# OpenSpec Change: slsa-spec-conformance

- **Change ID**: slsa-spec-conformance
- **Package**: `@suaveplan/slsa`
- **Status**: PROPOSED
- **Date**: 2026-04-26

## Summary

Add `**Verified by:**` lines to every requirement in `openspec/specs/slsa/spec.md` and pin previously-unverified structural scenarios — SLSA-04 (no `node:crypto` in `src/`), SLSA-14 (sibling `.md` per non-test source), SLSA-15 (subpath exports), SLSA-16 (coverage floor) — with `src/spec-conformance.test.ts`. No public-API or behavioural changes.

## Current state

`@suaveplan/slsa` ships in-toto v1 + SLSA v1.0 provenance generation, baseline + policy verification, CycloneDX 1.5 SBOM, DSSE PAE / envelope wrap / verify, RFC 6962 inclusion-proof verification, Sigstore Rekor v1 client (hashedrekord + intoto), policy evaluator, OTel adapter, structured errors with stable code registry, Zod schemas for every wire-format type, and `assessSlsaLevel` / `detectEnvironment`. Per-feature unit tests cover behaviour. The structural scenarios (no `node:crypto` import; sibling docs; subpath exports; coverage floor) were not pinned at runtime, and no requirement carried a `**Verified by:**` annotation.

The `schemas-at-boundaries` warns are by-design — every wire-format Zod schema is invoked at the `parseProvenance` / `parseSbom` / `RekorEntrySchema.safeParse` boundary inside `src/schemas/` or `src/rekor/`. The conformance script flags them because the call site is inside `src/schemas/`, not because they are unused.

## What changes

1. Annotate every requirement (SLSA-01 through SLSA-16) in the folded spec with a `**Verified by:**` line.
2. Add `src/spec-conformance.test.ts` covering SLSA-04 (no `node:crypto` import), SLSA-14 (sibling `.md` for every non-test, non-types, non-schema, non-bench, non-barrel source), SLSA-15 (every documented subpath export present), and SLSA-16 (vitest config declares ≥100 floor on all four metrics).
3. `bun scripts/openspec-conformance.ts @suaveplan/slsa` reports zero errors. The 26 `schemas-at-boundaries` warns remain by design.

## Impact

- Public API unchanged.
- One new test file (~110 lines).
- `openspec/specs/slsa/spec.md` gains 16 `**Verified by:**` blocks.
- Coverage stays at the 100% floor (current 100/100/100/100 threshold).