From 61bc5e25968581fabc7c77434168980a956281d8 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 17 Oct 2026 16:39:07 +0100
Subject: [PATCH 1/3] fix(k9): retain subprocess failures and collect
 structured conformance evidence

---
 .githooks/validate-k9.sh                      |  31 ++-
 1-formats/k9/tools/conformance-report.mjs     | 193 ++++++++++++++++++
 .../k9/tools/conformance-report.test.mjs      |  83 ++++++++
 3 files changed, 303 insertions(+), 4 deletions(-)
 create mode 100644 1-formats/k9/tools/conformance-report.mjs
 create mode 100644 1-formats/k9/tools/conformance-report.test.mjs

diff --git a/.githooks/validate-k9.sh b/.githooks/validate-k9.sh
index a9f8ea6a6..773c2556b 100755
--- a/.githooks/validate-k9.sh
+++ b/.githooks/validate-k9.sh
@@ -120,15 +120,30 @@ fi
 # per-file verdicts coming from a single process rather than N slightly
 # different environments.
 REPORT="$(mktemp)"
+trap 'rm -f "$REPORT"' EXIT
+STRICT_ARGS=()
+case "$LAYER" in L2|L3|all) STRICT_ARGS=(--strict) ;; esac
 set +e
-bash "$VALIDATOR" --layer "$LAYER" --json --quiet "${FILES[@]}" > "$REPORT" 2>/dev/null
+bash "$VALIDATOR" "${STRICT_ARGS[@]}" --layer "$LAYER" --json --quiet "${FILES[@]}" > "$REPORT"
+VALIDATOR_RC=$?
 set -e
+if [ -n "${K9_JSON_REPORT:-}" ]; then cp "$REPORT" "$K9_JSON_REPORT"; fi
+RESULTS=$(grep -cE '"verdict":"(pass|fail|error|routed)"' "$REPORT" || true)
+if [ "$RESULTS" -ne "${#FILES[@]}" ]; then
+  echo "[validate-k9] ERROR: expected ${#FILES[@]} file results, received $RESULTS (validator exit $VALIDATOR_RC)" >&2
+  exit 2
+fi
+case "$VALIDATOR_RC" in 0|1) ;; *)
+  echo "[validate-k9] ERROR: validator incomplete or unavailable (exit $VALIDATOR_RC)" >&2
+  exit "$VALIDATOR_RC" ;;
+esac
 
-CHANGED="$STAGED_FILES"
+CHANGED="${K9_CHANGED_FILES:-$STAGED_FILES}"
 HARD=0
 ADVISORY=0
 CONFORMING=0
 STALE=0
+ROUTED=0
 
 while IFS= read -r line; do
   [ -z "$line" ] && continue
@@ -140,7 +155,10 @@ while IFS= read -r line; do
   rules="$(printf '%s' "$line" | grep -oE '"rule":"K9-[ESNC][0-9]+"' | sed 's/.*:"//; s/"//' | sort -u | tr '\n' ' ' | sed 's/ $//' || true)"
 
   case "$verdict" in
-    pass|routed)
+    routed)
+      ROUTED=$((ROUTED + 1))
+      continue ;;
+    pass)
       CONFORMING=$((CONFORMING + 1))
       if in_ledger "$file"; then
         # A conforming file must not keep its exemption: that is how a ledger
@@ -166,13 +184,18 @@ while IFS= read -r line; do
 done < "$REPORT"
 rm -f "$REPORT"
 
+if [ "$VALIDATOR_RC" -ne 0 ] && [ "$HARD" -eq 0 ] && [ "$ADVISORY" -eq 0 ]; then
+  echo "[validate-k9] ERROR: validator failed without attributed violations" >&2
+  exit 2
+fi
+
 if [ "$STALE" -gt 0 ] || [ "$HARD" -gt 0 ]; then
   echo -e "${RED}[validate-k9] $HARD violation(s), $STALE stale ledger entr(ies)${NC}" >&2
   echo -e "${RED}[validate-k9] spec: 1-formats/k9/spec/K9-CONTRACT-SPEC.adoc · plan: 1-formats/k9/spec/MIGRATION-1058.adoc${NC}" >&2
   exit 1
 fi
 
-echo -e "${GRN}[validate-k9]${NC} $CONFORMING conforming, $ADVISORY grandfathered (layer $LAYER, contract v1.0.0)"
+echo -e "${GRN}[validate-k9]${NC} $CONFORMING conforming, $ADVISORY grandfathered, $ROUTED routed out of scope (layer $LAYER, contract v1.0.0)"
 if [ "$LAYER" = "L0" ] || [ "$LAYER" = "L1" ]; then
   # Say out loud what was NOT checked. A lexical pass is not a conformance
   # result, and the difference is the whole point of §12.
diff --git a/1-formats/k9/tools/conformance-report.mjs b/1-formats/k9/tools/conformance-report.mjs
new file mode 100644
index 000000000..0d8c6611b
--- /dev/null
+++ b/1-formats/k9/tools/conformance-report.mjs
@@ -0,0 +1,193 @@
+// SPDX-License-Identifier: MPL-2.0
+// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
+// hypatia: allow cicd_rules/javascript_detected -- Bun/GitHub JSON reporting boundary; zero dependencies.
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+export const VERSION = 1;
+const titles = { deed: 'DEED syntax', typecheck: 'K9 contract typecheck', selftest: 'K9 validator self-test', fixtures: 'K9 positive/negative controls', corpus: 'K9 live corpus (L0–L2)' };
+const marker = '<!-- k9-contractile-report: regenerated on every run -->';
+const clean = s => String(s).replace(/\x1b\[[0-9;]*m/g, '');
+const item = (id, status, reason = '', advisory = false) => ({ id, status, reason, advisory });
+const read = p => fs.readFileSync(p, 'utf8');
+export function counts(items) {
+  const c = { passed: 0, failed: 0, indeterminate: 0, not_applicable: 0, advisory: 0 };
+  for (const i of items) {
+    if (i.status === 'pass') c.passed++;
+    else if (i.status === 'fail') { c.failed++; if (i.advisory) c.advisory++; }
+    else if (i.status === 'not_applicable') c.not_applicable++;
+    else c.indeterminate++;
+  }
+  return c;
+}
+export function state(items) {
+  if (!items.length) return 'orange';
+  if (items.some(i => i.status === 'fail' && !i.advisory)) return 'red';
+  if (items.some(i => i.status === 'indeterminate')) return 'orange';
+  if (items.some(i => i.advisory)) return 'yellow';
+  return items.every(i => i.status === 'not_applicable') ? 'grey' : 'green';
+}
+export function assertions(output) {
+  return clean(output).split('\n').flatMap(line => {
+    const m = /^(ok|FAIL|SKIP)\s+(.+)$/.exec(line);
+    return m ? [item(m[2], m[1] === 'ok' ? 'pass' : m[1] === 'FAIL' ? 'fail' : 'indeterminate', m[1] === 'ok' ? '' : m[2])] : [];
+  });
+}
+export function checkedAssertions(output, code, expected) {
+  const rows = assertions(output);
+  if (!rows.length) rows.push(item('check execution', 'indeterminate', 'No assertion evidence was produced.'));
+  if (expected !== undefined && rows.length !== expected) rows.push(item('coverage', 'indeterminate', `Expected ${expected} controls, received ${rows.length} results.`));
+  if (code !== 0 && !rows.some(i => i.status !== 'pass')) rows.push(item('check execution', 'indeterminate', `Process exited ${code} despite passing assertion lines.`));
+  return rows;
+}
+export function corpusItems(text, expected, ledger, changed) {
+  const rows = [], seen = new Set();
+  for (const line of text.trim().split('\n').filter(Boolean)) {
+    let r;
+    try { r = JSON.parse(line); } catch { rows.push(item('validator output', 'indeterminate', 'Malformed JSON result.')); continue; }
+    if (!expected.includes(r.file) || seen.has(r.file) || !['pass', 'fail', 'error', 'routed'].includes(r.verdict) || !Array.isArray(r.findings)) {
+      rows.push(item(String(r.file ?? 'validator output'), 'indeterminate', 'Unexpected, duplicate or invalid result.')); continue;
+    }
+    seen.add(r.file);
+    const unavailable = r.findings.filter(f => f.severity === 'skipped');
+    const errors = r.findings.filter(f => f.severity === 'error');
+    const warnings = r.findings.filter(f => f.severity === 'warning');
+    const reason = r.findings.map(f => `${f.rule}: ${f.message}`).join('; ');
+    if (r.verdict === 'routed') rows.push(item(r.file, 'not_applicable', 'Routed to another dialect; not validated as a K9 contract.'));
+    else if (errors.length || r.verdict === 'fail' || r.verdict === 'error') rows.push(item(r.file, 'fail', reason, ledger.has(r.file) && !changed.has(r.file)));
+    else if (unavailable.length) rows.push(item(r.file, 'indeterminate', reason));
+    else if (ledger.has(r.file)) rows.push(item(r.file, 'fail', 'Stale debt exemption: this file now conforms.'));
+    else rows.push(item(r.file, 'pass', warnings.length ? reason : '', warnings.length > 0));
+  }
+  for (const f of expected) if (!seen.has(f)) rows.push(item(f, 'indeterminate', 'Validator did not return a result for this file.'));
+  if (!expected.length) rows.push(item('live corpus', 'not_applicable', 'No tracked live K9 contracts or routing files.'));
+  return rows;
+}
+function walk(dir) {
+  if (!fs.existsSync(dir)) return [];
+  return fs.readdirSync(dir, { withFileTypes: true }).flatMap(e => e.isDirectory() ? walk(path.join(dir, e.name)) : [path.join(dir, e.name)]);
+}
+function execute(root, command, args, env = {}) {
+  const r = spawnSync(command, args, { cwd: root, env: { ...process.env, ...env }, encoding: 'utf8', timeout: 180000, maxBuffer: 32 * 1024 * 1024 });
+  return { code: r.error || r.signal ? null : r.status, output: clean((r.stdout ?? '') + (r.stderr ?? '') + (r.error ? `\n${r.error.message}` : '')) };
+}
+export function collect(root, directory, env = process.env) {
+  fs.mkdirSync(directory, { recursive: true });
+  const run = (name, cmd, args, extra = {}) => {
+    const r = execute(root, cmd, args, extra);
+    fs.writeFileSync(path.join(directory, `${name}.log`), r.output);
+    return r;
+  };
+  const categories = [];
+  const add = (id, items) => categories.push({ id, title: titles[id], items, counts: counts(items), state: state(items) });
+  const tracked = execute(root, 'git', ['ls-files', '-z']);
+  if (tracked.code !== 0) throw Error('Cannot enumerate the tracked corpus.');
+  const files = tracked.output.split('\0').filter(Boolean);
+  const deeds = files.filter(f => !f.startsWith('9-archive/') && !f.includes('/fixtures/') && f.endsWith('.deed'));
+  if (!deeds.some(f => /^[^/]+_chora\.deed$/.test(f))) deeds.push('__missing_repo_deed__');
+  const runtime = env.BUN_BIN || 'bun';
+  const deedRows = [];
+  for (const f of deeds) {
+    if (f === '__missing_repo_deed__') { deedRows.push(item('repo deed', 'indeterminate', 'No tracked root <repo>_chora.deed found.')); continue; }
+    const r = run(`deed-${deedRows.length}`, runtime, ['1-formats/deed/tools/deed_lint.js', f]);
+    const ok = r.code === 0 && r.output.includes(`OK   ${f}`);
+    deedRows.push(item(f, ok ? 'pass' : r.code === 1 && r.output.includes(`FAIL ${f}`) ? 'fail' : 'indeterminate', ok ? '' : r.output.trim() || 'No DEED validator evidence.'));
+  }
+  add('deed', deedRows);
+  const contract = '1-formats/k9/spec/contract/k9_contract.ncl';
+  const nr = run('typecheck', 'nickel', ['typecheck', contract]);
+  add('typecheck', [item(contract, nr.code === 0 ? 'pass' : nr.code === null ? 'indeterminate' : 'fail', nr.code === 0 ? '' : nr.output.trim())]);
+  const validator = '1-formats/k9/tools/k9-validate.sh';
+  const sr = run('selftest', 'bash', [validator, '--self-test']);
+  let self = checkedAssertions(sr.output, sr.code);
+  if (sr.code === 0 && !sr.output.includes('self-test: all assertions passed')) self.push(item('completion', 'indeterminate', 'Missing self-test completion evidence.'));
+  add('selftest', self);
+  const fixtures = walk(path.join(root, '1-formats/k9/tools/fixtures')).filter(f => /\.(k9|ncl)$/.test(f));
+  const fr = run('fixtures', 'bash', [validator, '--strict', '--fixtures', '1-formats/k9/tools/fixtures']);
+  let controls = checkedAssertions(fr.output, fr.code, fixtures.length);
+  const names = fixtures.map(f => path.basename(f));
+  for (const name of names) if (!controls.some(r => r.id === name || r.id.startsWith(name + ' '))) controls.push(item(name, 'indeterminate', 'Expected control has no result.'));
+  if (new Set(names).size !== names.length) controls.push(item('fixture identity', 'indeterminate', 'Duplicate fixture basenames cannot be attributed uniquely.'));
+  if (state(categories.find(c => c.id === 'typecheck').items) !== 'green') {
+    controls = controls.map(i => i.status === 'pass' ? item(i.id, 'indeterminate', 'Normative contract did not typecheck; fixture verdict is not established.') : i);
+  }
+  add('fixtures', controls);
+  const expected = files.filter(f => /\.(k9|k9\.ncl)$/.test(f) && !f.startsWith('9-archive/') && !f.startsWith('1-formats/k9/tools/fixtures/'));
+  const ledgerFile = path.join(root, '.machine_readable/k9-contract-debt.txt');
+  const ledger = new Set(fs.existsSync(ledgerFile) ? read(ledgerFile).split('\n').filter(l => l && !/^\s*#/.test(l)) : []);
+  let changed = new Set(), baseResolved = true;
+  if (env.K9_BASE_SHA) {
+    const diff = execute(root, 'git', ['diff', '--name-only', '-z', `${env.K9_BASE_SHA}...${env.K9_HEAD_SHA || 'HEAD'}`]);
+    baseResolved = diff.code === 0;
+    changed = new Set(diff.output.split('\0').filter(Boolean));
+  }
+  const jsonFile = path.join(directory, 'corpus.jsonl');
+  const cr = run('corpus', 'bash', ['.githooks/validate-k9.sh'], { K9_VALIDATE_LAYER: 'L2', K9_JSON_REPORT: jsonFile, K9_CHANGED_FILES: [...changed].join('\n') });
+  const corpus = corpusItems(fs.existsSync(jsonFile) ? read(jsonFile) : '', expected, ledger, changed);
+  if (!baseResolved) corpus.push(item('change scope', 'indeterminate', 'Cannot resolve the PR base/head range; debt exemptions cannot be determined.'));
+  if (cr.code !== 0 && !corpus.some(i => i.status === 'indeterminate' || i.status === 'fail' && !i.advisory)) corpus.push(item('corpus gate', 'indeterminate', `Gate exited ${cr.code}; inspect corpus.log.`));
+  add('corpus', corpus);
+  const profileFiles = [contract, validator, '.githooks/validate-k9.sh', '1-formats/deed/tools/deed_lint.js', '1-formats/k9/tools/conformance-report.mjs'];
+  const profile = crypto.createHash('sha256').update(profileFiles.map(f => f + '\0' + read(path.join(root, f))).join('\0') + JSON.stringify({ fixtures: names.sort(), expected: expected.sort(), deeds: deeds.sort() })).digest('hex');
+  const all = categories.flatMap(c => c.items);
+  return { schema: VERSION, profile, generated: new Date().toISOString(), sha: env.K9_HEAD_SHA || execute(root, 'git', ['rev-parse', 'HEAD']).output.trim(), run: env.GITHUB_RUN_ID || 'local', pr: env.PR_NUMBER || 'local', url: env.GITHUB_RUN_ID ? `https://github.com/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}` : '', categories, state: state(all), counts: counts(all) };
+}
+const escape = s => String(s).replace(/[&<>|`]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '|': '&#124;', '`': '&#96;' }[c])).replace(/\r?\n/g, ' ');
+export function delta(current, previous, category) {
+  if (!previous || previous.schema !== VERSION || previous.profile !== current.profile || previous.sha === current.sha || previous.pr !== current.pr) return '— no comparable baseline';
+  const before = previous.categories.find(c => c.id === category.id);
+  if (!before || before.counts.indeterminate || category.counts.indeterminate) return '— indeterminate';
+  const a = before.counts.failed, b = category.counts.failed;
+  return b < a ? `↑ improved (${a - b} fewer failures)` : b > a ? `↓ regressed (${b - a} more failures)` : '↔ unchanged';
+}
+export function render(report, previous = null) {
+  const labels = { red: '🔴 failing', orange: '🟠 indeterminate', yellow: '🟡 advisory', green: '🟢 conformant', grey: '⚪ not applicable' };
+  const colour = { red: 'red', orange: 'orange', yellow: 'yellow', green: 'brightgreen', grey: 'lightgrey' };
+  const badge = `https://img.shields.io/badge/DEED%E2%80%93K9-${encodeURIComponent(report.state)}-${colour[report.state]}`;
+  let out = `${marker}\n![DEED–K9 ${report.state}](${badge})\n\n${labels[report.state]} · commit \`${escape(report.sha.slice(0, 12))}\` · ${report.url ? `[run ${escape(report.run)}](${report.url})` : 'local run'}\n\n`;
+  out += '| Category | Status | Pass | Fail | Indeterminate | N/A | Since previous revision |\n|---|---|---:|---:|---:|---:|---|\n';
+  for (const c of report.categories) out += `| ${c.title} | ${labels[c.state]} | ${c.counts.passed} | ${c.counts.failed}${c.counts.advisory ? ` (${c.counts.advisory} advisory)` : ''} | ${c.counts.indeterminate} | ${c.counts.not_applicable} | ${delta(report, previous, c)} |\n`;
+  for (const c of report.categories) {
+    const findings = c.items.filter(i => i.status !== 'pass' || i.advisory);
+    if (!findings.length) continue;
+    out += `\n<details>\n<summary>${c.title}: ${findings.length} finding(s) / scope notes</summary>\n\n`;
+    for (const i of findings.slice(0, 20)) out += `- **${escape(i.id)}** — ${escape(i.status)}${i.advisory ? ' (advisory)' : ''}: ${escape(i.reason).slice(0, 1200)}\n`;
+    if (findings.length > 20) out += `- ${findings.length - 20} more; see the structured report and logs.\n`;
+    out += '\n</details>\n';
+  }
+  out += '\nScope: DEED syntax and K9 contracts L0–L2. L3 signature verification and routed coordination dialects are not certified. Green is limited to this scope. Orange is missing evidence; grey is an explicit scope exclusion. Logs and report.json are in the dated conformance-evidence artifact on the linked run.\n';
+  const baseline = { schema: report.schema, profile: report.profile, pr: report.pr, sha: report.sha, categories: report.categories.map(c => ({ id: c.id, counts: c.counts })) };
+  out += `\n<!-- k9-baseline:${Buffer.from(JSON.stringify(baseline)).toString('base64')} -->\n`;
+  return out;
+}
+export function baseline(body) {
+  try {
+    const m = /<!-- k9-baseline:([A-Za-z0-9+/=]+) -->/.exec(body);
+    if (!m || m[1].length > 32000) return null;
+    const p = JSON.parse(Buffer.from(m[1], 'base64').toString());
+    if (!Array.isArray(p.categories) || !p.categories.every(c => c.counts && ['passed','failed','indeterminate','not_applicable','advisory'].every(k => Number.isSafeInteger(c.counts[k]) && c.counts[k] >= 0))) return null;
+    return p;
+  } catch { return null; }
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const root = process.cwd();
+  const safe = x => String(x || 'local').replace(/[^a-zA-Z0-9_-]/g, '_');
+  const date = new Date().toISOString().slice(0, 10);
+  const relative = `tests/conformance/${date}/pr-${safe(process.env.PR_NUMBER)}/run-${safe(process.env.GITHUB_RUN_ID)}-${safe(process.env.GITHUB_RUN_ATTEMPT || '1')}`;
+  const directory = path.resolve(root, relative);
+  let report;
+  try { report = collect(root, directory); }
+  catch (e) { const items = [item('report collection', 'indeterminate', e.message)]; report = { schema: VERSION, profile: '', sha: process.env.K9_HEAD_SHA || '', pr: process.env.PR_NUMBER || 'local', run: process.env.GITHUB_RUN_ID || 'local', url: '', categories: [{ id: 'corpus', title: 'Collection', items, counts: counts(items), state: 'orange' }], state: 'orange', counts: counts(items) }; }
+  fs.mkdirSync(directory, { recursive: true });
+  fs.writeFileSync(path.join(directory, 'report.json'), JSON.stringify(report, null, 2) + '\n');
+  const previous = process.env.K9_PREVIOUS_REPORT && fs.existsSync(process.env.K9_PREVIOUS_REPORT) ? baseline(read(process.env.K9_PREVIOUS_REPORT)) : null;
+  const markdown = render(report, previous);
+  fs.writeFileSync(path.join(directory, 'report.md'), markdown);
+  if (process.env.GITHUB_STEP_SUMMARY) fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, markdown);
+  if (process.env.GITHUB_ENV) fs.appendFileSync(process.env.GITHUB_ENV, `K9_REPORT_DIR=${relative}\n`);
+  console.log(markdown);
+  process.exitCode = report.state === 'red' ? 1 : report.state === 'orange' ? 2 : 0;
+}
diff --git a/1-formats/k9/tools/conformance-report.test.mjs b/1-formats/k9/tools/conformance-report.test.mjs
new file mode 100644
index 000000000..79d6034ee
--- /dev/null
+++ b/1-formats/k9/tools/conformance-report.test.mjs
@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: MPL-2.0
+// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
+// hypatia: allow cicd_rules/javascript_detected -- Bun reporting boundary regression tests.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { counts, state, checkedAssertions, corpusItems, render, delta, baseline } from './conformance-report.mjs';
+const row = (status, advisory = false) => ({ id: 'x', status, advisory, reason: '' });
+const json = (file, verdict = 'pass', findings = []) => JSON.stringify({ file, verdict, findings });
+test('known blocking failure remains red when other evidence is missing', () => {
+  assert.equal(state([row('fail'), row('indeterminate')]), 'red');
+  assert.equal(state([row('fail', true)]), 'yellow');
+  assert.equal(state([row('fail', true), row('indeterminate')]), 'orange');
+  assert.equal(state([row('not_applicable')]), 'grey');
+  assert.equal(state([row('pass'), row('not_applicable')]), 'green');
+  assert.equal(state([]), 'orange');
+});
+test('empty, partial and interrupted assertion streams never become a pass', () => {
+  assert.equal(state(checkedAssertions('', 0)), 'orange');
+  assert.equal(state(checkedAssertions('ok   one', 0, 2)), 'orange');
+  assert.equal(state(checkedAssertions('ok   one', 1)), 'orange');
+  assert.equal(state(checkedAssertions('FAIL one', 0)), 'red');
+  assert.equal(state(checkedAssertions('ok   one\nSKIP two', 0)), 'orange');
+});
+test('missing or malformed per-file evidence is indeterminate', () => {
+  assert.equal(state(corpusItems('', ['a'], new Set(), new Set())), 'orange');
+  assert.equal(state(corpusItems('not json', ['a'], new Set(), new Set())), 'orange');
+  assert.equal(state(corpusItems(json('a') + '\n' + json('a'), ['a'], new Set(), new Set())), 'orange');
+  assert.equal(state(corpusItems(json('b'), ['a'], new Set(), new Set())), 'orange');
+});
+test('missing semantic verifier is not a conformance pass', () => {
+  const result = corpusItems(json('a', 'pass', [{ severity: 'skipped', rule: 'K9-N000', message: 'no nickel' }]), ['a'], new Set(), new Set());
+  assert.equal(state(result), 'orange');
+  assert.equal(counts(result).indeterminate, 1);
+});
+test('debt is advisory only while untouched, and conforming exemptions fail', () => {
+  const data = json('a', 'fail', [{ severity: 'error', rule: 'K9-E001', message: 'invalid' }]);
+  assert.equal(state(corpusItems(data, ['a'], new Set(['a']), new Set())), 'yellow');
+  assert.equal(state(corpusItems(data, ['a'], new Set(['a']), new Set(['a']))), 'red');
+  assert.equal(state(corpusItems(json('a'), ['a'], new Set(['a']), new Set())), 'red');
+});
+test('routed dialects are excluded rather than counted as validated contracts', () => {
+  const items = corpusItems(json('coordination.k9', 'routed'), ['coordination.k9'], new Set(), new Set());
+  assert.equal(counts(items).passed, 0);
+  assert.equal(counts(items).not_applicable, 1);
+});
+test('comparisons require the same scope/profile and a different revision', () => {
+  const c = { id: 'corpus', counts: counts([row('pass')]) };
+  const current = { schema: 1, profile: 'p', pr: '12', sha: 'new', categories: [c] };
+  const previous = { ...current, sha: 'old', categories: [{ ...c, counts: counts([row('fail')]) }] };
+  assert.match(delta(current, previous, c), /improved/);
+  assert.match(delta(current, { ...previous, profile: 'other' }, c), /no comparable/);
+  assert.match(delta(current, current, c), /no comparable/);
+  assert.match(delta(current, { ...previous, categories: [{ ...c, counts: counts([row('indeterminate')]) }] }, c), /indeterminate/);
+});
+test('report escapes untrusted evidence and preserves a small valid baseline', () => {
+  const items = [{ id: '</details><script>x</script>', status: 'indeterminate', reason: 'bad | value\nnext' }];
+  const r = { schema: 1, state: 'orange', sha: 'abc', profile: 'p', pr: '1', run: 'local', url: '', categories: [{ id: 'corpus', title: 'Corpus', items, counts: counts(items), state: 'orange' }] };
+  const body = render(r);
+  assert.ok(!body.includes('<script>'));
+  assert.ok(body.includes('&#124;'));
+  assert.equal(baseline(body).sha, 'abc');
+  assert.equal(baseline('<!-- k9-baseline:xxx -->'), null);
+});
+test('the actual corpus shell gate rejects empty output and unattributed failure', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'k9-report-'));
+  try {
+    for (const dir of ['.githooks', '1-formats/k9/tools']) fs.mkdirSync(path.join(tmp, dir), { recursive: true });
+    fs.copyFileSync(new URL('../../../.githooks/validate-k9.sh', import.meta.url), path.join(tmp, '.githooks/validate-k9.sh'));
+    fs.writeFileSync(path.join(tmp, 'a.k9.ncl'), 'K9!\n');
+    spawnSync('git', ['init', '-q'], { cwd: tmp });
+    spawnSync('git', ['add', 'a.k9.ncl'], { cwd: tmp });
+    const validator = path.join(tmp, '1-formats/k9/tools/k9-validate.sh');
+    for (const body of ['exit 0', 'exit 1', `echo '${json('a.k9.ncl')}'\nexit 1`]) {
+      fs.writeFileSync(validator, '#!/bin/bash\n' + body + '\n');
+      const r = spawnSync('bash', ['.githooks/validate-k9.sh'], { cwd: tmp, encoding: 'utf8' });
+      assert.notEqual(r.status, 0, r.stdout + r.stderr);
+    }
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});

From 2cbe8ae07d1f9e244398732e2177a6381db8632a Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 17 Oct 2026 16:48:26 +0100
Subject: [PATCH 2/3] feat(k9): publish compact status tables and dated
 evidence artifacts

---
 .github/workflows/actions.lock                |   2 +
 .github/workflows/k9-contractile.yml          | 180 +++++-------------
 .gitignore                                    |   3 +
 1-formats/k9/tools/CONFORMANCE-REPORTING.adoc |  83 ++++++++
 1-formats/k9/tools/README.adoc                |   7 +
 1-formats/k9/tools/conformance-report.mjs     |  24 ++-
 .../k9/tools/conformance-report.test.mjs      |  18 ++
 README.adoc                                   |   4 +
 scripts/complete-job-refs.sh                  |   9 +-
 tests/conformance/README.adoc                 |  12 ++
 10 files changed, 199 insertions(+), 143 deletions(-)
 create mode 100644 1-formats/k9/tools/CONFORMANCE-REPORTING.adoc
 create mode 100644 tests/conformance/README.adoc

diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 08a84367b..24a50d8ee 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -90,6 +90,8 @@ workflows:
         - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
     '.github/workflows/k9-contractile.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
     '.github/workflows/label-triage.yml': []
     '.github/workflows/labels.yml': []
     '.github/workflows/launcher-standard-lockstep.yml':
diff --git a/.github/workflows/k9-contractile.yml b/.github/workflows/k9-contractile.yml
index 7abffb152..1cc2b79ee 100644
--- a/.github/workflows/k9-contractile.yml
+++ b/.github/workflows/k9-contractile.yml
@@ -45,6 +45,10 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: K9-SVC Validation
         run: |
@@ -119,147 +123,61 @@ jobs:
           echo "${NICKEL_SHA256}  ${RUNNER_TEMP}/nickel" | sha256sum -c -
           chmod +x "$RUNNER_TEMP/nickel"
           echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
-          echo "K9_REPORT=$RUNNER_TEMP/k9-report.md" >> "$GITHUB_ENV"
 
-      # Each step mirrors its output into $GITHUB_STEP_SUMMARY as well as
-      # stdout. The PR then shows the verdict without anyone opening a raw log,
-      # and `gh api repos/{o}/{r}/check-runs/{job_id} --jq .output.summary`
-      # reads it back — which matters on a machine that cannot reach the log
-      # blob host. `set -uo pipefail` without `-e` so a failing validator still
-      # reaches the tee and its own status is what the step exits with.
-      - name: K9 normative contract typecheck
-        run: |
-          set -uo pipefail
-          # Its own step, ahead of the fixtures. `nickel typecheck` stops at the
-          # first error, and when the contract is broken every fixture verdict
-          # downstream is void — reported as five "non-conforming" positive
-          # controls rather than one broken contract. Twice now that cost a run
-          # to diagnose (`Record`, then `Any`: neither is a Nickel type).
-          set +e
-          out="$(nickel typecheck 1-formats/k9/spec/contract/k9_contract.ncl 2>&1)"; rc=$?
-          set -e
-          {
-            echo '## K9 normative contract typecheck'
-            echo '```'
-            [ $rc -eq 0 ] && echo 'k9_contract.ncl typechecks' || printf '%s\n' "$out"
-            echo '```'
-          } | tee -a "$GITHUB_STEP_SUMMARY" "$K9_REPORT"
-          if [ $rc -ne 0 ]; then
-            printf '%s\n' "$out" | head -20 | while IFS= read -r line; do
-              esc="$(printf '%s' "$line" | sed 's/%/%25/g' | tr -d '\r\n')"
-              [ -n "$esc" ] && printf '::error title=k9_contract.ncl does not typecheck::%s\n' "$esc"
-            done
-          fi
-          exit $rc
+      - name: Install reporting runtime
+        if: ${{ always() }}
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
 
-      - name: K9 contract self-test
-        run: |
-          set -uo pipefail
-          # Asserts the validator's bash mirrors still agree with the normative
-          # contract, the capability arithmetic, the structural extractor, and
-          # the envelope strip. Runs before the fixtures so a broken validator
-          # is reported as a broken validator rather than as a broken corpus.
-          {
-            echo '## K9 contract self-test'
-            echo '```'
-            bash 1-formats/k9/tools/k9-validate.sh --self-test 2>&1
-            echo '```'
-          } | tee -a "$GITHUB_STEP_SUMMARY" "$K9_REPORT"
-          exit "${PIPESTATUS[0]}"
+      - name: Reporting regression tests
+        run: bun test 1-formats/k9/tools/conformance-report.test.mjs
 
-      - name: K9 conformance fixtures (positive AND negative controls)
+      - name: Read previous compact report
+        if: ${{ always() && github.event_name == 'pull_request' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          set -uo pipefail
-          # --strict: with Nickel on PATH every format layer (L0-L2) must
-          # actually run, so a missing toolchain cannot report a pass. The 21
-          # negative controls are the load-bearing half — a validator that
-          # accepts everything satisfies the positive half trivially.
-          set +e
-          out="$(bash 1-formats/k9/tools/k9-validate.sh --strict \
-            --fixtures 1-formats/k9/tools/fixtures 2>&1)"; rc=$?
-          set -e
-          {
-            echo '## K9 conformance fixtures'
-            echo '```'
-            printf '%s\n' "$out"
-            echo '```'
-          } | tee -a "$GITHUB_STEP_SUMMARY" "$K9_REPORT"
-          # A failing gate also raises a check-run annotation. Annotations are
-          # readable through `gh api repos/{o}/{r}/check-runs/{job}/annotations`
-          # from machines that cannot reach the log blob host, which is where
-          # the first two runs of this workflow had to be diagnosed from.
-          # Workflow-command escaping: % first, then CR and LF.
-          if [ $rc -ne 0 ]; then
-            # One annotation per failure, not one multi-kilobyte annotation: a
-            # whole-report message never reached the check-run API, and a
-            # per-failure annotation is what a reader wants anyway.
-            printf '%s\n' "$out" | grep -E '^(FAIL|ERROR)' | head -20 | while IFS= read -r line; do
-              esc="$(printf '%s' "$line" | sed 's/%/%25/g' | tr -d '\r\n')"
-              printf '::error title=K9 conformance fixture::%s\n' "$esc"
-            done
-          fi
-          exit $rc
+          set -euo pipefail
+          gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
+            --jq '[.[][] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- k9-contractile-report:")))] | last | .body // ""' \
+            > "$RUNNER_TEMP/k9-previous.md"
 
-      - name: K9 corpus conformance (ratcheted, L2)
+      - name: Collect DEED and K9 evidence
+        if: ${{ always() }}
         env:
-          # MIGRATION-1058 M7's first step. The hook's own default stays L1: a
-          # pre-commit hook that fails because a laptop lacks a toolchain
-          # teaches people to pass --no-verify, which is how a gate gets
-          # deleted. CI has the pinned binary, so here the corpus is checked at
-          # L2 as well. The six contractiles and the two axel config files that
-          # M1/M4 fixed had never been evaluated against K9.Component, and the
-          # closed record contracts in k9_contract.ncl rejected exactly the
-          # extension fields §5.5 permits. Ledger entries stay advisory, so the
-          # four svc templates and the rsr checklist are reported, not failed,
-          # until their own items land.
-          K9_VALIDATE_LAYER: all
+          PR_NUMBER: ${{ github.event.pull_request.number || 'local' }}
+          K9_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          K9_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          K9_PREVIOUS_REPORT: ${{ runner.temp }}/k9-previous.md
         run: |
-          set -uo pipefail
-          # The whole tracked corpus, through the same gate the pre-commit hook
-          # uses, so CI and the hook cannot disagree about what a K9 file is.
-          # .machine_readable/k9-contract-debt.txt grandfathers the files
-          # that predate the contract; it is shrink-only (a conforming file
-          # left in it fails), and it does not protect a file this PR touches.
-          set +e
-          out="$(bash .githooks/validate-k9.sh 2>&1)"; rc=$?
-          set -e
-          {
-            echo '## K9 corpus conformance (L2)'
-            echo '```'
-            printf '%s\n' "$out"
-            echo '```'
-          } | tee -a "$GITHUB_STEP_SUMMARY" "$K9_REPORT"
-          if [ $rc -ne 0 ]; then
-            printf '%s\n' "$out" | grep -E '^(FAIL|ERROR)' | head -20 | while IFS= read -r line; do
-              esc="$(printf '%s' "$line" | sed 's/%/%25/g' | tr -d '\r\n')"
-              printf '::error title=K9 corpus conformance::%s\n' "$esc"
-            done
+          set -euo pipefail
+          if command -v bun >/dev/null; then
+            bun 1-formats/k9/tools/conformance-report.mjs
+          else
+            node 1-formats/k9/tools/conformance-report.mjs
           fi
-          exit $rc
 
-      - name: Publish the K9 verdict to the pull request
-        # always(): a failing gate is exactly when the detail is needed, and a
-        # skipped step would publish nothing.
-        if: ${{ always() && github.event_name == 'pull_request' }}
+      - name: Archive dated conformance evidence
+        if: ${{ always() && env.K9_REPORT_DIR != '' }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: conformance-evidence-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ env.K9_REPORT_DIR }}
+          if-no-files-found: error
+          retention-days: 90
+
+      - name: Update the compact PR verdict
+        if: ${{ always() && github.event_name == 'pull_request' && env.K9_REPORT_DIR != '' }}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          set -uo pipefail
-          [ -s "$K9_REPORT" ] || { echo "no K9 report produced"; exit 0; }
-          {
-            echo '<!-- k9-contractile-report: regenerated on every run -->'
-            echo '# K9 contract conformance'
-            echo
-            echo "_run_ $GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
-            cat "$K9_REPORT"
-          } > "$RUNNER_TEMP/body.md"
-          # Always post; never PATCH. Creating a comment is the one path this
-          # step has been observed to complete, and two runs were lost
-          # diagnosing an update that could not be read back. Stacked reports
-          # cost a little noise on the PR and buy a result that actually
-          # arrives, which is the right trade while the log host is
-          # unreachable. Newest comment wins; each one names its run.
-          gh pr comment "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" \
-            --body-file "$RUNNER_TEMP/body.md" >/dev/null
-          echo "published the K9 verdict to #$PR_NUMBER"
+          set -euo pipefail
+          comment_id="$(gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
+            --jq '[.[][] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- k9-contractile-report:")))] | last | .id // ""')"
+          jq -n --rawfile body "$K9_REPORT_DIR/report.md" '{body: $body}' > "$RUNNER_TEMP/k9-comment.json"
+          if [ -n "$comment_id" ]; then
+            gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" --input "$RUNNER_TEMP/k9-comment.json" >/dev/null
+          else
+            gh api -X POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --input "$RUNNER_TEMP/k9-comment.json" >/dev/null
+          fi
diff --git a/.gitignore b/.gitignore
index 23c1789b7..e2133b91f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -105,3 +105,6 @@ hooks/playbook-to-recipe/Cargo.lock
 # Backup/scratch files (never commit)
 *.backup
 *.bak
+
+# Generated conformance evidence is uploaded by run, never mixed into source.
+/tests/conformance/????-??-??/
diff --git a/1-formats/k9/tools/CONFORMANCE-REPORTING.adoc b/1-formats/k9/tools/CONFORMANCE-REPORTING.adoc
new file mode 100644
index 000000000..e5e86e50f
--- /dev/null
+++ b/1-formats/k9/tools/CONFORMANCE-REPORTING.adoc
@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+= DEED–K9 evidence and compact reporting
+
+`conformance-report.mjs` calls the existing validators, retains their logs and
+produces a structured result plus one compact Markdown report. This is local
+reporting policy, not a new normative contract. It adds no K9 conformance rules.
+
+== What each category establishes
+
+[cols="1,3,3",options="header"]
+|===
+|Category |Evidence |Limit
+|DEED syntax |The current Bun linter accepts each tracked live deed; a root repo deed exists. |No assertion that metadata is true, complete or authorised.
+|Contract typecheck |Pinned Nickel typechecks the normative contract. |Does not establish that every predicate or validator path is correct.
+|Validator self-test |Mirror, extractor, capability and attribution assertions execute. |Finite implementation tests, not a proof of validator completeness.
+|Positive/negative controls |Valid examples pass; invalid examples fail by their named rule and layer. |Expected rejection is a successful test. Coverage is finite.
+|Live corpus L0–L2 |Tracked contracts are checked by the canonical hook with Nickel; changed debt entries lose their exemptions. |Coordination dialects are routed out of scope. L3 signature verification is outside this report.
+|===
+
+== Verdicts and counts
+
+* Red: at least one blocking conformance failure is known.
+* Orange: required evidence is incomplete, unavailable, interrupted or malformed.
+* Yellow: checks completed with permitted advisory debt or warnings.
+* Green: all applicable checks in the declared scope completed successfully.
+* Grey: explicitly not applicable, with a reason; never a synonym for not run.
+
+Red takes precedence over orange, so missing evidence cannot conceal a known
+failure. Indeterminate counts remain visible. Counts are result assertions or
+files, not lines of log output. Failed counts include advisory failures, labelled
+as such; advisory warnings on a passing file can also produce yellow. A routed
+coordination file is N/A, never a validated K9 contract. The combined badge covers
+DEED syntax and K9 L0–L2 only; it is no security certification or L3 claim.
+
+== Comparison and evidence
+
+The previous report is read from the latest bot-owned marked PR comment. A
+small baseline is embedded in that comment. Compare different revisions of the
+same PR only when schema, validator/profile hashes, tool versions, fixture definitions and corpus identities
+match and the category has no indeterminate evidence. Arrows mean fewer/more
+failed results; equal failures and advisories mean unchanged. Changes to scope or validators
+produce `no comparable baseline`, rather than an apparent improvement.
+
+Evidence lives in `tests/conformance/YYYY-MM-DD/pr-N/run-ID-ATTEMPT/` and is
+uploaded as a dated CI artifact. The current PR comment is updated in place.
+Failures and scope exclusions are expandable; at most 20 details per category
+are shown, with full evidence in the artifact. Run and commit identity accompany
+the badge. Reports are evidence, not an authority to weaken a gate.
+
+== Reproduce
+
+[source,bash]
+----
+# Install the workflow's pinned, SHA-256-verified Nickel, and use Bun.
+bun test 1-formats/k9/tools/conformance-report.test.mjs
+bun 1-formats/k9/tools/conformance-report.mjs
+----
+
+Exit 0 means green, yellow or explicit N/A; exit 1 means a blocking failure;
+exit 2 means evidence could not establish the verdict. CI retains its required
+job name. Existing structural/Mustfile checks still run and can fail the job
+independently of this scoped conformance report. No fabricated check status is
+posted. Fork PRs use `pull_request`, never privileged `pull_request_target`;
+if GitHub denies comment writes, the artifact and job summary remain available.
+
+== Audit changes
+
+The previous self-test workflow used a brace group ending in `echo`, so its
+pipeline status could hide the validator's failure. Collection now captures the
+actual subprocess exit. The corpus hook previously discarded that exit and
+could pass an empty result stream; it now checks both status and result count.
+Routed files no longer inflate the conformance count. A separate changed-file
+list applies debt policy to the full corpus without narrowing the scan.
+
+The structured reader additionally rejects missing, duplicate, unexpected or
+malformed per-file results. Missing tools and unresolvable PR ranges are orange.
+Report text escapes input from file paths and diagnostic messages.
+
+The lock membership helper also completes direct workflow refs from existing
+resolved dependencies. Its regression verifies idempotence; offline
+`gh-actions-lock --verify-local` checks that no new unresolved pin was invented.
+The full authenticated relock is unavailable in this environment; no dependency
+digest was changed.
diff --git a/1-formats/k9/tools/README.adoc b/1-formats/k9/tools/README.adoc
index d20b7631b..cd5de85db 100644
--- a/1-formats/k9/tools/README.adoc
+++ b/1-formats/k9/tools/README.adoc
@@ -23,6 +23,13 @@ The hook's default layer is L1 (it must run on a machine with no toolchain);
 the CI corpus step raises it with `K9_VALIDATE_LAYER=all`, because CI installs
 the pinned `nickel` binary. Ledger entries stay advisory at either layer.
 
+== Compact CI reports
+
+link:CONFORMANCE-REPORTING.adoc[Conformance reporting] defines the evidence
+schema, five-state verdicts, comparison rules and dated artifact layout.
+`conformance-report.mjs` renders one updatable PR table with expandable findings;
+`conformance-report.test.mjs` checks failure and missing-evidence behavior.
+
 == Running it
 
 [source,bash]
diff --git a/1-formats/k9/tools/conformance-report.mjs b/1-formats/k9/tools/conformance-report.mjs
index 0d8c6611b..7d1cf8ddb 100644
--- a/1-formats/k9/tools/conformance-report.mjs
+++ b/1-formats/k9/tools/conformance-report.mjs
@@ -57,6 +57,7 @@ export function corpusItems(text, expected, ledger, changed) {
     const warnings = r.findings.filter(f => f.severity === 'warning');
     const reason = r.findings.map(f => `${f.rule}: ${f.message}`).join('; ');
     if (r.verdict === 'routed') rows.push(item(r.file, 'not_applicable', 'Routed to another dialect; not validated as a K9 contract.'));
+    else if (errors.some(f => f.rule === 'K9-N002') && !errors.some(f => f.rule !== 'K9-N002')) rows.push(item(r.file, 'indeterminate', reason));
     else if (errors.length || r.verdict === 'fail' || r.verdict === 'error') rows.push(item(r.file, 'fail', reason, ledger.has(r.file) && !changed.has(r.file)));
     else if (unavailable.length) rows.push(item(r.file, 'indeterminate', reason));
     else if (ledger.has(r.file)) rows.push(item(r.file, 'fail', 'Stale debt exemption: this file now conforms.'));
@@ -89,6 +90,8 @@ export function collect(root, directory, env = process.env) {
   const deeds = files.filter(f => !f.startsWith('9-archive/') && !f.includes('/fixtures/') && f.endsWith('.deed'));
   if (!deeds.some(f => /^[^/]+_chora\.deed$/.test(f))) deeds.push('__missing_repo_deed__');
   const runtime = env.BUN_BIN || 'bun';
+  const tools = { runtime: process.version, bun: execute(root, runtime, ['--version']).output.trim(), nickel: execute(root, 'nickel', ['--version']).output.trim() };
+  fs.writeFileSync(path.join(directory, 'tools.json'), JSON.stringify(tools, null, 2) + '\n');
   const deedRows = [];
   for (const f of deeds) {
     if (f === '__missing_repo_deed__') { deedRows.push(item('repo deed', 'indeterminate', 'No tracked root <repo>_chora.deed found.')); continue; }
@@ -112,7 +115,7 @@ export function collect(root, directory, env = process.env) {
   for (const name of names) if (!controls.some(r => r.id === name || r.id.startsWith(name + ' '))) controls.push(item(name, 'indeterminate', 'Expected control has no result.'));
   if (new Set(names).size !== names.length) controls.push(item('fixture identity', 'indeterminate', 'Duplicate fixture basenames cannot be attributed uniquely.'));
   if (state(categories.find(c => c.id === 'typecheck').items) !== 'green') {
-    controls = controls.map(i => i.status === 'pass' ? item(i.id, 'indeterminate', 'Normative contract did not typecheck; fixture verdict is not established.') : i);
+    controls = controls.map(i => item(i.id, 'indeterminate', 'Normative contract did not typecheck; fixture verdict is not established. See fixtures.log.'));
   }
   add('fixtures', controls);
   const expected = files.filter(f => /\.(k9|k9\.ncl)$/.test(f) && !f.startsWith('9-archive/') && !f.startsWith('1-formats/k9/tools/fixtures/'));
@@ -130,31 +133,36 @@ export function collect(root, directory, env = process.env) {
   if (!baseResolved) corpus.push(item('change scope', 'indeterminate', 'Cannot resolve the PR base/head range; debt exemptions cannot be determined.'));
   if (cr.code !== 0 && !corpus.some(i => i.status === 'indeterminate' || i.status === 'fail' && !i.advisory)) corpus.push(item('corpus gate', 'indeterminate', `Gate exited ${cr.code}; inspect corpus.log.`));
   add('corpus', corpus);
-  const profileFiles = [contract, validator, '.githooks/validate-k9.sh', '1-formats/deed/tools/deed_lint.js', '1-formats/k9/tools/conformance-report.mjs'];
-  const profile = crypto.createHash('sha256').update(profileFiles.map(f => f + '\0' + read(path.join(root, f))).join('\0') + JSON.stringify({ fixtures: names.sort(), expected: expected.sort(), deeds: deeds.sort() })).digest('hex');
+  const profileFiles = [contract, validator, '.githooks/validate-k9.sh', '1-formats/deed/tools/deed_lint.js', '1-formats/deed/spec/abnf/deed.abnf', '1-formats/k9/tools/conformance-report.mjs'];
+  const fixtureDefinitions = fixtures.sort().map(f => path.relative(root, f) + '\0' + read(f)).join('\0');
+  const profile = crypto.createHash('sha256').update(profileFiles.map(f => f + '\0' + read(path.join(root, f))).join('\0') + fixtureDefinitions + (fs.existsSync(ledgerFile) ? read(ledgerFile) : '') + JSON.stringify({ tools, fixtures: names.sort(), expected: expected.sort(), deeds: deeds.sort() })).digest('hex');
   const all = categories.flatMap(c => c.items);
-  return { schema: VERSION, profile, generated: new Date().toISOString(), sha: env.K9_HEAD_SHA || execute(root, 'git', ['rev-parse', 'HEAD']).output.trim(), run: env.GITHUB_RUN_ID || 'local', pr: env.PR_NUMBER || 'local', url: env.GITHUB_RUN_ID ? `https://github.com/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}` : '', categories, state: state(all), counts: counts(all) };
+  const dirty = execute(root, 'git', ['diff', '--quiet', 'HEAD']).code !== 0;
+  return { schema: VERSION, profile, tools, dirty, generated: new Date().toISOString(), sha: env.K9_HEAD_SHA || execute(root, 'git', ['rev-parse', 'HEAD']).output.trim(), run: env.GITHUB_RUN_ID || 'local', pr: env.PR_NUMBER || 'local', url: env.GITHUB_RUN_ID ? `https://github.com/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}` : '', categories, state: state(all), counts: counts(all) };
 }
 const escape = s => String(s).replace(/[&<>|`]/g, c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '|': '&#124;', '`': '&#96;' }[c])).replace(/\r?\n/g, ' ');
 export function delta(current, previous, category) {
   if (!previous || previous.schema !== VERSION || previous.profile !== current.profile || previous.sha === current.sha || previous.pr !== current.pr) return '— no comparable baseline';
   const before = previous.categories.find(c => c.id === category.id);
   if (!before || before.counts.indeterminate || category.counts.indeterminate) return '— indeterminate';
+  if (before.counts.not_applicable !== category.counts.not_applicable) return '— scope changed';
   const a = before.counts.failed, b = category.counts.failed;
-  return b < a ? `↑ improved (${a - b} fewer failures)` : b > a ? `↓ regressed (${b - a} more failures)` : '↔ unchanged';
+  if (a !== b) return b < a ? `↑ improved (${a - b} fewer failures)` : `↓ regressed (${b - a} more failures)`;
+  const aw = before.counts.advisory, bw = category.counts.advisory;
+  return bw < aw ? '↑ fewer advisories' : bw > aw ? '↓ more advisories' : '↔ unchanged';
 }
 export function render(report, previous = null) {
   const labels = { red: '🔴 failing', orange: '🟠 indeterminate', yellow: '🟡 advisory', green: '🟢 conformant', grey: '⚪ not applicable' };
   const colour = { red: 'red', orange: 'orange', yellow: 'yellow', green: 'brightgreen', grey: 'lightgrey' };
-  const badge = `https://img.shields.io/badge/DEED%E2%80%93K9-${encodeURIComponent(report.state)}-${colour[report.state]}`;
-  let out = `${marker}\n![DEED–K9 ${report.state}](${badge})\n\n${labels[report.state]} · commit \`${escape(report.sha.slice(0, 12))}\` · ${report.url ? `[run ${escape(report.run)}](${report.url})` : 'local run'}\n\n`;
+  const badge = `https://img.shields.io/badge/DEED_syntax_%2B_K9_L0%E2%80%93L2-${encodeURIComponent(report.state)}-${colour[report.state]}`;
+  let out = `${marker}\n![DEED–K9 ${report.state}](${badge})\n\n${labels[report.state]} · commit \`${escape(report.sha.slice(0, 12))}\` · ${report.url ? `[run ${escape(report.run)}](${report.url})` : 'local run'}${report.dirty ? ' · working tree modified' : ''}\n\n`;
   out += '| Category | Status | Pass | Fail | Indeterminate | N/A | Since previous revision |\n|---|---|---:|---:|---:|---:|---|\n';
   for (const c of report.categories) out += `| ${c.title} | ${labels[c.state]} | ${c.counts.passed} | ${c.counts.failed}${c.counts.advisory ? ` (${c.counts.advisory} advisory)` : ''} | ${c.counts.indeterminate} | ${c.counts.not_applicable} | ${delta(report, previous, c)} |\n`;
   for (const c of report.categories) {
     const findings = c.items.filter(i => i.status !== 'pass' || i.advisory);
     if (!findings.length) continue;
     out += `\n<details>\n<summary>${c.title}: ${findings.length} finding(s) / scope notes</summary>\n\n`;
-    for (const i of findings.slice(0, 20)) out += `- **${escape(i.id)}** — ${escape(i.status)}${i.advisory ? ' (advisory)' : ''}: ${escape(i.reason).slice(0, 1200)}\n`;
+    for (const i of findings.slice(0, 20)) out += `- **${escape(i.id).slice(0, 240)}** — ${escape(i.status)}${i.advisory ? ' (advisory)' : ''}: ${escape(i.reason).slice(0, 280)}\n`;
     if (findings.length > 20) out += `- ${findings.length - 20} more; see the structured report and logs.\n`;
     out += '\n</details>\n';
   }
diff --git a/1-formats/k9/tools/conformance-report.test.mjs b/1-formats/k9/tools/conformance-report.test.mjs
index 79d6034ee..33188c2d5 100644
--- a/1-formats/k9/tools/conformance-report.test.mjs
+++ b/1-formats/k9/tools/conformance-report.test.mjs
@@ -81,3 +81,21 @@ test('the actual corpus shell gate rejects empty output and unattributed failure
     }
   } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
 });
+test('lock membership generator adds direct references and is idempotent', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'k9-lock-'));
+  try {
+    const wf = path.join(tmp, '.github/workflows');
+    fs.mkdirSync(wf, { recursive: true });
+    fs.writeFileSync(path.join(wf, 'test.yml'), 'jobs:\n  test:\n    steps:\n      - uses: owner/action@' + 'a'.repeat(40) + '\n');
+    const lock = path.join(wf, 'actions.lock');
+    fs.writeFileSync(lock, "version: 'v0.0.2'\nworkflows:\n    '.github/workflows/test.yml': []\ndependencies: {}\n");
+    const script = new URL('../../../scripts/complete-job-refs.sh', import.meta.url).pathname;
+    const r = spawnSync('bash', [script, wf], { cwd: tmp, encoding: 'utf8' });
+    assert.equal(r.status, 0, r.stderr);
+    const first = fs.readFileSync(lock, 'utf8');
+    assert.ok(first.includes('owner/action@' + 'a'.repeat(40)));
+    const again = spawnSync('bash', [script, wf], { cwd: tmp, encoding: 'utf8' });
+    assert.equal(again.status, 0, again.stderr);
+    assert.equal(fs.readFileSync(lock, 'utf8'), first);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
diff --git a/README.adoc b/README.adoc
index 70bb5a765..12bede55c 100644
--- a/README.adoc
+++ b/README.adoc
@@ -280,6 +280,10 @@ NOTE: Python is fully banned. The previous SaltStack exception has been removed.
 
 == Enforcement
 
+The link:.github/workflows/k9-contractile.yml[DEED–K9 workflow] publishes one
+compact PR report, with expandable findings and links to dated evidence.
+See link:1-formats/k9/tools/CONFORMANCE-REPORTING.adoc[its scope, colours and reproduction guide].
+
 === CI/CD Workflows
 
 Copy these workflows to `.github/workflows/` in your repository:
diff --git a/scripts/complete-job-refs.sh b/scripts/complete-job-refs.sh
index f3379bb78..bd34b812d 100755
--- a/scripts/complete-job-refs.sh
+++ b/scripts/complete-job-refs.sh
@@ -75,16 +75,17 @@ uses_values() {
   | tr -d '"'"'"'' | awk '{print $1}' | sed 's/,$//'
 }
 
-# 1. enumerate the refs each entry needs that gh actions-lock may not write, as
-#    "path<TAB>owner/repo@ref": the workflow's own job-level reusable refs, and
-#    every external ref used by a local composite action it reaches.
+# 1. enumerate each workflow's direct refs as well as reusable/composite refs.
+# This completes workflow membership for actions already resolved elsewhere in
+# the lock; it never resolves or changes a dependency digest. Offline verification
+# must still reject any reference without its own dependency entry.
 : > "$WANT"
 for f in "$WF"/*.yml "$WF"/*.yaml; do
   [ -e "$f" ] || continue
   b=".github/workflows/$(basename "$f")"
   set +e
   {
-    uses_values "$f" | grep -E '/\.github/workflows/'
+    uses_values "$f"
     reach_files "$f" | tail -n +2 | while IFS= read -r a; do uses_values "$a"; done
   } | while read -r u; do
       case "$u" in ./*|\$/*|docker://*|'') continue;; esac
diff --git a/tests/conformance/README.adoc b/tests/conformance/README.adoc
new file mode 100644
index 000000000..1f64bb4e8
--- /dev/null
+++ b/tests/conformance/README.adoc
@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+= Conformance evidence
+
+The runner writes `YYYY-MM-DD/pr-N/run-ID-ATTEMPT/` here, in UTC. Each directory
+contains `report.json`, the compact `report.md`, raw category logs and the
+validator's `corpus.jsonl`. Git ignores generated date directories. CI uploads
+each directory as a named artifact retained for 90 days; the PR report links to
+the run. Download it for longer retention. CI does not commit generated logs
+back to contributor branches.
+
+The schema, meaning of colours, comparison rules and reproduction commands are
+documented in link:../../1-formats/k9/tools/CONFORMANCE-REPORTING.adoc[the reporting guide].

From 0db2822073975db8671102e5a78c47c939d86655 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Sat, 17 Oct 2026 16:50:03 +0100
Subject: [PATCH 3/3] fix(ci): filter paginated comments with standalone jq

---
 .github/workflows/k9-contractile.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/k9-contractile.yml b/.github/workflows/k9-contractile.yml
index 1cc2b79ee..b934c6c13 100644
--- a/.github/workflows/k9-contractile.yml
+++ b/.github/workflows/k9-contractile.yml
@@ -139,7 +139,7 @@ jobs:
         run: |
           set -euo pipefail
           gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
-            --jq '[.[][] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- k9-contractile-report:")))] | last | .body // ""' \
+            | jq -r '[.[][] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- k9-contractile-report:")))] | last | .body // ""' \
             > "$RUNNER_TEMP/k9-previous.md"
 
       - name: Collect DEED and K9 evidence
@@ -174,7 +174,7 @@ jobs:
         run: |
           set -euo pipefail
           comment_id="$(gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
-            --jq '[.[][] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- k9-contractile-report:")))] | last | .id // ""')"
+            | jq -r '[.[][] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- k9-contractile-report:")))] | last | .id // ""')"
           jq -n --rawfile body "$K9_REPORT_DIR/report.md" '{body: $body}' > "$RUNNER_TEMP/k9-comment.json"
           if [ -n "$comment_id" ]; then
             gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" --input "$RUNNER_TEMP/k9-comment.json" >/dev/null