Initial Commit

openspec/archive/2026-04-29-slsa-spec-conformance/proposal.md

@@ -0,0 +1,29 @@
+# OpenSpec Change: slsa-spec-conformance
+
+- **Change ID**: slsa-spec-conformance
+- **Package**: `@suaveplan/slsa`
+- **Status**: PROPOSED
+- **Date**: 2026-04-26
+
+## Summary
+
+Add `**Verified by:**` lines to every requirement in `openspec/specs/slsa/spec.md` and pin previously-unverified structural scenarios — SLSA-04 (no `node:crypto` in `src/`), SLSA-14 (sibling `.md` per non-test source), SLSA-15 (subpath exports), SLSA-16 (coverage floor) — with `src/spec-conformance.test.ts`. No public-API or behavioural changes.
+
+## Current state
+
+`@suaveplan/slsa` ships in-toto v1 + SLSA v1.0 provenance generation, baseline + policy verification, CycloneDX 1.5 SBOM, DSSE PAE / envelope wrap / verify, RFC 6962 inclusion-proof verification, Sigstore Rekor v1 client (hashedrekord + intoto), policy evaluator, OTel adapter, structured errors with stable code registry, Zod schemas for every wire-format type, and `assessSlsaLevel` / `detectEnvironment`. Per-feature unit tests cover behaviour. The structural scenarios (no `node:crypto` import; sibling docs; subpath exports; coverage floor) were not pinned at runtime, and no requirement carried a `**Verified by:**` annotation.
+
+The `schemas-at-boundaries` warns are by-design — every wire-format Zod schema is invoked at the `parseProvenance` / `parseSbom` / `RekorEntrySchema.safeParse` boundary inside `src/schemas/` or `src/rekor/`. The conformance script flags them because the call site is inside `src/schemas/`, not because they are unused.
+
+## What changes
+
+1. Annotate every requirement (SLSA-01 through SLSA-16) in the folded spec with a `**Verified by:**` line.
+2. Add `src/spec-conformance.test.ts` covering SLSA-04 (no `node:crypto` import), SLSA-14 (sibling `.md` for every non-test, non-types, non-schema, non-bench, non-barrel source), SLSA-15 (every documented subpath export present), and SLSA-16 (vitest config declares ≥100 floor on all four metrics).
+3. `bun scripts/openspec-conformance.ts @suaveplan/slsa` reports zero errors. The 26 `schemas-at-boundaries` warns remain by design.
+
+## Impact
+
+- Public API unchanged.
+- One new test file (~110 lines).
+- `openspec/specs/slsa/spec.md` gains 16 `**Verified by:**` blocks.
+- Coverage stays at the 100% floor (current 100/100/100/100 threshold).

openspec/archive/2026-04-29-slsa-spec-conformance/specs/slsa/spec.md

@@ -0,0 +1,31 @@
+# Capability Spec Delta: slsa (spec-conformance)
+
+**Package**: `@suaveplan/slsa`
+**Status**: PROPOSED
+
+This delta annotates each existing requirement in `openspec/specs/slsa/spec.md` with a `**Verified by:**` line. No requirement semantics change.
+
+## MODIFIED Requirements
+
+| Requirement | Verified by |
+|---|---|
+| SLSA-01 Structured errors | `src/errors/slsa-error.test.ts` |
+| SLSA-02 Zod schemas | `src/schemas/parse.test.ts` AND `src/schemas/parse.extra.test.ts` |
+| SLSA-03 Canonical JSON | `src/provenance/canonical-json.test.ts` |
+| SLSA-04 SHA-256 via `@suaveplan/crypto-hash` | `src/provenance/digest.test.ts` AND `src/spec-conformance.test.ts::"src/ does not import node:crypto"` |
+| SLSA-05 Provenance generation | `src/provenance/provenance.test.ts` AND `src/provenance/provenance.extra.test.ts` |
+| SLSA-06 Provenance verification | `src/verification/verification.test.ts` |
+| SLSA-07 SBOM generation | `src/sbom/sbom.test.ts` |
+| SLSA-08 Assessment | `src/assessment/assessment.test.ts` |
+| SLSA-09 DSSE attestation envelope | `src/attestation/dsse/dsse.test.ts` |
+| SLSA-10 Sigstore Rekor client | `src/rekor/rekor-client.test.ts` AND `src/rekor/rekor-client.extra.test.ts` |
+| SLSA-11 Inclusion proof verification | `src/rekor/inclusion-proof.test.ts` AND `src/rekor/inclusion-proof.extra.test.ts` |
+| SLSA-12 Policy evaluator | `src/policy/policy.test.ts` |
+| SLSA-13 OTel audit events | `src/otel/slsa-otel.test.ts` AND `src/provenance/provenance.test.ts::"invokes otel adapter when supplied"` AND `src/rekor/rekor-client.test.ts::"emits otel upload event"` |
+| SLSA-14 Feature-module layout | `src/spec-conformance.test.ts::"every feature module has its sibling .md"` |
+| SLSA-15 Subpath exports | `src/spec-conformance.test.ts::"package.json exports include every documented subpath"` |
+| SLSA-16 Coverage floor | `src/spec-conformance.test.ts::"vitest config sets a coverage floor at or above 100"` AND coverage gate |
+
+## Newly added tests in this change
+
+- `src/spec-conformance.test.ts` — pins SLSA-04 (no `node:crypto`), SLSA-14 (sibling docs), SLSA-15 (subpath exports), SLSA-16 (coverage floor).

openspec/archive/2026-04-29-slsa-spec-conformance/tasks.md

@@ -0,0 +1,7 @@
+# Tasks — slsa-spec-conformance
+
+- [x] Add `**Verified by:**` line under every `SLSA-NN` requirement in `openspec/specs/slsa/spec.md`.
+- [x] Add `src/spec-conformance.test.ts` covering SLSA-04 / SLSA-14 / SLSA-15 / SLSA-16 structural scenarios.
+- [x] Confirm `bun scripts/openspec-conformance.ts @suaveplan/slsa` reports zero errors.
+- [x] Confirm `bunx turbo lint typecheck test --filter=@suaveplan/slsa` is green.
+- [x] Confirm `bunx turbo test:coverage --filter=@suaveplan/slsa` meets the 100% floor.