planr - npm Package Compare versions

Comparing version 1.9.0 to 1.10.0-alpha.1

docs/contracts/EVIDENCE_CONTRACT_V1.md

+# Evidence Contract v1
+
+Status: frozen for implementation
+
+Evidence Contract v1 is Planr's local-first contract for proving acceptance criteria. It defines the durable vocabulary for proof obligations, observation requirements, capability declarations, execution attempts, untrusted proposals, trusted receipts, coverage verdicts, policy, presets, waivers, statuses, compatibility, and extension naming. It does not add public commands by itself and does not grant closure authority until later implementation slices wire the contract into storage, audit, review, trace, pick, and active-goal enforcement.
+
+## Ownership
+
+- Product and build plans own authored acceptance criteria and the reviewed `ProofObligation` records bound to those criteria.
+- The Evidence domain owns `ProofObligation`, `ObservationRequirement`, `VerificationCapabilityManifest`, `VerificationCapabilityInstance`, `EvidenceAttempt`, `UntrustedEvidenceProposal`, `EvidenceReceipt`, `CoverageVerdict`, `EvidencePolicy`, `ProofPreset`, and `EvidenceWaiver`.
+- Planr assigns trusted provenance only from Planr-observed execution, verified host events, accepted MCP attestation, validated artifact import, or explicit approval-backed user attestation.
+- Public JSON, agent-authored JSON, adapter stdout, logs, and artifacts may propose claims, but they cannot construct trusted provenance, execution identity, freshness, target binding, receipt digest, or closure authority.
+- `src/canonical_json.rs` is the future single production owner for RFC 8785/JCS-compatible canonical bytes and SHA-256 digests used by this contract.
+- `src/execution.rs` is the future shared owner for bounded process execution, cancellation, process-tree cleanup, output limits, and stdout/stderr digests.
+- CLI, MCP, HTTP, docs, audit, hooks, review, trace, and pick surfaces are renderers or consumers. They must use the same Evidence application service and cannot implement alternate coverage decisions.
+
+## Existing-System Boundaries
+
+- Eval remains the owner of comparative candidate evaluation, immutable eval runs, case results, samples, comparisons, invalidations, and eval evidence references. Eval evidence keeps `closure_authority = false`; an eval verdict may support review but cannot close or reopen Planr work by itself.
+- Route Audit remains the owner of requested, resolved, and effective routing evidence. Evidence may consume a mapped provenance view, but it must not copy requested route declarations into effective execution proof.
+- Agent Profiles, model-routing capability classes, usage-policy capability classes, MCP protocol capabilities, and context tags are dispatch or protocol metadata. They are not verification capability instances and do not prove runtime availability.
+- Planr logs remain narrative and supporting records. A legacy `kind = verification` log is preserved as a claim and can be referenced, but it never automatically satisfies a binding observation.
+- Pre-Evidence plans and non-binding scopes keep their historical closure compatibility until an operator explicitly migrates a plan into binding Evidence. Migration is plan-scoped, previewable, idempotent, and materializes ordinary immutable `ProofObligation` rows; it must not rewrite plans, logs, reviews, artifacts, or historical claims.
+- Planr artifacts remain files or references with digests. An artifact alone is not trusted evidence unless a trusted receipt binds it to the source revision, target, environment, execution identity, observation results, and policy.
+
+## Versioning And Compatibility
+
+- `schema_version` for all v1 objects is `evidence.contract.v1`.
+- Additive optional fields are allowed only when old readers can ignore them without changing coverage, trust, freshness, or closure decisions.
+- Status enum values, failure reason codes, provenance source kinds, namespace rules, digest algorithms, and trusted/untrusted boundaries are frozen for v1.
+- Removing fields, renaming statuses, weakening required trust checks, changing digest semantics, or treating legacy logs as binding proof requires a new major contract.
+- Unknown object kinds, observation types, schema versions, status values, provenance kinds, or namespaces are invalid for trusted coverage unless an explicit project extension registers them.
+- Canonical JSON bytes and digests are computed over the object without non-contractual display fields. The frozen schema fixture in `docs/contracts/fixtures/evidence/v1/schemas/evidence-contract-v1.schema.json` names each object's required fields.
+
+## Contract Digests
+
+Digest preimages use RFC 8785/JCS canonical JSON bytes over the contract object after the digest field being produced is removed. No other contract field is implicitly excluded.
+
+- `EvidenceReceipt.receipt_digest`: hash the complete receipt object without the top-level `receipt_digest` field. Source, target, environment, capability, provenance, execution identity, observations, attempts, artifacts, raw result, config digest, fixture disclosure, permissions, sandbox, proof gaps, and timings all remain in the preimage.
+- `EvidencePolicy.policy_digest`: hash the complete policy object without the top-level `policy_digest` field. Defaults, presets, observation schema registrations, adapter registrations, extension namespaces, trust/freshness/fixture/completion/layering policy all remain in the preimage. Nested `PolicyLayer.policy_digest` values are included as references to already-materialized lower-layer policies and must not repeat the enclosing policy digest.
+
+The canonical fixture vectors are executable through `node scripts/verify-evidence-contract-vectors.mjs`.
+
+## Namespaces And Extensions
+
+Built-in observation types and proof presets are starter vocabulary only. They are conveniences for common API, process, browser, desktop, mobile, deployment, filesystem, database, queue, and artifact cases, not a closed enum.
+
+Observation type names and preset names use one of these namespaces:
+
+- `planr.*`: reserved for Planr-owned built-ins.
+- `mcp.*`: reserved for MCP attestation vocabulary that Planr validates.
+- `host.*`: reserved for verified host-native capture contracts.
+- Reverse-domain namespaces such as `com.example.queue.job.processed`.
+- Project-local namespaces such as `project.queue.job.processed` inside the repository that defines them.
+
+Custom observation types must reference a versioned JSON Schema and a registration digest in repository-local Evidence policy. Unknown, unregistered, or unavailable custom types remain uncovered and cannot be silently accepted as a weaker built-in.
+
+## Object Model
+
+### ProofObligation
+
+A reviewed, binding or advisory contract for one acceptance criterion.
+
+Required fields:
+
+- `id`, `schema_version`, `criterion_id`, `plan_id`, optional `item_id`.
+- `title`, `binding`, `observations`, `fixture_policy`, `freshness_policy`, `assurance_policy`.
+- `policy_digest`, `config_digest`, `created_at`, and optional `supersedes`.
+
+`binding = true` means closure must evaluate Evidence coverage. `binding = false` may be rendered as guidance but cannot block or satisfy closure.
+
+### ObservationRequirement
+
+One atomic fact that must be observed.
+
+Required fields:
+
+- `id`, namespaced `type`, `subject`, `expected`, `target`, `environment`, `runtime_target`.
+- Optional `payload_schema`, `state_transitions`, `persistence`, `negative_assertions`, `freshness_policy`, and `assurance_policy`.
+
+The `type` says what fact is being observed, not which tool must observe it. Tool preference belongs in policy.
+
+### VerificationCapabilityManifest
+
+A versioned static declaration from an adapter, host, or attestor.
+
+Required fields:
+
+- `id`, `schema_version`, `version`, `adapter_kind`, `adapter_digest`.
+- Supported surfaces, observation type/schema/digest triples, interactions, artifacts, runtime targets, provenance path, permissions, costs, determinism, repeatability, independence, blind spots, and availability probe contract.
+- Process adapters declare a closed `availability_probe.kind = process` contract with executable name, arguments, optional working directory, timeout, stdout/stderr byte limits, and the payload schema binding for emitted observations.
+
+A manifest is a claim about what a method can observe. It is not proof that the method is available now.
+
+### VerificationCapabilityInstance
+
+A runtime availability snapshot for one exact manifest, host, surface, version, environment, and permission set.
+
+Required fields:
+
+- `id`, `schema_version`, `manifest_id`, `manifest_digest`, `host`, `surface`, `host_version`, `adapter_version`, `environment`, `permissions`, `availability`, `probe_result`, `observed_payload_contract`, `limitations`, `captured_at`.
+
+`probe_result.probe_execution_id` is the single authoritative runtime probe execution identity for a capability instance. A separate top-level probe execution ID is not part of the contract.
+
+Instances expire or become stale when manifest, host, environment, permission, schema, or policy inputs change.
+
+### EvidenceAttempt
+
+An immutable record of each verification attempt.
+
+Required fields:
+
+- `id`, `schema_version`, `criterion_id`, `obligation_id`, `capability_instance_id`.
+- `started_at`, `ended_at`, `status`, resolved command or tool call, exit/signal/error details, retry lineage, stdout/stderr digests, raw result reference, artifact references, and output bounds.
+
+Attempts are durable whether they pass, fail, time out, abort, skip, become unavailable, or end inconclusively. A later passing attempt does not erase earlier failures.
+
+Attempt status and execution result must agree: `passed` requires clean exit code `0`; `failed` requires a non-zero exit code; `timed_out`, `skipped`, and `unavailable` require no exit code or signal and the matching error value; `aborted` requires no exit code plus an abort signal and error; `inconclusive` requires a completed exit with an inconclusive error marker.
+
+### UntrustedEvidenceProposal
+
+Adapter, host, import, or agent input before Planr assigns provenance.
+
+Required fields:
+
+- `id`, `schema_version`, `source_kind`, `submitted_at`, `claims`, `artifact_refs`, `producer_metadata`.
+
+Forbidden authoritative fields:
+
+- Trusted provenance, execution identity, source revision binding, target digest binding, environment identity, freshness result, policy result, coverage result, receipt digest, or closure authority.
+
+### EvidenceReceipt
+
+The trusted outer envelope created only by Planr or an accepted attestation verifier after validation.
+
+Required fields:
+
+- `id`, `schema_version`, `criterion_id`, `obligation_id`, `receipt_status`.
+- Source revision/tree state, target digest/URI/deployment ID, environment identity, vantage point.
+- Capability manifest and instance digests, Planr-assigned provenance, execution/tool-call ID.
+- Observation results, attempt IDs and retry history, artifact references and digests.
+- Fixture/mock disclosure, permission and sandbox state, proof gaps, started/ended timestamps, and `receipt_digest`.
+
+Receipts can satisfy coverage only when trusted, fresh, policy-compliant, target-matched, schema-valid, and observation-equivalent to the requirement.
+
+### CoverageVerdict
+
+The canonical coverage result for a criterion, item, plan, or goal.
+
+Required fields:
+
+- `id`, `schema_version`, `scope`, `evaluated_at`, `status`, `observation_coverage`, `validation_details`, `suggested_next_action`, `actionable_now`.
+
+Allowed statuses:
+
+- `satisfied`: every binding observation is covered by trusted, fresh, policy-compliant receipts.
+- `unsatisfied`: one or more observations lack sufficient proof and a product or test failure is indicated.
+- `blocked`: proof cannot currently be produced because a required capability, permission, sandbox, environment, or dependency is unavailable.
+- `inconclusive`: attempted evidence cannot decide the required observation.
+- `waived`: every remaining binding gap is covered by a valid scoped waiver.
+- `stale`: previously sufficient evidence was invalidated by source, target, environment, policy, adapter, schema, configuration, or freshness change.
+
+Gap coverage must match the verdict status:
+
+- `unsatisfied` uses `missing` or `unsatisfied` gap entries with missing/product/verifier/policy/trust/schema/fixture/waiver/unsupported-observation reasons.
+- `blocked` uses `blocked` gap entries with capability, permission, sandbox, environment, dependency, or runtime-target reasons.
+- `inconclusive` uses `inconclusive` gap entries with timeout, abort, inconclusive-result, or verifier-failed reasons.
+- `waived` uses `waived` gap entries, requires `waiver_id`, and records the underlying waived reason rather than `waiver_missing` or `waiver_expired`.
+- `stale` uses `stale` gap entries with stale source, target, environment, policy, adapter schema, or configuration reasons.
+
+### EvidencePolicy, ProofPreset, EvidenceWaiver
+
+Repository policy lives in `.planr/evidence.yaml`. It owns defaults, named presets, observation schema registrations, adapter registrations, trust/freshness/fixture/completion policy, and extension namespaces.
+
+Adapter registrations bind the manifest ID, repository-local manifest path, manifest digest, observation types, payload schema bindings, provenance path, and closed execution contract used by Planr-observed process adapters.
+
+Policy layer scope uses the frozen `EvidenceScope` chain. Repository policy defaults and extension declarations are document-level policy. Product-level policy is represented by `goal`, plan-level policy by `plan`, item-specific branches by `item`, and criterion-level policy by `criterion`.
+
+Policy layers may strengthen lower-level requirements. Weakening requires an explicit waiver. Waivers include identity, reason, scope, exact observation IDs, source/target binding, created-at, expires-at, approval reference, and audit trail.
+
+## Status And Failure Vocabularies
+
+`EvidenceAttempt.status` values:
+
+- `passed`, `failed`, `skipped`, `timed_out`, `aborted`, `unavailable`, `inconclusive`.
+
+`EvidenceReceipt.receipt_status` values:
+
+- `trusted`, `rejected`, `untrusted`, `stale`, `superseded`.
+
+`VerificationCapabilityInstance.availability.status` values:
+
+- `available`, `unavailable`, `degraded`, `permission_denied`, `sandbox_blocked`, `unsupported`, `probe_failed`.
+
+Coverage gap/failure reason codes:
+
+- `missing_observation`, `missing_capability`, `permission_denied`, `sandbox_blocked`, `environment_unavailable`, `external_dependency_unavailable`, `product_failed`, `verifier_failed`, `timed_out`, `aborted`, `inconclusive_result`, `stale_source`, `stale_target`, `stale_environment`, `stale_policy`, `stale_adapter_schema`, `stale_configuration`, `target_mismatch`, `schema_mismatch`, `manifest_mismatch`, `untrusted_provenance`, `fixture_disallowed`, `mock_disallowed`, `insufficient_assurance`, `waiver_missing`, `waiver_expired`, `unknown_observation_type`, `unsupported_runtime_target`.
+
+Legacy/operator aliases are rendered as aliases only and resolve to the canonical codes above: `capability_unavailable` -> `missing_capability`, `dependency_unavailable` -> `external_dependency_unavailable`, `policy_failed` -> `stale_policy`, `trust_failed` -> `untrusted_provenance`, and `stale_evidence` -> `stale_source`. Unknown legacy reasons are classified as `verifier_failed` rather than `product_failed`.
+
+Explicit pre-Evidence migration input uses `schema_version = "planr.evidence.migration.v1"`, a single `plan_id`, and an `obligations[]` array of full `ProofObligation` objects whose `plan_id` matches the migration plan and whose `binding` is `true`. Preview is non-mutating. Apply is atomic for the migration payload: any conflict or malformed obligation leaves the plan with no newly bound partial obligations. Reapplying an identical payload is `unchanged`.
+
+Process adapters may report a host boundary failure only with an exact single-field JSON line on stdout or stderr:
+
+- `{"planr_adapter_boundary":"permission_denied"}`
+- `{"planr_adapter_boundary":"sandbox_blocked"}`
+
+Planr treats those structured lines as adapter boundary signals for failed process attempts and capability probes. Numeric exit codes alone do not imply `sandbox_blocked`; shell exit code 126 remains permission denied.
+
+## Trust And Provenance Rules
+
+- Public deserialization always produces an `UntrustedEvidenceProposal` or authored policy object, never a trusted receipt.
+- Adapter output can report observed facts and artifact references, but Planr binds the actual source revision, target, environment, execution identity, timings, retries, sandbox, permissions, output bounds, and receipt digest.
+- Requested route metadata, declared agent profile metadata, and model names are not effective execution proof.
+- A user approval can attest a fact only through the waiver or user-attestation path, with identity, reason, scope, expiry where applicable, and audit trail. It cannot silently convert agent JSON into Planr-observed execution.
+- Artifacts referenced by trusted receipts require content digests and repository/root containment or explicit external URI policy.
+- Fixture and mock use must be disclosed and accepted by policy for the exact observation.
+
+## Canonical Fixtures
+
+The v1 frozen fixtures are:
+
+- `docs/contracts/fixtures/evidence/v1/schemas/evidence-contract-v1.schema.json`
+- `docs/contracts/fixtures/evidence/v1/examples/proof-obligation.json`
+- `docs/contracts/fixtures/evidence/v1/examples/verification-capability-manifest.json`
+- `docs/contracts/fixtures/evidence/v1/examples/verification-capability-instance.json`
+- `docs/contracts/fixtures/evidence/v1/examples/evidence-attempt.json`
+- `docs/contracts/fixtures/evidence/v1/examples/untrusted-evidence-proposal.json`
+- `docs/contracts/fixtures/evidence/v1/examples/evidence-receipt.json`
+- `docs/contracts/fixtures/evidence/v1/examples/coverage-verdict.json`
+- `docs/contracts/fixtures/evidence/v1/examples/evidence-policy.json`
+- `docs/contracts/fixtures/evidence/v1/examples/proof-preset.json`
+- `docs/contracts/fixtures/evidence/v1/examples/evidence-waiver.json`
+- `docs/contracts/fixtures/evidence/v1/negative/available-empty-probe-capability.json`
+- `docs/contracts/fixtures/evidence/v1/negative/mismatched-probe-execution-id-capability.json`
+- `docs/contracts/fixtures/evidence/v1/negative/empty-trust-bindings-receipt.json`
+- `docs/contracts/fixtures/evidence/v1/negative/failed-zero-exit-attempt.json`
+- `docs/contracts/fixtures/evidence/v1/negative/forged-trusted-receipt.json`
+- `docs/contracts/fixtures/evidence/v1/negative/timed-out-zero-exit-attempt.json`
+- `docs/contracts/fixtures/evidence/v1/negative/aborted-zero-exit-attempt.json`
+- `docs/contracts/fixtures/evidence/v1/negative/skipped-zero-exit-attempt.json`
+- `docs/contracts/fixtures/evidence/v1/negative/unavailable-zero-exit-attempt.json`
+- `docs/contracts/fixtures/evidence/v1/negative/inconclusive-clean-exit-attempt.json`
+- `docs/contracts/fixtures/evidence/v1/negative/passed-empty-attempt.json`
+- `docs/contracts/fixtures/evidence/v1/negative/unbound-waiver.json`
+- `docs/contracts/fixtures/evidence/v1/negative/minimal-policy-missing-owned-inputs.json`
+- `docs/contracts/fixtures/evidence/v1/negative/policy-default-preset-unregistered.json`
+- `docs/contracts/fixtures/evidence/v1/negative/policy-weakening-without-waiver.json`
+- `docs/contracts/fixtures/evidence/v1/negative/satisfied-empty-coverage-verdict.json`
+- `docs/contracts/fixtures/evidence/v1/negative/unsatisfied-coverage-without-gap.json`
+- `docs/contracts/fixtures/evidence/v1/negative/process-probe-missing-output-limits.json`
+- `docs/contracts/fixtures/evidence/v1/negative/adapter-registration-missing-execution-contract.json`
+- `docs/contracts/fixtures/evidence/v1/negative/waived-coverage-missing-waiver-id.json`
+- `docs/contracts/fixtures/evidence/v1/negative/waived-coverage-forbidden-gap-reason.json`
+- `docs/contracts/fixtures/evidence/v1/negative/blocked-coverage-with-stale-reason.json`
+- `docs/contracts/fixtures/evidence/v1/negative/inconclusive-coverage-with-blocked-reason.json`
+- `docs/contracts/fixtures/evidence/v1/negative/stale-coverage-with-inconclusive-reason.json`
+
+Replayable schema validation:
+
+```bash
+set -e
+schema='docs/contracts/fixtures/evidence/v1/schemas/evidence-contract-v1.schema.json'
+node scripts/verify-evidence-contract-vectors.mjs
+npx --yes ajv-cli@5.0.0 validate --spec=draft2020 --validate-formats=false -s "$schema" -d 'docs/contracts/fixtures/evidence/v1/examples/*.json'
+for fixture in docs/contracts/fixtures/evidence/v1/negative/*.json; do
+  case "$fixture" in
+    *policy-default-preset-unregistered.json)
+      npx --yes ajv-cli@5.0.0 validate --spec=draft2020 --validate-formats=false -s "$schema" -d "$fixture"
+      echo "$fixture accepted by schema for semantic validation"
+      continue
+      ;;
+  esac
+  if npx --yes ajv-cli@5.0.0 validate --spec=draft2020 --validate-formats=false -s "$schema" -d "$fixture" >/tmp/planr-evidence-negative.out 2>&1; then
+    cat /tmp/planr-evidence-negative.out
+    echo "unexpected valid negative fixture: $fixture" >&2
+    exit 1
+  fi
+  echo "$fixture rejected as expected"
+done
+```
+
+Later implementation slices must use these fixtures as no-drift inputs for production canonicalization, schema validation, and coverage behavior.

docs/contracts/fix...dence/v1/examples/coverage-verdict.json

+{
+  "id": "cverdict-api-health-v1",
+  "schema_version": "evidence.contract.v1",
+  "scope": {
+    "kind": "criterion",
+    "id": "criterion-api-health",
+    "plan_id": "pln-example",
+    "item_id": "item-example"
+  },
+  "evaluated_at": "2026-07-28T12:00:08Z",
+  "status": "satisfied",
+  "observation_coverage": [
+    {
+      "requirement_id": "obs-http-200",
+      "status": "covered",
+      "covering_receipt_ids": ["erec-planr-api-health-v1"],
+      "covered_observation_ids": ["obs-http-200"]
+    }
+  ],
+  "validation_details": {
+    "trust": {
+      "status": "passed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": ["erec-planr-api-health-v1"],
+      "gap_reasons": []
+    },
+    "freshness": {
+      "status": "passed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": ["erec-planr-api-health-v1"],
+      "gap_reasons": []
+    },
+    "target": {
+      "status": "passed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": ["erec-planr-api-health-v1"],
+      "gap_reasons": []
+    },
+    "schema": {
+      "status": "passed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": ["erec-planr-api-health-v1"],
+      "gap_reasons": []
+    },
+    "provenance": {
+      "status": "passed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": ["erec-planr-api-health-v1"],
+      "gap_reasons": []
+    },
+    "fixture": {
+      "status": "passed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": ["erec-planr-api-health-v1"],
+      "gap_reasons": []
+    },
+    "completion": {
+      "status": "passed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": ["erec-planr-api-health-v1"],
+      "gap_reasons": []
+    }
+  },
+  "suggested_next_action": "none",
+  "actionable_now": false
+}

docs/contracts/fix...dence/v1/examples/evidence-attempt.json

+{
+  "id": "eatt-planr-api-health-v1",
+  "schema_version": "evidence.contract.v1",
+  "criterion_id": "criterion-api-health",
+  "obligation_id": "pob-planr-api-health-v1",
+  "capability_instance_id": "vcinst-planr-http-process-v1",
+  "started_at": "2026-07-28T12:00:05Z",
+  "ended_at": "2026-07-28T12:00:06Z",
+  "status": "passed",
+  "resolved_command": {
+    "kind": "command",
+    "command": ["curl", "-fsS", "http://127.0.0.1:4173/health"],
+    "cwd": "$PLANR_REPOSITORY_ROOT"
+  },
+  "exit": {
+    "exit_code": 0,
+    "signal": null,
+    "error": null
+  },
+  "retry_lineage": {
+    "attempt_number": 1,
+    "max_attempts": 1,
+    "previous_attempt_ids": []
+  },
+  "stdout_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "stderr_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "raw_result": {
+    "kind": "artifact",
+    "artifact_id": "artifact-http-response",
+    "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
+  },
+  "artifacts": [],
+  "output_bounds": {
+    "stdout_bytes": 16,
+    "stderr_bytes": 0,
+    "stdout_truncated": false,
+    "stderr_truncated": false
+  }
+}

docs/contracts/fix...idence/v1/examples/evidence-policy.json

+{
+  "id": "epolicy-default-v1",
+  "schema_version": "evidence.contract.v1",
+  "policy_digest": "sha256:c1a2a26ece3ee7a3cf3166cd849664d723fe2fffda2dc0773b2c92dc8d1ae8c1",
+  "defaults": {
+    "preset_id": "preset-http-health",
+    "binding": true,
+    "assurance_level": "standard"
+  },
+  "named_presets": [
+    {
+      "id": "preset-http-health",
+      "schema_version": "evidence.contract.v1",
+      "namespace": "planr.api",
+      "observations": [
+        {
+          "id": "obs-http-200",
+          "type": "planr.api.http.response",
+          "subject": "GET /health",
+          "expected": {
+            "status": 200
+          },
+          "target": {
+            "kind": "local_service",
+            "uri": "http://127.0.0.1:4173/health"
+          },
+          "environment": {
+            "kind": "local",
+            "id": "dev-shell",
+            "digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+          },
+          "runtime_target": {
+            "kind": "process",
+            "id": "planr-doc-fixture"
+          }
+        }
+      ]
+    }
+  ],
+  "observation_schema_registrations": [
+    {
+      "type": "planr.api.http.response",
+      "schema_ref": "planr.api.http.response@v1",
+      "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+      "owning_namespace": "planr.api"
+    }
+  ],
+  "adapter_registrations": [
+    {
+      "manifest_id": "vcap-planr-http-process-v1",
+      "manifest_path": "docs/contracts/fixtures/evidence/v1/examples/verification-capability-manifest.json",
+      "manifest_digest": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
+      "observation_types": ["planr.api.http.response"],
+      "payload_schemas": [
+        {
+          "type": "planr.api.http.response",
+          "schema_ref": "planr.api.http.response@v1",
+          "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+        }
+      ],
+      "provenance_path": "planr_observed_execution",
+      "execution_contract": {
+        "kind": "process",
+        "executable": "curl",
+        "args": ["--fail", "--silent", "http://127.0.0.1:4173/health"],
+        "working_directory": ".",
+        "timeout_ms": 10000,
+        "stdout_limit_bytes": 1048576,
+        "stderr_limit_bytes": 1048576,
+        "payload_schema": {
+          "type": "planr.api.http.response",
+          "schema_ref": "planr.api.http.response@v1",
+          "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+        }
+      }
+    }
+  ],
+  "extension_namespaces": ["planr.api"],
+  "trust_policy": {
+    "accepted_provenance": ["planr_observed_execution"],
+    "min_receipt_status": "trusted",
+    "allow_user_attestation": false
+  },
+  "freshness_policy": {
+    "max_age_seconds": 3600,
+    "invalidate_on": [
+      "source_change",
+      "target_change",
+      "policy_change",
+      "adapter_schema_change",
+      "configuration_change"
+    ]
+  },
+  "fixture_policy": {
+    "fixtures_allowed": false,
+    "mocks_allowed": false,
+    "disclosure_required": true
+  },
+  "completion_policy": {
+    "require_satisfied_or_waived": true,
+    "allow_inconclusive_completion": false,
+    "require_review_evidence": true
+  },
+  "layering_policy": {
+    "mode": "monotonic_strengthening",
+    "weakening_requires_waiver": true,
+    "layers": [
+      {
+        "scope": {
+          "kind": "plan",
+          "id": "pln-example"
+        },
+        "policy_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+      }
+    ]
+  }
+}

docs/contracts/fix...dence/v1/examples/evidence-receipt.json

+{
+  "id": "erec-planr-api-health-v1",
+  "schema_version": "evidence.contract.v1",
+  "criterion_id": "criterion-api-health",
+  "obligation_id": "pob-planr-api-health-v1",
+  "receipt_status": "trusted",
+  "source": {
+    "revision": "0123456789abcdef0123456789abcdef01234567",
+    "tree_digest": "sha256:3333333333333333333333333333333333333333333333333333333333333333",
+    "dirty": false
+  },
+  "target": {
+    "kind": "local_service",
+    "uri": "http://127.0.0.1:4173/health",
+    "digest": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
+  },
+  "environment": {
+    "kind": "local",
+    "id": "dev-shell",
+    "digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  },
+  "vantage_point": {
+    "kind": "localhost",
+    "identity": "127.0.0.1"
+  },
+  "capability": {
+    "manifest_id": "vcap-planr-http-process-v1",
+    "manifest_digest": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
+    "instance_id": "vcinst-planr-http-process-v1",
+    "instance_digest": "sha256:7777777777777777777777777777777777777777777777777777777777777777"
+  },
+  "provenance": {
+    "source": "planr_observed_execution",
+    "assigned_by": "planr",
+    "execution_id": "exec-20260728-api-health",
+    "tool_call_id": null
+  },
+  "observations": [
+    {
+      "requirement_id": "obs-http-200",
+      "type": "planr.api.http.response",
+      "outcome": "passed",
+      "predicate": {
+        "status": 200,
+        "json_path": "$.status",
+        "equals": "ok"
+      },
+      "actual": {
+        "status": 200,
+        "json": {
+          "status": "ok"
+        }
+      }
+    }
+  ],
+  "attempt_ids": [
+    "eatt-planr-api-health-v1"
+  ],
+  "retry_history": [],
+  "artifacts": [
+    {
+      "id": "artifact-http-response",
+      "kind": "stdout",
+      "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
+    }
+  ],
+  "raw_result": {
+    "kind": "artifact",
+    "artifact_id": "artifact-http-response",
+    "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
+  },
+  "config_digest": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
+  "fixture_disclosure": {
+    "fixtures_used": false,
+    "mocks_used": false
+  },
+  "permissions": {
+    "network": "localhost_only",
+    "filesystem": "read_workspace"
+  },
+  "sandbox": {
+    "mode": "bounded_process",
+    "limits": {
+      "timeout_ms": 10000,
+      "stdout_bytes": 1048576,
+      "stderr_bytes": 1048576
+    }
+  },
+  "proof_gaps": [],
+  "started_at": "2026-07-28T12:00:05Z",
+  "ended_at": "2026-07-28T12:00:06Z",
+  "receipt_digest": "sha256:6ea111943fdafe268a5bbe85b0fecaab75890dbcb9b2e2dfb966f3c6916e348f"
+}

docs/contracts/fix...idence/v1/examples/evidence-waiver.json

+{
+  "id": "ewaiver-api-health-expiry",
+  "schema_version": "evidence.contract.v1",
+  "scope": {
+    "kind": "item",
+    "id": "item-example",
+    "plan_id": "pln-example"
+  },
+  "observation_ids": ["obs-http-200"],
+  "source": {
+    "revision": "0123456789abcdef0123456789abcdef01234567",
+    "tree_digest": "sha256:3333333333333333333333333333333333333333333333333333333333333333",
+    "dirty": false
+  },
+  "target": {
+    "kind": "local_service",
+    "uri": "http://127.0.0.1:4173/health",
+    "digest": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
+  },
+  "reason": "temporary approved exception for local fixture downtime",
+  "created_by": "[e-mail]",
+  "created_at": "2026-07-28T12:00:00Z",
+  "expires_at": "2026-07-29T12:00:00Z",
+  "approval_ref": "approval-123",
+  "audit_trail": [
+    {
+      "event": "created",
+      "at": "2026-07-28T12:00:00Z"
+    }
+  ]
+}

docs/contracts/fix...dence/v1/examples/proof-obligation.json

+{
+  "id": "pob-planr-api-health-v1",
+  "schema_version": "evidence.contract.v1",
+  "criterion_id": "criterion-api-health",
+  "plan_id": "pln-example",
+  "item_id": "item-example",
+  "title": "API health endpoint returns OK from the target service",
+  "binding": true,
+  "observations": [
+    {
+      "id": "obs-http-200",
+      "type": "planr.api.http.response",
+      "subject": "GET /health",
+      "expected": {
+        "status": 200,
+        "json_path": "$.status",
+        "equals": "ok"
+      },
+      "target": {
+        "kind": "local_service",
+        "uri": "http://127.0.0.1:4173/health"
+      },
+      "environment": {
+        "kind": "local",
+        "id": "dev-shell",
+        "digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+      },
+      "runtime_target": {
+        "kind": "process",
+        "id": "planr-doc-fixture"
+      },
+      "payload_schema": {
+        "schema_ref": "planr.api.http.response@v1"
+      },
+      "freshness_policy": {
+        "source": "source_tree",
+        "max_age_seconds": 3600
+      },
+      "assurance_policy": {
+        "min_provenance": "planr_observed_execution",
+        "independent_methods": 1
+      }
+    }
+  ],
+  "fixture_policy": {
+    "fixtures_allowed": false,
+    "mocks_allowed": false,
+    "disclosure_required": true
+  },
+  "freshness_policy": {
+    "invalidate_on": [
+      "source_change",
+      "target_change",
+      "policy_change",
+      "adapter_schema_change",
+      "configuration_change"
+    ]
+  },
+  "assurance_policy": {
+    "min_receipt_status": "trusted",
+    "allow_user_attestation": false
+  },
+  "policy_digest": "sha256:c1a2a26ece3ee7a3cf3166cd849664d723fe2fffda2dc0773b2c92dc8d1ae8c1",
+  "config_digest": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
+  "created_at": "2026-07-28T12:00:00Z",
+  "supersedes": null
+}

docs/contracts/fix.../evidence/v1/examples/proof-preset.json

+{
+  "id": "preset-http-health",
+  "schema_version": "evidence.contract.v1",
+  "namespace": "planr.api",
+  "observations": [
+    {
+      "id": "obs-http-200",
+      "type": "planr.api.http.response",
+      "subject": "GET /health",
+      "expected": {
+        "status": 200
+      },
+      "target": {
+        "kind": "local_service",
+        "uri": "http://127.0.0.1:4173/health"
+      },
+      "environment": {
+        "kind": "local",
+        "id": "dev-shell",
+        "digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+      },
+      "runtime_target": {
+        "kind": "process",
+        "id": "planr-doc-fixture"
+      }
+    }
+  ]
+}

docs/contracts/fix...amples/untrusted-evidence-proposal.json

+{
+  "id": "uep-agent-health-claim-v1",
+  "schema_version": "evidence.contract.v1",
+  "source_kind": "agent",
+  "submitted_at": "2026-07-28T12:00:07Z",
+  "claims": {
+    "criterion_id": "criterion-api-health",
+    "summary": "agent reported the health endpoint returned ok"
+  },
+  "artifact_refs": [
+    {
+      "id": "artifact-agent-note",
+      "kind": "agent-note",
+      "digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+    }
+  ],
+  "producer_metadata": {
+    "client": "codex"
+  }
+}

docs/contracts/fix...s/verification-capability-instance.json

+{
+  "id": "vcinst-planr-http-process-v1",
+  "schema_version": "evidence.contract.v1",
+  "manifest_id": "vcap-planr-http-process-v1",
+  "manifest_digest": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
+  "host": "codex",
+  "surface": "local-process",
+  "host_version": "1.0.0",
+  "adapter_version": "1.0.0",
+  "environment": {
+    "kind": "local",
+    "id": "dev-shell",
+    "digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  },
+  "permissions": {
+    "network": "localhost_only",
+    "filesystem": "read_workspace"
+  },
+  "availability": {
+    "status": "available"
+  },
+  "probe_result": {
+    "probe_execution_id": "probe-20260728-curl",
+    "outcome": "passed",
+    "observed_at": "2026-07-28T12:00:04Z",
+    "checks": [
+      {
+        "name": "curl-present",
+        "outcome": "passed"
+      }
+    ]
+  },
+  "observed_payload_contract": {
+    "schema_ref": "planr.api.http.response@v1",
+    "observation_types": ["planr.api.http.response"]
+  },
+  "limitations": ["localhost target must be running"],
+  "captured_at": "2026-07-28T12:00:04Z"
+}

docs/contracts/fix...s/verification-capability-manifest.json

+{
+  "id": "vcap-planr-http-process-v1",
+  "schema_version": "evidence.contract.v1",
+  "version": "1.0.0",
+  "adapter_kind": "process",
+  "adapter_digest": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
+  "supported_surfaces": ["local-process"],
+  "supported_observations": [
+    {
+      "type": "planr.api.http.response",
+      "schema_ref": "planr.api.http.response@v1",
+      "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+    }
+  ],
+  "supported_interactions": ["http-get"],
+  "supported_artifacts": ["stdout"],
+  "runtime_targets": [
+    {
+      "kind": "process",
+      "id": "planr-doc-fixture"
+    }
+  ],
+  "provenance_path": "planr_observed_execution",
+  "permissions": {
+    "network": "localhost_only",
+    "filesystem": "read_workspace"
+  },
+  "costs": {
+    "network": "local"
+  },
+  "determinism": "deterministic for static health endpoint",
+  "repeatability": "replayable from source tree and target URI",
+  "independence": "adapter observes process output independently of agent text",
+  "blind_spots": ["external network failures outside localhost are not covered"],
+  "availability_probe": {
+    "kind": "process",
+    "execution": {
+      "kind": "process",
+      "executable": "curl",
+      "args": ["--version"],
+      "working_directory": ".",
+      "timeout_ms": 5000,
+      "stdout_limit_bytes": 65536,
+      "stderr_limit_bytes": 65536,
+      "payload_schema": {
+        "type": "planr.api.http.response",
+        "schema_ref": "planr.api.http.response@v1",
+        "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+      }
+    }
+  }
+}

docs/contracts/fix...negative/aborted-zero-exit-attempt.json

+{
+  "id": "eatt-aborted-zero-exit",
+  "schema_version": "evidence.contract.v1",
+  "criterion_id": "criterion-api-health",
+  "obligation_id": "pob-planr-api-health-v1",
+  "capability_instance_id": "vcinst-planr-http-process-v1",
+  "started_at": "2026-07-28T12:00:05Z",
+  "ended_at": "2026-07-28T12:00:06Z",
+  "status": "aborted",
+  "resolved_command": {
+    "kind": "command",
+    "command": ["curl", "-fsS", "http://127.0.0.1:4173/health"],
+    "cwd": "$PLANR_REPOSITORY_ROOT"
+  },
+  "exit": {
+    "exit_code": 0,
+    "signal": null,
+    "error": null
+  },
+  "retry_lineage": {
+    "attempt_number": 1,
+    "max_attempts": 1,
+    "previous_attempt_ids": []
+  },
+  "stdout_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "stderr_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "raw_result": {
+    "kind": "artifact",
+    "artifact_id": "artifact-http-response",
+    "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
+  },
+  "artifacts": [],
+  "output_bounds": {
+    "stdout_bytes": 2,
+    "stderr_bytes": 0,
+    "stdout_truncated": false,
+    "stderr_truncated": false
+  }
+}

docs/contracts/fix...tration-missing-execution-contract.json

+{
+  "id": "epolicy-adapter-missing-execution",
+  "schema_version": "evidence.contract.v1",
+  "policy_digest": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
+  "defaults": {
+    "preset_id": "preset-http-health",
+    "binding": true,
+    "assurance_level": "standard"
+  },
+  "named_presets": [
+    {
+      "id": "preset-http-health",
+      "schema_version": "evidence.contract.v1",
+      "namespace": "planr.api",
+      "observations": [
+        {
+          "id": "obs-http-200",
+          "type": "planr.api.http.response",
+          "subject": "GET /health",
+          "expected": {
+            "status": 200
+          },
+          "target": {
+            "kind": "local_service",
+            "uri": "http://127.0.0.1:4173/health"
+          },
+          "environment": {
+            "kind": "local",
+            "id": "dev-shell",
+            "digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+          },
+          "runtime_target": {
+            "kind": "process",
+            "id": "planr-doc-fixture"
+          }
+        }
+      ]
+    }
+  ],
+  "observation_schema_registrations": [
+    {
+      "type": "planr.api.http.response",
+      "schema_ref": "planr.api.http.response@v1",
+      "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+      "owning_namespace": "planr.api"
+    }
+  ],
+  "adapter_registrations": [
+    {
+      "manifest_id": "vcap-planr-http-process-v1",
+      "manifest_path": "docs/contracts/fixtures/evidence/v1/examples/verification-capability-manifest.json",
+      "manifest_digest": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
+      "observation_types": ["planr.api.http.response"],
+      "payload_schemas": [
+        {
+          "type": "planr.api.http.response",
+          "schema_ref": "planr.api.http.response@v1",
+          "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+        }
+      ],
+      "provenance_path": "planr_observed_execution"
+    }
+  ],
+  "extension_namespaces": ["planr.api"],
+  "trust_policy": {
+    "accepted_provenance": ["planr_observed_execution"],
+    "min_receipt_status": "trusted",
+    "allow_user_attestation": false
+  },
+  "freshness_policy": {
+    "max_age_seconds": 3600,
+    "invalidate_on": ["source_change"]
+  },
+  "fixture_policy": {
+    "fixtures_allowed": false,
+    "mocks_allowed": false,
+    "disclosure_required": true
+  },
+  "completion_policy": {
+    "require_satisfied_or_waived": true,
+    "allow_inconclusive_completion": false,
+    "require_review_evidence": true
+  },
+  "layering_policy": {
+    "mode": "monotonic_strengthening",
+    "weakening_requires_waiver": true,
+    "layers": [
+      {
+        "scope": {
+          "kind": "plan",
+          "id": "pln-example"
+        },
+        "policy_digest": "sha256:1111111111111111111111111111111111111111111111111111111111111111"
+      }
+    ]
+  }
+}

docs/contracts/fix...e/available-empty-probe-capability.json

+{
+  "id": "vcinst-empty-probe",
+  "schema_version": "evidence.contract.v1",
+  "manifest_id": "vcap-planr-http-process-v1",
+  "manifest_digest": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
+  "host": "codex",
+  "surface": "local-process",
+  "host_version": "1.0.0",
+  "adapter_version": "1.0.0",
+  "environment": {
+    "kind": "local",
+    "id": "dev-shell",
+    "digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  },
+  "permissions": {
+    "network": "localhost_only",
+    "filesystem": "read_workspace"
+  },
+  "availability": {
+    "status": "available"
+  },
+  "probe_result": {},
+  "probe_execution_id": "probe-empty",
+  "observed_payload_contract": {},
+  "limitations": [],
+  "captured_at": "2026-07-28T12:00:04Z"
+}

docs/contracts/fix...blocked-coverage-with-stale-reason.json

+{
+  "id": "cverdict-blocked-stale-reason",
+  "schema_version": "evidence.contract.v1",
+  "scope": {
+    "kind": "criterion",
+    "id": "criterion-api-health"
+  },
+  "evaluated_at": "2026-07-28T12:00:08Z",
+  "status": "blocked",
+  "observation_coverage": [
+    {
+      "requirement_id": "obs-http-200",
+      "status": "blocked",
+      "gap_reason": "stale_source"
+    }
+  ],
+  "validation_details": {
+    "trust": {
+      "status": "failed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": [],
+      "gap_reasons": ["stale_source"]
+    }
+  },
+  "suggested_next_action": "restore capability",
+  "actionable_now": true
+}

docs/contracts/fix...ative/empty-trust-bindings-receipt.json

+{
+  "id": "erec-empty-trust-bindings",
+  "schema_version": "evidence.contract.v1",
+  "criterion_id": "criterion-api-health",
+  "obligation_id": "pob-planr-api-health-v1",
+  "receipt_status": "trusted",
+  "source": {
+    "revision": "0123456789abcdef0123456789abcdef01234567",
+    "tree_digest": "sha256:3333333333333333333333333333333333333333333333333333333333333333",
+    "dirty": false
+  },
+  "target": {
+    "kind": "local_service",
+    "uri": "http://127.0.0.1:4173/health",
+    "digest": "sha256:4444444444444444444444444444444444444444444444444444444444444444"
+  },
+  "environment": {
+    "kind": "local",
+    "id": "dev-shell",
+    "digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  },
+  "vantage_point": {},
+  "capability": {
+    "manifest_id": "vcap-planr-http-process-v1",
+    "manifest_digest": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
+    "instance_id": "vcinst-planr-http-process-v1",
+    "instance_digest": "sha256:7777777777777777777777777777777777777777777777777777777777777777"
+  },
+  "provenance": {
+    "source": "planr_observed_execution",
+    "assigned_by": "planr",
+    "execution_id": "exec-20260728-api-health",
+    "tool_call_id": null
+  },
+  "observations": [
+    {
+      "requirement_id": "obs-http-200",
+      "type": "planr.api.http.response",
+      "outcome": "passed",
+      "predicate": {
+        "status": 200
+      },
+      "actual": {
+        "status": 200
+      }
+    }
+  ],
+  "attempt_ids": [
+    "eatt-planr-api-health-v1"
+  ],
+  "retry_history": [],
+  "artifacts": [
+    {
+      "id": "artifact-http-response",
+      "kind": "stdout",
+      "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
+    }
+  ],
+  "raw_result": {
+    "kind": "artifact",
+    "artifact_id": "artifact-http-response",
+    "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
+  },
+  "config_digest": "sha256:2222222222222222222222222222222222222222222222222222222222222222",
+  "fixture_disclosure": {},
+  "permissions": {},
+  "sandbox": {},
+  "proof_gaps": [],
+  "started_at": "2026-07-28T12:00:05Z",
+  "ended_at": "2026-07-28T12:00:06Z",
+  "receipt_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999"
+}

docs/contracts/fix.../negative/failed-zero-exit-attempt.json

+{
+  "id": "eatt-failed-zero-exit",
+  "schema_version": "evidence.contract.v1",
+  "criterion_id": "criterion-api-health",
+  "obligation_id": "pob-planr-api-health-v1",
+  "capability_instance_id": "vcinst-planr-http-process-v1",
+  "started_at": "2026-07-28T12:00:05Z",
+  "ended_at": "2026-07-28T12:00:06Z",
+  "status": "failed",
+  "resolved_command": {
+    "kind": "command",
+    "command": ["curl", "-fsS", "http://127.0.0.1:4173/health"],
+    "cwd": "$PLANR_REPOSITORY_ROOT"
+  },
+  "exit": {
+    "exit_code": 0,
+    "signal": null,
+    "error": null
+  },
+  "retry_lineage": {
+    "attempt_number": 1,
+    "max_attempts": 1,
+    "previous_attempt_ids": []
+  },
+  "stdout_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "stderr_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "raw_result": {
+    "kind": "artifact",
+    "artifact_id": "artifact-http-response",
+    "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
+  },
+  "artifacts": [],
+  "output_bounds": {
+    "stdout_bytes": 2,
+    "stderr_bytes": 0,
+    "stdout_truncated": false,
+    "stderr_truncated": false
+  }
+}

docs/contracts/fix...v1/negative/forged-trusted-receipt.json

+{
+  "id": "erec-forged-minimal",
+  "schema_version": "evidence.contract.v1",
+  "criterion_id": "criterion-api-health",
+  "obligation_id": "pob-planr-api-health-v1",
+  "receipt_status": "trusted",
+  "source": {},
+  "target": {},
+  "environment": {},
+  "vantage_point": {},
+  "capability": {},
+  "provenance": {
+    "source": "planr_observed_execution",
+    "assigned_by": "planr"
+  },
+  "observations": [
+    {
+      "requirement_id": "obs-http-200",
+      "type": "planr.api.http.response",
+      "outcome": "passed",
+      "predicate": {},
+      "actual": {}
+    }
+  ],
+  "attempt_ids": [
+    "attempt-forged"
+  ],
+  "fixture_disclosure": {},
+  "permissions": {},
+  "sandbox": {},
+  "proof_gaps": [],
+  "started_at": "2026-07-28T12:00:05Z",
+  "ended_at": "2026-07-28T12:00:06Z",
+  "receipt_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+}

docs/contracts/fix...ve/inconclusive-clean-exit-attempt.json

+{
+  "id": "eatt-inconclusive-clean-exit",
+  "schema_version": "evidence.contract.v1",
+  "criterion_id": "criterion-api-health",
+  "obligation_id": "pob-planr-api-health-v1",
+  "capability_instance_id": "vcinst-planr-http-process-v1",
+  "started_at": "2026-07-28T12:00:05Z",
+  "ended_at": "2026-07-28T12:00:06Z",
+  "status": "inconclusive",
+  "resolved_command": {
+    "kind": "command",
+    "command": ["curl", "-fsS", "http://127.0.0.1:4173/health"],
+    "cwd": "$PLANR_REPOSITORY_ROOT"
+  },
+  "exit": {
+    "exit_code": 0,
+    "signal": null,
+    "error": null
+  },
+  "retry_lineage": {
+    "attempt_number": 1,
+    "max_attempts": 1,
+    "previous_attempt_ids": []
+  },
+  "stdout_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "stderr_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "raw_result": {
+    "kind": "artifact",
+    "artifact_id": "artifact-http-response",
+    "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
+  },
+  "artifacts": [],
+  "output_bounds": {
+    "stdout_bytes": 2,
+    "stderr_bytes": 0,
+    "stdout_truncated": false,
+    "stderr_truncated": false
+  }
+}

docs/contracts/fix...usive-coverage-with-blocked-reason.json

+{
+  "id": "cverdict-inconclusive-blocked-reason",
+  "schema_version": "evidence.contract.v1",
+  "scope": {
+    "kind": "criterion",
+    "id": "criterion-api-health"
+  },
+  "evaluated_at": "2026-07-28T12:00:08Z",
+  "status": "inconclusive",
+  "observation_coverage": [
+    {
+      "requirement_id": "obs-http-200",
+      "status": "inconclusive",
+      "gap_reason": "permission_denied"
+    }
+  ],
+  "validation_details": {
+    "trust": {
+      "status": "inconclusive",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": [],
+      "gap_reasons": ["permission_denied"]
+    }
+  },
+  "suggested_next_action": "rerun verifier",
+  "actionable_now": true
+}

docs/contracts/fix...inimal-policy-missing-owned-inputs.json

+{
+  "id": "epolicy-minimal",
+  "schema_version": "evidence.contract.v1",
+  "policy_digest": "sha256:1111111111111111111111111111111111111111111111111111111111111111"
+}

docs/contracts/fix...ched-probe-execution-id-capability.json

+{
+  "id": "vcinst-mismatched-probe",
+  "schema_version": "evidence.contract.v1",
+  "manifest_id": "vcap-planr-http-process-v1",
+  "manifest_digest": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
+  "host": "codex",
+  "surface": "local-process",
+  "host_version": "1.0.0",
+  "adapter_version": "1.0.0",
+  "environment": {
+    "kind": "local",
+    "id": "dev-shell",
+    "digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+  },
+  "permissions": {
+    "network": "localhost_only",
+    "filesystem": "read_workspace"
+  },
+  "availability": {
+    "status": "available"
+  },
+  "probe_result": {
+    "probe_execution_id": "probe-empty",
+    "outcome": "passed",
+    "observed_at": "2026-07-28T12:00:04Z",
+    "checks": [
+      {
+        "name": "http-health",
+        "outcome": "passed"
+      }
+    ]
+  },
+  "probe_execution_id": "probe-other",
+  "observed_payload_contract": {
+    "schema_ref": "planr.api.http.response@v1",
+    "observation_types": [
+      "planr.api.http.response"
+    ]
+  },
+  "limitations": [],
+  "captured_at": "2026-07-28T12:00:04Z"
+}

docs/contracts/fix...e/v1/negative/passed-empty-attempt.json

+{
+  "id": "eatt-empty-passed",
+  "schema_version": "evidence.contract.v1",
+  "criterion_id": "criterion-api-health",
+  "obligation_id": "pob-planr-api-health-v1",
+  "capability_instance_id": "vcinst-planr-http-process-v1",
+  "started_at": "2026-07-28T12:00:05Z",
+  "ended_at": "2026-07-28T12:00:06Z",
+  "status": "passed",
+  "resolved_command": {},
+  "exit": {},
+  "retry_lineage": {},
+  "stdout_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "stderr_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "raw_result": {
+    "kind": "artifact",
+    "artifact_id": "artifact-http-response",
+    "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
+  },
+  "artifacts": [],
+  "output_bounds": {}
+}

docs/contracts/fix...policy-default-preset-unregistered.json

+{
+  "id": "epolicy-unregistered-default-preset",
+  "schema_version": "evidence.contract.v1",
+  "policy_digest": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
+  "defaults": {
+    "preset_id": "preset-missing",
+    "binding": true,
+    "assurance_level": "standard"
+  },
+  "named_presets": [
+    {
+      "id": "preset-http-health",
+      "schema_version": "evidence.contract.v1",
+      "namespace": "planr.api",
+      "observations": [
+        {
+          "id": "obs-http-200",
+          "type": "planr.api.http.response",
+          "subject": "GET /health",
+          "expected": {
+            "status": 200
+          },
+          "target": {
+            "kind": "local_service",
+            "uri": "http://127.0.0.1:4173/health"
+          },
+          "environment": {
+            "kind": "local",
+            "id": "dev-shell",
+            "digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+          },
+          "runtime_target": {
+            "kind": "process",
+            "id": "planr-doc-fixture"
+          }
+        }
+      ]
+    }
+  ],
+  "observation_schema_registrations": [
+    {
+      "type": "planr.api.http.response",
+      "schema_ref": "planr.api.http.response@v1",
+      "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+      "owning_namespace": "planr.api"
+    }
+  ],
+  "adapter_registrations": [
+    {
+      "manifest_id": "vcap-planr-http-process-v1",
+      "manifest_path": "docs/contracts/fixtures/evidence/v1/examples/verification-capability-manifest.json",
+      "manifest_digest": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
+      "observation_types": ["planr.api.http.response"],
+      "payload_schemas": [
+        {
+          "type": "planr.api.http.response",
+          "schema_ref": "planr.api.http.response@v1",
+          "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+        }
+      ],
+      "provenance_path": "planr_observed_execution",
+      "execution_contract": {
+        "kind": "process",
+        "executable": "curl",
+        "args": ["--fail", "--silent", "http://127.0.0.1:4173/health"],
+        "working_directory": ".",
+        "timeout_ms": 10000,
+        "stdout_limit_bytes": 1048576,
+        "stderr_limit_bytes": 1048576,
+        "payload_schema": {
+          "type": "planr.api.http.response",
+          "schema_ref": "planr.api.http.response@v1",
+          "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+        }
+      }
+    }
+  ],
+  "extension_namespaces": ["planr.api"],
+  "trust_policy": {
+    "accepted_provenance": ["planr_observed_execution"],
+    "min_receipt_status": "trusted",
+    "allow_user_attestation": false
+  },
+  "freshness_policy": {
+    "max_age_seconds": 3600,
+    "invalidate_on": ["source_change"]
+  },
+  "fixture_policy": {
+    "fixtures_allowed": false,
+    "mocks_allowed": false,
+    "disclosure_required": true
+  },
+  "completion_policy": {
+    "require_satisfied_or_waived": true,
+    "allow_inconclusive_completion": false,
+    "require_review_evidence": true
+  },
+  "layering_policy": {
+    "mode": "monotonic_strengthening",
+    "weakening_requires_waiver": true,
+    "layers": [
+      {
+        "scope": {
+          "kind": "plan",
+          "id": "pln-example"
+        },
+        "policy_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+      }
+    ]
+  }
+}

docs/contracts/fix...ve/policy-weakening-without-waiver.json

+{
+  "id": "epolicy-weakening",
+  "schema_version": "evidence.contract.v1",
+  "policy_digest": "sha256:1111111111111111111111111111111111111111111111111111111111111111",
+  "defaults": {
+    "preset_id": "preset-http-health",
+    "binding": true,
+    "assurance_level": "standard"
+  },
+  "named_presets": [
+    {
+      "id": "preset-http-health",
+      "schema_version": "evidence.contract.v1",
+      "namespace": "planr.api",
+      "observations": [
+        {
+          "id": "obs-http-200",
+          "type": "planr.api.http.response",
+          "subject": "GET /health",
+          "expected": {
+            "status": 200
+          },
+          "target": {
+            "kind": "local_service",
+            "uri": "http://127.0.0.1:4173/health"
+          },
+          "environment": {
+            "kind": "local",
+            "id": "dev-shell",
+            "digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555"
+          },
+          "runtime_target": {
+            "kind": "process",
+            "id": "planr-doc-fixture"
+          }
+        }
+      ]
+    }
+  ],
+  "observation_schema_registrations": [
+    {
+      "type": "planr.api.http.response",
+      "schema_ref": "planr.api.http.response@v1",
+      "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+      "owning_namespace": "planr.api"
+    }
+  ],
+  "adapter_registrations": [
+    {
+      "manifest_id": "vcap-planr-http-process-v1",
+      "manifest_path": "docs/contracts/fixtures/evidence/v1/examples/verification-capability-manifest.json",
+      "manifest_digest": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
+      "observation_types": ["planr.api.http.response"],
+      "payload_schemas": [
+        {
+          "type": "planr.api.http.response",
+          "schema_ref": "planr.api.http.response@v1",
+          "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+        }
+      ],
+      "provenance_path": "planr_observed_execution",
+      "execution_contract": {
+        "kind": "process",
+        "executable": "curl",
+        "args": ["--fail", "--silent", "http://127.0.0.1:4173/health"],
+        "working_directory": ".",
+        "timeout_ms": 10000,
+        "stdout_limit_bytes": 1048576,
+        "stderr_limit_bytes": 1048576,
+        "payload_schema": {
+          "type": "planr.api.http.response",
+          "schema_ref": "planr.api.http.response@v1",
+          "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+        }
+      }
+    }
+  ],
+  "extension_namespaces": ["planr.api"],
+  "trust_policy": {
+    "accepted_provenance": ["planr_observed_execution"],
+    "min_receipt_status": "trusted",
+    "allow_user_attestation": false
+  },
+  "freshness_policy": {
+    "max_age_seconds": 3600,
+    "invalidate_on": ["source_change"]
+  },
+  "fixture_policy": {
+    "fixtures_allowed": false,
+    "mocks_allowed": false,
+    "disclosure_required": true
+  },
+  "completion_policy": {
+    "require_satisfied_or_waived": true,
+    "allow_inconclusive_completion": false,
+    "require_review_evidence": true
+  },
+  "layering_policy": {
+    "mode": "monotonic_strengthening",
+    "weakening_requires_waiver": false,
+    "layers": [
+      {
+        "scope": {
+          "kind": "plan",
+          "id": "pln-example"
+        },
+        "policy_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+      }
+    ]
+  }
+}

docs/contracts/fix...rocess-probe-missing-output-limits.json

+{
+  "id": "vcap-process-probe-missing-limits",
+  "schema_version": "evidence.contract.v1",
+  "version": "1.0.0",
+  "adapter_kind": "process",
+  "adapter_digest": "sha256:6666666666666666666666666666666666666666666666666666666666666666",
+  "supported_surfaces": ["local-process"],
+  "supported_observations": [
+    {
+      "type": "planr.api.http.response",
+      "schema_ref": "planr.api.http.response@v1",
+      "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+    }
+  ],
+  "supported_interactions": ["http-get"],
+  "supported_artifacts": ["stdout"],
+  "runtime_targets": [
+    {
+      "kind": "process",
+      "id": "planr-doc-fixture"
+    }
+  ],
+  "provenance_path": "planr_observed_execution",
+  "permissions": {
+    "network": "localhost_only",
+    "filesystem": "read_workspace"
+  },
+  "costs": {
+    "network": "local"
+  },
+  "determinism": "deterministic for static health endpoint",
+  "repeatability": "replayable from source tree and target URI",
+  "independence": "adapter observes process output independently of agent text",
+  "blind_spots": [],
+  "availability_probe": {
+    "kind": "process",
+    "execution": {
+      "kind": "process",
+      "executable": "curl",
+      "args": ["--version"],
+      "timeout_ms": 5000,
+      "payload_schema": {
+        "type": "planr.api.http.response",
+        "schema_ref": "planr.api.http.response@v1",
+        "schema_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"
+      }
+    }
+  }
+}

docs/contracts/fix...e/satisfied-empty-coverage-verdict.json

+{
+  "id": "cverdict-empty-satisfied",
+  "schema_version": "evidence.contract.v1",
+  "scope": {
+    "kind": "criterion",
+    "id": "criterion-api-health"
+  },
+  "evaluated_at": "2026-07-28T12:00:08Z",
+  "status": "satisfied",
+  "observation_coverage": [],
+  "validation_details": {},
+  "suggested_next_action": "none",
+  "actionable_now": false
+}

docs/contracts/fix...negative/skipped-zero-exit-attempt.json

+{
+  "id": "eatt-skipped-zero-exit",
+  "schema_version": "evidence.contract.v1",
+  "criterion_id": "criterion-api-health",
+  "obligation_id": "pob-planr-api-health-v1",
+  "capability_instance_id": "vcinst-planr-http-process-v1",
+  "started_at": "2026-07-28T12:00:05Z",
+  "ended_at": "2026-07-28T12:00:06Z",
+  "status": "skipped",
+  "resolved_command": {
+    "kind": "command",
+    "command": ["curl", "-fsS", "http://127.0.0.1:4173/health"],
+    "cwd": "$PLANR_REPOSITORY_ROOT"
+  },
+  "exit": {
+    "exit_code": 0,
+    "signal": null,
+    "error": null
+  },
+  "retry_lineage": {
+    "attempt_number": 1,
+    "max_attempts": 1,
+    "previous_attempt_ids": []
+  },
+  "stdout_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "stderr_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "raw_result": {
+    "kind": "artifact",
+    "artifact_id": "artifact-http-response",
+    "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
+  },
+  "artifacts": [],
+  "output_bounds": {
+    "stdout_bytes": 2,
+    "stderr_bytes": 0,
+    "stdout_truncated": false,
+    "stderr_truncated": false
+  }
+}

docs/contracts/fix...-coverage-with-inconclusive-reason.json

+{
+  "id": "cverdict-stale-inconclusive-reason",
+  "schema_version": "evidence.contract.v1",
+  "scope": {
+    "kind": "criterion",
+    "id": "criterion-api-health"
+  },
+  "evaluated_at": "2026-07-28T12:00:08Z",
+  "status": "stale",
+  "observation_coverage": [
+    {
+      "requirement_id": "obs-http-200",
+      "status": "stale",
+      "gap_reason": "inconclusive_result"
+    }
+  ],
+  "validation_details": {
+    "freshness": {
+      "status": "failed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": [],
+      "gap_reasons": ["inconclusive_result"]
+    }
+  },
+  "suggested_next_action": "refresh evidence",
+  "actionable_now": true
+}

docs/contracts/fix...gative/timed-out-zero-exit-attempt.json

+{
+  "id": "eatt-timed-out-zero-exit",
+  "schema_version": "evidence.contract.v1",
+  "criterion_id": "criterion-api-health",
+  "obligation_id": "pob-planr-api-health-v1",
+  "capability_instance_id": "vcinst-planr-http-process-v1",
+  "started_at": "2026-07-28T12:00:05Z",
+  "ended_at": "2026-07-28T12:00:06Z",
+  "status": "timed_out",
+  "resolved_command": {
+    "kind": "command",
+    "command": ["curl", "-fsS", "http://127.0.0.1:4173/health"],
+    "cwd": "$PLANR_REPOSITORY_ROOT"
+  },
+  "exit": {
+    "exit_code": 0,
+    "signal": null,
+    "error": null
+  },
+  "retry_lineage": {
+    "attempt_number": 1,
+    "max_attempts": 1,
+    "previous_attempt_ids": []
+  },
+  "stdout_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "stderr_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "raw_result": {
+    "kind": "artifact",
+    "artifact_id": "artifact-http-response",
+    "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
+  },
+  "artifacts": [],
+  "output_bounds": {
+    "stdout_bytes": 2,
+    "stderr_bytes": 0,
+    "stdout_truncated": false,
+    "stderr_truncated": false
+  }
+}

docs/contracts/fix...tive/unavailable-zero-exit-attempt.json

+{
+  "id": "eatt-unavailable-zero-exit",
+  "schema_version": "evidence.contract.v1",
+  "criterion_id": "criterion-api-health",
+  "obligation_id": "pob-planr-api-health-v1",
+  "capability_instance_id": "vcinst-planr-http-process-v1",
+  "started_at": "2026-07-28T12:00:05Z",
+  "ended_at": "2026-07-28T12:00:06Z",
+  "status": "unavailable",
+  "resolved_command": {
+    "kind": "command",
+    "command": ["curl", "-fsS", "http://127.0.0.1:4173/health"],
+    "cwd": "$PLANR_REPOSITORY_ROOT"
+  },
+  "exit": {
+    "exit_code": 0,
+    "signal": null,
+    "error": null
+  },
+  "retry_lineage": {
+    "attempt_number": 1,
+    "max_attempts": 1,
+    "previous_attempt_ids": []
+  },
+  "stdout_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "stderr_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "raw_result": {
+    "kind": "artifact",
+    "artifact_id": "artifact-http-response",
+    "digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888"
+  },
+  "artifacts": [],
+  "output_bounds": {
+    "stdout_bytes": 2,
+    "stderr_bytes": 0,
+    "stdout_truncated": false,
+    "stderr_truncated": false
+  }
+}

docs/contracts/fix...vidence/v1/negative/unbound-waiver.json

+{
+  "id": "ewaiver-unbound",
+  "schema_version": "evidence.contract.v1",
+  "scope": {
+    "kind": "item",
+    "id": "item-example"
+  },
+  "observation_ids": [
+    "obs-http-200"
+  ],
+  "reason": "temporary manual exception",
+  "created_by": "[e-mail]",
+  "created_at": "2026-07-28T12:00:00Z",
+  "expires_at": "2026-07-29T12:00:00Z",
+  "approval_ref": "approval-123",
+  "audit_trail": [
+    {
+      "event": "created"
+    }
+  ]
+}

docs/contracts/fix...e/unsatisfied-coverage-without-gap.json

+{
+  "id": "cverdict-unsatisfied-no-gap",
+  "schema_version": "evidence.contract.v1",
+  "scope": {
+    "kind": "criterion",
+    "id": "criterion-api-health"
+  },
+  "evaluated_at": "2026-07-28T12:00:08Z",
+  "status": "unsatisfied",
+  "observation_coverage": [
+    {
+      "requirement_id": "obs-http-200",
+      "status": "covered",
+      "covering_receipt_ids": ["erec-planr-api-health-v1"]
+    }
+  ],
+  "validation_details": {
+    "trust": {
+      "status": "failed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": [],
+      "gap_reasons": ["missing_observation"]
+    },
+    "freshness": {
+      "status": "passed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": [],
+      "gap_reasons": []
+    },
+    "target": {
+      "status": "passed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": [],
+      "gap_reasons": []
+    },
+    "schema": {
+      "status": "passed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": [],
+      "gap_reasons": []
+    },
+    "provenance": {
+      "status": "passed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": [],
+      "gap_reasons": []
+    },
+    "fixture": {
+      "status": "passed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": [],
+      "gap_reasons": []
+    },
+    "completion": {
+      "status": "failed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": [],
+      "gap_reasons": ["missing_observation"]
+    }
+  },
+  "suggested_next_action": "run required observation",
+  "actionable_now": true
+}

docs/contracts/fix...ived-coverage-forbidden-gap-reason.json

+{
+  "id": "cverdict-waived-forbidden-gap",
+  "schema_version": "evidence.contract.v1",
+  "scope": {
+    "kind": "criterion",
+    "id": "criterion-api-health"
+  },
+  "evaluated_at": "2026-07-28T12:00:08Z",
+  "status": "waived",
+  "observation_coverage": [
+    {
+      "requirement_id": "obs-http-200",
+      "status": "waived",
+      "gap_reason": "waiver_expired",
+      "waiver_id": "ewaiver-api-health-v1"
+    }
+  ],
+  "validation_details": {
+    "trust": {
+      "status": "failed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": [],
+      "gap_reasons": ["waiver_expired"]
+    }
+  },
+  "suggested_next_action": "renew waiver",
+  "actionable_now": true
+}

docs/contracts/fix.../waived-coverage-missing-waiver-id.json

+{
+  "id": "cverdict-waived-missing-waiver",
+  "schema_version": "evidence.contract.v1",
+  "scope": {
+    "kind": "criterion",
+    "id": "criterion-api-health"
+  },
+  "evaluated_at": "2026-07-28T12:00:08Z",
+  "status": "waived",
+  "observation_coverage": [
+    {
+      "requirement_id": "obs-http-200",
+      "status": "waived",
+      "gap_reason": "missing_observation"
+    }
+  ],
+  "validation_details": {
+    "trust": {
+      "status": "failed",
+      "checked_at": "2026-07-28T12:00:08Z",
+      "receipt_ids": [],
+      "gap_reasons": ["missing_observation"]
+    }
+  },
+  "suggested_next_action": "record waiver id",
+  "actionable_now": true
+}

docs/contracts/fix...chemas/evidence-contract-v1.schema.json

+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://planr.local/contracts/evidence/v1/evidence-contract-v1.schema.json",
+  "title": "Planr Evidence Contract v1",
+  "type": "object",
+  "oneOf": [
+    {
+      "$ref": "#/$defs/ProofObligation"
+    },
+    {
+      "$ref": "#/$defs/VerificationCapabilityManifest"
+    },
+    {
+      "$ref": "#/$defs/VerificationCapabilityInstance"
+    },
+    {
+      "$ref": "#/$defs/EvidenceAttempt"
+    },
+    {
+      "$ref": "#/$defs/UntrustedEvidenceProposal"
+    },
+    {
+      "$ref": "#/$defs/EvidenceReceipt"
+    },
+    {
+      "$ref": "#/$defs/CoverageVerdict"
+    },
+    {
+      "$ref": "#/$defs/EvidencePolicy"
+    },
+    {
+      "$ref": "#/$defs/ProofPreset"
+    },
+    {
+      "$ref": "#/$defs/EvidenceWaiver"
+    }
+  ],
+  "$defs": {
+    "SchemaVersion": {
+      "const": "evidence.contract.v1"
+    },
+    "Id": {
+      "type": "string",
+      "minLength": 1,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$"
+    },
+    "Timestamp": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "Digest": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "NamespaceName": {
+      "type": "string",
+      "pattern": "^(planr|mcp|host|project|[a-z0-9]+(\\.[a-z0-9-]+)+)\\.[a-z0-9][a-z0-9._-]*$"
+    },
+    "JsonObject": {
+      "type": "object",
+      "additionalProperties": true
+    },
+    "PayloadSchemaBinding": {
+      "type": "object",
+      "required": [
+        "type",
+        "schema_ref",
+        "schema_digest"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "type": {
+          "$ref": "#/$defs/NamespaceName"
+        },
+        "schema_ref": {
+          "type": "string",
+          "minLength": 1
+        },
+        "schema_digest": {
+          "$ref": "#/$defs/Digest"
+        }
+      }
+    },
+    "ProcessExecutionContract": {
+      "type": "object",
+      "required": [
+        "kind",
+        "executable",
+        "args",
+        "timeout_ms",
+        "stdout_limit_bytes",
+        "stderr_limit_bytes",
+        "payload_schema"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "kind": {
+          "const": "process"
+        },
+        "executable": {
+          "type": "string",
+          "minLength": 1
+        },
+        "args": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "working_directory": {
+          "type": "string",
+          "minLength": 1
+        },
+        "timeout_ms": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "stdout_limit_bytes": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "stderr_limit_bytes": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "payload_schema": {
+          "$ref": "#/$defs/PayloadSchemaBinding"
+        }
+      }
+    },
+    "ProcessAvailabilityProbe": {
+      "type": "object",
+      "required": [
+        "kind",
+        "execution"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "kind": {
+          "const": "process"
+        },
+        "execution": {
+          "$ref": "#/$defs/ProcessExecutionContract"
+        }
+      }
+    },
+    "AvailabilityProbeContract": {
+      "oneOf": [
+        {
+          "$ref": "#/$defs/ProcessAvailabilityProbe"
+        }
+      ]
+    },
+    "EvidenceScope": {
+      "type": "object",
+      "required": [
+        "kind",
+        "id"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "kind": {
+          "enum": [
+            "criterion",
+            "item",
+            "plan",
+            "goal"
+          ]
+        },
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "plan_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "item_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "criterion_id": {
+          "$ref": "#/$defs/Id"
+        }
+      }
+    },
+    "StringList": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
+    "ArtifactRef": {
+      "type": "object",
+      "required": [
+        "id",
+        "kind",
+        "digest"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "kind": {
+          "type": "string",
+          "minLength": 1
+        },
+        "digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "uri": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "SourceBinding": {
+      "type": "object",
+      "required": [
+        "revision",
+        "tree_digest",
+        "dirty"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "revision": {
+          "type": "string",
+          "minLength": 7
+        },
+        "tree_digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "dirty": {
+          "type": "boolean"
+        }
+      }
+    },
+    "TargetBinding": {
+      "type": "object",
+      "required": [
+        "kind"
+      ],
+      "anyOf": [
+        {
+          "required": [
+            "digest"
+          ]
+        },
+        {
+          "required": [
+            "uri"
+          ]
+        },
+        {
+          "required": [
+            "deployment_id"
+          ]
+        }
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "kind": {
+          "type": "string",
+          "minLength": 1
+        },
+        "uri": {
+          "type": "string",
+          "minLength": 1
+        },
+        "digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "deployment_id": {
+          "$ref": "#/$defs/Id"
+        }
+      }
+    },
+    "EnvironmentBinding": {
+      "type": "object",
+      "required": [
+        "kind",
+        "id",
+        "digest"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "kind": {
+          "type": "string",
+          "minLength": 1
+        },
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "digest": {
+          "$ref": "#/$defs/Digest"
+        }
+      }
+    },
+    "RuntimeTarget": {
+      "type": "object",
+      "required": [
+        "kind",
+        "id"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "kind": {
+          "type": "string",
+          "minLength": 1
+        },
+        "id": {
+          "$ref": "#/$defs/Id"
+        }
+      }
+    },
+    "CapabilityBinding": {
+      "type": "object",
+      "required": [
+        "manifest_id",
+        "manifest_digest",
+        "instance_id",
+        "instance_digest"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "manifest_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "manifest_digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "instance_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "instance_digest": {
+          "$ref": "#/$defs/Digest"
+        }
+      }
+    },
+    "RawResultRef": {
+      "type": "object",
+      "required": [
+        "kind",
+        "digest"
+      ],
+      "additionalProperties": true,
+      "properties": {
+        "kind": {
+          "type": "string",
+          "minLength": 1
+        },
+        "digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "artifact_id": {
+          "$ref": "#/$defs/Id"
+        }
+      }
+    },
+    "VantagePoint": {
+      "type": "object",
+      "required": [
+        "kind",
+        "identity"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "kind": {
+          "type": "string",
+          "minLength": 1
+        },
+        "identity": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "FixtureDisclosure": {
+      "type": "object",
+      "required": [
+        "fixtures_used",
+        "mocks_used"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "fixtures_used": {
+          "type": "boolean"
+        },
+        "mocks_used": {
+          "type": "boolean"
+        },
+        "fixture_refs": {
+          "$ref": "#/$defs/StringList"
+        },
+        "mock_refs": {
+          "$ref": "#/$defs/StringList"
+        }
+      }
+    },
+    "PermissionState": {
+      "type": "object",
+      "required": [
+        "network",
+        "filesystem"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "network": {
+          "type": "string",
+          "minLength": 1
+        },
+        "filesystem": {
+          "type": "string",
+          "minLength": 1
+        },
+        "environment": {
+          "type": "string",
+          "minLength": 1
+        },
+        "secrets": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "SandboxState": {
+      "type": "object",
+      "required": [
+        "mode",
+        "limits"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "mode": {
+          "type": "string",
+          "minLength": 1
+        },
+        "limits": {
+          "type": "object",
+          "required": [
+            "timeout_ms",
+            "stdout_bytes",
+            "stderr_bytes"
+          ],
+          "additionalProperties": false,
+          "properties": {
+            "timeout_ms": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "stdout_bytes": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "stderr_bytes": {
+              "type": "integer",
+              "minimum": 0
+            }
+          }
+        }
+      }
+    },
+    "ProbeResult": {
+      "type": "object",
+      "required": [
+        "probe_execution_id",
+        "outcome",
+        "observed_at",
+        "checks"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "probe_execution_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "outcome": {
+          "$ref": "#/$defs/AttemptStatus"
+        },
+        "observed_at": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "checks": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": [
+              "name",
+              "outcome"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "name": {
+                "type": "string",
+                "minLength": 1
+              },
+              "outcome": {
+                "$ref": "#/$defs/AttemptStatus"
+              },
+              "detail": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        }
+      }
+    },
+    "ObservedPayloadContract": {
+      "type": "object",
+      "required": [
+        "schema_ref",
+        "observation_types"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "schema_ref": {
+          "type": "string",
+          "minLength": 1
+        },
+        "observation_types": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/NamespaceName"
+          }
+        }
+      }
+    },
+    "ResolvedExecution": {
+      "oneOf": [
+        {
+          "type": "object",
+          "required": [
+            "kind",
+            "command",
+            "cwd"
+          ],
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "command"
+            },
+            "command": {
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "type": "string",
+                "minLength": 1
+              }
+            },
+            "cwd": {
+              "type": "string",
+              "minLength": 1
+            },
+            "env_digest": {
+              "$ref": "#/$defs/Digest"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "kind",
+            "tool_name",
+            "arguments_digest"
+          ],
+          "additionalProperties": false,
+          "properties": {
+            "kind": {
+              "const": "tool_call"
+            },
+            "tool_name": {
+              "type": "string",
+              "minLength": 1
+            },
+            "arguments_digest": {
+              "$ref": "#/$defs/Digest"
+            }
+          }
+        }
+      ]
+    },
+    "ExecutionResult": {
+      "type": "object",
+      "required": [
+        "exit_code",
+        "signal",
+        "error"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "exit_code": {
+          "anyOf": [
+            {
+              "type": "integer",
+              "minimum": 0
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "signal": {
+          "anyOf": [
+            {
+              "type": "string",
+              "minLength": 1
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "error": {
+          "anyOf": [
+            {
+              "type": "string",
+              "minLength": 1
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      }
+    },
+    "RetryLineage": {
+      "type": "object",
+      "required": [
+        "attempt_number",
+        "max_attempts",
+        "previous_attempt_ids"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "attempt_number": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "max_attempts": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "previous_attempt_ids": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/Id"
+          }
+        }
+      }
+    },
+    "OutputBounds": {
+      "type": "object",
+      "required": [
+        "stdout_bytes",
+        "stderr_bytes",
+        "stdout_truncated",
+        "stderr_truncated"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "stdout_bytes": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "stderr_bytes": {
+          "type": "integer",
+          "minimum": 0
+        },
+        "stdout_truncated": {
+          "type": "boolean"
+        },
+        "stderr_truncated": {
+          "type": "boolean"
+        }
+      }
+    },
+    "ProofObligation": {
+      "type": "object",
+      "required": [
+        "id",
+        "schema_version",
+        "criterion_id",
+        "plan_id",
+        "title",
+        "binding",
+        "observations",
+        "fixture_policy",
+        "freshness_policy",
+        "assurance_policy",
+        "policy_digest",
+        "config_digest",
+        "created_at"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "schema_version": {
+          "$ref": "#/$defs/SchemaVersion"
+        },
+        "criterion_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "plan_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "item_id": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Id"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "title": {
+          "type": "string",
+          "minLength": 1
+        },
+        "binding": {
+          "type": "boolean"
+        },
+        "observations": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/ObservationRequirement"
+          }
+        },
+        "fixture_policy": {
+          "$ref": "#/$defs/JsonObject"
+        },
+        "freshness_policy": {
+          "$ref": "#/$defs/JsonObject"
+        },
+        "assurance_policy": {
+          "$ref": "#/$defs/JsonObject"
+        },
+        "policy_digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "config_digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "created_at": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "supersedes": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Id"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      }
+    },
+    "ObservationRequirement": {
+      "type": "object",
+      "required": [
+        "id",
+        "type",
+        "subject",
+        "expected",
+        "target",
+        "environment",
+        "runtime_target"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "type": {
+          "$ref": "#/$defs/NamespaceName"
+        },
+        "subject": {
+          "type": "string",
+          "minLength": 1
+        },
+        "expected": {
+          "$ref": "#/$defs/JsonObject"
+        },
+        "target": {
+          "$ref": "#/$defs/TargetBinding"
+        },
+        "environment": {
+          "$ref": "#/$defs/EnvironmentBinding"
+        },
+        "runtime_target": {
+          "$ref": "#/$defs/RuntimeTarget"
+        },
+        "payload_schema": {
+          "$ref": "#/$defs/JsonObject"
+        },
+        "state_transitions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/JsonObject"
+          }
+        },
+        "persistence": {
+          "$ref": "#/$defs/JsonObject"
+        },
+        "negative_assertions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/JsonObject"
+          }
+        },
+        "freshness_policy": {
+          "$ref": "#/$defs/JsonObject"
+        },
+        "assurance_policy": {
+          "$ref": "#/$defs/JsonObject"
+        }
+      }
+    },
+    "VerificationCapabilityManifest": {
+      "type": "object",
+      "required": [
+        "id",
+        "schema_version",
+        "version",
+        "adapter_kind",
+        "adapter_digest",
+        "supported_surfaces",
+        "supported_observations",
+        "supported_interactions",
+        "supported_artifacts",
+        "runtime_targets",
+        "provenance_path",
+        "permissions",
+        "costs",
+        "determinism",
+        "repeatability",
+        "independence",
+        "blind_spots",
+        "availability_probe"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "schema_version": {
+          "$ref": "#/$defs/SchemaVersion"
+        },
+        "version": {
+          "type": "string",
+          "minLength": 1
+        },
+        "adapter_kind": {
+          "enum": [
+            "process",
+            "host",
+            "mcp",
+            "artifact_import",
+            "user_attestation"
+          ]
+        },
+        "adapter_digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "supported_surfaces": {
+          "$ref": "#/$defs/StringList"
+        },
+        "supported_observations": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/PayloadSchemaBinding"
+          }
+        },
+        "supported_interactions": {
+          "$ref": "#/$defs/StringList"
+        },
+        "supported_artifacts": {
+          "$ref": "#/$defs/StringList"
+        },
+        "runtime_targets": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/RuntimeTarget"
+          }
+        },
+        "provenance_path": {
+          "enum": [
+            "planr_observed_execution",
+            "verified_host_event",
+            "mcp_attestation",
+            "validated_artifact_import",
+            "user_attestation"
+          ]
+        },
+        "permissions": {
+          "$ref": "#/$defs/JsonObject"
+        },
+        "costs": {
+          "$ref": "#/$defs/JsonObject"
+        },
+        "determinism": {
+          "type": "string",
+          "minLength": 1
+        },
+        "repeatability": {
+          "type": "string",
+          "minLength": 1
+        },
+        "independence": {
+          "type": "string",
+          "minLength": 1
+        },
+        "blind_spots": {
+          "$ref": "#/$defs/StringList"
+        },
+        "availability_probe": {
+          "$ref": "#/$defs/AvailabilityProbeContract"
+        }
+      }
+    },
+    "VerificationCapabilityInstance": {
+      "type": "object",
+      "required": [
+        "id",
+        "schema_version",
+        "manifest_id",
+        "manifest_digest",
+        "host",
+        "surface",
+        "host_version",
+        "adapter_version",
+        "environment",
+        "permissions",
+        "availability",
+        "probe_result",
+        "observed_payload_contract",
+        "limitations",
+        "captured_at"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "schema_version": {
+          "$ref": "#/$defs/SchemaVersion"
+        },
+        "manifest_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "manifest_digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "host": {
+          "type": "string",
+          "minLength": 1
+        },
+        "surface": {
+          "type": "string",
+          "minLength": 1
+        },
+        "host_version": {
+          "type": "string",
+          "minLength": 1
+        },
+        "adapter_version": {
+          "type": "string",
+          "minLength": 1
+        },
+        "environment": {
+          "$ref": "#/$defs/EnvironmentBinding"
+        },
+        "permissions": {
+          "$ref": "#/$defs/PermissionState"
+        },
+        "availability": {
+          "$ref": "#/$defs/CapabilityAvailability"
+        },
+        "probe_result": {
+          "$ref": "#/$defs/ProbeResult"
+        },
+        "observed_payload_contract": {
+          "$ref": "#/$defs/ObservedPayloadContract"
+        },
+        "limitations": {
+          "$ref": "#/$defs/StringList"
+        },
+        "captured_at": {
+          "$ref": "#/$defs/Timestamp"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "availability": {
+                "type": "object",
+                "properties": {
+                  "status": {
+                    "const": "available"
+                  }
+                },
+                "required": [
+                  "status"
+                ]
+              }
+            }
+          },
+          "then": {
+            "properties": {
+              "probe_result": {
+                "type": "object",
+                "properties": {
+                  "outcome": {
+                    "const": "passed"
+                  }
+                },
+                "required": [
+                  "outcome",
+                  "probe_execution_id"
+                ]
+              }
+            }
+          }
+        }
+      ]
+    },
+    "CapabilityAvailability": {
+      "type": "object",
+      "required": [
+        "status"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "status": {
+          "enum": [
+            "available",
+            "unavailable",
+            "degraded",
+            "permission_denied",
+            "sandbox_blocked",
+            "unsupported",
+            "probe_failed"
+          ]
+        },
+        "reason": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "EvidenceAttempt": {
+      "type": "object",
+      "required": [
+        "id",
+        "schema_version",
+        "criterion_id",
+        "obligation_id",
+        "capability_instance_id",
+        "started_at",
+        "ended_at",
+        "status",
+        "resolved_command",
+        "exit",
+        "retry_lineage",
+        "stdout_digest",
+        "stderr_digest",
+        "raw_result",
+        "artifacts",
+        "output_bounds"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "schema_version": {
+          "$ref": "#/$defs/SchemaVersion"
+        },
+        "criterion_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "obligation_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "capability_instance_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "started_at": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "ended_at": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "status": {
+          "$ref": "#/$defs/AttemptStatus"
+        },
+        "resolved_command": {
+          "$ref": "#/$defs/ResolvedExecution"
+        },
+        "exit": {
+          "$ref": "#/$defs/ExecutionResult"
+        },
+        "retry_lineage": {
+          "$ref": "#/$defs/RetryLineage"
+        },
+        "stdout_digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "stderr_digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "raw_result": {
+          "$ref": "#/$defs/RawResultRef"
+        },
+        "artifacts": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/ArtifactRef"
+          }
+        },
+        "output_bounds": {
+          "$ref": "#/$defs/OutputBounds"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "passed"
+              }
+            },
+            "required": [
+              "status"
+            ]
+          },
+          "then": {
+            "properties": {
+              "exit": {
+                "type": "object",
+                "properties": {
+                  "exit_code": {
+                    "const": 0
+                  },
+                  "signal": {
+                    "type": "null"
+                  },
+                  "error": {
+                    "type": "null"
+                  }
+                },
+                "required": [
+                  "exit_code",
+                  "signal",
+                  "error"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "failed"
+              }
+            },
+            "required": [
+              "status"
+            ]
+          },
+          "then": {
+            "properties": {
+              "exit": {
+                "type": "object",
+                "properties": {
+                  "exit_code": {
+                    "type": "integer",
+                    "minimum": 1
+                  },
+                  "signal": {
+                    "type": "null"
+                  }
+                },
+                "required": [
+                  "exit_code",
+                  "signal",
+                  "error"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "timed_out"
+              }
+            },
+            "required": [
+              "status"
+            ]
+          },
+          "then": {
+            "properties": {
+              "exit": {
+                "type": "object",
+                "properties": {
+                  "exit_code": {
+                    "type": "null"
+                  },
+                  "signal": {
+                    "type": "null"
+                  },
+                  "error": {
+                    "const": "timed_out"
+                  }
+                },
+                "required": [
+                  "exit_code",
+                  "signal",
+                  "error"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "aborted"
+              }
+            },
+            "required": [
+              "status"
+            ]
+          },
+          "then": {
+            "properties": {
+              "exit": {
+                "type": "object",
+                "properties": {
+                  "exit_code": {
+                    "type": "null"
+                  },
+                  "signal": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "error": {
+                    "const": "aborted"
+                  }
+                },
+                "required": [
+                  "exit_code",
+                  "signal",
+                  "error"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "skipped"
+              }
+            },
+            "required": [
+              "status"
+            ]
+          },
+          "then": {
+            "properties": {
+              "exit": {
+                "type": "object",
+                "properties": {
+                  "exit_code": {
+                    "type": "null"
+                  },
+                  "signal": {
+                    "type": "null"
+                  },
+                  "error": {
+                    "const": "skipped"
+                  }
+                },
+                "required": [
+                  "exit_code",
+                  "signal",
+                  "error"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "unavailable"
+              }
+            },
+            "required": [
+              "status"
+            ]
+          },
+          "then": {
+            "properties": {
+              "exit": {
+                "type": "object",
+                "properties": {
+                  "exit_code": {
+                    "type": "null"
+                  },
+                  "signal": {
+                    "type": "null"
+                  },
+                  "error": {
+                    "const": "unavailable"
+                  }
+                },
+                "required": [
+                  "exit_code",
+                  "signal",
+                  "error"
+                ]
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "inconclusive"
+              }
+            },
+            "required": [
+              "status"
+            ]
+          },
+          "then": {
+            "properties": {
+              "exit": {
+                "type": "object",
+                "properties": {
+                  "exit_code": {
+                    "const": 0
+                  },
+                  "signal": {
+                    "type": "null"
+                  },
+                  "error": {
+                    "const": "inconclusive"
+                  }
+                },
+                "required": [
+                  "exit_code",
+                  "signal",
+                  "error"
+                ]
+              }
+            }
+          }
+        }
+      ]
+    },
+    "AttemptStatus": {
+      "enum": [
+        "passed",
+        "failed",
+        "skipped",
+        "timed_out",
+        "aborted",
+        "unavailable",
+        "inconclusive"
+      ]
+    },
+    "UntrustedEvidenceProposal": {
+      "type": "object",
+      "required": [
+        "id",
+        "schema_version",
+        "source_kind",
+        "submitted_at",
+        "claims",
+        "artifact_refs",
+        "producer_metadata"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "schema_version": {
+          "$ref": "#/$defs/SchemaVersion"
+        },
+        "source_kind": {
+          "enum": [
+            "agent",
+            "adapter",
+            "host",
+            "mcp",
+            "artifact_import",
+            "user"
+          ]
+        },
+        "submitted_at": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "claims": {
+          "$ref": "#/$defs/JsonObject"
+        },
+        "artifact_refs": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/ArtifactRef"
+          }
+        },
+        "producer_metadata": {
+          "$ref": "#/$defs/JsonObject"
+        }
+      },
+      "not": {
+        "anyOf": [
+          {
+            "required": [
+              "provenance"
+            ]
+          },
+          {
+            "required": [
+              "execution_id"
+            ]
+          },
+          {
+            "required": [
+              "receipt_digest"
+            ]
+          },
+          {
+            "required": [
+              "closure_authority"
+            ]
+          }
+        ]
+      }
+    },
+    "EvidenceReceipt": {
+      "type": "object",
+      "required": [
+        "id",
+        "schema_version",
+        "criterion_id",
+        "obligation_id",
+        "receipt_status",
+        "source",
+        "target",
+        "environment",
+        "vantage_point",
+        "capability",
+        "provenance",
+        "observations",
+        "attempt_ids",
+        "retry_history",
+        "artifacts",
+        "raw_result",
+        "config_digest",
+        "fixture_disclosure",
+        "permissions",
+        "sandbox",
+        "proof_gaps",
+        "started_at",
+        "ended_at",
+        "receipt_digest"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "schema_version": {
+          "$ref": "#/$defs/SchemaVersion"
+        },
+        "criterion_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "obligation_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "receipt_status": {
+          "enum": [
+            "trusted",
+            "rejected",
+            "untrusted",
+            "stale",
+            "superseded"
+          ]
+        },
+        "source": {
+          "$ref": "#/$defs/SourceBinding"
+        },
+        "target": {
+          "$ref": "#/$defs/TargetBinding"
+        },
+        "environment": {
+          "$ref": "#/$defs/EnvironmentBinding"
+        },
+        "vantage_point": {
+          "$ref": "#/$defs/VantagePoint"
+        },
+        "capability": {
+          "$ref": "#/$defs/CapabilityBinding"
+        },
+        "provenance": {
+          "$ref": "#/$defs/TrustedProvenance"
+        },
+        "observations": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/ObservationResult"
+          }
+        },
+        "attempt_ids": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/Id"
+          }
+        },
+        "retry_history": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/JsonObject"
+          }
+        },
+        "artifacts": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/ArtifactRef"
+          }
+        },
+        "raw_result": {
+          "$ref": "#/$defs/RawResultRef"
+        },
+        "config_digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "fixture_disclosure": {
+          "$ref": "#/$defs/FixtureDisclosure"
+        },
+        "permissions": {
+          "$ref": "#/$defs/PermissionState"
+        },
+        "sandbox": {
+          "$ref": "#/$defs/SandboxState"
+        },
+        "proof_gaps": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/GapReason"
+          }
+        },
+        "started_at": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "ended_at": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "receipt_digest": {
+          "$ref": "#/$defs/Digest"
+        }
+      }
+    },
+    "TrustedProvenance": {
+      "type": "object",
+      "required": [
+        "source",
+        "assigned_by",
+        "execution_id"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "source": {
+          "enum": [
+            "planr_observed_execution",
+            "verified_host_event",
+            "mcp_attestation",
+            "validated_artifact_import",
+            "user_attestation"
+          ]
+        },
+        "assigned_by": {
+          "const": "planr"
+        },
+        "execution_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "tool_call_id": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/Id"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      }
+    },
+    "ObservationResult": {
+      "type": "object",
+      "required": [
+        "requirement_id",
+        "type",
+        "outcome",
+        "predicate",
+        "actual"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "requirement_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "type": {
+          "$ref": "#/$defs/NamespaceName"
+        },
+        "outcome": {
+          "$ref": "#/$defs/AttemptStatus"
+        },
+        "predicate": {
+          "$ref": "#/$defs/JsonObject"
+        },
+        "actual": {
+          "$ref": "#/$defs/JsonObject"
+        }
+      }
+    },
+    "CoverageVerdict": {
+      "type": "object",
+      "required": [
+        "id",
+        "schema_version",
+        "scope",
+        "evaluated_at",
+        "status",
+        "observation_coverage",
+        "validation_details",
+        "suggested_next_action",
+        "actionable_now"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "schema_version": {
+          "$ref": "#/$defs/SchemaVersion"
+        },
+        "scope": {
+          "$ref": "#/$defs/EvidenceScope"
+        },
+        "evaluated_at": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "status": {
+          "enum": [
+            "satisfied",
+            "unsatisfied",
+            "blocked",
+            "inconclusive",
+            "waived",
+            "stale"
+          ]
+        },
+        "observation_coverage": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/ObservationCoverage"
+          }
+        },
+        "validation_details": {
+          "$ref": "#/$defs/CoverageValidationDetails"
+        },
+        "suggested_next_action": {
+          "type": "string"
+        },
+        "actionable_now": {
+          "type": "boolean"
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "satisfied"
+              }
+            },
+            "required": [
+              "status"
+            ]
+          },
+          "then": {
+            "properties": {
+              "observation_coverage": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "$ref": "#/$defs/CoveredObservationCoverage"
+                }
+              },
+              "validation_details": {
+                "$ref": "#/$defs/PassingCoverageValidationDetails"
+              },
+              "actionable_now": {
+                "const": false
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "unsatisfied"
+              }
+            },
+            "required": [
+              "status"
+            ]
+          },
+          "then": {
+            "properties": {
+              "observation_coverage": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/$defs/CoveredObservationCoverage"
+                    },
+                    {
+                      "$ref": "#/$defs/UnsatisfiedObservationCoverage"
+                    }
+                  ]
+                },
+                "contains": {
+                  "$ref": "#/$defs/UnsatisfiedObservationCoverage"
+                }
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "blocked"
+              }
+            },
+            "required": [
+              "status"
+            ]
+          },
+          "then": {
+            "properties": {
+              "observation_coverage": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/$defs/CoveredObservationCoverage"
+                    },
+                    {
+                      "$ref": "#/$defs/BlockedObservationCoverage"
+                    }
+                  ]
+                },
+                "contains": {
+                  "$ref": "#/$defs/BlockedObservationCoverage"
+                }
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "inconclusive"
+              }
+            },
+            "required": [
+              "status"
+            ]
+          },
+          "then": {
+            "properties": {
+              "observation_coverage": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/$defs/CoveredObservationCoverage"
+                    },
+                    {
+                      "$ref": "#/$defs/InconclusiveObservationCoverage"
+                    }
+                  ]
+                },
+                "contains": {
+                  "$ref": "#/$defs/InconclusiveObservationCoverage"
+                }
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "waived"
+              }
+            },
+            "required": [
+              "status"
+            ]
+          },
+          "then": {
+            "properties": {
+              "observation_coverage": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/$defs/CoveredObservationCoverage"
+                    },
+                    {
+                      "$ref": "#/$defs/WaivedObservationCoverage"
+                    }
+                  ]
+                },
+                "contains": {
+                  "$ref": "#/$defs/WaivedObservationCoverage"
+                }
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "properties": {
+              "status": {
+                "const": "stale"
+              }
+            },
+            "required": [
+              "status"
+            ]
+          },
+          "then": {
+            "properties": {
+              "observation_coverage": {
+                "type": "array",
+                "minItems": 1,
+                "items": {
+                  "oneOf": [
+                    {
+                      "$ref": "#/$defs/CoveredObservationCoverage"
+                    },
+                    {
+                      "$ref": "#/$defs/StaleObservationCoverage"
+                    }
+                  ]
+                },
+                "contains": {
+                  "$ref": "#/$defs/StaleObservationCoverage"
+                }
+              }
+            }
+          }
+        }
+      ]
+    },
+    "GapReason": {
+      "enum": [
+        "missing_observation",
+        "missing_capability",
+        "permission_denied",
+        "sandbox_blocked",
+        "environment_unavailable",
+        "external_dependency_unavailable",
+        "product_failed",
+        "verifier_failed",
+        "timed_out",
+        "aborted",
+        "inconclusive_result",
+        "stale_source",
+        "stale_target",
+        "stale_environment",
+        "stale_policy",
+        "stale_adapter_schema",
+        "stale_configuration",
+        "target_mismatch",
+        "schema_mismatch",
+        "manifest_mismatch",
+        "untrusted_provenance",
+        "fixture_disallowed",
+        "mock_disallowed",
+        "insufficient_assurance",
+        "waiver_missing",
+        "waiver_expired",
+        "unknown_observation_type",
+        "unsupported_runtime_target"
+      ]
+    },
+    "CoveredObservationCoverage": {
+      "type": "object",
+      "required": [
+        "requirement_id",
+        "status",
+        "covering_receipt_ids"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "requirement_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "status": {
+          "const": "covered"
+        },
+        "covering_receipt_ids": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/Id"
+          }
+        },
+        "covered_observation_ids": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/Id"
+          }
+        }
+      }
+    },
+    "GapObservationCoverage": {
+      "type": "object",
+      "required": [
+        "requirement_id",
+        "status",
+        "gap_reason"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "requirement_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "status": {
+          "enum": [
+            "missing",
+            "blocked",
+            "inconclusive",
+            "waived",
+            "stale",
+            "unsatisfied"
+          ]
+        },
+        "gap_reason": {
+          "$ref": "#/$defs/GapReason"
+        },
+        "gap_reasons": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/GapReason"
+          }
+        },
+        "attempted_receipt_ids": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/Id"
+          }
+        },
+        "waiver_id": {
+          "$ref": "#/$defs/Id"
+        }
+      }
+    },
+    "UnsatisfiedObservationCoverage": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/GapObservationCoverage"
+        },
+        {
+          "type": "object",
+          "properties": {
+            "status": {
+              "enum": [
+                "missing",
+                "unsatisfied"
+              ]
+            },
+            "gap_reason": {
+              "enum": [
+                "missing_observation",
+                "product_failed",
+                "verifier_failed",
+                "target_mismatch",
+                "schema_mismatch",
+                "manifest_mismatch",
+                "untrusted_provenance",
+                "fixture_disallowed",
+                "mock_disallowed",
+                "insufficient_assurance",
+                "waiver_missing",
+                "waiver_expired",
+                "unknown_observation_type",
+                "unsupported_runtime_target"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "BlockedObservationCoverage": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/GapObservationCoverage"
+        },
+        {
+          "type": "object",
+          "properties": {
+            "status": {
+              "const": "blocked"
+            },
+            "gap_reason": {
+              "enum": [
+                "missing_capability",
+                "permission_denied",
+                "sandbox_blocked",
+                "environment_unavailable",
+                "external_dependency_unavailable",
+                "unsupported_runtime_target"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "InconclusiveObservationCoverage": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/GapObservationCoverage"
+        },
+        {
+          "type": "object",
+          "properties": {
+            "status": {
+              "const": "inconclusive"
+            },
+            "gap_reason": {
+              "enum": [
+                "timed_out",
+                "aborted",
+                "inconclusive_result",
+                "verifier_failed"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "WaivedObservationCoverage": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/GapObservationCoverage"
+        },
+        {
+          "type": "object",
+          "required": [
+            "waiver_id"
+          ],
+          "properties": {
+            "status": {
+              "const": "waived"
+            },
+            "gap_reason": {
+              "enum": [
+                "missing_observation",
+                "missing_capability",
+                "permission_denied",
+                "sandbox_blocked",
+                "environment_unavailable",
+                "external_dependency_unavailable",
+                "product_failed",
+                "verifier_failed",
+                "target_mismatch",
+                "schema_mismatch",
+                "manifest_mismatch",
+                "untrusted_provenance",
+                "fixture_disallowed",
+                "mock_disallowed",
+                "insufficient_assurance",
+                "unknown_observation_type",
+                "unsupported_runtime_target"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "StaleObservationCoverage": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/GapObservationCoverage"
+        },
+        {
+          "type": "object",
+          "properties": {
+            "status": {
+              "const": "stale"
+            },
+            "gap_reason": {
+              "enum": [
+                "stale_source",
+                "stale_target",
+                "stale_environment",
+                "stale_policy",
+                "stale_adapter_schema",
+                "stale_configuration"
+              ]
+            }
+          }
+        }
+      ]
+    },
+    "ObservationCoverage": {
+      "oneOf": [
+        {
+          "$ref": "#/$defs/CoveredObservationCoverage"
+        },
+        {
+          "$ref": "#/$defs/GapObservationCoverage"
+        }
+      ]
+    },
+    "CoverageValidationCheck": {
+      "type": "object",
+      "required": [
+        "status",
+        "checked_at",
+        "receipt_ids",
+        "gap_reasons"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "status": {
+          "enum": [
+            "passed",
+            "failed",
+            "warning",
+            "not_applicable"
+          ]
+        },
+        "checked_at": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "receipt_ids": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/Id"
+          }
+        },
+        "gap_reasons": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/GapReason"
+          }
+        },
+        "detail": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "PassingCoverageValidationCheck": {
+      "allOf": [
+        {
+          "$ref": "#/$defs/CoverageValidationCheck"
+        },
+        {
+          "type": "object",
+          "properties": {
+            "status": {
+              "const": "passed"
+            },
+            "gap_reasons": {
+              "type": "array",
+              "maxItems": 0
+            }
+          }
+        }
+      ]
+    },
+    "CoverageValidationDetails": {
+      "type": "object",
+      "required": [
+        "trust",
+        "freshness",
+        "target",
+        "schema",
+        "provenance",
+        "fixture",
+        "completion"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "trust": {
+          "$ref": "#/$defs/CoverageValidationCheck"
+        },
+        "freshness": {
+          "$ref": "#/$defs/CoverageValidationCheck"
+        },
+        "target": {
+          "$ref": "#/$defs/CoverageValidationCheck"
+        },
+        "schema": {
+          "$ref": "#/$defs/CoverageValidationCheck"
+        },
+        "provenance": {
+          "$ref": "#/$defs/CoverageValidationCheck"
+        },
+        "fixture": {
+          "$ref": "#/$defs/CoverageValidationCheck"
+        },
+        "completion": {
+          "$ref": "#/$defs/CoverageValidationCheck"
+        }
+      }
+    },
+    "PassingCoverageValidationDetails": {
+      "type": "object",
+      "required": [
+        "trust",
+        "freshness",
+        "target",
+        "schema",
+        "provenance",
+        "fixture",
+        "completion"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "trust": {
+          "$ref": "#/$defs/PassingCoverageValidationCheck"
+        },
+        "freshness": {
+          "$ref": "#/$defs/PassingCoverageValidationCheck"
+        },
+        "target": {
+          "$ref": "#/$defs/PassingCoverageValidationCheck"
+        },
+        "schema": {
+          "$ref": "#/$defs/PassingCoverageValidationCheck"
+        },
+        "provenance": {
+          "$ref": "#/$defs/PassingCoverageValidationCheck"
+        },
+        "fixture": {
+          "$ref": "#/$defs/PassingCoverageValidationCheck"
+        },
+        "completion": {
+          "$ref": "#/$defs/PassingCoverageValidationCheck"
+        }
+      }
+    },
+    "EvidencePolicyDefaults": {
+      "type": "object",
+      "required": [
+        "preset_id",
+        "binding",
+        "assurance_level"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "preset_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "binding": {
+          "type": "boolean"
+        },
+        "assurance_level": {
+          "enum": [
+            "low",
+            "standard",
+            "high"
+          ]
+        }
+      }
+    },
+    "ObservationSchemaRegistration": {
+      "type": "object",
+      "required": [
+        "type",
+        "schema_ref",
+        "schema_digest",
+        "owning_namespace"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "type": {
+          "$ref": "#/$defs/NamespaceName"
+        },
+        "schema_ref": {
+          "type": "string",
+          "minLength": 1
+        },
+        "schema_digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "owning_namespace": {
+          "$ref": "#/$defs/NamespaceName"
+        }
+      }
+    },
+    "AdapterRegistration": {
+      "type": "object",
+      "required": [
+        "manifest_id",
+        "manifest_path",
+        "manifest_digest",
+        "observation_types",
+        "payload_schemas",
+        "provenance_path",
+        "execution_contract"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "manifest_id": {
+          "$ref": "#/$defs/Id"
+        },
+        "manifest_path": {
+          "type": "string",
+          "minLength": 1
+        },
+        "manifest_digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "observation_types": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/NamespaceName"
+          }
+        },
+        "payload_schemas": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/PayloadSchemaBinding"
+          }
+        },
+        "provenance_path": {
+          "enum": [
+            "planr_observed_execution",
+            "verified_host_event",
+            "mcp_attestation",
+            "validated_artifact_import",
+            "user_attestation"
+          ]
+        },
+        "execution_contract": {
+          "$ref": "#/$defs/ProcessExecutionContract"
+        }
+      }
+    },
+    "TrustPolicy": {
+      "type": "object",
+      "required": [
+        "accepted_provenance",
+        "min_receipt_status",
+        "allow_user_attestation"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "accepted_provenance": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "enum": [
+              "planr_observed_execution",
+              "verified_host_event",
+              "mcp_attestation",
+              "validated_artifact_import",
+              "user_attestation"
+            ]
+          }
+        },
+        "min_receipt_status": {
+          "const": "trusted"
+        },
+        "allow_user_attestation": {
+          "type": "boolean"
+        }
+      }
+    },
+    "FreshnessPolicy": {
+      "type": "object",
+      "required": [
+        "max_age_seconds",
+        "invalidate_on"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "max_age_seconds": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "invalidate_on": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "enum": [
+              "source_change",
+              "target_change",
+              "environment_change",
+              "policy_change",
+              "adapter_schema_change",
+              "configuration_change"
+            ]
+          }
+        }
+      }
+    },
+    "FixturePolicy": {
+      "type": "object",
+      "required": [
+        "fixtures_allowed",
+        "mocks_allowed",
+        "disclosure_required"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "fixtures_allowed": {
+          "type": "boolean"
+        },
+        "mocks_allowed": {
+          "type": "boolean"
+        },
+        "disclosure_required": {
+          "const": true
+        }
+      }
+    },
+    "CompletionPolicy": {
+      "type": "object",
+      "required": [
+        "require_satisfied_or_waived",
+        "allow_inconclusive_completion",
+        "require_review_evidence"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "require_satisfied_or_waived": {
+          "const": true
+        },
+        "allow_inconclusive_completion": {
+          "const": false
+        },
+        "require_review_evidence": {
+          "type": "boolean"
+        }
+      }
+    },
+    "PolicyLayer": {
+      "type": "object",
+      "required": [
+        "scope",
+        "policy_digest"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "scope": {
+          "$ref": "#/$defs/EvidenceScope"
+        },
+        "policy_digest": {
+          "$ref": "#/$defs/Digest"
+        }
+      }
+    },
+    "PolicyLayering": {
+      "type": "object",
+      "required": [
+        "mode",
+        "weakening_requires_waiver",
+        "layers"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "mode": {
+          "const": "monotonic_strengthening"
+        },
+        "weakening_requires_waiver": {
+          "const": true
+        },
+        "layers": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/PolicyLayer"
+          }
+        }
+      }
+    },
+    "EvidencePolicy": {
+      "type": "object",
+      "required": [
+        "id",
+        "schema_version",
+        "policy_digest",
+        "defaults",
+        "named_presets",
+        "observation_schema_registrations",
+        "adapter_registrations",
+        "extension_namespaces",
+        "trust_policy",
+        "freshness_policy",
+        "fixture_policy",
+        "completion_policy",
+        "layering_policy"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "schema_version": {
+          "$ref": "#/$defs/SchemaVersion"
+        },
+        "policy_digest": {
+          "$ref": "#/$defs/Digest"
+        },
+        "defaults": {
+          "$ref": "#/$defs/EvidencePolicyDefaults"
+        },
+        "named_presets": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/ProofPreset"
+          }
+        },
+        "observation_schema_registrations": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/ObservationSchemaRegistration"
+          }
+        },
+        "adapter_registrations": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/AdapterRegistration"
+          }
+        },
+        "extension_namespaces": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/NamespaceName"
+          }
+        },
+        "trust_policy": {
+          "$ref": "#/$defs/TrustPolicy"
+        },
+        "freshness_policy": {
+          "$ref": "#/$defs/FreshnessPolicy"
+        },
+        "fixture_policy": {
+          "$ref": "#/$defs/FixturePolicy"
+        },
+        "completion_policy": {
+          "$ref": "#/$defs/CompletionPolicy"
+        },
+        "layering_policy": {
+          "$ref": "#/$defs/PolicyLayering"
+        }
+      }
+    },
+    "ProofPreset": {
+      "type": "object",
+      "required": [
+        "id",
+        "schema_version",
+        "namespace",
+        "observations"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "schema_version": {
+          "$ref": "#/$defs/SchemaVersion"
+        },
+        "namespace": {
+          "$ref": "#/$defs/NamespaceName"
+        },
+        "observations": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/ObservationRequirement"
+          }
+        }
+      }
+    },
+    "EvidenceWaiver": {
+      "type": "object",
+      "required": [
+        "id",
+        "schema_version",
+        "scope",
+        "observation_ids",
+        "source",
+        "target",
+        "reason",
+        "created_by",
+        "created_at",
+        "expires_at",
+        "approval_ref",
+        "audit_trail"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/Id"
+        },
+        "schema_version": {
+          "$ref": "#/$defs/SchemaVersion"
+        },
+        "scope": {
+          "$ref": "#/$defs/EvidenceScope"
+        },
+        "observation_ids": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/Id"
+          }
+        },
+        "source": {
+          "$ref": "#/$defs/SourceBinding"
+        },
+        "target": {
+          "$ref": "#/$defs/TargetBinding"
+        },
+        "reason": {
+          "type": "string",
+          "minLength": 1
+        },
+        "created_by": {
+          "type": "string",
+          "minLength": 1
+        },
+        "created_at": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "expires_at": {
+          "$ref": "#/$defs/Timestamp"
+        },
+        "approval_ref": {
+          "$ref": "#/$defs/Id"
+        },
+        "audit_trail": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "$ref": "#/$defs/JsonObject"
+          }
+        }
+      }
+    }
+  }
+}

scripts/host-capab...apability-expected-manifest.schema.json

+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "planr.host_capability_expected_manifest.schema.v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "payload_version",
+    "suite_id",
+    "schema_refs",
+    "provenance_ref",
+    "capability_instances"
+  ],
+  "properties": {
+    "schema_version": {
+      "const": "planr.host_capability_expected_manifest.v1"
+    },
+    "payload_version": {
+      "type": "string",
+      "minLength": 1
+    },
+    "suite_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "schema_refs": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "raw",
+        "expected",
+        "provenance"
+      ],
+      "properties": {
+        "raw": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "path",
+            "digest"
+          ],
+          "properties": {
+            "path": {
+              "type": "string",
+              "minLength": 1
+            },
+            "digest": {
+              "type": "string",
+              "pattern": "^sha256:[0-9a-f]{64}$"
+            }
+          }
+        },
+        "expected": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "path",
+            "digest"
+          ],
+          "properties": {
+            "path": {
+              "type": "string",
+              "minLength": 1
+            },
+            "digest": {
+              "type": "string",
+              "pattern": "^sha256:[0-9a-f]{64}$"
+            }
+          }
+        },
+        "provenance": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "path",
+            "digest"
+          ],
+          "properties": {
+            "path": {
+              "type": "string",
+              "minLength": 1
+            },
+            "digest": {
+              "type": "string",
+              "pattern": "^sha256:[0-9a-f]{64}$"
+            }
+          }
+        }
+      }
+    },
+    "provenance_ref": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "digest"
+      ],
+      "properties": {
+        "path": {
+          "type": "string",
+          "minLength": 1
+        },
+        "digest": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$"
+        }
+      }
+    },
+    "capability_instances": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "raw_capture_id",
+          "claim_source",
+          "trusted_adapter_enabled",
+          "manifest_ref",
+          "provenance_ref",
+          "capability_instance"
+        ],
+        "properties": {
+          "raw_capture_id": {
+            "type": "string",
+            "minLength": 1
+          },
+          "claim_source": {
+            "type": "string",
+            "minLength": 1
+          },
+          "trusted_adapter_enabled": {
+            "const": false
+          },
+          "manifest_ref": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "path",
+              "digest"
+            ],
+            "properties": {
+              "path": {
+                "type": "string",
+                "minLength": 1
+              },
+              "digest": {
+                "type": "string",
+                "pattern": "^sha256:[0-9a-f]{64}$"
+              }
+            }
+          },
+          "provenance_ref": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "path",
+              "digest"
+            ],
+            "properties": {
+              "path": {
+                "type": "string",
+                "minLength": 1
+              },
+              "digest": {
+                "type": "string",
+                "pattern": "^sha256:[0-9a-f]{64}$"
+              }
+            }
+          },
+          "capability_instance": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "id",
+              "schema_version",
+              "manifest_id",
+              "manifest_digest",
+              "host",
+              "surface",
+              "host_version",
+              "adapter_version",
+              "environment",
+              "permissions",
+              "availability",
+              "probe_result",
+              "observed_payload_contract",
+              "limitations",
+              "captured_at"
+            ],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              },
+              "schema_version": {
+                "const": "evidence.contract.v1"
+              },
+              "manifest_id": {
+                "type": "string",
+                "minLength": 1
+              },
+              "manifest_digest": {
+                "type": "string",
+                "pattern": "^sha256:[0-9a-f]{64}$"
+              },
+              "host": {
+                "type": "string",
+                "minLength": 1
+              },
+              "surface": {
+                "type": "string",
+                "minLength": 1
+              },
+              "host_version": {
+                "type": "string",
+                "minLength": 1
+              },
+              "adapter_version": {
+                "type": "string",
+                "minLength": 1
+              },
+              "environment": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "kind",
+                  "id",
+                  "digest"
+                ],
+                "properties": {
+                  "kind": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "id": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "digest": {
+                    "type": "string",
+                    "pattern": "^sha256:[0-9a-f]{64}$"
+                  }
+                }
+              },
+              "permissions": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "network",
+                  "filesystem"
+                ],
+                "properties": {
+                  "network": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "filesystem": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "environment": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "secrets": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                }
+              },
+              "availability": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "status"
+                ],
+                "properties": {
+                  "status": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "reason": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                }
+              },
+              "probe_result": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "probe_execution_id",
+                  "outcome",
+                  "observed_at",
+                  "checks"
+                ],
+                "properties": {
+                  "probe_execution_id": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "outcome": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "observed_at": {
+                    "type": "string",
+                    "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z$"
+                  },
+                  "checks": {
+                    "type": "array",
+                    "minItems": 1,
+                    "items": {
+                      "type": "object",
+                      "additionalProperties": false,
+                      "required": [
+                        "name",
+                        "outcome"
+                      ],
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "outcome": {
+                          "type": "string",
+                          "minLength": 1
+                        },
+                        "detail": {
+                          "type": "string",
+                          "minLength": 1
+                        }
+                      }
+                    }
+                  }
+                }
+              },
+              "observed_payload_contract": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "schema_ref",
+                  "observation_types"
+                ],
+                "properties": {
+                  "schema_ref": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "observation_types": {
+                    "type": "array",
+                    "items": {
+                      "type": "string",
+                      "minLength": 1
+                    }
+                  }
+                }
+              },
+              "limitations": {
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "minLength": 1
+                }
+              },
+              "captured_at": {
+                "type": "string",
+                "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z$"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

scripts/host-capab...ost-capability-observed-raw.schema.json

+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "planr.host_capability_observed_raw.schema.v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "payload_version",
+    "experiment_id",
+    "host_identity",
+    "surface",
+    "tool_name",
+    "event_source",
+    "started_at",
+    "ended_at",
+    "input",
+    "events",
+    "result",
+    "provenance_ref"
+  ],
+  "properties": {
+    "schema_version": {
+      "const": "planr.host_capability_observed_raw.v1"
+    },
+    "payload_version": {
+      "type": "string",
+      "minLength": 1
+    },
+    "experiment_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "host_identity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "host",
+        "surface",
+        "version",
+        "adapter_version"
+      ],
+      "properties": {
+        "host": {
+          "type": "string",
+          "minLength": 1
+        },
+        "surface": {
+          "type": "string",
+          "minLength": 1
+        },
+        "version": {
+          "type": "string",
+          "minLength": 1
+        },
+        "adapter_version": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "surface": {
+      "type": "string",
+      "minLength": 1
+    },
+    "tool_name": {
+      "type": "string",
+      "minLength": 1
+    },
+    "event_source": {
+      "type": "string",
+      "minLength": 1
+    },
+    "started_at": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z$"
+    },
+    "ended_at": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z$"
+    },
+    "input": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "input_kind"
+      ],
+      "properties": {
+        "input_kind": {
+          "type": "string",
+          "minLength": 1
+        },
+        "command": {
+          "oneOf": [
+            {
+              "type": "string",
+              "minLength": 1
+            },
+            {
+              "type": "array"
+            }
+          ]
+        },
+        "cwd": {
+          "type": "string",
+          "minLength": 1
+        },
+        "javascript": {
+          "type": "string",
+          "minLength": 1
+        },
+        "probe": {
+          "type": "string",
+          "minLength": 1
+        },
+        "replay_mode": {
+          "type": "string",
+          "minLength": 1
+        },
+        "attempts": {
+          "type": "integer"
+        },
+        "reset_between_attempts": {
+          "type": "boolean"
+        },
+        "tool": {
+          "type": "string",
+          "minLength": 1
+        },
+        "arguments": {
+          "type": "object"
+        },
+        "navigation": {
+          "oneOf": [
+            {
+              "type": "string",
+              "minLength": 1
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "url": {
+                  "type": "string",
+                  "minLength": 1
+                }
+              }
+            }
+          ]
+        },
+        "setup": {
+          "oneOf": [
+            {
+              "type": "string",
+              "minLength": 1
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {}
+            }
+          ]
+        },
+        "operations": {
+          "type": "array"
+        },
+        "ui_write_actions": {
+          "oneOf": [
+            {
+              "type": "boolean"
+            },
+            {
+              "type": "array"
+            }
+          ]
+        },
+        "function": {
+          "type": "string",
+          "minLength": 1
+        },
+        "args": {
+          "type": "array"
+        }
+      }
+    },
+    "events": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "sequence",
+          "event_name",
+          "payload_version",
+          "tool_name",
+          "event_source",
+          "payload"
+        ],
+        "properties": {
+          "sequence": {
+            "type": "integer"
+          },
+          "event_name": {
+            "type": "string",
+            "minLength": 1
+          },
+          "final": {
+            "type": "boolean"
+          },
+          "payload_version": {
+            "type": "string",
+            "minLength": 1
+          },
+          "tool_name": {
+            "type": "string",
+            "minLength": 1
+          },
+          "event_source": {
+            "type": "string",
+            "minLength": 1
+          },
+          "payload": {
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "input_kind": {
+                "type": "string",
+                "minLength": 1
+              },
+              "final_status": {
+                "type": "string",
+                "minLength": 1
+              },
+              "status": {
+                "type": "string",
+                "minLength": 1
+              },
+              "isError": {
+                "type": "boolean"
+              },
+              "error": {
+                "type": "string",
+                "minLength": 1
+              },
+              "redacted_message": {
+                "type": "string",
+                "minLength": 1
+              },
+              "exit_code": {
+                "type": "integer"
+              },
+              "call_tool_keys": {
+                "type": "array",
+                "items": {
+                  "type": "string",
+                  "minLength": 1
+                }
+              },
+              "title": {
+                "type": "string",
+                "minLength": 1
+              },
+              "url": {
+                "type": "string",
+                "minLength": 1
+              },
+              "heading_count": {
+                "type": "integer"
+              },
+              "bodyVisible": {
+                "type": "boolean"
+              }
+            }
+          }
+        }
+      }
+    },
+    "result": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "final_status",
+        "availability_reason",
+        "permissions",
+        "sandbox",
+        "missing_fields",
+        "blind_spots",
+        "artifact_refs",
+        "artifact_digests"
+      ],
+      "properties": {
+        "final_status": {
+          "type": "string",
+          "minLength": 1
+        },
+        "availability_reason": {
+          "type": "string",
+          "minLength": 1
+        },
+        "permissions": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "network",
+            "filesystem"
+          ],
+          "properties": {
+            "network": {
+              "type": "string",
+              "minLength": 1
+            },
+            "filesystem": {
+              "type": "string",
+              "minLength": 1
+            },
+            "environment": {
+              "type": "string",
+              "minLength": 1
+            },
+            "secrets": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        },
+        "sandbox": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "mode",
+            "writable_roots"
+          ],
+          "properties": {
+            "mode": {
+              "type": "string",
+              "minLength": 1
+            },
+            "writable_roots": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          }
+        },
+        "missing_fields": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "blind_spots": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "artifact_refs": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "id",
+              "kind",
+              "root_kind",
+              "path",
+              "digest"
+            ],
+            "properties": {
+              "id": {
+                "type": "string",
+                "minLength": 1
+              },
+              "kind": {
+                "type": "string",
+                "minLength": 1
+              },
+              "root_kind": {
+                "type": "string",
+                "minLength": 1
+              },
+              "path": {
+                "type": "string",
+                "minLength": 1
+              },
+              "digest": {
+                "type": "string",
+                "pattern": "^sha256:[0-9a-f]{64}$"
+              }
+            }
+          }
+        },
+        "artifact_digests": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "string",
+            "pattern": "^sha256:[0-9a-f]{64}$"
+          }
+        },
+        "experiment_plan": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "notes": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    },
+    "provenance_ref": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "digest"
+      ],
+      "properties": {
+        "path": {
+          "type": "string",
+          "minLength": 1
+        },
+        "digest": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$"
+        }
+      }
+    }
+  }
+}

scripts/host-capab.../host-capability-provenance.schema.json

+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "planr.host_capability_provenance.schema.v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "schema_ref",
+    "schema_digest",
+    "suite_id",
+    "captures"
+  ],
+  "properties": {
+    "schema_version": {
+      "const": "planr.host_capability_provenance.v1"
+    },
+    "schema_ref": {
+      "type": "string",
+      "minLength": 1
+    },
+    "schema_digest": {
+      "type": "string",
+      "pattern": "^sha256:[0-9a-f]{64}$"
+    },
+    "suite_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "captures": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "experiment_id",
+          "source_kind",
+          "host",
+          "surface",
+          "input_kind",
+          "observation_mode",
+          "tool_name",
+          "event_source",
+          "host_version",
+          "adapter_version",
+          "claim_source",
+          "availability_reason",
+          "probe_checks",
+          "missing_fields",
+          "artifact_ids",
+          "captured_at"
+        ],
+        "properties": {
+          "experiment_id": {
+            "type": "string",
+            "minLength": 1
+          },
+          "source_kind": {
+            "type": "string",
+            "minLength": 1
+          },
+          "host": {
+            "type": "string",
+            "minLength": 1
+          },
+          "surface": {
+            "type": "string",
+            "minLength": 1
+          },
+          "input_kind": {
+            "type": "string",
+            "minLength": 1
+          },
+          "observation_mode": {
+            "type": "string",
+            "minLength": 1
+          },
+          "tool_name": {
+            "type": "string",
+            "minLength": 1
+          },
+          "event_source": {
+            "type": "string",
+            "minLength": 1
+          },
+          "host_version": {
+            "type": "string",
+            "minLength": 1
+          },
+          "adapter_version": {
+            "type": "string",
+            "minLength": 1
+          },
+          "claim_source": {
+            "type": "string",
+            "minLength": 1
+          },
+          "availability_reason": {
+            "type": "string",
+            "minLength": 1
+          },
+          "probe_checks": {
+            "type": "array",
+            "minItems": 1,
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "name",
+                "outcome"
+              ],
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "outcome": {
+                  "type": "string",
+                  "minLength": 1
+                },
+                "detail": {
+                  "type": "string",
+                  "minLength": 1
+                }
+              }
+            }
+          },
+          "missing_fields": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "artifact_ids": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "minLength": 1
+            }
+          },
+          "captured_at": {
+            "type": "string",
+            "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z$"
+          },
+          "external_producer": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "name",
+              "version",
+              "captured_at",
+              "envelope_digest"
+            ],
+            "properties": {
+              "name": {
+                "type": "string",
+                "minLength": 1
+              },
+              "version": {
+                "type": "string",
+                "minLength": 1
+              },
+              "captured_at": {
+                "type": "string",
+                "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z$"
+              },
+              "envelope_digest": {
+                "type": "string",
+                "pattern": "^sha256:[0-9a-f]{64}$"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}

docs/documentation/COVERAGE.md

@@ -7,3 +7,3 @@ # Documentation Coverage Matrix
 
-The site currently owns 63 MDX routes. Next.js also emits the landing page and framework support routes during the production build.
+The site currently owns 66 MDX routes. Next.js also emits the landing page and framework support routes during the production build.
 
@@ -17,5 +17,5 @@ | Section | Published routes |
 | Plugins | `/docs/plugins`, `/docs/plugins/switchloom` |
-| Concepts | `/docs/concepts`, `/docs/concepts/local-first-model`, `/docs/concepts/plans-and-map`, `/docs/concepts/graph-and-readiness`, `/docs/concepts/picks-and-leases`, `/docs/concepts/evidence-and-context`, `/docs/concepts/reviews-and-approvals`, `/docs/concepts/recovery-packages-and-closure` |
-| Guides | `/docs/guides`, `/docs/guides/daily-worker-loop`, `/docs/guides/parallel-coordination`, `/docs/guides/handoff-and-resume`, `/docs/guides/review-and-fix-loops`, `/docs/guides/recover-interrupted-work`, `/docs/guides/packages-and-reuse`, `/docs/guides/recipes` |
-| Reference | `/docs/reference`, `/docs/reference/cli`, `/docs/reference/cli-generated`, `/docs/reference/mcp`, `/docs/reference/mcp-schemas-generated`, `/docs/reference/http-api`, `/docs/reference/configuration-and-storage`, `/docs/reference/data-and-status`, `/docs/reference/outputs-and-errors`, `/docs/reference/support-matrix`, `/docs/reference/maintenance` |
+| Concepts | `/docs/concepts`, `/docs/concepts/local-first-model`, `/docs/concepts/plans-and-map`, `/docs/concepts/graph-and-readiness`, `/docs/concepts/picks-and-leases`, `/docs/concepts/evidence-and-context`, `/docs/concepts/evidence-trust-model`, `/docs/concepts/reviews-and-approvals`, `/docs/concepts/recovery-packages-and-closure` |
+| Guides | `/docs/guides`, `/docs/guides/daily-worker-loop`, `/docs/guides/parallel-coordination`, `/docs/guides/handoff-and-resume`, `/docs/guides/review-and-fix-loops`, `/docs/guides/recover-interrupted-work`, `/docs/guides/packages-and-reuse`, `/docs/guides/evidence-scenarios`, `/docs/guides/recipes` |
+| Reference | `/docs/reference`, `/docs/reference/cli`, `/docs/reference/cli-generated`, `/docs/reference/mcp`, `/docs/reference/mcp-schemas-generated`, `/docs/reference/http-api`, `/docs/reference/evidence`, `/docs/reference/configuration-and-storage`, `/docs/reference/data-and-status`, `/docs/reference/outputs-and-errors`, `/docs/reference/support-matrix`, `/docs/reference/maintenance` |
 | Contributing | `/docs/contributing`, `/docs/contributing/repository-setup`, `/docs/contributing/architecture`, `/docs/contributing/docs-authoring`, `/docs/contributing/testing`, `/docs/contributing/security-and-privacy` |
@@ -37,5 +37,7 @@ | Operations | `/docs/operations`, `/docs/operations/release`, `/docs/operations/versioning-and-migrations`, `/docs/operations/docs-deployment`, `/docs/operations/health-and-diagnostics`, `/docs/operations/rollback`, `/docs/operations/documentation-governance` |
 | Logs, contexts, artifacts, live evidence | `src/app/application.rs`, `src/app/inspection.rs` | `/docs/concepts/evidence-and-context` |
+| Binding Evidence trust model | `src/evidence/`, `src/app/evidence.rs`, `docs/contracts/EVIDENCE_CONTRACT_V1.md` | `/docs/concepts/evidence-trust-model`, `/docs/reference/evidence`, `/docs/guides/evidence-scenarios` |
 | Reviews, approvals, fix chains | `src/app/review.rs`, `src/app/flow.rs`, `src/app/application.rs` | `/docs/concepts/reviews-and-approvals`, `/docs/guides/review-and-fix-loops` |
 | Recovery, conditions, packages, closure | `src/app/recovery.rs`, `src/app/packages.rs`, `src/app/flow.rs` | `/docs/concepts/recovery-packages-and-closure`, `/docs/guides/recover-interrupted-work`, `/docs/guides/packages-and-reuse` |
 | Worker loop, handoff, recipes | application flow and lease owners | `/docs/guides/daily-worker-loop`, `/docs/guides/handoff-and-resume`, `/docs/guides/recipes` |
+| Copy-paste Evidence scenarios | `apps/docs/scripts/generate-evidence-examples.mjs`, `tests/fixtures/evidence/docs/` | `/docs/guides/evidence-scenarios` |
 
@@ -53,2 +55,3 @@ ## CLI, MCP, HTTP, and data contracts
 | Local HTTP/SSE and review routes | `src/app/http.rs` | `/docs/reference/http-api` |
+| Evidence CLI/MCP/HTTP contracts and classifications | `src/evidence/`, `src/cli/evidence.rs`, `src/app/evidence.rs` | `/docs/reference/evidence` |
 | Environment, installers, storage, repository files | CLI/install/storage owners | `/docs/reference/configuration-and-storage` |
@@ -95,3 +98,3 @@ | DTOs, IDs, statuses, links, SQLite tables, packages | `src/model.rs`, `src/storage/schema.rs` | `/docs/reference/data-and-status` |
 
-- [x] All 63 current MDX routes are explicitly inventoried.
+- [x] All 66 current MDX routes are explicitly inventoried.
 - [x] Every public product, CLI, MCP, HTTP, data, client, contributor, and operations surface has a current target and canonical source owner.
@@ -98,0 +101,0 @@ - [x] Generated CLI and MCP inventories are separated from editorial guidance and mechanically checked.

docs/documentation/INFORMATION_ARCHITECTURE.md

@@ -23,3 +23,3 @@ # Documentation Information Architecture
 
-The 62 MDX files below are the current page tree and must agree with every `meta.json` file and `COVERAGE.md`.
+The 66 MDX files below are the current page tree and must agree with every `meta.json` file and `COVERAGE.md`.
 
@@ -26,0 +26,0 @@ ```text

docs/fixtures/mcp-contract.json

@@ -45,2 +45,18 @@ {
     "planr_debug_bundle",
+    "planr_evidence_policy",
+    "planr_evidence_obligation_add",
+    "planr_evidence_obligation_list",
+    "planr_evidence_obligation_show",
+    "planr_evidence_migrate",
+    "planr_evidence_classifications",
+    "planr_evidence_capability_list",
+    "planr_evidence_capability_show",
+    "planr_evidence_run",
+    "planr_evidence_import",
+    "planr_evidence_host_capture_import",
+    "planr_evidence_host_capture_run",
+    "planr_evidence_attempts",
+    "planr_evidence_receipts",
+    "planr_evidence_coverage",
+    "planr_evidence_explain",
     "planr_eval_suite_check",
@@ -47,0 +63,0 @@ "planr_eval_run",

docs/RELEASE.md

@@ -27,6 +27,9 @@ # Release
 `main`, requires every version and generated reference to already match the
-requested version, reruns the local eval and deterministic gates, and rejects
-any command that changes the reviewed source. Only then does it create and push
-the annotated tag. Editing manifests by hand or publishing an unprepared commit
-skips this ownership boundary.
+requested version, verifies an independently green CI run and human approval
+for the exact `HEAD` SHA, and only then creates and pushes the annotated tag.
+It does not replay the Rust, docs, or packaging suites already proven by that
+CI run. Security, secret, dependency, and workflow scanners are deliberate
+local maintainer preflight commands rather than automatic pull-request or push
+CI evidence. Editing manifests by hand or publishing an unprepared commit skips
+this ownership boundary.
 
@@ -38,6 +41,22 @@ ```bash
 ```bash
+export PLANR_RELEASE_CI_RECEIPT=/path/to/downloaded/promotion-receipt.json
+export PLANR_RELEASE_APPROVAL=/path/to/exact-sha-release-approval.json
+scripts/release.sh 1.2.0 "one-line release summary"
+```
+
+Download `release-promotion-<sha>` from the successful `CI` run for the exact
+main commit. The approval file uses schema `planr.release-approval.v1` and
+contains only `approval_id`, `source_sha`, `version`, `decision: "approved"`,
+`approved_by`, and `approved_at` in addition to `schema_version`. Publication
+queries the recorded GitHub Actions run and rejects a stale SHA, non-main or
+non-push run, failed conclusion, repository mismatch, or non-approved decision.
+
+External evaluation is conditional. When the evaluated workflow subject or its
+explicit evaluation policy changed since the previous release tag, also set:
+
+```bash
 export PLANR_RELEASE_EVAL_SUITE="$HOME/projects/planr-evals/suites/planr-lean-skills-dogfood.suite.json"
 export PLANR_RELEASE_EVAL_RECEIPT=/path/to/sanitized-release-eval-receipt.json
 export PLANR_RELEASE_EVAL_DB=/path/to/planr-evals/results/eval.sqlite
-scripts/release.sh 1.2.0 "one-line release summary"
+export PLANR_RELEASE_PLANR_BIN=/path/to/reviewed/candidate/planr
 ```
@@ -47,3 +66,3 @@
 the public repository in `~/projects/planr-evals`; that workspace and its exact
-layout are not a Planr runtime contract. All three paths above are explicit so a
+layout are not a Planr runtime contract. All external evaluation paths above are explicit so a
 release cannot silently use the product repository's ordinary `.planr` database
@@ -82,3 +101,3 @@ or a stale bundled suite. The receipt is a short-lived local pointer containing
 6. publication requires clean `main`, the exact prepared versions/references, a committed changelog section, and no existing tag;
-7. the candidate binary validates the sanitized receipt and recomputed comparison, then deterministic tests, package, and security gates run without changing source;
+7. publication validates the exact-SHA CI and approval receipts; when the evaluated subject or policy changed, the reviewed candidate binary also validates the sanitized eval receipt and recomputed comparison;
 8. publication creates and pushes only the annotated `vx.y.z` tag for that reviewed commit.
@@ -152,2 +171,7 @@
 
+`scripts/security-local.sh`, `cargo audit --deny warnings`, and local
+`zizmor .` are on-demand maintainer checks. Pull-request and push workflows do
+not install or execute BetterLeaks, Trivy, TruffleHog, cargo-audit, zizmor, or
+equivalent dependency/security scanners.
+
 The external consumer E2E suite must pass when available on the release machine.
@@ -172,2 +196,5 @@ Pull-request CI separately builds both Linux architectures through the canonical
 - `planr`
+- `scripts/host-capability-experiment.mjs`
+- `scripts/host-capability-runtime/v1/schemas/*.schema.json`
+- `scripts/planr-host-capability-validator`
 - `README.md`
@@ -196,2 +223,5 @@ - `LICENSE.md`
 - `npm/bin/planr.js`
+- `scripts/host-capability-experiment.mjs`
+- `scripts/host-capability-runtime/v1/schemas/*.schema.json`
+- `scripts/planr-host-capability-validator`
 - `docs/`
@@ -198,0 +228,0 @@ - `docs/fixtures/mcp-contract.json`

package.json

 {
   "name": "planr",
-  "version": "1.9.0",
+  "version": "1.10.0-alpha.1",
   "description": "Local-first planning and execution coordination for coding agents.",
@@ -17,2 +17,5 @@ "license": "MIT",
     "npm/native",
+    "scripts/host-capability-experiment.mjs",
+    "scripts/host-capability-runtime",
+    "scripts/planr-host-capability-validator",
     "plugins",
@@ -33,2 +36,9 @@ "README.md",
     "verify:release-script": "node scripts/test-release-script.mjs",
+    "verify:change-classifier": "node scripts/test-verification-policy.mjs",
+    "verify:runner": "node scripts/test-verification-runner.mjs",
+    "verify:ci-router": "node scripts/test-ci-router.mjs",
+    "verify:docs-deployment": "node scripts/test-docs-deployment.mjs",
+    "classify:changes": "node scripts/classify-changes.mjs",
+    "verification:run": "node scripts/verification-runner.mjs run",
+    "verification:verify": "node scripts/verification-runner.mjs verify",
     "pack:check": "npm pack --dry-run",
@@ -39,3 +49,3 @@ "docs:dev": "pnpm --filter @planr/docs dev",
     "docs:start": "pnpm --filter @planr/docs start",
-    "docs:deploy": "pnpm --filter @planr/docs run deploy",
+    "docs:deploy": "node scripts/deploy-docs.mjs",
     "docs:destroy": "pnpm --filter @planr/docs run destroy",
@@ -51,2 +61,3 @@ "docs:content": "pnpm --filter @planr/docs content",
     "docs:verify-concepts": "cargo build --bin planr && pnpm --filter @planr/docs verify:concepts",
+    "docs:verify-evidence-docs": "pnpm --filter @planr/docs verify:evidence-docs",
     "docs:verify-maintenance": "pnpm --filter @planr/docs verify:maintenance",
@@ -58,2 +69,4 @@ "docs:sync-linux-portability": "pnpm --filter @planr/docs sync:linux-portability",
     "docs:verify-clean-install": "pnpm --filter @planr/docs verify:clean-install",
+    "docs:evidence-examples:generate": "cargo build --bin planr && pnpm --filter @planr/docs evidence-examples:generate",
+    "docs:evidence-examples:check": "cargo build --bin planr && pnpm --filter @planr/docs evidence-examples:check",
     "verify:switchloom-cross-product": "node scripts/verify-switchloom-cross-product.mjs",
@@ -60,0 +73,0 @@ "docs:reference:generate": "cargo build --bin planr && pnpm --filter @planr/docs reference:generate",

plugins/planr/.claude-plugin/plugin.json

 {
   "name": "planr",
   "description": "Skill-driven planning and execution loop for coding agents: one planr entry point, an autonomous planr-loop, and evidence-backed task graph skills powered by the planr CLI.",
-  "version": "1.9.0",
+  "version": "1.10.0-alpha.1",
   "author": {
@@ -6,0 +6,0 @@ "name": "instructa"

plugins/planr/.codex-plugin/plugin.json

 {
   "name": "planr",
-  "version": "1.9.0",
+  "version": "1.10.0-alpha.1",
   "description": "Skill-driven planning and execution loop for coding agents: one $planr entry point, an autonomous $planr-loop, and evidence-backed task graph skills powered by the planr CLI.",
@@ -5,0 +5,0 @@ "author": {

plugins/planr/skills/planr-goal/SKILL.md

@@ -33,4 +33,6 @@ ---
 
-Fill required plan sections directly. Replace the placeholder task with typically 4-8 independently verifiable `TASK-00n` slices before `planr map build`. Preserve real execution order with `blocks` links. When registry routes use `work_type`, annotate tasks before mapping or retag them afterward; this is prep work, not a user question.
+Fill required plan sections directly. Replace the placeholder task with independently verifiable `TASK-00n` slices before `planr map build`. A small coherent change is one implementation item plus one signal-bearing independent review; do not split mechanical stages into separate implementation/review pairs. Larger scopes still use multiple slices where ownership, dependencies, or independently observable outcomes genuinely differ. Preserve real execution order with `blocks` links. When registry routes use `work_type`, annotate tasks before mapping or retag them afterward; this is prep work, not a user question.
 
+When the repository provides a versioned verification policy and source-bound receipt runner, make that policy the verification owner in the plan. Record the selected profile, exact receipt path/digest, source revision, and the command that validates the receipt. Do not enumerate broad suites independently in every task when the policy already selects them.
+
 ## Durable Contract
@@ -44,3 +46,3 @@
 
-Never weaken it mid-run. Workers use `planr pick --plan <plan-id>`; termination uses `planr plan audit <plan-id> --json`. Reviews are required only where they add signal; evidence-backed setup work may close directly.
+Never weaken it mid-run. Workers use `planr pick --plan <plan-id>`; termination uses `planr plan audit <plan-id> --json`. Reviews are required only where they add signal; evidence-backed setup work may close directly. Where deployment is in scope, the contract must retain human deployment approval and a bounded live oracle against the deployed result.
 
@@ -47,0 +49,0 @@ ## Hand Off

plugins/planr/skills/planr-loop/SKILL.md

@@ -16,2 +16,4 @@ ---
 
+At the start of the host thread that drives an active goal, run `planr stop activate --plan <plan-id>` once. Codex hosts should let Planr use `CODEX_THREAD_ID`; otherwise provide a stable explicit session with `--session <id>`. Leave the binding active until `planr plan audit <plan-id> --json` returns `holds: true`. Run `planr stop deactivate --plan <plan-id>` only for explicit user cancellation or after a durable ownership transfer has activated the same plan in the successor session; a budgeted handoff alone must not deactivate an unfinished goal.
+
 Each iteration follows the Planr stage protocols:
@@ -21,8 +23,8 @@
 2. Use `$planr-plan` or `$planr-task-graph` only when scope or graph structure is missing.
-3. Dispatch `$planr-work` for exactly one ready item scoped to `<plan-id>`; makers must use `planr pick --work-type code --plan <plan-id>`, never an unscoped pick, and finish implementation with `planr done <item-id> ... --review`.
-4. Run the target-platform oracle and record `planr log add --item <id> --kind verification --summary ... --cmd ...`.
-5. Dispatch `$planr-review`; findings create fix work, while `complete --close-target` settles the target.
+3. Dispatch `$planr-work` for exactly one ready item scoped to `<plan-id>`; makers must use `planr pick --work-type code --plan <plan-id>`, never an unscoped pick, select the repository verification policy, and finish implementation with `planr done <item-id> ... --review`.
+4. Run the target-platform oracle when the goal requires one and record `planr log add --item <id> --kind verification --summary ... --cmd ...`. Deployment still requires prior human approval and a bounded live oracle.
+5. Dispatch `$planr-review`; the checker independently inspects the diff and validates the exact-source receipt, replaying only cheap, missing, failing, or explicitly high-risk evidence. Findings create fix work, while `complete --close-target` settles the target.
 6. Repeat from audit.
 
-One picked item per iteration. Use plain `done` only for low-signal setup/inspection work. Maker and checker stay separate when the host supports another agent; a maker never self-reviews when an independent checker is available, and never manufactures independence by changing worker identity. A worker may use `done --next`, which never returns its own review.
+One picked item per iteration. A small coherent change stays one implementation item with one signal-bearing review; do not create a new review boundary for every mechanical stage or for an already-reviewed successful live smoke. Use plain `done` only for low-signal setup/inspection work. Maker and checker stay separate when the host supports another agent; a maker never self-reviews when an independent checker is available, and never manufactures independence by changing worker identity. The reviewer must exercise independent judgment even when it relies on a green receipt rather than replaying an expensive gate. A worker may use `done --next`, which never returns its own review.
 
@@ -46,3 +48,3 @@ Pick packets explain null results and include `remaining`; follow their repair command. Destructive or out-of-repository effects require `planr approval request`. Two iterations without map movement must stop. On success or budget exhausted, finish with `$planr-summary`.
 
-“Done” means the feature ran. For web dispatch `$planr-verify-web`; for CLI execute the built binary; for API use real requests; for iOS launch the simulator. Log the replayable command. If the capability is missing, record a blocker context, request approval, and pause—never fake proof.
+“Done” means the feature ran. For web dispatch `$planr-verify-web`; for CLI execute the built binary; for API use real requests; for iOS launch the simulator. Log the replayable command. A passing bounded live oracle is evidence for the existing review boundary, not a reason to start another full reviewer replay. If the capability is missing, record a blocker context, request approval, and pause—never fake proof.
 
@@ -49,0 +51,0 @@ Recovery starts in a fresh session with audit, map state, the stored contract, and the next scoped pick. Read [recovery and platform details](references/recovery-and-verification.md) only when that branch is active.

plugins/planr/skills/planr-review/SKILL.md

@@ -21,4 +21,6 @@ ---
 
-Inspect the actual changed files and re-run the logged verification evidence. Then close the review exactly once:
+Inspect the actual changed files and acceptance criteria, then independently judge whether the evidence proves them. When the repository owns a versioned verification policy, verify the logged receipt against its exact source revision, policy digest, changed-file digest, selected gates, command results, and artifact digests. Use the repository's receipt validator (for this repository, `npm run verification:verify -- --receipt <path> --base <base-revision> --head <source-revision>`), not a visual read of JSON.
 
+Replay only evidence that is cheap, missing, failing, or explicitly high-risk. An already-green expensive gate bound to the reviewed source is normally validated from its receipt rather than rerun. Receipt validation does not replace judgment: inspect the diff for security, correctness, scope, and acceptance-criteria gaps, and record a finding when the policy selection or receipt is inadequate. Then close the review exactly once:
+
 ```bash
@@ -40,4 +42,6 @@ planr review close <review-id> --verdict complete --reviewer <your-id> --close-target
 - Missing tests are findings when acceptance criteria need proof.
+- A stale, mismatched, unvalidated, or insufficiently scoped receipt is a finding.
 - Architecture or ownership drift is a finding when it creates duplicate policy or state owners.
 - If evidence is insufficient, use `--verdict unclear` rather than complete.
+- Deployment remains gated by explicit approval and a bounded live oracle where applicable. A successful live smoke does not by itself require another broad build or a second full review; replay it only under the same cheap/missing/failing/explicitly-high-risk rule.
 
@@ -44,0 +48,0 @@ ## Single-Agent Mode

plugins/planr/skills/planr-verify-web/SKILL.md

@@ -61,4 +61,6 @@ ---
 
-The replay command is mandatory. The reviewer reruns it instead of trusting this run; a verification that cannot be replayed is not evidence.
+The replay command is mandatory. The reviewer validates the evidence and reruns it only when it is cheap, missing, failing, or explicitly high-risk; a verification that cannot be replayed when needed is not evidence. A successful bounded live smoke joins the existing coherent review boundary and does not automatically trigger another full build or reviewer replay.
 
+For a deployment oracle, require an approved deployment decision before the deploy begins. After deployment, keep the live check bounded to the changed routes, content, or interaction and record the deployed source/receipt identity in the summary.
+
 ## When Verification Is Impossible
@@ -65,0 +67,0 @@

plugins/planr/skills/planr-work/SKILL.md

@@ -25,2 +25,11 @@ ---
 
+Before choosing ad hoc checks, inspect the repository's versioned verification policy. When it supplies a runner, use that runner once for the changed-file set and preserve its exact-source receipt. For this repository the canonical flow is:
+
+```bash
+npm run verification:run -- --receipt .planr/receipts/<name>.json --base <base-revision> --head <source-revision>
+npm run verification:verify -- --receipt .planr/receipts/<name>.json --base <base-revision> --head <source-revision>
+```
+
+Record the receipt path, digest, source revision, selected profile/gates, and copy-paste replayable validation command in the completion evidence. Do not manually add broader suites that the selected policy does not require, and do not rerun an expensive green gate merely to hand work to the reviewer.
+
 Put build/serve commands in `--cmd` and test runs in `--tests` — both are recorded as evidence. When the pick packet carries a `routing` block, also report the registry profile you actually ran on: add `--profile <profile-id>` to `done`/`log add`, or export `PLANR_PROFILE` once per session. It is part of the evidence — a mismatch with the declared route is advisory (never blocks the close) and surfaces in `planr trace item` so silent host overrides get caught. Include the decisive output line in `--summary` (e.g. "12 tests passed", "GET /videos returned 3 entries"): reviewers see your recorded command strings, not your terminal, so the summary must carry what you observed, not just what you ran. Single-quote `--files` values that contain `$` (route files like `watch.$videoId.tsx`), or the shell expands them before planr sees them. `done --review` writes the completion log, requests the review, and moves the item to `in_review` (you keep ownership; it is waiting on the gate, not abandoned) — the response names the target's new status and the plan-scoped reviewer pick command; add `--next` to pick the following item in the same call. Without `--review` it closes the item directly (only for items that need no review gate). Running `done` on a ready item you never picked adopts it: the lease is written retroactively under your worker id so the review always has a maker. The response reports what your settlement `unlocked`, echoes the item's post condition, and hints when downstream work depends on an item closed without command/test evidence.
@@ -34,3 +43,3 @@
 
-The `--cmd` value must be copy-paste replayable: a real shell command (or a small script you committed), never a prose transcript like "start server; curl /; check stats". A reviewer replays your command verbatim — if it cannot run, the verification cannot be independently confirmed.
+The `--cmd` value must be copy-paste replayable: a real shell command (or a small script you committed), never a prose transcript like "start server; curl /; check stats". Reviewers validate the exact-source receipt and selectively replay cheap, missing, failing, or explicitly high-risk evidence; the command must still be runnable when that risk decision calls for replay.
 
@@ -64,2 +73,4 @@ Log persistent evidence, not transient noise: a failure you immediately fixed belongs in the final log's narrative, not as a standalone failure log. Only record a failure separately when it blocks the item.
 
+Deployment is always such a gate: obtain approval before deployment and record a bounded live oracle afterward. Keep that oracle on the same coherent implementation/review boundary; a successful smoke does not automatically require another full build or review replay.
+
 ## Rules
@@ -66,0 +77,0 @@

README.md

@@ -5,3 +5,3 @@ # Planr
 
-Planr is a local-first planning and execution coordination tool for coding agents. It combines reviewable Markdown plans with a dependency-aware work map so Codex, Claude Code, Cursor, Grok Build, generic MCP clients, and human operators can drive the same work safely — from idea to verified completion.
+Planr is a local-first planning and execution coordination tool for coding agents. It combines reviewable Markdown plans with a dependency-aware work map so Codex, Claude Code, Cursor, Grok Build, Pi, generic MCP clients, and human operators can drive the same work safely — from idea to verified completion.
 
@@ -57,3 +57,3 @@ [**View the Demo →**](https://x.com/kevinkern/status/2066957434564808884?s=20)
 
-Then initialize a project. When selected, Claude Code and Cursor also receive standalone project worker/reviewer roles; Codex workflow skills come from its plugin. Grok Build is a separate explicit opt-in and is not included by `all`:
+Then initialize a project. When selected, Claude Code and Cursor also receive standalone project worker/reviewer roles; Codex workflow skills come from its plugin. Grok Build and Pi are separate explicit opt-ins and are not included by `all`:
 
@@ -66,2 +66,12 @@ ```bash
 
+To add Pi's native Agent Skills and optional pi-subagents roles to a trusted repository, select it explicitly:
+
+```bash
+planr install pi --dry-run
+planr install pi
+planr project init "My Product" --client pi
+```
+
+Planr writes repository-local `.pi/skills/` workflow assets and optional `.pi/agents/` roles only. It does not install Pi, pi-subagents, MCP config, hooks, global settings, provider credentials, or session state. Full setup and trust guidance: [Pi integration](https://planr.so/docs/integrations/pi).
+
 ## Install The Plugin (Skills)
@@ -129,2 +139,18 @@
 
+<a id="install-pi"></a>
+<details>
+<summary><strong>Pi</strong></summary>
+
+Preview or install the repository-local Pi integration:
+
+```bash
+planr install pi --dry-run
+planr install pi
+planr doctor --client pi --json
+```
+
+Planr writes native `.pi/skills/` workflow assets and optional `.pi/agents/` role files for `pi-subagents`. It writes no MCP configuration, hooks, extension package, global Pi settings, provider credentials, model pin, or session reference. Pi is intentionally explicit opt-in and is not part of `--client all`. See the [Pi integration guide](https://planr.so/docs/integrations/pi).
+
+</details>
+
 <a id="install-plugin-opencode"></a>
@@ -207,2 +233,3 @@ <details>
 
+- **1.9.0 — First-class Pi integration:** Added an explicit repository opt-in that installs native Pi Agent Skills plus optional `pi-subagents` worker/reviewer roles without treating Pi as an MCP host. The integration writes no Pi global settings, hooks, provider credentials, model pin, or session reference, and `--client all` remains unchanged for existing Codex, Claude Code, Cursor, and Grok setup. See the [Pi integration guide](https://planr.so/docs/integrations/pi), [Pi contract](docs/contracts/PI_INTEGRATION_V1.md), and [1.9.0 changelog](CHANGELOG.md#190---2026-07-27).
 - **1.8.0 — First-class Grok Build integration:** Added an explicit repository opt-in that installs portable project MCP configuration plus native Grok agents and all ten Planr workflow skills. The integration writes no plugin, hooks, model setting, xAI credentials, or provider runtime dependency; authenticated verification remains maintainer-local and never runs in CI. See the [Grok Build guide](https://planr.so/docs/integrations/grok-build) and [1.8.0 changelog](CHANGELOG.md#180---2026-07-27).
@@ -228,3 +255,3 @@ - **1.7.2 — Reproducible release candidates:** Locked the pnpm workspace inventory, made external eval fixtures self-contained, refreshed reviewed workflow runtimes, and made all four published architectures execute the exact tagged version before upload. Model-backed evaluation remains a local, candidate-bound maintainer gate; this patch makes no unmeasured speed or quality claim. See the [1.7.2 changelog](CHANGELOG.md#172---2026-07-25) and [release guidance](https://planr.so/docs/operations/release).
 - [CLI Reference](https://planr.so/docs/reference/cli) · [MCP Reference](https://planr.so/docs/reference/mcp)
-- [Codex](https://planr.so/docs/integrations/codex) · [Claude Code](https://planr.so/docs/integrations/claude-code) · [Cursor](https://planr.so/docs/integrations/cursor) · [Grok Build](https://planr.so/docs/integrations/grok-build)
+- [Codex](https://planr.so/docs/integrations/codex) · [Claude Code](https://planr.so/docs/integrations/claude-code) · [Cursor](https://planr.so/docs/integrations/cursor) · [Grok Build](https://planr.so/docs/integrations/grok-build) · [Pi](https://planr.so/docs/integrations/pi)
 - [Daily Worker Loop](https://planr.so/docs/guides/daily-worker-loop)
@@ -231,0 +258,0 @@ - [Task Graph Model](https://planr.so/docs/concepts/graph-and-readiness)

New alerts

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

85164225

166.6%

Number of package files

85

112.5%

Lines of code

7891

3470.59%

Number of lines in readme file

262

11.49%

Worsened metrics

Number of low quality alerts

2

100%

Number of low supply chain risk alerts

9

200%

Number of medium supply chain risk alerts

11

120%

No dependency changes