harness-everything 0.38.0 → 0.40.0

package/benchmarks/results/reviews/pr353-r6-2026-10-22/b-reviews-a.md

@@ -0,0 +1,100 @@
+# Cross-review — PR #353 leg A (reviewer: leg B)
+
+Reviewer role: **read-only** reviewer of peer A at `/Users/daniel.chang/Desktop/Skills/Harness-everything/.worktrees/353-r6-a`.
+Nothing in either worktree was edited; no git/gh writes; no full suites run.
+
+Inputs read: `/tmp/harness-353-r6-a/REPORT.md`, A's `git diff 59421f4` (production files, tests, fixture,
+docs, CHANGELOG), the unchanged derive contract `harness-everything/scripts/doc-obligations.js` and
+`doc-lifecycle.js`, and the S2a contract text.
+
+Probes executed (read-only, both implementations): my consolidated probe
+`/tmp/harness-353-r6-b/probe/cross-review-probe.js` (8 cases × both legs) and the coordinator's
+`semantic-transitions.js` (4 cases) against A. Logs: `logs/CROSS-probe-A.log`, `logs/CROSS-probe-B.log`,
+`logs/CROSS-coordinator-transitions-A.log`.
+
+## Verdict
+
+**ACCEPT peer A.** No blocker found. One executed behavioural difference against leg B, where A is the
+stricter and packet-compliant side. Three non-blocking follow-ups for the owner.
+
+## Review by dimension
+
+| Dimension | Finding | Label |
+| --- | --- | --- |
+| Origin tuple ↔ identity | A binds all five origin-correlated fields (`workspaceId`, `sessionId`, `workflowId`, `workflowRevision`, `taskId`) of `originContext` to `identity` (`originBound`), so the provider↔captured-context half and the event-identity↔identity half are connected. The joint substitution is rejected in verification, review and the cached-acceptance path. | executed (coordinator probe 26/26 for A, per A's report) + source-traced (A's `originBound`, core line 149ff) |
+| Plan ↔ identity | A checks the captured plan explicitly (`workflow.workflowId/workflowRevision/sessionId`, `task.taskId`, `prdRoot`, `configDigest`) against the identity. B relies on `taskScopeDigest` for the same links, so A's plan check is the more legible of the two; A's `plan.configDigest ↔ identity.configDigest` link has no counterpart in B. | source-traced |
+| Config ↔ inventory | A adds `configBytesBound`: the captured config source bytes must equal the captured inventory bytes for the same path (`config-capture-mismatch` otherwise). The producer already enforced this at capture; the core did not. **A closes a represented link that B does not.** | source-traced + A's own non-vacuity probe (`legA/logs/red-config-link-3.log`) |
+| Host binding | `originContext.activeHost` vs `config.capture.activeHost`, skipped only when neither side represents a host — same rule as B, both absent-tolerant. | source-traced |
+| Binary bytes intact | Every stored byte stays in the identity framing; A ships a test asserting the per-record digest equals SHA-256 of the stored bytes and that a changed asset changes `candidateDigest` while the MUST set is unchanged. My probe's `irrelevant-asset-control` → `ready` on both legs. | executed |
+| Relevant undecodable content cannot disappear | The coordinator's defect class (candidate bytes carrying `role: prd` or a REQ-citing test while the baseline record is nonsemantic) **fails closed in A** (`semantic-transitions.js` 4/4 → `unavailable`), and my probe reproduces the same two shapes → `unavailable` in both A and B. A additionally fails closed for every governed/legacy/derived/code/**test** path. | executed |
+| Divergence A vs B | `undecodable-test-path-no-req` (an undecodable record at `tests/plain.dat`, no REQ id): **A → `inventory-unsupported`**, **B → `ready` (the test input is silently omitted)**. The packet says "Do not silently drop code/test/governed/derived inputs"; B drops a test input, A does not. `undecodable-code-path-no-req` → both fail closed. | executed |
+| Producer/core parity | Both legs share one helper (`U.deriveFiles` in A, `deriveCapturedFacts` in B). A's producer is non-strict and its core strict, which preserves the base code's asymmetry; B makes both strict (a superset). Neither diverges on the semantic handling. | source-traced |
+| Malformed inputs | A's core catch maps the message `invalid-input`/`inventory-incomplete`/`inventory-unsupported`; because the shared `bytes()` helper throws a plain `Error('inventory-unsupported')` for a malformed `storedBytes`, **A now reports `inventory-unsupported` where the base reported `invalid-input`**. Credit is withheld either way; B preserves the base diagnostic. One-line mapping fix available. | source-traced |
+| Purity | A's new core code is pure (no `fs`, no `child_process`, no network); the core's no-I/O assertion still holds. | source-traced |
+| Scope / API regressions | Only the write-set is touched: S2a core + producer (+ generated copies), the two S2a suites, the S2a fixture, the S2a contract text, `CHANGELOG.md`. No public derive/checker API, identity/digest schema, S1 runtime, workflow wiring, version or dependency change; `doc-reconciliation-events.js` untouched (it inherits the P1 binding through `validateSnapshot`). A added two `[Unreleased]` entries instead of one — trivial deviation from the packet's "topmost entry" wording, consistent with the repo's existing multi-entry `[Unreleased]` convention. | source-traced + executed (`git status`/`git diff --stat` read-only) |
+
+## Comparison of the two approaches
+
+**A — static relevance surface.** Relevance = the derive contract's own path classes (governed/legacy
+globs, derived output/source globs, `CODE_EXTENSION`, `TEST_PATH`) plus "the record opens a frontmatter
+block"; anything else is omitted. Fail closed for everything else that cannot be decoded.
+
+**B — derivation-probe relevance.** Relevance = the unchanged derivation changes its obligations when the
+record's own bytes are probed under the actual, addition and deletion transitions; otherwise omit.
+
+| | A | B |
+|---|---|---|
+| Packet clause "do not drop code/test/governed/derived inputs" | **satisfied** (executed: test path fails closed) | **deviates** on the test class (executed: test path silently omitted) |
+| Candidate-side semantics of an undecodable record | caught (frontmatter rule) and, for classified paths, by path class | caught (actual-transition probe) |
+| Duplication of the derive contract | **duplicates** `CODE_EXTENSION`, `TEST_PATH`, glob semantics (A's own risk #1) | none |
+| Extra derivation passes per capture with binaries | 0 | up to 3 |
+| Additional represented links closed | config bytes ↔ inventory; plan.configDigest ↔ identity.configDigest | none |
+| Residual gap | the mirrored surface is not provably complete; a future derive-contract change can silently narrow it (maintenance risk, no current defect) | the witness is a synthetic lossy-text probe; it is not a proof about the true bytes of an undecodable file (documented in both reports) |
+| Shipped coverage of the coordinator's defect class | **unpinned** — the `opensFrontmatter` branch is exercised by no shipped test (A's binary paths are `assets/logo.png`, `docs/prd/binary.md`, `docs/roadmap/index.md`, `src/app.js`, `tests/app.test.js`; none opens a frontmatter) | pinned by `R2h-P2:*` (frontmatter + REQ-citing test) |
+| Diagnostic fidelity for malformed records | drifts to `inventory-unsupported` | preserves `invalid-input` |
+
+## Recommendation
+
+**Take A**, optionally plus one small B-derived addition.
+
+Reasons, in order of weight:
+
+1. **A satisfies the packet's explicit drop clause; B does not.** The only executed behavioural difference
+   is an undecodable REQ-test record: A fails closed, B omits it. The packet names test inputs explicitly,
+   so A's behaviour is the compliant one.
+2. **A closes two represented links B leaves open** (config source bytes ↔ captured inventory bytes;
+   plan `configDigest` ↔ identity `configDigest`). Both are in the same class the packet asked to be closed
+   coherently.
+3. **A is simpler and cheaper**: one shared conversion helper, no extra derivation passes, and a
+   readability advantage (explicit plan/host checks instead of digest-implied ones).
+4. A's weaknesses are maintenance-level (mirrored path rules, an unpinned heuristic branch, a diagnostic
+   drift), while B's weakness is a behavioural deviation from the written requirement.
+
+Optional minimal combination, if the owner wants B's guarantee that the *candidate's own bytes* are always
+consulted: keep A's static classification **and** add B's actual-transition witness as an additional
+fail-closed trigger (the union). That closes A's "surface not provably complete" residual at the cost of
+A's duplication plus B's extra derivation passes. It is **not** required for acceptance.
+
+## Non-blocking follow-ups for peer A (owner decides)
+
+1. **Pin the `opensFrontmatter` branch** with the coordinator's two transition shapes (a candidate record
+   whose bytes open a `role: prd` frontmatter at a path no glob classifies; a candidate record whose bytes
+   are a REQ-citing test). Today that branch carries the defect class and no shipped test reaches it.
+2. **Preserve the base diagnostic** for a malformed record: map only the explicitly coded
+   `inventory-unsupported` to itself and keep `invalid-input` for everything else (one line in the catch).
+3. **Guard the mirrored path rules** (optional): a check that fails when `doc-obligations.js`'s
+   `CODE_EXTENSION`/`TEST_PATH`/glob semantics change, so the duplication cannot silently narrow the
+   relevance surface; otherwise keep the drift risk recorded as A does.
+
+## Scope and limits of this review
+
+- **Not executed**: A's and B's full S2a suites (the coordinator is running the common probes and the
+  swapped suites), `npm test`, `verify:all`, the mechanism runner; the Windows and Node 22 lanes.
+- **Not assessed**: live-host provenance, S1 runtime behaviour, workflow wiring, E1 readiness — all outside
+  S2a. Every origin in these probes is the explicit test fake.
+- **Inconclusive**: whether A's mirrored relevance surface is complete for every future derive-contract
+  change; and whether B's witness omission of a test input could ever coincide with an applicability
+  change not visible in the derived obligations (no such case was found in the eight probed shapes).
+- No PR readiness is declared here; the owner decides.
+
+STATUS: DONE

package/benchmarks/results/reviews/pr353-r6-2026-10-22/baseline-probes.log

@@ -0,0 +1,47 @@
+FAIL source:joint-workspaceId: event acceptance must reject corrupted identity
+FAIL source:joint-sessionId: event acceptance must reject corrupted identity
+FAIL source:joint-workflowId: event acceptance must reject corrupted identity
+FAIL source:joint-workflowRevision: event acceptance must reject corrupted identity
+FAIL source:joint-taskId: event acceptance must reject corrupted identity
+FAIL source:joint-activeHost: event acceptance must reject corrupted identity
+FAIL source:png-stays-hashed-and-reconciles: [{"code":"inventory-unsupported","message":"inventory unsupported"}]
++ actual - expected
+
++ 'unavailable'
+- 'ready'
+
+FAIL source:binary-only-is-legacy: Expected values to be strictly equal:
++ actual - expected
+
++ 'unavailable'
+- 'ready'
+
+PASS source:undecodable-relevant-src/invalid.js
+PASS source:undecodable-relevant-tests/invalid.dat
+PASS source:undecodable-relevant-docs/prd/invalid.md
+PASS source:undecodable-relevant-docs/roadmap/index.md
+PASS source:undecodable-derived-source
+FAIL packaged:joint-workspaceId: event acceptance must reject corrupted identity
+FAIL packaged:joint-sessionId: event acceptance must reject corrupted identity
+FAIL packaged:joint-workflowId: event acceptance must reject corrupted identity
+FAIL packaged:joint-workflowRevision: event acceptance must reject corrupted identity
+FAIL packaged:joint-taskId: event acceptance must reject corrupted identity
+FAIL packaged:joint-activeHost: event acceptance must reject corrupted identity
+FAIL packaged:png-stays-hashed-and-reconciles: [{"code":"inventory-unsupported","message":"inventory unsupported"}]
++ actual - expected
+
++ 'unavailable'
+- 'ready'
+
+FAIL packaged:binary-only-is-legacy: Expected values to be strictly equal:
++ actual - expected
+
++ 'unavailable'
+- 'ready'
+
+PASS packaged:undecodable-relevant-src/invalid.js
+PASS packaged:undecodable-relevant-tests/invalid.dat
+PASS packaged:undecodable-relevant-docs/prd/invalid.md
+PASS packaged:undecodable-relevant-docs/roadmap/index.md
+PASS packaged:undecodable-derived-source
+{"passed":10,"failed":16}

package/benchmarks/results/reviews/pr353-r6-2026-10-22/bom-red.log

@@ -0,0 +1,85 @@
+  PASS snapshot:required-fields-present [source]
+  PASS snapshot:required-fields-present [packaged]
+  PASS snapshot:identity-tuple-types-and-digest-equalities [source]
+  PASS snapshot:identity-tuple-types-and-digest-equalities [packaged]
+  PASS snapshot:obligations-equal-unchanged-derive-api-on-captured-bytes [source]
+  PASS snapshot:obligations-equal-unchanged-derive-api-on-captured-bytes [packaged]
+  PASS snapshot:derivation-reasons-cover-every-obligation [source]
+  PASS snapshot:derivation-reasons-cover-every-obligation [packaged]
+  PASS A04:docs-prd-root-positive-produces-ready-snapshot [source]
+  PASS A04:docs-prd-root-positive-produces-ready-snapshot [packaged]
+  PASS A04:custom-prd-root-unavailable-with-no-fallback [source]
+  PASS A04:custom-prd-root-unavailable-with-no-fallback [packaged]
+  PASS A05:whole-candidate-identity-is-not-the-prd-set-digest [source]
+  PASS A05:whole-candidate-identity-is-not-the-prd-set-digest [packaged]
+  PASS A05:deletion-and-rename-endpoints-are-both-bound [source]
+  PASS A05:deletion-and-rename-endpoints-are-both-bound [packaged]
+  PASS A05:deleted-tombstones-omitted-from-checker-artifacts [source]
+  PASS A05:deleted-tombstones-omitted-from-checker-artifacts [packaged]
+  PASS A05:deleted-path-differs-from-empty-file-in-candidate-digest [source]
+  PASS A05:deleted-path-differs-from-empty-file-in-candidate-digest [packaged]
+  PASS framing:path-boundary-concatenation-does-not-collide [source]
+  PASS framing:path-boundary-concatenation-does-not-collide [packaged]
+  PASS framing:mode-drift-changes-candidate-digest [source]
+  PASS framing:mode-drift-changes-candidate-digest [packaged]
+  PASS A09:pinned-baseline-remains-after-fixture-commit [source]
+  PASS A09:pinned-baseline-remains-after-fixture-commit [packaged]
+  PASS A09:head-anchored-capture-has-a-different-baseline-identity [source]
+  PASS A09:head-anchored-capture-has-a-different-baseline-identity [packaged]
+  PASS A09:rename-endpoints-stable-across-repeated-captures [source]
+  PASS A09:rename-endpoints-stable-across-repeated-captures [packaged]
+  PASS R2d-P1:reference-only-provider-context-is-baseline-unavailable [source]
+  PASS R2d-P1:reference-only-provider-context-is-baseline-unavailable [packaged]
+  PASS R2d-P1:input-baseline-re-anchored-to-moved-head-is-never-ready [source]
+  PASS R2d-P1:input-baseline-re-anchored-to-moved-head-is-never-ready [packaged]
+  PASS R2d-P1:input-baseline-equal-to-the-provider-pin-stays-ready-after-head-moved [source]
+  PASS R2d-P1:input-baseline-equal-to-the-provider-pin-stays-ready-after-head-moved [packaged]
+  PASS R2d-P2a:nested-scope-policy-status-is-a-semantic-change [source]
+  PASS R2d-P2a:nested-scope-policy-status-is-a-semantic-change [packaged]
+  PASS R2d-P2a:nested-requirement-and-binding-semantics-change-the-digest [source]
+  PASS R2d-P2a:nested-requirement-and-binding-semantics-change-the-digest [packaged]
+  PASS A10:missing-baseline-commit-yields-baseline-unavailable [source]
+  PASS A10:missing-baseline-commit-yields-baseline-unavailable [packaged]
+  PASS A10:non-repository-baseline-root-yields-baseline-unavailable [source]
+  PASS A10:non-repository-baseline-root-yields-baseline-unavailable [packaged]
+  PASS A10:normal-git-capture-succeeds [source]
+  PASS A10:normal-git-capture-succeeds [packaged]
+  PASS A11:ignored-governed-path-included-or-unavailable-never-silent [source]
+  PASS A11:ignored-governed-path-included-or-unavailable-never-silent [packaged]
+  PASS A11:index-removed-ignored-file-included-or-unavailable [source]
+  PASS A11:index-removed-ignored-file-included-or-unavailable [packaged]
+  PASS A11:ignored-irrelevant-control-has-no-new-must-and-a-justified-exclusion [source]
+  PASS A11:ignored-irrelevant-control-has-no-new-must-and-a-justified-exclusion [packaged]
+  PASS A03:captured-resolution-equals-existing-resolver-project-config [source]
+  PASS A03:captured-resolution-equals-existing-resolver-project-config [packaged]
+  PASS A03:project-overrides-host-positive-equals-existing-resolver [source]
+  PASS A03:project-overrides-host-positive-equals-existing-resolver [packaged]
+  PASS A03:equal-host-positive-equals-existing-resolver [source]
+  PASS A03:equal-host-positive-equals-existing-resolver [packaged]
+  PASS A03:capture-binds-exact-config-bytes-and-selection [source]
+  PASS A03:capture-binds-exact-config-bytes-and-selection [packaged]
+  PASS A03:absent-project-config-yields-config-unavailable [source]
+  PASS A03:absent-project-config-yields-config-unavailable [packaged]
+  PASS purity:producer-capture-writes-nothing-spawns-only-git [source]
+  PASS purity:producer-capture-writes-nothing-spawns-only-git [packaged]
+  PASS R3-P2:unchanged-binary-asset-captures-without-changing-applicability [source]
+  PASS R3-P2:unchanged-binary-asset-captures-without-changing-applicability [packaged]
+  PASS R3-P2:changed-binary-asset-changes-the-candidate-digest-without-changing-applicability [source]
+  PASS R3-P2:changed-binary-asset-changes-the-candidate-digest-without-changing-applicability [packaged]
+  PASS R3-P2:undecodable-governed-document-record-fails-closed [source]
+  PASS R3-P2:undecodable-governed-document-record-fails-closed [packaged]
+  PASS R3-P2:undecodable-derived-output-record-fails-closed [source]
+  PASS R3-P2:undecodable-derived-output-record-fails-closed [packaged]
+  PASS R3-P2:undecodable-code-input-record-fails-closed [source]
+  PASS R3-P2:undecodable-code-input-record-fails-closed [packaged]
+  PASS R3-P2:undecodable-test-input-record-fails-closed [source]
+  PASS R3-P2:undecodable-test-input-record-fails-closed [packaged]
+  PASS R3-P2:undecodable-frontmatter-plain-fails-closed [source]
+  PASS R3-P2:undecodable-frontmatter-plain-fails-closed [packaged]
+  FAIL R3-P2:undecodable-frontmatter-bom-fails-closed [source] — undecodable frontmatter must not disappear from semantic inputs
+  FAIL R3-P2:undecodable-frontmatter-bom-fails-closed [packaged] — undecodable frontmatter must not disappear from semantic inputs
+
+S2a producer summary: 78 PASS, 2 FAIL, 0 INFRA across 80 assertion-legs
+FAIL reason classes:
+  2 × undecodable frontmatter must not disappear from semantic inputs
+S2a producer suite: assertion FAIL present (expected on the RED base; GREEN must clear every FAIL).

package/benchmarks/results/reviews/pr353-r6-2026-10-22/bom-transition.txt

@@ -0,0 +1,25 @@
+'use strict';
+const fs=require('fs'),path=require('path'),assert=require('assert/strict');
+const root=path.resolve(process.argv[2]);
+const H=require(path.join(root,'ci/fixtures/doc-obligations/reconciliation-s2a/harness.js'));
+const binary=Buffer.from([0x89,0,0xff]);let passed=0,failed=0;
+for(const leg of H.LEGS) for(const vector of ['frontmatter']) {
+ const P=require(path.join(leg.lib,'doc-reconciliation-producer.js'));
+ const files=H.vectorFiles('normative');const name=vector==='frontmatter'?'assets/role.dat':'tests/fixture.dat';
+ const repo=H.makeRepo({...files.base,[name]:binary});
+ try {
+  H.writeFiles(repo.root,files.candidate);
+  const content=vector==='frontmatter'?'---\nrole: prd\nid: PRD-GRPH-999\nrevision: 1\nstatus: draft\n---\n### REQ-GRPH-999\n\nThe binary candidate carries a requirement.\n\nAcceptance: evaluate this requirement.\n':'// REQ-GRPH-001\nit("requires the rule", () => { expect(true).toBe(true); });\n';
+  fs.writeFileSync(path.join(repo.root,name),Buffer.concat([Buffer.from('\ufeff'+content),binary]));
+  const provider=new H.FakeOrigin({context:H.fakeContext({},repo)});
+  const produced=P.produceDocSnapshot(H.producerInput(repo),{originProvider:provider});
+  if(produced.state==='ready') {
+   const obligations=produced.snapshot.obligations;
+   const relevant=vector==='frontmatter'?obligations.some(o=>o.strength==='MUST'&&o.applicability!=='N/A'&&o.scope.paths.includes(name)):obligations.some(o=>o.capability==='requirement-sync'&&o.applicability!=='N/A');
+   assert(relevant,'candidate semantic content was omitted after probing only baseline bytes');
+  }
+  passed++;console.log('PASS',leg.name,vector,produced.state);
+ } catch(e) { failed++; console.error('FAIL',leg.name,vector,e.message); }
+ finally{H.removeRepo(repo.root);}
+}
+console.log(JSON.stringify({passed,failed}));process.exitCode=failed?1:0;

package/benchmarks/results/reviews/pr353-r6-2026-10-22/coordinator-probes.txt

@@ -0,0 +1,84 @@
+'use strict';
+const assert = require('assert/strict');
+const fs = require('fs');
+const path = require('path');
+const root = path.resolve(process.argv[2]);
+const H = require(path.join(root, 'ci/fixtures/doc-obligations/reconciliation-s2a/harness.js'));
+let passed = 0, failed = 0;
+function test(name, fn) { try { fn(); passed++; console.log('PASS ' + name); } catch (e) { failed++; console.error('FAIL ' + name + ': ' + e.message); } }
+const binary = Buffer.from([0x89,0x50,0x4e,0x47,0,0xff,0x80]);
+for (const leg of H.LEGS) {
+ const P = require(path.join(leg.lib, 'doc-reconciliation-producer.js'));
+ const E = require(path.join(leg.lib, 'doc-reconciliation-events.js'));
+ const C = require(path.join(leg.lib, 'doc-reconciliation-core.js'));
+ function setup(fn, extraBase = {}, key = 'normative') {
+  const files = H.vectorFiles(key), repo = H.makeRepo({...files.base,...extraBase});
+  try {
+   H.writeFiles(repo.root, files.candidate);
+   const origin = new H.FakeOrigin({context:H.fakeContext({},repo)});
+   const input = H.producerInput(repo);
+   const flow = () => {
+    const produced = P.produceDocSnapshot(input,{originProvider:origin});
+    if (produced.state !== 'ready') return {produced};
+    const snapshot=produced.snapshot, events=H.buildEvents(snapshot,repo,H.VECTORS.vectors[key]);
+    for(const [ref,event] of Object.entries(events)) origin.issueEvent(ref,event);
+    const accepted=E.acceptDocEvents({snapshot,eventRefs:Object.keys(events)},{originProvider:origin});
+    return {produced,snapshot,events,accepted,decision:C.checkAcceptedDocEvidence({snapshot,accepted})};
+   };
+   fn({repo,origin,input,flow});
+  } finally { H.removeRepo(repo.root); }
+ }
+ const label = s => leg.name + ':' + s;
+ for (const field of ['workspaceId','sessionId','workflowId','workflowRevision','taskId','activeHost']) {
+  test(label('joint-'+field),()=>setup(({origin,flow})=>{
+   const b=flow(); assert.equal(b.decision?.eligible,true,'positive control');
+   const snapshot=H.clone(b.snapshot);
+   const value=field==='workflowRevision'?snapshot.originContext[field]+1:field==='activeHost'?{hostId:'other-host'}:snapshot.originContext[field]+'-other';
+   snapshot.originContext[field]=value; origin.context[field]=value;
+   const accepted=E.acceptDocEvents({snapshot,eventRefs:Object.keys(b.events)},{originProvider:origin});
+   assert.notEqual(accepted.state,'ready','event acceptance must reject corrupted identity');
+   for(const mode of ['verification','review']) {
+    const fresh=C.checkAcceptedDocEvidence({snapshot,accepted,mode});
+    assert.equal(fresh.eligible,false,'fresh '+mode);
+    const cached=H.clone(b.accepted); cached.originContext=H.clone(snapshot.originContext);
+    const replay=C.checkAcceptedDocEvidence({snapshot,accepted:cached,mode});
+    assert.equal(replay.eligible,false,'cached '+mode);
+   }
+  }));
+ }
+ test(label('png-stays-hashed-and-reconciles'),()=>setup(({repo,flow})=>{
+  const first=flow();assert.equal(first.produced.state,'ready',JSON.stringify(first.produced.diagnostics));assert.equal(first.decision.eligible,true);
+  assert.deepEqual(Buffer.from(first.snapshot.candidate.records.find(x=>x.path==='assets/logo.png').storedBytes),binary);
+  fs.writeFileSync(path.join(repo.root,'assets/logo.png'),Buffer.concat([binary,Buffer.from([1])]));
+  const changed=flow();assert.equal(changed.produced.state,'ready');assert.equal(changed.decision.eligible,true);
+  assert.notEqual(changed.snapshot.identity.candidateDigest,first.snapshot.identity.candidateDigest);
+  assert.equal(changed.snapshot.identity.baselineDigest,first.snapshot.identity.baselineDigest);
+  assert.deepEqual(changed.snapshot.obligations,first.snapshot.obligations);
+ },{'assets/logo.png':binary}));
+ test(label('binary-only-is-legacy'),()=>setup(({repo,flow})=>{
+  fs.writeFileSync(path.join(repo.root,'assets/logo.png'),Buffer.concat([binary,Buffer.from([1])]));
+  const b=flow();assert.equal(b.produced.state,'ready');assert.equal(b.decision.decision,'legacy');assert.equal(b.decision.eligible,false);
+ },{'assets/logo.png':binary},'nondocument'));
+ for (const relevant of ['src/invalid.js','tests/invalid.dat','docs/prd/invalid.md','docs/roadmap/index.md']) {
+  test(label('undecodable-relevant-'+relevant),()=>setup(({repo,flow})=>{
+   fs.writeFileSync(path.join(repo.root,relevant),binary);
+   const b=flow();
+   if(b.produced.state==='ready') {
+    assert.equal(b.decision.eligible,false,'undecodable semantic input cannot silently earn complete credit');
+    if(relevant.startsWith('src/')) assert.equal(b.snapshot.facts.codeChanged,true,'changed binary source must retain code trigger');
+   }
+  },{[relevant]:'// REQ-GRPH-001\noriginal text\n'}));
+ }
+ test(label('undecodable-derived-source'),()=>setup(({repo,flow})=>{
+  const config=JSON.parse(fs.readFileSync(path.join(repo.root,H.CONFIG_REL),'utf8'));
+  config.derived[0].source='assets/logo.png';
+  fs.writeFileSync(path.join(repo.root,H.CONFIG_REL),JSON.stringify(config)+'\n');
+  fs.writeFileSync(path.join(repo.root,'assets/logo.png'),Buffer.concat([binary,Buffer.from([1])]));
+  const b=flow();
+  if(b.produced.state==='ready') {
+   assert.equal(b.snapshot.facts.derivedAffected,true,'changed derived binary input retains regeneration trigger');
+   assert(b.snapshot.obligations.some(o=>o.capability==='derived-regenerate' && o.applicability!=='N/A'),'derived binary source MUST survives');
+  }
+ },{'assets/logo.png':binary}));
+}
+console.log(JSON.stringify({passed,failed}));process.exitCode=failed?1:0;

package/benchmarks/results/reviews/pr353-r6-2026-10-22/cross-suite.txt

@@ -0,0 +1,18 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const Module = require('module');
+const peerRoot = path.resolve(process.argv[2]);
+const targetRoot = path.resolve(process.argv[3]);
+const suite = process.argv[4];
+const fixture = path.join(peerRoot,'ci/fixtures/doc-obligations/reconciliation-s2a/harness.js');
+const H = require(fixture);
+for (const leg of H.LEGS) {
+ leg.lib = path.join(targetRoot,path.relative(peerRoot,leg.lib));
+ leg.scripts = path.join(targetRoot,path.relative(peerRoot,leg.scripts));
+}
+const file = path.join(peerRoot,'ci',suite);
+console.log('Peer tests:',file,'implementation:',targetRoot);
+const m = new Module(file,module);
+m.filename=file;m.paths=Module._nodeModulePaths(path.dirname(file));
+m._compile(fs.readFileSync(file,'utf8'),file);

package/benchmarks/results/reviews/pr353-r6-2026-10-22/final-bom.log

@@ -0,0 +1,3 @@
+PASS source frontmatter unavailable
+PASS packaged frontmatter unavailable
+{"passed":2,"failed":0}

package/benchmarks/results/reviews/pr353-r6-2026-10-22/final-core.log

@@ -0,0 +1,198 @@
+  PASS A01:normative-complete-vector-eligible-with-exact-expected-set [source]
+  PASS A01:normative-complete-vector-eligible-with-exact-expected-set [packaged]
+  PASS A01:normative-checker-results-unchanged-from-direct-checker-call [source]
+  PASS A01:normative-checker-results-unchanged-from-direct-checker-call [packaged]
+  PASS A01:nonnormative-positive-is-eligible-and-review-not-forced [source]
+  PASS A01:nonnormative-positive-is-eligible-and-review-not-forced [packaged]
+  PASS A02:same-bytes-same-task-positive-control [source]
+  PASS A02:same-bytes-same-task-positive-control [packaged]
+  PASS A03:parse-A-then-replace-with-B-same-value-rejected [source]
+  PASS A03:parse-A-then-replace-with-B-same-value-rejected [packaged]
+  PASS A03:active-host-selection-change-rejected [source]
+  PASS A03:active-host-selection-change-rejected [packaged]
+  PASS A06:independent-review-eligible-in-review-mode-before-any-verifier [source]
+  PASS A06:independent-review-eligible-in-review-mode-before-any-verifier [packaged]
+  PASS A06:verification-stays-unresolved-with-review-only-evidence [source]
+  PASS A06:verification-stays-unresolved-with-review-only-evidence [packaged]
+  PASS A06:later-accepted-execution-makes-verification-retry-eligible [source]
+  PASS A06:later-accepted-execution-makes-verification-retry-eligible [packaged]
+  PASS A06:self-review-rejected-even-when-summary-claims-independence [source]
+  PASS A06:self-review-rejected-even-when-summary-claims-independence [packaged]
+  PASS A06:unknown-independent-provenance-rejected [source]
+  PASS A06:unknown-independent-provenance-rejected [packaged]
+  PASS A07:with-and-without-authored-doc-change-derive-the-same-musts [source]
+  PASS A07:with-and-without-authored-doc-change-derive-the-same-musts [packaged]
+  PASS A07:omit-one-result-quality-review-loses-eligibility-even-when-returned-results-pass [source]
+  PASS A07:omit-one-result-quality-review-loses-eligibility-even-when-returned-results-pass [packaged]
+  PASS A07:omit-all-results-loses-eligibility-even-when-returned-results-pass [source]
+  PASS A07:omit-all-results-loses-eligibility-even-when-returned-results-pass [packaged]
+  PASS A07:subset-results-only-lint-and-link-loses-eligibility-even-when-returned-results-pass [source]
+  PASS A07:subset-results-only-lint-and-link-loses-eligibility-even-when-returned-results-pass [packaged]
+  PASS A08:previously-nondocument-snapshot-is-legacy-never-verified [source]
+  PASS A08:previously-nondocument-snapshot-is-legacy-never-verified [packaged]
+  PASS A08:new-governed-scope-rejects-old-legacy-tuple-and-produces-current-musts [source]
+  PASS A08:new-governed-scope-rejects-old-legacy-tuple-and-produces-current-musts [packaged]
+  PASS A12:copied-journal-without-current-acceptance-rejected [source]
+  PASS A12:copied-journal-without-current-acceptance-rejected [packaged]
+  PASS A12:missing-origin-yields-origin-unavailable [source]
+  PASS A12:missing-origin-yields-origin-unavailable [packaged]
+  PASS A12:expired-origin-yields-origin-unavailable [source]
+  PASS A12:expired-origin-yields-origin-unavailable [packaged]
+  PASS A13:unknown-must-stays-unresolved [source]
+  PASS A13:unknown-must-stays-unresolved [packaged]
+  PASS A13:na-without-trusted-derivation-reason-is-unresolved [source]
+  PASS A13:na-without-trusted-derivation-reason-is-unresolved [packaged]
+  PASS A13:should-outcome-never-gates-a-complete-normative-vector [source]
+  PASS A13:should-outcome-never-gates-a-complete-normative-vector [packaged]
+  PASS R2d-P2b:rejected-should-never-gates-a-complete-must-set [source]
+  PASS R2d-P2b:rejected-should-never-gates-a-complete-must-set [packaged]
+  PASS R2d-P2b:rejected-na-obligation-event-never-gates-a-complete-must-set [source]
+  PASS R2d-P2b:rejected-na-obligation-event-never-gates-a-complete-must-set [packaged]
+  PASS R2d-P2b:rejected-applicable-must-still-blocks-eligibility [source]
+  PASS R2d-P2b:rejected-applicable-must-still-blocks-eligibility [packaged]
+  PASS R2e-P1:changed-provider-pin-commit-rejected-at-event-acceptance [source]
+  PASS R2e-P1:changed-provider-pin-commit-rejected-at-event-acceptance [packaged]
+  PASS R2e-P1:changed-provider-pin-root-rejected-at-event-acceptance [source]
+  PASS R2e-P1:changed-provider-pin-root-rejected-at-event-acceptance [packaged]
+  PASS R2e-P1:unchanged-provider-context-stays-eligible-control [source]
+  PASS R2e-P1:unchanged-provider-context-stays-eligible-control [packaged]
+  PASS R2f-P1:joint-origin-and-snapshot-pin-commit-tampering-rejected [source]
+  PASS R2f-P1:joint-origin-and-snapshot-pin-commit-tampering-rejected [packaged]
+  PASS R2f-P1:joint-origin-and-snapshot-pin-root-tampering-rejected [source]
+  PASS R2f-P1:joint-origin-and-snapshot-pin-root-tampering-rejected [packaged]
+  PASS R2f-P1:joint-origin-and-snapshot-pin-missing-pin-tampering-rejected [source]
+  PASS R2f-P1:joint-origin-and-snapshot-pin-missing-pin-tampering-rejected [packaged]
+  PASS R2f-P1:equivalent-provider-root-is-canonicalized-control [source]
+  PASS R2f-P1:equivalent-provider-root-is-canonicalized-control [packaged]
+  PASS R3-P1:joint-origin-and-identity-workspaceId-substitution-rejected [source]
+  PASS R3-P1:joint-origin-and-identity-workspaceId-substitution-rejected [packaged]
+  PASS R3-P1:joint-origin-and-identity-sessionId-substitution-rejected [source]
+  PASS R3-P1:joint-origin-and-identity-sessionId-substitution-rejected [packaged]
+  PASS R3-P1:joint-origin-and-identity-workflowId-substitution-rejected [source]
+  PASS R3-P1:joint-origin-and-identity-workflowId-substitution-rejected [packaged]
+  PASS R3-P1:joint-origin-and-identity-workflowRevision-substitution-rejected [source]
+  PASS R3-P1:joint-origin-and-identity-workflowRevision-substitution-rejected [packaged]
+  PASS R3-P1:joint-origin-and-identity-taskId-substitution-rejected [source]
+  PASS R3-P1:joint-origin-and-identity-taskId-substitution-rejected [packaged]
+  PASS R3-P1:joint-origin-and-active-host-substitution-rejected [source]
+  PASS R3-P1:joint-origin-and-active-host-substitution-rejected [packaged]
+  PASS R3-P1:joint-plan-and-identity-substitution-rejected [source]
+  PASS R3-P1:joint-plan-and-identity-substitution-rejected [packaged]
+  PASS R3-P1:unchanged-origin-identity-stays-eligible-control [source]
+  PASS R3-P1:unchanged-origin-identity-stays-eligible-control [packaged]
+  PASS R3-P1:config-capture-bytes-must-match-the-captured-inventory [source]
+  PASS R3-P1:config-capture-bytes-must-match-the-captured-inventory [packaged]
+  PASS R3-P2:irrelevant-binary-record-captures-and-reconciles [source]
+  PASS R3-P2:irrelevant-binary-record-captures-and-reconciles [packaged]
+  PASS R3-P2:core-fails-closed-on-a-relevant-undecodable-record [source]
+  PASS R3-P2:core-fails-closed-on-a-relevant-undecodable-record [packaged]
+  PASS A14:unchanged-repository-captures-identically [source]
+  PASS A14:unchanged-repository-captures-identically [packaged]
+  PASS A14:context-advancing-during-capture-rejected-as-snapshot-changed [source]
+  PASS A14:context-advancing-during-capture-rejected-as-snapshot-changed [packaged]
+  PASS A14:status-only-workflow-progress-does-not-stale-the-task-scope [source]
+  PASS A14:status-only-workflow-progress-does-not-stale-the-task-scope [packaged]
+  PASS flip:tuple-workspaceId [source]
+  PASS flip:tuple-workspaceId [packaged]
+  PASS flip:tuple-sessionId [source]
+  PASS flip:tuple-sessionId [packaged]
+  PASS flip:tuple-workflowId [source]
+  PASS flip:tuple-workflowId [packaged]
+  PASS flip:tuple-workflowRevision [source]
+  PASS flip:tuple-workflowRevision [packaged]
+  PASS flip:tuple-taskId [source]
+  PASS flip:tuple-taskId [packaged]
+  PASS flip:tuple-taskScopeDigest [source]
+  PASS flip:tuple-taskScopeDigest [packaged]
+  PASS flip:tuple-baselineDigest [source]
+  PASS flip:tuple-baselineDigest [packaged]
+  PASS flip:tuple-candidateDigest [source]
+  PASS flip:tuple-candidateDigest [packaged]
+  PASS flip:tuple-configDigest [source]
+  PASS flip:tuple-configDigest [packaged]
+  PASS flip:tuple-prdRoot [source]
+  PASS flip:tuple-prdRoot [packaged]
+  PASS flip:tuple-prdSetDigestSubstituted [source]
+  PASS flip:tuple-prdSetDigestSubstituted [packaged]
+  PASS flip:recapture-task-requirements-narrowed [source]
+  PASS flip:recapture-task-requirements-narrowed [packaged]
+  PASS flip:recapture-task-acceptance-changed [source]
+  PASS flip:recapture-task-acceptance-changed [packaged]
+  PASS flip:recapture-task-binding-changed [source]
+  PASS flip:recapture-task-binding-changed [packaged]
+  PASS flip:recapture-task-id-changed [source]
+  PASS flip:recapture-task-id-changed [packaged]
+  PASS flip:recapture-workflow-revision [source]
+  PASS flip:recapture-workflow-revision [packaged]
+  PASS flip:source-config-bytes [source]
+  PASS flip:source-config-bytes [packaged]
+  PASS flip:active-host-selection [source]
+  PASS flip:active-host-selection [packaged]
+  PASS flip:author-is-reviewer [source]
+  PASS flip:author-is-reviewer [packaged]
+  PASS flip:executor-is-reviewer [source]
+  PASS flip:executor-is-reviewer [packaged]
+  PASS flip:independence-unknown [source]
+  PASS flip:independence-unknown [packaged]
+  PASS flip:exit-null [source]
+  PASS flip:exit-null [packaged]
+  PASS flip:exit-noninteger [source]
+  PASS flip:exit-noninteger [packaged]
+  PASS flip:exit-nonzero [source]
+  PASS flip:exit-nonzero [packaged]
+  PASS flip:exit-signal [source]
+  PASS flip:exit-signal [packaged]
+  PASS flip:capability-unrelated-command [source]
+  PASS flip:capability-unrelated-command [packaged]
+  PASS flip:path-coverage-narrowed [source]
+  PASS flip:path-coverage-narrowed [packaged]
+  PASS flip:baseline-artifact-digest [source]
+  PASS flip:baseline-artifact-digest [packaged]
+  PASS flip:destination-digest-wrong [source]
+  PASS flip:destination-digest-wrong [packaged]
+  PASS flip:rename-other-tree-bytes [source]
+  PASS flip:rename-other-tree-bytes [packaged]
+  PASS flip:deleted-path-as-empty-file [source]
+  PASS flip:deleted-path-as-empty-file [packaged]
+  PASS flip:mode-drift [source]
+  PASS flip:mode-drift [packaged]
+  PASS flip:approve-verdict-rejected [source]
+  PASS flip:approve-verdict-rejected [packaged]
+  PASS flip:approve-summary-empty [source]
+  PASS flip:approve-summary-empty [packaged]
+  PASS flip:duplicate-event [source]
+  PASS flip:duplicate-event [packaged]
+  PASS flip:conflicting-event [source]
+  PASS flip:conflicting-event [packaged]
+  PASS flip:duplicate-result [source]
+  PASS flip:duplicate-result [packaged]
+  PASS flip:stale-review [source]
+  PASS flip:stale-review [packaged]
+  PASS flip:origin-expired [source]
+  PASS flip:origin-expired [packaged]
+  PASS flip:origin-missing [source]
+  PASS flip:origin-missing [packaged]
+  PASS flip:forged-copied-journal [source]
+  PASS flip:forged-copied-journal [packaged]
+  PASS flip:omitted-must [source]
+  PASS flip:omitted-must [packaged]
+  PASS regression:derive-and-checker-pins-normative [source]
+  PASS regression:derive-and-checker-pins-normative [packaged]
+  PASS regression:derive-and-checker-pins-nonnormative [source]
+  PASS regression:derive-and-checker-pins-nonnormative [packaged]
+  PASS regression:derive-and-checker-pins-code-only [source]
+  PASS regression:derive-and-checker-pins-code-only [packaged]
+  PASS regression:derive-and-checker-pins-nondocument [source]
+  PASS regression:derive-and-checker-pins-nondocument [packaged]
+  PASS regression:exported-signatures-unchanged [source]
+  PASS regression:exported-signatures-unchanged [packaged]
+  PASS purity:core-decisions-perform-no-io [source]
+  PASS purity:core-decisions-perform-no-io [packaged]
+  PASS parity:doc-reconciliation-producer.js-byte-identical [both]
+  PASS parity:doc-reconciliation-events.js-byte-identical [both]
+  PASS parity:doc-reconciliation-core.js-byte-identical [both]
+  PASS resolver:captured-export-and-copies-synchronized [source]
+  PASS resolver:captured-export-and-copies-synchronized [packaged]
+
+S2a core summary: 195 PASS, 0 FAIL, 0 INFRA across 195 assertion-legs
+S2a core suite: all assertions PASS.

package/benchmarks/results/reviews/pr353-r6-2026-10-22/final-probes.log

@@ -0,0 +1,27 @@
+PASS source:joint-workspaceId
+PASS source:joint-sessionId
+PASS source:joint-workflowId
+PASS source:joint-workflowRevision
+PASS source:joint-taskId
+PASS source:joint-activeHost
+PASS source:png-stays-hashed-and-reconciles
+PASS source:binary-only-is-legacy
+PASS source:undecodable-relevant-src/invalid.js
+PASS source:undecodable-relevant-tests/invalid.dat
+PASS source:undecodable-relevant-docs/prd/invalid.md
+PASS source:undecodable-relevant-docs/roadmap/index.md
+PASS source:undecodable-derived-source
+PASS packaged:joint-workspaceId
+PASS packaged:joint-sessionId
+PASS packaged:joint-workflowId
+PASS packaged:joint-workflowRevision
+PASS packaged:joint-taskId
+PASS packaged:joint-activeHost
+PASS packaged:png-stays-hashed-and-reconciles
+PASS packaged:binary-only-is-legacy
+PASS packaged:undecodable-relevant-src/invalid.js
+PASS packaged:undecodable-relevant-tests/invalid.dat
+PASS packaged:undecodable-relevant-docs/prd/invalid.md
+PASS packaged:undecodable-relevant-docs/roadmap/index.md
+PASS packaged:undecodable-derived-source
+{"passed":26,"failed":0}