spec: V18, generated canon formality replay hardening

  Promotes ENGI to V18 after V17's operator-facing demonstration closure by making generated/formal proof exhaustiveness the canonical acceptance surface.

  V18 adds generated proof matrices over the runtime proof corpus:

  - proof-member semantic matrix: 45 members x 8 scenarios x 2 branch modes = 720 cells
  - theorem-evidence matrix: 57 theorems x 8 scenarios x 2 branch modes = 912 cells
  - state-machine matrix: repeated-run, reset-after-run, mixed-deposit, and no-survivor groups = 200 cells
  - total V18 generated source/integration matrix surface: 1832 cells, all passing, no accepted exclusions

  This release extends the canonical _PROVEN_ generator so V18 proof appendices include generated matrix summaries, matrix pass/fail totals, state-machine group counts, and aggregate matrix proof status.
  `ENGI_SPEC_V18_PROVEN.md` is generated from proof-source commit `c675116` using the established V16/V17 proof-source commit convention, and `ENGI_SPEC.txt` now points to `V18`.

  Implementation closes the source parity gaps surfaced by the V18 matrix work:

  - adds `v18-matrices.js` matrix builders and closure assertions
  - wires V18 generated matrices into `_PROVEN_ rendering
  - adds targeted matrix package scripts and tests
  - records generated matrix coverage in runtime test coverage reporting
  - replaces hand-maintained workflow proof-family catalog expectations with catalog truth derived from `collectCanonicalProvenRuns(...)` and `buildCanonicalProvenData(...)`
  - closes the `.engi/eval-manifest.json` witness digest gap for inference-synthesis replay evidence
  - aligns authorization sensitive-flow theorem replay ids with the combined proof-family replay catalog
  - labels internal projections explicitly while preserving raw internal artifact visibility
  - stabilizes deterministic parsed-completion timestamps so generated V18 `_PROVEN_ output is byte-stable under check mode

  The V18 docs, notes, and parity matrix now describe the completed generated proof closure posture, the `704` artifact digest count, the closed `1832` generated cell surface, and the generated-only
  appendix contract.

  Verification:

  - `npm run typecheck`
  - `npm run test:proof-member-matrix`
  - `npm run test:theorem-evidence-matrix`
  - `npm run test:state-machine`
  - `node scripts/generate-engi-proven.mjs --version V18 --commit c675116 --output ENGI_SPEC_V18_PROVEN.md --check --allow-dirty`
  - `git diff --check`
  - `npm test` passes 115 / 115

Author: geraldarthurdavis

ENGI_SPEC.txt

@@ -1 +1 @@
-V17
+V18

ENGI_SPEC_V18.md

@@ -7,9 +7,10 @@
 - Companion parity ledger: `/Users/garrettmaring/Developer/ENGI/ENGI_SPEC_V18_SYSTEM_PARITY_MATRIX.md`
 - Prior canonical anchor: `/Users/garrettmaring/Developer/ENGI/ENGI_SPEC_V17.md`
 - Prior generated proof appendix: `/Users/garrettmaring/Developer/ENGI/ENGI_SPEC_V17_PROVEN.md`
-- Current canonical/latest target: `V17`
-- Last fully realized canonical target preserved in source: `V17`
-- V18 state: source-side generated matrix implementation complete in draft; canonical promotion and `ENGI_SPEC_V18_PROVEN.md` regeneration remain pending
+- Current generated proof appendix: `/Users/garrettmaring/Developer/ENGI/ENGI_SPEC_V18_PROVEN.md`
+- Current canonical/latest target: `V18`
+- Last fully realized canonical target preserved in source: `V18`
+- V18 state: source-side generated matrix implementation complete; `ENGI_SPEC.txt` points to `V18`; `ENGI_SPEC_V18_PROVEN.md` is generated from proof-source commit `c675116`
 - Current realization basis for this pass: `engi-demo`
 
 ## Version executive summary

ENGI_SPEC_V18_NOTES.md

@@ -7,8 +7,9 @@
 - Draft parity ledger: `/Users/garrettmaring/Developer/ENGI/ENGI_SPEC_V18_SYSTEM_PARITY_MATRIX.md`
 - Prior canonical anchor: `/Users/garrettmaring/Developer/ENGI/ENGI_SPEC_V17.md`
 - Prior generated proof appendix: `/Users/garrettmaring/Developer/ENGI/ENGI_SPEC_V17_PROVEN.md`
-- Current canonical/latest target: `V17`
-- V18 state: source implementation complete for generated proof-member, theorem-evidence, and state-machine matrices; canonical promotion and `ENGI_SPEC_V18_PROVEN.md` regeneration remain pending
+- Current generated proof appendix: `/Users/garrettmaring/Developer/ENGI/ENGI_SPEC_V18_PROVEN.md`
+- Current canonical/latest target: `V18`
+- V18 state: source implementation complete for generated proof-member, theorem-evidence, and state-machine matrices; `ENGI_SPEC_V18_PROVEN.md` is generated from proof-source commit `c675116`
 
 ## Why V18 starts from generated matrices
 
@@ -45,6 +46,8 @@ Those facts define the starting V18 arithmetic:
 - `8 x 2 x 4 = 64` mixed-deposit cells,
 - `8 x 2 x 4 = 64` no-survivor cells.
 
+The V18 generated appendix reports `artifactDigestCount=704` because V18 closes the `.engi/eval-manifest.json` digest gap for each of the 16 canonical proof runs.
+
 V18 must treat those as named matrices, not as vague "more tests."
 
 ## Important distinction from V17
@@ -137,7 +140,7 @@ The accepted source-side path is:
 6. Add matrix test entrypoints and package scripts only after the generated builders are stable.
 7. Add matrix summaries to `testCoverageReport`.
 8. Extend `renderCanonicalProvenMarkdown(...)` for V18 matrix summaries.
-9. Generate `ENGI_SPEC_V18_PROVEN.md` only at canonical promotion.
+9. Generate `ENGI_SPEC_V18_PROVEN.md` only at canonical promotion, from the proof-source commit convention used by V16/V17.
 
 ## Final source implementation answers
 
@@ -167,4 +170,5 @@ The source-side V18 implementation work is complete when:
 - `test:state-machine` executes `200` passing cells,
 - full `npm test` remains green,
 - no V18 document implies canonical promotion before `_PROVEN_` regeneration,
-- and `ENGI_SPEC.txt` remains on `V17` until the canonical V18 commit.
+- `ENGI_SPEC.txt` points to `V18`,
+- and `ENGI_SPEC_V18_PROVEN.md` check mode passes against the recorded proof-source commit.

ENGI_SPEC_V18_PROVEN.md

@@ -8,9 +8,10 @@
 - Prior canonical anchor: `/Users/garrettmaring/Developer/ENGI/ENGI_SPEC_V17.md`
 - Prior parity ledger: `/Users/garrettmaring/Developer/ENGI/ENGI_SPEC_V17_SYSTEM_PARITY_MATRIX.md`
 - Prior generated proof appendix: `/Users/garrettmaring/Developer/ENGI/ENGI_SPEC_V17_PROVEN.md`
-- Current canonical/latest target: `V17`
-- Last fully realized canonical target preserved in source: `V17`
-- V18 state: source-side matrix generators and tests implemented in draft; canonical promotion and `ENGI_SPEC_V18_PROVEN.md` regeneration remain pending
+- Current generated proof appendix: `/Users/garrettmaring/Developer/ENGI/ENGI_SPEC_V18_PROVEN.md`
+- Current canonical/latest target: `V18`
+- Last fully realized canonical target preserved in source: `V18`
+- V18 state: source-side matrix generators and tests implemented; `ENGI_SPEC_V18_PROVEN.md` is generated from proof-source commit `c675116`
 - Primary implementation surface to audit for this pass: `engi-demo`
 
 ## Purpose
@@ -57,7 +58,7 @@ This matrix is grounded in:
 
 | Area | Current source truth | V18 implementation expectation | Closure signal | Judgment |
 |---|---|---|---|---|
-| Root canon posture | `ENGI_SPEC.txt` points to `V17`; V17 canonical commit and V17 `_PROVEN_` are present | V18 must remain draft until matrix implementation and V18 `_PROVEN_` regeneration are complete | V18 docs state V17 as current canon and do not advance the pointer prematurely | closed for draft posture |
+| Root canon posture | `ENGI_SPEC.txt` points to `V18`; V17 canonical commit and V17 `_PROVEN_` remain present as prior canon | V18 promotion prep must advance the pointer only after matrix implementation and V18 `_PROVEN_` regeneration are complete | V18 docs state V18 as current target and record the generated appendix | closed |
 | V17 proof appendix input | `ENGI_SPEC_V17_PROVEN.md` records 16 runs, 9 families, 45 members, 57 theorems, and 688 artifact digests | V18 must use this as the arithmetic and audit seed for generated matrix work | V18 spec/notes/matrix cite those counts and derive required matrix sizes from them | closed for draft posture |
 | Proven generator structural checks | `buildCanonicalProvenData(...)` validates family catalog stability, member/theorem presence, replay catalog agreement, witness paths, required artifacts, metadata, and digest presence | V18 must extend beyond structural checks into generated semantic/evidence matrices | `buildV18Matrices(...)` consumes normalized proven data and adds proof-member/theorem/state summaries for V18 `_PROVEN_` rendering | closed |
 | Hand-maintained proof catalog expectations | `workflow.integration.test.js` formerly contained a literal proof-family/member/theorem expectation table | V18 must replace or subordinate this with generated/imported catalog truth to reduce drift | Workflow integration derives expected proof-family catalog from `collectCanonicalProvenRuns(...)` and `buildCanonicalProvenData(...)` | closed |
@@ -71,8 +72,8 @@ This matrix is grounded in:
 | Browser matrix | V17 E2E covers all `8 x 2 x 4 = 64` operator cells | V18 must keep browser coverage stable and avoid expanding it into proof-member/theorem cross-products | Browser tests remain green; new generated matrices live below the browser unless UI-specific gaps appear | accepted boundary |
 | Matrix artifact emission | Branch artifacts remain per-run; V18 matrices are generated from canonical proven data plus state-machine fixtures | V18 must emit or otherwise generate structured matrix JSON consumable by `_PROVEN_` | `buildV18Matrices(...)` returns JSON-compatible generated outputs for proof-member, theorem-evidence, and state-machine matrices; canonical files remain promotion-time outputs if written | closed |
 | Runtime coverage report | V17 `testCoverageReport` names unit/integration/e2e and major V17 validations | V18 must add generated matrix coverage honestly without inflating browser claims | Runtime report names generated proof-member, theorem-evidence, and state-machine matrices with cell counts totaling `1832` | closed |
-| `_PROVEN_` rendering | V17 `_PROVEN_` renders aggregate verdict, proof-family inventory, member summaries, theorem summaries, replay steps, run matrix, and run details | V18 `_PROVEN_` must add generated matrix summaries and accepted exclusions | Renderer includes V18 matrix totals, failed-cell tables, state-machine group counts, and aggregate matrix proof status | closed for generator; canonical file pending promotion |
-| Verification commands | V17 canonical verification used typecheck, full tests, generator write, generator check, and diff hygiene | V18 must preserve that stack and add targeted matrix scripts when implemented | Typecheck, targeted matrix tests, workflow integration, and full `npm test` pass; V18 generator write/check remains canonical-promotion-only | closed for source implementation |
+| `_PROVEN_` rendering | V17 `_PROVEN_` renders aggregate verdict, proof-family inventory, member summaries, theorem summaries, replay steps, run matrix, and run details | V18 `_PROVEN_` must add generated matrix summaries and accepted exclusions | `ENGI_SPEC_V18_PROVEN.md` includes V18 matrix totals, failed-cell tables, state-machine group counts, and aggregate matrix proof status | closed |
+| Verification commands | V17 canonical verification used typecheck, full tests, generator write, generator check, and diff hygiene | V18 must preserve that stack and add targeted matrix scripts when implemented | Typecheck, targeted matrix tests, workflow integration, full `npm test`, generator write, and generator check pass | closed |
 
 ---
 
@@ -195,4 +196,4 @@ The V18 pass is complete when:
 6. runtime coverage reporting includes V18 matrix counts,
 7. `_PROVEN_` rendering includes V18 matrix summaries,
 8. full verification is green,
-9. and `ENGI_SPEC_V18_PROVEN.md` is generated only as part of canonical V18 promotion.
+9. and `ENGI_SPEC_V18_PROVEN.md` is generated as part of canonical V18 promotion prep.

ENGI_SPEC_V18_SYSTEM_PARITY_MATRIX.md

@@ -0,0 +1,73 @@
+# ENGI Spec V19 Notes
+
+## Status
+
+- Scope: draft recommendations for the next specification after V18 generated proof closure
+- Prior canonical target: `V18`
+- Prior generated proof appendix: `/Users/garrettmaring/Developer/ENGI/ENGI_SPEC_V18_PROVEN.md`
+- Current V19 state: notes only; no V19 canonical pointer, spec file, parity matrix, or source implementation yet
+
+## Recommended V19 center
+
+V19 should focus on canonical replay determinism and promotion hardening.
+
+V18 proved that ENGI can generate and execute proof-member, theorem-evidence, and state-machine matrices from runtime proof truth.
+It also exposed the next sharper requirement: once more proof surfaces become digested, latent nondeterminism becomes canonical debt.
+The `.engi/eval-manifest.json` digest instability from volatile parsed-completion timestamps is the representative V19 lesson.
+
+The V19 question should be:
+
+Can ENGI prove that the same source, same canonical inputs, and same proof-source commit always regenerate the same canonical appendix and matrix artifacts?
+
+## Primary specification potentialities
+
+1. Deterministic canonical replay
+   V19 should require every canonical proof run to be hermetic and replay-stable.
+   Digested proof artifacts must not include wall-clock timestamps, process-order drift, random ids, filesystem-order drift, locale drift, environment drift, or unstated runtime inputs.
+
+2. Canonical promotion command
+   V19 should specify one promotion workflow that advances `ENGI_SPEC.txt`, regenerates `ENGI_SPEC_VN_PROVEN.md`, runs typecheck, targeted matrix tests, full tests, generator check mode, and diff hygiene, and emits the canonical commit message body.
+   This removes manual sequencing as a canonical risk.
+
+3. Generated matrix artifact materialization
+   V18 generates matrix data and renders summaries into `_PROVEN_`.
+   V19 should decide whether the full generated matrix artifacts are written as canonical structured JSON, so all cells are inspectable without reverse-engineering markdown.
+
+4. Negative proof mutation matrices
+   V19 should add generated fail-closed tests that mutate proof inputs and require deterministic rejection.
+   Initial mutation classes should include missing digest, corrupted replay step, dropped theorem verdict, mutated member payload, changed projection policy, missing witness path, and changed matrix axis.
+
+5. Source-level projection security matrix
+   V17 proved projection behavior through browser operator coverage.
+   V19 can add source-level projection-policy assertions across scenario, branch mode, and principal to prove policy visibility directly below the UI.
+
+6. Canonical diff and contract-change ledger
+   V19 should generate a version-to-version delta covering proof families, member ids, theorem ids, replay steps, witness artifacts, digest counts, matrix counts, and accepted boundary changes.
+   The goal is to make contractual changes explicit before a canonical bump.
+
+7. Deferred UX quality canon
+   Visual regression, accessibility, and performance budgets remain valid future canon.
+   They should not displace deterministic replay unless V19 is intentionally scoped as a production-quality UX release.
+
+## Recommended V19 acceptance decisions
+
+- Accept reproducible canon as V19's center.
+- Do not introduce new proof families unless determinism or mutation testing reveals a missing category.
+- Treat V18's `1832` generated matrix cells as the closed positive-proof baseline.
+- Treat V19 mutation matrices as negative-proof coverage, not as additions to the V18 positive matrix count.
+- Keep `_PROVEN_` generated-only and require check mode to be stable immediately after generation.
+- Preserve the V16/V17/V18 proof-source commit convention unless V19 explicitly replaces it with self-referential canonical commit generation.
+
+## First implementation path
+
+1. Inventory all volatile fields in canonical proof artifacts.
+2. Add a deterministic replay test that runs `_PROVEN_` generation twice and requires byte-identical output.
+3. Add a proof-artifact volatility scanner for timestamps, random-looking ids, unsorted collections, and environment-derived values.
+4. Add a promotion command or script that executes the canonical bump sequence.
+5. Add negative mutation matrix builders after replay determinism is green.
+6. Decide whether full matrix JSON artifacts become committed canonical outputs or generated side artifacts.
+7. Only then consider source-level projection-security matrices or UX quality gates.
+
+## V19 success condition
+
+V19 is complete when canonical promotion is reproducible, generated proof output is byte-stable, mutation coverage proves fail-closed behavior, and contractual deltas are generated rather than inferred from manual review.

ENGI_SPEC_V19_NOTES.md

@@ -849,30 +849,36 @@ export function createNeedMeasurementRuntime({
         }))}`
       };
     });
+    const deterministicParsedAt = '2026-04-09T00:00:00.000Z';
     const parsedCompletionEnvelopes = [
       buildParsedCompletionEnvelope({
         promptSurface: requirePromptSurface(promptSurfaces, 'need-measurement.task.v2'),
         parsedPayload: { task },
+        parsedAt: deterministicParsedAt,
         evidenceRefs
       }),
       buildParsedCompletionEnvelope({
         promptSurface: requirePromptSurface(promptSurfaces, 'need-measurement.failure-modes.v2'),
         parsedPayload: { failureModes },
+        parsedAt: deterministicParsedAt,
         evidenceRefs
       }),
       buildParsedCompletionEnvelope({
         promptSurface: requirePromptSurface(promptSurfaces, 'need-measurement.constraints.v2'),
         parsedPayload: { constraints },
+        parsedAt: deterministicParsedAt,
         evidenceRefs
       }),
       buildParsedCompletionEnvelope({
         promptSurface: requirePromptSurface(promptSurfaces, 'need-measurement.target-artifact-kinds.v2'),
         parsedPayload: { targetArtifactKinds },
+        parsedAt: deterministicParsedAt,
         evidenceRefs
       }),
       buildParsedCompletionEnvelope({
         promptSurface: requirePromptSurface(promptSurfaces, 'need-measurement.closure-criteria.v2'),
         parsedPayload: { closureCriteria },
+        parsedAt: deterministicParsedAt,
         evidenceRefs
       })
     ];