Define scheme-neutral semantic projections and evidence-bounded coverage reports

[Brad-Edwards]

Problem

External concept bindings answer what an author asserts about a native RAES subject. They do not, by themselves, answer a query such as which concepts have declared, admitted, observed, or verified witnesses in a particular artifact and execution context. A bare coverage count collapses distinct predicates and silently turns an external classification into runtime truth.

Outcome

Define a generic projection and reporting contract over the portable bindings introduced by #986 and governed RAES predicates. The contract must support useful coverage, gap, and traceability views without giving an external scheme authority over RAES execution semantics.

Projection frame

Every projection must declare at least:

• the scheme authority, revision or content digest, and explicit concept inclusion set or denominator;
• the RAES subject kind and digest-stable artifact scope;
• the governed native predicate or profile being queried;
• the asserting or observing perspective;
• configuration and state cut where the predicate depends on them;
• existential, universal, threshold, or other governed quantification;
• the evidence boundary and freshness policy;
• the transformation and binding versions used to derive the view.

The result must distinguish witnesses, gaps, unknowns, ambiguous bindings, and excluded concepts. A concept is never itself executed or realized; those predicates apply to native RAES subjects and may be projected onto concepts only within the declared frame.

Acceptance criteria

• The same projection machinery operates over at least two unrelated schemes.
• Reports identify the exact native predicate being summarized and never emit an unqualified coverage percentage.
• Declared, admitted, observed, and verified views remain independent rather than forming an assumed maturity ladder.
• Every positive result links to digest-stable native witnesses and admissible evidence.
• Ambiguous, approximate, stale, or lossy bindings remain visible in the result.
• Changes in configuration, perspective, quantifier, or evidence boundary can change a projection without changing the underlying transition semantics.
• Participant-visible reports obey the same information-flow controls as their source bindings and evidence.
• Negative fixtures reject unknown predicates, implicit denominators, missing scheme revisions, and evidence-free verification claims.

Non-goals

• Defining a universal quality score.
• Treating concept counts as environment capabilities.
• Replacing native proposition, outcome, trace, evidence, or realization semantics.

[Brad-Edwards]

Milestone 59 ownership audit

Disposition: retain in RAES. The scheme-neutral projection frame, governed predicates, evidence boundary, and portable report contract are RAES semantic authority. Hub #25 may present the resulting views, and env-packs may orchestrate pack-level reports, but neither should redefine projection meaning.

[Brad-Edwards]

🛠️ Picked up by /implement - driver Codex, branch 987-semantic-projection-reports, 2026-08-09T01:49:18.466Z.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #987). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

🛠️ Picked up by /implement - driver Codex, branch 987-gov-918-semantic-projection-reports, 2026-08-09T02:08:36.573Z.

[Brad-Edwards]

gc workflow phase recorded: plan (issue #987). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

Implementation plan

Scope: publish one closed semantic-projection-report/v1 family and one pure offline projector over the exact portable bindings from #986 and governed native results. The issue has no ## Requirements section, so Ground Control scope remains requirement-free; the UID-bearing branch uses GOV-918, whose cross-artifact concept-binding statement explicitly covers reporting artifacts and supplies repository-policy context for the new schema validator.

Contract and projection engine

• Add closed frame/report models under the concept-authority boundary. The frame will bind the exact scheme authority/revision/digest and explicit inclusion set, digest-stable subject scope, one exact native predicate profile and producer, perspective, configuration/state posture, quantifier, evidence/freshness posture, binding-set digest, and transformation/adapter versions. A canonical frame digest will include every semantic axis.
• Partition every pinned-snapshot concept into exactly one of witness, gap, unknown, ambiguous, or excluded. Preserve resolved/stale/ambiguous binding outcome, relationship, semantic effect, confidence, approximation/loss, limitations, and review status on rows. Emit integer counts and a predicate-qualified fraction only; no coverage percentage, score, maturity, quality, or capability field.
• Add a pure deterministic projector that reuses admit_external_concept_bindings(), exact subjects, a single pinned local scheme snapshot, and canonical digest helpers. It performs no I/O, lookup, plugin import, environment access, network, subprocess, cache, or mutable registration.
• Keep declared, admitted, observed, and verified facts independent through fixed owner-specific adapters over incumbent contracts: digest-stable declarations, validation-basis disclosures, proposition truth results, and verified artifact-transformation preservation. Missing/stale/conflicting/lossy evidence remains unknown unless the exact profile admits it; a gap requires complete scope and a decisive negative. Evidence-free verification is rejected.
• Require participant-relative frames to carry exact audience, participant, episode, policy, and cut coordinates plus complete deny-first source authorizations. The projector refuses participant-visible output when any contributing binding, native result, evidence digest, diagnostic, or limitation is absent from the authorized source set; aggregation never declassifies.
• Register the report with schema_bundle(), the canonical conformance validator, generation routing, public exports/version constants, and a sharded schema-publication entry containing the normative schema hash and last_change. The checked-in schema remains hand-governed authority and byte-for-byte equivalent to generated output.

TDD, fixtures, and acceptance coverage

• Write focused tests first and observe them fail before adding production models/engine.
• Positive cases will run MITRE ATT&CK and NIST CSF through the same public projector and report schema. Tests will prove exact predicate-qualified counts, deterministic frame-digest changes for configuration/perspective/quantifier/evidence-boundary changes, replayable witness/evidence digests, and independent declared/admitted/observed/verified views.
• Negative fixtures/tests will reject unknown predicate profiles, empty or implicit denominators, missing scheme revision/digest, mismatched binding/frame digests, invalid thresholds, evidence-free verified witnesses, incomplete-scope gaps, and participant publication lacking complete source authorization.
• Regression cases will keep ambiguous, approximate, stale, and lossy bindings visible rather than collapsing them into false/zero/omitted output. Both Pydantic and the checked-in Draft 2020-12 schema will enforce portable invariants.
• Update specs/concept-authority/external-concept-bindings.md and contracts/schemas/README.md with the reporting boundary, exact-count language, native-authority separation, information-flow rule, and non-goals. Keep the architecture preflight note; no new ADR is needed under its stated boundary.

Whole-repository design checks

• Security: closed bounded inputs, strict digests and sorted uniqueness, safe diagnostics, exact local joins, evidence completeness, deny-first participant authorization, and no secret-bearing values or rejected-input echo.
• Maintainability: reuse ContractModel, canonical_json_digest(), binding admission, native result contracts, DiagnosticModel, schema/conformance/publication tooling, and existing fixtures rather than creating parallel registries, validators, errors, or stores.
• Extensibility: a new scheme supplies the incumbent neutral snapshot; a new predicate supplies one digest-pinned profile and trusted owner adapter. Neither changes the report partition or schema.
• Whole-repo surfaces: concept-authority specs, contract facade/bundle, conformance, normative schema/publication ledger, fixtures/tests, and schema docs remain aligned. No CHANGELOG.md, changelog fragment, product version, or authority-bearing artifact outside approved roots will be edited.

Verification

• Focused red/green tests for the new report and projector, then the affected conformance/schema tests.
• implementations/python/.venv/bin/python tools/check_repo_policy.py
• implementations/python/.venv/bin/python tools/check_requirement_governance.py
• implementations/python/.venv/bin/python tools/verify_all.py
• Configured completion and policy gates through Ground Control, followed by mandatory pre-push core and test-quality reviews.

[Brad-Edwards]

Execution obligation COMPLETION-GATE-VERIFY-1 — Opened

Category: failing_check
Observed state: The authoritative completion gate failed after unit, integration, contracts, and static lanes passed; the compact envelope clipped the remaining lane output.
Impact: Phase C cannot begin until the remaining completion lane is identified, repaired, and the final tree passes completion and policy unchanged.
Current obligation: Identify and repair the failing completion lane, then rerun the authoritative mechanical verification.

Evidence

• gc_implement_mechanical verify job job-msl6rz5j-2 returned implement_mechanical_completion_gate_failed
• Reported passing lanes: unit-tests, integration-tests, contracts, static

[Brad-Edwards]

Execution obligation COMPLETION-GATE-VERIFY-1 — Resolved

Category: failing_check
Observed state: The initial completion gate could not replay the participant-opacity proof because pinned Isabelle was absent.
Impact: The completion graph is no longer blocked by the local proof toolchain.
Current obligation: Acquire the checksum-pinned Isabelle toolchain and prove the completion graph can advance.

Evidence

• Pinned Isabelle2025-2 acquired with repository-declared SHA-256 a20a507bc7c1270d8be96a9f3fbec06345387789d2dc2c4d3df6260d47bfb33c
• gc_implement_mechanical verify job job-msl6yo38-3 advanced past completion and failed only at policy_gate

Disposition: fix
Corrective action: Ran the repository's pinned Isabelle acquisition command, which verified the exact archive and installed it in the repository-local ignored cache.

Verification

• Acquisition returned success with the pinned release digest.
• The next authoritative verification completed the completion stage and entered the policy stage.

[Brad-Edwards]

Execution obligation POLICY-GATE-VERIFY-2 — Opened

Category: failing_check
Observed state: The second authoritative verification passed the completion graph but tools/check_repo_policy.py exited 1; the compact envelope omitted its diagnostic.
Impact: Phase C remains blocked until the repository-policy finding is repaired and the authoritative gate passes unchanged.
Current obligation: Identify and repair the repository-policy finding, then rerun the authoritative mechanical verification.

Evidence

• gc_implement_mechanical verify job job-msl6yo38-3 returned implement_mechanical_policy_gate_failed
• The policy conftest self-verification passed before the repository policy checker failed

[Brad-Edwards]

Execution obligation STATIC-GATE-VERIFY-3 — Opened

Category: failing_check
Observed state: The third authoritative verification passed unit, integration, and contracts but failed the static lane after facade import compaction.
Impact: The compact import repair cannot remain unless it satisfies the repository's static/export checks.
Current obligation: Repair the facade under the 500-line cap without violating static export conventions, then verify the static and authoritative gates.

Evidence

• gc_implement_mechanical verify job job-msl74qau-4 returned implement_mechanical_completion_gate_failed
• Reported lane status: unit-tests PASS, integration-tests PASS, contracts PASS, static FAIL