From 3f0b262e5f11fdcf14db8dc70ddcb2a89941e52d Mon Sep 17 00:00:00 2001 From: yaojingang Date: Sun, 14 Jun 2026 10:32:25 +0800 Subject: [PATCH] feat: require world-class evidence artifacts --- evidence/world_class/intake.schema.json | 183 ++++++++++++++++++ registry/index.json | 2 +- registry/packages/yao-meta-skill.json | 6 +- reports/context_budget.json | 14 +- reports/context_budget.md | 2 +- reports/context_budget_summary.json | 6 +- reports/package_verification.json | 2 +- reports/package_verification.md | 2 +- reports/registry_audit.json | 8 +- reports/registry_audit.md | 4 +- reports/review-studio.html | 10 +- reports/review-studio.json | 108 ++++++----- reports/security_trust_report.json | 2 +- reports/security_trust_report.md | 2 +- reports/skill-overview.json | 28 +-- reports/upgrade_check.json | 4 +- reports/world_class_claim_guard.json | 2 +- reports/world_class_claim_guard.md | 2 +- reports/world_class_evidence_intake.json | 18 +- reports/world_class_evidence_intake.md | 11 +- reports/world_class_evidence_ledger.json | 2 +- reports/world_class_evidence_ledger.md | 2 +- reports/world_class_evidence_plan.json | 2 +- reports/world_class_evidence_plan.md | 2 +- reports/world_class_operator_runbook.json | 2 +- reports/world_class_operator_runbook.md | 2 +- reports/world_class_submission_review.json | 2 +- reports/world_class_submission_review.md | 2 +- scripts/render_world_class_evidence_intake.py | 2 + scripts/world_class_evidence_contract.py | 32 +++ tests/verify_world_class_evidence_intake.py | 25 ++- tests/verify_world_class_evidence_ledger.py | 56 +++++- 32 files changed, 424 insertions(+), 123 deletions(-) diff --git a/evidence/world_class/intake.schema.json b/evidence/world_class/intake.schema.json index 347aeb90..96fb4484 100644 --- a/evidence/world_class/intake.schema.json +++ b/evidence/world_class/intake.schema.json @@ -197,6 +197,189 @@ } } } + }, + { + "if": { + "properties": { + "template_only": { + "const": false + }, + "evidence_key": { + "const": "provider-holdout" + } + }, + "required": [ + "template_only", + "evidence_key" + ] + }, + "then": { + "properties": { + "artifact_refs": { + "contains": { + "type": "object", + "properties": { + "path": { + "const": "reports/output_execution_runs.json" + } + }, + "required": [ + "path" + ] + } + } + } + } + }, + { + "if": { + "properties": { + "template_only": { + "const": false + }, + "evidence_key": { + "const": "human-adjudication" + } + }, + "required": [ + "template_only", + "evidence_key" + ] + }, + "then": { + "properties": { + "artifact_refs": { + "allOf": [ + { + "contains": { + "type": "object", + "properties": { + "path": { + "const": "reports/output_review_adjudication.json" + } + }, + "required": [ + "path" + ] + } + }, + { + "contains": { + "type": "object", + "properties": { + "path": { + "const": "reports/output_review_decisions.json" + } + }, + "required": [ + "path" + ] + } + } + ] + } + } + } + }, + { + "if": { + "properties": { + "template_only": { + "const": false + }, + "evidence_key": { + "const": "native-permission-enforcement" + } + }, + "required": [ + "template_only", + "evidence_key" + ] + }, + "then": { + "properties": { + "artifact_refs": { + "allOf": [ + { + "contains": { + "type": "object", + "properties": { + "path": { + "const": "reports/runtime_permission_probes.json" + } + }, + "required": [ + "path" + ] + } + }, + { + "contains": { + "type": "object", + "properties": { + "path": { + "const": "reports/install_simulation.json" + } + }, + "required": [ + "path" + ] + } + } + ] + } + } + } + }, + { + "if": { + "properties": { + "template_only": { + "const": false + }, + "evidence_key": { + "const": "native-client-telemetry" + } + }, + "required": [ + "template_only", + "evidence_key" + ] + }, + "then": { + "properties": { + "artifact_refs": { + "allOf": [ + { + "contains": { + "type": "object", + "properties": { + "path": { + "const": "reports/adoption_drift_report.json" + } + }, + "required": [ + "path" + ] + } + }, + { + "contains": { + "type": "object", + "properties": { + "path": { + "const": "reports/telemetry_hook_recipes.json" + } + }, + "required": [ + "path" + ] + } + } + ] + } + } + } } ], "additionalProperties": true diff --git a/registry/index.json b/registry/index.json index 4a96cfe7..120f1940 100644 --- a/registry/index.json +++ b/registry/index.json @@ -16,7 +16,7 @@ "vscode" ], "package_metadata": "registry/packages/yao-meta-skill.json", - "package_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8" + "package_sha256": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb" } ] } diff --git a/registry/packages/yao-meta-skill.json b/registry/packages/yao-meta-skill.json index be3b8100..97fafc10 100644 --- a/registry/packages/yao-meta-skill.json +++ b/registry/packages/yao-meta-skill.json @@ -16,8 +16,8 @@ "trust_level": "local", "license": "MIT", "checksums": { - "package_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8", - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576" + "package_sha256": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d" }, "compatibility": { "openai": "pass", @@ -48,7 +48,7 @@ }, "distribution": { "archive_verified": true, - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d", "package_verification": "reports/package_verification.json", "install_simulated": true, "install_simulation": "reports/install_simulation.json" diff --git a/reports/context_budget.json b/reports/context_budget.json index ab0abb13..f68731a5 100644 --- a/reports/context_budget.json +++ b/reports/context_budget.json @@ -6,15 +6,15 @@ "context_budget_tier": "production", "context_budget_limit": 1000, "skill_body_tokens": 751, - "other_text_tokens": 1190325, + "other_text_tokens": 1191951, "estimated_initial_load_tokens": 944, - "estimated_total_text_tokens": 1191076, - "deferred_resource_tokens": 383511, + "estimated_total_text_tokens": 1192702, + "deferred_resource_tokens": 383953, "deferred_resource_warn_threshold": 120000, "deferred_resource_dirs": [ { "path": "scripts", - "estimated_tokens": 336028, + "estimated_tokens": 336470, "file_count": 96 }, { @@ -31,7 +31,7 @@ "large_deferred_resource_dirs": [ { "path": "scripts", - "estimated_tokens": 336028, + "estimated_tokens": 336470, "file_count": 96 } ], @@ -54,14 +54,14 @@ ], "missing": [], "path": "scripts", - "estimated_tokens": 336028, + "estimated_tokens": 336470, "file_count": 96, "rationale": "Script resources are deterministic deferred tools, not initial-load prompt context." } ], "summary": "Large deferred resources are indexed and backed by evidence." }, - "relevant_file_count": 504, + "relevant_file_count": 505, "unused_resource_dirs": [], "quality_signal_points": 130, "quality_density": 137.7 diff --git a/reports/context_budget.md b/reports/context_budget.md index c4b82e99..b3db2287 100644 --- a/reports/context_budget.md +++ b/reports/context_budget.md @@ -2,7 +2,7 @@ | Target | Path | Tier | Limit | Initial | SKILL | Deferred | Resource Governance | Large Deferred Dirs | Quality Density | Unused Dirs | Status | | --- | --- | --- | ---: | ---: | ---: | ---: | --- | --- | ---: | --- | --- | -| root | `.` | `production` | 1000 | 944 | 751 | 383511 | `governed` | scripts:336028 | 137.7 | - | ok | +| root | `.` | `production` | 1000 | 944 | 751 | 383953 | `governed` | scripts:336470 | 137.7 | - | ok | | complex-release-orchestrator | `examples/complex-release-orchestrator/generated-skill` | `production` | 1000 | 790 | 718 | 1657 | `not-required` | - | 164.6 | - | ok | | governed-incident-command | `examples/governed-incident-command/generated-skill` | `production` | 1000 | 760 | 658 | 1030 | `not-required` | - | 171.1 | - | ok | diff --git a/reports/context_budget_summary.json b/reports/context_budget_summary.json index e25fd552..4e2399e3 100644 --- a/reports/context_budget_summary.json +++ b/reports/context_budget_summary.json @@ -8,11 +8,11 @@ "budget_limit": 1000, "initial_tokens": 944, "skill_body_tokens": 751, - "deferred_resource_tokens": 383511, + "deferred_resource_tokens": 383953, "large_deferred_resource_dirs": [ { "path": "scripts", - "estimated_tokens": 336028, + "estimated_tokens": 336470, "file_count": 96 } ], @@ -35,7 +35,7 @@ ], "missing": [], "path": "scripts", - "estimated_tokens": 336028, + "estimated_tokens": 336470, "file_count": 96, "rationale": "Script resources are deterministic deferred tools, not initial-load prompt context." } diff --git a/reports/package_verification.json b/reports/package_verification.json index f2217083..24a09632 100644 --- a/reports/package_verification.json +++ b/reports/package_verification.json @@ -8,7 +8,7 @@ "target_count": 4, "adapter_count": 4, "archive_present": true, - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d", "archive_entry_count": 575, "failure_count": 0, "warning_count": 0 diff --git a/reports/package_verification.md b/reports/package_verification.md index 4bd2d34b..f2ed4845 100644 --- a/reports/package_verification.md +++ b/reports/package_verification.md @@ -4,7 +4,7 @@ - Package directory: `dist` - Targets: `4 / 4` adapters present - Archive present: `True` -- Archive SHA256: `5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576` +- Archive SHA256: `54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d` - Failures: `0` - Warnings: `0` diff --git a/reports/registry_audit.json b/reports/registry_audit.json index 53a1f612..476fda0d 100644 --- a/reports/registry_audit.json +++ b/reports/registry_audit.json @@ -21,8 +21,8 @@ "trust_level": "local", "license": "MIT", "checksums": { - "package_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8", - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576" + "package_sha256": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d" }, "compatibility": { "openai": "pass", @@ -53,7 +53,7 @@ }, "distribution": { "archive_verified": true, - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d", "package_verification": "reports/package_verification.json", "install_simulated": true, "install_simulation": "reports/install_simulation.json" @@ -78,7 +78,7 @@ "vscode" ], "package_metadata": "registry/packages/yao-meta-skill.json", - "package_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8" + "package_sha256": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb" } ] }, diff --git a/reports/registry_audit.md b/reports/registry_audit.md index 654abf29..cc99d634 100644 --- a/reports/registry_audit.md +++ b/reports/registry_audit.md @@ -6,8 +6,8 @@ - Maturity: `governed` - Owner: `Yao Team` - License: `MIT` -- Package SHA256: `59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8` -- Archive SHA256: `5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576` +- Package SHA256: `2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb` +- Archive SHA256: `54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d` - Install simulated: `True` ## Compatibility diff --git a/reports/review-studio.html b/reports/review-studio.html index 47d5c212..4bd99144 100644 --- a/reports/review-studio.html +++ b/reports/review-studio.html @@ -439,7 +439,7 @@

审查闸门

-
通过

意图画布

intent confidence 100/100; Intent is clear enough to package the first routeable version.

reports/intent-confidence.json 证据
通过

触发实验

13 trigger cases; 0 misroutes; 0 ambiguous

reports/route_scorecard.json 证据
关注

输出实验

5/5 cases; with-skill 100.0; baseline 0.0; file-backed 1; near-neighbor 1; blind A/B 5; exec 10; command 10; model 0; recorded 0; reviewed 0/5; review pending 5

reports/output_quality_scorecard.json 证据
通过

上下文

initial load 944/1000; deferred 383511/120000; top deferred scripts 336028; resource governance governed; quality density 137.7

reports/context_budget.json 证据
通过

运行矩阵

5 / 5 targets pass

reports/conformance_matrix.json 证据
通过

信任报告

0 secrets; 96 scripts; 3 network-capable scripts; 0 help smoke failures

reports/security_trust_report.json 证据
通过

Python 兼容

Python 3.11; 158 files; 0 compatibility issues; 0 syntax; 0 f-string 3.11 hazards

reports/python_compatibility.json 证据
通过

架构维护

155 Python files; 0 hotspots; 0 blockers; largest 888 lines; 34 CLI handlers

reports/architecture_maintainability.json 证据
通过

权限批准

3/3 permissions approved; gaps 0; required file_write, network, subprocess

reports/security_trust_report.json + security/permission_policy.json 证据
通过

权限探针

4/4 targets probed; native 0; metadata fallback 4; installer 4; residual risks 4

reports/runtime_permission_probes.json 证据
通过

组合治理

12 skills, 1 actionable; 0 actionable route collisions; 0 actionable owner gaps; 0 actionable stale; 0 actionable drift; 24 scoped non-actionable issues

reports/skill_atlas.json 证据
通过

运营回路

1 metadata events; adoption 100.0; missed 0; bad-output 0; risk low

reports/adoption_drift_report.json 证据
关注

人工批准

0 active waivers; 1 warning gates still need reviewer decision

reports/review_waivers.json 证据
关注

世界证据

4 pending world-class evidence entries; 1 human pending; 3 external pending; overclaim guard true

reports/world_class_evidence_ledger.json 证据
通过

注册审计

yao-meta-skill 1.1.0; 6/6 compatibility entries pass; install pass with 4 adapters; installer permissions 12 enforced / 0 failures

reports/registry_audit.json + reports/install_simulation.json 证据
通过

发布路线

0 promote; 3 keep current; 0 blocked; upgrade minor declared / minor recommended

reports/promotion_decisions.json + reports/upgrade_check.json + docs/migration-v2.md 证据
+
通过

意图画布

intent confidence 100/100; Intent is clear enough to package the first routeable version.

reports/intent-confidence.json 证据
通过

触发实验

13 trigger cases; 0 misroutes; 0 ambiguous

reports/route_scorecard.json 证据
关注

输出实验

5/5 cases; with-skill 100.0; baseline 0.0; file-backed 1; near-neighbor 1; blind A/B 5; exec 10; command 10; model 0; recorded 0; reviewed 0/5; review pending 5

reports/output_quality_scorecard.json 证据
通过

上下文

initial load 944/1000; deferred 383953/120000; top deferred scripts 336470; resource governance governed; quality density 137.7

reports/context_budget.json 证据
通过

运行矩阵

5 / 5 targets pass

reports/conformance_matrix.json 证据
通过

信任报告

0 secrets; 96 scripts; 3 network-capable scripts; 0 help smoke failures

reports/security_trust_report.json 证据
通过

Python 兼容

Python 3.11; 158 files; 0 compatibility issues; 0 syntax; 0 f-string 3.11 hazards

reports/python_compatibility.json 证据
通过

架构维护

155 Python files; 0 hotspots; 0 blockers; largest 888 lines; 34 CLI handlers

reports/architecture_maintainability.json 证据
通过

权限批准

3/3 permissions approved; gaps 0; required file_write, network, subprocess

reports/security_trust_report.json + security/permission_policy.json 证据
通过

权限探针

4/4 targets probed; native 0; metadata fallback 4; installer 4; residual risks 4

reports/runtime_permission_probes.json 证据
通过

组合治理

12 skills, 1 actionable; 0 actionable route collisions; 0 actionable owner gaps; 0 actionable stale; 0 actionable drift; 24 scoped non-actionable issues

reports/skill_atlas.json 证据
通过

运营回路

1 metadata events; adoption 100.0; missed 0; bad-output 0; risk low

reports/adoption_drift_report.json 证据
关注

人工批准

0 active waivers; 1 warning gates still need reviewer decision

reports/review_waivers.json 证据
关注

世界证据

4 pending world-class evidence entries; 1 human pending; 3 external pending; overclaim guard true

reports/world_class_evidence_ledger.json 证据
通过

注册审计

yao-meta-skill 1.1.0; 6/6 compatibility entries pass; install pass with 4 adapters; installer permissions 12 enforced / 0 failures

reports/registry_audit.json + reports/install_simulation.json 证据
通过

发布路线

0 promote; 3 keep current; 0 blocked; upgrade minor declared / minor recommended

reports/promotion_decisions.json + reports/upgrade_check.json + docs/migration-v2.md 证据
@@ -501,12 +501,12 @@
-

上下文

initial load 944/1000; deferred 383511/120000; top deferred scripts 336028; resource governance governed; quality density 137.7

+

上下文

initial load 944/1000; deferred 383953/120000; top deferred scripts 336470; resource governance governed; quality density 137.7

编译证据

Review reports/compiled_targets.md before packaging to inspect target adapter modes, generated files, preserved semantics, warnings, and unsupported features.

-

信任报告

Secret
0
脚本数
96
网络脚本
3
Help 失败
0
包体哈希
59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8
+

信任报告

Secret
0
脚本数
96
网络脚本
3
Help 失败
0
包体哈希
2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb

安全边界

高风险 secret、远程 inline execution、缺失依赖策略或无法解释的脚本接口应阻断 governed release。

@@ -574,12 +574,12 @@

注册审计

yao-meta-skill 1.1.0; 6/6 compatibility entries pass; install pass with 4 adapters; installer permissions 12 enforced / 0 failures

-

包体元数据

名称
yao-meta-skill
版本
1.1.0
Maturity
governed
Owner
Yao Team
License
MIT
信任级别
local
目标平台
openai, claude, generic, agent-skills-compatible, vscode
兼容通过
6/6
归档哈希
5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576
+

包体元数据

名称
yao-meta-skill
版本
1.1.0
Maturity
governed
Owner
Yao Team
License
MIT
信任级别
local
目标平台
openai, claude, generic, agent-skills-compatible, vscode
兼容通过
6/6
归档哈希
54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d

发布路线

0 promote; 3 keep current; 0 blocked; upgrade minor declared / minor recommended

-

包体验证

目标数
4
Adapter
4
归档存在
是
Zip 条目
575
失败数
0
警告数
0
归档哈希
5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576
+

包体验证

目标数
4
Adapter
4
归档存在
是
Zip 条目
575
失败数
0
警告数
0
归档哈希
54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d
diff --git a/reports/review-studio.json b/reports/review-studio.json index 09276bc6..0fdf6088 100644 --- a/reports/review-studio.json +++ b/reports/review-studio.json @@ -43,7 +43,7 @@ "key": "context-budget", "label": "上下文", "status": "pass", - "detail": "initial load 944/1000; deferred 383511/120000; top deferred scripts 336028; resource governance governed; quality density 137.7", + "detail": "initial load 944/1000; deferred 383953/120000; top deferred scripts 336470; resource governance governed; quality density 137.7", "evidence": "reports/context_budget.json", "link": "context_budget.md" }, @@ -1332,13 +1332,13 @@ "ok": true, "summary": { "reproducibility_ready": true, - "release_lock_ready": true, + "release_lock_ready": false, "methodology_complete": true, "required_artifact_count": 24, "missing_artifact_count": 0, - "evidence_bundle_sha256": "de8906187bdb5ad75cfc4e606ed9cd38b88cd23232fce6a60912be45b16bce06", - "source_contract_sha256": "c42643ea854dd90bb03ca607595f6a6b2c00118da64a78e8bdbb4392d7f204fb", - "archive_sha256": "76793bd367e9aaf6c25e6b11ac1139156950827bd87ba3dd8a1bdc883f7d70fe", + "evidence_bundle_sha256": "58baf3fe11e00c2be487239945ab3cc43a70b545507e1f1c891d1aed9a6da25e", + "source_contract_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8", + "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576", "output_case_count": 5, "failure_disclosure_count": 3, "command_count": 21, @@ -1352,10 +1352,10 @@ "world_class_open_gap_count": 4, "world_class_task_count": 4, "world_class_ledger_pending_count": 4, - "working_tree_dirty": false, - "changed_file_count": 0 + "working_tree_dirty": true, + "changed_file_count": 30 }, - "commit": "165ef11daf45ffff44169935c71de280348af936", + "commit": "d808071fb55a91484e78fe40f4b64bb52815758a", "missing_artifacts": [], "limitations": [ "The git commit and dirty flag are generation-time context; the evidence bundle hash is the durable artifact anchor inside a committed report.", @@ -1460,7 +1460,7 @@ "interactive_script_count": 0, "package_hash_scope": "source-contract-without-generated-reports", "package_hash_file_count": 180, - "package_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8" + "package_sha256": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb" }, "skill_atlas": { "skill_count": 12, @@ -1498,8 +1498,8 @@ "trust_level": "local", "license": "MIT", "checksums": { - "package_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8", - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576" + "package_sha256": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d" }, "compatibility": { "openai": "pass", @@ -1530,7 +1530,7 @@ }, "distribution": { "archive_verified": true, - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d", "package_verification": "reports/package_verification.json", "install_simulated": true, "install_simulation": "reports/install_simulation.json" @@ -1546,7 +1546,7 @@ "target_count": 4, "adapter_count": 4, "archive_present": true, - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d", "archive_entry_count": 575, "failure_count": 0, "warning_count": 0 @@ -1625,12 +1625,12 @@ { "field": "archive_sha256", "from": "", - "to": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576" + "to": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d" }, { "field": "package_sha256", "from": "0000000000000000000000000000000000000000000000000000000000000000", - "to": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8" + "to": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb" } ] }, @@ -3809,7 +3809,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 31.91, + "duration_ms": 29.91, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -3837,7 +3837,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 31.46, + "duration_ms": 28.72, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -3860,7 +3860,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 31.55, + "duration_ms": 28.83, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -3888,7 +3888,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 31.52, + "duration_ms": 28.47, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -3911,7 +3911,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 31.58, + "duration_ms": 29.49, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -3939,7 +3939,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 31.11, + "duration_ms": 29.13, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -3962,7 +3962,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 30.98, + "duration_ms": 28.38, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -3989,7 +3989,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 30.56, + "duration_ms": 28.42, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -4012,7 +4012,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 31.13, + "duration_ms": 28.69, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -4041,7 +4041,7 @@ "execution_mode": "command", "model_executed": false, "command_executed": true, - "duration_ms": 31.4, + "duration_ms": 28.75, "provider": "local-output-eval-runner", "model": "", "usage": { @@ -10257,7 +10257,7 @@ "interactive_script_count": 0, "package_hash_scope": "source-contract-without-generated-reports", "package_hash_file_count": 180, - "package_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8" + "package_sha256": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb" }, "failures": [], "warnings": [], @@ -13787,15 +13787,15 @@ "context_budget_tier": "production", "context_budget_limit": 1000, "skill_body_tokens": 751, - "other_text_tokens": 1190325, + "other_text_tokens": 1191951, "estimated_initial_load_tokens": 944, - "estimated_total_text_tokens": 1191076, - "deferred_resource_tokens": 383511, + "estimated_total_text_tokens": 1192702, + "deferred_resource_tokens": 383953, "deferred_resource_warn_threshold": 120000, "deferred_resource_dirs": [ { "path": "scripts", - "estimated_tokens": 336028, + "estimated_tokens": 336470, "file_count": 96 }, { @@ -13812,7 +13812,7 @@ "large_deferred_resource_dirs": [ { "path": "scripts", - "estimated_tokens": 336028, + "estimated_tokens": 336470, "file_count": 96 } ], @@ -13835,14 +13835,14 @@ ], "missing": [], "path": "scripts", - "estimated_tokens": 336028, + "estimated_tokens": 336470, "file_count": 96, "rationale": "Script resources are deterministic deferred tools, not initial-load prompt context." } ], "summary": "Large deferred resources are indexed and backed by evidence." }, - "relevant_file_count": 504, + "relevant_file_count": 505, "unused_resource_dirs": [], "quality_signal_points": 130, "quality_density": 137.7 @@ -15697,7 +15697,7 @@ "adoption_drift": { "ok": true, "schema_version": "2.0", - "generated_at": "2026-06-14T02:13:52Z", + "generated_at": "2026-06-14T02:29:07Z", "skill_dir": ".", "privacy_contract": { "storage": "local-first", @@ -15885,7 +15885,7 @@ "world_class_evidence_ledger": { "schema_version": "1.0", "ok": true, - "generated_at": "2026-06-13", + "generated_at": "2026-06-14", "skill_dir": ".", "summary": { "ledger_entry_count": 4, @@ -16161,7 +16161,7 @@ "world_class_evidence_intake": { "schema_version": "1.0", "ok": true, - "generated_at": "2026-06-13", + "generated_at": "2026-06-14", "skill_dir": ".", "summary": { "schema_present": true, @@ -16189,7 +16189,9 @@ "artifact_integrity": { "artifact_ref_count": 1, "artifact_existing_count": 0, - "artifact_sha256_verified_count": 0 + "artifact_sha256_verified_count": 0, + "required_artifact_count": 0, + "required_artifact_verified_count": 0 }, "errors": [] }, @@ -16201,7 +16203,9 @@ "artifact_integrity": { "artifact_ref_count": 2, "artifact_existing_count": 0, - "artifact_sha256_verified_count": 0 + "artifact_sha256_verified_count": 0, + "required_artifact_count": 0, + "required_artifact_verified_count": 0 }, "errors": [] }, @@ -16213,7 +16217,9 @@ "artifact_integrity": { "artifact_ref_count": 3, "artifact_existing_count": 0, - "artifact_sha256_verified_count": 0 + "artifact_sha256_verified_count": 0, + "required_artifact_count": 0, + "required_artifact_verified_count": 0 }, "errors": [] }, @@ -16225,7 +16231,9 @@ "artifact_integrity": { "artifact_ref_count": 2, "artifact_existing_count": 0, - "artifact_sha256_verified_count": 0 + "artifact_sha256_verified_count": 0, + "required_artifact_count": 0, + "required_artifact_verified_count": 0 }, "errors": [] } @@ -16455,7 +16463,7 @@ "world_class_submission_review": { "schema_version": "1.0", "ok": true, - "generated_at": "2026-06-13", + "generated_at": "2026-06-14", "skill_dir": ".", "summary": { "review_item_count": 4, @@ -16631,7 +16639,7 @@ "world_class_operator_runbook": { "schema_version": "1.0", "ok": true, - "generated_at": "2026-06-13", + "generated_at": "2026-06-14", "skill_dir": ".", "summary": { "evidence_item_count": 4, @@ -16950,7 +16958,7 @@ "world_class_claim_guard": { "schema_version": "1.0", "ok": true, - "generated_at": "2026-06-13", + "generated_at": "2026-06-14", "skill_dir": ".", "summary": { "ledger_ready_to_claim_world_class": false, @@ -17314,8 +17322,8 @@ "trust_level": "local", "license": "MIT", "checksums": { - "package_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8", - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576" + "package_sha256": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d" }, "compatibility": { "openai": "pass", @@ -17346,7 +17354,7 @@ }, "distribution": { "archive_verified": true, - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d", "package_verification": "reports/package_verification.json", "install_simulated": true, "install_simulation": "reports/install_simulation.json" @@ -17371,7 +17379,7 @@ "vscode" ], "package_metadata": "registry/packages/yao-meta-skill.json", - "package_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8" + "package_sha256": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb" } ] }, @@ -17394,7 +17402,7 @@ "target_count": 4, "adapter_count": 4, "archive_present": true, - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d", "archive_entry_count": 575, "failure_count": 0, "warning_count": 0 @@ -18402,12 +18410,12 @@ { "field": "archive_sha256", "from": "", - "to": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576" + "to": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d" }, { "field": "package_sha256", "from": "0000000000000000000000000000000000000000000000000000000000000000", - "to": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8" + "to": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb" } ] }, diff --git a/reports/security_trust_report.json b/reports/security_trust_report.json index c9d50de8..d0fceaad 100644 --- a/reports/security_trust_report.json +++ b/reports/security_trust_report.json @@ -23,7 +23,7 @@ "interactive_script_count": 0, "package_hash_scope": "source-contract-without-generated-reports", "package_hash_file_count": 180, - "package_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8" + "package_sha256": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb" }, "failures": [], "warnings": [], diff --git a/reports/security_trust_report.md b/reports/security_trust_report.md index 56e1ba5f..1aaf342f 100644 --- a/reports/security_trust_report.md +++ b/reports/security_trust_report.md @@ -16,7 +16,7 @@ - Interactive scripts: `0` - Package hash scope: `source-contract-without-generated-reports` - Package hash files: `180` -- Package SHA256: `59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8` +- Package SHA256: `2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb` ## Failures diff --git a/reports/skill-overview.json b/reports/skill-overview.json index 7b614643..218202eb 100644 --- a/reports/skill-overview.json +++ b/reports/skill-overview.json @@ -918,13 +918,13 @@ "ok": true, "summary": { "reproducibility_ready": true, - "release_lock_ready": true, + "release_lock_ready": false, "methodology_complete": true, "required_artifact_count": 24, "missing_artifact_count": 0, - "evidence_bundle_sha256": "de8906187bdb5ad75cfc4e606ed9cd38b88cd23232fce6a60912be45b16bce06", - "source_contract_sha256": "c42643ea854dd90bb03ca607595f6a6b2c00118da64a78e8bdbb4392d7f204fb", - "archive_sha256": "76793bd367e9aaf6c25e6b11ac1139156950827bd87ba3dd8a1bdc883f7d70fe", + "evidence_bundle_sha256": "58baf3fe11e00c2be487239945ab3cc43a70b545507e1f1c891d1aed9a6da25e", + "source_contract_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8", + "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576", "output_case_count": 5, "failure_disclosure_count": 3, "command_count": 21, @@ -938,10 +938,10 @@ "world_class_open_gap_count": 4, "world_class_task_count": 4, "world_class_ledger_pending_count": 4, - "working_tree_dirty": false, - "changed_file_count": 0 + "working_tree_dirty": true, + "changed_file_count": 30 }, - "commit": "165ef11daf45ffff44169935c71de280348af936", + "commit": "d808071fb55a91484e78fe40f4b64bb52815758a", "missing_artifacts": [], "limitations": [ "The git commit and dirty flag are generation-time context; the evidence bundle hash is the durable artifact anchor inside a committed report.", @@ -1046,7 +1046,7 @@ "interactive_script_count": 0, "package_hash_scope": "source-contract-without-generated-reports", "package_hash_file_count": 180, - "package_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8" + "package_sha256": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb" }, "skill_atlas": { "skill_count": 12, @@ -1084,8 +1084,8 @@ "trust_level": "local", "license": "MIT", "checksums": { - "package_sha256": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8", - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576" + "package_sha256": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d" }, "compatibility": { "openai": "pass", @@ -1116,7 +1116,7 @@ }, "distribution": { "archive_verified": true, - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d", "package_verification": "reports/package_verification.json", "install_simulated": true, "install_simulation": "reports/install_simulation.json" @@ -1132,7 +1132,7 @@ "target_count": 4, "adapter_count": 4, "archive_present": true, - "archive_sha256": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576", + "archive_sha256": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d", "archive_entry_count": 575, "failure_count": 0, "warning_count": 0 @@ -1211,12 +1211,12 @@ { "field": "archive_sha256", "from": "", - "to": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576" + "to": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d" }, { "field": "package_sha256", "from": "0000000000000000000000000000000000000000000000000000000000000000", - "to": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8" + "to": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb" } ] }, diff --git a/reports/upgrade_check.json b/reports/upgrade_check.json index e02d987f..0800ab27 100644 --- a/reports/upgrade_check.json +++ b/reports/upgrade_check.json @@ -70,12 +70,12 @@ { "field": "archive_sha256", "from": "", - "to": "5f3d7a018d80277336598d3bf78c546f37a301c0e4d8be6691a9f8de349c6576" + "to": "54e6b60578526fb40d38c7105cc61f59f0ca93c2811b1074b9ebc1620cfe853d" }, { "field": "package_sha256", "from": "0000000000000000000000000000000000000000000000000000000000000000", - "to": "59b0f65b269be1bcd9b8ab46997136fd5c19da796d0797702fb6a0dc96274cb8" + "to": "2af3b1e7638215a67244ed897737e1d0b42b8c930c3a8ac66d87d818b3ba01bb" } ] }, diff --git a/reports/world_class_claim_guard.json b/reports/world_class_claim_guard.json index edf4d040..88dc21e5 100644 --- a/reports/world_class_claim_guard.json +++ b/reports/world_class_claim_guard.json @@ -1,7 +1,7 @@ { "schema_version": "1.0", "ok": true, - "generated_at": "2026-06-13", + "generated_at": "2026-06-14", "skill_dir": ".", "summary": { "ledger_ready_to_claim_world_class": false, diff --git a/reports/world_class_claim_guard.md b/reports/world_class_claim_guard.md index 3318385b..b3eaa58f 100644 --- a/reports/world_class_claim_guard.md +++ b/reports/world_class_claim_guard.md @@ -1,6 +1,6 @@ # World-Class Claim Guard -Generated at: `2026-06-13` +Generated at: `2026-06-14` ## Summary diff --git a/reports/world_class_evidence_intake.json b/reports/world_class_evidence_intake.json index 356c6383..4ca0bb2f 100644 --- a/reports/world_class_evidence_intake.json +++ b/reports/world_class_evidence_intake.json @@ -1,7 +1,7 @@ { "schema_version": "1.0", "ok": true, - "generated_at": "2026-06-13", + "generated_at": "2026-06-14", "skill_dir": ".", "summary": { "schema_present": true, @@ -29,7 +29,9 @@ "artifact_integrity": { "artifact_ref_count": 1, "artifact_existing_count": 0, - "artifact_sha256_verified_count": 0 + "artifact_sha256_verified_count": 0, + "required_artifact_count": 0, + "required_artifact_verified_count": 0 }, "errors": [] }, @@ -41,7 +43,9 @@ "artifact_integrity": { "artifact_ref_count": 2, "artifact_existing_count": 0, - "artifact_sha256_verified_count": 0 + "artifact_sha256_verified_count": 0, + "required_artifact_count": 0, + "required_artifact_verified_count": 0 }, "errors": [] }, @@ -53,7 +57,9 @@ "artifact_integrity": { "artifact_ref_count": 3, "artifact_existing_count": 0, - "artifact_sha256_verified_count": 0 + "artifact_sha256_verified_count": 0, + "required_artifact_count": 0, + "required_artifact_verified_count": 0 }, "errors": [] }, @@ -65,7 +71,9 @@ "artifact_integrity": { "artifact_ref_count": 2, "artifact_existing_count": 0, - "artifact_sha256_verified_count": 0 + "artifact_sha256_verified_count": 0, + "required_artifact_count": 0, + "required_artifact_verified_count": 0 }, "errors": [] } diff --git a/reports/world_class_evidence_intake.md b/reports/world_class_evidence_intake.md index 4376838f..ec83cee8 100644 --- a/reports/world_class_evidence_intake.md +++ b/reports/world_class_evidence_intake.md @@ -1,6 +1,6 @@ # World-Class Evidence Intake -Generated at: `2026-06-13` +Generated at: `2026-06-14` ## Summary @@ -21,10 +21,10 @@ This report validates the intake contract for human and external evidence. A val | Evidence | Status | Path | Artifacts | Errors | | --- | --- | --- | --- | --- | -| `provider-holdout` | `pass` | `evidence/world_class/templates/provider-holdout.intake.json` | 0 existing / 0 sha256 verified / 1 refs | none | -| `human-adjudication` | `pass` | `evidence/world_class/templates/human-adjudication.intake.json` | 0 existing / 0 sha256 verified / 2 refs | none | -| `native-permission-enforcement` | `pass` | `evidence/world_class/templates/native-permission-enforcement.intake.json` | 0 existing / 0 sha256 verified / 3 refs | none | -| `native-client-telemetry` | `pass` | `evidence/world_class/templates/native-client-telemetry.intake.json` | 0 existing / 0 sha256 verified / 2 refs | none | +| `provider-holdout` | `pass` | `evidence/world_class/templates/provider-holdout.intake.json` | 0 existing / 0 sha256 verified / 0 required verified / 1 refs | none | +| `human-adjudication` | `pass` | `evidence/world_class/templates/human-adjudication.intake.json` | 0 existing / 0 sha256 verified / 0 required verified / 2 refs | none | +| `native-permission-enforcement` | `pass` | `evidence/world_class/templates/native-permission-enforcement.intake.json` | 0 existing / 0 sha256 verified / 0 required verified / 3 refs | none | +| `native-client-telemetry` | `pass` | `evidence/world_class/templates/native-client-telemetry.intake.json` | 0 existing / 0 sha256 verified / 0 required verified / 2 refs | none | ## Submissions @@ -201,6 +201,7 @@ This report validates the intake contract for human and external evidence. A val ## Boundary - Templates and planned work do not count as accepted evidence. +- Real submissions must include the evidence-key critical artifact paths with verified SHA-256 digests. - Local command-runner output does not count as provider-backed model evidence. - Metadata fallback does not count as native permission enforcement. - Pending reviewer work does not count as human adjudication. diff --git a/reports/world_class_evidence_ledger.json b/reports/world_class_evidence_ledger.json index 3225daee..be15f902 100644 --- a/reports/world_class_evidence_ledger.json +++ b/reports/world_class_evidence_ledger.json @@ -1,7 +1,7 @@ { "schema_version": "1.0", "ok": true, - "generated_at": "2026-06-13", + "generated_at": "2026-06-14", "skill_dir": ".", "summary": { "ledger_entry_count": 4, diff --git a/reports/world_class_evidence_ledger.md b/reports/world_class_evidence_ledger.md index 71d63aef..fdc73c48 100644 --- a/reports/world_class_evidence_ledger.md +++ b/reports/world_class_evidence_ledger.md @@ -1,6 +1,6 @@ # World-Class Evidence Ledger -Generated at: `2026-06-13` +Generated at: `2026-06-14` ## Summary diff --git a/reports/world_class_evidence_plan.json b/reports/world_class_evidence_plan.json index 47ea5508..bf4ed94e 100644 --- a/reports/world_class_evidence_plan.json +++ b/reports/world_class_evidence_plan.json @@ -1,7 +1,7 @@ { "schema_version": "1.0", "ok": true, - "generated_at": "2026-06-13", + "generated_at": "2026-06-14", "skill_dir": ".", "summary": { "audit_decision": "continue-iteration", diff --git a/reports/world_class_evidence_plan.md b/reports/world_class_evidence_plan.md index 63bf0848..47777c92 100644 --- a/reports/world_class_evidence_plan.md +++ b/reports/world_class_evidence_plan.md @@ -1,6 +1,6 @@ # World-Class Evidence Plan -Generated at: `2026-06-13` +Generated at: `2026-06-14` ## Summary diff --git a/reports/world_class_operator_runbook.json b/reports/world_class_operator_runbook.json index c7a608a0..c7f73901 100644 --- a/reports/world_class_operator_runbook.json +++ b/reports/world_class_operator_runbook.json @@ -1,7 +1,7 @@ { "schema_version": "1.0", "ok": true, - "generated_at": "2026-06-13", + "generated_at": "2026-06-14", "skill_dir": ".", "summary": { "evidence_item_count": 4, diff --git a/reports/world_class_operator_runbook.md b/reports/world_class_operator_runbook.md index 5cc913bf..449a0dc2 100644 --- a/reports/world_class_operator_runbook.md +++ b/reports/world_class_operator_runbook.md @@ -1,6 +1,6 @@ # World-Class Operator Runbook -Generated at: `2026-06-13` +Generated at: `2026-06-14` ## Summary diff --git a/reports/world_class_submission_review.json b/reports/world_class_submission_review.json index f5cd09b6..b462c0bb 100644 --- a/reports/world_class_submission_review.json +++ b/reports/world_class_submission_review.json @@ -1,7 +1,7 @@ { "schema_version": "1.0", "ok": true, - "generated_at": "2026-06-13", + "generated_at": "2026-06-14", "skill_dir": ".", "summary": { "review_item_count": 4, diff --git a/reports/world_class_submission_review.md b/reports/world_class_submission_review.md index 11389553..f8f7527b 100644 --- a/reports/world_class_submission_review.md +++ b/reports/world_class_submission_review.md @@ -1,6 +1,6 @@ # World-Class Submission Review -Generated at: `2026-06-13` +Generated at: `2026-06-14` ## Summary diff --git a/scripts/render_world_class_evidence_intake.py b/scripts/render_world_class_evidence_intake.py index 576387fb..4bdf781f 100644 --- a/scripts/render_world_class_evidence_intake.py +++ b/scripts/render_world_class_evidence_intake.py @@ -215,6 +215,7 @@ def render_table(items: list[dict[str, Any]]) -> list[str]: artifact_summary = ( f"{integrity.get('artifact_existing_count', 0)} existing / " f"{integrity.get('artifact_sha256_verified_count', 0)} sha256 verified / " + f"{integrity.get('required_artifact_verified_count', 0)} required verified / " f"{integrity.get('artifact_ref_count', 0)} refs" ) lines.append( @@ -295,6 +296,7 @@ def render_markdown(report: dict[str, Any]) -> str: "## Boundary", "", "- Templates and planned work do not count as accepted evidence.", + "- Real submissions must include the evidence-key critical artifact paths with verified SHA-256 digests.", "- Local command-runner output does not count as provider-backed model evidence.", "- Metadata fallback does not count as native permission enforcement.", "- Pending reviewer work does not count as human adjudication.", diff --git a/scripts/world_class_evidence_contract.py b/scripts/world_class_evidence_contract.py index 4bd462d4..28747e78 100644 --- a/scripts/world_class_evidence_contract.py +++ b/scripts/world_class_evidence_contract.py @@ -50,6 +50,21 @@ EXPECTED_SOURCE_TYPES = { } SHA256_RE = re.compile(r"^[0-9a-fA-F]{64}$") DISALLOWED_REAL_ARTIFACTS = {"reports/telemetry_events.jsonl"} +REQUIRED_REAL_ARTIFACT_PATHS = { + "provider-holdout": {"reports/output_execution_runs.json"}, + "human-adjudication": { + "reports/output_review_adjudication.json", + "reports/output_review_decisions.json", + }, + "native-permission-enforcement": { + "reports/runtime_permission_probes.json", + "reports/install_simulation.json", + }, + "native-client-telemetry": { + "reports/adoption_drift_report.json", + "reports/telemetry_hook_recipes.json", + }, +} def load_json(path: Path) -> dict[str, Any]: @@ -120,10 +135,14 @@ def validate_artifact_refs( ) -> dict[str, int]: refs = payload.get("artifact_refs") add_error(errors, isinstance(refs, list) and len(refs) > 0, "artifact_refs must contain at least one reference") + required_paths = REQUIRED_REAL_ARTIFACT_PATHS.get(str(payload.get("evidence_key", "")), set()) + observed_paths: set[str] = set() stats = { "artifact_ref_count": len(refs) if isinstance(refs, list) else 0, "artifact_existing_count": 0, "artifact_sha256_verified_count": 0, + "required_artifact_count": len(required_paths) if not template_expected else 0, + "required_artifact_verified_count": 0, } if not isinstance(refs, list): return stats @@ -137,6 +156,11 @@ def validate_artifact_refs( add_error(errors, ref.get("contains_raw_content") is False, f"artifact_refs[{index}] must not contain raw content") if template_expected or not path_text: continue + candidate = Path(path_text) + if not candidate.is_absolute() and ".." not in candidate.parts and not any( + token in path_text for token in ("<", ">", "*", "?") + ): + observed_paths.add(candidate.as_posix()) resolved, path_error = resolve_artifact_path(path_text, root) if path_error: errors.append(f"artifact_refs[{index}].path {path_error}") @@ -160,6 +184,14 @@ def validate_artifact_refs( errors.append(f"artifact_refs[{index}].sha256 does not match local artifact") continue stats["artifact_sha256_verified_count"] += 1 + if rel in required_paths: + stats["required_artifact_verified_count"] += 1 + if not template_expected and required_paths: + missing_required = sorted(required_paths - observed_paths) + for path in missing_required: + errors.append(f"artifact_refs must include required evidence artifact {path}") + if not missing_required and stats["required_artifact_verified_count"] < len(required_paths): + errors.append("all required evidence artifacts must have verified sha256 digests") return stats diff --git a/tests/verify_world_class_evidence_intake.py b/tests/verify_world_class_evidence_intake.py index dbda6f12..a4c84edf 100644 --- a/tests/verify_world_class_evidence_intake.py +++ b/tests/verify_world_class_evidence_intake.py @@ -56,7 +56,7 @@ def run_kit(*extra: str) -> subprocess.CompletedProcess[str]: ) -def provider_submission(*, valid: bool) -> dict: +def provider_submission(*, valid: bool, artifact_path: str = "reports/output_execution_runs.json") -> dict: return { "schema_version": "1.0", "evidence_key": "provider-holdout", @@ -68,10 +68,10 @@ def provider_submission(*, valid: bool) -> dict: "summary": "Aggregate provider-backed holdout evidence for ledger review.", "artifact_refs": [ { - "path": "reports/output_execution_runs.json", + "path": artifact_path, "kind": "aggregate-report", "contains_raw_content": not valid, - "sha256": sha256_file(ROOT / "reports" / "output_execution_runs.json") if valid else "example-only", + "sha256": sha256_file(ROOT / artifact_path) if valid else "example-only", } ], "provenance": { @@ -153,11 +153,12 @@ def main() -> None: assert "ready to claim world-class: `false`" in markdown, markdown assert "Operator Checklist" in markdown, markdown assert "operator checklist: `0` ready / `4` total" in markdown, markdown - assert "0 existing / 0 sha256 verified / 1 refs" in markdown, markdown + assert "0 existing / 0 sha256 verified / 0 required verified / 1 refs" in markdown, markdown assert "`evidence/world_class/submissions/provider-holdout.json`" in markdown, markdown assert "`python3 scripts/yao.py world-class-submission-kit . --evidence-key provider-holdout --output-dir evidence/world_class/submissions`" in markdown, markdown assert "`python3 scripts/yao.py world-class-ledger .`" in markdown, markdown assert "Templates and planned work do not count as accepted evidence." in markdown, markdown + assert "Real submissions must include the evidence-key critical artifact paths with verified SHA-256 digests." in markdown, markdown kit_dir = TMP / "submission_kit" kit_proc = run_kit("--output-dir", str(kit_dir), "--evidence-key", "provider-holdout") @@ -234,6 +235,22 @@ def main() -> None: assert any("attestation.real_external_or_human_evidence" in error for error in invalid_payload["submissions"][0]["errors"]), invalid_payload["submissions"] invalid_checklist = {item["evidence_key"]: item for item in invalid_payload["operator_checklist"]} assert invalid_checklist["provider-holdout"]["readiness"] == "fix-submission", invalid_checklist["provider-holdout"] + + unrelated_dir = TMP / "unrelated_artifact_submissions" + unrelated_dir.mkdir() + (unrelated_dir / "provider-holdout.json").write_text( + json.dumps(provider_submission(valid=True, artifact_path="reports/context_budget.json"), ensure_ascii=False, indent=2) + + "\n", + encoding="utf-8", + ) + unrelated_payload = run_intake("--submissions-dir", str(unrelated_dir)) + assert unrelated_payload["ok"] is False, unrelated_payload + assert unrelated_payload["summary"]["decision"] == "fix-intake", unrelated_payload["summary"] + assert unrelated_payload["summary"]["invalid_submission_count"] == 1, unrelated_payload["summary"] + unrelated_errors = unrelated_payload["submissions"][0]["errors"] + assert any("required evidence artifact reports/output_execution_runs.json" in error for error in unrelated_errors), unrelated_errors + assert unrelated_payload["submissions"][0]["artifact_integrity"]["artifact_sha256_verified_count"] == 1, unrelated_payload["submissions"] + assert unrelated_payload["submissions"][0]["artifact_integrity"]["required_artifact_verified_count"] == 0, unrelated_payload["submissions"] print(json.dumps({"ok": True}, ensure_ascii=False, indent=2)) diff --git a/tests/verify_world_class_evidence_ledger.py b/tests/verify_world_class_evidence_ledger.py index db2d33c0..7dbe2dcf 100644 --- a/tests/verify_world_class_evidence_ledger.py +++ b/tests/verify_world_class_evidence_ledger.py @@ -20,7 +20,7 @@ def sha256_file(path: Path) -> str: return digest.hexdigest() -def provider_submission(artifact_root: Path = ROOT) -> dict: +def provider_submission(artifact_root: Path = ROOT, artifact_path: str = "reports/output_execution_runs.json") -> dict: return { "schema_version": "1.0", "evidence_key": "provider-holdout", @@ -32,10 +32,10 @@ def provider_submission(artifact_root: Path = ROOT) -> dict: "summary": "Aggregate provider-backed holdout evidence for ledger review.", "artifact_refs": [ { - "path": "reports/output_execution_runs.json", + "path": artifact_path, "kind": "aggregate-report", "contains_raw_content": False, - "sha256": sha256_file(artifact_root / "reports" / "output_execution_runs.json"), + "sha256": sha256_file(artifact_root / artifact_path), } ], "provenance": { @@ -213,6 +213,56 @@ def main() -> None: assert accepted_source_provider["status"] == "pending", accepted_source_provider assert accepted_source_provider["submission_state"]["status"] == "missing", accepted_source_provider + (accepted_source_skill / "reports" / "context_budget.json").write_text( + json.dumps({"summary": {"unrelated": True}}, ensure_ascii=False, indent=2) + "\n", + encoding="utf-8", + ) + unrelated_accepted_submissions = TMP / "unrelated_accepted_submissions" + unrelated_accepted_submissions.mkdir() + (unrelated_accepted_submissions / "provider-holdout.json").write_text( + json.dumps( + provider_submission(accepted_source_skill, artifact_path="reports/context_budget.json"), + ensure_ascii=False, + indent=2, + ) + + "\n", + encoding="utf-8", + ) + unrelated_accepted_proc = subprocess.run( + [ + sys.executable, + str(SCRIPT), + str(accepted_source_skill), + "--output-json", + str(TMP / "unrelated_accepted_provider_ledger.json"), + "--output-md", + str(TMP / "unrelated_accepted_provider_ledger.md"), + "--submissions-dir", + str(unrelated_accepted_submissions), + "--generated-at", + "2026-06-13", + ], + cwd=ROOT, + capture_output=True, + text=True, + check=True, + ) + unrelated_accepted_payload = json.loads(unrelated_accepted_proc.stdout) + unrelated_accepted_summary = unrelated_accepted_payload["summary"] + assert unrelated_accepted_summary["source_accepted_count"] == 1, unrelated_accepted_summary + assert unrelated_accepted_summary["accepted_count"] == 0, unrelated_accepted_summary + assert unrelated_accepted_summary["invalid_submission_count"] == 1, unrelated_accepted_summary + unrelated_accepted_provider = { + entry["key"]: entry for entry in unrelated_accepted_payload["entries"] + }["provider-holdout"] + assert unrelated_accepted_provider["source_accepted"] is True, unrelated_accepted_provider + assert unrelated_accepted_provider["status"] == "pending", unrelated_accepted_provider + assert unrelated_accepted_provider["submission_state"]["status"] == "invalid-contract", unrelated_accepted_provider + assert any( + "required evidence artifact reports/output_execution_runs.json" in error + for error in unrelated_accepted_provider["submission_state"]["errors"] + ), unrelated_accepted_provider + accepted_submissions = TMP / "accepted_submissions" accepted_submissions.mkdir() (accepted_submissions / "provider-holdout.json").write_text(