Add spec/ + source/ + explanatory docs from canon migration

docs/canon-vs-runtime.md

@@ -0,0 +1,73 @@
+# Canon vs Runtime
+
+LogLine is canon first. A runtime is an implementation that claims adherence to
+a specific canon version.
+
+## Canon
+
+The canon defines the normative shape:
+
+```text
+who
+did
+this
+when
+confirmed_by
+if_ok
+if_doubt
+if_not
+status
+```
+
+The canon owns:
+
+- required positions;
+- textual and JSON shape;
+- route classes;
+- lifecycle vocabulary;
+- evidence expectations;
+- conformance cases;
+- versioned normative changes.
+
+## Runtime
+
+A runtime executes, validates, walks, optimizes, and reports. It may be written
+in Rust, Python, JavaScript, or another language.
+
+A runtime owns:
+
+- parser implementation;
+- validator implementation;
+- evidence adapters;
+- CLI or SDK surface;
+- performance strategy;
+- storage strategy;
+- receipts emitted by that implementation.
+
+It does not own the norm.
+
+## Conformance
+
+An implementation should be able to say:
+
+```text
+I implement LogLine canon version X.
+I ran conformance suite Y.
+These receipts prove the observed result.
+```
+
+Conformance is measured against published artifacts, not against hidden behavior
+inside the Rust runtime.
+
+## Boundary
+
+The Rust runtime is the reference implementation. It is important, but not
+sovereign.
+
+The authority chain is:
+
+```text
+canon -> conformance corpus -> receipts -> implementation report
+```
+
+The runtime sits in the implementation layer.

docs/evidence-model.md

@@ -0,0 +1,124 @@
+# Evidence model
+
+## Purpose
+
+`confirmed_by` is the pivot of the LogLine runtime. It determines whether a
+candidate act has enough evidence to move toward `if_ok`, must remain in
+`if_doubt`, or should be rejected by `if_not`.
+
+## Evidence kinds
+
+### none
+
+No evidence was supplied.
+
+Rules:
+
+- MUST NOT release consequence by default.
+- MAY enter `if_doubt` for clarification, suspension, or simulation.
+- MAY be allowed only by explicit override or narrow canon rule.
+
+### token
+
+A named witness or local capability token.
+
+Example:
+
+```text
+ana
+operator:dan
+```
+
+Rules:
+
+- Useful for local workflows.
+- Not sufficient for strong public verification unless mapped to authority.
+
+### receipt
+
+A prior runtime artifact proving that a bounded observation occurred.
+
+Example:
+
+```text
+receipt:sha256:abc...
+```
+
+Rules:
+
+- SHOULD be dereferenceable or reproducible.
+- MUST define scope.
+- MUST NOT be generalized beyond its observed claim.
+- MAY be referenced by `receipt_hash` in `evidence.input_receipts`.
+- MAY become `confirmed_by` evidence for a later LogLine when its scope matches
+  the later claim.
+- MUST keep the canonical slots at top level when encoded as a LogLine receipt.
+
+### digest
+
+A cryptographic digest of a tuple, artifact, stdout, input, or receipt.
+
+Example:
+
+```text
+digest:sha256:abc...
+```
+
+Rules:
+
+- Identifies bytes or canonical tuple identity.
+- Does not by itself prove authority, intent, or execution.
+
+### signature
+
+A verifiable signature over a canonical message.
+
+Example:
+
+```text
+signature:ed25519:...
+```
+
+Rules:
+
+- Requires key, algorithm, message, and verification result.
+- SHOULD be linked to DID or authority document in future versions.
+
+### quorum
+
+A threshold witness pattern.
+
+Example:
+
+```text
+quorum:2:release_committee
+```
+
+Rules:
+
+- Duplicate witnesses MUST NOT count twice.
+- Quorum scope MUST be declared.
+- Quorum result SHOULD produce a receipt.
+
+## Evidence collapse
+
+Evidence collapse means the runtime has enough scoped evidence to route toward
+`if_ok`. It does not mean broad truth, production safety, or human-signature
+approval unless those are explicitly part of the claim and receipt.
+
+## Receipt hashes
+
+Receipt encoding distinguishes three identities:
+
+```text
+tuple_hash    identity of exactly the nine-slot LogLine tuple
+result_hash   identity of the produced result
+receipt_hash  identity of the historical receipt emission
+```
+
+`tuple_hash` uses the LogLine length-prefixed tuple profile.
+
+`result_hash` and `receipt_hash` use JCS / RFC 8785 canonical JSON with SHA-256
+in v0.
+
+Changing transport changes `receipt_hash`, but not `result_hash`.

docs/if-doubt-package-notes.md

@@ -0,0 +1,36 @@
+# LogLine Canon Improvement Pack - if_doubt as auditable simulation
+
+This package turns the raw improvement list into repo-ready source documents.
+It is intended as a draft bundle for the next canonical move.
+
+Central sentence:
+
+```text
+confirmed_by collapses evidence. if_ok releases the real. if_doubt simulates the possible. if_not records the false. status closes the history.
+```
+
+## Contents
+
+```text
+spec/if-doubt-simulation.md
+spec/if-doubt-canon-addendum.md
+spec/logline-canon.schema.json
+spec/grammar-delta-if-doubt.ebnf
+lips/LIP-0002-if-doubt-auditable-simulation.md
+docs/implementation-backlog.md
+docs/evidence-model.md
+docs/release-discipline.md
+docs/runtime-declaration.md
+docs/governance-delta.md
+docs/modes.md
+docs/implementation-plan.md
+conformance/cases.json
+conformance/README.md
+proposals/proposta-melhoria-canon-if-doubt.md
+```
+
+## Editorial stance
+
+This pack does not claim implementation. It defines the intended canonical rule,
+the receipt shape, the conformance fixture shape, and the implementation path.
+Runtime verification still requires the Rust CLI or another conforming runtime.

source/README.md

@@ -0,0 +1,3 @@
+# source/
+
+Canon and adapter specs described in the LogLine language itself (dogfooding). Not normative — the markdown specs in `spec/` are. These files demonstrate the language can describe its own protocols.

source/adapter-conformance.logline

@@ -0,0 +1,7 @@
+adapter_conformance define_conformance adapter_protocol_conformance lip_0006 confirmed_by canon_governance if_ok accept_adapter_conformance_report if_doubt require_more_cases if_not reject_conformance_claim status normative
+adapter_conformance require adapter_conformance_is_lateral lip_0006 confirmed_by canon_governance if_ok accept_lateral_claim if_doubt clarify_claim_scope if_not reject_canon_conformance_confusion status normative
+adapter_conformance require full_adapter_conformance_requires_report lip_0006 confirmed_by canon_governance if_ok accept_full_claim if_doubt mark_claim_unproven if_not reject_full_claim status normative
+adapter_conformance require conformance_report_references_protocol_lips lip_0006 confirmed_by canon_governance if_ok accept_report_scope if_doubt require_lip_reference if_not reject_unscoped_report status normative
+adapter_conformance require adapter_cases_include_no_slot_capture lip_0006 confirmed_by canon_governance if_ok accept_case_set if_doubt require_more_cases if_not reject_slot_capture_case_set status normative
+adapter_conformance require technical_failure_is_reported_not_branch_override lip_0006 confirmed_by canon_governance if_ok accept_failure_report if_doubt mark_technical_uncertainty if_not reject_false_canonical_not status normative
+adapter_conformance require conformance_runner_is_not_runtime_authority lip_0006 confirmed_by canon_governance if_ok allow_runner_projection if_doubt mark_runner_incomplete if_not reject_runner_as_canon status normative

source/adapter-declaration-profile.logline

@@ -0,0 +1,12 @@
+adapter_declaration_profile define_profile adapter_declaration lip_0005 confirmed_by canon_governance if_ok allow_manifest_projection if_doubt quarantine_incomplete_manifest if_not reject_declaration_profile status normative
+adapter_declaration_profile require adapter_identity_declared lip_0005 confirmed_by canon_governance if_ok accept_adapter_identity if_doubt require_identity_evidence if_not reject_anonymous_adapter status normative
+adapter_declaration_profile require adapter_kind_declared lip_0005 confirmed_by canon_governance if_ok accept_adapter_kind if_doubt quarantine_kind_claim if_not reject_unknown_kind status normative
+adapter_declaration_profile require effect_class_declared lip_0005 confirmed_by canon_governance if_ok accept_effect_class if_doubt require_effect_scope if_not reject_effect_claim status normative
+adapter_declaration_profile require supported_receipt_scopes_declared lip_0005 confirmed_by canon_governance if_ok accept_receipt_scope_list if_doubt require_scope_clarification if_not reject_unscoped_adapter status normative
+adapter_declaration_profile require manifest_is_auxiliary lip_0005 confirmed_by canon_governance if_ok allow_json_manifest if_doubt mark_manifest_incomplete if_not reject_manifest_as_canon status normative
+adapter_declaration_profile require projection_is_not_norm lip_0005 confirmed_by canon_governance if_ok allow_projection if_doubt mark_projection_incomplete if_not reject_projection_as_norm status normative
+adapter_declaration_profile define_vocabulary effect_none lip_0005 confirmed_by canon_governance if_ok allow_pure_adapter if_doubt inspect_adapter_claim if_not reject_effect_claim status normative
+adapter_declaration_profile define_vocabulary effect_read lip_0005 confirmed_by canon_governance if_ok allow_read_adapter if_doubt inspect_read_scope if_not reject_read_claim status normative
+adapter_declaration_profile define_vocabulary effect_write lip_0005 confirmed_by canon_governance if_ok allow_write_adapter_after_release if_doubt require_write_simulation if_not reject_write_claim status normative
+adapter_declaration_profile define_vocabulary effect_external lip_0005 confirmed_by canon_governance if_ok allow_external_effect_after_release if_doubt simulation_only if_not reject_external_effect_claim status normative
+adapter_declaration_profile define_vocabulary effect_irreversible lip_0005 confirmed_by canon_governance if_ok require_strong_release_evidence if_doubt block_irreversible_effect if_not reject_irreversible_effect_claim status normative

source/adapter-protocol.logline

@@ -0,0 +1,17 @@
+adapter_protocol define_contract inbound_adapter lip_0004 confirmed_by canon_governance if_ok translate_external_input if_doubt reject_implicit_effects if_not deny_adapter_claim status normative
+adapter_protocol define_contract evidence_adapter lip_0004 confirmed_by canon_governance if_ok resolve_confirmed_by if_doubt mark_unresolved_evidence if_not mark_contradicted_evidence status normative
+adapter_protocol define_contract runtime_invocation_transport lip_0004 confirmed_by canon_governance if_ok invoke_runtime if_doubt report_transport_uncertainty if_not report_transport_failure status normative
+adapter_protocol define_contract release_adapter lip_0004 confirmed_by canon_governance if_ok execute_released_route if_doubt simulate_without_effect if_not refuse_external_effect status normative
+adapter_protocol define_contract receipt_sink lip_0004 confirmed_by canon_governance if_ok persist_phase_receipt if_doubt preserve_unwritten_receipt if_not report_receipt_failure status normative
+adapter_protocol require adapter_must_not_redefine_canon lip_0004 confirmed_by canon_governance if_ok allow_adapter_registration if_doubt quarantine_adapter_claim if_not reject_adapter_claim status normative
+adapter_protocol require external_input_becomes_logline_candidate lip_0004 confirmed_by canon_governance if_ok allow_runtime_walk if_doubt require_translation_receipt if_not reject_external_input status normative
+adapter_protocol require confirmed_by_is_resolvable_evidence lip_0004 confirmed_by canon_governance if_ok resolve_evidence_scope if_doubt mark_evidence_unresolved if_not mark_evidence_contradicted status normative
+adapter_protocol require transport_invokes_runtime_without_judging lip_0004 confirmed_by canon_governance if_ok allow_runtime_invocation if_doubt report_transport_uncertainty if_not reject_transport_judgment_claim status normative
+adapter_protocol require if_ok_releases_external_effect lip_0004 confirmed_by canon_governance if_ok allow_released_execution if_doubt simulation_only if_not block_external_effect status normative
+adapter_protocol require if_doubt_must_not_mutate_world lip_0004 confirmed_by canon_governance if_ok preserve_simulation_boundary if_doubt simulate_without_mutation if_not reject_doubt_execution status normative
+adapter_protocol require adapter_receipts_prove_scope_not_universal_truth lip_0004 confirmed_by canon_governance if_ok accept_scoped_receipt if_doubt require_scope_clarification if_not reject_unscoped_receipt status normative
+adapter_protocol require default_deny_external_effects lip_0004 confirmed_by canon_governance if_ok allow_declared_effects_after_release if_doubt simulate_effects_only if_not block_undeclared_effects status normative
+adapter_protocol require branch_authority_remains_canonical lip_0004 confirmed_by canon_governance if_ok preserve_if_ok_if_doubt_if_not if_doubt reject_parallel_decision_field if_not deny_adapter_branch_override status normative
+adapter_protocol require adapter_failure_is_not_canonical_rejection lip_0004 confirmed_by canon_governance if_ok report_adapter_failure_receipt if_doubt mark_technical_uncertainty if_not avoid_false_canonical_not status normative
+adapter_protocol require receipt_sink_preserves_receipt_hash lip_0004 confirmed_by canon_governance if_ok accept_receipt_sink if_doubt quarantine_sink if_not reject_hash_mutating_sink status normative
+adapter_protocol clarify product_examples_are_not_canonical_adapters lip_0004 confirmed_by canon_governance if_ok allow_illustrative_examples if_doubt require_scope_clarification if_not reject_product_capture status normative

source/logline.canon.logline

@@ -0,0 +1,15 @@
+canon define logline 0.2.0-draft confirmed_by nine_position_form if_ok allow_runtime_walk if_doubt suspend if_not reject status canonical
+form require who did this when confirmed_by if_ok if_doubt if_not status
+runtime walk logline at_admissibility confirmed_by evidence if_ok release_to_tower if_doubt suspend if_not deny status judge
+if_doubt model auditable_simulation during_doubt confirmed_by doubt_trace if_ok record_trace if_doubt emit_simulation_receipt if_not forbid_execution status canonical
+human_or_authorized_actor express_or_author intent before_runtime confirmed_by accountability if_ok enter_translation if_doubt ask_or_suspend if_not reject status source
+llm_with_pocket_runtime translate natural_language before_logline confirmed_by pocket_runtime if_ok emit_logline if_doubt ghost_and_clarify if_not refuse_translation status translator
+logline hold act at_runtime_boundary confirmed_by nine_position_form if_ok enter_strong_grammar if_doubt remain_unreleased if_not void status canonical_act
+strong_grammar compile logline after_logline confirmed_by grammar_constraints if_ok emit_ir if_doubt return_to_logline if_not reject_shape status compiler
+ir model consequence after_strong_grammar confirmed_by algebra if_ok enter_runtime_walk if_doubt suspend if_not reject status formal
+tower operate released_consequence after_admissibility confirmed_by runtime_release if_ok execute if_doubt halt if_not do_not_execute status operator
+evidence close consequence after_operation confirmed_by receipt if_ok commit_status if_doubt mark_open if_not mark_failed status closure
+natural_language execute * before_logline confirmed_by * if_ok * if_doubt translate_with_pocket_runtime if_not forbid status forbidden
+llm become automation any_time confirmed_by * if_ok * if_doubt operator_only if_not forbid status forbidden
+act bypass logline any_time confirmed_by * if_ok * if_doubt suspend if_not reject status forbidden
+act release * any_time confirmed_by none if_ok * if_doubt suspend if_not reject status forbidden

spec/README.md

@@ -0,0 +1,16 @@
+# Engine spec/
+
+Normative-leaning artifacts that the engine implements but the canon has not yet **frozen**.
+
+The canon (`LogLine-Foundation/canon`) holds only what is content-frozen and citable as a stable identifier. Things here are **proposed** behavior the engine honors today, pending promotion to canon via a future LIP (see `LogLine-Foundation/governance/lips/`).
+
+| file | LIP |
+|---|---|
+| `logline.adapter.v0` | LIP-0004 (adapter protocol) |
+| `logline.adapter-declaration.v0` + `.schema.json` | LIP-0005 (declaration profile) |
+| `logline.adapter-conformance.v0` | LIP-0006 (adapter conformance) |
+| `logline.if-doubt.v0` | LIP-0002 (if-doubt simulation) |
+| `logline.if-doubt-simulation.v0` | LIP-0002 |
+| `logline.if-doubt-grammar.v0` | LIP-0002 |
+
+Grammar (EBNF for LogLine language proper) is intentionally not here yet — it is planned to live with the `constitutional-runtime` crate in the Minilab workspace, where it is consumed by the IR layer.

spec/logline.adapter-conformance.v0

@@ -0,0 +1,51 @@
+# Adapter Conformance
+
+Status: Draft
+Introduces: LIP-0006 Adapter Conformance
+Depends on: LIP-0004 Adapter Protocol, LIP-0005 Adapter Declaration Profile
+Primary lateral source: `../source/adapter-conformance.logline`
+
+## Core law
+
+```text
+Adapter conformance is lateral.
+Runtime conformance is canonical.
+Do not confuse them.
+```
+
+## Status values
+
+```text
+none
+partial
+full
+failed
+unknown
+```
+
+An adapter MUST NOT report `full` without a conformance report.
+
+An adapter MUST NOT claim full LogLine canon conformance merely because it
+passes adapter protocol cases.
+
+## Minimum case families
+
+```text
+adapter does not redefine canon
+external input becomes LogLine candidate
+confirmed_by is resolved or fails audibly
+runtime invocation transport invokes without judging
+release adapter requires if_ok before external effect
+if_doubt does not mutate world by default
+receipt proves scope
+receipt sink preserves hash and scope
+product examples do not become canonical adapters
+adapter manifest is auxiliary
+projection does not redefine protocol
+technical failure is not automatic if_not
+```
+
+## Runner boundary
+
+A future conformance runner may execute these cases. The runner is a projection
+and MUST NOT become canon authority.