fix: keep descriptive transaction plans non-executable

docs/specs/proofkit-spec-proof-core/requirements.v1.json

@@ -676,7 +676,7 @@
     {
       "requirementId": "REQ-PROOFKIT-SPEC-033",
       "ownerId": "proofkit.spec-proof-core",
-      "invariant": "The repository-transaction owner confines every effect to one explicit repository root; freezes a bounded canonical execution plan before effects; rejects non-canonical, reserved, symlinked, case-folding, Unicode-folding, and prefix-alias target identities; keeps staged payloads, backups, ownership records, and publish temporaries in one private transaction namespace; records each created directory by exact filesystem identity; and performs each target replacement by same-filesystem atomic rename. A bounded durable journal identifies the exact before-state prefix, applied-target count, and terminal result; apply fails closed on stale state, unknown control records, and cooperative concurrency; rollback removes only transaction-owned artifacts and restores exact bytes and modes; resume and rollback are state-compatible, action-stable, cancellation-aware, and replay-idempotent; terminal receipts preserve the complete observable result until a later valid transaction replaces them. These guarantees cover process interruption at every injected mutation boundary but do not claim filesystem-wide atomic visibility, power-loss durability beyond successful synchronization, protection from arbitrary readers, or safety against a non-cooperative same-user process mutating the private namespace.",
+      "invariant": "The repository-transaction owner confines every effect to one explicit repository root; freezes a bounded canonical execution plan before effects; rejects non-canonical, reserved, symlinked, case-folding, Unicode-folding, and prefix-alias target identities; keeps staged payloads, backups, ownership records, and publish temporaries in one private transaction namespace; records each created directory by exact filesystem identity; and performs each target replacement by same-filesystem atomic rename. A bounded durable journal identifies the exact before-state prefix, applied-target count, and terminal result; apply fails closed on stale state, unknown control records, and cooperative concurrency; rollback removes only transaction-owned artifacts and restores exact bytes and modes; resume and rollback are state-compatible, action-stable, cancellation-aware, and replay-idempotent; terminal receipts preserve the complete observable result until a later valid transaction replaces them. Native construction binds Apply to the complete transaction identity; public JSON re-admission remains descriptive even for empty payloads, while recovery retains its separate confined journal and staged-object admission. These guarantees cover process interruption at every injected mutation boundary but do not claim filesystem-wide atomic visibility, power-loss durability beyond successful synchronization, protection from arbitrary readers, or safety against a non-cooperative same-user process mutating the private namespace.",
       "claimLevel": "blocking",
       "riskClass": "critical",
       "proofBindingRefs": ["proofkit/requirement-bindings.json"],

internal/app/cli_contract_test.go

@@ -24,7 +24,7 @@ import (
 )
 
 const (
-	cliContractPublicABISHA256               = "0e246c0d26bebd39ca6d6747ee7e325cb73aaca4dc01d80fa63cb6dc4899155f"
+	cliContractPublicABISHA256               = "cc1fc5a55e00ea13e92d82edc3a3e3115cd9e69a00d08618fe2b1cefd25216d2"
 	maxAggregateFileReadBytesForContractTest = 64 << 20
 	maxPackageManifestBytesForContractTest   = 256 << 10
 	maxSourceFileBytesForContractTest        = 8 << 20

internal/app/integration_version_edge_test.go

@@ -1,12 +1,13 @@
 package app
 
 import (
+	"crypto/sha256"
+	"fmt"
 	"os"
 	"path/filepath"
 	"slices"
 	"testing"
 
-	"github.com/research-engineering/agentic-proofkit/internal/kernel/admission"
 	"github.com/research-engineering/agentic-proofkit/internal/kernel/commandroute"
 	"github.com/research-engineering/agentic-proofkit/internal/tools/releasechange"
 )
@@ -37,27 +38,18 @@ func TestIntegrationVersionEdgeClosesCompletePublicABIDiff(t *testing.T) {
 		t.Fatal("new public commands retained the previous complete ABI identity")
 	}
 
-	change, err := releasechange.Read(filepath.Join(repoRoot(t), releasechange.RecordPath))
+	changePath := filepath.Join(repoRoot(t), "internal/app/testdata/releases/v0.10.0", releasechange.RecordPath)
+	content, err := os.ReadFile(changePath)
+	if err != nil || fmt.Sprintf("%x", sha256.Sum256(content)) != "9240098569e1fcc1d9cd8137e1184a97a9ad31f10649dfff901f2d66d7f2b81b" {
+		t.Fatalf("archived integration release bytes changed: %v", err)
+	}
+	change, err := releasechange.Read(changePath)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if change.PreviousVersion != frozen.ReleaseVersion || change.Version != "0.10.0" || change.ChangeClass != "compatible" || len(change.BreakingChanges) != 0 || change.Migration.Required || len(change.Migration.Steps) != 0 || !slices.Equal(releaseChangeIDs(change.Additions), []string{"proofkit.agent-integration.freshness", "proofkit.agent-integration.source"}) {
 		t.Fatal("integration release record does not describe the exact compatible addition")
 	}
-	file, err := os.Open(filepath.Join(repoRoot(t), "package.json"))
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer file.Close()
-	manifest, err := admission.DecodeTypedJSON[struct {
-		Version string `json:"version"`
-	}](file, 64<<10)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if manifest.Version != change.Version {
-		t.Fatal("integration package version differs from its release record")
-	}
 	contracts, err := currentVersionEdgeCommandContracts(repoRoot(t), []string{"integration-check", "integration-source"})
 	if err != nil {
 		t.Fatal(err)

internal/app/testdata/releases/v0.10.0/release/change-record.v2.json

@@ -0,0 +1,38 @@
+{
+  "schemaVersion": 2,
+  "previousVersion": "0.9.0",
+  "version": "0.10.0",
+  "changeClass": "compatible",
+  "breakingChanges": [],
+  "additions": [
+    {
+      "changeId": "proofkit.agent-integration.freshness",
+      "summary": "Add integration check for explicit Codex or Claude repository paths; compare bounded current template bytes through confined read-only inspection without granting installation or host-activation authority."
+    },
+    {
+      "changeId": "proofkit.agent-integration.source",
+      "summary": "Add integration source to generate one bounded portable skill body and descriptor-owned path, with an identity bound to consumed registered CLI invocation contracts rather than package version or a host-specific executable."
+    }
+  ],
+  "migration": {
+    "required": false,
+    "steps": []
+  },
+  "platformRequirements": [
+    "Published Darwin package binaries require macOS 13.0 or later on arm64 and x86_64."
+  ],
+  "knownLimitations": [
+    "Adopt plan inventories only a fixed root-file catalog; it does not infer stack identity, inspect arbitrary source semantics, generate requirements, write files, or execute native evidence.",
+    "Transactional materialization writes only owner-admitted candidate artifacts under one explicit repository root; it does not infer requirement meaning, execute native evidence, approve merge or release, provide filesystem-wide atomic visibility to concurrent readers, or protect its private namespace from a hostile same-user process.",
+    "Agent workflow plans, prompts, text, and envelopes are derived guidance and do not execute agents, repository mutations, native witnesses, CI, release, rollout, or production operations.",
+    "Brief agent-route packets cap pretty JSON at 3072 bytes and may defer oversized argv to explicit full detail; the bound does not claim tokenizer-specific token counts.",
+    "Complete nested public structural contracts remain blocked under SCHEMA-01; current CLI contracts own exact root variants only.",
+    "Project status and next classify materialized repository structure only; they do not execute native verification, validate receipt currentness or trust, or declare workflow completion.",
+    "The selected requirement-source v2 codec remains internal; current requirement sources are not migrated and no source cutover is claimed.",
+    "TSX source parsing remains unsupported.",
+    "Integration source and check do not install, update, remove, activate, or execute a host skill. Managed lifecycle and observed host activation remain separate open work."
+  ],
+  "rollback": {
+    "strategy": "previous_admitted_version"
+  }
+}