V32 Gate 3: Prove deterministic artifact replay

Add the deterministic replay artifact package, volatility inventory, source-safety failure probes, and exact regeneration checker for V32 Gate 3.

Wire the gate-quality workflow and package scripts, widen the Gate 2 roadmap guard for later gates, and update the V32 specification family plus roadmap to track deterministic stable JSON replay.

Validated with pnpm run check:v32-gate1, check:v32-gate2, check:v32-gate3, @bitcode/protocol tests, V32 spec family checks, canonical input checks, canon posture drift checks, artifact regeneration, and git diff --check.

Author: geraldarthurdavis

.bitcode/v32-artifact-volatility-inventory.json

@@ -0,0 +1,85 @@
+{
+  "acceptedVolatileFields": [
+    {
+      "artifactPath": ".bitcode/v32-proof-coverage-matrix.json",
+      "classification": "context-bound",
+      "fieldPath": "generatedAt",
+      "normalizedValue": "2026-05-22T00:00:00.000Z",
+      "reason": "V32 generated artifacts use a fixed replay context timestamp so byte equality remains meaningful."
+    },
+    {
+      "artifactPath": ".bitcode/v32-artifact-volatility-inventory.json",
+      "classification": "context-bound",
+      "fieldPath": "generatedAt",
+      "normalizedValue": "2026-05-22T00:00:00.000Z",
+      "reason": "V32 generated artifacts use a fixed replay context timestamp so byte equality remains meaningful."
+    },
+    {
+      "artifactPath": ".bitcode/v32-deterministic-replay-report.json",
+      "classification": "context-bound",
+      "fieldPath": "generatedAt",
+      "normalizedValue": "2026-05-22T00:00:00.000Z",
+      "reason": "V32 generated artifacts use a fixed replay context timestamp so byte equality remains meaningful."
+    }
+  ],
+  "artifactId": "v32-artifact-volatility-inventory",
+  "blockingFindings": [],
+  "classificationCounts": {
+    "canonical-stable": 1,
+    "context-bound": 4
+  },
+  "command": "pnpm run generate:v32-deterministic-replay-artifacts",
+  "currentTarget": "V31",
+  "findingCount": 5,
+  "findings": [
+    {
+      "artifactPath": ".bitcode/v32-proof-coverage-matrix.json",
+      "classification": "canonical-stable",
+      "fieldPath": "$",
+      "reason": "artifact bytes match stable sorted JSON serialization",
+      "value": "stable-json-order"
+    },
+    {
+      "artifactPath": ".bitcode/v32-proof-coverage-matrix.json",
+      "classification": "context-bound",
+      "fieldPath": "generatedAt",
+      "reason": "generatedAt is fixed by V32 replay context",
+      "value": "2026-05-22T00:00:00.000Z"
+    },
+    {
+      "artifactPath": ".bitcode/v32-proof-coverage-matrix.json",
+      "classification": "context-bound",
+      "fieldPath": "generatedAt",
+      "reason": "V32 generated artifacts use a fixed replay context timestamp so byte equality remains meaningful.",
+      "value": "2026-05-22T00:00:00.000Z"
+    },
+    {
+      "artifactPath": ".bitcode/v32-artifact-volatility-inventory.json",
+      "classification": "context-bound",
+      "fieldPath": "generatedAt",
+      "reason": "V32 generated artifacts use a fixed replay context timestamp so byte equality remains meaningful.",
+      "value": "2026-05-22T00:00:00.000Z"
+    },
+    {
+      "artifactPath": ".bitcode/v32-deterministic-replay-report.json",
+      "classification": "context-bound",
+      "fieldPath": "generatedAt",
+      "reason": "V32 generated artifacts use a fixed replay context timestamp so byte equality remains meaningful.",
+      "value": "2026-05-22T00:00:00.000Z"
+    }
+  ],
+  "generatedArtifactPaths": [
+    ".bitcode/v32-proof-coverage-matrix.json",
+    ".bitcode/v32-artifact-volatility-inventory.json",
+    ".bitcode/v32-deterministic-replay-report.json"
+  ],
+  "generatedAt": "2026-05-22T00:00:00.000Z",
+  "passed": true,
+  "scannedArtifactPaths": [
+    ".bitcode/v32-proof-coverage-matrix.json"
+  ],
+  "schemaId": "bitcode.v32.artifactVolatilityInventory.v1",
+  "sourceCommit": "draft-gate-3-source-derived",
+  "sourceSafetyVerdict": "source-safe",
+  "version": "V32"
+}

.bitcode/v32-deterministic-replay-report.json

@@ -0,0 +1,50 @@
+{
+  "allReplayArtifactsByteEqual": true,
+  "artifactComparisons": [
+    {
+      "artifactPath": ".bitcode/v32-artifact-volatility-inventory.json",
+      "byteEqual": true,
+      "byteLength": 3276,
+      "firstDigest": "sha256:d31f4689ff0f08afa8044dbb394e117adb9f9a74ee6e78c3c4ae31c24624f278",
+      "secondDigest": "sha256:d31f4689ff0f08afa8044dbb394e117adb9f9a74ee6e78c3c4ae31c24624f278"
+    },
+    {
+      "artifactPath": ".bitcode/v32-proof-coverage-matrix.json",
+      "byteEqual": true,
+      "byteLength": 19340,
+      "firstDigest": "sha256:dad4dd6b12ed1c45b703ba88bffa589981d722e51bb298f52aec84ed16c4a4c8",
+      "secondDigest": "sha256:dad4dd6b12ed1c45b703ba88bffa589981d722e51bb298f52aec84ed16c4a4c8"
+    }
+  ],
+  "artifactId": "v32-deterministic-replay-report",
+  "command": "pnpm run generate:v32-deterministic-replay-artifacts",
+  "currentTarget": "V31",
+  "failureModeCoverage": [
+    "missing-path",
+    "stale-source-commit",
+    "malformed-schema",
+    "source-safety-violation",
+    "unstable-json-order"
+  ],
+  "generatedArtifactPaths": [
+    ".bitcode/v32-proof-coverage-matrix.json",
+    ".bitcode/v32-artifact-volatility-inventory.json",
+    ".bitcode/v32-deterministic-replay-report.json"
+  ],
+  "generatedAt": "2026-05-22T00:00:00.000Z",
+  "passed": true,
+  "replayCommands": [
+    "pnpm run generate:v32-proof-coverage-matrix",
+    "pnpm run generate:v32-deterministic-replay-artifacts"
+  ],
+  "replaySourceArtifacts": [
+    ".bitcode/v32-proof-coverage-matrix.json"
+  ],
+  "runCount": 2,
+  "schemaId": "bitcode.v32.deterministicReplayReport.v1",
+  "sourceCommit": "draft-gate-3-source-derived",
+  "sourceSafetyVerdict": "source-safe",
+  "version": "V32",
+  "volatilityBlockingFindingCount": 0,
+  "volatilityInventoryArtifact": ".bitcode/v32-artifact-volatility-inventory.json"
+}

.github/workflows/bitcode-gate-quality.yml

@@ -113,6 +113,7 @@ jobs:
             node scripts/check-v31-gate10-promotion-readiness.mjs --promotion-mode --skip-branch-check
             node scripts/check-v32-gate1-provation-roadmap-opening.mjs --skip-branch-check
             node scripts/check-v32-gate2-proof-matrix-inventory.mjs --skip-branch-check
+            node scripts/check-v32-gate3-deterministic-replay-artifact-stability.mjs --skip-branch-check
           else
             echo "Unexpected BITCODE_SPEC.txt pointer: $POINTER" >&2
             exit 1

BITCODE_SPEC_V32.md

@@ -8,7 +8,7 @@
 - Canonical proof-source commit: none until V32 promotion
 - Prior canonical anchor: `BITCODE_SPEC_V31.md`
 - Prior generated proof appendix: `BITCODE_SPEC_V31_PROVEN.md`
-- Generated structured artifact inventory: planned draft `.bitcode/v32-spec-family-report.json`, `.bitcode/v32-canonical-input-report.json`, `.bitcode/v32-canon-posture-drift-report.json`, generated Gate 2 `.bitcode/v32-proof-coverage-matrix.json`, later V32 proof/test coverage artifacts, V32 gate-quality and promotion workflow evidence, and `BITCODE_SPEC_V32_PROVEN.md` only after promotion
+- Generated structured artifact inventory: planned draft `.bitcode/v32-spec-family-report.json`, `.bitcode/v32-canonical-input-report.json`, `.bitcode/v32-canon-posture-drift-report.json`, generated Gate 2 `.bitcode/v32-proof-coverage-matrix.json`, generated Gate 3 `.bitcode/v32-artifact-volatility-inventory.json` and `.bitcode/v32-deterministic-replay-report.json`, later V32 proof/test coverage artifacts, V32 gate-quality and promotion workflow evidence, and `BITCODE_SPEC_V32_PROVEN.md` only after promotion
 - Source parity state: V32 source-side proof-family replay, deterministic artifact generation, scenario matrices, cross-surface regression coverage, browser/accessibility/visual evidence, testnet/mainnet-readiness rehearsal, and promotion-proof hardening are opened but not yet closed
 - State: draft target opened
 - Active canonical pointer during draft opening: `BITCODE_SPEC.txt` -> `V31`
@@ -243,6 +243,13 @@ Gate 3 deterministic replay precision:
 - volatile fields must be explicitly cataloged and normalized before equality checks;
 - stale artifact checks must identify missing path, stale source commit, malformed schema, or source-safety violation separately.
 
+Gate 3 closes the first V32 deterministic replay package with `.bitcode/v32-artifact-volatility-inventory.json` and `.bitcode/v32-deterministic-replay-report.json`.
+Those artifacts are generated by `pnpm run generate:v32-deterministic-replay-artifacts` and checked by `pnpm run check:v32-gate3`.
+The Gate 3 replay package regenerates `.bitcode/v32-proof-coverage-matrix.json`, compares two deterministic in-memory runs, records byte-level digest equality for generated proof artifacts, and requires stable JSON ordering for every generated artifact.
+The volatility inventory classifies accepted `generatedAt` fields as context-bound using a fixed replay timestamp and fails closed when unaccepted random, nonce, UUID, timestamp, `createdAt`, or `updatedAt` fields appear.
+The Gate 3 checker proves fail-closed behavior for `missing-path`, `stale-source-commit`, `malformed-schema`, `source-safety-violation`, and `unstable-json-order` cases.
+No Gate 3 generated artifact may contain provider tokens, service keys, database passwords, OpenAI keys, Vercel tokens, Supabase service-role material, protected AssetPack source, private prompts, or pre-settlement AssetPack source.
+
 Gate 4 Reading pipeline proof precision:
 
 - `ReadNeedComprehensionSynthesis` coverage names phases, PTRR agents, PTRR steps, ThricifiedGenerations, prompt templates, prompt parts, tool calls, typed outputs, telemetry, and storage records;
@@ -834,6 +841,8 @@ V32 continues operator-quality proof: Terminal workflow claims must be backed by
 | `.bitcode/v32-canonical-input-report.json` | yes | yes | records canonical input closure for active V31 plus V32 draft |
 | `.bitcode/v32-canon-posture-drift-report.json` | gate-dependent | yes | proves runtime/docs active/draft posture |
 | `.bitcode/v32-proof-coverage-matrix.json` | yes | yes | records source-safe V32 proof/test coverage inventory across promoted surfaces |
+| `.bitcode/v32-artifact-volatility-inventory.json` | yes | yes | records V32 accepted volatile fields, stable ordering findings, source-safety verdict, and blocking volatility count |
+| `.bitcode/v32-deterministic-replay-report.json` | yes | yes | records V32 deterministic replay byte comparisons and fail-closed artifact stability failure modes |
 | `BITCODE_SPEC_V32_PROVEN.md` | no | yes | generated proof appendix for promoted V32 |
 
 ### V32 specifying generated artifacts

BITCODE_SPEC_V32_DELTA.md

@@ -8,7 +8,7 @@
 - Canonical proof-source commit: none until V32 promotion
 - Prior canonical anchor: `BITCODE_SPEC_V31.md`
 - Prior generated proof appendix: `BITCODE_SPEC_V31_PROVEN.md`
-- Generated structured artifact inventory: planned draft `.bitcode/v32-spec-family-report.json`, `.bitcode/v32-canonical-input-report.json`, `.bitcode/v32-canon-posture-drift-report.json`, generated Gate 2 `.bitcode/v32-proof-coverage-matrix.json`, later V32 proof/test coverage artifacts, V32 gate-quality and promotion workflow evidence, and `BITCODE_SPEC_V32_PROVEN.md` only after promotion
+- Generated structured artifact inventory: planned draft `.bitcode/v32-spec-family-report.json`, `.bitcode/v32-canonical-input-report.json`, `.bitcode/v32-canon-posture-drift-report.json`, generated Gate 2 `.bitcode/v32-proof-coverage-matrix.json`, generated Gate 3 `.bitcode/v32-artifact-volatility-inventory.json` and `.bitcode/v32-deterministic-replay-report.json`, later V32 proof/test coverage artifacts, V32 gate-quality and promotion workflow evidence, and `BITCODE_SPEC_V32_PROVEN.md` only after promotion
 - Source parity state: V32 source-side proof-family replay, deterministic artifacts, test matrices, cross-surface regression, browser/accessibility/visual proof, testnet/mainnet-readiness rehearsal, and promotion-proof hardening are opened but not yet closed
 - State: draft target delta opened
 - Active canonical pointer during draft opening: `BITCODE_SPEC.txt` -> `V31`
@@ -108,6 +108,10 @@ Closure acceptance:
 - generated JSON artifacts have stable ordering, source-safe payloads, and no volatile fields outside explicit volatility inventories;
 - promotion proof generation fails closed on missing, stale, or malformed artifacts.
 
+Gate 3 source closure is `.bitcode/v32-artifact-volatility-inventory.json` plus `.bitcode/v32-deterministic-replay-report.json`, generated by `pnpm run generate:v32-deterministic-replay-artifacts` and checked by `pnpm run check:v32-gate3`.
+The replay report compares byte digests across two deterministic generated-artifact runs and the volatility inventory records the accepted context-bound `generatedAt` field for every V32 replay artifact.
+The checker must fail closed for `missing-path`, `stale-source-commit`, `malformed-schema`, `source-safety-violation`, and `unstable-json-order`, separating those failures so promotion diagnostics are repairable.
+
 ### Gate 4: Reading Pipeline Proof Coverage
 
 Gate 4 deepens proof over `ReadNeedComprehensionSynthesis` and `ReadFitsFindingSynthesis`.

BITCODE_SPEC_V32_NOTES.md

@@ -8,7 +8,7 @@
 - Current active draft target: `V32`
 - Prior canonical anchor: `BITCODE_SPEC_V31.md`
 - Prior generated proof appendix: `BITCODE_SPEC_V31_PROVEN.md`
-- Generated structured artifact inventory: planned `.bitcode/v32-spec-family-report.json`, `.bitcode/v32-canonical-input-report.json`, `.bitcode/v32-canon-posture-drift-report.json`, generated Gate 2 `.bitcode/v32-proof-coverage-matrix.json`, later V32 proof/test coverage artifacts, and `BITCODE_SPEC_V32_PROVEN.md` only at promotion
+- Generated structured artifact inventory: planned `.bitcode/v32-spec-family-report.json`, `.bitcode/v32-canonical-input-report.json`, `.bitcode/v32-canon-posture-drift-report.json`, generated Gate 2 `.bitcode/v32-proof-coverage-matrix.json`, generated Gate 3 `.bitcode/v32-artifact-volatility-inventory.json` and `.bitcode/v32-deterministic-replay-report.json`, later V32 proof/test coverage artifacts, and `BITCODE_SPEC_V32_PROVEN.md` only at promotion
 - Source parity state: V32 proof/test parity begins with Gate 1 and closes only through gate-specific implementation, tests, documentation, and workflow evidence
 - Scope: deeper provation and testing over promoted Terminal, Reading, Protocol/BTD, Auxillaries, MCP, ChatGPT App, API, ledger/database/object-storage, and protocol-demonstration surfaces.
 
@@ -61,6 +61,9 @@ Harden generated artifact repeatability:
 - stable JSON ordering and source-safe payloads;
 - volatility inventories for accepted variable fields;
 - fail-closed checks for stale, missing, malformed, or non-regenerable artifacts.
+- generated artifacts `.bitcode/v32-artifact-volatility-inventory.json` and `.bitcode/v32-deterministic-replay-report.json`;
+- generator command `pnpm run generate:v32-deterministic-replay-artifacts` and closure checker `pnpm run check:v32-gate3`;
+- required failure modes `missing-path`, `stale-source-commit`, `malformed-schema`, `source-safety-violation`, and `unstable-json-order`.
 
 ### Gate 4: Reading Pipeline Proof Coverage