W1-CI-CLOSURE: SDLC v1.2 AuthContract verification controls

[veraxis-protocol]

W1-CI-CLOSURE producer submission — reconciled with current main

• Original Wave 1 baseline: ce783851897b8ddbbe92fae2b098b8bee8e88f57
• Prior reviewed PR head: 442f020dbcdd0009f8f383bc88589f23fbc75996
• Imported current main: ea19609c0f9547a6edaf4765e03b5fc1a3e87e67
• Final reconciled producer head: fcc21aee65f8ba0a26fc407717a73a40766a99f0
• Merge parents: 442f020dbcdd0009f8f383bc88589f23fbc75996 + ea19609c0f9547a6edaf4765e03b5fc1a3e87e67
• Current-main diff: ea19609...fcc21ae
• Ahead/behind current main: 4 ahead / 0 behind; current main is an ancestor of the final head.

Reconciliation rationale

Current main was merged into the existing Wave 1 branch without rebase,
force-push, or history rewriting. Non-conflicting AC-039 improvements were
retained. The overlapping workflow and policy files preserve the strongest
compatible controls: least-privilege permissions, immutable Node-24-native
Action pins, controlled dependency constraints, PR merge-composition testing,
both public falsification surfaces, scheduled strict advisory coverage, PR
dependency review, no-network verification, and SBOM generation.

The merged SECURITY.md truthfully records that a verified private reporting
route is not established. Gate I is therefore NOT ESTABLISHED; the earlier
producer PASS was not preserved as a false claim. No licence grant was
invented, and Gate K remains NOT ESTABLISHED.

Local commands/results on final head

• make ci — 342 tests passed; bounded Wave 1 falsification 4/4; offline
  reinstall/import/tests/CLI passed; candidate SBOM generated with 2 components.
• python -m pip_audit --skip-editable — no known vulnerabilities found;
  editable authcontract distribution explicitly skipped.
• python falsify.py — AC-039 public harness 5/5 matched expected dispositions.
• README authcontract run-specimen ... and authcontract verify-receipt ...
  commands — both returned PASS / OK with exit 0.
• Workflow YAML parse — successful.
• git diff --check — successful.

Gate E–M producer matrix — canonical CURRENT-SDLC v1.2

Gate	Canonical gate	Disposition	Producer evidence / limitation
E	Human Repository Usability	PASS	README provides truthful clean-clone/install, meaningful valid/refusal CLI, expected output, integration, and boundary paths; the documented commands were re-executed on the final head.
F	Agent Usability	PASS	AGENTS.md gives real install, verification, falsification, CLI, evidence-reading, and limitation instructions.
G	Adoption Readiness	NOT ESTABLISHED	First-run and integration surfaces are truthful, but no adoption/conversion result is established and no CTA is treated as adoption proof.
H	Supply-Chain & Release Integrity	PASS	Immutable Node-24-native Action pins, controlled dependency resolution, dependency review, strict advisory scan, no-network check, and candidate SBOM are implemented. No package/release artifact is published, so artifact provenance/attestation is not claimed.
I	Security & Vulnerability Management	NOT ESTABLISHED	SECURITY.md defines supported scope, triage, scanner limits, and explicitly records that a verified private reporting route is not established. Dependency review and advisory scans are green bounded evidence, not an audit.
J	API & Versioning Integrity	PASS	Pre-1.0 Python/import, CLI, exit, reason-code, artifact, receipt, and compatibility surfaces are declared.
K	Machine-Readable Discovery & Licensing	NOT ESTABLISHED	Package metadata truthfully marks the no-license-grant state; no SPDX identity or usage grant exists or is invented.
L	Public Falsification Completeness	PASS	Wave 1 public 4/4 harness covers valid, unclassified-action, stale-fact, and receipt-tamper paths; retained AC-039 harness also passed 5/5.
M	Agent Interaction Observability	NOT ESTABLISHED	Attribution/dark-local and no-hidden-telemetry boundaries are documented, but no approved ingestion pipeline, hosted gateway, or MCP observability implementation is established.

Independent Adjudication remains separate for the designated reviewer and owner.

Exact-head GitHub-native evidence

• AuthContract Gate: run 32794197926 — success; merge composition ran 342 tests.
• PR CI: run 32794197934 — test (3.10) success; test (3.12) success; each ran make ci, 342 tests, 4/4 falsification, no-network verification, and SBOM.
• Push CI: run 32794195162 — test (3.10) success; test (3.12) success.
• PR Security: run 32794197933 — dependency-review success; Dependency advisory audit and SBOM success.
• Push Security: run 32794195165 — advisory audit and SBOM success; dependency-review skipped by explicit PR-only condition because dependency comparison is inapplicable to a push event.
• Dependabot workflow validation attached to the exact head — success.
• Node-runtime deprecation warnings across all five Actions runs — zero.

Historical failures remain visible. The prior offline-install backend failure was
remediated at 442f020dbcdd0009f8f383bc88589f23fbc75996; this reconciliation did not
rerun a deterministic failure without a fix and introduced no new red attempt.

Required declarations

• CI GREEN IS NOT ACCEPTANCE
• CI PASS IS NOT ACCEPTANCE
• NO HIDDEN TELEMETRY INTRODUCED
• NOT SELF-ADJUDICATED