P8-A3.1 — research-only typed evidence report bridge prototype #149

Status

OPEN — RESEARCH_ONLY_TYPED_REPORT_BRIDGE_PROTOTYPE

Parent external gate: #145
Accepted research PR: #147
Selected architecture: REPORT_LAYER_TYPED_HEALTH_BRIDGE

Objective

Build the smallest executable first-party prototype that exports typed evidence/health already known inside ExecSurface without changing the public Alpha.5 raw-v2 contract.

The prototype must consume the internal BackendObservation boundary before typed collection-health information is discarded by the legacy public Observation return path.

Why this location

The external Probity integration demonstrated that reconstructing semantics from serialized raw-v2 forces consumers to rebuild information ExecSurface already knows internally.

A first-party bridge should therefore project existing internal evidence outward; it should not infer stronger semantics post hoc from an already lossy public JSON trace.

Prototype output — bounded

Research report v0 may contain only:

• producer/report schema identity;
• backend semantic profile / platform / architecture;
• typed collection health:
  • complete;
  • incomplete_loss;
  • incomplete_limit;
  • incomplete_capability;
  • incomplete_ambiguity;
  • error where representable;
• warning/ambiguity codes;
• bounded proposition records for facts already justified by the backend;
• typed evidence guarantees such as successful-operation result and runtime-fd path correlation;
• explicit limitations / unsupported capability state.

Hard prohibitions

The prototype must not:

• expose new file contents, argv/env, stdin, network payloads or arbitrary memory;
• add before/after file-state roots;
• add signing/custody/trusted-time claims;
• treat backend name as authority;
• invent exact byte counts not retained by evidence;
• alter raw schema v2;
• alter baseline/policy/verdict semantics;
• alter public CLI or GitHub Action;
• promote Semantics v3 wholesale;
• create a new public compatibility promise.

Gate chain

R0 — internal-boundary freeze

Prove the prototype reads only existing BackendObservation / raw observation facts and does not expand acquisition.

R1 — minimal deterministic report

Produce deterministic research-only JSON for:

• healthy successful fd-write effect;
• incomplete/ambiguous observation;
• unsupported capability.

R2 — non-inflation attacks

At minimum:

• incomplete/warning laundering;
• backend-name inflation;
• missing capability;
• path/process substitution;
• repeated effects;
• unsupported exact byte-count/state-root claim;
• source/profile mismatch.

R3 — live native proof

Use the native Linux x86_64 ptrace backend in test scope and demonstrate that the internal typed health is preserved into the report.

R4 — compatibility

Full CI + P9.3 compatibility must remain green.

R5 — decision

Choose exactly one:

• BRIDGE_PROTOTYPE_ACCEPTED_FOR_PUBLIC_API_DESIGN
• BRIDGE_PROTOTYPE_ACCEPTED_RESEARCH_ONLY_MORE_EVIDENCE_REQUIRED
• BRIDGE_PROTOTYPE_KILLED_AUTHORITY_RISK
• BRIDGE_PROTOTYPE_KILLED_NO_EXTERNAL_VALUE

Governance

This gate may validate a design path only. Public product/API integration requires a later separately authorized issue/PR and must not be inferred from a successful prototype.