Add evidence-driven gates: facts registry, evidence tooling, provenance rules #205

Merged

weichen merged 8 commits from feature/evidence-driven-gates into main 2026-10-05 10:55:13 +00:00

Conversation 0 Commits 8 Files Changed 8

+353 -8

8 Commits

Author	SHA1	Message	Date
weichen	4b58491427	Record the sync checkpoint	2026-10-05 10:52:23 +00:00
weichen	e1009f475f	Record the final-HEAD quick-check evidence row	2026-10-05 10:52:22 +00:00
weichen	9337207906	Record results and verification summary on the task card	2026-10-05 10:52:17 +00:00
weichen	0123cec450	Sharpen the sync evidence warning to non-card changes only ... Why: evidence rows are written before their containing card commit, so a naive HEAD-diff would flag every task's evidence as stale and train people to ignore the warning. Evidence: bash -n clean; the live task-sync for this task exercises the new path (warning fires only when a non-.task diff follows an evidence row's HEAD). Impact: scripts/task.sh cmd_sync now excludes .task from the staleness diff; AGENTS.md wording aligned (three-output evidence via make evidence). Refs: task card evidence table; guidelines verification.md tool-written rule.	2026-10-05 10:51:39 +00:00
weichen	6518f6ed0a	Fix F2 verify command for the markdown-list token file format ... Why: facts-verify failed closed on first run — the real token file stores keys as markdown bullets ("- ACCESS_TOKEN=..."), so the ^-anchored sed match in the registry never fired; the earlier manual probe had used grep (anywhere-in-line) and passed, which is exactly the drift the registry re-verification exists to surface. Evidence: re-run recorded in the task card — [facts-verify] total=4 pass=4 fail=0 (sha256 919401b838d77909), after fixing the sed pattern to "^[ -]*ACCESS_TOKEN=". Impact: policy/facts.md F2 command now matches the actual file shape and the fact text documents the file format; no behavior change elsewhere. Refs: task card evidence table (failed run sha256 6c61e644395042fa, then pass).	2026-10-05 10:49:29 +00:00
weichen	efa701279f	Fix evidence CMD quoting and record first tool self-tests ... Why: the make-variable pass-through re-quoted CMD and broke any command containing quotes (caught by the redaction self-test before it could run). Evidence: redaction self-test now records 'token <redacted> hello' with quoting intact (row sha256 aae6a895); negative 'false' case earlier recorded exit=1 row and propagated rc — both in the task card evidence table. Impact: CMD now travels via environment (CMD="..." make evidence); SRC/TAIL stay make variables; usage strings updated in Makefile/AGENTS.md/task.sh template comment. Refs: task card evidence table; guidelines draft.10 tool-written-evidence rule.	2026-10-05 10:48:31 +00:00
weichen	ba83a17c11	Add evidence gates: facts registry, evidence tooling, and precheck checks ... Why: declarations were passing as capability; hand-transcribed outputs flowed through cards and PR bodies as if they were execution evidence, and stale external facts (e.g. the dead git-panel host) kept being trusted until burned. Evidence: guidelines draft.10 (PR Development-Guidelines#4, merged af199ee) pinned here; policy/facts.md F1-F4 each re-verified on 2026-10-05 before registration (endpoint version, token HTTP 200 via header only, SSH ls-remote, dead-host negative probe); scripts syntax-checked (bash -n); tool self-tests and make test recorded in the task card via the new make evidence. Impact: new AGENTS.md section (SELF/REPLAY/GATE, tool-written evidence, replay-on-review, zero-trust facts, honest-empty); make evidence/facts-verify; precheck gains [hooks]/[facts], task-sync gains stale-evidence-HEAD warning; task-start cards now embed the evidence table; gitlink advances to draft.10. Refs: task card .task/feature-evidence-driven-gates.md; guidelines CHANGELOG 0.1.0-draft.10.	2026-10-05 10:47:27 +00:00
weichen	fb99968922	Record the task card for feature-evidence-driven-gates	2026-10-05 10:41:39 +00:00