PROP-056 — Scraped project export and in-place VibeVM removal

1. Owner mandate and outcome

02The owner requires a project that may be authored and maintained with VibeVM and then delivered without VibeVM repository artifacts: the vibevm/ tree, project .vibe/ state, vibe.toml, vibe.lock, discipline policy/index artifacts, managed harness blocks and source-level traceability metadata as selected by policy. The operation must preserve the native build. Ambiguity is expressed once in a project contract, after which inventory, rewriting, deletion, health checks, rollback and proof are algorithmic.

03The default contract lives at vibevm/scrape/contract.toml, may be replaced by an explicit --contract path, and—when contained in the project and selected for removal—is the last project payload file removed. Standard Cargo, npm, Maven and Python/pip health checks are declarative; a snapshotted user-defined verifier is the escape hatch for domain checks.

2. Relationship to existing laws

• 04PROP-031 supplies the write-side law: typed operation, deterministic plan, no free-form LLM rewriting, and post-operation gating. Scrape is one composed refactoring over source, manifests, generated state and project topology.
• PROP-052 defines the vibevm/ root. Scrape is the explicit terminal exception that removes that root from an exported consumer; it does not reintroduce the retired pre-PROP-052 Vibe layout.
• PROP-053 vibe clean removes regenerable dependency and boot products while retaining authored project state and vibe.lock. Scrape is not clean: it removes the Vibe relationship itself and therefore requires a contract, native health proof and recoverable commit.
• PROP-054 supplies typed lifecycle planning, injected environment authority, artifact identity and durable transaction precedents. Scrape reuses those principles but has a distinct external journal because project .vibe/ is removable.
• The Rust, TypeScript and Go AI-Native stacks remain authoring disciplines. Scrape removes their registered metadata and tool wiring; it never erases useful product code merely because a discipline helped create it.

3. Problem, boundary and vocabulary

05Scrape is the terminal cleaning operation defined here: it removes the selected VibeVM repository layer while preserving the native product. The command vocabulary deliberately reserves attach and detach for a future live-tool relationship such as connecting and disconnecting a debugger. Scrape is never an alias for that future runtime operation, and no detach spelling is accepted by this command.

06Blindly deleting Vibe paths is not safe. A Rust consumer may path-depend on the specmark proc macro inside vibevm/vibedeps; build scripts or CI may call vibe bin; generated product source may live beside disposable generated state; authored specifications may share a tree with generated boot output. A path name alone cannot decide disposition.

• 07A scraped tree is a project tree for which every contract-selected Vibe path, dependency, managed marker, source annotation, tool script and environment reference is absent or explicitly retained under a neutral identity, and whose required native health panel is accepted after scraping under the declared strict or no-regression baseline policy. A retained non-pass verdict is never described as an unconditional pass.
• Product preservation means: all untouched files are byte-identical; every authored source rewrite is metadata erasure-equivalent; every declared relocation preserves exact bytes and mode; native manifests and lockfiles describe the scraped dependency graph; the health oracle accepts the result.
• Zero residue means zero registered Vibe identities, paths and markers selected by this contract. It does not mean deleting an ordinary word such as “vibe” from prose, nor undoing architectural choices learned while using a discipline.
• The owner supplies policy: delete, keep, relocate, strip, retain, required checks and acceptable baseline mode. The engine supplies all mechanics and verdicts. Any state not decidable from the sealed contract and observed tree is a blocker, never a guess or best-effort success.

08Schema 1 does not reverse the historical influence of VibeVM on product architecture, infer replacements for arbitrary runtime libraries, mutate Git history, publish artifacts, or silently remove user-global deployments. Schema 1 does not discover, report or remove receipt-owned user-global deployments; the operator runs the existing explicit undeploy operation separately when external removal is desired.

09Epoch-1 contract parsing, planning and contract checking are portable. Mutating --output, --in-place and --recover execution is enabled only on Windows, where the implementation proves handle-relative exclusive directory creation, no-replace publication, write/delete-denying namespace seals and restartable cleanup. Linux, macOS and other hosts return the typed blocker scrape-platform-unsupported before journal creation or project mutation. Their wire/state-machine shape remains portable, but the product does not claim a weaker check-then-rename implementation as support.

10Windows epoch 1 does not claim POSIX directory fsync or a persistent-media namespace-flush guarantee that the public handle-relative rename/delete APIs do not provide. Every namespace change instead runs under an already-durable external WAL intent, uses the native held-source/expected-identity atomic primitive, is re-observed as exactly its sealed before or after state, and is replayed on recovery. This is reported as journal-recoverable namespace evidence, never as synced or write-through evidence. A verified Windows scrape therefore carries reduced assurance; a future strict media-durable profile remains unsupported until the platform supplies a compatible capability-relative primitive. Path-based MoveFileEx is not substituted because it would discard the no-follow/root-capability authority.

4. Command surface

• 11vibe scrape --plan [--contract <path>] [--output <dir> | --in-place] is read-only. With neither execution mode, it plans the in-place form because that is the larger risk surface; it writes no project, journal, quarantine or report file.
• vibe scrape --output <absent-dir> [--contract <path>] creates a scraped export and never changes the source tree. The destination must be absent; adoption of an existing directory is forbidden.
• vibe scrape --in-place [--contract <path>] executes the journaled in-place transaction. Interactive use shows the exact modified-file and deletion census; unattended use requires --assume-yes after a green plan.
• vibe scrape --recover --path <project> settles the one pending user-local transaction. Recovery reads the journaled contract and plan, never the possibly removed project contract. A new scrape refuses while recovery is pending.
• vibe scrape contract init writes a conservative default contract only when absent; vibe scrape contract check parses and plans it read-only. Existing contracts are never silently refreshed by install or a language discipline.
• --output and --in-place are mutually exclusive. --recover accepts neither mode nor contract because the durable journal already fixes both.

5. Contract discovery, schema and snapshot

12The default is the project-root literal vibevm/scrape/contract.toml. Every operand inside it is project-root-relative regardless of where an alternate contract lives. Contract location never changes mutation authority.

• 13An explicit --contract may name a portable project-relative literal or an explicit absolute regular file. A contained contract may be removed under the contract-last law. An external contract is read-only and can never be deleted or make any external path writable. Absolute selection walks and pins every parent no-follow; contained/external identity is decided by capability ancestry, never lexical prefix.
• The TOML schema rejects unknown tables, fields, tagged kinds and enum values. schema must equal 1; every id is a unique portable token across classification, rewrite, relocation, assertion and health rows.
• The contract is opened no-follow as a regular single-link file, size-bounded to 1 MiB and read stably through one held handle. A symlink, reparse point, hard link, special file, identity change or second-pass mismatch refuses.
• Before the first mutation the engine durably stores exact contract bytes, digest, canonical parsed value, expanded inventory, prepared rewrite outputs, verifier snapshots and plan hash in the user-local transaction. Recovery never rereads or reparses the source contract.
• For a contained contract, commit.contract = "delete-last" reserves it from every earlier wildcard batch. It is the last project payload file moved to quarantine; only deterministic pruning of now-empty ancestor directories follows. An external contract requires commit.contract = "preserve".
• A contained delete-last contract must resolve to exactly one regular effective-delete file. It cannot be effectively kept/generated, a rewrite target, relocation source/destination, baseline target or ordinary deletion entry. Broad patterns may select it only because the engine reserves its exact identity into the last slot before classification ordering. Any overlap that would produce another disposition refuses.

14Schema-1 example for a mixed Rust/TypeScript/Go consumer:

schema = 1
id = "org.example.scraped-release"

[policy]
unclassified = "refuse"
links = "refuse"
concurrent_change = "refuse"

[scope]
closed_roots = ["vibevm", ".vibe"]
outside = "implicit-keep"

[commit]
contract = "delete-last"

[[classify]]
id = "remove-vibevm-tree"
kind = "delete"
patterns = ["vibevm", "vibevm/**"]
owner = "vibe"
proof = "contract-assertion-v1"
modified = "delete"
require_match = true

[[classify]]
id = "remove-project-vibe-state"
kind = "delete"
patterns = [".vibe", ".vibe/**", "vibe.toml", "vibe.lock"]
owner = "vibe"
proof = "contract-assertion-v1"
modified = "delete"
require_match = false

[[classify]]
id = "remove-discipline-state"
kind = "delete"
patterns = [
  "conform.toml",
  "specmap.toml",
  "specmap.json",
  "*-ai-native-conform-baseline.json",
  "discipline/**",
]
owner = "vibe"
proof = "contract-assertion-v1"
modified = "delete"
require_match = false

[[classify]]
id = "keep-harness-docs"
kind = "keep"
patterns = ["AGENTS.md", "CLAUDE.md", "GEMINI.md"]
owner = "project"
require_match = false

[[rewrite]]
id = "remove-harness-blocks"
kind = "managed-block-remove-v1"
paths = ["AGENTS.md", "CLAUDE.md", "GEMINI.md"]
marker = "vibevm"
matches = "zero-or-one-per-file"

[[rewrite]]
id = "strip-rust-specmark"
kind = "rust-specmark-strip-v1"
patterns = ["**/*.rs"]
exclude = [".git/**", "vibevm/**", ".vibe/**", "target/**"]
forms = ["scope", "spec", "verifies", "cell"]
matches = "zero-or-more"

[[rewrite]]
id = "remove-rust-specmark-dependency"
kind = "cargo-package-remove-v1"
manifests = ["Cargo.toml", "crates/*/Cargo.toml"]
package = "core-ai-native-specmark"
aliases = ["specmark"]
matches = "zero-or-more"

[[rewrite]]
id = "remove-vibe-workspace-excludes"
kind = "toml-array-values-remove-v1"
path = "Cargo.toml"
table = ["workspace"]
key = "exclude"
values = ["vibevm", "vibevm/vibedeps"]
matches = "zero-or-more"

[[rewrite]]
id = "strip-typescript-spec-tags"
kind = "typescript-spec-comments-strip-v1"
patterns = ["src/**/*.ts", "src/**/*.tsx"]
matches = "zero-or-more"

[[rewrite]]
id = "strip-go-spec-directives"
kind = "go-spec-directives-strip-v1"
patterns = ["**/*.go"]
exclude = [".git/**", "vibevm/**", ".vibe/**"]
matches = "zero-or-more"

[[assert]]
id = "vibe-paths-absent"
kind = "paths-absent-v1"
patterns = ["vibevm", "vibevm/**", ".vibe", ".vibe/**", "vibe.toml", "vibe.lock"]

[[assert]]
id = "vibe-cargo-paths-absent"
kind = "cargo-path-prefix-absent-v1"
manifests = ["Cargo.toml", "crates/*/Cargo.toml"]
prefixes = ["vibevm/", ".vibe/"]

[health]
baseline = "strict"
before_failure = "refuse"
after_failure = "rollback"
parallel = false
network = "tool-offline"
max_stdout_bytes = 1048576
max_stderr_bytes = 1048576
max_result_bytes = 1048576
termination_grace_seconds = 5

[[healthcheck]]
id = "rust"
kind = "cargo"
root = "."
build = "build"
workspace = true
locked = true
all_targets = true
tests = "required"
profile = "dev"
features = []
timeout_seconds = 900

[[healthcheck]]
id = "web"
kind = "npm"
root = "web"
manager = "npm"
lockfile = "package-lock.json"
install = "none"
build_script = "build"
tests = "required"
test_script = "test"
timeout_seconds = 900
when = { path_exists = "package.json" }

[[healthcheck]]
id = "domain-health"
kind = "custom"
root = "."
source = "vibevm/scrape/health/domain_health.py"
snapshot = [
  "vibevm/scrape/health/domain_health.py",
  "vibevm/scrape/health/lib/**",
]
interpreter = "python"
argv = ["--phase", "{phase}", "--result", "{result}"]
protocol = "vibe-health-json-v1"
network = "deny"
reads = ["**"]
writes = []
spawn = true
timeout_seconds = 120

6. Path, glob, inventory and classification law

27Every mutation operand is resolved from the pinned project root. No contract field can name an absolute mutation path, parent traversal, drive, UNC path, URL or device. The explicit alternate contract source is the sole read-only external-path exception.

• 28Schema 1 owns one glob grammar: * means zero or more non-separator characters within one component; ** means zero or more complete components and is legal only as a whole component. ?, character classes, braces, negation, escapes, ***, embedded **, backslashes, colons, empty components and dot components are rejected.
• The filesystem and shell never expand a pattern. The engine enumerates no-follow logical paths, renders forward slashes, matches case-sensitively, byte-sorts and deduplicates. Authored pattern order has no semantic effect.
• Every entry beneath a selected deletion/classification root is inventoried. Any walk error, non-UTF-8 name, unsafe component, link/reparse point, special file or changed identity is a failure rather than absence. Schema 1 requires policy.unclassified = "refuse".
• The engine enumerates the whole pinned project for pattern matching and residual proof, excluding only .git/ internals and externally owned transaction state. Every existing entry at or below a literal scope.closed_roots member must be explicitly classified; an unmatched entry there refuses. Outside closed roots, unmatched paths are implicit project-owned keep. Explicit classify/rewrite/assert patterns may still select them. Rewrite targets are effectively kept unless an explicit classification conflict says otherwise.
• Project-selected trees are never passed to an ambient recursive delete. Files are classified and quarantined individually; directories are removed only when independently observed empty, deepest first. A kept descendant prevents ancestor deletion.
• .git and every descendant are non-addressable mutation paths in schema 1. A classify, rewrite, relocation, baseline, health-write or assertion operand that can effectively match them after include-minus-exclude evaluation refuses. Every broad source selector must therefore exclude .git/**; exclusion from inventory alone is never permission or a silent no-op.
• Classification uses a fixed lattice, not first-match order: keep plus generated is invalid; keep explicitly shields delete; generated proof dominates an overlapping delete; same-kind overlap is allowed only when owner, proof and modified policy are identical. Every path receives one effective disposition.

7. Typed rewrite algebra

33Globs select candidates; they never rewrite bytes. Authored source and structural manifests are changed only by a closed typed adapter. Generic regex replacement, shell rewrite hooks, implicit format conversion and whole-document reserialization are forbidden.

34Every planned rewrite records adapter epoch, parsed node identity, original byte span, complete before digest, prepared after bytes/digest, expected match cardinality and reason. Apply accepts only the journaled before state; recovery accepts only exact before or exact after. A third state is concurrent mutation and refuses.

8. Verification and user-defined health

40Verification is part of the contract, not an informal script run after deletion. The engine deterministically resolves, snapshots, invokes and judges the declared oracle. It proves exactly that the declared oracle accepted; it cannot infer that an incomplete user oracle covers every product requirement.

• 41The same canonical ordered health plan runs before and after. Strict baseline requires every check to pass; no-regression requires an admissible structured before verdict and its subset/severity relation after. A non-admissible before state causes no project mutation; an unacceptable after state rolls in-place work back. Executable, arguments, verifier snapshot, environment identity and policies are phase-identical except journaled phase/root/scratch values.
• Each preset declares tests = "skip" | "if-present" | "required". Required with no discoverable test target is a preflight failure. If-present records a typed skip, never pass. Skip is allowed but the final report labels verification reduced.
• No check retries by default. Timeout, cancellation, process-tree loss, unavailable executable, malformed protocol, undeclared effect or nonzero exit is an execution failure and never baselineable. A valid structured result written by an exit-0 custom verifier may carry a health-fail verdict; that is evidence eligible for explicit no-regression comparison, not an execution failure.

{
  "protocol": 1,
  "status": "pass",
  "summary": "domain health passed",
  "findings": [
    {
      "id": "stable/check-id",
      "severity": "info",
      "message": "bounded diagnostic",
      "evidence": "root-relative/path:line"
    }
  ],
  "metrics": { "tests": 42 }
}

9. Residual and preservation proof

53The final verifier reports zero unresolved members of: source metadata, dependency identity, manifest path, managed marker, generated artifact, tool config, tool script, selected spec URI, environment reference, lock entry and link escape.

• 54Proof combines language-aware scans, parsed manifest/dependency graphs, exact registered path/identity scans and a supplemental bounded lexical scan. A lexical prose hit is a disposition blocker, never auto-deletion.
• For each authored Rust, TypeScript and Go source, erase_registered_metadata(parse(before)) == parse(after). Untouched files have identical bytes; relocations have identical bytes/mode under the new path.
• Native manifest and lock adapters record before and after dependency graphs. Only dependencies made unreachable by planned removals disappear; shared transitive dependencies remain.
• Epoch-1 implements Cargo.lock v3/v4 reconciliation when the removed package has one unambiguous root identity and records exact before/after/removed graph evidence. npm, pnpm, yarn and Go native lock reconciliation remains a typed plan blocker until each manager has an equally exact graph proof.
• Canonical proof is emitted to stdout and the user-local transaction/report home, never into the scraped project whose zero-residue assertion it would contradict.

10. Scraped export mode

• 55Export holds the source project in an enforced read-only/COW view. The requested output must be disjoint from the source—neither equal, descendant nor ancestor. The engine pins its parent no-follow and creates an exclusive sibling candidate on the output filesystem; inability to enforce source immutability refuses.
• All project files outside selected deletion roots are copied byte/mode-identically except typed rewrites. The exact engine-reserved exclusion is .git and its descendants; authoritative transaction state is external and therefore not in the inventory. Ambient Git ignore or cache heuristics are never consulted: every other observed regular project file is copied unless the contract explicitly deletes it, so untracked/ignored product inputs cannot disappear by accident.
• After candidate structural proof, publish uses an atomic no-replace rename onto the still-absent requested output; a raced occupant or platform without no-replace guarantee refuses. The output is still transaction-owned and rollback-capable. Full residual and after health run in the external exact-copy view while the requested final path is protected by complete pre/post reproof. Failure removes only the exact owned output back into stage; before that rename the engine re-enumerates the complete no-follow descendant set and requires exact equality with the journaled candidate paths, identities, digests and modes. An extra, missing or changed descendant is a third state and refuses, preserving the concurrent data in place. The source remains unchanged.
• Export uses the same external journal with states prepared → candidate → published-pending-verify → verified → cleanup-pending → complete. Before verified, recovery discards or quarantines only the transaction-owned candidate/output and never publishes it as success; verified states roll forward through cleanup/report. Recovery validates the same complete descendant state, never only the root-directory identity; any third state refuses.

11. In-place transaction and recovery

56The authoritative journal and lock are user-local and outside the project, for example ~/.vibe/scrape/transactions/<project-key>/<transaction-id>/. Project .vibe/ is removable and can never contain the only journal, recovery intent, verifier snapshot or rollback bytes. The journal location is implementation-owned, not contract-configurable, and must itself be proven outside the pinned project root.

57Removed and replaced bytes live in an exclusively created, identity-pinned sibling quarantine under the project parent on the same filesystem. A pre-existing, linked, replaced or unverifiable quarantine refuses and is never adopted or deleted. The chosen name is durable before creation.

1. 58Acquire the user-local project transaction lock and settle any prior journal before loading a new contract.
2. Pin root and parent; read/validate the contract; inventory; prepare rewrites, relocations, native lock updates, assertions and health identities; calculate one canonical plan hash.
3. Persist contract/verifier snapshots, canonical plan, full before identities, complete rollback map and prepared after bytes in the external journal; fsync it before executing any child. No project byte or quarantine exists yet.
4. Run before health from the sealed verifier bundle in an enforced read-only/COW view whose writes are all redirected to phase scratch. Strict requires pass; no-regression admits only its specified structured baseline. If isolation cannot be enforced, refuse. A before refusal mutates no source-project byte.
5. After an admissible baseline, durably select the name and creation intent, exclusively create and identity-check the same-volume quarantine, then persist its root identity and complete manifest before entering mutating state. A crash after create but before that first identity seal is fail-closed manual recovery: the existing name is never adopted from spelling alone.
6. Copy and fsync every rewrite before-image into quarantine while its visible name remains present, then atomically replace that name with the prepared after-image. Reconcile native locks and apply exact relocations. Platforms lacking an atomic replace primitive for the target refuse; no move-then-create missing-name window is claimed atomic.
7. Move every non-contract removal into quarantine in canonical file order, then prune only observed-empty non-contract directories.
8. Run residual/preservation proof with a contained delete-last contract as the sole permitted residue; an external preserved contract receives zero project-tree exemption. Any failure rolls back.
9. Durably enter the rollback-capable contract-boundary state. Its tagged action is: contained/delete-last moves the contract as the last payload and prunes empty ancestors; external/preserve performs no project mutation. Both then run zero-exemption residual proof and after health in the isolated view. After it exits, re-observe the complete scraped tree digest and residual proof before verified commit. Crossing the contract boundary is not commit.
10. After all gates pass, durably mark verified, release project mutation ownership, copy the canonical report to the stable user-local report home, then clean the exact verified quarantine and transaction journal. Cleanup failure leaves a verified transaction in cleanup-pending state for roll-forward cleanup; it never reopens product mutation.

59The durable states are prepared → before-passed → mutating → contract-boundary → verified → cleanup-pending → complete, with rolling-back → rolled-back | rollback-failed as the inverse branch. The contract-boundary record carries exactly delete-last-moved | external-preserved. Failure or recovery from any state before verified restores in reverse journal order, including restoration of a moved contained contract, and proves the original bytes/modes. Verified and cleanup-pending only roll forward through report/quarantine/journal cleanup. Any path matching neither journaled before nor after is a third state and refuses rather than overwriting concurrent/user work.

60Git is not the rollback engine. Scrape works in non-Git projects and preserves untracked/ignored files according to the contract. A dirty repository is allowed only when every affected path's observed digest is sealed in the plan; unrelated concurrent changes remain detectable and refuse at the affected boundary.

12. Plan, report and observable outcomes

61Human and JSON plans are projections of one typed value. They include project/contract identities, mode, every matched path and effective class, ownership proof, modification state, rewrite before/after digests, relocation graph, native lock changes, residual assertions, exact health argv/executable identities, test modes, contract-last order, quarantine requirement, blockers and summary counts.

62The plan wire is scrape_plan/e1. Its required top-level members and enums are fixed below; item/rewrite/health variant members are the generated tagged unions from §5.1. Digests are lowercase sha256:<64-hex>, sizes/counts are nonnegative integers, and every array is already in canonical execution order.

{
  "schema": 1,
  "command": "scrape",
  "mode": "in-place",
  "plan_id": "sha256:...",
  "project": {
    "display_root": "C:/work/project",
    "tree_digest": "sha256:..."
  },
  "contract": {
    "display_path": "vibevm/scrape/contract.toml",
    "contained": true,
    "sha256": "sha256:...",
    "action": "delete-last"
  },
  "items": [],
  "rewrites": [],
  "relocations": [],
  "native_lock_changes": [],
  "assertions": [],
  "healthchecks": [],
  "contract_boundary": {
    "kind": "delete-last",
    "path": "vibevm/scrape/contract.toml",
    "empty_ancestors": ["vibevm/scrape", "vibevm"]
  },
  "blockers": [],
  "summary": {
    "keep": 0,
    "rewrite": 0,
    "relocate": 0,
    "delete_unmodified": 0,
    "delete_modified": 0,
    "delete_unknown": 0,
    "delete_last": 1
  }
}

64The required contract_boundary tagged union is either {"kind":"delete-last","path":<project-relative>, "empty_ancestors":[...]} or exactly {"kind":"preserve"}. Preserve has no path/ancestor members; delete-last requires both. Variant leakage is rejected by JTD.

65Plan display may carry absolute root, contract and executable paths; the separately generated hash projection excludes timestamps, transaction nonce, project-root display path, external contract source path, user-local journal location and quarantine name. It includes contract/verifier bytes, project-relative operands, executable content/version identity, platform, mode and—for export—the canonical requested output identity because that is a mutation target. The strict JTD identity object contains no maps/floats and is encoded in schema field order with canonical array order before SHA-256.

66The canonical external JSON report records before/after root digests, unchanged-file hashes, deleted artifacts with provenance, typed rewrites, relocations, dependency graphs, every health command step/argv/terminal/output digest/finding, skipped tests, residual counts, actual apply/rollback/recovery work, bounded diagnostic events and final outcome. Human output is rendered from the same data. Outcome is exactly verified | refused | rolled-back | rollback-failed; orthogonal assurance = full | reduced and cleanup = complete | pending fields prevent an outcome-enum explosion. The headline renders all three.

67Unavailable verification, truncated/missing structured evidence and rollback failure cannot yield a verified outcome. Explicitly skipped/if-present checks may yield outcome = verified, assurance = reduced; committed quarantine/report cleanup residue yields outcome = verified, cleanup = pending and a recovery command. Neither is rendered as unqualified verified/full/complete.

68Before transaction-journal cleanup, the canonical report is atomically copied to ~/.vibe/scrape/reports/<transaction-id>.json (or emitted only to stdout when the operator explicitly disables retention). The report home is outside the project and distinct from the ephemeral transaction directory.

13. Security and authority invariants

• 69All project reads/writes are capability-relative under pinned root/parent identities. No path normalization, glob, relocation, managed marker or verifier write may escape.
• Links, reparse points, special files, unexpected hard links and name/handle identity changes fail closed at inventory and again before mutation.
• Epoch-1 Windows crosses a hand-written native ABI in exactly five narrowly reviewed functions: lease-entry, remove-expected, create-directory, rename-no-replace and NTSTATUS conversion. No safe standard-library or cap-std primitive preserves the required retained-handle, no-follow, no-replace and race semantics for those operations. Each function owns its inline SAFETY proof and exact tests. This is not a broad crate or file exemption. A second consumer or an expanded native ABI is the trigger to revisit a dedicated audit crate.
• A custom health verifier is user-authorized code with the same trust consequence as a project build script. The plan names its exact snapshot/interpreter/effects before confirmation; packages cannot inject an executable scrape hook. Epoch 1 exposes only the disjoint copy through cwd and {root}; arbitrary malicious host-absolute writes are outside its sandbox guarantee and therefore require the same operator trust as any other authorized build script.
• Contract, plan, argv, output and reports may contain variable names and paths but never credential values. Custom children receive only allowlisted environment. Output redaction and bounds precede persistence.
• The running Vibe executable, user-local journal and machine cache are outside project mutation authority. Scrape removes repository integration, not the operator's installed tool.

14. Required verification matrix

• 70Strict parse/write tests cover every tagged variant, unknown field/kind/enum, duplicate id, missing required member, wrong schema and canonical plan identity.
• Glob tests cover literal, component star and whole-component double-star; reject question/class/brace/negation/ escape/triple-star/embedded-double-star, absolute/dot/backslash/colon spellings; prove no shell/host expansion and deterministic order.
• Fixtures cover clean generated, modified generated, explicit authored deletion, keep shielding, invalid keep/generated overlap, unclassified members, authored specifications and kept descendants preventing ancestor deletion.
• Rust goldens cover qualified/renamed aliases, explicit/grouped imports, scope/spec/verifies/cell, every Cargo dependency table, workspace inheritance, features and lock pruning across src, tests, examples, benches, build.rs and arbitrarily nested workspace members. Negatives preserve same-named local macros, strings/comments, re-exports, glob imports and invalid macro grammar. End-to-end REDs prove that a still-present path dependency blocks tree deletion before mutation, and a still-present macro/attribute blocks dependency removal rather than becoming rustc E0433 after publication.
• TypeScript/Go goldens cover mixed comments, empty metadata comments, CRLF/indentation preservation and non-target strings/prose/compiler/build/lint directives; product source/tests remain native-buildable.
• Managed-block fixtures cover valid, absent, orphaned, reversed, duplicate, nested and embedded markers. Relocation covers destination collision, overlap, cycle, cross-filesystem refusal, byte/mode equality and ancestor retention.
• Epoch-1 has a real hermetic Cargo before/after smoke plus exact argv and discovery unit coverage. Equivalent real npm, Maven and Python preset smokes remain planned and unsupported profiles remain typed blockers.
• Epoch-1 ships the sealed Windows exit-code/inherit/reads-all/writes-none/spawn-allowed custom profile with bundle, argv, output, timeout, cancel and drift tests. Stronger structured, denied-network and restricted-effect profiles remain planned behind explicit capability blockers.
• Strict before-red refuses with zero writes; before-green/after-red restores exact tree; admissible structured no-regression before-fail/after-subset yields reduced assurance; a new or worsened after finding rolls back; opaque nonzero never baselines.
• Fault injection at every journal, stage, rewrite, relocation, quarantine, contract-last, assertion, health, rollback and cleanup boundary proves restart idempotence, correct direction, third-state refusal and exact restoration. Before and after verifier cwd/{root} writes are trapped in the external exact copy/scratch, both the copy and delivered tree digest are re-proven after health, and ambient TMP/TEMP inside the project cannot redirect workspace creation into the product tree.
• Export REDs cover output equal to/inside/above source, destination race, unavailable no-replace rename, crash before/after publication, after health in an exact disjoint copy while the final location remains sealed, and extra/missing/changed descendants before rollback. Concurrent output data is never captured into transaction stage.
• Epoch-1 end-to-end fixtures cover real Rust export/in-place, Specmark erasure, Cargo.lock reconciliation, green before/after, zero selected residue, external report and safe second-scrape refusal. The mixed TypeScript/Go expansion remains planned.
• A future host fixture covers this repository's direct vibevm/vibepacks Cargo path wiring and proves the scraper reports non-Specmark product tool dependencies as blockers rather than deleting them into a broken build.

15. Implementation decomposition

1. 71A — strict contract model, default generator, path/glob parser, inventory/classification, canonical plan and human/JSON rendering.
2. B — typed rewrite/relocation algebra, managed blocks, Rust/Cargo, TypeScript/npm and Go/module adapters, Cargo v3/v4 native-lock reconciliation and residual proof. npm/pnpm/yarn/Go manager-native lock rows remain explicit blockers.
3. C — prepared Cargo/npm/Maven/Python presets, the exact-copy Windows Cargo backend, the narrow sealed custom profile, effect/output/process control and baseline comparison. Chains without complete runtime capabilities fail closed.
4. D — read-only source export transaction, candidate publication and export evidence.
5. E — external journal/lock, same-volume quarantine, in-place contract-last commit, rollback and recovery.
6. The pre-public internal transaction journal moved from handwritten epoch 1 JSON to the strict generated scrape-transaction-journal/e2 root. Old epoch-1 state refuses with an actionable restart recipe and is not migrated automatically; the public scrape plan, report and health-result roots remain byte-identical at epoch 1. Root and named-object member order is schema-declared; inline standard JTD discriminator arms use the pinned generator's deterministic canonical field order.
7. The pre-public prepared-health snapshot and canonical transaction health evidence use the strict generated scrape-prepared-health-snapshot/e2 and scrape-verification-health-evidence/e2 roots. An old handwritten prepared-health shape refuses with the restart recipe rather than being guessed forward. Live file identities and separately journaled verifier bundle bytes remain outside the plan snapshot and are reattached only after their recorded digest, byte count, mode and path identity agree. The public scrape plan, report and custom health-result roots remain byte-identical at epoch 1; their health finding/report-row vocabulary has one generated shared authority.
8. F — the bounded epoch-1 evidence includes transaction/store fault matrices, composed production recovery, real Rust Cargo/custom smokes, Windows races and explicit non-Windows fail-closed probes. Wider ecosystem and host-dogfood rows remain planned above.

16. Foundational decisions

17. History

882026-09-04: commissioned directly by the owner after auditing how Rust Specmark, TypeScript JSDoc and Go directive metadata behave when the Vibe tree disappears. The owner then extended the request to an explicit default/alternate contract and algorithmic standard/custom health checks, and ordered this feature ahead of every remaining lifecycle R task.

892026-09-05: implemented and ratified the Windows epoch-1 product surface: generated plan/report wire, external journal/workspace, capability mutation, export, in-place contract-last, rollback/recovery, exact-copy health, Cargo and the narrow custom profile. Recorded the remaining manager-native lock, wider preset/custom, mixed-language and host-dogfood work as explicit planned scope.