[E05] Ingest observed proof without promoting claims

[TheAmericanMaker]

Context and scope

Part of the incremental CodeCartographer engineering evolution. Planned, not shipped. Read the agent handoff, vision/decisions, record contract, and implementation plan. Documentation baseline PR #410 is merged at bbdf6b1a8b3bc348aa9e8f20a409c66df087af13. Follow this issue's prerequisite gates before starting.

Host-executed/framework-tracked; preserve analysis state ABI, both Pi analysis guards, and current synthesis confirmation gates. Ordinary in-place changes accept zero external references. No implicit source execution, provider spend, GitHub write, release/deployment, or private-data publication. E01 owns schema/API/authority decisions; dependent workers consume its merged contract rather than inventing another.

Tracking: #398

Blocked by: #400, #401. Prerequisites must be merged, not merely started.

Objective: retain actual check outcomes and provenance while refusing missing, malformed, or misbound evidence.

Depends on: E02, E03. Files: create core/engineering/proofs.ts, tests/engineering-proofs.test.mjs, proof fixtures; update engineering exports.

Steps:

1. Write tests for passing/failing host-observed checks, CI-reported checks, manual observations, blocked environments, and agent-only claims.
2. Write negative cases for absent output/exit metadata, wrong attempt/snapshot/scenario, incomplete capture, stale proof, duplicate ingestion, out-of-root artifact references, and private data in exported summaries; run RED.
3. Implement normalization and create-only ingestion under the E01 schema. Preserve raw-local versus sanitized-export digest distinctions; ingestion does not execute commands or upload logs.
4. Exercise meaningful RED/GREEN proof pairs using a small deterministic fixture executed by the test harness; the framework only consumes the resulting observations.
5. Run GREEN/full gates and record the exact trust boundary.

Acceptance: a prose PASS cannot satisfy an observed proof obligation; failing or blocked checks cannot be promoted; a valid recorded observation retains snapshot/environment/provenance and safe artifact identity.

Out of scope: command runner, arbitrary filesystem importer, automatic secret-proof export, or claiming that a dishonest host cannot fabricate observations.

Required verification and handoff

• Run the named RED/GREEN tests, npm run build, npm test, and git diff --check; record actual results, not historical counts.
• Inspect current source and dependency PRs first. All new paths are proposed until their owning issue lands.
• Get independent review on the exact candidate; stop on missing authority or unresolved security design.
• Attach commit/PR, changed paths, observed proof, remaining limits, compatibility notes, and the next eligible issue.
• Keep shared barrel/registration/invariant edits small and coordinate them; do not absorb unrelated work.
• This issue does not authorize implementation of the later reuse/team/release backlog.

[TheAmericanMaker]

E05 delivered in #432 (1f22119)

core/engineering/proofs.ts ingests what a host reports about a check it
ran, and refuses to turn a claim into an observation.

The trust boundary, recorded exactly

CodeCartographer does not run checks. A host does, and reports what it saw.
This module therefore cannot establish that a result is true — a
dishonest host can fabricate an observation and it will be stored faithfully.
E05's scope excludes claiming otherwise, and the module header says so.

What it enforces: authority is derived, never read. Collector +
attestation via E01's proofAuthority, so authority: "observed" written
beside a prose PASS still yields a claimed proof that discharges nothing
under the verified policy. Adversarial review found no route around this
across 12 collector x attestation combinations, payload-supplied authority,
__proto__, getters, or a Proxy.

Refused: unknown attempt · snapshot of another attempt · undeclared
obligation · a proof not naming the obligation's scenario · a scenario not in
the change · a result contradicting its own exit code · a second write to an
existing proof id.

Retained but non-discharging: failed · blocked · claimed · unstable
snapshot (the tree moved during capture) · a non-current candidate · a
baseline snapshot · a concluded attempt. All truthful records of what ran.

Artifacts are identity-only. No bytes read, no command executed, nothing
uploaded. Export carries the sanitized digest and never the raw one.

Worth carrying forward: six invented guards

Six rules guarded states the E01 contract makes unrepresentable — a
snapshot_digest field, a redacted flag, an artifact path-traversal guard
(location is derived from the id, grammar [0-9a-f]{24}), a
timestamp-ordering rule contradicted by E01's own fixture, and two dead
sub-terms. All had passing tests. All were dead code.

A guard that cannot fire looks exactly like a guard that works. Only
mutation testing told them apart.

But the inverse error is just as easy, and I made it: I deleted the
role === "candidate" term because a mutation left the suite green, and that
one was reachable — it let a baseline-bound proof discharge. A surviving
mutation means the state is untested, not that the code is unnecessary.
Distinguishing the two requires asking whether the contract permits the
state.

1101/1101, build 0, all six checks green. Next: E06 (#404).