Close proof, contract, release, and onboarding audit gaps

[iperev]

Summary

Closes the confirmed July 2026 architecture, proof, security, release, package, documentation, onboarding, browser-UX, and test-oracle findings with owner-bound contracts and executable falsifiers.

• Canonical correction authority: docs/implementation/audit-remediation-design.md (C-01 through C-124).
• Execution authority: docs/implementation/audit-remediation-plan.md; it contains no duplicated correction-ledger rows.
• The implementation preserves valid-input business behavior except for the explicit versioned 0.2.0 compatibility record.

Exact object

• Audit baseline: 3d86b6d
• Integration base and single parent: 0df4c28
• Candidate: 7ffd0d5
• Tree: 18a70ada42fa549a5097f0ee1b6dc1bfc40c3145
• Diff: 150 files, 39,928 insertions, 2,185 deletions
• Binary diff SHA-256: f7937b87999cf30d879b470842aa191a490d4edbd0c6c6c647615efc77865853

External audit adjudication

• Confirmed: the PR closeout predicate was incomplete. It is now executed below with canonical provider and local-closeout bytes, SHA-256 markers, sentinels, and byte-level server readback.
• Confirmed: late handoff completion could overwrite a newer view state. C-118 binds global-state publication to the captured view identity while preserving one-shot packet publication.
• Rejected: the claimed unreachable record above offset 20,000 has no admitted counterexample. The 8 MiB workspace byte cap makes the proposed 20,225-record dataset impossible, so Admit(dataset) is false for that witness.
• Rejected: design and plan do not duplicate the C-ledger. The design contains exactly C-01 through C-124 once; the plan contains zero C-ledger rows and delegates correction authority to the design.

Final correction cycles

• C-119 through C-121 replace provider-falsified browser lifecycle waits with pre-armed exact-URL, exact-main-frame navigation-response observation, successful-response admission, and exact semantic readiness.
• C-120 and C-123 falsify response, heading, URL, credential, path, query, fragment, navigation-kind, frame, and foreign-URL drift.
• C-124 falsifies token admission, pre-arm ordering, abort, and waiter-rejection consumption with a deterministic pending waiter.
• C-122 time-indexes correction inventories and makes the final staging declaration and executable predicate identical.
• C-118 prevents late successful or failed handoffs from replacing a newer view state without changing server submission semantics.

Verification

The exact committed object passed npm run check:

• browser static: 22/22;
• browser runtime: 93/93 (31 Chromium, 31 Firefox, 31 WebKit), one worker, zero retries, unchanged 30-second timeout;
• all Go tests, formatting, vet, staticcheck, actionlint, and govulncheck (no known vulnerabilities reported by the pinned scanner);
• npm tarball and all declared Python wheels, SBOM, manifest, self-hosting receipts, and package execution;
• coverage: 69/69 requirements bound, 173 scenarios, 78 commands;
• local closeout: 5/5 blocking criteria satisfied, zero blocking unsatisfied, one provider-publication advisory skipped.

Five earlier classifier/status/heading mutants plus the C-123 path mutant and C-124 token/abort/consume mutants each failed through their owning oracle. The final 5.6-Sol maximum-reasoning audit returned APPROVE with P0/P1/P2/P3 = 0/0/0/0; its academic bundle contained 32 records, 38 obligations, and zero unresolved obligations.

Provider proof

• Exact PR/SHA CI run: 30341326847, attempt 1, conclusion success.
• Closed CI job inventory: source, macOS platform smoke, browser runtime, and required aggregate; all four succeeded.
• All nine literal-SHA check runs are terminal: seven successes and two policy-valid provider-upload skips.
• No rerun or second same-SHA CI run was used.

Dependency pull requests

• Dependabot PRs chore(deps): bump the codeql-action group with 3 updates #75, chore(deps): bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 #76, and chore(deps): bump actions/setup-go from 6.5.0 to 7.0.0 #77 were independently green and were merged before this candidate.
• chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 #79 was not merged because browser runtime and required aggregate are red.
• chore(deps-dev): bump @playwright/test from 1.61.1 to 1.62.0 #80 was not independently mergeable because source/package verification and required aggregate are red. Its Playwright update is incorporated here only with all version owners synchronized and the complete proof epoch.

Large-file and decomposition disposition

The design contains the exact threshold ledger with path, LOC, bytes, disposition, and owner proof. The confirmed multi-owner workflow god-file was decomposed by policy owner. Large cohesive registries, generated contracts, command corpora, and temporary design/plan files were not split without a second owner; reverse-decomposition candidates were reviewed and rejected where merging would mix authority. The temporary design and plan retain explicit retirement conditions.

Retrospective

Routing decision: invoke. Confirmed causes were an execution lapse (guards admitted before independent falsifiers), an epoch-accounting lapse (current inventory copied across an amend), and a provider/runtime boundary (rendered Firefox documents did not imply Playwright lifecycle completion). C-120 through C-124 close recurrence locally with guard mutants, exact epoch inventories, response-event observation, and machine closeout. Existing repository and academic-engineering rules already required these controls, so no broader reusable rule or skill mutation is justified.

Non-claims

This PR does not prove or perform registry publication, provider attestation, Trusted Publisher/OIDC identity, branch-protection configuration, rollout, deployment, production readiness, complete WCAG conformance, branded Safari parity, absence of every vulnerability, exhaustive fuzz coverage, or a performance guarantee. Local evidence objects are individually admitted snapshots, not one atomic filesystem transaction. Provider observations are bounded literal-SHA reads, not an atomic or immutable cross-endpoint snapshot.

provider-projection-sha256: sha256:cc122a0830d51b51fb2308f1334fde280d30f5c4088a3f4129c15e7faddf4e60
provider-projection-json-begin
{
"checkRuns": [
{
"appSlug": "github-actions",
"conclusion": "success",
"externalId": "5288fdb8-261c-5323-86d9-d67570e47a6f",
"id": 90217336384,
"name": "advisory / sem entity diff",
"status": "completed"
},
{
"appSlug": "github-actions",
"conclusion": "success",
"externalId": "edc35d47-f876-52b2-acd9-edb2769f8d08",
"id": 90217336017,
"name": "codeql / go",
"status": "completed"
},
{
"appSlug": "github-actions",
"conclusion": "skipped",
"externalId": "733ed5db-2d82-5647-84c3-caa7b021de8b",
"id": 90217767227,
"name": "codeql / provider upload",
"status": "completed"
},
{
"appSlug": "github-actions",
"conclusion": "skipped",
"externalId": "4a9060a4-b839-56a0-9fe6-171ae0b13bc2",
"id": 90217441882,
"name": "osv / provider upload",
"status": "completed"
},
{
"appSlug": "github-actions",
"conclusion": "success",
"externalId": "f01ae2b8-1d8d-5ce3-90f1-a10edb3a8ab6",
"id": 90217345291,
"name": "osv / source advisory",
"status": "completed"
},
{
"appSlug": "github-actions",
"conclusion": "success",
"externalId": "d279791a-e1cf-558d-b5fb-911a306230b0",
"id": 90217354235,
"name": "quality / browser runtime",
"status": "completed"
},
{
"appSlug": "github-actions",
"conclusion": "success",
"externalId": "92a688d4-207d-5039-8bea-d4d1751389b4",
"id": 90217354290,
"name": "quality / platform smoke / macos-15",
"status": "completed"
},
{
"appSlug": "github-actions",
"conclusion": "success",
"externalId": "c978efb9-7488-524f-ac01-069749eb4d00",
"id": 90218388007,
"name": "quality / required aggregate",
"status": "completed"
},
{
"appSlug": "github-actions",
"conclusion": "success",
"externalId": "bd0e5731-bded-55f4-9bca-cea174a0e979",
"id": 90217354339,
"name": "quality / source",
"status": "completed"
}
],
"ciRun": {
"conclusion": "success",
"event": "pull_request",
"headBranch": "fix/audit-remediation",
"headSha": "7ffd0d56187594a8bdac21b2bacde8645f08da1f",
"id": 30341326847,
"pullRequests": [
{
"baseRef": "main",
"baseRepo": "https://api.github.com/repos/research-engineering/agentic-proofkit",
"baseSha": "0df4c28bac9737f476f7dc66030363b8b40d5417",
"headRef": "fix/audit-remediation",
"headRepo": "https://api.github.com/repos/research-engineering/agentic-proofkit",
"headSha": "7ffd0d56187594a8bdac21b2bacde8645f08da1f",
"number": 78
}
],
"runAttempt": 1,
"status": "completed"
},
"finalSha": "7ffd0d56187594a8bdac21b2bacde8645f08da1f",
"integrationBaseSha": "0df4c28bac9737f476f7dc66030363b8b40d5417",
"jobs": [
{
"conclusion": "success",
"headSha": "7ffd0d56187594a8bdac21b2bacde8645f08da1f",
"id": 90217354235,
"name": "quality / browser runtime",
"runAttempt": 1,
"status": "completed"
},
{
"conclusion": "success",
"headSha": "7ffd0d56187594a8bdac21b2bacde8645f08da1f",
"id": 90217354290,
"name": "quality / platform smoke / macos-15",
"runAttempt": 1,
"status": "completed"
},
{
"conclusion": "success",
"headSha": "7ffd0d56187594a8bdac21b2bacde8645f08da1f",
"id": 90218388007,
"name": "quality / required aggregate",
"runAttempt": 1,
"status": "completed"
},
{
"conclusion": "success",
"headSha": "7ffd0d56187594a8bdac21b2bacde8645f08da1f",
"id": 90217354339,
"name": "quality / source",
"runAttempt": 1,
"status": "completed"
}
],
"legacyStatuses": [],
"schemaVersion": 1
}
provider-projection-json-end

closeout-record-sha256: sha256:a520e9c2e5edc3525b441ace76c3129158bff524a5f637cef0c31905c35bffcb
closeout-record-json-begin
{
"auditBaselineSha": "3d86b6d0e4ec4a6c6a7f7a35ff2787011771aa64",
"diff": {
"addedLines": 39928,
"deletedLines": 2185,
"files": 150
},
"finalSha": "7ffd0d56187594a8bdac21b2bacde8645f08da1f",
"finalTree": "18a70ada42fa549a5097f0ee1b6dc1bfc40c3145",
"integrationBaseSha": "0df4c28bac9737f476f7dc66030363b8b40d5417",
"localGates": {
"browserRuntime": {
"executedTestCount": 93,
"passedTestCount": 93,
"projectCount": 3,
"sourceRevision": "7ffd0d56187594a8bdac21b2bacde8645f08da1f",
"sourceTreeState": "clean",
"state": "passed"
},
"coverage": {
"boundRequirementCount": 69,
"commandCount": 78,
"requirementCount": 69,
"scenarioCount": 173,
"sourceRevision": "7ffd0d56187594a8bdac21b2bacde8645f08da1f"
},
"localCloseout": {
"advisorySkippedCount": 1,
"blockingCriterionCount": 5,
"blockingUnsatisfiedCount": 0,
"satisfiedCount": 5,
"state": "passed"
},
"packageArtifact": {
"commandId": "proofkit.package-artifact",
"exitCode": 0,
"sourceRevision": "7ffd0d56187594a8bdac21b2bacde8645f08da1f",
"status": "passed"
}
},
"residualNonClaims": [
"No registry publication, Trusted Publisher or OIDC provider identity, branch-protection setting, rollout, deployment, or production readiness is proven.",
"Pinned browser engines do not imply complete WCAG conformance or branded Safari parity.",
"The output writer does not claim protection from same-user content or namespace mutation during the operation, fsync durability, or a repository-wide transaction.",
"Local closeout evidence objects are individually admitted snapshots, not an atomic filesystem transaction across all artifacts.",
"Provider observations are bounded but not atomic across endpoints or immutable after the final response."
],
"retrospective": [
"Single-factor Firefox hypotheses were falsified before response-event and semantic-readiness admission was accepted.",
"Repeated closeout misses require literal-SHA provider APIs, mutation oracles for every decision guard, epoch-bound inventories, admitted byte snapshots, and machine-readable closeout projections."
],
"schemaVersion": 1
}
closeout-record-json-end