chore: establish phase 0 baseline

2026-07-18 18:20:34 -04:00
commit b38da7d53f
42 changed files with 2618 additions and 0 deletions
@@ -0,0 +1,66 @@
+# Test evidence: Work Mode baseline
+
+- Date/time (UTC): 2026-07-18
+- Repository revision: uncommitted initial scaffold
+- Requirement IDs: R-001 through R-029 (structural traceability only)
+- Phase/gate: phase 0 / lightweight static baseline
+- Runtime: ChatGPT Work Mode container; Python 3.12; Git 2.51.1
+- Exact commands: `make static`, `python3 -m py_compile scripts/verify_repo.py`, `git diff --check`
+- Expected result: manifests/spec parse, identifiers are unique, every requirement is traced,
+  temporary naming is recorded, Python verifier compiles, and whitespace checks pass
+- Observed result: `PASS: Phase 0 static baseline (29 requirements traced)`; remaining checks passed silently
+- Logs/artifacts: none required; command output contains no credentials or personal provider data
+- Cleanup performed: generated Python bytecode ignored; no provider or user state accessed
+- Result: pass, with Rust compilation explicitly blocked because Rust is unavailable here
+
+## First desktop attempt
+
+The first local run correctly exposed two scaffold defects before compilation: source
+files were not in canonical Rustfmt form, and the workspace treated the 1.97.1 toolchain
+pin as its minimum supported compiler. The source was formatted and the MSRV was corrected
+to Rust 1.85 (the Edition 2024 baseline) while retaining 1.97.1 as the exact development
+and CI toolchain pin.
+
+The corrected workspace then passed Rustfmt, `cargo check`, all three core unit tests,
+Clippy with `-D warnings`, `kiln doctor`, and JSON doctor output on the user's
+EndeavourOS desktop. The output revealed that the active distro compiler was Rust 1.97.0,
+not the declared 1.97.1 pin. The result is retained as valid functional evidence, but it
+does not complete the reproducible-toolchain gate. `make verify` now checks the active
+compiler version before running Rust quality gates.
+
+## Final desktop rerun
+
+- Platform: EndeavourOS / Arch Linux package `rust 1:1.97.1-1`
+- Compiler: `rustc 1.97.1 (8bab26f4f 2026-07-14)`
+- Commands: `make verify`; preceding corrected run also executed both `kiln doctor` forms
+- Result: static baseline passed; exact compiler pin passed; Rustfmt passed; workspace and
+  all-target check passed; three of three core unit tests passed; Clippy passed with
+  warnings denied; doctor returned schema 1 and JSON status `ok`
+- Gate status: passed
+
+## Completed repository-policy baseline
+
+The subsequent Phase 0 audit added and verified the canonical 34,523-byte GNU AGPL v3
+license text, release/version policy, changelog, fixture policy, security-reporting
+policy, cargo-deny configuration, pinned audit-tool inventory, real placeholder scan,
+workspace/license/source audit, and local Markdown-link validation. The dependency-free
+workspace contains no external packages in `Cargo.lock`. `make static` passes all three
+dependency-free audit programs. The network-backed `make audit` gate remains pending.
+
+The first cargo-deny 0.20.2 execution rejected the local `kiln-core` path dependency as
+wildcarded because it lacked a version constraint. It also reported unused allowances in
+the speculative broad license list. The internal dependency now requires exact version
+`=0.0.1` while retaining its workspace path, and the license allowlist now contains only
+AGPL-3.0-or-later. Future dependency licenses require an explicit reviewed addition. A
+fresh `make verify` and `make audit` result is required.
+
+## Final Phase 0 audit rerun
+
+- Commands: `make verify`; `make audit`
+- Static baseline: passed, 29 requirement IDs traced
+- Workspace/license/source audit: passed
+- Temporary-name scan: passed, 29 private occurrences inventoried
+- Compiler: exact Rust 1.97.1 pin passed
+- Rustfmt, workspace/all-target check, three unit tests, and Clippy `-D warnings`: passed
+- cargo-deny 0.20.2: advisories, bans, licenses, and sources all passed
+- Phase 0 result: complete