V38 Gate 5: Prove Inference Telemetry Disclosure

Adds the package-backed V38InferenceTelemetryDisclosureReport and deterministic disclosure-boundary artifact for source-safe inference telemetry rows, disclosure tiers, raw provider response boundaries, schema verdicts, retry/repair posture, and stream UI projection proof.

Wires generator/checker scripts, protocol exports/tests, gate/canon workflows, roadmap advancement, and V38 spec/docs parity closure for Gate 5.

Author: geraldarthurdavis

.bitcode/v38-disclosure-boundary-report.json

@@ -154,6 +154,9 @@ jobs:
               if [ -f scripts/check-v38-gate4-prompt-benchmark-report.mjs ]; then
                 node scripts/check-v38-gate4-prompt-benchmark-report.mjs --skip-branch-check
               fi
+              if [ -f scripts/check-v38-gate5-inference-telemetry-disclosure-report.mjs ]; then
+                node scripts/check-v38-gate5-inference-telemetry-disclosure-report.mjs --skip-branch-check
+              fi
             fi
           else
             echo "Unexpected BITCODE_SPEC.txt pointer: $POINTER" >&2

.github/workflows/bitcode-canon-quality.yml

@@ -283,6 +283,9 @@ jobs:
               if [ -f scripts/check-v38-gate4-prompt-benchmark-report.mjs ]; then
                 node scripts/check-v38-gate4-prompt-benchmark-report.mjs --skip-branch-check
               fi
+              if [ -f scripts/check-v38-gate5-inference-telemetry-disclosure-report.mjs ]; then
+                node scripts/check-v38-gate5-inference-telemetry-disclosure-report.mjs --skip-branch-check
+              fi
             fi
           else
             echo "Unexpected BITCODE_SPEC.txt pointer: $POINTER" >&2
@@ -368,6 +371,9 @@ jobs:
           if [ -f packages/protocol/test/v38-prompt-benchmark-report.test.js ]; then
             pnpm --dir packages/protocol exec node --test --test-force-exit test/v38-prompt-benchmark-report.test.js
           fi
+          if [ -f packages/protocol/test/v38-inference-telemetry-disclosure-report.test.js ]; then
+            pnpm --dir packages/protocol exec node --test --test-force-exit test/v38-inference-telemetry-disclosure-report.test.js
+          fi
           pnpm --filter @bitcode/protocol test
 
       - name: Test staged Reading route and Terminal harness contracts

.github/workflows/bitcode-gate-quality.yml

@@ -96,6 +96,9 @@ The artifact has `source-safe-prompt-benchmark-metadata` disclosure posture and
 
 Gate 5 binds inference execution to source-safe telemetry.
 It must stream phase, agent, step, Failsafe, ThricifiedGeneration, tool, prompt-template, interpolated-prompt, raw-response, parsed-output, schema-verdict, retry, repair, and failure evidence at the correct disclosure tier without leaking protected source, credentials, unpaid AssetPack contents, wallet private material, or settlement private payloads.
+Gate 5 is closed by the package-backed `V38InferenceTelemetryDisclosureReport` source and deterministic `.bitcode/v38-disclosure-boundary-report.json` artifact.
+The artifact has `source-safe-inference-telemetry-disclosure-metadata` disclosure posture and records 8 telemetry/disclosure rows, 13 required telemetry levels, 12 disclosure tier ids, 66 passed source predicates, and upstream proof roots for V35 telemetry taxonomy, V37 stream events, V38 inference inventory, V38 PTRR/Failsafe/Thricified stack, and V38 prompt benchmarking.
+The raw provider response boundary is private or root-only: public and reader-visible streams may show raw-response presence, roots, typed output shape, schema verdicts, retry/repair posture, and prompt/template identities, but never raw provider response content, raw protected prompt text, protected source, unpaid AssetPack source, credentials, wallet private material, or private settlement payloads.
 
 ### Gate 6: ReadNeedComprehensionSynthesis Inference Hardening
 
@@ -417,15 +420,15 @@ Generated canon for V38 includes source-safe `.bitcode/v38-*` artifacts, generat
 Generated artifacts must be reproducible, deterministic where possible, and blocked when source-safe payload rules fail.
 Inherited V19 reproducible-canon artifacts remain the baseline for deterministic generated proof.
 Inherited V20 operator-quality artifacts remain the baseline for operator-visible quality.
-Exact generated-artifact inventory matrix includes `.bitcode/v38-spec-family-report.json`, `.bitcode/v38-canonical-input-report.json`, `.bitcode/v38-canon-posture-drift-report.json`, `.bitcode/v38-inference-surface-inventory.json`, `.bitcode/v38-ptrr-failsafe-thricified-stack.json`, and later `.bitcode/v38-*` gate artifacts.
+Exact generated-artifact inventory matrix includes `.bitcode/v38-spec-family-report.json`, `.bitcode/v38-canonical-input-report.json`, `.bitcode/v38-canon-posture-drift-report.json`, `.bitcode/v38-inference-surface-inventory.json`, `.bitcode/v38-ptrr-failsafe-thricified-stack.json`, `.bitcode/v38-prompt-benchmark-report.json`, `.bitcode/v38-disclosure-boundary-report.json`, and later `.bitcode/v38-*` gate artifacts.
 V38 specifying generated artifacts include inference inventory, prompt benchmark, telemetry disclosure, depository search, AssetPack handoff, rehearsal, and promotion readiness reports.
 Shared generated-artifact fields: version, currentTarget, artifactRoot, sourceRoots, proofRoots, disclosureTier, generatedAt, and command.
 Artifact-specific generated payload fields: prompt ids, PromptPart ids, phase ids, agent ids, step ids, Failsafe ids, ThricifiedGeneration ids, tool ids, fit ids, ranking roots, and settlement roots.
 Artifact confidentiality and disclosability taxonomy: public, source-safe, buyer-visible, reviewer-visible, operator-only, and forbidden.
 
 ## validation canon
 
-Validation canon includes `pnpm run check:v38-gate1`, `pnpm run check:v38-gate2`, `pnpm run check:v38-gate3`, later V38 gate checks, `node scripts/check-bitcode-spec-family.mjs --version V38 --mode draft --current-target V37`, `node scripts/check-bitcode-canonical-inputs.mjs --current-target V37`, `node scripts/check-bitcode-canon-posture-drift.mjs --active-canon V37 --draft-target V38`, package tests, route tests, UI tests, prompt benchmark checks, telemetry redaction checks, and local/staging rehearsal checks.
+Validation canon includes `pnpm run check:v38-gate1`, `pnpm run check:v38-gate2`, `pnpm run check:v38-gate3`, `pnpm run check:v38-gate4`, `pnpm run check:v38-gate5`, later V38 gate checks, `node scripts/check-bitcode-spec-family.mjs --version V38 --mode draft --current-target V37`, `node scripts/check-bitcode-canonical-inputs.mjs --current-target V37`, `node scripts/check-bitcode-canon-posture-drift.mjs --active-canon V37 --draft-target V38`, package tests, route tests, UI tests, prompt benchmark checks, telemetry redaction checks, and local/staging rehearsal checks.
 
 ## promotion canon
 
@@ -490,6 +493,13 @@ Its current source-predicate contract is 69/69 passed predicates, 9 rows, 52 PTR
 
 V38 specifying generated artifacts include inference inventory, prompt benchmark, telemetry disclosure, depository search, AssetPack handoff, rehearsal, and promotion readiness reports.
 
+### V38InferenceTelemetryDisclosureReport
+
+`V38InferenceTelemetryDisclosureReport` is the Gate 5 source-safe inference telemetry and disclosure tier contract.
+It is generated to `.bitcode/v38-disclosure-boundary-report.json` as `source-safe-inference-telemetry-disclosure-metadata`.
+It binds phase, agent, PTRR step, Failsafe, ThricifiedGeneration, tool, prompt template, interpolated prompt, raw response, parsed output, schema verdict, retry, repair, and stream UI projection rows to allowed payload fields, forbidden payload classes, proof roots, storage targets, stream event kinds, fail-closed states, and source predicates.
+Its current count contract is 8 rows, 13 required telemetry levels, 12 disclosure tier ids, 66 passed predicates, no legacy source roots, and no public raw provider response, protected source, credential, wallet private material, private settlement payload, or unpaid AssetPack source visibility.
+
 ### Shared generated-artifact fields
 
 Shared generated-artifact fields: version, currentTarget, artifactRoot, sourceRoots, proofRoots, disclosureTier, generatedAt, and command.

BITCODE_SPEC_V38.md

@@ -125,6 +125,13 @@ Closure acceptance:
 - protected payloads remain blocked or redacted;
 - `pnpm run check:v38-gate5` validates event contracts, UI stream compatibility, API contracts, and redaction tests.
 
+Closure implementation:
+
+- `V38InferenceTelemetryDisclosureReport` is now package-backed in `packages/protocol/src/canonical/inference-telemetry-disclosure-report.js` and generated to `.bitcode/v38-disclosure-boundary-report.json`.
+- The generated artifact is `source-safe-inference-telemetry-disclosure-metadata` and covers pipeline phase, PTRR agent step, Failsafe sequence, ThricifiedGeneration, tool execution, prompt template interpolation, raw response to parsed output schema, and stream UI/storage projection rows.
+- The report binds 13 required telemetry levels and 12 disclosure tier ids to allowed payload fields, forbidden payload classes, proof roots, fail-closed states, V35 telemetry taxonomy roots, V37 stream-event roots, V38 Gate 2 inventory roots, V38 Gate 3 PTRR/Failsafe/Thricified roots, and V38 Gate 4 prompt benchmark roots.
+- The raw provider response boundary is private or root-only: public rows can expose raw response presence, roots, typed output shape, schema verdict, retry/repair posture, and source-safe inference audit shapes, but not raw provider response content, raw protected prompts, protected source, unpaid AssetPack source, credentials, private wallet material, or private settlement payloads.
+
 ### Gate 6: ReadNeedComprehensionSynthesis Inference Hardening
 
 Closure acceptance:

BITCODE_SPEC_V38_DELTA.md

@@ -171,6 +171,14 @@ The artifact deliberately stores prompt identities, source-safe fixture ids, typ
 The current generated report covers 7 benchmark rows, 13 fixtures, 24 typed-output quality expectations, 38 source predicates, 443 active PromptPart doc-comments, 39 complete Prompt doc-comments, 465 benchmark definitions, 275 PromptPart exports, and 85 Prompt constructions.
 Later V38 gates must use this report when streaming inference telemetry, hardening the two Reading pipelines, and applying Conversation/tool-prompt parity.
 
+## Gate 5 implementation notes
+
+Gate 5 closes the first source-safe inference telemetry and disclosure-tier contract by making the disclosure boundary package-backed, generated, tested, and workflow-checkable.
+`V38InferenceTelemetryDisclosureReport` and `.bitcode/v38-disclosure-boundary-report.json` record pipeline phase lifecycle, PTRR agent step lifecycle, FailsafeGenerationSequence lifecycle, ThricifiedGeneration lifecycle, tool execution lifecycle, prompt template interpolation, raw response to parsed output schema, and stream UI/storage projection rows as `source-safe-inference-telemetry-disclosure-metadata`.
+The artifact deliberately stores telemetry level ids, disclosure tier ids, source roots, proof roots, source predicate ids, allowed payload fields, forbidden payload classes, and fail-closed states rather than raw provider response content or raw protected prompt text.
+The current generated report covers 8 rows, 13 required telemetry levels, 12 disclosure tier ids, 66 source predicates, V35 telemetry taxonomy roots, V37 stream event roots, V38 inference inventory roots, V38 PTRR/Failsafe/Thricified stack roots, and V38 prompt benchmark roots.
+Prompt template identity, interpolated prompt presence, raw response presence, parsed typed output shape, schema verdicts, retry, repair, and inference audit shapes can stream at their disclosure tiers; protected source, unpaid AssetPack source, raw provider response content, credentials, private wallet material, and private settlement payloads remain blocked or private.
+
 ## V38 gate plan
 
 - Gate 1: V38 Inference Stack Roadmap And Spec Opening

BITCODE_SPEC_V38_NOTES.md

@@ -7,7 +7,7 @@
 - Current canonical/latest target: `V37`
 - Prior canonical anchor: `BITCODE_SPEC_V37.md`
 - Prior generated proof appendix: `BITCODE_SPEC_V37_PROVEN.md`
-- Generated structured artifact inventory: draft `.bitcode/v38-spec-family-report.json`, `.bitcode/v38-canonical-input-report.json`, `.bitcode/v38-canon-posture-drift-report.json`, `.bitcode/v38-inference-surface-inventory.json`, `.bitcode/v38-ptrr-failsafe-thricified-stack.json`, `.bitcode/v38-prompt-benchmark-report.json`, V38 gate-quality workflow evidence, and future V38 generated proof artifacts as gates close
+- Generated structured artifact inventory: draft `.bitcode/v38-spec-family-report.json`, `.bitcode/v38-canonical-input-report.json`, `.bitcode/v38-canon-posture-drift-report.json`, `.bitcode/v38-inference-surface-inventory.json`, `.bitcode/v38-ptrr-failsafe-thricified-stack.json`, `.bitcode/v38-prompt-benchmark-report.json`, `.bitcode/v38-disclosure-boundary-report.json`, V38 gate-quality workflow evidence, and future V38 generated proof artifacts as gates close
 - Source parity state: V38 source-side inference stack, prompt benchmarking, Reading pipeline, depository-search, telemetry, rehearsal, workflow, and promotion surfaces are draft-required until their gates close
 - Spec companion: `BITCODE_SPEC_V38.md`
 - Notes companion: `BITCODE_SPEC_V38_NOTES.md`
@@ -69,6 +69,11 @@ Gate 1 audit basis:
 - `packages/protocol/test/v38-prompt-benchmark-report.test.js`
 - `scripts/generate-v38-prompt-benchmark-report.mjs`
 - `scripts/check-v38-gate4-prompt-benchmark-report.mjs`
+- `.bitcode/v38-disclosure-boundary-report.json`
+- `packages/protocol/src/canonical/inference-telemetry-disclosure-report.js`
+- `packages/protocol/test/v38-inference-telemetry-disclosure-report.test.js`
+- `scripts/generate-v38-inference-telemetry-disclosure-report.mjs`
+- `scripts/check-v38-gate5-inference-telemetry-disclosure-report.mjs`
 
 No `_legacy/` source is active source truth.
 
@@ -86,6 +91,7 @@ No `_legacy/` source is active source truth.
 | Inference surface inventory | Gate 2 | `V38InferenceSurfaceInventory`, `.bitcode/v38-inference-surface-inventory.json`, protocol test, generator, checker, workflows | closed | Source-safe inventory covers Reading, Conversation, tool-definition prompt, interface entrypoint, prompt registry, and execution primitive families with 52 PTRR steps and later-gate gaps explicit. |
 | PTRR Failsafe and Thricified execution stack | Gate 3 | `V38PtrrFailsafeThricifiedStack`, `.bitcode/v38-ptrr-failsafe-thricified-stack.json`, protocol test, generator, checker, workflows | closed | Practical PTRR agents prove four steps, three Failsafe stages, three ThricifiedGeneration stages, 69 source predicates, and Gate 2 count binding with step-owned tools. |
 | PromptPart and Prompt benchmarking | Gate 4 | `V38PromptBenchmarkReport`, `.bitcode/v38-prompt-benchmark-report.json`, protocol test, generator, checker, workflows | closed | Source-safe benchmark report covers active Reading, Conversation, and tool-definition PromptParts and complete Prompts with 7 rows, 13 fixtures, 24 typed-output quality expectations, and 38 passed source predicates. |
+| Inference telemetry and disclosure tiers | Gate 5 | `V38InferenceTelemetryDisclosureReport`, `.bitcode/v38-disclosure-boundary-report.json`, protocol test, generator, checker, workflows | closed | Source-safe telemetry disclosure report covers phase, agent, PTRR step, Failsafe, ThricifiedGeneration, tool, prompt template, interpolated prompt, raw response root, parsed typed output shape, schema verdict, retry, repair, and stream UI projection rows with 8 rows, 13 telemetry levels, 12 disclosure tier ids, and 66 passed predicates. |
 
 ## V38 implementation checklist
 
@@ -101,6 +107,7 @@ No `_legacy/` source is active source truth.
 | Inference surface inventory | `.bitcode/v38-inference-surface-inventory.json` and `V38InferenceSurfaceInventory` are generated, tested, checked, documented, and workflow-wired as `source-safe-inference-surface-metadata` | closed |
 | PTRR stack artifact | `.bitcode/v38-ptrr-failsafe-thricified-stack.json` and `V38PtrrFailsafeThricifiedStack` are generated, tested, checked, documented, and workflow-wired as `source-safe-ptrr-failsafe-thricified-stack-metadata` | closed |
 | Prompt benchmark artifact | `.bitcode/v38-prompt-benchmark-report.json` and `V38PromptBenchmarkReport` are generated, tested, checked, documented, and workflow-wired as `source-safe-prompt-benchmark-metadata` | closed |
+| Inference telemetry disclosure artifact | `.bitcode/v38-disclosure-boundary-report.json` and `V38InferenceTelemetryDisclosureReport` are generated, tested, checked, documented, and workflow-wired as `source-safe-inference-telemetry-disclosure-metadata` with disclosure tier and raw provider response boundaries explicit | closed |
 | Inference stack vocabulary | V38 spec family names `PipelineExecution`, PTRR agents, Plan, Try, Refine, Retry, `FailsafeGenerationSequence`, `ThricifiedGeneration`, `ToolExecution`, `DocCodeToolPrompt`, and provider call boundaries | drafted |
 | Reading vocabulary | V38 spec family names `ReadNeedComprehensionSynthesis` and `ReadFitsFindingSynthesis` | drafted |
 | Depository search vocabulary | V38 spec family names lexical, symbolic, path, metadata, measurement, embedding/vector, provider-specific channels, candidate deposits, ranking, thresholds, and selected-fit provenance | drafted |
@@ -169,9 +176,25 @@ No `_legacy/` source is active source truth.
 | Count contract is explicit | 7 rows, 13 fixtures, 24 typed-output quality expectations, 38 source predicates, 443 PromptPart doc-comments, 39 complete Prompt doc-comments, 465 benchmark definitions, 275 PromptPart exports, and 85 Prompt constructions | closed |
 | Gate checker is wired | `pnpm run check:v38-gate4`, package test, generator check, gate/canon workflows | closed |
 
+## Gate 5 Parity
+
+| Requirement | Source evidence | Current V38 judgment |
+| --- | --- | --- |
+| Telemetry disclosure source is package-owned | `packages/protocol/src/canonical/inference-telemetry-disclosure-report.js`, `packages/protocol/src/index.js`, `packages/protocol/src/index.d.ts` | closed |
+| Deterministic artifact exists | `.bitcode/v38-disclosure-boundary-report.json` | closed |
+| Source-safe disclosure posture is explicit | `source-safe-inference-telemetry-disclosure-metadata`, disclosure tier ids, forbidden payload classes, no protected source, credentials, private wallet material, private settlement payload, or unpaid AssetPack source | closed |
+| Pipeline phase rows are covered | `storePhaseStart`, `storePhaseComplete`, `phase-start`, `phase-complete`, phase input/output summaries | closed |
+| PTRR agent step rows are covered | agent start/complete events, Plan/Try/Refine/Retry factories, source-safe step traces | closed |
+| Failsafe rows are covered | prepare-context, chunk-then-sum, stitch-until-complete, retry, repair, prompt-pruned trace posture | closed |
+| ThricifiedGeneration rows are covered | Reason, Judge, StructuredOutput, prompt template ids, interpolation roots, raw response roots, parsed typed output shape, schema verdicts | closed |
+| Tool rows are covered | `ToolExecution`, tools namespace, invocation/result events, tool input/output/error shape telemetry | closed |
+| Stream UI projection is covered | Terminal harness stream snapshots, `readingPipelineTelemetry`, `inferenceAudit`, rich execution log metadata, V37 stream UI parity | closed |
+| Count contract is explicit | 8 rows, 13 required telemetry levels, 12 disclosure tier ids, 66 source predicates, V35/V37/V38 proof roots | closed |
+| Gate checker is wired | `pnpm run check:v38-gate5`, package test, generator check, gate/canon workflows | closed |
+
 ## Completion condition
 
-Gate 4 closes when `pnpm run check:v38-gate4`, the V38 prompt benchmark report generator check, Gate 3 PTRR/Failsafe/Thricified stack checks, Gate 2 inventory checks, V38 draft spec-family validation over V37, V37/V38 canon-posture drift validation, canonical input validation for V37, strict V38 spec quality, protocol tests, workflow wiring checks, secret scans, and diff hygiene all pass on `v38/gate-4-promptpart-prompt-benchmarking`.
+Gate 5 closes when `pnpm run check:v38-gate5`, the V38 inference telemetry disclosure report generator check, Gate 4 prompt benchmark checks, Gate 3 PTRR/Failsafe/Thricified stack checks, Gate 2 inventory checks, V38 draft spec-family validation over V37, V37/V38 canon-posture drift validation, canonical input validation for V37, strict V38 spec quality, protocol tests, workflow wiring checks, secret scans, and diff hygiene all pass on `v38/gate-5-inference-telemetry-disclosure-tiers`.
 
 ## accepted boundaries