Prototype minimum defensible verification planning

[sneakocom]

Summary

• define the versioned minimum-defensible-verification contract and explicit sufficiency states
• reconcile Nx, Turbo, Jest, Vitest, testmon, vitest-affected, Bazel, Pants, Azure TIA, and regression-test-selection literature
• add a dependency-free deterministic planner with fail-closed escalation, first-class skip reasons, canonical provenance, Visible Value receipts, and fixture-level shadow miss classification
• add 12 positive/boundary scenarios, explicit negative/tampered cases, 54 tests, and public CI

Verification

• npm run verify — 54/54 tests, 15/15 conformance scenarios, 5/5 determinism checks
• current Opsle opsle.value-receipt.v1 validator — PASS
• actionlint .github/workflows/ci.yml — PASS
• gitleaks dir . --no-banner --redact — no leaks
• git diff --check — PASS

Claim limits

No real-repository benchmark has run. No time, token, cost, correctness, or causal savings claim is made. Context Firewall dogfood on the Node checkmark transcript correctly required raw evidence and expanded rather than claiming reduction.