feat(pubpunk): require resolved connector refs for evidence handoff

[t3chn]

Linked intent

• Issue / Discussion: N/A
• Goal / report / eval ref:
  • work/goals/goal_add_pubpunk_publish_operation_evidence_handoff_resolved_connector_refs_v0_1.md
  • work/reports/2026-05-20-pubpunk-publish-operation-evidence-handoff-resolved-connector-refs-v0-1.md
  • evals/specs/pubpunk-publish-operation-evidence-handoff.v0.1.md

Summary

• Requires connector profile resolution, connector profile, and selected connector strategy refs on the PubPunk publish operation evidence handoff packet.
• Carries those refs through assessment and handoff refs, and requires them in allowed source refs plus expected receipt fields.
• Updates smoke evidence, module docs, crate status, eval spec, work goal, report, and work status.
• Keeps PubPunk advisory and side-effect-free: no runtime publishing, adapter invocation, browser/API calls, metrics collection, or PubPunk-owned evidence writing.

Type

• docs / README / community
• work-ledger artifact
• core crate / Rust

Goal / intent

Keep the PubPunk publish handoff chain from losing connector-resolution evidence before operation-evidence writing. This is the next bounded continuation after the resolved-connector receipt write handoff slice.

Research Gate preflight

• Classification: R2
• Why this classification fits: changes an incubating PubPunk operation-evidence handoff boundary before runtime publishing, satisfied by existing repo-tracked module, connector, and handoff docs/specs/reports.

Work Ledger alignment

• follows work/STATUS.md:selected_next
• explicit maintainer/user scope override
• relevant goal/report/work/STATUS.md updated

Linked goal / report:

• work/goals/goal_add_pubpunk_publish_operation_evidence_handoff_resolved_connector_refs_v0_1.md
• work/reports/2026-05-20-pubpunk-publish-operation-evidence-handoff-resolved-connector-refs-v0-1.md

Scope

In:

• PubPunk operation evidence handoff packet readiness and refs
• Smoke eval coverage and wording
• PubPunk module docs, workspace instructions, crate status
• Eval spec and work ledger artifacts

Out:

• PubPunk runtime, Module Host runtime, public CLI behavior
• Workspace initialization or scanning, draft body reads
• API calls, browser automation, credential reads
• Adapter invocation, external publishing, metrics collection
• PubPunk-owned receipt or operation-evidence writing
• Event-log mutation, gate/proof writing, acceptance claims

Sensitive surfaces

• docs/product/*
• work/*
• crates/*

DocImpact

• Classification: code-doc
• Canonical/touched surfaces: docs/product/CRATE-STATUS.md, docs/modules/pubpunk.md, docs/modules/pubpunk-workspace-instructions.md, evals/specs/pubpunk-publish-operation-evidence-handoff.v0.1.md, work/STATUS.md
• Required updates: module docs, crate status, eval spec, work goal/report/status
• Why this is enough: the change is a bounded PubPunk boundary extension and does not activate runtime behavior or external publishing.

Validation / proof

Commands run:

cargo fmt
cargo test -p punk-mod-pubpunk
cargo test -p punk-eval
python3 scripts/check_research_gate.py
python3 scripts/check_work_ledger.py
python3 scripts/check_docs_governance.py --files crates/punk-mod-pubpunk/src/lib.rs crates/punk-eval/src/lib.rs docs/modules/pubpunk.md docs/modules/pubpunk-workspace-instructions.md docs/product/CRATE-STATUS.md evals/specs/pubpunk-publish-operation-evidence-handoff.v0.1.md work/STATUS.md work/goals/goal_add_pubpunk_publish_operation_evidence_handoff_resolved_connector_refs_v0_1.md work/reports/2026-05-20-pubpunk-publish-operation-evidence-handoff-resolved-connector-refs-v0-1.md --report work/reports/2026-05-20-pubpunk-publish-operation-evidence-handoff-resolved-connector-refs-v0-1.md
cargo check --workspace
cargo run -p punk-cli -- eval run smoke
git diff --check

Evidence:

• cargo test -p punk-mod-pubpunk: 42 passed; 0 failed
• cargo test -p punk-eval: 6 passed; 0 failed
• Research Gate: PASS
• Work ledger: PASS
• Docs governance: PASS, warnings 0
• Smoke result: pass
• Case eval_pubpunk_publish_operation_evidence_handoff_chains_to_host_operation_evidence_write: pass

DCO / authorship

• Every commit in this PR is signed off (git commit -s) and complies with DCO.md

Reviewer notes

Event handoff still carries the older connector boundary and should be handled in a later slice.

Merge strategy recommendation

• Recommended: squash
• Reason: this PR is one logical boundary hardening slice with one commit.