Bind execution evidence to observed runs

.gitattributes

@@ -0,0 +1,2 @@
+# Canonical JSON fixtures and lockfiles are byte-sensitive across platforms.
+*.json text eol=lf

README.md

@@ -37,8 +37,8 @@ Logical strata may share one process. The rule is a dependency and responsibilit
 - A composite cache fingerprint that requires both semantic and operational equivalence: policy, capability set, authoritative context, tenant, privacy, constraints, and outcome are all bound.
 - An RFC 8785 JSON Canonicalization Scheme implementation with cross-language golden vectors, strict duplicate-member rejection at the JSON boundary, and a hash-linked receipt chain with tamper and missing-evidence detection.
 - Runtime conformance checks for rooted authority, causal evidence, actual budget consumption, exact-action idempotency, approval, read-back or compensation, predeclared criterion evidence bindings, layer direction, and model/authority separation.
-- An [Execution Passport](docs/spec/attestations/execution-passport/v1/README.md) that binds one run bundle, its complete conformance report, and one externally validated OASF record in a strict in-toto Statement without embedding those documents.
-- Mapping-only adapter documents for AG-UI, A2A, MCP, OpenTelemetry GenAI, CloudEvents, an external policy engine, OASF, and content-free execution-placement evidence.
+- An [Execution Passport v2](docs/spec/attestations/execution-passport/v2/README.md) that binds one run bundle, its complete conformance report, one externally validated OASF record, and optional run-bound observations in a strict in-toto Statement without embedding those documents.
+- Mapping-only adapter documents for AG-UI, A2A, MCP, OpenTelemetry GenAI, CloudEvents, an external policy engine, and OASF, plus an executable StageFabric evidence-reduction adapter.
 - A neutral prepare/commit/read-back demo with exact-action approval and duplicate suppression.
 
 ## Quick start
@@ -72,7 +72,23 @@ node dist/cli.js passport .tmp/demo/run.bundle.json \
 node dist/cli.js validate .tmp/demo/execution-passport.json
 ```
 
-The output file contains exact RFC 8785 Statement bytes suitable for an external DSSE/Sigstore adapter. Repeat `--execution-evidence` only with strict `ExecutionEvidenceBinding` documents containing descriptors and digests, never provider output.
+When StageFabric produces a sealed content-free placement artifact, reduce it to a run-bound descriptor before Passport creation:
+
+```bash
+node dist/cli.js bind-stagefabric /path/to/stagefabric-evidence.json \
+  --uri urn:stagefabric:evidence:run-001 \
+  --output .tmp/demo/stagefabric-binding.json
+node dist/cli.js passport .tmp/demo/run.bundle.json \
+  --report .tmp/demo/conformance-report.json \
+  --oasf-record /path/to/validated-oasf-record.json \
+  --oasf-media-type "$OASF_MEDIA_TYPE" \
+  --execution-evidence .tmp/demo/stagefabric-binding.json \
+  --output .tmp/demo/execution-passport.json
+```
+
+The output file contains exact RFC 8785 Statement bytes suitable for an external DSSE/Sigstore adapter. Repeat `--execution-evidence` only with strict v2 bindings whose `runIdDigest` matches the Passport run and whose authority is fixed to `observation-only`.
+
+`bind-stagefabric` accepts only the exact canonical JSON plus trailing LF emitted by the StageFabric evidence writer. Pretty-printed JSON, YAML, or a reserialized object is rejected because the resulting descriptor digest identifies the retrievable file bytes, not merely an equivalent object.
 
 All commands accept JSON; `validate` and `lint` also accept YAML. Build once with `npm run build` before invoking the repository-local CLI. Input documents are bounded to 16 MiB, JSON member names must be unique, and YAML alias expansion is limited.
 
@@ -115,7 +131,7 @@ Read [Architecture](docs/architecture.md), [Contracts and conformance](docs/cont
 - Reports bind the evaluator name, package version, semantic revision, selected rule set, and effective profile configuration. The evaluator digest identifies the declared implementation revision; it is not a code signature.
 - An unsigned Execution Passport proves deterministic integrity and cross-artifact binding only. Authenticity requires an externally verified DSSE envelope or equivalent trusted channel, and consumers must make that requirement explicit so removing a signature cannot silently downgrade policy.
 - The OASF subject digest proves which opaque record was bound; it does not prove that the record is semantically valid OASF. Validate it before passport creation with the specification owner’s tooling.
-- Execution-placement evidence enters the predicate only as strict descriptors with no payload or `content` field. Descriptor metadata must come from a trusted producer and be redacted or pseudonymized when sensitive; its optional stable URI may be omitted. Full provider result objects are outside the Passport contract.
+- Execution-placement evidence enters the predicate only as a strict, run-bound, observation-only descriptor with a normalized observation time and no payload or `content` field. A StageFabric descriptor hashes the exact canonical JSON file bytes, including its trailing LF. Descriptor metadata must come from a trusted producer and be redacted or pseudonymized when sensitive; its optional stable URI may be omitted. Full provider result objects are outside the Passport contract.
 - A safe fingerprint binds the declared canonical intent. It does not prove that an upstream intent normalizer chose the correct meaning.
 - Adapter documents are integration contracts, not bundled protocol SDKs or policy engines.
 - The current release is an alpha contract surface. Version consumers explicitly before production adoption.
@@ -126,6 +142,6 @@ Read [Architecture](docs/architecture.md), [Contracts and conformance](docs/cont
 npm run release:check
 ```
 
-The release gate runs strict lint and types, 60+ tests with coverage thresholds, build, repository hygiene, production audit, `publint`, and Are the Types Wrong.
+The release gate runs strict lint and types, 80+ tests with coverage thresholds, build, repository hygiene, production audit, `publint`, and Are the Types Wrong.
 
 Apache-2.0 licensed. See [CONTRIBUTING.md](CONTRIBUTING.md) and [SECURITY.md](SECURITY.md).

adapters/stagefabric.mapping.yaml

@@ -2,14 +2,14 @@ contractType: AdapterMapping
 apiVersion: agenticstrata.dev/v1
 mappingId: adapter/stagefabric
 protocol: stagefabric
-protocolVersion: configurable
+protocolVersion: v1alpha1
 direction: inbound
 contractBindings:
   - strataContract: ExecutionEvidenceBinding
-    protocolObject: ExecutionPlacementEvidence ResourceDescriptor
-    notes: Only role, producer, disclosure mode, resource name, canonical digest, media type, and an optional bounded stable HTTPS or URN reference are admitted; metadata must be trusted and redacted or pseudonymized when sensitive.
+    protocolObject: ExecutionPlacementEvidence
+    notes: The executable adapter validates strict source schema, semantic trace, timestamp grammar, seal, and exact canonical-JSON-plus-LF writer bytes; converts the prefixed run digest; normalizes observedAt; fixes authority to observation-only; and hashes the retrievable file bytes.
   - strataContract: ExecutionPassport
     protocolObject: predicate executionEvidence entry
-    notes: No payload or content field is admitted; the full provider result remains outside the mapping.
+    notes: Passport creation rejects a source from another run. No payload or content field is admitted, and placement never grants executable authority.
 lossPolicy: explicit-loss
 extensionPoint: true

docs/adr/0004-execution-passport.md

@@ -1,6 +1,6 @@
 # ADR 0004: Execution Passport as a strict external attestation statement
 
-Status: accepted
+Status: accepted for v1; superseded by ADR 0005 for new Passport evidence
 
 ## Context
 

docs/adr/0005-run-bound-execution-evidence.md

@@ -0,0 +1,26 @@
+# ADR 0005: Run-bound execution evidence is observation-only
+
+Status: accepted
+
+## Context
+
+Execution Passport v1 admitted strict content-free placement descriptors, but the descriptor did not cryptographically identify the run it observed. A valid descriptor could therefore be attached to another run if its resource digest remained unchanged. Placement metadata must also never be interpreted as permission to execute.
+
+## Decision
+
+Execution Passport v2 requires every `ExecutionEvidenceBinding` to carry `runIdDigest = SHA256(RFC8785(runId))`, normalized `observedAt`, and `authority = observation-only`. Passport creation validates the binding and rejects any run-digest mismatch or observation later than the bound report before emission.
+
+Provider integrations are explicit reduction adapters. They validate the external artifact schema and producer seal, bind the complete artifact by digest, and emit only a strict descriptor.
+
+The StageFabric adapter binds the exact canonical JSON file bytes written by StageFabric, including its trailing LF, rather than hashing a reparsed object. Its CLI path rejects alternative encodings so a URI can be verified byte-for-byte against the descriptor.
+
+The evidence can explain where execution was observed. It cannot issue a grant, widen a grant, authorize a capability, or override an authority check. Provider payloads and result objects remain outside the Passport.
+
+## Consequences
+
+- Cross-run descriptor reuse fails closed.
+- Future or differently serialized observations fail closed.
+- Consumers can distinguish observation from authorization mechanically.
+- External formats remain replaceable behind narrow validation adapters.
+- A producer seal still provides integrity, not identity; authenticity remains an external signature or trusted-channel concern.
+- V1 evidence cannot be upgraded by relabeling. It must be regenerated with a proven run binding or omitted.

docs/architecture.md

@@ -78,7 +78,7 @@ Passport creation is a deterministic packaging step after conformance evaluation
 2. the canonical digest of the complete `ConformanceReport`, including its own `digest` field;
 3. the canonical digest of one opaque, externally validated OASF record.
 
-Optional execution-placement evidence is already reduced by its producer to a `ResourceDescriptor` with no payload or `content` field. AgenticStrata admits only the descriptor, producer identity, fixed role, and `content-free` disclosure marker; descriptor metadata must be trusted and redacted or pseudonymized when sensitive, and its URI may be omitted. It never consumes a provider’s full execution result through this boundary.
+Optional execution-placement evidence is reduced to a `ResourceDescriptor` with no payload or `content` field. AgenticStrata admits only the descriptor, producer identity, fixed role, canonical run-identifier digest, normalized observation time, `observation-only` authority, and `content-free` disclosure marker. A StageFabric adapter validates the source artifact, semantic trace, timestamp grammar, producer seal, and exact canonical-JSON-plus-LF writer bytes before reduction. Descriptor metadata must be trusted and redacted or pseudonymized when sensitive, and its URI may be omitted. A placement observation never grants authority; a descriptor from another run or after the report is rejected.
 
 The core emits an unsigned Statement. A replaceable external adapter may wrap its exact RFC 8785 bytes in DSSE and use Sigstore or another trust system. Signature verification, signer identity, transparency-log policy, and trusted time remain consumer-owned controls.
 

docs/contracts-and-conformance.md

@@ -44,13 +44,13 @@ Every report binds the run bundle, selected rule list, effective merged profile
 
 ## Execution Passport invariants
 
-The [v1 specification](spec/attestations/execution-passport/v1/README.md) is an in-toto Statement with one project-owned predicate URI. Its subject tuple has fixed order and length: run bundle, complete conformance report, external OASF record. Each subject is a strict `ResourceDescriptor` containing only a name, one SHA-256 digest, a media type, and an optional bounded stable HTTPS or URN reference. The report subject uses `digestValue(report)`, not `report.digest`: the former binds the complete serialized report, while the latter seals the report content before its own digest field is added.
+The [v2 specification](spec/attestations/execution-passport/v2/README.md) is an in-toto Statement with one project-owned predicate URI. Its subject tuple has fixed order and length: run bundle, complete conformance report, external OASF record. Each subject is a strict `ResourceDescriptor` containing only a name, one SHA-256 digest, a media type, and an optional bounded stable HTTPS or URN reference. The report subject uses `digestValue(report)`, not `report.digest`: the former binds the complete serialized report, while the latter seals the report content before its own digest field is added.
 
 The predicate records `runStatus` and `conformanceStatus` separately. Creation does not require either status to be successful, so an incomplete or failed run can be bound honestly. It does require unambiguous run identity, a valid receipt chain, a sealed report and evaluator identity, ordered unique check identifiers bound by `rulesDigest`, status derived from those checks, matching bundle and manifest digests, report/receipt status agreement, report generation no earlier than any included observed evidence, and issuance no earlier than report generation.
 
 OASF input is accepted only as an opaque I-JSON object and canonicalized for its subject digest. AgenticStrata deliberately does not carry an OASF schema and therefore does not claim semantic validity. A caller must validate the record externally and provide the owner-declared media type.
 
-`executionEvidence` accepts only strict bindings with no payload or `content` field. The producer computes and publishes the evidence artifact digest; AgenticStrata carries its descriptor but never receives the full provider result through the CLI. Descriptor metadata must be trusted and redacted or pseudonymized when sensitive, and the URI may be omitted.
+`executionEvidence` accepts only strict bindings with no payload or `content` field. Every binding carries the canonical digest of the observed run identifier, normalized observation time, and fixed `observation-only` authority; a run mismatch or observation later than the report fails Passport creation. The StageFabric reduction adapter verifies the source schema, semantic invariants, producer seal, timestamp grammar, and exact writer encoding, then binds the complete canonical-JSON-plus-LF file bytes. AgenticStrata never imports a full provider result. Descriptor metadata must be trusted and redacted or pseudonymized when sensitive, and the URI may be omitted.
 
 The Passport is created after assessment and is not required by a conformance rule. Making it a prerequisite of the report it contains would create a circular dependency.
 

docs/interoperability.md

@@ -12,13 +12,14 @@ AgenticStrata owns application-level runtime invariants. It deliberately leaves
 | Policy engine | Grant, approval, attenuation query | The external enforcement point remains authoritative. |
 | OASF | Opaque agent-record subject descriptor | AgenticStrata binds canonical bytes but delegates semantic validation and media-type ownership. |
 | in-toto / DSSE | Execution Passport Statement and optional external envelope | The core owns deterministic binding; signing, identity, transparency, and trusted time stay outside it. |
-| Execution-placement provider | Content-free evidence descriptor | No payload or `content` field is admitted; descriptor metadata remains subject to producer trust, redaction, and pseudonymization policy. |
+| StageFabric | Sealed content-free placement artifact reduced to an evidence descriptor | Adapter verifies schema, seal, exact writer bytes, run binding, and observation time; the result is observation-only and cannot expand authority. |
+| Other execution-placement provider | Content-free, run-bound evidence descriptor | No payload or `content` field is admitted; producer validation remains an explicit adapter responsibility. |
 
 Adapter YAML files are declarative mappings with an explicit `lossPolicy`. They contain no vendor SDK and can be replaced without changing the core contract registry.
 
 ## Attestation exchange
 
-The Execution Passport uses the project-controlled predicate namespace documented at [`docs/spec/attestations/execution-passport/v1`](spec/attestations/execution-passport/v1/README.md). The core writes exact RFC 8785 Statement bytes. A deployment may pass those bytes to an external DSSE/Sigstore adapter using payload type `application/vnd.in-toto+json`; no signing key, certificate flow, or Sigstore dependency enters AgenticStrata.
+The Execution Passport uses the project-controlled predicate namespace documented at [`docs/spec/attestations/execution-passport/v2`](spec/attestations/execution-passport/v2/README.md). The core writes exact RFC 8785 Statement bytes. A deployment may pass those bytes to an external DSSE/Sigstore adapter using payload type `application/vnd.in-toto+json`; no signing key, certificate flow, or Sigstore dependency enters AgenticStrata.
 
 Consumers choose one of two explicit policies:
 

docs/spec/attestations/execution-passport/v1/README.md

@@ -1,6 +1,8 @@
 # AgenticStrata Execution Passport v1
 
-Status: alpha, versioned contract
+Status: superseded historical contract
+
+New producers must use [Execution Passport v2](../v2/README.md). V1 execution-evidence descriptors did not bind the observed run and must not be promoted by changing only the predicate URI. This document is retained for migration analysis; `validate` retains read-only v1 Statement support while the current creation schema and builder implement v2.
 
 Predicate type:
 
@@ -10,7 +12,7 @@ Predicate type:
 
 Execution Passport v1 is an in-toto Statement that binds one runtime bundle, the complete conformance report produced for that bundle, and one external OASF agent record. It packages lineage; it is not a success certificate, an OASF validator, a digital signature, or a trusted timestamp.
 
-The normative machine-readable shape is `$defs.ExecutionPassport` in [`schemas/v1/agentic-strata.schema.json`](../../../../../schemas/v1/agentic-strata.schema.json).
+The historical shape is described here. The current `$defs.ExecutionPassport` in [`schemas/v1/agentic-strata.schema.json`](../../../../../schemas/v1/agentic-strata.schema.json) implements v2.
 
 ## Statement envelope