docs(af02): plan adversarial test strength

donors/af-02-adversarial-testing.yaml

@@ -0,0 +1,105 @@
+schema: commandf.donor-manifest/v1
+updated: 2026-08-27
+
+sources:
+  - id: rust-fuzz-cargo-fuzz
+    repository: https://github.com/rust-fuzz/cargo-fuzz
+    ref: 984c861c8dfea28055254c5f1d2659ab2cd63f76
+    tag: 0.13.2
+    license: MIT OR Apache-2.0
+    mode: [DEPEND_DEV_TOOL, STUDY, ADAPT_CONFIG]
+  - id: sourcefrog-cargo-mutants
+    repository: https://github.com/sourcefrog/cargo-mutants
+    ref: 8ab1dc786a1f61a4e370416cc6c68b81a704e917
+    tag: v27.1.0
+    license: MIT
+    mode: [DEPEND_DEV_TOOL, STUDY, ADAPT_CONFIG]
+  - id: taiki-e-cargo-llvm-cov
+    repository: https://github.com/taiki-e/cargo-llvm-cov
+    ref: be59056988acd54c7f984b7c85643daea3711b29
+    tag: v0.9.0
+    license: Apache-2.0 OR MIT
+    mode: [DEPEND_DEV_TOOL, STUDY, ADAPT_CONFIG]
+  - id: nextest-rs-nextest
+    repository: https://github.com/nextest-rs/nextest
+    ref: 60fa45f638ffc3f35e74afa65737f45fcd32db2a
+    tag: cargo-nextest-0.9.143
+    license: MIT OR Apache-2.0
+    mode: [DEPEND_DEV_TOOL, STUDY, ADAPT_CONFIG]
+  - id: proptest-rs-proptest
+    repository: https://github.com/proptest-rs/proptest
+    ref: a6f033cf83adfd55557b86e6065e6f4df054ec70
+    version: 1.11.0
+    license: MIT OR Apache-2.0
+    mode: [DEPEND_TEST_ONLY, STUDY, ADAPT_PATTERNS]
+
+adoption_decisions:
+  product_runtime:
+    use: none
+    rationale: AF-02 tools remain development/test assurance only.
+  fuzz:
+    use:
+      - "cargo-fuzz 0.13.2 at 984c861c8dfea28055254c5f1d2659ab2cd63f76"
+      - "libfuzzer-sys =0.4.13"
+      - "arbitrary =1.4.2 features=[derive]"
+      - "nightly-2026-08-25"
+  property:
+    use: [proptest =1.11.0]
+  flaky:
+    use: [cargo-nextest 0.9.143 at 60fa45f638ffc3f35e74afa65737f45fcd32db2a, --retries 2, --flaky-result fail]
+  coverage:
+    use: [cargo-llvm-cov 0.9.0 at be59056988acd54c7f984b7c85643daea3711b29]
+  mutation:
+    use: [cargo-mutants 27.1.0 at 8ab1dc786a1f61a4e370416cc6c68b81a704e917]
+
+immutable_acquisition_contract:
+  executable_mode: LOCKED_GIT_REV_SOURCE_BUILD
+  required_evidence: [exact upstream repository and commit, locked source/build command and dependency digest, installed executable SHA-256, version output SHA-256, compiler/cargo/target/features]
+  prohibited: [latest, branch-only identity, tag-only identity, self-update as retained proof identity, implementation-time acquisition-mode choice]
+
+registry_package_contract:
+  packages:
+    - syn =3.0.3 features=[full,visit] checksum=53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3
+    - proptest =1.11.0 default-features
+    - libfuzzer-sys =0.4.13 default-features
+    - arbitrary =1.4.2 features=[derive]
+  rule: exact crates.io checksum MUST be canonical before the package activation stack executes dependent evidence.
+
+normative_contract:
+  path: specs/016-af-02-adversarial-test-strength/verification-protocol.md
+  policy_files:
+    - specs/016-af-02-adversarial-test-strength/tool-policy.json
+    - specs/016-af-02-adversarial-test-strength/exclusion-policy.json
+    - specs/016-af-02-adversarial-test-strength/waiver-policy.json
+    - specs/016-af-02-adversarial-test-strength/required-check-policy.json
+    - specs/016-af-02-adversarial-test-strength/semantic-contract.json
+    - specs/016-af-02-adversarial-test-strength/verifier-input-policy.json
+  inventory_files:
+    - specs/016-af-02-adversarial-test-strength/enforcement-inventory.json
+  schema_files:
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-authority-baseline-v2.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-adversarial-proof-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-adversarial-proof-core-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-tool-policy-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-tool-lock-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-exclusion-policy-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-evidence-inventories-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-waiver-policy-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-required-check-policy-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-required-check-provenance-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-retained-authority-sources-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-semantic-contract-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-verifier-input-policy-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-surface-policy-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-resource-policy-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-corpus-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-coverage-policy-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-mutation-policy-v1.schema.json
+    - specs/016-af-02-adversarial-test-strength/schemas/af02-enforcement-inventory-v1.schema.json
+
+review_before_copy:
+  - verify exact source path and commit before copying upstream code
+  - preserve license notices where required
+  - prefer configuration/executable-tool adoption over vendoring
+  - re-audit every version/acquisition change through AF-01 workflow/dependency policy
+  - no adopted tool becomes commandF semantic authority

specs/016-af-02-adversarial-test-strength/consistency.md

@@ -0,0 +1,112 @@
+# AF-02 Consistency Analysis — Adversarial Test Strength
+
+Status: PLANNING_CANDIDATE
+
+Canonical planning base:
+
+```text
+main: 2b4033e237a5c74f3c45c12fbc7e7bfdc88067b1
+tree: 804ce63c15edb501574bd4aba9a9aadc5bfb07f3
+AF-01: CLOSED_CANONICAL
+```
+
+## Authority consistency
+
+AF-02 precedence is singular:
+
+1. repository governance/constitution/`AGENTS.md`;
+2. `verification-protocol.md`, checked-in machine policies and schemas;
+3. non-superseded `evidence-contracts.md`;
+4. `spec.md`;
+5. `plan.md`;
+6. `tasks.md`;
+7. this analysis and donor/provenance records.
+
+Authority-baseline v1 remains deprecated and non-implementable. Baseline v2 is the only authority-baseline schema.
+
+The final proof path and schema id remain `schemas/af02-adversarial-proof-v1.schema.json` / `commandf.af02-adversarial-proof/v1`. During planning it was strengthened into an envelope over the byte-identical prior schema now retained as `af02-adversarial-proof-core-v1.schema.json`. The core preserves the previous 25 contract roles and already contains the `enforcement_inventory` instance role. The envelope therefore adds 17 required extension roles, including only the standalone enforcement-inventory schema, so the final deterministic proof binds 42 distinct contract files without discarding or duplicating earlier structural constraints. The extension authority separately cross-binds the enforcement-inventory instance digest to the core role and the schema digest to the extension role.
+
+## Preserved external authority
+
+AF-02 does not weaken the active AF-01 assurance/review rulesets. Required contexts remain `assurance-proof`, `rust`, `scorecard`, each GitHub Actions integration id 15368.
+
+CF-06 remains HAPI FHIR `6.10.2`, source `d06577dbc5c62c74a2a8823fbc4830a3024d5b0b`, validator digest `a3addadfa18dfa23146a0a243b6ede68eaad92157a5407738c468bb3d7e4ccd6`, and R4 `hl7.fhir.r4.core@4.0.1`.
+
+CF-10 retained run `31916124080` remains `failure`. Its manifest/donor/run/artifact locators are validated against a closed schema and reconstructed from GitHub identity fields. AF-02 never relabels that production gate as PASS.
+
+## Reviewer finding closure
+
+The latest planning round is addressed as follows:
+
+- **Waiver authority:** `waiver-policy.json` + closed schema; zero initial waivers; canonical ancestry and mutant binding are named semantic-verifier algorithms.
+- **Required-check provenance:** `required-check-policy.json` freezes repository, GitHub Actions app, workflow ids/paths/base blobs and job names; runtime provenance has a dedicated schema including run/job/check-suite/head/base identities.
+- **Retained locator semantics:** exact repository/commit/blob/run/artifact URL relationships have a closed retained-authority schema; supplied URLs are reconstructed rather than trusted.
+- **Prose-only semantic relations:** `semantic-contract.json` freezes algorithm ids, verifier package/path/entrypoint and required negative-fixture ids. Missing implementation/test mapping is non-green.
+- **Candidate parser/resource boundary:** `verifier-input-policy.json` freezes preparse size/containment/symlink limits, JSON/YAML depth/record/string constraints, YAML safe-loader restrictions, aggregate wall-time/memory bounds, separate stdout/stderr byte ceilings, and observed-byte/overflow evidence.
+- **Proof-critical policy schemas:** separate closed schemas now exist for surface, resource, corpus, coverage and mutation policy instances before dependent execution.
+- **Enforcement-inventory closure:** `enforcement-inventory.json` and `schemas/af02-enforcement-inventory-v1.schema.json` freeze the 27-role activation inventory; the aggregate evidence schema requires exactly one runtime entry for each role.
+- **Proof binding:** the proof envelope retains the original 25-role core, where `enforcement_inventory` already exists, and adds 17 exact extension contract roles including only `enforcement_inventory_schema`; final authority digests cross-bind the core instance and extension schema without duplicating a contract path.
+
+## Anti-self-forgery consistency
+
+A candidate cannot define both the acceptance rule and its own success. A0 bootstraps policy/schema/verifier infrastructure only. After A0 canonicalization, the base-controlled `pull_request_target` gate executes canonical-base workflow/verifier/schema blobs, never candidate code, and parses candidate data only under the input-limit policy.
+
+A same-candidate waiver, source exclusion, mutation exclusion, coverage floor reduction, policy weakening, verifier weakening or locator substitution cannot make dependent evidence green.
+
+## Source and coverage consistency
+
+Surface discovery and coverage share the same Git-derived tracked Rust universe:
+
+```text
+crates/**/src/**/*.rs
+tools/**/src/**/*.rs
+```
+
+minus canonical-base source exclusions only. Missing, unknown, duplicate-normalized or out-of-root paths fail instead of becoming implicit exclusions.
+
+Coverage policy is frozen before percentages. Coverage remains diagnostic evidence, not semantic authority.
+
+## Mutation consistency
+
+Mutation target paths, tool identity, test command, timeout/retry/diagnosis, exclusion policy and waiver policy freeze before listing.
+
+Required membership is deterministic:
+
+```text
+all listed mutants in target scope
+minus exactly matched pre-frozen exclusions
+```
+
+There is no top-N, percentage, operator preference or post-result manual subset. A waiver resolves only through canonical waiver authority and cannot be introduced by the candidate it greens.
+
+## Required-check consistency
+
+Integration id 15368 alone is insufficient. Qualification binds each context to repository, GitHub Actions app identity, canonical-base workflow id/path/blob, workflow run/attempt, job name/id, exact head/base, pull_request event and success.
+
+## Parser and resource consistency
+
+The privileged/base-controlled verifier treats candidate files as hostile data. Size is checked before parsing. Symlinks/path escapes are rejected. JSON and YAML have explicit depth/item/string bounds. YAML aliases, merge keys and custom tags are prohibited. Aggregate file/record/byte, parser wall-time and memory limits are fixed. Parent-enforced stdout/stderr byte ceilings are fixed separately, and evidence retains observed bytes plus overflow classification for both streams. Parser exhaustion or output-limit breach is failure, not neutral topology.
+
+## Tool and corpus consistency
+
+Executable tools retain immutable source and installed-binary identity. Registry packages cannot activate with unresolved checksums.
+
+Corpus entries remain synthetic/publicly redistributable non-PHI only, <=256 KiB by default and <=8 MiB aggregate. Corpus/assertion/replay membership is bijective and independently reconstructed.
+
+## Nextest consistency
+
+The fixed retry-pass fixture uses retries 2 and flaky-result fail. First failure then retry pass remains failed AF-02 evidence with non-zero process exit. JUnit/stdout/stderr/exit are bound to one waited-for process and dedicated clean output mount.
+
+## Temporal boundary
+
+T005/T006 evidence lives in GitHub because a commit cannot contain proof of its own future exact-head CI/review/merge. No planning merge occurs until the current head qualifies, and no implementation authority exists until post-merge main/tree plus live AF-01 rulesets are re-read.
+
+## Current decision
+
+```text
+AF-02: PLANNING_CANDIDATE
+T005: OPEN
+T006: OPEN
+IMPLEMENTATION AUTHORITY: NOT_GRANTED
+NEXT AUTHORITY AFTER T006: STACK A0 ONLY
+```

specs/016-af-02-adversarial-test-strength/enforcement-inventory.json

@@ -0,0 +1 @@
+{"schema":"commandf.af02-enforcement-inventory/v1","policy_status":"PLANNING_FREEZE","entries":[{"role":"AF02_SCHEMA","required_from_stack":"A0","implementation_kind":"SCHEMA_SET","planned_path":"specs/016-af-02-adversarial-test-strength/schemas/","entrypoint":"validate-all"},{"role":"AUTHORITY_PROJECTOR","required_from_stack":"A0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/authority.rs","entrypoint":"project-authority"},{"role":"RETAINED_AUTHORITY_PROJECTOR","required_from_stack":"A0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/retained.rs","entrypoint":"project-retained"},{"role":"SURFACE_SCANNER","required_from_stack":"A0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/surface.rs","entrypoint":"scan-surface"},{"role":"SURFACE_POLICY_PARSER","required_from_stack":"A0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/surface.rs","entrypoint":"parse-surface-policy"},{"role":"RESOURCE_RUNNER","required_from_stack":"A0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/resource.rs","entrypoint":"run-bounded"},{"role":"RESOURCE_POLICY_PARSER","required_from_stack":"A0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/resource.rs","entrypoint":"parse-resource-policy"},{"role":"TOOL_ACQUISITION_VERIFIER","required_from_stack":"A0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/tool_lock.rs","entrypoint":"verify-tool-lock"},{"role":"CORPUS_MANIFEST_PARSER","required_from_stack":"A0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/corpus.rs","entrypoint":"parse-corpus"},{"role":"ASSERTION_REGISTRY_PARSER","required_from_stack":"A0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/corpus.rs","entrypoint":"parse-assertions"},{"role":"VERIFIER_INPUT_GUARD","required_from_stack":"A0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/input_guard.rs","entrypoint":"guard-inputs"},{"role":"BASE_POLICY_COMPARATOR","required_from_stack":"A0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/policy.rs","entrypoint":"compare-base-policy"},{"role":"SEMANTIC_CONTRACT_VERIFIER","required_from_stack":"A0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/semantic.rs","entrypoint":"verify-semantic-contract"},{"role":"REQUIRED_CHECK_PROVENANCE_VERIFIER","required_from_stack":"A0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/github_provenance.rs","entrypoint":"verify-required-checks"},{"role":"AF02_WORKFLOW","required_from_stack":"A0","implementation_kind":"WORKFLOW","planned_path":".github/workflows/af02-base-verifier.yml","entrypoint":"af02-base-verifier"},{"role":"AF02_ACTION_OR_SCRIPT","required_from_stack":"A0","implementation_kind":"SCRIPT","planned_path":".github/scripts/run_af02_base_verifier.sh","entrypoint":"run-af02-base-verifier"},{"role":"REPLAY_RUNNER","required_from_stack":"A1","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/replay.rs","entrypoint":"run-replay"},{"role":"RESULT_NORMALIZER","required_from_stack":"A1","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/replay.rs","entrypoint":"normalize-result"},{"role":"NEXTEST_RESULT_PARSER","required_from_stack":"B0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/nextest.rs","entrypoint":"parse-nextest"},{"role":"COVERAGE_REPORT_PARSER","required_from_stack":"B0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/coverage.rs","entrypoint":"parse-coverage"},{"role":"COVERAGE_POLICY_PARSER","required_from_stack":"B0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/coverage.rs","entrypoint":"parse-coverage-policy"},{"role":"MUTATION_INVENTORY_PARSER","required_from_stack":"C0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/mutation.rs","entrypoint":"parse-mutation-inventory"},{"role":"MUTATION_RESULT_PARSER","required_from_stack":"C0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/mutation.rs","entrypoint":"parse-mutation-results"},{"role":"MUTATION_POLICY_PARSER","required_from_stack":"C0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/mutation.rs","entrypoint":"parse-mutation-policy"},{"role":"WAIVER_POLICY_VERIFIER","required_from_stack":"C0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/waiver.rs","entrypoint":"verify-waivers"},{"role":"PROOF_BUILDER","required_from_stack":"C0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/proof.rs","entrypoint":"build-proof"},{"role":"PROOF_VERIFIER","required_from_stack":"C0","implementation_kind":"RUST_MODULE","planned_path":"tools/af02-verifier/src/proof.rs","entrypoint":"verify-proof"}],"closure_rule":"EXACT_ROLE_SET_NO_DUPLICATES_ACTIVE_PATHS_MUST_RESOLVE_AT_OR_AFTER_REQUIRED_STACK"}