Summary

• add a draft, explicitly unimplemented ProofPatch RFC
• define intent, deterministic digests, invariants, threat model and phased guarantees
• use an in-toto Statement shape with a future DSSE signing path
• add kill criteria instead of claiming compatibility before implementation
• derive generated artifact versions from package.json and cover that behavior with a unit test

Verification

• npm run verify passed in full
• 86 files scanned, 0 findings
• generated reports and machine artifacts are current
• git diff --check