[Change] Governance Evidence Emitters Follow-Up #169

Owner-approved agentic SDLC amendment — 2026-10-04

Add a bounded optional export using in-toto Statement v1 and SCAI v0.3 to bind a digest-addressed evidence bundle and the original native reports. Preserve independent statuses, producer authority, uncertainty and limitations in authoritative native JSON; neither SARIF nor an attestation is a replacement report. Signing authenticates origin/integrity, not claim correctness. Reuse existing CI signing/verification infrastructure: no new signer, store or predicate-standardization dependency. Test tampered bundle, mismatched subject/digest and unauthorized signer rejection. Summary/SARIF interoperability may consume native producer reports without requiring the full envelope, #170/#171 graph/index or seals; export does not block #481/#740/#483.

Planning scope only; implementation/release evidence remains pending. This amendment supersedes conflicting scope and prerequisite wording below.

Scope rescope — 2026-09-20

Emit lean current-run results and references to existing CI artifacts. Historical chronology is optional and separately labeled; no transcripts, approval receipts, or duplicate proof execution by default. This broader emitter feature is not a blocker for #481.

R09 boundary alignment: nold-ai/specfact-cli#740 and #481; this issue retains its existing schema or runtime ownership. This section supersedes conflicting default-workflow and dependency statements below; other acceptance criteria remain in force.

Modules-repo runtime follow-up for the split core change governance-01-evidence-output. This issue owns only the bundle-side emitters and runtime output behavior after the core evidence schema/contracts split.\n\nCounterpart core issue: nold-ai/specfact-cli#247\nTarget feature: #163

Normative acceptance and delivery order — 2026-09-20

Current execution is independent from optional chronology. Passing current tests do not establish historical failing-before proof, complete graph coverage or protected CI authority. Missing mappings remain unassessed or explicit findings; original producer outcomes/references remain independent. Fresh current-only verification needs no prior receipt, full-chain run or duplicate proof execution.

Core #247 owns the envelope contract and precedes core #241 and modules #169. Modules #171 consumes core #241 plus modules #169. The stale core #241 prerequisite on #247 is removed; existing unrelated prerequisites remain. Only actual full-chain emission requires full-chain results. R09 and workflow delivery do not become downstream blockers of this broader feature.

The normative OpenSpec deltas preserve these rules during archival. Serialization uses distinct additive requirements without replacing producer-owned validation or policy requirements. Core remains contract-only; modules owns emitters/file persistence. All implementation tasks remain unchecked.