tracegrove 0.0.0-stage → 0.3.0

package/samples/notes-api/verification/auth/host-issued-owner.yaml

@@ -0,0 +1,6 @@
+schemaVersion: workflow.auth-recipe/v1
+ref: { id: example.auth.owner, revision: "1" }
+kind: host_issued
+credentialName: owner_token
+header: authorization
+scheme: Bearer

package/samples/notes-api/verification/cases/notes.contract.yaml

@@ -0,0 +1,51 @@
+schemaVersion: workflow.case/v1
+ref: { id: example.notes.contract, revision: "1" }
+purpose: Exercise the declared notes contract against a loopback stub. Teaches the schema; proves nothing about the real application.
+workflowId: notes.create
+requirementRefs: []
+sourceRefs: []
+sourceAnalysisRef: null
+risk: exploratory
+surface: api
+surfaceBindingRef: { $file: ../surfaces/http-api.binding.yaml }
+proofClaim: The case contract and reducer behave as declared under a stubbed application boundary. No live product claim.
+environmentClasses: [isolated_candidate]
+requiredCapabilities: [http.request, observe]
+requiredBoundaries:
+  - { boundaryId: application, mode: stubbed }
+dependencyCases: []
+personaRef: { $file: ../personas/owner.yaml }
+datasetRef: null
+fixturePlanRef: null
+navigationRef: null
+preconditions: []
+steps:
+  - id: create
+    kind: http.request
+    timeoutMs: 5000
+    inputs: { title: { kind: literal, value: Stub note } }
+    retry: { attempts: 1 }
+    method: POST
+    path: /notes
+    headers: {}
+    body: { title: "{title}", body: stub }
+    auth: { kind: persona }
+    expectStatus: 201
+    captures: [ { name: noteId, from: json, path: note.id } ]
+  - id: read_back
+    kind: observe
+    timeoutMs: 5000
+    inputs: { noteId: { kind: capture, stepId: create, name: noteId } }
+    retry: { attempts: 1 }
+    readback: { kind: http, method: GET, path: "/notes/{noteId}", auth: { kind: persona } }
+    predicate: { kind: status_equals, value: 200 }
+    pollIntervalMs: 100
+    captures: []
+assertions:
+  - { id: a.created, required: true, environmentClasses: [isolated_candidate], oracle: { name: step.result, version: "1" }, stepId: create, predicate: { kind: step_result, value: completed }, coverageTags: [notes.contract] }
+  - { id: a.readback, required: true, environmentClasses: [isolated_candidate], oracle: { name: http.observation, version: "1" }, stepId: read_back, predicate: { kind: all, predicates: [ { kind: status_equals, value: 200 }, { kind: json_path_present, path: body.note.id } ] }, coverageTags: [notes.contract] }
+effects: { mode: designated_writes, allowedHosts: ["launch://notes-api"], allowedMethods: [GET, POST], allowedResourcePrefixes: ["/notes"], maxCreates: 1, maxMessages: 0, maxJobs: 0, cleanupRecipeRef: null }
+limits: { deadlineMs: 20000, maxProviderRequests: 0, maxTokens: 0, costCeilingCents: 0, maxBrowserActions: 0, maxArtifactBytes: 1048576, diagnosticRetries: 0, concurrencyGroup: notes }
+capture: { stepEvents: true, networkMetadata: true, trace: optional, video: optional, redactionPolicyRef: null, retentionPolicyRef: null }
+baselineRef: null
+generation: null

package/samples/notes-api/verification/cases/notes.create.yaml

@@ -0,0 +1,123 @@
+schemaVersion: workflow.case/v1
+ref: { id: example.notes.create, revision: "1" }
+purpose: Create a note through the real API, read it back independently, confirm a foreign principal is denied, delete only that note and confirm absence while a seeded note stays intact.
+workflowId: notes.create
+requirementRefs: []
+sourceRefs: []
+sourceAnalysisRef: null
+risk: critical
+surface: api
+surfaceBindingRef: { $file: ../surfaces/http-api.binding.yaml }
+proofClaim: The locally launched notes application, at the attested source digest, persists and authorizes notes through its normal HTTP API. This establishes local application behavior, not production deployment identity.
+environmentClasses: [isolated_candidate]
+requiredCapabilities: [http.request, observe, fixture.http]
+requiredBoundaries:
+  - { boundaryId: application, mode: real }
+  - { boundaryId: storage, mode: real }
+dependencyCases: []
+personaRef: { $file: ../personas/owner.yaml }
+datasetRef: null
+fixturePlanRef: { $file: ../fixtures/existing-note.plan.yaml }
+navigationRef: null
+preconditions: []
+steps:
+  - id: create
+    kind: http.request
+    timeoutMs: 5000
+    inputs:
+      title: { kind: literal, value: Fresh note }
+      body: { kind: literal, value: Written through the real API. }
+    retry: { attempts: 1 }
+    method: POST
+    path: /notes
+    headers: {}
+    body: { title: "{title}", body: "{body}" }
+    auth: { kind: persona }
+    expectStatus: 201
+    captures:
+      - { name: noteId, from: json, path: note.id }
+  - id: read_back
+    kind: observe
+    timeoutMs: 5000
+    inputs:
+      noteId: { kind: capture, stepId: create, name: noteId }
+    retry: { attempts: 1 }
+    readback: { kind: http, method: GET, path: "/notes/{noteId}", auth: { kind: persona } }
+    predicate:
+      kind: all
+      predicates:
+        - { kind: status_equals, value: 200 }
+        - { kind: json_path_equals, path: body.note.title, value: Fresh note }
+    pollIntervalMs: 100
+    captures: []
+  - id: intruder_read
+    kind: http.request
+    timeoutMs: 5000
+    inputs:
+      noteId: { kind: capture, stepId: create, name: noteId }
+      intruder: { kind: credential, name: intruder_token }
+    retry: { attempts: 1 }
+    method: GET
+    path: "/notes/{noteId}"
+    headers: {}
+    body: null
+    auth: { kind: credential, name: intruder_token }
+    expectStatus: null
+    captures: []
+  - id: delete
+    kind: http.request
+    timeoutMs: 5000
+    inputs:
+      noteId: { kind: capture, stepId: create, name: noteId }
+    retry: { attempts: 1 }
+    method: DELETE
+    path: "/notes/{noteId}"
+    headers: {}
+    body: null
+    auth: { kind: persona }
+    expectStatus: 204
+    captures: []
+  - id: confirm_absent
+    kind: observe
+    timeoutMs: 5000
+    inputs:
+      noteId: { kind: capture, stepId: create, name: noteId }
+    retry: { attempts: 1 }
+    readback: { kind: http, method: GET, path: "/notes/{noteId}", auth: { kind: persona } }
+    predicate: { kind: status_equals, value: 404 }
+    pollIntervalMs: 100
+    captures: []
+  - id: existing_intact
+    kind: observe
+    timeoutMs: 5000
+    inputs:
+      existingId: { kind: fixture, entityKey: existing_note, outputName: noteId }
+    retry: { attempts: 1 }
+    readback: { kind: http, method: GET, path: "/notes/{existingId}", auth: { kind: persona } }
+    predicate:
+      kind: all
+      predicates:
+        - { kind: status_equals, value: 200 }
+        - { kind: json_path_equals, path: body.note.title, value: Existing note }
+    pollIntervalMs: 100
+    captures: []
+assertions:
+  - { id: a.created, required: true, environmentClasses: [isolated_candidate], oracle: { name: step.result, version: "1" }, stepId: create, predicate: { kind: step_result, value: completed }, coverageTags: [notes.create] }
+  - { id: a.readback, required: true, environmentClasses: [isolated_candidate], oracle: { name: http.observation, version: "1" }, stepId: read_back, predicate: { kind: all, predicates: [ { kind: status_equals, value: 200 }, { kind: json_path_equals, path: body.note.title, value: Fresh note }, { kind: json_path_equals, path: body.note.body, value: Written through the real API. } ] }, coverageTags: [notes.read] }
+  - { id: a.denied, required: true, environmentClasses: [isolated_candidate], oracle: { name: http.observation, version: "1" }, stepId: intruder_read, predicate: { kind: all, predicates: [ { kind: status_equals, value: 403 }, { kind: json_path_absent, path: body.note } ] }, coverageTags: [notes.authz] }
+  - { id: a.deleted, required: true, environmentClasses: [isolated_candidate], oracle: { name: step.result, version: "1" }, stepId: delete, predicate: { kind: step_result, value: completed }, coverageTags: [notes.delete] }
+  - { id: a.absent, required: true, environmentClasses: [isolated_candidate], oracle: { name: http.observation, version: "1" }, stepId: confirm_absent, predicate: { kind: status_equals, value: 404 }, coverageTags: [notes.delete] }
+  - { id: a.existing_intact, required: true, environmentClasses: [isolated_candidate], oracle: { name: http.observation, version: "1" }, stepId: existing_intact, predicate: { kind: all, predicates: [ { kind: status_equals, value: 200 }, { kind: json_path_equals, path: body.note.title, value: Existing note } ] }, coverageTags: [notes.isolation] }
+effects:
+  mode: designated_writes
+  allowedHosts: ["launch://notes-api"]
+  allowedMethods: [GET, POST, DELETE]
+  allowedResourcePrefixes: ["/notes"]
+  maxCreates: 2
+  maxMessages: 0
+  maxJobs: 0
+  cleanupRecipeRef: null
+limits: { deadlineMs: 30000, maxProviderRequests: 0, maxTokens: 0, costCeilingCents: 0, maxBrowserActions: 0, maxArtifactBytes: 1048576, diagnosticRetries: 0, concurrencyGroup: notes }
+capture: { stepEvents: true, networkMetadata: true, trace: optional, video: optional, redactionPolicyRef: null, retentionPolicyRef: null }
+baselineRef: null
+generation: null

package/samples/notes-api/verification/cases/notes.suite.yaml

@@ -0,0 +1,5 @@
+schemaVersion: workflow.suite/v1
+id: notes.suite
+cases:
+  - { caseRef: ./notes.create.yaml, required: true, profiles: [native-real] }
+  - { caseRef: ./notes.contract.yaml, required: true, profiles: [offline-contract] }

package/samples/notes-api/verification/components/notes-api-stub.profile.yaml

@@ -0,0 +1,8 @@
+schemaVersion: workflow.component-profile/v1
+ref: { id: example.components.notes-api-stub, revision: "1" }
+components:
+  - componentId: notes-api
+    kind: application
+    required: true
+    expectedIdentity: { kind: declared_release, release: stub }
+    exclusionReason: null

package/samples/notes-api/verification/components/notes-api.profile.yaml

@@ -0,0 +1,15 @@
+schemaVersion: workflow.component-profile/v1
+ref:
+  id: example.components.notes-api
+  revision: "1"
+components:
+  - componentId: notes-api
+    kind: application
+    required: true
+    expectedIdentity:
+      kind: source_digest
+      sourceDigest:
+        algorithm: sha256
+        hex: e5218f7d91fbd86adac23fad45a169bc5827bc7a1aa673447aab0221e6918d03
+      runtime: node22
+    exclusionReason: null

package/samples/notes-api/verification/environments/local-notes.yaml

@@ -0,0 +1,11 @@
+schemaVersion: workflow.environment-plan/v1
+ref: { id: example.env.local-notes, revision: "1" }
+class: isolated_candidate
+origins: ["launch://notes-api"]
+componentProfileRef: { $file: ../components/notes-api.profile.yaml }
+credentialRecipeRef: { $file: ../auth/host-issued-owner.yaml }
+actionEnvelopeRef: null
+personaLeasePolicyRef: null
+budgetPolicyRef: null
+networkProfileRef: null
+clockProfileRef: null

package/samples/notes-api/verification/environments/mock-notes.yaml

@@ -0,0 +1,11 @@
+schemaVersion: workflow.environment-plan/v1
+ref: { id: example.env.mock-notes, revision: "1" }
+class: isolated_candidate
+origins: ["launch://notes-api"]
+componentProfileRef: { $file: ../components/notes-api-stub.profile.yaml }
+credentialRecipeRef: { $file: ../auth/host-issued-owner.yaml }
+actionEnvelopeRef: null
+personaLeasePolicyRef: null
+budgetPolicyRef: null
+networkProfileRef: null
+clockProfileRef: null

package/samples/notes-api/verification/fidelity/full-live-sandbox.yaml

@@ -0,0 +1,7 @@
+schemaVersion: workflow.fidelity-profile/v1
+ref: { id: example.fidelity.full-live-sandbox, revision: "1" }
+lane: full_live_sandbox
+boundaryProfileRef: null
+boundaryRules:
+  - { boundaryId: application, adapterRef: null, mode: real, required: true, exclusionReasonRef: null, accountClass: local, readbackOracleRef: null, interceptorRef: null }
+  - { boundaryId: storage, adapterRef: null, mode: real, required: true, exclusionReasonRef: null, accountClass: local, readbackOracleRef: null, interceptorRef: null }

package/samples/notes-api/verification/fidelity/mock-contract.yaml

@@ -0,0 +1,6 @@
+schemaVersion: workflow.fidelity-profile/v1
+ref: { id: example.fidelity.mock-contract, revision: "1" }
+lane: mock_contract
+boundaryProfileRef: null
+boundaryRules:
+  - { boundaryId: application, adapterRef: null, mode: stubbed, required: true, exclusionReasonRef: null, accountClass: none, readbackOracleRef: null, interceptorRef: null }

package/samples/notes-api/verification/fixtures/existing-note.payload.yaml

@@ -0,0 +1,15 @@
+schemaVersion: workflow.logical-payload/v1
+ref:
+  id: example.recipe.existing-note.payload
+  revision: "1"
+seedRecipeRef:
+  id: example.recipe.existing-note
+  revision: "1"
+  digest:
+    algorithm: sha256
+    hex: 1e858b98f27166343a5d7a7140840f1bab76df97b8cda1a439b13c40c71b1a9f
+entities:
+  - entityKey: existing_note
+    values:
+      title: Existing note
+      body: zephyr pebble nectar velvet quartz thistle

package/samples/notes-api/verification/fixtures/existing-note.plan.yaml

@@ -0,0 +1,9 @@
+schemaVersion: workflow.fixture-plan/v1
+kind: case
+ref: { id: example.fixture-plan.existing-note, revision: "1" }
+seedRecipeRef: { $file: ./existing-note.recipe.yaml }
+modelCatalogRef: null
+logicalPayloadRef: { $file: ./existing-note.payload.yaml }
+outputBindingsSchemaRef: null
+effectEnvelopeRef: null
+limitPolicyRef: null

package/samples/notes-api/verification/fixtures/existing-note.recipe.yaml

@@ -0,0 +1,29 @@
+schemaVersion: workflow.seed-recipe/v1
+ref: { id: example.recipe.existing-note, revision: "1" }
+intent: One pre-existing note owned by the persona that the case must leave intact.
+modelCatalogRef: null
+actionRegistryRef: { $file: ../actions/notes.registry.yaml }
+entities:
+  - entityKey: existing_note
+    modelId: note
+    actionId: notes.create/v1
+    dependsOn: []
+    traits: []
+    values:
+      title: { kind: literal, value: Existing note }
+      body: { kind: generator, generatorId: words, args: { count: 6 } }
+    outputNames: [noteId]
+    readback:
+      actionId: notes.read/v1
+      predicate:
+        kind: all
+        predicates:
+          - { kind: status_equals, value: 200 }
+          - { kind: json_path_equals, path: body.note.title, value: Existing note }
+    cleanup:
+      actionId: notes.delete/v1
+      absenceReadback: { actionId: notes.read/v1, expectStatus: 404 }
+relationBindings: []
+cleanupStrategy: reverse_dependency_order
+lifecyclePolicy: application_api
+generation: { logicalSeed: notes-existing-note-1, generatorVersion: "1", locale: en-US, timezone: UTC, logicalClock: "2026-10-10T00:00:00Z" }

package/samples/notes-api/verification/hosts/local-process.yaml

@@ -0,0 +1,27 @@
+schemaVersion: workflow.host-plan/v1
+ref: { id: example.host.local-process, revision: "1" }
+placement: local
+adapter: local_process
+launch:
+  componentId: notes-api
+  command: node
+  args: [app/app.mjs]
+  cwd: ..
+  env: { NOTES_BUILD: sample }
+  portEnv: PORT
+  dataDirEnv: NOTES_DIR
+  credentialsEnv: NOTES_TOKENS
+  readiness: { path: /health, timeoutMs: 5000 }
+  identitySourceFiles: [app/app.mjs, app/http.mjs]
+  issuedCredentials:
+    - { name: owner_token, subject: alice }
+    - { name: intruder_token, subject: bob }
+mockResponsesRef: null
+transportPolicy: in_process
+isolationPolicy: fresh_directory_and_port
+networkRules: [loopback_only]
+requestedResources: { cpu: 1, memoryMb: 128, diskMb: 16 }
+requiredCapabilities: [shell, network_origin:loopback, confirmed_cancel, artifact_delivery]
+captureRequirements: []
+sessionLifetimeMs: 120000
+cleanupReserveMs: 10000

package/samples/notes-api/verification/hosts/mock-loopback.yaml

@@ -0,0 +1,14 @@
+schemaVersion: workflow.host-plan/v1
+ref: { id: example.host.mock-loopback, revision: "1" }
+placement: local
+adapter: mock_loopback
+launch: null
+mockResponsesRef: { $file: ../mocks/notes.responses.yaml }
+transportPolicy: in_process
+isolationPolicy: fresh_directory_and_port
+networkRules: [loopback_only]
+requestedResources: { cpu: 1, memoryMb: 64, diskMb: 1 }
+requiredCapabilities: [network_origin:loopback, confirmed_cancel, artifact_delivery]
+captureRequirements: []
+sessionLifetimeMs: 60000
+cleanupReserveMs: 5000

package/samples/notes-api/verification/mocks/notes.responses.yaml

@@ -0,0 +1,5 @@
+schemaVersion: workflow.mock-responses/v1
+ref: { id: example.mock.notes, revision: "1" }
+routes:
+  - { method: POST, path: /notes, status: 201, body: { note: { id: 00000000-0000-4000-8000-000000000001, title: Stub note, body: stub } }, requireBearer: true }
+  - { method: GET, path: "/notes/{id}", status: 200, body: { note: { id: 00000000-0000-4000-8000-000000000001, title: Stub note, body: stub } }, requireBearer: true }

package/samples/notes-api/verification/personas/owner.yaml

@@ -0,0 +1,16 @@
+schemaVersion: workflow.persona/v1
+ref: { id: example.persona.owner, revision: "1" }
+traits: [new_user]
+accountBindingRef: null
+roleScopes: [notes.owner]
+stateRecipeRef: null
+dataVolumeRecipeRef: null
+entitlementRef: null
+connectorStateRef: null
+authRecipeRef: { $file: ../auth/host-issued-owner.yaml }
+locale: en-US
+timezone: UTC
+viewport: { width: 1280, height: 800 }
+inputMode: keyboard
+reducedMotion: true
+cleanupPolicyRef: null

package/samples/notes-api/verification/policies/no-authoring-inference.yaml

@@ -0,0 +1,10 @@
+schemaVersion: workflow.intelligence-policy/v1
+ref: { id: example.policy.no-authoring-inference, revision: "1" }
+stages:
+  analysis: { allowed: false, maxCalls: 0, maxTokens: 0, costCeilingCents: 0 }
+  drafting: { allowed: false, maxCalls: 0, maxTokens: 0, costCeilingCents: 0 }
+  discovery: { allowed: false, maxCalls: 0, maxTokens: 0, costCeilingCents: 0 }
+  diagnosis: { allowed: false, maxCalls: 0, maxTokens: 0, costCeilingCents: 0 }
+  evaluation: { allowed: false, maxCalls: 0, maxTokens: 0, costCeilingCents: 0 }
+  benchmark: { allowed: false, maxCalls: 0, maxTokens: 0, costCeilingCents: 0 }
+replayInference: none

package/samples/notes-api/verification/runners/http.yaml

@@ -0,0 +1,5 @@
+schemaVersion: workflow.runner-profile/v1
+ref: { id: tracegrove.runner.http, revision: "1" }
+adapter: http
+maxStepsPerCase: 50
+cancellation: confirmed

package/samples/notes-api/verification/surfaces/http-api.binding.yaml

@@ -0,0 +1,11 @@
+schemaVersion: workflow.surface-binding/v1
+ref: { id: example.surface.notes-http, revision: "1" }
+kind: http_api
+packRef: { $file: ./http-api.pack.yaml }
+driverProfileRef: null
+componentProfileRef: { $file: ../components/notes-api.profile.yaml }
+interaction: protocol
+configurationSchemaRef: null
+configurationRef: null
+variantPolicyRef: null
+requiredCapabilities: [http.request, observe]

package/samples/notes-api/verification/surfaces/http-api.pack.yaml

@@ -0,0 +1,7 @@
+schemaVersion: workflow.surface-pack/v1
+ref: { id: tracegrove.pack.http-api, revision: "1" }
+kind: http_api
+protocol: http
+stepKinds: [http.request, observe]
+oracles: [http.observation/1, step.result/1]
+captureFormats: [application/json]

package/samples/notes-api/verification/workflow.yaml

@@ -0,0 +1,27 @@
+schemaVersion: workflow.config/v1
+project: notes
+suiteRef: ./cases/notes.suite.yaml
+defaultProfile: native-real
+outputDir: ./verification-output
+sourceSetRef: null
+executionHostRef: ./hosts/local-process.yaml
+intelligencePolicyRef: ./policies/no-authoring-inference.yaml
+profiles:
+  native-real:
+    class: isolated_candidate
+    environmentPlanRef: ./environments/local-notes.yaml
+    hostPlanRef: null
+    personaRef: ./personas/owner.yaml
+    fixturePlanRef: null
+    fidelityProfileRef: ./fidelity/full-live-sandbox.yaml
+    runnerRef: ./runners/http.yaml
+    budget: { deadlineMs: 60000, costCeilingCents: 0 }
+  offline-contract:
+    class: isolated_candidate
+    environmentPlanRef: ./environments/mock-notes.yaml
+    hostPlanRef: ./hosts/mock-loopback.yaml
+    personaRef: ./personas/owner.yaml
+    fixturePlanRef: null
+    fidelityProfileRef: ./fidelity/mock-contract.yaml
+    runnerRef: ./runners/http.yaml
+    budget: { deadlineMs: 20000, costCeilingCents: 0 }

package/samples/notes-browser/tracegrove/notes/browser.flow.yaml

@@ -0,0 +1,19 @@
+title: A seeded note appears in the authenticated browser
+tags: [browser, smoke]
+given: { existing: existing-note }
+browser:
+  allowPaths: [/ui, /notes]
+  allowMethods: [GET, HEAD]
+steps:
+  - name: open notes
+    browser: { kind: navigate, path: /ui }
+    expect: { status: 200 }
+  - name: refresh notes
+    browser: { kind: click, target: { by: role, role: button, name: Refresh } }
+  - name: note is visible
+    browser: { kind: read, target: { by: testId, name: notes } }
+    expect: { text: Existing note }
+  - name: independent API readback
+    GET: /notes/{existing.noteId}
+    observe: true
+    expect: { status: 200, json: { note.title: Existing note } }

package/samples/notes-browser/verification/cases/notes.browser.yaml

@@ -0,0 +1,63 @@
+schemaVersion: workflow.case/v1
+ref: { id: example.notes.browser, revision: "1" }
+purpose: Read a seeded note through the authenticated browser and confirm its state through an independent API readback.
+workflowId: notes.browser
+requirementRefs: []
+sourceRefs: []
+sourceAnalysisRef: null
+risk: standard
+surface: hybrid
+surfaceBindingRef: { $file: ../surfaces/http-api.binding.yaml }
+proofClaim: The locally launched application displays a seeded note through its authenticated UI, agrees with an independent API readback, and records the browser interaction. This establishes local application behavior only.
+environmentClasses: [isolated_candidate]
+requiredCapabilities: [ui.navigate, ui.action, ui.observe, observe, fixture.http]
+requiredBoundaries:
+  - { boundaryId: application, mode: real }
+  - { boundaryId: storage, mode: real }
+dependencyCases: []
+personaRef: { $file: ../personas/owner.yaml }
+datasetRef: null
+fixturePlanRef: { $file: ../fixtures/existing-note.plan.yaml }
+navigationRef: null
+preconditions: []
+steps:
+  - { id: navigate, kind: ui.navigate, path: /ui, timeoutMs: 5000, inputs: {}, retry: { attempts: 1 } }
+  - id: refresh
+    kind: ui.action
+    timeoutMs: 5000
+    inputs: {}
+    retry: { attempts: 1 }
+    command: { kind: click, target: { by: role, role: button, name: Refresh } }
+  - id: read_dom
+    kind: ui.observe
+    timeoutMs: 5000
+    inputs: {}
+    retry: { attempts: 1 }
+    target: { by: testId, name: notes }
+    predicate: { kind: json_path_equals, path: browser.text, value: Existing note }
+    pollIntervalMs: 50
+  - id: read_api
+    kind: observe
+    timeoutMs: 5000
+    inputs: { existingId: { kind: fixture, entityKey: existing_note, outputName: noteId } }
+    retry: { attempts: 1 }
+    readback: { kind: http, method: GET, path: "/notes/{existingId}", auth: { kind: persona } }
+    predicate: { kind: json_path_equals, path: body.note.title, value: Existing note }
+    pollIntervalMs: 50
+    captures: []
+assertions:
+  - { id: a.browser, stepId: read_dom, required: true, environmentClasses: [isolated_candidate], oracle: { name: browser.observation, version: "1" }, predicate: { kind: json_path_equals, path: browser.text, value: Existing note }, coverageTags: [notes.ui] }
+  - { id: a.readback, stepId: read_api, required: true, environmentClasses: [isolated_candidate], oracle: { name: http.observation, version: "1" }, predicate: { kind: all, predicates: [ { kind: status_equals, value: 200 }, { kind: json_path_equals, path: body.note.title, value: Existing note } ] }, coverageTags: [notes.read] }
+effects:
+  mode: read_only
+  allowedHosts: ["launch://notes-api"]
+  allowedMethods: [GET, HEAD]
+  allowedResourcePrefixes: [/ui, /notes]
+  maxCreates: 1
+  maxMessages: 0
+  maxJobs: 0
+  cleanupRecipeRef: null
+limits: { deadlineMs: 30000, maxProviderRequests: 0, maxTokens: 0, costCeilingCents: 0, maxBrowserActions: 50, maxArtifactBytes: 2097152, diagnosticRetries: 0, concurrencyGroup: notes }
+capture: { stepEvents: true, networkMetadata: true, trace: optional, video: required, redactionPolicyRef: null, retentionPolicyRef: null }
+baselineRef: null
+generation: null

package/samples/notes-browser/verification/cases/notes.suite.yaml

@@ -0,0 +1,4 @@
+schemaVersion: workflow.suite/v1
+id: notes.browser.suite
+cases:
+  - { caseRef: ./notes.browser.yaml, required: true, profiles: [native-real] }

package/samples/notes-browser/verification/runners/http.yaml

@@ -0,0 +1,5 @@
+schemaVersion: workflow.runner-profile/v1
+ref: { id: tracegrove.runner.browser, revision: "1" }
+adapter: browser
+maxStepsPerCase: 50
+cancellation: confirmed

package/samples/notes-browser/verification/surfaces/http-api.binding.yaml

@@ -0,0 +1,11 @@
+schemaVersion: workflow.surface-binding/v1
+ref: { id: example.surface.notes-browser, revision: "1" }
+kind: web
+packRef: { $file: ./http-api.pack.yaml }
+driverProfileRef: null
+componentProfileRef: { $file: ../components/notes-api.profile.yaml }
+interaction: hybrid
+configurationSchemaRef: null
+configurationRef: null
+variantPolicyRef: null
+requiredCapabilities: [http.request, observe, ui.navigate, ui.action, ui.observe]

package/samples/notes-browser/verification/surfaces/http-api.pack.yaml

@@ -0,0 +1,7 @@
+schemaVersion: workflow.surface-pack/v1
+ref: { id: tracegrove.pack.browser, revision: "1" }
+kind: web
+protocol: playwright
+stepKinds: [http.request, observe, ui.navigate, ui.action, ui.observe]
+oracles: [http.observation/1, browser.observation/1, step.result/1]
+captureFormats: [application/json, video/webm]

package/samples/notes-django/README.md

@@ -0,0 +1,21 @@
+# Django notes sample
+
+This local Django application uses real HTTP and file-backed persistence. It has no ORM models, database connection, OrgX SDK, provider account or authoring inference. The runner uses the same cases, fixtures, assertions and HTTP adapter as the Node notes sample.
+
+Use Python 3.13 and the verifier's supported Node 22 runtime. From this generated sample directory:
+
+```sh
+python3.13 -m venv .venv
+.venv/bin/python -m pip install --require-hashes -r app/requirements.lock
+workflow-verify doctor --config verification/workflow.yaml
+workflow-verify plan --config verification/workflow.yaml --output request.json
+workflow-verify run --request request.json --json
+```
+
+The launch recipe issues temporary owner and intruder credentials, allocates a fresh loopback port and writes notes inside the attempt's owned workspace. The local supervisor terminates the application group and removes that workspace after confirmed cleanup. No application data is written into the sample's source directory.
+
+The source identity binds `app/django_app.py` and `app/requirements.lock`. The launcher observes Python's executable version and digest separately. Startup refuses installed dependency versions that disagree with the lock. This establishes local behavior; it does not attest installed dependency bytes or prove a production deployment.
+
+The lock pins Django 6.1.2, asgiref and sqlparse to the downloaded pure-Python wheel hashes. Install with `--require-hashes`; do not replace the lock with an unpinned install. These dependencies use BSD licenses and remain distributed separately from this sample's Apache-2.0 source. The [Django standalone-settings documentation](https://docs.djangoproject.com/en/6.1/topics/settings/#using-settings-without-setting-django-settings-module) describes the settings/setup path.
+
+Export the completed execution with `workflow-verify export`, then use `workflow-verify verify-bundle` to check its saved evidence. Product assertions, successful cleanup and a verified local bundle each describe their own evidence; none enables hosted execution.