suaveplan/openspec/archive/2026-04-29-slsa-spec-conformance/specs/slsa/spec.md

Capability Spec Delta: slsa (spec-conformance)

Package: @suaveplan/slsa Status: PROPOSED

This delta annotates each existing requirement in openspec/specs/slsa/spec.md with a **Verified by:** line. No requirement semantics change.

MODIFIED Requirements

Requirement	Verified by
SLSA-01 Structured errors	src/errors/slsa-error.test.ts
SLSA-02 Zod schemas	src/schemas/parse.test.ts AND src/schemas/parse.extra.test.ts
SLSA-03 Canonical JSON	src/provenance/canonical-json.test.ts
SLSA-04 SHA-256 via @suaveplan/crypto-hash	src/provenance/digest.test.ts AND src/spec-conformance.test.ts::"src/ does not import node:crypto"
SLSA-05 Provenance generation	src/provenance/provenance.test.ts AND src/provenance/provenance.extra.test.ts
SLSA-06 Provenance verification	src/verification/verification.test.ts
SLSA-07 SBOM generation	src/sbom/sbom.test.ts
SLSA-08 Assessment	src/assessment/assessment.test.ts
SLSA-09 DSSE attestation envelope	src/attestation/dsse/dsse.test.ts
SLSA-10 Sigstore Rekor client	src/rekor/rekor-client.test.ts AND src/rekor/rekor-client.extra.test.ts
SLSA-11 Inclusion proof verification	src/rekor/inclusion-proof.test.ts AND src/rekor/inclusion-proof.extra.test.ts
SLSA-12 Policy evaluator	src/policy/policy.test.ts
SLSA-13 OTel audit events	src/otel/slsa-otel.test.ts AND src/provenance/provenance.test.ts::"invokes otel adapter when supplied" AND src/rekor/rekor-client.test.ts::"emits otel upload event"
SLSA-14 Feature-module layout	src/spec-conformance.test.ts::"every feature module has its sibling .md"
SLSA-15 Subpath exports	src/spec-conformance.test.ts::"package.json exports include every documented subpath"
SLSA-16 Coverage floor	src/spec-conformance.test.ts::"vitest config sets a coverage floor at or above 100" AND coverage gate

Newly added tests in this change

• src/spec-conformance.test.ts — pins SLSA-04 (no node:crypto), SLSA-14 (sibling docs), SLSA-15 (subpath exports), SLSA-16 (coverage floor).