docs(cf12): close deterministic impact convergence

specs/013-cf-12-impact/convergence.md

@@ -0,0 +1,122 @@
+# CF-12 Convergence — Deterministic Impact Analysis
+
+Status: CONVERGENCE_CANDIDATE — this record is not canonical until the docs-only closeout PR is itself qualified and merged.
+
+## Canonical implementation merges
+
+- Stack A PR: `#26` — `feat(impact): add deterministic blast-radius library`
+  - exact qualified head: `9fa948cb2ad0110cd4288c330a5bc8b977472418`
+  - merge commit: `d46591f0f7224d49fda0d89a6a79cc418fba534e`
+- Stack B PR: `#27` — `feat(impact): ship deterministic commandf impact`
+  - exact qualified head: `6d8e22b1d8c999256692052d473ba3c27effc972`
+  - merge commit: `9e462cbb5c0bd05cf2219e2283f09bfbc8a51720`
+- T022 follow-up evidence PR: `#28` — `test(impact): prove reverse package exposure through CLI`
+  - exact final qualified head: `c874c8c665a053d3022b6592a6dcf2a9f9c88349`
+  - exact tree: `0ab82f0d8fb19d88ddcb0af1fbc5a4cd8535b765`
+  - merge commit: `71c5c4372a829ca6b26846acad0a8ded44f1e1ba`
+  - merged main tree: `0ab82f0d8fb19d88ddcb0af1fbc5a4cd8535b765`
+
+The T022 follow-up changes tests only. No production behavior changed after Stack B.
+
+## Exact-head workflow qualification
+
+Final implementation/evidence head:
+
+```text
+head  c874c8c665a053d3022b6592a6dcf2a9f9c88349
+tree  0ab82f0d8fb19d88ddcb0af1fbc5a4cd8535b765
+```
+
+Applicable workflows on that exact head:
+
+```text
+ci                       run 32942924918  SUCCESS
+cf11-multi-version-proof run 32942924926  SUCCESS
+cf11g-context-proof      run 32942924928  SUCCESS
+cf12-impact-proof        run 32942924956  SUCCESS
+cf06-oracle              run 32942924969  SUCCESS
+```
+
+`ci` job `98097504281` passed the mandatory workspace gates and the configured integrated regressions:
+
+- `cargo fmt --all -- --check`;
+- `cargo clippy --workspace --all-targets --all-features -- -D warnings`;
+- `cargo test --workspace --all-features`;
+- CF-08 Action runner security regression;
+- CF-09 Action source-map security regression;
+- real FHIR registry/inspect/self-diff/self-classify/self-check smoke;
+- real FHIR self-terminology smoke;
+- local GitHub Action source-map self-check and output verification.
+
+No post-merge workflow run was emitted for merge commit `71c5c4372a829ca6b26846acad0a8ded44f1e1ba`; repository workflows qualified the exact PR head before merge, and the merge commit retained the same tree.
+
+## Deterministic impact proof identity
+
+Dedicated proof:
+
+```text
+workflow  cf12-impact-proof
+run       32942924956
+job       98097504274
+head      c874c8c665a053d3022b6592a6dcf2a9f9c88349
+tree      0ab82f0d8fb19d88ddcb0af1fbc5a4cd8535b765
+result    SUCCESS
+```
+
+The job passed the pinned-toolchain assertion, byte-identical repeated `commandf impact` execution, repository-cleanliness assertion, and evidence upload.
+
+Retained evidence:
+
+```text
+artifact name    cf12-impact-proof
+artifact id      9597183002
+artifact digest  sha256:1cf1fc14c84f35a84c00c01ed2cc475a0c310e374dd14f3105ae4ac08bb79c1f
+CF12_IMPACT_SHA256=e75f54cefc9af93819fb11b437418c04f6fe8036bef3e4be1ccf6523170c84b1
+```
+
+## Independent review
+
+Final evidence PR `#28` received independent Qodo review. One substantive correctness finding identified that the initial CLI regression assertions did not bind the declared constraints to the specific `acme.subject` package-impact relation. The finding was fixed in commit `6210db22c08a5e9a0b6e9f9b5c7653b771da0795`; the regression then selected the exact impacted package name/version relation and asserted side-local declared constraints. The thread is resolved and outdated on the final head.
+
+CodeRabbit commit status on the final head is `success`; its status description reports review rate limiting. No CodeRabbit PASS beyond that recorded status is invented.
+
+Unresolved substantive review findings at convergence: `0`.
+
+## Acceptance-contract convergence
+
+CF-12 now ships the V1 `commandf impact` vertical slice and preserves the frozen authority boundary:
+
+- deterministic structural-diff-derived change seeds;
+- side-aware reverse traversal over exact CF-11G `resolved` canonical-reference edges only;
+- deterministic shortest-path evidence with lexicographic equal-length tie-breaking;
+- cycle termination and deterministic deduplication;
+- exact schema-v2 multi-version reverse package exposure with declared constraints;
+- explicit `external` and `ambiguous` unresolved boundaries without traversal or network completion;
+- before/after evidence preservation with `both` only for exactly identical normalized relations;
+- JSON-only V1 CLI with explicit before/after lock/cache inputs;
+- fail-closed unsupported-schema and corrupt/missing local evidence behavior;
+- deterministic retained CLI proof identity;
+- no compatibility severity inferred from reachability.
+
+The final T022 CLI regression additionally proves reverse package exposure for `acme.subject` through a changed `acme.shared` dependency and binds exact before/after constraints to the corresponding package-impact relations.
+
+## Coverage limits and explicit deferrals
+
+The following remain intentionally outside CF-12 V1 and are not gaps in its accepted contract:
+
+- SQL-on-FHIR, CQL, SearchParameter-expression, and FHIRPath-invariant impact extraction;
+- persistent graph storage or graph databases;
+- network canonical completion;
+- AI/model/agent impact authority;
+- runtime or clinical breakage claims derived from reachability;
+- CF-06 production oracle identity changes;
+- mutation of the frozen CF-10 corpus;
+- PHI/instance-data analysis.
+
+Artifact-level blast-radius evidence is limited to relation kinds extracted by CF-11G V1. Package-level exposure remains independent of artifact extractor coverage.
+
+## Convergence decision
+
+Implementation and evidence satisfy CF-12's frozen V1 acceptance contract on the exact qualified implementation tree. This docs-only closeout may be merged only after its own exact-head, path-applicable CI/review gates are terminal and clean.
+
+After that merge, CF-12 may be recorded as `CLOSED_CANONICAL` and the repository may proceed to the next dependency-eligible slice under Master Architecture V2.

specs/013-cf-12-impact/tasks.md

@@ -1,6 +1,6 @@
 # CF-12 Tasks — Deterministic Impact Analysis
 
-Status: PLANNING_READY_FOR_MERGE — T004 is closed by the first exact-head planning qualification; implementation remains blocked until this planning PR itself passes final-head requalification and merges.
+Status: CONVERGENCE_CANDIDATE — implementation and exact-head evidence are complete; canonical closure requires this docs-only closeout PR to qualify and merge.
 
 Tasks are dependency ordered. A task is complete only with executable evidence on the exact candidate state.
 
@@ -24,78 +24,97 @@ Tasks are dependency ordered. A task is complete only with executable evidence o
   - no graph database/model/agent authority.
 
 - [x] T004 — Close planning consistency and independent review.
-  - `spec.md`, `plan.md`, `tasks.md`, and `consistency.md` contain no known unresolved contradiction;
-  - first exact planning head `1bee6f3651fa686f03902f3d86761736d4844513` passed `ci` run `32928525763` and `cf06-oracle` run `32928525784`;
-  - CodeRabbit status was `success` and no review thread/substantive finding was returned on that planning head;
-  - Qodo was not observed connected/available; no Qodo PASS is claimed;
-  - this T004 state change moves the head, so the planning PR MUST rerun applicable exact-head gates/review before merge.
+  - canonical planning merge: `cefa5e4a56041bf88e833844a318b170e7e7ae83`.
 
 ## Stack A — library model and deterministic traversal
 
-- [ ] T010 — Add library-owned CF-12 impact report schema v1.
+Stack A merged through PR `#26` at merge commit `d46591f0f7224d49fda0d89a6a79cc418fba534e` from exact qualified head `9fa948cb2ad0110cd4288c330a5bc8b977472418`.
+
+- [x] T010 — Add library-owned CF-12 impact report schema v1.
   - subject/evidence identity, seeds, artifact impacts, package impacts, unresolved boundaries, coverage, canonical JSON.
 
-- [ ] T011 — Build deterministic change seeds from the existing package structural-diff pipeline.
+- [x] T011 — Build deterministic change seeds from the existing package structural-diff pipeline.
   - added, removed, and modified canonical artifacts with exact side-specific identity;
   - no second diff engine.
 
-- [ ] T012 — Build side-specific reverse indexes over resolved CF-11G canonical-reference edges.
+- [x] T012 — Build side-specific reverse indexes over resolved CF-11G canonical-reference edges.
   - only `resolved` edges are traversable;
   - exact artifact identities remain version-aware.
 
-- [ ] T013 — Implement deterministic transitive reverse artifact traversal.
+- [x] T013 — Implement deterministic transitive reverse artifact traversal.
   - direct/transitive dependents, cycle termination, exact visited state, canonical shortest path.
 
-- [ ] T014 — Implement equal-length path tie-breaking.
+- [x] T014 — Implement equal-length path tie-breaking.
   - minimum edge count, then lexicographically smallest stable exact path.
 
-- [ ] T015 — Implement exact reverse package-dependency exposure.
+- [x] T015 — Implement exact reverse package-dependency exposure.
   - schema-v2 exact edges, exact version/digest identity, declared constraints, no name-only collapse.
 
-- [ ] T016 — Collect unresolved impact boundaries.
+- [x] T016 — Collect unresolved impact boundaries.
   - preserve `external` and `ambiguous` edges/candidates;
   - no network lookup or preferred-candidate heuristic.
 
-- [ ] T017 — Normalize before/after evidence without losing side-only state.
+- [x] T017 — Normalize before/after evidence without losing side-only state.
   - preserve removed-before and added-after evidence;
   - use `both` only for exact normalized identical evidence.
 
-- [ ] T018 — Prove library invariants and byte determinism.
+- [x] T018 — Prove library invariants and byte determinism.
   - direct/transitive, cycles, add/remove, multi-version, ambiguous/external, tie-breaking, permutations, repeat bytes.
 
 ## Stack B — shipped `commandf impact`
 
-- [ ] T020 — Add the `commandf impact` CLI surface.
+Stack B merged through PR `#27` at merge commit `9e462cbb5c0bd05cf2219e2283f09bfbc8a51720` from exact qualified head `6d8e22b1d8c999256692052d473ba3c27effc972`.
+
+- [x] T020 — Add the `commandf impact` CLI surface.
   - package + explicit before/after lock/cache + JSON output.
 
-- [ ] T021 — Enforce CLI fail-closed boundaries.
+- [x] T021 — Enforce CLI fail-closed boundaries.
   - schema-v1/unsupported context refusal, missing/corrupt cache refusal, bounded malformed-input handling, sanitized diagnostics.
 
-- [ ] T022 — Add end-to-end impact fixtures.
-  - direct/transitive, removed/added target, multi-version package exposure, ambiguous/external boundaries, no invented severity.
+- [x] T022 — Add end-to-end impact fixtures.
+  - direct/transitive, removed/added target, multi-version package exposure, ambiguous/external boundaries, no invented severity;
+  - final CLI-level reverse package-exposure evidence merged through PR `#28` at `71c5c4372a829ca6b26846acad0a8ded44f1e1ba`.
 
-- [ ] T023 — Add dedicated `cf12-impact-proof` workflow.
+- [x] T023 — Add dedicated `cf12-impact-proof` workflow.
   - digest-pinned Rust 1.97.1 container, immutable action SHAs, complete path filters, repeat-byte comparison, clean tree, retained artifact.
 
-- [ ] T024 — Record deterministic CLI proof identity.
-  - `CF12_IMPACT_SHA256=<sha256>`, exact head/tree/run/job, artifact id/digest.
+- [x] T024 — Record deterministic CLI proof identity.
+  - final implementation/evidence head: `c874c8c665a053d3022b6592a6dcf2a9f9c88349`;
+  - tree: `0ab82f0d8fb19d88ddcb0af1fbc5a4cd8535b765`;
+  - `cf12-impact-proof` run: `32942924956`;
+  - job: `98097504274`;
+  - artifact: `9597183002`;
+  - artifact digest: `sha256:1cf1fc14c84f35a84c00c01ed2cc475a0c310e374dd14f3105ae4ac08bb79c1f`;
+  - `CF12_IMPACT_SHA256=e75f54cefc9af93819fb11b437418c04f6fe8036bef3e4be1ccf6523170c84b1`.
 
-- [ ] T025 — Prove existing command behavior remains unchanged.
-  - no regression for diff/classify/check/context/terminology/oracle/source-map/annotations;
-  - no compatibility-authority or lock-schema change.
+- [x] T025 — Prove existing command behavior remains unchanged.
+  - exact-head `ci` run `32942924918` passed format, Clippy, workspace tests, CF-08/CF-09 security regressions, real FHIR command smoke, terminology smoke, and Action source-map smoke;
+  - exact-head `cf06-oracle` run `32942924969`, `cf11-multi-version-proof` run `32942924926`, and `cf11g-context-proof` run `32942924928` all succeeded;
+  - no compatibility-authority, CF-06 identity, frozen CF-10 corpus, dependency, or lock-schema change was introduced.
 
 ## Regression, review, and convergence
 
-- [ ] T040 — Run mandatory workspace gates on the exact final implementation head.
-- [ ] T041 — Preserve applicable repository workflows including `ci`, `cf06-oracle`, path-triggered CF-11/CF-11G proofs, `cf12-impact-proof`, real FHIR, and security regressions.
-- [ ] T042 — Independent implementation review; disposition every substantive returned finding and record reviewer unavailability without invented PASS.
-- [ ] T043 — Run CF-12 convergence; record final heads/runs, `CF12_IMPACT_SHA256`, artifact digest, coverage limits, and every remaining gap/deferral.
+- [x] T040 — Run mandatory workspace gates on the exact final implementation head.
+  - `ci` run `32942924918`, job `98097504281`, exact head `c874c8c665a053d3022b6592a6dcf2a9f9c88349`: SUCCESS.
+
+- [x] T041 — Preserve applicable repository workflows including `ci`, `cf06-oracle`, path-triggered CF-11/CF-11G proofs, `cf12-impact-proof`, real FHIR, and security regressions.
+  - all five configured workflows triggered on the final implementation/evidence head and succeeded;
+  - integrated real-FHIR and security regressions inside `ci` also succeeded.
+
+- [x] T042 — Independent implementation review; disposition every substantive returned finding and record reviewer unavailability without invented PASS.
+  - Qodo returned one substantive correctness finding on PR `#28`; it was fixed in `6210db22c08a5e9a0b6e9f9b5c7653b771da0795` and the thread is resolved/outdated on the final head;
+  - CodeRabbit commit status on the final head is `success` with description `Review rate limited`; no stronger CodeRabbit review claim is made;
+  - unresolved substantive findings: `0`.
+
+- [x] T043 — Run CF-12 convergence; record final heads/runs, `CF12_IMPACT_SHA256`, artifact digest, coverage limits, and every remaining gap/deferral.
+  - immutable evidence and V1 coverage/deferral boundaries are recorded in `convergence.md`;
+  - this task record remains a convergence candidate until the docs-only closeout PR itself passes its path-applicable exact-head gates/review and merges.
 
 ## Hard sequencing rules
 
-1. This planning PR MUST merge cleanly before T010 implementation starts.
-2. T010 precedes traversal tasks; T011/T012 precede T013; T013 precedes T014; T015/T016/T017 precede T018.
-3. T010–T018 precede user-visible CLI shipping; T020–T025 precede final convergence.
-4. No task may traverse CF-11G `external` or `ambiguous` evidence as resolved.
-5. No task may convert reachability into compatibility severity without an existing explicit CF-04/CF-05 authority contract.
-6. No CF-06 production pin, frozen CF-10 case, graph database, AI/model authority, or network resolution is authorized by CF-12 V1.
+1. The planning PR merged before T010 implementation started.
+2. T010 preceded traversal tasks; T011/T012 preceded T013; T013 preceded T014; T015/T016/T017 preceded T018.
+3. T010–T018 preceded user-visible CLI shipping; T020–T025 preceded final convergence.
+4. CF-12 does not traverse CF-11G `external` or `ambiguous` evidence as resolved.
+5. CF-12 does not convert reachability into compatibility severity without existing explicit CF-04/CF-05 authority.
+6. CF-12 V1 does not authorize a CF-06 production pin change, frozen CF-10 case mutation, graph database, AI/model authority, or network resolution.