v2.9.34 — audit-ledger closure wave (4 closes + HS3 + CLAUDE.md contract)

Closes 4 of 7 carryover items from AUDIT_LEDGER_v2.9.34.md plus HS3:

- HS3 / CLAUDE.md operating contract — repo-root contract with the 4
  DoD criteria, hard-stop conditions, ledger operating rules, forbidden
  phrases, three-artifact /ship-audit output contract.
- #9 / alert triage — ALERT_TRIAGE.md enumerates all 23 alerts of case
  01-small-clean-baseline; single root cause (corpus harness does not
  pass cal_map; 9 forward + 14 backward fallback variants).
- #10 / 1k DAG fixture — new case 13-large-1000-dag-branching: 10-phase
  diamond cascade, 5-way fan-out + 5-way fan-in per phase, 1020 acts /
  1059 rels, strict-mode PASS.
- #16 / crypto signoff stub — real Ed25519 sign/verify via Node built-in
  crypto, cpp-skill-manifest/v2 wire format, 7-sub-suite tamper test.
- #17 / SOP checklist schema + validator — JSON Schema draft-07 +
  per-step semantic binding from FORENSIC_USE_SOP.md, 4-fixture
  regression test.

Partial close (engineering only, P6-values still user-blocked):
- #6 / P6 expected-value — validate-p6-comparison.js + 7-scenario test
  + schema doc + matrix-doc cleanup (stale row-14/15 refs removed).

New release-blocking test gates wired into test:all:
test:sop, test:crypto, test:p6-comparison, test:corpus-dag.

Engine math unchanged. ENGINE_VERSION bumped 2.9.33 -> 2.9.34 in
cpm-engine.js + package.json; python_reference/cpm.py bumped 2.9.27
-> 2.9.34 (7-version drift closed). 5 hard-coded version assertions in
cpm-engine.test.js refreshed. 34 stale v2.9.33 doc refs swept to
v2.9.34. All validation/**/engine-output.json + summaries regenerated
under v2.9.34 stamp. release-evidence/v2.9.34/ packet committed
(7 computed + 3 CI-pending stubs to populate post-tag-push).

CHECK_RELEASE_EVIDENCE=1 npm run test:all green:
  1128/1128 unit + 747/747 crossval + 4 pre-existing gates + 4 new gates.

cpm-engine.js     SHA-256: 5a6abd78fac05bde9951b17f9ca27d2fd163b85ef956df18ced84cc214cc1f78
python_reference  SHA-256: fefc98115060ecc7aec6e9fe2cf01a758f795ccd35631b84d1e80e367e6b1f68

See CHANGELOG.md v2.9.34 entry for the full closure breakdown.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: danafitkowski

CHANGELOG.md

@@ -12,6 +12,149 @@ A stray bridge tag `temp-deploy-bridge-2026-05-11` (unrelated to any CHANGELOG e
 
 ---
 
+## v2.9.34 — 2026-05-24 — Audit-ledger closure wave + CLAUDE.md operating contract
+
+Closes 4 of 7 carryover items from the `AUDIT_LEDGER_v2.9.34.md` v2.9.33-rollover plus the HS3 hard stop. Engine math byte-identical to v2.9.33; this is a docs + closures + test-gates release.
+
+### HS closes (hard-stop conditions on the audit ledger)
+
+- **HS3 / `CLAUDE.md` operating contract missing.** The v2.9.34 audit ledger
+  referenced `CLAUDE.md` three times (lines 6, 27, 63) as the source of
+  the four Definition-of-Done criteria, but no such file existed in the
+  repo. `CLAUDE.md` now lives in the repo root with the DoD, status
+  taxonomy, hard-stop conditions, ledger operating rules, forbidden
+  phrases, and the three-artifact `/ship-audit` output contract. The
+  file becomes the citable contract for every future ledger.
+
+### Ledger-row closes
+
+- **#9 / Alert investigation — 23 baseline alerts.**
+  `validation/xer-corpus/cases/01-small-clean-baseline/ALERT_TRIAGE.md`
+  enumerates all 23 alerts and identifies the single root cause: the
+  corpus harness does not pass `cal_map` through `runEngineOnXer`, so
+  the engine falls back to 7-day ordinal arithmetic and emits one
+  alert per arithmetic site (9 forward variants + 14 backward
+  variants = 23). Verification: `node scripts/verify-alert-triage-01.js`.
+- **#10 / 1k DAG fixture extension.** New corpus case
+  `13-large-1000-dag-branching` — 10-phase diamond cascade, 5-way
+  fan-out from each phase-start milestone + 5-way fan-in to each
+  phase-end milestone, 1020 activities / 1059 relationships /
+  strict-mode PASS. Closes the "trivial FS chain only" gap on the
+  existing 1k case (#02). Topology regression in
+  `tests/corpus-dag-fixture.test.js`.
+- **#16 / Cryptographic analyst signoff stub + schema v2.**
+  `scripts/crypto-signoff.js` ships real Ed25519 signing + verification
+  via Node's built-in `crypto` (zero external deps). The
+  `cpp-skill-manifest/v2` wire format documented at
+  `docs/crypto-signoff-schema-v2.md` covers canonicalization, threat
+  model, and the forward path to Sigstore Rekor (stubbed — the
+  transparency block carries a documented `_note` placeholder).
+  7-sub-suite regression: round-trip, payload tamper, signature
+  zeroing, public-key swap, full key swap, schema mismatch,
+  cross-keypair. Test gate `test:crypto`.
+- **#17 / Machine-readable SOP checklist + validator.**
+  `schemas/sop-checklist.schema.json` (JSON Schema draft-07) +
+  `scripts/validate-sop.js` (per-step semantic binding from
+  FORENSIC_USE_SOP.md's "Capture in manifest" sections) +
+  `validation/sop-examples/` (template, passing, failing fixtures).
+  Documentation at `docs/sop-checklist-schema.md`. 4-fixture regression
+  gate `test:sop`.
+
+### Partial close — engineering portion only
+
+- **#6 / P6 expected-value population.** Engineering scaffolding shipped:
+  `scripts/validate-p6-comparison.js` validates each `comparison.csv`
+  for header schema, engine-column accuracy against the case's
+  `engine-output.json`, P6-discipline (all-filled or all-blank, no
+  partial), and verdict-format grammar (`PASS` or `FAIL — <delta>`).
+  7-scenario regression `tests/p6-comparison-validator.test.js`.
+  Matrix-doc cleanup: stale row-14/15 references removed from
+  `validation/p6-comparison/comparison-matrix.md` after their move to
+  `validation/engine-limitations/` in the v2.9.33 audit cycle.
+  Schema doc at `docs/p6-comparison-schema.md`. The P6-VALUES portion
+  (filling `*_p6` columns from native P6 capture) remains user-blocked
+  on Dana's P6 access.
+
+### Carryover (unchanged status)
+
+- **#5 / Third-party reproduction memo** — BLOCKED on identifying an
+  outside reviewer.
+- **#8 / Real-XER sourcing** — ACCEPTED-LIMITATION; requires client
+  consent.
+
+### New test gates (release-blocking, wired into `test:all`)
+
+- `test:sop` → `tests/sop-validator.test.js`
+- `test:crypto` → `tests/crypto-signoff.test.js`
+- `test:p6-comparison` → `tests/p6-comparison-validator.test.js`
+- `test:corpus-dag` → `tests/corpus-dag-fixture.test.js`
+
+`scripts/attestation.js` continues to invoke the 5 pre-existing gates
+(unit, crossval, citation, truncation, version-drift); the new gates
+are exercised by `npm run test:all` separately. A v2.9.35+
+enhancement may extend `attestation.js` to include the new gates in
+the witness JSON; not in scope for this release.
+
+### Engine code
+
+- `cpm-engine.js:151` — `ENGINE_VERSION` bumped `'2.9.33'` → `'2.9.34'`.
+  No math-side edits. SHA-256 rotates as a consequence of the string
+  bump.
+- `python_reference/cpm.py:91` — `ENGINE_VERSION` bumped from a stale
+  pin (had not been updated since the v2.9.27 audit cycle — 7-version
+  drift). Behaviorally byte-identical; crossval 747/747 holds.
+
+### Tests modified
+
+- `cpm-engine.test.js` — 5 hard-coded `=== '2.9.33'` assertions
+  refreshed to `'2.9.34'` (lines 1316, 1353, 1606, 2065, 2085).
+- `cpm-engine.test.js` SECTION R historical narration preserved
+  (v2.9.33 section header references intentionally retained).
+
+### Files added (17 new)
+
+`CLAUDE.md`, `schemas/sop-checklist.schema.json`, `scripts/validate-sop.js`,
+`scripts/crypto-signoff.js`, `scripts/verify-alert-triage-01.js`,
+`scripts/validate-p6-comparison.js`, `tests/sop-validator.test.js`,
+`tests/crypto-signoff.test.js`, `tests/corpus-dag-fixture.test.js`,
+`tests/p6-comparison-validator.test.js`,
+`validation/sop-examples/{01-template-blank,02-passing-fully-filled,03-failing-incomplete}.json`,
+`validation/xer-corpus/cases/13-large-1000-dag-branching/{case.xer, engine-output.json, README.md}`,
+`validation/xer-corpus/cases/01-small-clean-baseline/ALERT_TRIAGE.md`,
+`docs/sop-checklist-schema.md`, `docs/crypto-signoff-schema-v2.md`,
+`docs/p6-comparison-schema.md`, `release-evidence/v2.9.34/`.
+
+### Files modified
+
+`package.json` (version + test gates + files list), `cpm-engine.js`
+(ENGINE_VERSION), `python_reference/cpm.py` (ENGINE_VERSION),
+`cpm-engine.test.js` (5 assertion refreshes),
+`validation/xer-corpus/generate-corpus.js` (case 13 + helper),
+`validation/p6-comparison/comparison-matrix.md` (row cleanup +
+version stamps), all `validation/**/engine-output.json` +
+`corpus-summary.json` + `engine-outputs-summary.json` (regenerated
+under new engine version stamp), `ROADMAP_OPEN.md` (status flips for
+#9 / #10 / #16 / #17), and version-header sweep across README,
+DAUBERT, VERIFY_RELEASE, FORENSIC_USE_SOP, docs/jurisdictions,
+docs/api, validation/p6-comparison/README, validation/xer-corpus/README.
+
+### Verification chain
+
+```
+Tag:                    v2.9.34
+Engine SHA-256:         5a6abd78fac05bde9951b17f9ca27d2fd163b85ef956df18ced84cc214cc1f78
+Python ref SHA-256:     fefc98115060ecc7aec6e9fe2cf01a758f795ccd35631b84d1e80e367e6b1f68
+Unit tests:             1,128 / 1,128
+Crossval:               747 / 747 across 43 fixtures
+New gates:              4 / 4 (sop, crypto, p6-comparison, corpus-dag)
+npm run verify:         PASS
+npm run test:all:       PASS
+```
+
+Sigstore Rekor entry + GitHub Actions workflow URL populate post-tag.
+
+---
+
 ## v2.9.33 — 2026-05-24 — Audit-response wave pass 2 (closes ChatGPT fourth-pass findings)
 
 Fourth-pass ChatGPT audit on v2.9.32 surfaced 19 items. v2.9.33 closes 14

CLAUDE.md

@@ -0,0 +1,114 @@
+# CLAUDE.md — Operating contract for `cpp-cpm-engine` releases
+
+This file is the contract that the per-version `AUDIT_LEDGER_v{X}.md` files cite. It defines what "CLOSED" means, what hard-stop conditions block a release, and what the operator (a human or an AI agent like Claude Code) must do before claiming an audit row is closed.
+
+If the ledger and this file disagree, **this file wins**. The ledger refers to this file; it does not redefine it.
+
+---
+
+## 1. Definition of Done (DoD) — the four criteria
+
+A row in any `AUDIT_LEDGER_v{X}.md` may move to status **CLOSED** if and only if **all four** of the following are true:
+
+1. **Code or doc change exists.** A concrete, committable diff — a new file, an edit to an existing file, or a configuration change — addresses the finding. Adding the item to `ROADMAP_OPEN.md` is *not* a change for this purpose; it closes the meta-tracking task only.
+2. **Verification command provided.** The ledger row's **Verification command** column contains a single shell or `node` command that an independent operator can run, in the repo root, to reproduce the verification. The command must exit non-zero on regression.
+3. **File read end-to-end after edit.** After the diff is written, the author re-reads the touched file(s) from line 1 to EOF — not by `grep`, not by pattern-match. This is the human-eye check that the change is internally consistent, that no leftover scaffolding remains, and that the surrounding context still parses.
+4. **Clean-window re-grep performed.** From a fresh read, search every touched file for: outdated version strings, contradictory test counts / metric values, references to evidence packets or fixtures that do not exist on disk, and forbidden marketing language ("industry-first", "best-in-class", "revolutionary", "world-class", "game-changing", "unprecedented", "cutting-edge", "state-of-the-art"). Any finding downgrades the row to DEFERRED until resolved.
+
+A row that satisfies 3 of 4 is not CLOSED. There is no partial credit.
+
+---
+
+## 2. Status taxonomy (mirrored in every ledger)
+
+- **CLOSED** — Four DoD criteria satisfied.
+- **DEFERRED** — Could be done with the available tools and context; not done this session. The row must state an effort estimate and confirm no structural blocker.
+- **ACCEPTED-LIMITATION** — Structural reason this cannot be done unaided. Allowed reasons: client consent, credentials, third-party action, missing physical access. The row must name the structural reason.
+- **BLOCKED** — Requires a specific user action named in the row (e.g., "Dana to identify reviewer").
+- **OBSOLETE** — Item no longer relevant. Row must include the reason. Row is never deleted.
+
+The four are mutually exclusive. Every row is in exactly one state.
+
+---
+
+## 3. Hard-stop conditions before any release
+
+A release may not proceed (no version bump, no release notes, no tag) if any of the following is true:
+
+1. Any ACCEPTED-LIMITATION row lacks a structural reason from the allowed list.
+2. Any CLOSED row's Verification command failed or was not run.
+3. Any file touched in the release contains a Step-3 re-grep finding (stale version, contradiction, missing artifact reference, or marketing language).
+4. Any CLOSED row has empty Evidence or Verification command cells.
+5. Any row's Status column conflicts with its Verification result column (e.g., status = CLOSED but result describes a failure).
+
+Hard stop #4 applies only to CLOSED rows. DEFERRED / ACCEPTED-LIMITATION / BLOCKED rows are expected to have empty Evidence / Verification cells until the underlying work happens.
+
+---
+
+## 4. Operating rules for ledgers
+
+1. No row may move to CLOSED without satisfying §1.
+2. No row may be deleted. If it becomes irrelevant, mark OBSOLETE with a reason in the Verification result column.
+3. The `/ship-audit` command writes the final Status and Verification result columns. Do not pre-fill those during work — they get filled at verification time, not edit time.
+4. If a DEFERRED item is completed during the session: update Evidence + Verification command columns in place, leave Status as DEFERRED, and re-run `/ship-audit` to validate the closure.
+5. Adding an item to `ROADMAP_OPEN.md` is **not** closure. It closes the meta-tracking task; the underlying item stays DEFERRED until §1 is satisfied.
+6. If a verification command's output exceeds 100 lines, summarize to head + tail + total line count and link to the full output in `VERIFICATION_LOG_v{X}.md`.
+
+---
+
+## 5. Forbidden phrases in `/ship-audit` summary output
+
+The closing summary must use the honest tally from `/ship-audit` Step 4. It may not use any of:
+
+- "All items addressed"
+- "Audit closed"
+- "Substantially complete"
+- "Effectively done"
+- "Tracked for follow-up" (as a substitute for DEFERRED)
+
+These phrases are forbidden because they have historically been used to claim closure without the underlying DoD work being done. The honest tally — "X CLOSED, Y DEFERRED, Z ACCEPTED-LIMITATION, W BLOCKED" — is always available and always acceptable.
+
+---
+
+## 6. Three artifacts at session end
+
+Every `/ship-audit` run produces exactly three artifacts:
+
+1. Updated `AUDIT_LEDGER_v{X}.md` with verified statuses, tally section filled, per-row Verification result column annotated with the audit-date note.
+2. New or updated `VERIFICATION_LOG_v{X}.md` containing the Step 2 command outputs and Step 3 re-grep findings.
+3. A one-paragraph summary delivered to the operator stating the honest tally and naming the top deferred items by number and effort estimate.
+
+The operator writes release notes after reviewing those artifacts. `/ship-audit` does not write release notes.
+
+---
+
+## 7. Test gates and regression protection
+
+Every release ships these test gates (run by `npm run test:all`):
+
+- `npm test` — `cpm-engine.test.js` unit suite.
+- `npm run crossval` — `cpm-engine.crossval.js` JS/Python parity matrix.
+- `npm run test:cites` — `tests/no-fabricated-citations.test.js` (citation provenance).
+- `npm run test:truncation` — `tests/no-truncation.test.js` (no user-facing data truncation).
+- `npm run test:version-refs` — `tests/no-stale-version-refs.test.js` (no version-drift in docs).
+
+New release-blocking gates added in v2.9.34:
+
+- `tests/sop-validator.test.js` — machine-readable SOP checklist schema is honored by skill_manifest bindings.
+- `tests/crypto-signoff.test.js` — analyst-signoff stub round-trips sign → verify cleanly and rejects tampered manifests.
+
+The `scripts/attestation.js` entrypoint must invoke every gate above; a release tag is forbidden if any gate fails.
+
+---
+
+## 8. Citation provenance
+
+This contract is referenced by `AUDIT_LEDGER_v{X}.md` files in the repo root. If a future audit run cannot locate `CLAUDE.md` in the repo root, that is itself a Step-3 finding (HS3) and the release is blocked.
+
+---
+
+## 9. Document version
+
+- Created: 2026-05-24 (v2.9.34 audit cycle).
+- Closes Hard Stop #3 of `AUDIT_LEDGER_v2.9.34.md` (missing contract document).
+- Update on every release that changes any rule above.

DAUBERT.md

@@ -1,4 +1,4 @@
-# Daubert / FRE 702 Disclosure — `cpm-engine` v2.9.33
+# Daubert / FRE 702 Disclosure — `cpm-engine` v2.9.34
 
 This is a formal disclosure for the engine itself, modeled on the structured output of `buildDaubertDisclosure()`. It is intended for use as a starting point in expert-witness exhibits and FRCP 26(a)(2)(B) reports under the *Daubert v. Merrell Dow Pharmaceuticals* (1993) framework as codified in Federal Rule of Evidence 702 (Dec 1, 2023 amendment), and is forward-compatible with proposed FRE 707.
 
@@ -176,7 +176,7 @@ Every `computeCPM` result carries a `manifest` block:
 
 ```js
 result.manifest = {
-    engine_version: '2.9.33',                   // Synchronized with package.json (bump per release)
+    engine_version: '2.9.34',                   // Synchronized with package.json (bump per release)
     method_id: 'computeCPM',                    // 'computeTIA', 'computeCPMSalvaging', etc.
     activity_count: 282,
     relationship_count: 421,
@@ -243,7 +243,7 @@ The engine and the validation suite were developed by the same author (Dana Fitk
 ## Disclosure format version
 
 `disclosure_format_version: 1.0`
-`engine_version: 2.9.33`
+`engine_version: 2.9.34`
 `generated_at:` (will be filled in by `buildDaubertDisclosure()` at runtime; this static document is dated 2026-05-24, refreshed for v2.9.33 audit-response-pass-2. v2.9.33 fixes the fatal-tier audit findings v2.9.33 still left open (VERIFY_RELEASE.md test-count contradictions, missing release-evidence packets, SHA-sidecar wording, attestation script not wiring the new gates) plus the medium-tier residuals (jurisdictions bottom guarantee section, "no silent wrong-answer paths" absolute language, dead-context test strengthening, structured override fields with backward compat, README competitor-table removal, machine-readable SOP-checklist binding). Prior milestones preserved: v2.9.33 audit-response wave + version-drift regression gate + computeCPMSalvaging strict-mode refusal; v2.9.31 Section Q Forensic Strict Mode public API + 33 strict-mode unit tests; v2.9.27 audit closeout + crossval 444→747; v2.9.12 Round 9 engine math fix wave; v2.9.11 Round 7 independent-verification infrastructure tag; v2.9.9 full hammock SS/FF/SF semantics; v2.9.10 Round 7-8 independent-verification stack (public CI, Sigstore attestation, one-command local reproduction).)
 
 ---
@@ -314,7 +314,7 @@ The engine honors the following Primavera P6 constraint types declared on activi
 
 **Semantics.** Forward-pass clamps emit `{severity:'WARN', context:'constraint-applied'}`; impossibility-of-satisfaction cases emit `{severity:'ALERT', context:'constraint-violated'}`. Hammock-cycle topology emits `{severity:'ALERT', context:'hammock-cycle'}`. Hammock negative-span emits `{severity:'ALERT', context:'hammock-negative-span'}`. No silent-wrong-answer paths — every constraint that affects ES/EF/LS/LF, and every hammock anomaly, appears in `result.alerts`.
 
-**Disclosure.** Opposing experts can audit every constraint applied during a run by filtering `result.alerts` on the contexts above. Pair with `result.manifest.engine_version === '2.9.33'` to confirm the constraint module version.
+**Disclosure.** Opposing experts can audit every constraint applied during a run by filtering `result.alerts` on the contexts above. Pair with `result.manifest.engine_version === '2.9.34'` to confirm the constraint module version.
 
 **v2.9.12 — Round 9 engine math fix wave.** The audit memo identified ~30 substantive math defects across constraint handling, calendar arithmetic, in-progress + actuals, and JS/Python parity. T1.1 added MS_Start hard-pin on backward LF clamp (was JS+Python silent gap). T1.2-T1.3 emit `constraint-noop` WARN and suppress ES-side constraint clamps when an `actual_start` is present (AACE 29R-03 §4.3 immutability — both engines). T1.4 added Section D actual_start pinning with one-time `actual-start-not-anchored` WARN when `projectStart` is missing. T1.5 surfaces TT_LOE/TT_WBS/completed/zero-remaining drops + dangling-relationship drops + non-finite-lag rejections as INFO/ALERT alerts. T1.6 emits `constraint-unrecognized` / `constraint-incomplete` WARN on unknown tokens / missing dates. T1.7 added `CS_MANSTART` / `CS_MANFINISH` aliases. T1.8-T1.10 added Section D SNLT/FNLT/MS_Start violated+applied alerts symmetric with Section C. T2.11 rewrote Free Float on the binding-link's calendar so coincident lag-walked-forward pairs produce 0 slack. T2.12 made `_countWorkDaysBetween` signed (preserves negative-float forensic signal). T2.13 removed the `Math.max(0, ...)` FF clamp. T2.14 added `dateToNum` rollover guard (Feb 30 → 0 instead of silent rewrite to Mar 2). T2.15 rejects non-finite `lag_hr_cnt` from parseXER. T2.16 emits `invalid-calendar-falling-back` WARN when work_days is empty/invalid. T2.17 updated SUB_DAY_LAG_ROUNDED message to disclose V8 Math.round direction-bias. T3.18 added `remaining_duration` for P6 retained-logic EF anchoring. T3.19 pins LS=ES on backward pass when actual_start is present (in-progress, both engines). T3.20 guards `EF >= ES` in Section C EF-side helpers. T3.21 enumerates every unstarted predecessor + catches premature-start OoS. T3.22 emits `hammock-orphan` ALERT when no anchors resolve. T3.23 adds `duration_working_days` to hammocks. T3.24 emits `unrecognized-task-type` WARN. T4.25-T4.26 backport R8A-1 (MISSING_ACTUAL_START ES derivation) and ALAP-secondary-slot guard to the Python reference, rotating the SHA-256 pin. T4.27 was already in place on the JS side from T1.3.