fix: close pre-pilot correctness and provenance invariants

CHANGELOG.md

@@ -1,6 +1,30 @@
 ## [unreleased]
 
-### Session 55 — fabric entity taxonomy + Smithville coverage summary (2026-08-05)
+### Pre-pilot correctness and provenance invariant closure (2026-08)
+
+- Continuity gate ordering: the analysis eligibility/continuity gate now
+  runs before any result is derived from finding counts, so an empty
+  finding set can no longer produce a "no route-state change" verdict
+  when UPDATE archive gaps or session resets make the absence of changes
+  unproven. (No tracked historical result changed.)
+- Artifact resolution consolidated: every artifact consumer (run page,
+  workbench, demo verifier, artifact audit) uses the single
+  containment-validating resolver; crafted or legacy artifact paths
+  (absolute, parent traversal, symlink escape, Windows normalization
+  hazards) cannot leave the configured artifact root.
+- Open events now require an explicit reviewed analysis cutoff with
+  recorded provenance before any Ready plan can exist; malformed open
+  manifests are rejected, legacy invalid plans are blocked at queue and
+  worker time before source access, and the cutoff participates in plan
+  identity.
+- Project-scope exclusions now apply to standalone `inim analyze` as
+  well as the catalog workflow, before any planning or source access;
+  the CLI warns when the policy file is absent.
+- Observed results and expectation assessments are exposed as separate,
+  evidence-scoped projections in the run API; stored verdict strings
+  remain as documented legacy fields.
+
+### Corrected MAN LAN entity taxonomy and Smithville coverage provenance (2026-08-05)
 
 - MAN LAN entity taxonomy correction: Ixia is test/measurement equipment
   (not a fabric attachment, peer, or AS node); WIX interconnect is

docs/DOMAIN.md

@@ -304,7 +304,16 @@ complete.
 
 Project scope is a reviewed project-owner decision, stored in
 `config/project-scope.toml` (schema v1) and loaded once per process by
-the web app, CLI, worker, and demo. It is ORTHOGONAL to the analytical
+the web app, CLI, worker, and demo. It is a universal first-party
+execution policy: the standalone `inim analyze` path applies the same
+reviewed exclusions as the catalog workflow, before any planning,
+broker discovery, archive acquisition, or MRT parsing (a scope-blocked
+analyze exits `EXIT_ANALYSIS_BLOCKED` and writes no outputs). The
+standalone `analyze` CLI has no catalog root: it loads the policy from
+`config/project-scope.toml` under the current working directory, and
+warns on stderr when that file is absent (the established empty
+all-Included policy applies for every caller in that case). It is
+ORTHOGONAL to the analytical
 applicability vocabulary: an exclusion never marks an event
 not-observable, failed, or invalid. Matching keys, in precedence order:
 exact external source ID, exact reviewed entity name, exact reviewed
@@ -314,6 +323,9 @@ after claim and cancels pre-execution jobs (`excluded_by_project_scope`);
 imports skip excluded manifests explicitly; demo verify fails when an
 excluded event is present; immutable runtime records are hidden from
 default views and reported by the read-only `project-scope audit`.
+Project scope is policy, not authentication or sandboxing: it constrains
+which subjects first-party commands analyze and publish, and does not
+protect a hostile local caller.
 
 ## Candidate grouping
 

docs/audits/2026-08-documentation-inventory.md

@@ -215,7 +215,7 @@ The following lists are compared with `git ls-files` by
 must be classified in a table above (or in `repository-inventory.json`
 for non-documentation files).
 
-### Tracked Markdown files (96, excluding `spec/`)
+### Tracked Markdown files (97, excluding `spec/`)
 
 ```
 .github/PULL_REQUEST_TEMPLATE.md
@@ -280,6 +280,7 @@ docs/audits/2026-08-incident-family-deferral.md
 docs/audits/2026-08-internal-evaluator-findings.md
 docs/audits/2026-08-manlan-ticket-readiness.md
 docs/audits/2026-08-non-noaa-ip-event-candidates.md
+docs/audits/2026-08-pre-pilot-invariant-closure.md
 docs/audits/2026-08-project-scope-noaa-removal.md
 docs/audits/2026-08-repository-truth-audit.md
 docs/audits/2026-08-second-network-neutrality.md
@@ -322,7 +323,7 @@ tests/fixtures/README.md
 
 
 
-### Tracked files under `docs/` (76)
+### Tracked files under `docs/` (77)
 
 ```
 docs/ADRs/CASE-STUDY-LAYER.md
@@ -368,6 +369,7 @@ docs/audits/2026-08-incident-family-deferral.md
 docs/audits/2026-08-internal-evaluator-findings.md
 docs/audits/2026-08-manlan-ticket-readiness.md
 docs/audits/2026-08-non-noaa-ip-event-candidates.md
+docs/audits/2026-08-pre-pilot-invariant-closure.md
 docs/audits/2026-08-project-scope-noaa-removal.md
 docs/audits/2026-08-repository-truth-audit.md
 docs/audits/2026-08-second-network-neutrality.md

docs/audits/2026-08-pre-pilot-invariant-closure.md

@@ -0,0 +1,74 @@
+# Pre-pilot invariant closure — incremental design checksum (2026-08)
+
+Historical audit, not normative. Applies the documented design-checksum
+method (see `docs/computational-model.md`) to the correction range
+`b2fde8161aef361a99b3df6f50c2eba7f9c0ee31..9a6354c20be5d80cb0d9a22bfa49199aa5866fd5`
+(Session 57, pre-pilot invariant closure). It is not a full design-recovery
+rerun; no external evaluator session occurred; no canonical analysis was
+rerun.
+
+## Data structures changed
+
+| Change | Before | After | Evidence | Compatibility | Tests |
+|--------|--------|-------|----------|---------------|-------|
+| Artifact containment primitive | inline absolute/parent checks in `resolve_artifact` | `is_safe_relative_path` shared primitive (rejects empty, absolute, parent traversal, drive-letter/UNC prefixes, backslash separators) | `src/catalog/artifact_path.rs` | none (internal) | `is_safe_relative_path_rejects_escape_forms` |
+| Run API view model | `run.verdict` + `run.assessment` raw | + structured `observed_result {kind,label}` and `expectation_assessment {kind,label}`; raw fields documented legacy | `load_run_json` (`src/catalog/web/view.rs`), `src/catalog/web/api.rs` | additive (new fields) | `api_exposes_structured_observed_result` |
+
+## Semantic identity changed
+
+| Change | Before | After | Evidence | Compatibility | Tests |
+|--------|--------|-------|----------|---------------|-------|
+| Canonical plan identity | `CanonicalPlan.analysis_end` = declared `event_window_utc.end` (empty for open events); the reviewed cutoff did not participate in the plan hash | `analysis_end` = reviewed `analysis_end_utc` for open events; the cutoff participates in plan identity | `CanonicalPlan::from_manifest` (`src/catalog/jobs/plan.rs`) | plan hashes of newly queued open-event runs differ; stored historical rows unchanged | `cutoff_participates_in_plan_hash_when_semantic` |
+
+## Invariants changed
+
+| Change | Before | After | Evidence | Compatibility | Tests |
+|--------|--------|-------|----------|---------------|-------|
+| Continuity gate ordering (F-1) | empty-finding fallback ran before the continuity gate | continuity gate runs before any finding-cardinality result derivation | `derive_verdict` (`src/assess.rs`) | completed-run verdict for gaps+zero-transitions changes from no-change to `InsufficientVisibility`; no tracked run demonstrated affected | `continuity_failure_precedes_empty_finding_fallback`, `continuity_gate_decision_table` |
+| Artifact resolver equivalence (F-2/F-3) | four resolvers; workbench missed some reviewed trees; demo fallback unvalidated | one resolver + one containment primitive on every consumer | `src/catalog/artifact_path.rs`, `src/catalog/workbench.rs`, `src/catalog/demo.rs`, `src/catalog/jobs/publish.rs` | all tracked artifact rows still resolve | `all_artifact_consumers_agree_on_validity`, `workbench_and_demo_resolver_equivalent` |
+| Open-event cutoff readiness (F-4) | open manifest could store a Ready plan without a reviewed cutoff/provenance | load rejects; plan Blocks; queue/worker require cutoff regardless of declared end; import requires recorded provenance | `src/manifest.rs`, `src/catalog/import.rs`, `src/catalog/jobs/plan.rs`, `src/worker.rs` | malformed open manifests now rejected at import; tracked manifests already conform | `open_event_ready_plan_requires_cutoff`, `open_event_ready_plan_requires_cutoff_provenance` |
+| Standalone scope boundary (F-5) | `inim analyze` never loaded project scope | `analyze_scope_block` rejects excluded subjects before planning/source access | `src/main.rs`, `docs/DOMAIN.md` | blocked analyze now exits `EXIT_ANALYSIS_BLOCKED`; no exclusions changed | `standalone_analyze_scope_boundary_is_explicit` |
+| Observed-result projection (F-6) | unrecognized stored verdicts rendered verbatim in the observed-result slot; API exposed raw verdict strings | neutral fallback label; structured API projections; raw fields documented legacy | `src/catalog/web/view.rs`, `src/catalog/web/api.rs`, `docs/reference/API.md` | additive API fields; historical rows readable | `legacy_verdict_does_not_override_current_projection` |
+| Changelog session-narrative (F-8) | `Session 55` heading tripped the docs audit; CI red | product-language heading; regression test | `CHANGELOG.md`, `tests/release_test.rs` | release-facing content preserved | `changelog_contains_no_session_narrative` |
+
+## Algorithms changed
+
+| Change | Before | After | Evidence | Compatibility | Tests |
+|--------|--------|-------|----------|---------------|-------|
+| Verdict derivation | empty-findings early return before continuity gate | continuity gate first | `derive_verdict` (`src/assess.rs`) | see F-1 invariant row | `continuity_gate_decision_table` |
+| Artifact resolution | consumer-specific candidate lists | one candidate search + containment validation | `resolve_artifact` | see F-2/F-3 | `git_checkout_and_packaged_source_resolver_equivalent` |
+
+## State transitions changed
+
+| Change | Before | After | Evidence | Compatibility | Tests |
+|--------|--------|-------|----------|---------------|-------|
+| Plan readiness for open events | Ready without cutoff possible via import | Blocked (`MissingAnalysisEndForOpenTicket`) | `build_plan_record` (`src/catalog/import.rs`) | catalog rows for invalid legacy input read Blocked | `open_event_ready_plan_requires_cutoff` |
+| Standalone analyze exit | proceeded to planning/analysis regardless of scope | exits `EXIT_ANALYSIS_BLOCKED` before source access for excluded subjects | `cmd_analyze` (`src/main.rs`) | documented exit code | `project_scope_checked_before_network_access_where_applicable` |
+
+## Effects changed
+
+- Standalone `analyze` now reads `config/project-scope.toml` (filesystem read) before any planning.
+- No network effect changed: scope checks and cutoff gates occur before broker discovery on every path.
+- No new write effects: blocked analyze writes no outputs.
+
+## Authority boundaries changed
+
+- Artifact path authority: `resolve_artifact` + `is_safe_relative_path` are now the single authority for analysis artifacts; document serving uses the same primitive plus its canonical check.
+- Run-result authority: the structured `observed_result`/`expectation_assessment` projections are the current interpretation; the stored `verdict`/`assessment` fields are explicitly legacy.
+- Scope authority: `config/project-scope.toml` applies to every first-party execution path (catalog workflow and standalone analyze).
+
+## Information-loss boundaries changed
+
+- Observed-result projection no longer forwards raw/unrecognized stored verdict strings into the observed-result slot (a neutral fallback is used); the raw value remains available as the legacy field.
+- No canonical evidence, snapshot, or report was rewritten; historical runs remain readable.
+
+## Complexity changed
+
+- `resolve_artifact` adds one canonicalization per existing candidate (bounded by the small candidate set; 118 demo-catalog rows verified).
+- No unbounded structures introduced.
+
+## Statements
+
+- No full design-recovery rerun.
+- No external evaluator session (pilot registry unchanged: zero).
+- No canonical analysis rerun; no source contacted; no archive acquired.

docs/audits/2026-08-repository-truth-audit.md

@@ -1,6 +1,6 @@
 # Repository truth audit — 2026-08
 
-Audit start HEAD: `0517aac` · audit date: 2026-08-04
+Audit start HEAD: `0517aac` · audit date: 2026-08-05
 
 This audit verifies that every tracked file is classified, that every current statement matches the implemented model, and that historical records and generated evidence are clearly distinguished. The machine-readable source of this document is `docs/audits/repository-inventory.json`; regenerate with `python3 scripts/build-repo-audit.py`. Paths are repository-relative only; no absolute local paths appear in this audit.
 
@@ -24,19 +24,19 @@ This audit verifies that every tracked file is classified, that every current st
 
 ## Summary
 
-Tracked files: **470** · inventory entries: **470**
+Tracked files: **472** · inventory entries: **472**
 
 | Category | Files |
 |---|---|
 | Immutable or generated evidence | 148 |
 | Production source | 106 |
 | Normative current documentation | 48 |
-| Historical decision record | 42 |
+| Historical decision record | 43 |
 | Reviewed case-study interpretation | 30 |
 | Script or developer tool | 25 |
 | Configuration | 24 |
 | Template or stylesheet | 16 |
-| Test source | 11 |
+| Test source | 12 |
 | Test fixture | 11 |
 | GitHub/community metadata | 4 |
 | Packaging or release metadata | 3 |
@@ -288,6 +288,7 @@ Tracked files: **470** · inventory entries: **470**
 | `docs/audits/2026-08-internal-evaluator-findings.md` | Historical decision record | maintainers | dated audit | no | historical | status and applicability reviewed in this audit | none | reviewed in this audit |
 | `docs/audits/2026-08-manlan-ticket-readiness.md` | Normative current documentation | maintainers | dated audit evidence | no | current | line-by-line reviewed in this audit | none | reviewed in this audit |
 | `docs/audits/2026-08-non-noaa-ip-event-candidates.md` | Historical decision record | maintainers | dated audit evidence | no | historical | status and applicability reviewed in this audit | none | reviewed in this audit |
+| `docs/audits/2026-08-pre-pilot-invariant-closure.md` | Historical decision record | maintainers | dated audit | no | historical | status and applicability reviewed in this audit | none | reviewed in this audit |
 | `docs/audits/2026-08-project-scope-noaa-removal.md` | Historical decision record | maintainers | dated audit evidence | no | historical | status and applicability reviewed in this audit | none | reviewed in this audit |
 | `docs/audits/2026-08-repository-truth-audit.md` | Normative current documentation | maintainers | repository-inventory.json + git state (rendered, reviewed content) | no | current | line-by-line reviewed in this audit | none | reviewed in this audit |
 | `docs/audits/2026-08-second-network-neutrality.md` | Historical decision record | maintainers | dated audit evidence | no | historical | status and applicability reviewed in this audit | none | reviewed in this audit |
@@ -506,6 +507,7 @@ Tracked files: **470** · inventory entries: **470**
 | `tests/fixtures/ris/updates.20190821.1600.gz` | Test fixture | maintainers | immutable public source snapshot | no | current | provenance reviewed in this audit | none | reviewed in this audit |
 | `tests/grnoc_reconciliation_test.rs` | Production source | developers | implementation | no | current | implementation comments audited in this audit | none | reviewed in this audit |
 | `tests/i2px_audit_test.rs` | Test source | maintainers | implementation behavior + fixtures | no | current | reviewed in this audit | none | reviewed in this audit |
+| `tests/invariant_register_test.rs` | Test source | maintainers | invariant register + implementation | no | current | reviewed in this audit | none | reviewed in this audit |
 | `tests/job_migration_test.rs` | Production source | developers | implementation | no | current | implementation comments audited in this audit | none | reviewed in this audit |
 | `tests/job_workflow_tests.rs` | Production source | developers | implementation | no | current | implementation comments audited in this audit | none | reviewed in this audit |
 | `tests/project_scope_enforcement_test.rs` | Test source | maintainers | implementation behavior + fixtures | no | current | reviewed in this audit | none | reviewed in this audit |

docs/audits/2026-08-wirthian-design-recovery.md

@@ -273,3 +273,27 @@ External evaluation sessions: **zero**. Pilot registry unchanged
 
 Navigation updated: `../README.md` (docs index), `./README.md`
 (audits index). No other documentation was modified.
+
+## Follow-up status (Session 57 — pre-pilot invariant closure)
+
+The findings below were addressed by
+[`2026-08-pre-pilot-invariant-closure.md`](2026-08-pre-pilot-invariant-closure.md).
+This section records status only; the historical findings above are not
+rewritten.
+
+| Finding | Status | Correction | Enforcement / tests | Residual limitation |
+|---------|--------|------------|---------------------|---------------------|
+| F-1 Continuity-gate bypass | resolved | gate runs before empty-finding fallback (`src/assess.rs`) | `continuity_failure_precedes_empty_finding_fallback`, `continuity_gate_decision_table`, `assessment_is_deterministic` | F-10 (historical occurrence) not demonstrated |
+| F-2 Duplicated artifact resolvers | resolved | all consumers use `resolve_artifact` or the shared primitive | `all_artifact_consumers_agree_on_validity`, `workbench_and_demo_resolver_equivalent`, `git_checkout_and_packaged_source_resolver_equivalent` | none identified |
+| F-3 Unvalidated root.join(rel) | resolved | `is_safe_relative_path` lexical containment + canonical containment for existing candidates | `artifact_symlink_escape_rejected`, `artifact_parent_traversal_rejected`, `artifact_absolute_path_rejected`, `missing_artifact_distinct_from_invalid_artifact_path` | none identified |
+| F-4 Storable Ready plan for open event without cutoff | resolved | load rejects; plan Blocks; queue/worker require cutoff regardless of declared end; import requires provenance | `open_event_ready_plan_requires_cutoff`, `open_event_ready_plan_requires_cutoff_provenance`, `worker_missing_cutoff_fails_loudly`, `source_fetch_time_not_implicitly_analysis_cutoff` | legacy rows are blocked at queue/worker before source access |
+| F-5 Standalone analyze has no project-scope enforcement | resolved by enforcement (Outcome A: universal first-party execution policy) | `analyze_scope_block` in `cmd_analyze` before planning/source access; boundary documented in `docs/DOMAIN.md` | `standalone_analyze_scope_boundary_is_explicit`, `project_scope_checked_before_network_access_where_applicable`, `standalone_output_cannot_silently_bypass_scoped_publication` | scope is policy, not sandboxing (documented) |
+| F-6 Expectation vocabulary in stored/API verdict strings | resolved (compatibility-narrowed) | structured `observed_result`/`expectation_assessment` projections; neutral fallback; raw fields documented legacy | `api_exposes_structured_observed_result`, `api_exposes_structured_expectation_assessment`, `legacy_verdict_does_not_override_current_projection`, `historical_runs_remain_readable` | the legacy `verdict`/`assessment` fields remain on stored rows and reports for compatibility |
+| F-7 WAL sidecars under read-only serving | remains open (accepted boundary) | not implemented (out of scope) | — | catalog opens read-write WAL; logical rows unchanged under GET (PV-2) |
+| F-8 Pre-existing red documentation CI | resolved | CHANGELOG entry rewritten in product language; render regenerated; regression test | `changelog_contains_no_session_narrative`; `scripts/audit-docs.sh` green | none |
+| F-9 Extraction-reuse predicate caveat | remains open (out of scope) | not implemented | — | origin-keyed extraction reuse may miss predicate-2-only streams at production scale |
+| F-10 Occurrence of F-1 in a historical real run | no tracked run demonstrated affected | static inspection of all 12 tracked `report.json` files found zero runs with the unknown-continuity + empty-findings combination | — | absence is demonstrated for the tracked set only; not proven for untracked runtime catalogs |
+
+Synthetic reproduction of the F-1 input combination is covered by the
+gate-ordering tests; that is not evidence that any historical run was
+affected.