": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "parserTier": { "enum": ["js-ast", "py-ast", "regex-fallback", "fallback-language", "mixed", "not-applicable"] },
+        "classification": { "enum": ["defect", "clean_control", "ambiguous", "unsupported_syntax", "policy_disagreement"] },
+        "repairOutcome": { "enum": ["accepted", "rejected", "not_evaluated"] },
+        "source": { "$ref": "#/$defs/source" },
+        "scope": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["validatorKey", "codes"],
+          "properties": {
+            "validatorKey": { "type": "string", "minLength": 1, "maxLength": 64 },
+            "codes": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^[A-Z]{3}[0-9]{3}$" } }
+          }
+        },
+        "config": { "type": "object" },
+        "mutations": { "type": "array", "items": { "$ref": "#/$defs/mutation" } },
+        "expected": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/identity" } },
+        "forbidden": { "type": "array", "uniqueItems": true, "items": { "$ref": "#/$defs/identity" } },
+        "oppositeControl": { "type": ["string", "null"], "pattern": "^[a-z0-9][a-z0-9._-]{2,127}$" }
+      }
+    }
+  }
+}

package/schemas/docguard-feedback-fixture.schema.json

@@ -0,0 +1,54 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://raccioly.github.io/docguard/schemas/docguard-feedback-fixture.schema.json",
+  "title": "DocGuard synthetic feedback fixture",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schemaVersion", "classification", "detector", "parserTier", "config", "expectedIdentity", "interestingness", "fixture", "oppositeControl", "provenance"],
+  "properties": {
+    "$schema": { "const": "https://raccioly.github.io/docguard/schemas/docguard-feedback-fixture.schema.json" },
+    "schemaVersion": { "const": 1 },
+    "classification": { "enum": ["false_positive", "false_negative", "unsupported_syntax", "ambiguous", "policy_disagreement"] },
+    "detector": {
+      "type": "object", "additionalProperties": false, "required": ["code", "validator"],
+      "properties": { "code": { "type": "string", "pattern": "^[A-Z]{3}[0-9]{3}$" }, "validator": { "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9]{1,63}$" } }
+    },
+    "parserTier": { "enum": ["js-ast", "py-ast", "regex-fallback", "fallback-language", "mixed", "not-applicable"] },
+    "config": { "type": "object" },
+    "expectedIdentity": { "type": "string", "pattern": "^[A-Z]{3}[0-9]{3}@.+$" },
+    "interestingness": {
+      "type": "object", "additionalProperties": false, "required": ["predicate"],
+      "properties": { "predicate": { "enum": ["finding_present", "finding_absent", "validator_unsupported"] } }
+    },
+    "fixture": { "$ref": "#/$defs/fileSet" },
+    "oppositeControl": { "$ref": "#/$defs/fileSet" },
+    "provenance": {
+      "type": "object", "additionalProperties": false, "required": ["synthetic", "redactionAttested"],
+      "properties": { "synthetic": { "const": true }, "redactionAttested": { "const": true } }
+    },
+    "contribution": {
+      "type": "object", "additionalProperties": false, "required": ["testOnly", "scopeDocumented", "benchmarkDelta"],
+      "properties": {
+        "testOnly": { "const": true }, "scopeDocumented": { "const": true },
+        "benchmarkDelta": {
+          "type": "object", "additionalProperties": false,
+          "required": ["falsePositives", "falseNegatives", "unsupportedCases", "abstainedSupportedCases"],
+          "properties": {
+            "falsePositives": { "type": "integer", "minimum": 0 }, "falseNegatives": { "type": "integer", "minimum": 0 },
+            "unsupportedCases": { "type": "integer", "minimum": 0 }, "abstainedSupportedCases": { "type": "integer", "minimum": 0 }
+          }
+        }
+      }
+    }
+  },
+  "$defs": {
+    "fileSet": {
+      "type": "object", "additionalProperties": false, "required": ["files"],
+      "properties": { "files": { "type": "array", "minItems": 1, "maxItems": 16, "items": { "$ref": "#/$defs/file" } } }
+    },
+    "file": {
+      "type": "object", "additionalProperties": false, "required": ["path", "content"],
+      "properties": { "path": { "type": "string", "minLength": 1 }, "content": { "type": "string", "maxLength": 131072 } }
+    }
+  }
+}

package/templates/ci/github-actions.yml

@@ -31,7 +31,7 @@ jobs:
           node-version: '20'
 
       - name: Install DocGuard
-        run: npm install --global --ignore-scripts docguard-cli@0.38.0
+        run: npm install --global --ignore-scripts docguard-cli@0.39.0
 
       - name: Run DocGuard
         shell: bash

package/templates/feedback-fixture.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://raccioly.github.io/docguard/schemas/docguard-feedback-fixture.schema.json",
+  "schemaVersion": 1,
+  "classification": "false_positive",
+  "detector": { "code": "SEC001", "validator": "security" },
+  "parserTier": "js-ast",
+  "config": { "profile": "starter", "diskCache": false, "validators": { "security": true } },
+  "expectedIdentity": "SEC001@src/case.js",
+  "interestingness": { "predicate": "finding_present" },
+  "fixture": { "files": [{ "path": "src/case.js", "content": "const password = \"validation message with several words\";\n" }] },
+  "oppositeControl": { "files": [{ "path": "src/case.js", "content": "const password = \"real-looking-password\";\n" }] },
+  "provenance": { "synthetic": true, "redactionAttested": true },
+  "contribution": {
+    "testOnly": true,
+    "scopeDocumented": true,
+    "benchmarkDelta": { "falsePositives": 0, "falseNegatives": 0, "unsupportedCases": 0, "abstainedSupportedCases": 0 }
+  }
+}