Proof Evidence and Honest Boundaries

A green command is not automatically proof of application behavior, dependency causality, cold setup, lifecycle closure, or the whole repository.

Ota publishes the strongest claim supported by runner-authored evidence and carries the remaining boundary in not_proved[].

• caller-side traces are supporting evidence and cannot promote a dependency to exercised
• an observer that merely exits zero cannot prove exercise
• an unrelated non-zero control cannot prove fault_tested
• even fault_tested may retain dependency_output_shaping_not_proved when the evidence covers causality but not wider output correctness

• cold_start_verified requires an absent or cleared isolated target plus producer and consumer evidence from the current run
• persistent_state_reused records verified pre-existing target state
• unknown remains when Ota cannot attest prior state or lineage
• a package cache may assist reconstruction while a fresh .venv or node_modules target still qualifies as cold for that asserted prerequisite
• services, databases, and volumes remain unknown until an adapter supplies trustworthy boundary and state evidence

• cleanup authority is acquired before Ota starts a service it owns
• pre-existing or unknown services are not silently claimed
• cleanup runs after acquired ownership on success, failure, and interruption
• boundary_terminated names Ota's exact ephemeral session; it does not claim host-wide process absence
• archive verification re-derives lifecycle selection, dependency closure, and teardown authority from the archived contract snapshot

ota proof lifecycle --workflow integration --json --archive

• read proof_verdict, not only top-level ok
• read not_proved[] before promoting a selected-lane result
• keep execution success, proof breadth, freshness, dependency evidence, and lifecycle closure as separate fields
• reject missing or contradictory evidence through the published JSON schemas instead of reconstructing claims from logs

{  ok: true,  proof_verdict: "passed_with_unproven_boundaries",  not_proved: [    {      kind: "dependency_output_shaping_not_proved"    }  ]}