docs(runtime): assess evidence boundaries and specify artifact identity validation - #328

…rs, not pending

Follow-up on the Leaf assessment after the original author accepted the
correction and refined the takeaway. Two changes, both from reading the tree
rather than from the paper.

Accepts the second concept-level takeaway: separate the collection substrate
from the analysis-facing representation. Leaf does not hand probes to analyzers
-- probes are shaped for cheap instrumentation and an adapter reconstructs
structured events -- and that boundary is what stops a snapshot and an event
stream being forced into one datatype.

Replaces "decide before the second dynamic consumer" with what is actually
there. audit/runtime/ already ships four collectors, so Plan.md categories 6 and
11 exist as code with bespoke JSON each. Two producers of runtime.json emit two
different schema strings -- RetentionPath says own-runtime/1, the newer
stand-side collector and docs and every fixture say ownAudit/runtime/v1 -- a
lift-out artifact, but live. Nothing enforces either: correlate.py reads only
retained/type/count/expected/bytes/roots/kind/holder/member and never touches
schema, scenario, iterations, collector or verdict, and the one assertion checks
a producer against itself. No impact today since the correlator ignores unknown
fields; the risk is latent and cheap to settle now.

Adds a caution the proposed hybrid needs: moving completeness into the envelope
collides with the existing fail-closed contract, where a refusal means exit 2
and no artifact at all. A completeness: PARTIAL field would create the first
valid-but-admittedly-incomplete artifact -- possibly right for an event trace,
but a weakening to decide deliberately, not inherit.

Records the invariant that caused the original error, since it will recur: do
not infer analyzed-language support from the implementation language of the
core. P-022 moves the analyzer's implementation to Rust; it does not change the
audited runtime or make Rust an analysis target.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PbyzyVi7fibuSKLweuXgea

…cts before unifying them

Two corrections and a resequencing, all verified against the tree.

Counting fix: the note said four C# collectors under Own.NET/audit/runtime and
then showed a five-row table, because the fifth row is the lift-out producer in
the other repository. There are four directories under audit/runtime and five
producer implementations across the two repos.

Terminology fix, and it is load-bearing rather than pedantic. "Collector"
conflated two layers. Checked by the APIs each one calls: PropertyChangedStorm
opens an ETWTraceEventSource over an .etl captured externally by
PerfView/xperf/logman and acquires nothing at all; DuplicateDetector and
LeakHarness interpret a .dmp and can shell out to procdump; RetentionPath does
AttachToProcess or LoadDump. So the layering is acquisition (live attach / .dmp
/ .etl) then interpretation then analysis-facing artifact. That sharpens the
takeaway: the acquisition representation should not be the evidence
representation, and what deserves sharing is a runtime artifact contract, not a
collection substrate. A .dmp and an .etl are already good acquisition
substrates; unifying them would unify the wrong layer.

Resequencing: a shared envelope is the right destination but the wrong first
move, since designing commonality up front is the mistake Leaf avoids. The
minimal work is per-family mandatory schema identity, then readers that validate
family and major version while staying tolerant of unknown fields, and only then
an envelope extracted from commonality proven by shipped schemas. Step two is
the actual gap: correlate() duck-types any dict carrying a retained array.

Splits completeness into collection outcome, artifact validity and evidence
coverage. Refusal still means exit 2 and no artifact; validity is the missing
layer; coverage belongs to the artifact family, so heap retention can stay
total-or-no-artifact while an ETW trace carries real bounds. Records the
invariant that artifact existence proves execution of the producer contract, not
completeness of observation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PbyzyVi7fibuSKLweuXgea

Fixes two errors in the assessment note and promotes the one finding that
earned it from recorded to a written work item.

Arithmetic fix: the note claimed four of five producers emit no version, which
contradicted its own table. Ground truth -- RetentionPath emits a schema string
twice, OwnAudit.Runtime once, and LeakHarness, DuplicateDetector and
PropertyChangedStorm emit none. Three of five, not four.

Recounts by artifact family instead, since families are what would be versioned:
five producer implementations emit four analysis-facing families, and all four
have an identity problem -- heap-retention carries two conflicting identities,
the other three carry none. Also drops a stale tail that still spoke of a fourth
consumer inheriting the ambiguity; four families and five producers already
exist, so the trigger is the artifact surface expanding further.

Adds docs/tasks/runtime-artifact-identity.md in the established task-spec
format. Scope is held deliberately small: one identity per shipped family, an
explicit compatibility decision for the heap-retention lift-out split, readers
that reject missing identity, wrong family and unsupported major while still
accepting unknown fields, and negative fixtures for every rejection case. The
load-bearing acceptance case is that a valid-looking retained[] payload with a
wrong or missing schema must not correlate -- without it the change is a
decorative equality check. A common envelope, any completeness enum, acquisition
changes and SARIF changes are all explicitly out of scope, with a guard telling
implementers to stop if they start designing a field every family would share.

Priority recorded as small correctness debt with high leverage: not a blocker,
sequenced after the boundary and gate work already in flight.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PbyzyVi7fibuSKLweuXgea

The spec said 'not scheduled' but not what happens when it is, so the default
next action was to copy 132 lines into a GitHub issue and mint a second
normative surface -- the same duplicate-contract defect this task exists to fix,
reproduced in our own process.

Records the decision: this file stays canonical, no issue is filed at this
stage, and when the task enters the execution queue the issue is a thin handle
carrying title, a pointer to this spec, why-now, live dependencies and the PR
link -- with scope and acceptance explicitly not duplicated. Also notes the
second reason to wait: the task spans both repositories and its heap-retention
compatibility decision is taken up front, so execution metadata frozen today
would be stale by the time work starts.

No code, no scope, no acceptance changes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PbyzyVi7fibuSKLweuXgea