I1951 — Evidence runs are typed, and a recording carries what its run measured

○READY wave 1 · p1 · implementation profile · runs alone

Part of test-evidence — Every verifiable claim and widget resolves to revision-bound test evidence, on every surface.

Objective

Add the run record, the measured provenance, the coverage record and the crate count rule of ADR 0087 decisions 2, 6 and 12, and feed run records to the one monotone rule, so that a recording states the commit and tree its run measured and only what ran.

Why

The recorder stamps the commit and tree at record time rather than what the run measured, a crate binary summary that says ok is read as a pass even when nothing ran, and an evidence record call leaves no record of the run beside the ledger.

Current state

record.rs stamps HEAD and the recorder's own tree; the crate parser reads ok as a pass without counting and without stripping colour codes; there is no run record, no coverage record, no evidence stamp and no --ledger local.

Desired state

evidence stamp measures a run's commit and tree; evidence record --provenance stamps them, refuses a measured commit that is not HEAD, and records T as unknown without a measurement; each call writes an EvidenceRunRecord; coverage is an EvidenceCoverage, current only for its own commit with a clean tree; a crate binary that ran no test or a filtered subset is a skip; --ledger local writes an advisory local ledger, and the default still writes the tracked one.

Scope

• apps/majordomus-cli/src/git/mod.rs
• apps/majordomus-cli/src/evidence/provenance.rs
• apps/majordomus-cli/src/evidence/run.rs
• apps/majordomus-cli/src/evidence/coverage.rs
• apps/majordomus-cli/src/evidence/record.rs
• apps/majordomus-cli/src/evidence/ledger.rs
• apps/majordomus-cli/src/evidence/mod.rs
• apps/majordomus-cli/src/evidence/freshness.rs
• apps/majordomus-cli/src/capability/builtin/evidence.rs
• apps/majordomus-cli/src/cli.rs
• apps/majordomus-cli/src/commands/evidence.rs
• scripts/ci/evidence-collect
• test/cases/505_a_recording_carries_what_its_run_measured.sh
• test/cases/506_a_crate_binary_that_ran_nothing_is_not_a_pass.sh
• docs/EVIDENCE.md
• docs/CLAIMS.yaml
• docs/claims
• .ai/repo/features/evidence.md

Out of scope

• A second copy of the monotone rule: run records feed the one I1948 writes
• Wiring the runners in CI, which is I1954's
• A version bump

Dependencies

• I1948✓DONE Evidence is judged at the presented revision, by one freshness function
• I1949✓DONE CI evidence is recorded clean, and its report is the tracked ledger's verdict

What waits on this

• I1953✕BLOCKED Evidence answers by subject, on every surface
• I1954✕BLOCKED Every runner reaches the ledger, through the recording branch

Acceptance criteria

• A report whose measured commit is not HEAD is refused, and one without a measurement is recorded with T unknown
• A crate binary that ran no test or a filtered subset is recorded as a skip, and one with a failed test as a failure, whatever colour codes its output carries
• Each evidence record call writes a run record carrying its commit, its tree, its totals, what was absent and what was dropped
• A clean failing run record caps a proven verdict at stale through the one monotone rule, naming the record
• evidence record with no ledger flag still writes the tracked ledger

Validation

• bash test/run.sh 505_a_recording_carries_what_its_run_measured
• bash test/run.sh 506_a_crate_binary_that_ran_nothing_is_not_a_pass
• bash test/run.sh 124_evidence
• cargo test --workspace --all-features

Evidence required

• provenance_measured_by_the_run
• crate_count_rule
• run_records_typed

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Risk

It needs the run reference of PR #577 (with I1949) and the tree state of I1948, and it is the second capability change of the chain, so it starts only after both have landed.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I1951.yaml. Read it back with majordomus plan show I1951.