suaveplan/openspec/archive/2026-04-29-slsa-spec-conformance/proposal.md

OpenSpec Change: slsa-spec-conformance

• Change ID: slsa-spec-conformance
• Package: @suaveplan/slsa
• Status: PROPOSED
• Date: 2026-04-26

Summary

Add **Verified by:** lines to every requirement in openspec/specs/slsa/spec.md and pin previously-unverified structural scenarios — SLSA-04 (no node:crypto in src/), SLSA-14 (sibling .md per non-test source), SLSA-15 (subpath exports), SLSA-16 (coverage floor) — with src/spec-conformance.test.ts. No public-API or behavioural changes.

Current state

@suaveplan/slsa ships in-toto v1 + SLSA v1.0 provenance generation, baseline + policy verification, CycloneDX 1.5 SBOM, DSSE PAE / envelope wrap / verify, RFC 6962 inclusion-proof verification, Sigstore Rekor v1 client (hashedrekord + intoto), policy evaluator, OTel adapter, structured errors with stable code registry, Zod schemas for every wire-format type, and assessSlsaLevel / detectEnvironment. Per-feature unit tests cover behaviour. The structural scenarios (no node:crypto import; sibling docs; subpath exports; coverage floor) were not pinned at runtime, and no requirement carried a **Verified by:** annotation.

The schemas-at-boundaries warns are by-design — every wire-format Zod schema is invoked at the parseProvenance / parseSbom / RekorEntrySchema.safeParse boundary inside src/schemas/ or src/rekor/. The conformance script flags them because the call site is inside src/schemas/, not because they are unused.

What changes

1. Annotate every requirement (SLSA-01 through SLSA-16) in the folded spec with a **Verified by:** line.
2. Add src/spec-conformance.test.ts covering SLSA-04 (no node:crypto import), SLSA-14 (sibling .md for every non-test, non-types, non-schema, non-bench, non-barrel source), SLSA-15 (every documented subpath export present), and SLSA-16 (vitest config declares ≥100 floor on all four metrics).
3. bun scripts/openspec-conformance.ts @suaveplan/slsa reports zero errors. The 26 schemas-at-boundaries warns remain by design.

Impact

• Public API unchanged.
• One new test file (~110 lines).
• openspec/specs/slsa/spec.md gains 16 **Verified by:** blocks.
• Coverage stays at the 100% floor (current 100/100/100/100 threshold).