chore: sync OpenAPI contract from logion-private

.deps.lock.json

@@ -38,6 +38,7 @@
     "dependencies": [
       "cryptography>=50.0.0,<51.0.0",
       "logion-client",
+      "logion-runner",
       "logion-skillmap",
       "pydantic>=2.7,<3.0.0",
       "pyyaml>=6.0,<7.0",

.github/workflows/pr-safety.yml

@@ -274,18 +274,8 @@ jobs:
       - name: Set up Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
-      - name: Install sf
-        run: >
-          cargo install --git https://github.com/nicolasmelo1/software-factory
-          --rev b06be44f6c982dac58b898778d7dba224d9ed7b1 --locked
-
-      # See the comment on `factory-check` in the Makefile for why the
-      # flag is required rather than a convenience.
-      - name: Prove the factory rules still fire
-        run: sf verify --allow-commands
-
-      - name: Software-factory rules
-        run: sf check --allow-commands
+      - name: Prove and check the pinned factory rules
+        run: make factory-check
 
       - name: Installer security guardrails
         run: make check-installer-security

CONTRIBUTING.md

@@ -60,6 +60,15 @@ make test
 - Python 3.12+
 - [uv](https://docs.astral.sh/uv/) — package and workspace manager
 - Node.js 18+ (only needed for the Prism mock server)
+- Rust/Cargo (for `make factory-check`; the first run builds the reviewed `sf` revision)
+
+`make factory-check` and CI use `python3 scripts/sf.py`, which installs the
+commit pinned in that launcher under `.local/software-factory/` without
+replacing a global `sf`. It checks Cargo source provenance and the installed
+binary's recorded SHA-256 before each invocation; an unrelated `sf` on `PATH`
+is never used. A missing install needs network access; a damaged or unverifiable
+install fails closed with its rebuild path. Do not remove rule documentation
+to accommodate a different local tool version.
 
 ## Running the OpenAPI mock locally
 

Makefile

@@ -152,9 +152,10 @@ check-docs:
 # runs a command, and without the flag `sf verify` scores it as fired on
 # the "commands are not enabled" finding instead of on its mutation --
 # a rule proven by its own refusal to run.
+.PHONY: factory-check
 factory-check:
-	sf verify --allow-commands
-	sf check --allow-commands
+	python3 scripts/sf.py verify --allow-commands
+	python3 scripts/sf.py check --allow-commands
 
 update-generated-lock:
 	uv run python scripts/check_generated_lock.py --update

artifacts/phase-gates/phase-15.15.json

@@ -7,12 +7,12 @@
       "driver": "codex",
       "implementation": {
         "private_sha256": "27ad80932471b07200b9367b7aaead63837d9d02725105f4e1bf172841cbae7f",
-        "public_sha256": "6acfa322ca19032a3f29a5300301c2e0ffa1ad74cec3691d0157904860cd4bf0"
+        "public_sha256": "99215a360de9e32afd8a33338bc966ebd246ebec901c3005dce2b76efa9e14d2"
       },
       "model": "gpt-5.4-mini",
       "report": "artifacts/phase-gates/reports/phase-15.15-isolated-runner-node.json",
-      "report_sha256": "dd7c5b4fe73648023fd542b79cd8adb49ccc18eca3eda8622e3fa21c5924befe",
-      "run_id": "20260907T012517-isolated_runner_node",
+      "report_sha256": "ecf736f4cffce4b50132ef608d8166588c01b02a67f4aad4b80fbc512c44d368",
+      "run_id": "20260907T234105-isolated_runner_node",
       "scenario": "isolated_runner_node",
       "status": "passed",
       "unsupported_assertions": []

artifacts/phase-gates/phase-16.1.json

@@ -4,15 +4,15 @@
   "runs": [
     {
       "api_adapter": "local-devrig",
-      "driver": "codex",
+      "driver": "claude-code",
       "implementation": {
         "private_sha256": "430be1d01d7c99d0021ffecd42af771a99e4a67ac76b9aca8892294e517a8efc",
-        "public_sha256": "1d445b479d9912ef8022e7f17eb6ff1cc6c775e15c0a3f101dcf0b901c407961"
+        "public_sha256": "210dd03705f79936bc25d17e085166bb0bad303924dc3e11bb75f5a8885c364c"
       },
-      "model": "gpt-5.4-mini",
+      "model": "claude-haiku-4-5",
       "report": "artifacts/phase-gates/reports/phase-16.1-eval-contract-reference-runner.json",
-      "report_sha256": "2ad3029ef87cd460b0df7af3dcf66c9fac023863c792bf3c61a285d851392652",
-      "run_id": "20260907T011240-eval_contract_reference_runner",
+      "report_sha256": "72cec14d236e18f2b649d4b3155bbb6b3e2a1183e63434e188e5797c3e7918d4",
+      "run_id": "20260907T225931-eval_contract_reference_runner",
       "scenario": "eval_contract_reference_runner",
       "status": "passed",
       "unsupported_assertions": []