# Capability Spec Delta: slsa (spec-conformance)

**Package**: `@suaveplan/slsa`
**Status**: PROPOSED

This delta annotates each existing requirement in `openspec/specs/slsa/spec.md` with a `**Verified by:**` line. No requirement semantics change.

## MODIFIED Requirements

| Requirement | Verified by |
|---|---|
| SLSA-01 Structured errors | `src/errors/slsa-error.test.ts` |
| SLSA-02 Zod schemas | `src/schemas/parse.test.ts` AND `src/schemas/parse.extra.test.ts` |
| SLSA-03 Canonical JSON | `src/provenance/canonical-json.test.ts` |
| SLSA-04 SHA-256 via `@suaveplan/crypto-hash` | `src/provenance/digest.test.ts` AND `src/spec-conformance.test.ts::"src/ does not import node:crypto"` |
| SLSA-05 Provenance generation | `src/provenance/provenance.test.ts` AND `src/provenance/provenance.extra.test.ts` |
| SLSA-06 Provenance verification | `src/verification/verification.test.ts` |
| SLSA-07 SBOM generation | `src/sbom/sbom.test.ts` |
| SLSA-08 Assessment | `src/assessment/assessment.test.ts` |
| SLSA-09 DSSE attestation envelope | `src/attestation/dsse/dsse.test.ts` |
| SLSA-10 Sigstore Rekor client | `src/rekor/rekor-client.test.ts` AND `src/rekor/rekor-client.extra.test.ts` |
| SLSA-11 Inclusion proof verification | `src/rekor/inclusion-proof.test.ts` AND `src/rekor/inclusion-proof.extra.test.ts` |
| SLSA-12 Policy evaluator | `src/policy/policy.test.ts` |
| SLSA-13 OTel audit events | `src/otel/slsa-otel.test.ts` AND `src/provenance/provenance.test.ts::"invokes otel adapter when supplied"` AND `src/rekor/rekor-client.test.ts::"emits otel upload event"` |
| SLSA-14 Feature-module layout | `src/spec-conformance.test.ts::"every feature module has its sibling .md"` |
| SLSA-15 Subpath exports | `src/spec-conformance.test.ts::"package.json exports include every documented subpath"` |
| SLSA-16 Coverage floor | `src/spec-conformance.test.ts::"vitest config sets a coverage floor at or above 100"` AND coverage gate |

## Newly added tests in this change

- `src/spec-conformance.test.ts` — pins SLSA-04 (no `node:crypto`), SLSA-14 (sibling docs), SLSA-15 (subpath exports), SLSA-16 (coverage floor).