Harden proof and package boundaries

docs/release-process.md

@@ -42,10 +42,11 @@ Go source
   -> GitHub Release assets with checksums and SBOM for provenance lookup
 ```
 
-The committed `release/change-record.v2.json` owns the reviewed, version-bound
-declaration of the public-contract delta, migration decision, platform
-requirements, known limitations, and rollback strategy. It does not infer
-change completeness from the source diff. The repository-owned
+In a source checkout, the committed `release/change-record.v2.json` owns the
+reviewed, version-bound declaration of the public-contract delta, migration
+decision, platform requirements, known limitations, and rollback strategy. It
+is not part of the installed npm or PyPI projection and does not infer change
+completeness from the source diff. The repository-owned
 `release:manifest` tool admits that record and creates `release-manifest.json`,
 `checksums.sha256`, `metadata-checksums.sha256`, `sbom-subjects.sha256`,
 release notes, and deterministic SBOM candidate evidence from explicit package,
@@ -81,10 +82,10 @@ Before publishing a version:
 
 1. The source tree is clean.
 2. `package.json` contains the exact new version.
-3. `release/change-record.v2.json` contains the same version, names the exact
-   previous version and compatible or breaking change class, and explicitly
-   classifies breaking changes, additions, migration, platform requirements,
-   known limitations, and rollback.
+3. In the source checkout, `release/change-record.v2.json` contains the same
+   version, names the exact previous version and compatible or breaking change
+   class, and explicitly classifies breaking changes, additions, migration,
+   platform requirements, known limitations, and rollback.
 4. `package.json` repository, license, bin, exports, files, and publishConfig
    match the intended public package contract.
 5. The npm account has verified email and write-protective 2FA, or the package

internal/app/cli_abi_test.go

@@ -1046,7 +1046,7 @@ func TestRequirementBrowserServerSpecTreeCLIABI(t *testing.T) {
 
 func TestRequirementBrowserOneShotCLIOutputVariants(t *testing.T) {
 	if runtime.GOOS == "windows" {
-		t.Skip("test launcher fixture is POSIX-only")
+		t.Fatal("test launcher fixture is POSIX-only")
 	}
 	fixture, err := browserfixture.Workspace()
 	if err != nil {

internal/app/cli_contract_test.go

@@ -22,7 +22,7 @@ import (
 )
 
 const (
-	cliContractPublicABISHA256               = "1b615f82dd66b83cf3d1a72154d7f4b7d1946eb3a6727cf4d0c54f065462c63f"
+	cliContractPublicABISHA256               = "8c1ed8d811ee9421a773647cc6255dcd233af6d5ab24c2c7d76bca06760da723"
 	maxAggregateFileReadBytesForContractTest = 64 << 20
 	maxPackageManifestBytesForContractTest   = 256 << 10
 	maxSourceFileBytesForContractTest        = 8 << 20
@@ -156,6 +156,61 @@ func TestCLIContractsAreCompleteGeneratedAndWitnessBound(t *testing.T) {
 	}
 }
 
+func TestCLIContractInputRootShapesMatchNativeOwnerVariants(t *testing.T) {
+	contract := readCLIContract(t)
+	definitions := cliContractDefinitionMap(t, contract.ContractDefinitions)
+	tests := []struct {
+		definitionID string
+		allowed      []string
+		required     []string
+	}{
+		{
+			definitionID: "proofkit.external-consumer.input.v1.root-shape",
+			allowed:      []string{"evidence", "input", "schemaVersion"},
+			required:     []string{"evidence", "input", "schemaVersion"},
+		},
+		{
+			definitionID: "proofkit.registry-consumer.input.v1.root-shape",
+			allowed:      []string{"input", "proof", "schemaVersion"},
+			required:     []string{"input", "schemaVersion"},
+		},
+		{
+			definitionID: "proofkit.requirement-proof-source-set.input.v1.root-shape",
+			allowed:      []string{"canonicalEnvelope", "projection", "sourceSet", "sources"},
+			required:     []string{"canonicalEnvelope", "sourceSet", "sources"},
+		},
+		{
+			definitionID: "proofkit.secret-scan.input.v1.root-shape",
+			allowed:      []string{"files", "nonClaims", "reportId", "schemaVersion", "suppressions"},
+			required:     []string{"files", "nonClaims", "reportId", "schemaVersion"},
+		},
+		{
+			definitionID: "proofkit.selective-gate-obligation-decision-input.input.v1.root-shape",
+			allowed:      []string{"commandRoutes", "decisionId", "evidence", "nonClaims", "receiptCurrentnessScopeAdmission", "receiptTrustClassAdmission", "schemaVersion"},
+			required:     []string{"commandRoutes", "decisionId", "evidence", "nonClaims", "schemaVersion"},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.definitionID, func(t *testing.T) {
+			definition := definitions[test.definitionID]
+			if definition == nil {
+				t.Fatalf("missing definition %s", test.definitionID)
+			}
+			variants := definition["fieldTree"].(map[string]any)["variants"].([]any)
+			if len(variants) != 1 {
+				t.Fatalf("variants=%d want 1", len(variants))
+			}
+			variant := variants[0].(map[string]any)
+			if actual := stringsFromAny(variant["allowedFields"].([]any)); !slices.Equal(actual, test.allowed) {
+				t.Fatalf("allowedFields=%v want %v", actual, test.allowed)
+			}
+			if actual := stringsFromAny(variant["requiredFields"].([]any)); !slices.Equal(actual, test.required) {
+				t.Fatalf("requiredFields=%v want %v", actual, test.required)
+			}
+		})
+	}
+}
+
 func TestCLIContractRootShapeVariantInventoryIsClosedAndModeComplete(t *testing.T) {
 	contract := readCLIContract(t)
 	definitions := cliContractDefinitionMap(t, contract.ContractDefinitions)