VC: consolidate current verification and preserve semantic guarantees

.github/workflows/phase1-ci.yml

@@ -1,5 +1,5 @@
 {
-  "name": "Phase 3 cumulative CI",
+  "name": "Current verification",
   "on": {
     "pull_request": {
       "branches": [
@@ -81,19 +81,19 @@
           }
         },
         {
-          "name": "Check actual checkout and guards",
+          "name": "Check actual event, checkout, history and risk",
           "run": "python -B tests/scaffold/test_ci_contract.py --ci-stage preflight"
         },
         {
-          "name": "Review and install pinned development wheels",
+          "name": "Prepare pinned tools for the recorded verification scope",
           "run": "python -B tests/scaffold/test_ci_contract.py --ci-stage prepare"
         },
         {
-          "name": "Collect and run all cumulative tests",
+          "name": "Run the recorded scope, including all five test directories when full",
           "run": "python -B tests/scaffold/test_ci_contract.py --ci-stage test"
         },
         {
-          "name": "Record results, archives and unchanged checkout",
+          "name": "Reconcile identities, installed witnesses and failure evidence",
           "if": "${{ always() }}",
           "run": "python -B tests/scaffold/test_ci_contract.py --ci-stage evidence"
         },

README.md

@@ -2,7 +2,7 @@
 
 A local, supplied-evidence toolkit for examining source lineage, evidence independence, external presence and corrective capacity in AI-native information systems.
 
-**Status: P3-W15 private-core handoff, with approved R01 reason repair, R02 history-verification optimization and R03 complete-CI budget amendment implemented. The final hosted gate and owner acceptance remain pending; Phase 3 is not accepted. Public auditing remains unavailable.** The package remains installable as `0.1.0.dev0`. The private core implements fifteen analytical families in the planned twenty-nine active modules; nineteen protected modules retain their accepted bytes. Public audit calls raise `NotImplementedError`; CLI auditing refuses with exit 1 without reading dossiers or producing reports.
+**Status: Phase 3 private analytical core accepted through [PR #34](https://github.com/DavidWallstructurallaw/source-integrity-toolkit/pull/34). Verification consolidation is in progress; its final four-environment gate and owner acceptance remain pending. Public auditing remains unavailable.** The package remains installable as `0.1.0.dev0`. The private core implements fifteen analytical families in twenty-nine active modules; nineteen protected modules retain their accepted bytes. Public audit calls raise `NotImplementedError`; CLI auditing refuses with exit 1 without reading dossiers or producing reports.
 
 
 ## Intended purpose
@@ -25,55 +25,36 @@ All 228 field obligations have accepted owner-local core evidence. W14 added sou
 
 ## Developer installation and checks
 
-Use a complete Git checkout and a clean CPython 3.11 or 3.13 development environment. The six migrated test files load only their exact, SHA-256-checked historical source from the fixed intake commit, then adapt the named phase-specific assertions. Full Git history is required; no network or mutable-ref fallback occurs during test loading. This retains the original assertions and all 194 historical test identities instead of silently replacing them. See [phase2/transition_ledger.md](phase2/transition_ledger.md).
-
-Use the unit context for this checkout. Local execution is separate from the required four-profile hosted gate. In a POSIX shell:
-
-```sh
-export SIT_PHASE_UNIT=P3-W15
-```
-
-In PowerShell:
-
-```powershell
-$env:SIT_PHASE_UNIT = 'P3-W15'
-```
-
-Then run:
+Use a complete Git checkout and a clean CPython 3.11 or 3.13 development environment. Install the existing pinned development requirements, then use the single current verification entry:
 
 ```sh
 python -m pip install -r requirements-dev.txt
-python -m pip install --no-build-isolation --no-deps .
-sit --version
-sit --help
-python -B tools/check_phase0_baseline.py
-python -B tools/check_scaffold_boundary.py --unit P3-W15
-python -m pytest tests -q
+python -B tests/scaffold/test_ci_contract.py --local --evidence-dir ../sit-local-evidence
 ```
 
-A missing context retains the conservative Phase 2 W01 default and cannot validate this Phase 3 checkout. Keep `SIT_PHASE_UNIT=P3-W15` set for both guard and pytest. CI derives Phase 3 context from the actual `phase3/p3-wNN` branch or a single `SIT-Phase-Unit: P3-WNN` main merge footer. Metadata cannot authorize a unit. The original 1,650 Phase 2 identities and method-level adaptations are recorded in [phase3/transition_ledger.md](phase3/transition_ledger.md).
+Choose a new evidence directory for each attempt. The entry verifies the actual tool versions, current module/workflow boundaries and frozen Phase 0 baseline, explicitly collects all five directories (scaffold, security, contract, unit and integration), runs the complete suite with third-party pytest plugin autoload disabled, and reconciles exact collected identities with JUnit. Successful subtest events are counted separately. It checks tracked bytes before/after and retains raw logs, failure records, distribution inventories and available installed-runtime evidence. Missing directories, an empty collection, failure/error/skip outcomes or incomplete evidence fail the command. The complete-suite process budget is 2,400 seconds.
 
-Dependency installation is a developer operation and may access the package index. The installed product has zero third-party runtime dependencies and never imports the developer guards, catalogs or historical tests. Source distributions retain the four permitted repository-context tests; running those tests requires the complete developer checkout. Building the sdist/wheel and using the installed package do not require this test loader or Git history.
+This local command requires no `SIT_PHASE_UNIT` or fabricated GitHub event. It checks the local working tree and records its source hashes. It cannot attest hosted context, authorize a checkout or replace the four required hosted profiles. The retained preparation installation test asserts its complete witness locally, but its persistent W08 receipt is emitted only on an actual Actions run; local evidence states that limit. Use the resulting `summary.json` and raw logs to inspect the attempt, including a failed or timed-out attempt.
 
-The older pytest default covers only tests/scaffold. Use the explicit tests root or the cumulative CI driver to include all present security, contract, unit and integration tests. Stored logical expectations need actual source-bound analytical assertions to count as behavior evidence.
+Dependency installation is a developer operation and may access the package index. The installed product has zero third-party runtime dependencies. Package construction, clean offline installation, all 48 installed module hashes, private preparation and analytical witnesses, and public refusals remain tested. The product never imports developer guards, catalogs or tests. Six former historical wrappers now contain their current assertions directly; normal test collection does not fetch or execute historical Git blobs. Some developer boundary tests intentionally use real temporary Git repositories. Building and using the installed package does not require that history.
 
-## CI and evidence
+Bare `pytest` retains its older scaffold-only configuration. Use the current entry above for complete local verification. Existing targeted pytest invocations are useful diagnostics and must be reported with their actual selected scope.
 
-[Phase 3 cumulative CI](.github/workflows/phase1-ci.yml) retains Ubuntu 24.04 and Windows Server 2025, each with Python 3.11 and 3.13, immutable action pins, read-only permissions, no stored checkout credentials and finite timeouts. It validates actual entry trees, history and current-unit scope, frozen artifacts, module boundaries and the retained test collection. Raw JUnit outcomes, separately counted subtests, tracked bytes before/after, packaging and offline installed-runtime witnesses remain required.
+## CI and evidence
 
-Accepted W14 code `5146a2e41dfdddfccebd85367655109288fe313f` passed [run 35832693910](https://github.com/DavidWallstructurallaw/source-integrity-toolkit/actions/runs/35832693910), attempt 1, in all four profiles with 3,918 tests and 428 separately counted subtests, zero failures/errors/skips. Its final three-record successor passed the affected existing controls and preserved all other 202 blobs and modes. These remain W14 results. W15 R01 repair precursor `2a8697ea23e315e74c7cc8d7632c95725332b45b` passed source-bound direct controls. Its checkpoint `4d480f2cc5400e96e724d949ed00c82d62f5aeb7` collected 3,937 tests. [Run 36268092968](https://github.com/DavidWallstructurallaw/source-integrity-toolkit/actions/runs/36268092968) passed that collection and 428 separate subtests in Ubuntu 3.11, Ubuntu 3.13 and Windows 3.11; Windows 2025 / Python 3.13 timed out at the unchanged 1,800-second suite limit on both attempts. The retained five artifact ZIPs passed integrity checks, while the acceptance gate remained blocked.
+[Current verification](.github/workflows/phase1-ci.yml) keeps Ubuntu 24.04 and Windows Server 2025, each with Python 3.11 and 3.13, immutable Action pins, read-only permissions, no stored checkout credentials, a 50-minute job budget and the 2,400-second suite budget. The seven existing workflow stages remain visible. Evidence reconciliation and artifact upload run with `always()`; the existing fourteen-day retention and `sit-p3/evidence` receipt destination remain intact.
 
-The owner approved `批准 P3-W15-R02` on 2026-09-27 UTC to batch only actual Git parents/tree metadata within each history-validation call. Its nine-path segment preserves product/API behavior, R01 semantic assertions, every existing test identity, live ancestry/diff/archive checks, pins and the then-current 1,800-second suite / 40-minute job limits. One local paired history measurement reduced Git subprocesses from 443 to 335 and elapsed time from 12.326 to 10.270 seconds, with all 57 history rows identical; it does not predict Windows or full-suite savings.
+CI resolves the actual GitHub event, base and checked-out head. A consolidation PR must use the same-repository `verification/consolidation` branch targeting `main`; a main push requires the exact `SIT-Verification-Unit: VC` footer and matching event head. These labels do not grant authority: the accepted Phase 3 anchor, approved consolidation plan, every post-anchor commit and actual index/worktree must also pass the current scope checks. Missing or inconsistent external context fails closed.
 
-R02 precursor `fae43fcdae0341a6f596545f700bc8932b5d8444` passed 371 affected controls in 342.81 pytest seconds, with 343.616 seconds of process elapsed time. Its final collection was 3,962 tests, preserving all 3,937 R01 identities and adding 25 controls. Actual head `3a8c6f99a2aa71ce8e67454801e16a1c5c5caed7` ran [CI 36296729627](https://github.com/DavidWallstructurallaw/source-integrity-toolkit/actions/runs/36296729627), attempt 1. Both Ubuntu profiles passed all 3,962 tests and 428 subtests; Windows 3.11 completed with three temporary-Git-object deletion failures; Windows 3.13 timed out at 1,800 seconds without complete JUnit. All four original ZIPs remain retained. Follow-up `d32c1499fe7969b9415468ef62c966c38110a090` repaired the temporary object write permission and passed 12 local controls in 15.36 pytest seconds. That local pass provides no Windows CI certification.
+Risk routing uses every parent edge in the actual event change interval, including intermediate edits restored before the final head and merge sides. Only changes confined to the two exact non-executable consolidation records, `VERIFICATION_CONSOLIDATION_COMPLETION.md` and `verification/consolidation_map.json`, can use the explicit documentation scope. That scope still checks current authority, complete history, checkout, frozen bytes, module boundaries and workflow policy, and reports that no full suite was run. It does not acquire test tools or claim package/installed-runtime execution. Empty, unknown or mixed changes require the full scope. README changes also require the full scope because README is package metadata. File suffixes and candidate declarations cannot select the reduced route.
 
-The owner approved `批准 R03 继续` at `2026-09-30T15:08:59Z`. R03 binds `d32c1499fe7969b9415468ef62c966c38110a090`, tree `1234a087200c5e56d20c7f53aa0d71a828f167fb`, and sole parent `3a8c6f99a2aa71ce8e67454801e16a1c5c5caed7`. It sets the complete CI test process limit to exactly 2,400 seconds and the job limit to exactly 50 minutes. All 48 product modules, the analytical integration test, the product's 60-second cooperative deadline and work quotas, other internal timeouts, matrix, permissions and pins remain unchanged. Historical scopes stay separate at seven, eleven, nine and ten paths; the cumulative W15 union has twelve. R03's added workflow permission applies only to actual descendants and the named job-budget edit.
+Full scope requires all five test directories, exact collection/JUnit identity reconciliation, separately observed subtests, unchanged tracked bytes, pinned installed tools, package inventories and both current-head installed receipts. Each attempt binds evidence to its actual head, event, run/attempt and matrix profile. Raw partial output and failure records remain evidence of failure. A successful documentation check or local check is never reported as full-matrix acceptance.
 
-R03 precursor `95368b54d17721ff7e975773ea4f3a22e5888ecf` passed 372 affected controls in 67.57 pytest seconds. Actual collection on the directly tested source is 3963 tests, retaining all 3,962 existing identities and adding 1 named controls. A new run on the actual final head must pass all four profiles, including 428 separate subtests each, and a raw-evidence audit. Earlier successes cannot be reused for that gate, and 2,400 seconds is not a measured guarantee of completion. Remaining failures stay blocked without automatic timeout expansion or blind retries. [PR #34](https://github.com/DavidWallstructurallaw/source-integrity-toolkit/pull/34) remains unmerged; [phase3/implementation_evidence.json](phase3/implementation_evidence.json) distinguishes historical runs, local checks and this final gate. Final execution results will be recorded in the PR and review package. Owner acceptance, permanent verification consolidation, the next phase and release remain pending.
+The accepted Phase 3 anchor is `2413a29b839b7e1de8f76a449762f031de19d52b`, with the same tree as directly tested head `90684996eac568af6129973764fe40f3b666a15f`. [Run 36736103966, attempt 1](https://github.com/DavidWallstructurallaw/source-integrity-toolkit/actions/runs/36736103966) passed all four original profiles with 3,963 tests and 428 separate subtest events each. Those are historical Phase 3 results. The completed consolidation candidate still requires its own same-head four-environment run and raw-evidence audit in VC-06. Changes to executable verification, semantics, security, platform behavior, loading or packaging require that gate; strictly explanatory records use the explicit limited scope above. CI success does not automatically authorize acceptance, merge, a next implementation phase or release.
 
-The planning PR's inherited-driver failure remains disclosed in [PHASE_3_PLAN.md](PHASE_3_PLAN.md) section 1.2; it is not relabeled as a successful Phase 3 execution.
+Current progress, collection changes and local evidence are in [VERIFICATION_CONSOLIDATION_COMPLETION.md](VERIFICATION_CONSOLIDATION_COMPLETION.md) and the one-time [consolidation map](verification/consolidation_map.json). The map is a review artifact and is never imported by current verification. Historical stage evidence remains in [PHASE_3_COMPLETION.md](PHASE_3_COMPLETION.md), [phase3/implementation_evidence.json](phase3/implementation_evidence.json) and their immutable Git history. The complete pre-retirement test implementation is available at `3ac5128e4744e2d3708400e3cb1875a9cd4ed0e1`; inspect any historical replay in an isolated checkout with its original tooling and label it as historical investigation. Earlier failed attempts and missing W01-W07 raw ZIPs and some W08 profile artifacts remain disclosed.
 
-Windows Server component tests do not certify the future Windows 11/NTFS native adapter. No production platform support or general security proof is asserted. Artifacts retain the existing fourteen-day retention.
+Windows Server component tests do not certify a future Windows 11/NTFS native adapter. Public audit/report output, CLI auditing, native file adapters and release remain unfinished. The product's 60-second cooperative deadline and existing work quotas are unchanged; a safe resource interruption is not certification of unperformed analysis.
 
 ## Specifications, security and rights