L01-02 — Define complete inspection receipt

[mberrys]

Outcome

Specify one typed receipt for input digest, revision, profile, check coverage, evidence refs, fidelity, limitations, and Pass/Fail/Incomplete/Error.

Parent and boundary

Parent: #2. Owner: LoopLibCore. This issue owns one bounded slice of Evidence Core; consume accepted upstream contracts and keep PDF/verdict/publication authority with Core.

Acceptance

• Same input and policy produce stable identity; zero findings with missing required coverage is Incomplete.
• Failure case: Unsupported, budget-limited, cancelled, or parser-error paths cannot coerce to PASS.

Required proof

Golden vectors and Core unit tests across all terminal states. Record the exact source SHA, test command or hosted run, fixture/artifact identity, and any skipped or unavailable lane. Run the repository's mapped proof and check-change gate for a PR.

Handoff

Record changed files, observed result, remaining risk, and a 1–3 sentence anti-slop review. Completion means acceptance evidence, not merely a merged implementation.

Sources

Approved master roadmap.

[mberrys]

Acceptance evidence

• Source SHA: 4388ca36db44cc187ba22031ef5e5aed8e3e2477 on unstable, in PR [0.3.0 first half] L01 Evidence Core train — unstable → stable #155 (unstable -> stable). The hosted PR runs checked out merge commit 2fa707a47677e56ca825ed9e28460d6edc3e138c; git rev-parse shows its tree (f4a0696645f24cf9fdecf87c7da7bb6a9748519f) is identical to the tree of 4388ca36.
• Implementing commits: b9caa53e (receipt), 2bd7d2a9 (mapped CTest runs with the Release configuration), 874c953b (evidence manifest binding). Merged earlier to dev as PR L01-02: define complete Core inspection receipt #101.

Criteria to test to hosted run

Test executable: UnitTestsPreflightVerdict (UnitTests/tst_preflightverdicttest.cpp; it is in the mapped CTest regex printed by the agent_contract job). Hosted run: Release Gate 36782669896. In the full CTest pass, Test #44: UnitTestsPreflightVerdict ... Passed appeared on both platforms:

• linux / build, job 110116570084: 100% tests passed, 0 tests failed out of 91; 44/91 Test #44: UnitTestsPreflightVerdict ... Passed 0.12 sec.
• windows / build, job 110116569911: 100% tests passed, 0 tests failed out of 91; 44/91 Test #44: UnitTestsPreflightVerdict ... Passed 1.55 sec.
• No Skipped/Not Run lines appeared in the CTest output of either job, and tst_preflightverdicttest.cpp contains no QSKIP.

Criterion	Test (at 4388ca36)	Result
Same input and policy produce stable identity	PreflightVerdictTest::receiptIdentity_matchesGoldenVector (line 1004). It asserts golden identity 8e94a7fe...933a8b, that a later document revision with the same bytes and policy yields the same identity, and a different golden identity 931952b4...da11f8 once the effective profile digest changes.	Passed on Linux and Windows (run above)
Zero findings with missing required coverage is Incomplete	receiptTerminalStates, row missing-required (line 1142 data, 1155 body): check statuses cleared, no findings, expects Incomplete.	Passed
Unsupported, budget-limited, cancelled, or parser-error paths cannot coerce to PASS	Rows unsupported, budget-limited, cancelled expect Incomplete and !allowsCertificateIssuance(). Row parser-error expects Error. Each row also asserts isPass() == (expected == Pass).	Passed
All terminal states	Rows pass, fail, missing-required, unsupported, budget-limited, cancelled, parser-error cover Pass, Fail, Incomplete and Error.	Passed
Mismatched provenance is rejected before publication	receiptRejectsMismatchedProvenance (line 1198): wrong artifact digest and wrong revision both fail with an empty identity.	Passed

Fixture and artifact identity

The vectors are in-source (golden identities above); no fixture or sealed output was added. Contract text: docs/PREFLIGHT_VERDICT.md, section "Typed inspection receipt".

Check-change and architecture gates

• Hosted agent_contract (job 110116496019) concluded success. It runs check-change.py --dry-run, so it plans the mapped proof and does not execute it; the execution evidence is the CTest runs above.
• Local read-only run at 4388ca36: python scripts/agent/check-change.py --base origin/stable --head 4388ca36db44cc187ba22031ef5e5aed8e3e2477 --head-branch unstable --dry-run --skip-changelog exited 0 (plan only), and python scripts/agent/check-architecture.py printed architecture contracts ok.

Skipped or unavailable lanes

• On the push CI run for unstable (36782282330), the linux, windows and agent-fast jobs were skipped. The Linux and Windows build-and-CTest lanes ran in the PR's Release Gate run instead (above).
• changes/codex-issue-16-inspection-receipt.evidence.yaml lists unresolved: core:scripts/ci/check_independent_validation_gate.py. It is carried in the other L01 manifests too and belongs to L01-04 — Prove independent standards and rendering claims #18.

Changed files (implementation)

LoopLibCore/sources/pdfpreflightverdict.cpp, LoopLibCore/sources/pdfpreflightverdict.h, UnitTests/tst_preflightverdicttest.cpp, docs/PREFLIGHT_VERDICT.md, scripts/agent/check-change.py, changes/codex-issue-16-inspection-receipt.md, changes/codex-issue-16-inspection-receipt.evidence.yaml. Later commit 4bcd75de (#20) extended the receipt (pdfpreflightreceipt.cpp) and the same test file; the run above covers that state.

Observed result

All Core receipt tests passed in a full 91-test CTest run on hosted Linux and Windows; all CI checks on PR #155 are green.

Remaining risk

• CTest reports per executable, so the per-function results are not individually visible in the logs. The cases above are read from the test source at 4388ca36.
• The receipt is an in-memory Core contract; the report and bundle schemas are unchanged. Cross-process admission of receipts belongs to L01-06 — Audit untrusted PDF process isolation #20 and the module gate to L01-07 — Admit exact-SHA Core qualification #21.

Quality review

The change adds one typed receipt builder with explicit rejection of mismatched provenance, and the tests assert exact golden identities rather than only non-emptiness. I found no silent coercion paths: each non-pass state is covered by a named test row.

Closes on merge of #155 into stable.