Merge pull request #37 from StepenkoAnatoli/feat/corroboration-check

A thirteenth check: the gate can see single-sourcing (ADR-0036)

Author: StepenkoAnatoli

CONTEXT.md

@@ -151,3 +151,4 @@ Added 2026-09-21 under ADR-0032. The vocabulary of the ZIP that leaves this kit.
 | **unrewritten finding** | An `EVIDENCE.md` `Finding` cell byte-identical to what the extractor re-produces from the cached capture — so it was demonstrably never rewritten by a human. The negative half of a question with no positive answer: ADR-0013 refuses to grade whether an agent reasoned properly, and this does not try. It detects the unreviewed case only. |
 | **structural refusal** | A ZIP fault decided from the **central directory**, before one byte is inflated: traversal, absolute path, drive letter, backslash, NUL, duplicate, case collision, symlink, entry count, declared size, compression ratio. The directory is attacker-controlled too, so `inflateRawSync` also runs with `maxOutputLength` — the ceiling belongs to the runtime rather than to a field the attacker wrote. |
 | **transport, not storage** | What an artifact is. Workflow artifacts last at most 90 days on a public repository and vanish with the run that produced them, so anything that must persist is committed instead. |
+| **corroboration** | How many INDEPENDENT readings a closed unknown rests on, and the thirteenth check. Three shapes: one row (`single-source`), several rows from one host (`one-voice`), several hosts (`independent`). The middle one is the distinction a count cannot make — two pages from one vendor catch a misreading and cannot catch the vendor being wrong about itself. It reports and never fails on its own: a vendor's own reference is the authority on that vendor, and demanding a second opinion about it would be ceremony. `evidencePolicy=strict` is where an operator says otherwise. |

docs/ARCHITECTURE.md

@@ -415,6 +415,7 @@ each line — is in the ADR named beside it and in
 | A ZIP's structural faults are refused from the **central directory, before inflation**; the inflation ceiling is `maxOutputLength`, not a field the archive declared about itself | ADR-0032 |
 | **No dispatch input reaches a shell**: `${{ inputs.x }}` inside a `run:` block is substitution *before* the shell parses, so inputs arrive through `env:` and then an argv array. Enforced across **every** workflow, not only the newest | [ADR-0033](adr/0033-the-collector-refuses-rather-than-degrades.md), ADR-0020 |
 | The collector's spend gate is a **protected environment whose existence is proven**, because GitHub silently creates an *unprotected* one when a workflow names a missing environment; a missing credential **refuses** rather than falling back to a keyless route | ADR-0033 |
+| A claim's **support is weighed, not just checked**: `corroboration` reports whether a closed unknown rests on one reading, several readings of one source, or several hosts — it never fails a corpus on its own, because single-sourcing is often the right answer | [ADR-0036](adr/0036-the-gate-can-see-single-sourcing.md) |
 | A privacy claim is **measured, not asserted**: `bin/disclosure.mjs` re-runs the probe, and a report never lets an unchecked thing read as a clean one | [ADR-0035](adr/0035-a-privacy-claim-is-measured-not-asserted.md) |
 | A credential that resolves in a job declaring **no** environment is **not behind the approval gate**, and fails the run: the scope question GitHub will not answer directly is answered by asking it from a context that can see only one scope | ADR-0033 |
 | The vendor **package name** lives in `lib/firecrawl.mjs` (`CLI_PACKAGE`, `cliInstallSpec`), never in a workflow: the CLI is **`firecrawl-cli`**, and the npm package called `firecrawl` is the SDK and ships no binary. Both workflows installed the wrong one for weeks, and only a real dispatch could find it | ADR-0005, ADR-0033 |
@@ -436,7 +437,7 @@ Counted against the filesystem, not estimated:
 | `bin/` entrypoints | **29**, of which **4 are Python**: 3 conformance runners and the module they share |
 | `schemas/` | **12** |
 | `conformance/` vector packets | **3** |
-| checks in the registry | **12** |
+| checks in the registry | **13** |
 | supported CI platforms | **2** |
 
 The `schemas/` count became 12 on 2026-09-21 when `artifact-manifest.schema.json` arrived

docs/adr/0036-the-gate-can-see-single-sourcing.md

@@ -0,0 +1,105 @@
+# ADR-0036 — The gate can see single-sourcing, and says so without blocking
+
+- **Date:** 2026-09-21
+- **Status:** accepted
+- **Area:** contract checks, evidence policy
+- **Depends on:** ADR-0004 (the checks are an ordered registry), ADR-0013 (a check that judged reasoning would be wrong)
+
+## Context
+
+Twelve checks asked whether a claim was **backed**: is there a row, is there a capture,
+does the chain verify, is the capture whole, is it fresh, is it primary, has it been
+superseded. Not one asked whether it was backed **more than once**.
+
+So a corpus in which every unknown rested on a single page passed `preflight` and
+`--strict` with nothing to say about it. That is not hypothetical — it is this
+repository's own delivery-architecture corpus, on the day it was used to justify ADR-0031
+and ADR-0032. Nine rows, all primary, all `full`, all fresh, and eight unknowns each
+resting on exactly one of them. Three of those eight carried architecture decisions.
+
+**From inside such a corpus, a single correct source and a single lucky one are
+indistinguishable.** Every other check would report green either way.
+
+## Decision
+
+A thirteenth check, `corroboration`, reporting the **shape** of an unknown's support:
+
+| rule | when | severity |
+|---|---|---|
+| `single-source` | one row | `warn` |
+| `one-voice` | several rows, one host | `warn` |
+| `independent` | several rows, several hosts | `pass` |
+
+### It never fails a corpus on its own
+
+Single-sourcing is frequently the right answer. A vendor's own API reference *is* the
+authority on that API, and demanding a second opinion about it is ceremony. This check
+declines to make that judgement — it describes the support and leaves the call to a
+reviewer, which is the same line ADR-0013 drew when it refused to let a check grade
+reasoning.
+
+`corroboration` joins `transport-provenance` and `capture-completeness` in `POLICY_CHECKS`,
+so `evidencePolicy=strict` is where an operator says they want the harder rule. All three
+are questions an *evidence policy* should answer rather than the kit: how it was fetched,
+how much arrived, how many times it was read.
+
+Every existing corpus stays green. Verified on all three in this repository — the
+repository's own, and both nested decision projects — each still `PASS` under the default
+policy, now with warnings that say something true.
+
+### The host distinction is the point, not a refinement
+
+Counting rows would have been easier and would have missed the case that matters. Two
+pages from one vendor are **one witness read twice**: that catches a misreading, and
+cannot catch a vendor being wrong about itself. The remedies differ — one wants another
+page, the other wants another party — so the finding names which it found.
+
+## What it immediately said about work finished an hour earlier
+
+The corroboration pass that preceded this ADR added a second source to the three
+delivery-architecture unknowns that carry decisions, and the commit called them
+*"independent"*. The check disagrees: all three second sources are `docs.github.com`, so
+all three report `one-voice` rather than `independent`.
+
+**The check is right and the commit message was loose.** They are independent *pages* —
+different URLs, written by different teams, and they did catch facts the originals omitted,
+including that an unpinned API client silently moves to a different version on a date. They
+are not independent *sources*. The corpus's own contract already said this in prose —
+"a second reading of the same vendor" — and the commit summarising it reached for the
+stronger word anyway.
+
+That is the argument for the check in miniature: the distinction is easy to state, easy to
+believe you have honoured, and invisible unless something counts hosts.
+
+## Alternatives considered
+
+**Fail on single-sourcing.** Would have broken every corpus in this repository and most
+that anyone writes, to enforce a rule that is wrong about half the time.
+
+**Count rows and ignore hosts.** Simpler, and it would have graded the delivery corpus as
+corroborated when it is not.
+
+**Require a second source only for unknowns marked load-bearing.** No such marking exists,
+and inventing one moves the judgement into the contract without making it checkable.
+
+**Leave it to review.** That is what was happening. Review missed it for as long as the
+corpus existed, and the corpus was used to make two architecture decisions in the meantime.
+
+## Consequences
+
+- The registry is thirteen checks; the pinned-order test and the inventory move with it.
+- One preflight test asserted "every check reports a **pass**" on the fixture project. That
+  fixture is single-sourced, so it now carries one warning. The assertion was changed to
+  "every check **reports**", with the expected warning named — rather than padding the
+  fixture with a second source to preserve the old wording, which would have been tuning
+  the world to fit the assertion.
+- The policy-membership test stopped inferring "hygiene is not hardened" from a whole
+  verdict passing, and now isolates the claim. That proxy only ever worked while nothing
+  else in the policy set fired.
+
+## What this ADR does not claim
+
+That two hosts make a claim true. Two vendors can repeat one another, and a specification
+and its own tutorial are not independent whatever their hostnames say. `independent` means
+*this check found no reason to flag the support*, which is weaker than correct and is the
+strongest thing a mechanical check can honestly report.

docs/adr/README.md

@@ -51,5 +51,6 @@ directory and are treated as ADR-equivalent.
 | [0033](0033-the-collector-refuses-rather-than-degrades.md) | **The collector refuses rather than degrades, and no dispatch input reaches a shell.** `collect.yml` implements ADR-0031 against ADR-0032's contract, separate from `live-collection.yml` because "does the adapter work" and "collect this, for a person, now" deserve different approvers. The environment is the spend gate — and is **checked for existence**, because GitHub silently *creates* an unprotected environment when a workflow names one that is missing (E-06), which would remove the approval gate without failing anything. The honest limit is written in the file: GitHub exposes no scope information, so the marker proves the environment was configured and **cannot** prove a repository-level value did not serve the secret. No `http-keyless` fallback: a missing credential refuses rather than shipping a quietly worse corpus under the same artifact name. Every input arrives through `env:` and then an argv array — `${{ inputs.x }}` in a `run:` block is substitution *before* the shell parses, so a backtick in a topic executes. The test enforcing that scans every workflow and found `live-collection.yml` had been doing it since it was written; fixed here **Amended the same day**: the required reviewer is dropped and the environment kept. A reviewer approving a *dispatch* is a spend gate, not a review — nothing is collected yet to judge — and it makes autonomous dispatch impossible. The environment stays because it was never about approval: it is the only place the credential is unreadable by every other workflow. Spend is bounded by `max_pages`, the depth tier and the vendor's 402-at-zero cap. The control that replaces the reviewer is **token scope**: a fine-grained PAT with `Actions: read and write` on one repository, driven by `bin/collect-remote.mjs`, which takes **no `--token` flag** and redacts by pattern rather than by remembering its own value |
 | [0034](0034-the-collector-speaks-mcp-over-stdio.md) | **The collector speaks MCP over stdio** — and this is the first module in the repository built from research that PASSED THE GATE rather than from a plan; every decision cites an `E-` row in [`docs/decisions/2026-09-21-agent-interface/`](../decisions/2026-09-21-agent-interface/research/BRIEF.md). stdio because semantics are identical on both transports, so the difference is operational, and remote costs the entire OAuth 2.1 chain. Two tools, not one, because a server cannot initiate a request — so the alternative is a call held open for minutes and an agent that loses a paid run when its process dies. A `resource_link`, never embedded bytes: the spec defines embedding and **states no maximum size**, so "permitted" is not "known to work". The credential stays in the environment, which for stdio is what the spec itself prescribes. **The gate refused the first draft of that brief**, naming a load-bearing GAP; two more pages went into the same ledger to close it, and `resource_link` is what came back |
 | [0035](0035-a-privacy-claim-is-measured-not-asserted.md) | **A privacy claim is measured, not asserted — and this repository stays public.** The collector's own header said dispatch inputs are visible to anyone with read access. I wrote that from reasoning and never tested it; unauthenticated probing found the topic in **none** of the readable responses — run metadata, step names, timing and the artifact *listing* are `200`, while the artifact **download** is `401` and the job **logs** are `403`. A stranger learns a run's shape, not its subject. Wrong in the direction that feels safe is still wrong: a reader who finds one warning false discounts the next. Staying public because this account is on the **free** plan (checked, not inferred) where going private makes environment secrets *ignored* — a plan change, not a toggle. The claim is now executable: `bin/disclosure.mjs`, unauthenticated by construction, exit codes as the finding, and `needleChecked` so an **unchecked** thing can never print as a clean one |
+| [0036](0036-the-gate-can-see-single-sourcing.md) | **The gate can see single-sourcing, and says so without blocking.** Twelve checks asked whether a claim was *backed*; none asked whether it was backed more than once — so a corpus where every unknown rested on one page passed `preflight` AND `--strict`, and that corpus was this repository's own, on the day it justified ADR-0031 and ADR-0032. `corroboration` reports the SHAPE of support: `single-source`, `one-voice` (several rows, one host), or `independent` (several hosts). It **never fails on its own** — a vendor's own reference is the authority on that vendor — and joins the `POLICY_CHECKS` so `evidencePolicy=strict` is where an operator asks for the harder rule. The host distinction is the point: two pages from one vendor are one witness read twice. It immediately contradicted a commit written an hour earlier that called three `docs.github.com` pages "independent"; they are independent *pages*, not independent *sources*, and the check was right |
 
 Domain vocabulary lives in [`CONTEXT.md`](../../CONTEXT.md).

research-kit/README.md

@@ -395,7 +395,7 @@ node research-kit/bin/selftest.mjs            # all of it
 node research-kit/bin/selftest.mjs gate hook  # just these files
 ```
 
-824 tests, offline, no key and no network. The runner **awaits** every test, so `ok` means
+829 tests, offline, no key and no network. The runner **awaits** every test, so `ok` means
 the assertions settled (ADR-0021), and each test is raced against a watchdog
 (`RESEARCH_KIT_TEST_TIMEOUT`, default 60s).
 

research-kit/lib/checks.mjs

@@ -7,7 +7,7 @@
 // A check emits findings. It never decides what a finding MEANS for the build - that is
 // the verdict's single judgement, in lib/preflight.mjs.
 
-import { PATHS, resolve, exists, ageInDays } from './core.mjs';
+import { hostOf, PATHS, resolve, exists, ageInDays } from './core.mjs';
 import { captureOf, traceOf, citedIds } from './corpus.mjs';
 import { coverageOfUniversals } from './dimensions.mjs';
 import { verifyLedger } from './provenance.mjs';
@@ -477,6 +477,72 @@ function corpusShape(corpus) {
   return out;
 }
 
+
+// ---------------------------------------------------------------- 13. corroboration
+
+/**
+ * How many independent readings does a closed unknown rest on?
+ *
+ * WHY THIS EXISTS. Every check before it asks whether a claim is BACKED - is there a row,
+ * is there a capture, does the chain verify, is it fresh, is it primary. None of them asks
+ * whether it is backed more than once, so a corpus in which every unknown rested on a
+ * single page passed preflight and `--strict` with nothing to say about it. From inside
+ * such a corpus, a single CORRECT source and a single LUCKY one are indistinguishable.
+ *
+ * Found in this repository's own delivery-architecture corpus on 2026-09-21: nine rows,
+ * all primary, all complete, all fresh - and eight unknowns each resting on exactly one of
+ * them. Three of those eight carried architecture decisions.
+ *
+ * WHY IT IS A WARNING. Single-sourcing is often the right answer: a vendor's own API
+ * reference is the authority on that API, and demanding a second opinion about it would be
+ * ceremony. This check refuses to make that judgement - it reports the shape of the
+ * support so a reviewer can make it. `evidencePolicy=strict` or `--strict` is where an
+ * operator says they want the harder rule.
+ *
+ * WHY THE HOST MATTERS. Two pages from one vendor are not two witnesses. They are one
+ * witness read twice, which catches a misreading and cannot catch a vendor being wrong
+ * about itself. The finding says which of those it found, because the remedies differ:
+ * one wants another page, the other wants another party.
+ */
+function corroboration(corpus) {
+  const out = [];
+  const byId = new Map(corpus.evidence.map((row) => [row.id.toUpperCase(), row]));
+
+  for (const unknown of corpus.unknowns) {
+    // A KNOWN-UNKNOWN rests on nothing by definition, and unknown-closure already owns
+    // the case of a CLOSED one citing no row at all.
+    if (unknown.status !== 'CLOSED') continue;
+
+    const rows = unknown.cites
+      .filter((id) => /^E-\d+$/i.test(id))
+      .map((id) => byId.get(id.toUpperCase()))
+      .filter(Boolean);
+    if (!rows.length) continue;
+
+    if (rows.length === 1) {
+      out.push(finding('warn', 'corroboration', 'single-source',
+        `${unknown.id} rests on ${rows[0].id} alone - one reading, so a correct source and a lucky one look the same`,
+        { row: unknown.id, line: unknown.line }));
+      continue;
+    }
+
+    const hosts = new Set(rows.map((row) => hostOf(row.url)).filter(Boolean));
+    if (hosts.size === 1) {
+      out.push(finding('warn', 'corroboration', 'one-voice',
+        `${unknown.id} cites ${rows.length} rows and all are ${[...hosts][0]} - a second reading of one source, which catches a misreading and not a source that is wrong about itself`,
+        { row: unknown.id, line: unknown.line }));
+      continue;
+    }
+
+    out.push(finding('pass', 'corroboration', 'independent',
+      `${unknown.id} rests on ${rows.length} rows across ${hosts.size} hosts`,
+      { row: unknown.id, line: unknown.line }));
+  }
+
+  if (!out.length) out.push(finding('pass', 'corroboration', 'support', 'no closed unknown to weigh'));
+  return out;
+}
+
 // ---------------------------------------------------------------- the registry
 
 /** Order is part of the interface: a failure a person must act on precedes a warning. */
@@ -493,6 +559,7 @@ export const CHECKS = Object.freeze([
   { name: 'collection-attempts', about: 'a known-unknown was reached for before it was declared unreachable', run: collectionAttempts },
   { name: 'hygiene', about: 'duplicate rows, uncited captures, unparseable dates', run: hygiene },
   { name: 'corpus-shape', about: 'the corpus parses and the shape is there', run: corpusShape },
+  { name: 'corroboration', about: 'how many independent readings a closed unknown rests on', run: corroboration },
 ]);
 
 export const CHECK_NAMES = Object.freeze(CHECKS.map((c) => c.name));