feat(runtime): govern generated proof artifact lifecycle

[bartytime4life]

Goal

Implement the next dependency-closed gap from New Ideas 4-15-26.pdf and the repository's governed source map: KFM-TRIAD-069 — Generated Runtime-Proof Artifact Lifecycle.

This change defines how generated runtime-test outputs such as actual.response.json move through ephemeral, retained, reviewed, promoted-golden, stale, invalidated, and deleted states without becoming evidence, policy, KFM lifecycle promotion, release, or publication authority.

Status labels

• CONFIRMED: authoring base main@f25175455642c61aea022b09e7ed16e592abaa0b.
• CONFIRMED: exact branch head afe2f8177e2713363712cc2697979e39b31b7d7d; two commits; 25 added paths; 2,489 additions; zero deletions; branch is two ahead and zero behind its authoring base.
• CONFIRMED: the directly affected exact-head workflow, repository-wide schema/contract lanes, validator suite, contract-drift lane, and generated-receipt integrity all passed.
• CONFIRMED: all 38 pull-request workflows reached terminal state: 35 succeeded and 3 failed. The three failures are unrelated repository workflow/readiness debt classified below.
• PROPOSED: the object family, schema, lifecycle grammar, golden-fixture decision, validator, fixtures, and focused workflow remain pending human review.
• NEEDS VERIFICATION: required-check/ruleset coupling and human reviewer disposition.

Evidence and idea lineage

The supplied packet recommends a hybrid runtime-proof artifact policy:

• emit actuals in local and CI review runs;
• do not commit generated actuals as truth by default;
• promote only a small stable subset through explicit review;
• preserve expiry, invalidation, correction, and deletion behavior.

The current repository source map records that generated actuals had no confirmed common lifecycle covering ephemeral output, retained review material, reviewed and promoted goldens, staleness, invalidation, provenance, and deletion. This slice closes that bounded gap using synthetic data only.

Directory Rules basis

Accepted ADR-0029 makes docs/doctrine/directory-rules.md the writable Directory Rules authority. Placement follows responsibility rather than topic:

Path family	Owning root	Purpose
contracts/runtime/generated_runtime_proof_artifact.md	contracts/	Human-readable object meaning
schemas/contracts/v1/runtime/generated_runtime_proof_artifact.schema.json	schemas/	Closed machine shape
fixtures/contracts/v1/runtime/generated_runtime_proof_artifact/**	fixtures/	Reusable synthetic valid/invalid corpus
tools/validators/validate_generated_runtime_proof_artifact.py	tools/	Deterministic validation behavior
tests/validators/test_validate_generated_runtime_proof_artifact.py	tests/	Focused executable proof
.github/workflows/generated-runtime-proof-artifact.yml	.github/	Read-only CI orchestration
data/receipts/generated/genrec-generated-runtime-proof-artifact-20260805.json	data/receipts/generated/	Pending-review AI authoring provenance

No new root, parallel contract/schema/policy/fixture/proof/release authority, lifecycle store, public path, or artifact payload store is introduced.

What changed

Semantic contract and schema

Adds a proposed GeneratedRuntimeProofArtifact profile with:

• digest-bound artifact reference, media type, byte size, case identity, generator identity, run receipt, spec_hash, and input references;
• explicit states: EPHEMERAL, RETAINED, REVIEWED, PROMOTED_GOLDEN, STALE, INVALIDATED, and DELETED;
• a finite allowed-transition graph and prior-record linkage;
• review state and review-record references;
• a separate, digest-bound golden_promotion decision with TEST_FIXTURE_ONLY authority and expiry;
• invalidation, correction, supersession, and deletion-receipt linkage;
• synthetic/public-safe gating for promoted goldens;
• fixed negative governance declarations and null release reference.

Validator

Adds a deterministic no-network validator that:

• rejects symbolic links, missing/non-regular/oversized inputs, duplicate keys, non-finite numbers, malformed JSON, and non-object roots;
• validates the Draft 2020-12 schema with bounded findings;
• rejects zero digest placeholders and artifact-reference digest mismatch;
• requires sorted unique references and reason codes;
• enforces temporal ordering, allowed transitions, predecessor linkage, review support, golden decision/digest/expiry binding, safety restrictions, invalidation/correction support, deletion receipts, and the non-authority boundary;
• emits stable finding codes and fields without echoing untrusted values.

Fixtures and tests

Adds seven valid lifecycle states and ten exact-negative cases covering:

• artifact-reference digest mismatch;
• deleted-without-receipt;
• golden digest mismatch;
• golden without review;
• governance overclaim;
• illegal lifecycle transition;
• invalidation without correction/supersession lineage;
• timing inversion;
• unsafe/internal golden candidate;
• noncanonical references.

Eight focused tests cover schema validity, valid-state acceptance, exact-negative finding sets, CLI fixture replay, duplicate keys, non-finite numbers, missing files, and non-echoing diagnostics.

Shared schema-lane compatibility correction

The first hosted run exposed a real integration issue: repository-wide schema tests require every fixtures/contracts/v1/**/invalid/invalid_*.json file to be JSON-Schema invalid, while the new negative cases were initially schema-valid and rejected only by the dedicated semantic validator.

Commit afe2f8177e2713363712cc2697979e39b31b7d7d applies the smallest correction:

• every semantic-negative fixture now includes an explicit undeclared schema canary;
• the exact finding manifest expects both SCHEMA_INVALID and the case-specific semantic finding;
• repository-wide schema polarity and dedicated lifecycle semantics are both non-vacuous;
• the generated authoring receipt is rebound to the corrected bytes.

This repairs the shared fixture convention rather than weakening the generic schema test or dropping semantic coverage.

CI and provenance

The focused workflow retains read-only contents: read, immutable action pins, GitHub-hosted execution, bounded timeout, no secrets, no OIDC, and no artifact upload, comment mutation, deployment, release, or publication step. It runs focused tests, fixture replay, schema/JSON checks, and generated-receipt integrity.

Local validation

Check	Outcome
Focused unittest suite	PASS — 8 tests
Valid lifecycle corpus	PASS — 7 states
Exact-negative corpus	PASS — 10 cases
Direct fixture CLI	PASS
Draft 2020-12 meta-schema	PASS
Python compilation	PASS
JSON parsing	PASS — schema plus 18 fixture JSON files
Workflow YAML/name/job/permission/action pins	PASS
Generated-receipt path/hash/truth-label closure	PASS — 24 authored artifacts
UTF-8, LF, and trailing-whitespace hygiene	PASS — 25 paths
Remote compare	PASS — two commits, 25 paths, 2,489 additions, zero deletions

Exact-head hosted validation

Directly affected workflow

generated-runtime-proof-artifact run 30970718617 succeeded at exact head afe2f8177e2713363712cc2697979e39b31b7d7d:

• 8/8 focused tests passed;
• 7 valid lifecycle fixtures passed;
• 10 invalid fixtures produced the exact reviewed schema-plus-semantic finding sets;
• Draft 2020-12 schema validation passed;
• the schema and 18 fixture JSON files parsed;
• the generated receipt validated with 24 digest-bound artifacts and pending review.

Integration workflows

The correction restored all directly related repository-wide lanes:

• contracts-validate — success;
• schema-validation — success;
• contract-drift — success;
• validator-suite — success;
• generated-runtime-proof-artifact — success.

Repository-wide snapshot

All 38 pull-request workflows reached terminal state:

• 35 success;
• 3 failure, each unrelated to the paths and behavior in this PR.

domain-roads-rail-trade — unrelated readiness hold

The existing Roads/Rail/Trade lane still reports missing executable validator coverage in untouched scaffold roots. This branch changes no Roads/Rail/Trade path.

rollback-drill — unrelated stale readiness assertion

The workflow still asserts that RollbackCard schemas, fixtures, and validators remain permissive or absent. Current main has since gained a bounded RollbackCard implementation, so the old hold assertion now fails. The workflow explicitly reports that no rollback was simulated. This branch changes no rollback path.

release-dry-run — unrelated dependency-installation gap

The rollback-card-presence job invokes tools/validators/release/validate_rollback_card.py --fixtures without installing repository dependencies. It fails with ModuleNotFoundError: No module named 'jsonschema'. The same workflow's candidate-assembly and promotion-gate jobs succeeded. This branch changes no release-dry-run or RollbackCard path.

These failures do not implicate the generated runtime-proof contract, schema, validator, fixture corpus, test lane, or workflow, but the repository is not fully green and this PR remains draft.

Trust boundary

A green result proves only the proposed schema, local lifecycle consistency, exact synthetic fixture polarity, deterministic no-network validator behavior, and declared authoring-artifact integrity.

It does not:

• store or validate generated payload bytes;
• prove runtime correctness or expected-versus-actual equivalence;
• authenticate reviewer identity or authority;
• create EvidenceRef or EvidenceBundle closure;
• evaluate rights, sensitivity, or policy;
• authorize KFM lifecycle promotion, release, deployment, publication, or public use;
• create a ProofPack, PromotionReceipt, ReleaseManifest, or RollbackCard.

The word proof names the test lane only. PROMOTED_GOLDEN is a reviewed test-fixture state, not KFM PUBLISHED state.

What did not change

• No runtime implementation, governed API route, UI, MapLibre surface, live source, connector, model client, artifact upload, catalog record, policy bundle, release object, deployment, or public path.
• No generated actual.response.json payload is committed by this slice.
• No existing authority document or production behavior is replaced.
• No workflow failure is hidden or reclassified as success.

Rollback

Before merge, close this draft pull request and abandon agent/generated-runtime-proof-artifact-20260805. After an authorized merge, revert commits in reverse order:

1. afe2f8177e2713363712cc2697979e39b31b7d7d;
2. f047efd931add3083c4d282a31e7dea8a4e40210.

No source activation, lifecycle data, schema migration, generated payload, release state, deployment, or public artifact requires restoration.

Reviewer disposition

DRAFT — DIRECT IMPLEMENTATION AND EXACT-HEAD HOSTED VALIDATION PASS; HUMAN REVIEW AND REQUIRED-CHECK COUPLING REMAIN PENDING. The three unrelated repository failures remain visible. Do not mark ready, merge, release, deploy, publish, activate sources, or change repository settings from this pull request.