Complete receipt-backed binding compliance and retire legacy claims

.agents/skills/classic-project-guide/references/repo-guide.md

@@ -9,8 +9,8 @@ This file supplements `AGENTS.md`. Keep always-on architecture rules there; keep
 | Rust-only crates | `cargo fmt`, `cargo clippy`, focused `cargo test`; set `PYO3_PYTHON` first if PyO3 can build | Affected `docs/api/` pages for public contracts |
 | `classic-cli/` or `classic-gui/` | PowerShell wrappers in `Native C++ Wrappers` | Packaging/install output only when requested; CLI integration fixtures may require submodules |
 | `cpp-bindings/classic-cpp-bridge/` or Rust APIs exposed through C++ | CXX parity gate, then CLI/GUI wrapper tests for changed consumers | `docs/implementation/cxx_api_parity/baseline/`; `docs/api/cxx-parity-gate.md` |
-| `node-bindings/classic-node/` or Rust APIs exposed through Node | Node parity gate, declaration freshness, Bun and Node tests | `index.d.ts`, Node runtime coverage registry, `docs/implementation/node_api_parity/baseline/` |
-| `python-bindings/` or Rust APIs exposed through Python | Python parity gate, stub validation, rebuild, pytest | `.pyi` files, Python runtime coverage registry, `python-bindings/parity-artifacts/`, `docs/implementation/python_api_parity/baseline/` |
+| `node-bindings/classic-node/` or Rust APIs exposed through Node | Node parity gate, declaration freshness, Bun and Node tests | `index.d.ts`, shared conformance packs and receipts, `docs/implementation/node_api_parity/baseline/` |
+| `python-bindings/` or Rust APIs exposed through Python | Python parity gate, stub validation, rebuild, pytest | `.pyi` files, shared conformance packs and receipts, `python-bindings/parity-artifacts/`, `docs/implementation/python_api_parity/baseline/` |
 | `CLASSIC Data/databases/` or schema-version behavior | Schema drift guard and YAML publish validator | `docs/api/yaml-update-delivery.md` for loader, manifest, or delivery contract changes |
 | `CLASSIC Data/app-notification.yaml` or notification publish tooling | Notification source validator, dry-run harness, publish-tool tests | `docs/api/app-update-notification-delivery.md` and affected update/path/error API docs |
 | Linux or cloud validation | Rust-only subsets and source-only gates first | Note any skipped Windows/MSVC-native checks explicitly |
@@ -85,6 +85,27 @@ Use the `--group drift-guards` form when the schema drift guard or YAML publish
 
 ## Binding Parity Workflows
 
+The canonical contributor entrypoint is the Binding Compliance Suite. Run the
+source profile first; run applicable scenario launchers against built native
+bindings; aggregate a directory containing every family and execution instance
+only when requesting repository-wide proof:
+
+```powershell
+python tools/binding_compliance/check_compliance.py --repo-root . --profile ci
+python tools/binding_compliance/run_semantic_conformance.py --family <family> --participant <rust|node|python>
+pwsh -ExecutionPolicy Bypass -File tools/binding_compliance/conformance/adapters/run_cxx_conformance.ps1 -Family <family> -Compiler msvc
+pwsh -ExecutionPolicy Bypass -File tools/binding_compliance/conformance/adapters/run_cxx_conformance.ps1 -Family <family> -Compiler clang-cl
+python tools/binding_compliance/check_compliance.py --repo-root . --profile full --receipt-directory <receipt-directory>
+```
+
+Use the dedicated Scan Run/User Settings/consumer launchers listed in
+`docs/api/binding-compliance-suite.md` for those packs. Missing or stale receipts
+fail the full profile; source profiles and individual family jobs cannot certify
+the repository. Preserve sibling immutable plans when moving receipt artifacts.
+The old runtime registries, their loaders, claim-only summaries, and migration
+ledger are removed. The commands below remain focused source diagnostics and
+intentional baseline refresh tools; they do not grant runtime proof.
+
 ### CXX
 
 Use this when bridge source, `cpp-bindings/classic-cpp-bridge/build.rs`, or a Rust public API exposed through the bridge changes.
@@ -120,7 +141,7 @@ bun run parity:gate:local:vsdev
 bun run shell:vsdev           # interactive VS dev shell in this directory
 ```
 
-Use `parity:gate:local` only for intentional source-backed drift; it refreshes `index.d.ts`, updates the tracked Node baseline, and verifies declaration freshness. Commit affected files under `docs/implementation/node_api_parity/baseline/`, `node-bindings/classic-node/index.d.ts`, and `node-bindings/classic-node/__test__/fixtures/runtime_coverage_registry.json` when ownership changes. Do not commit `node-bindings/classic-node/parity-artifacts/` or generated `index.js`.
+Use `parity:gate:local` only for intentional source-backed drift; it refreshes `index.d.ts`, updates the tracked Node baseline, and verifies declaration freshness. Commit affected files under `docs/implementation/node_api_parity/baseline/`, `node-bindings/classic-node/index.d.ts` when source ownership changes. Do not commit `node-bindings/classic-node/parity-artifacts/` or generated `index.js`.
 
 ### Python
 
@@ -143,7 +164,7 @@ uv sync --project python-bindings --inexact --group drift-guards
 uv run --project python-bindings python tools/schema_version_gate.py --repo-root .
 ```
 
-Commit touched `.pyi` files, runtime coverage registry changes under `python-bindings/tests/fixtures/`, tracked reports under `python-bindings/parity-artifacts/`, and affected files under `docs/implementation/python_api_parity/baseline/` when generated results legitimately change.
+Commit touched `.pyi` files, shared conformance pack/adapter changes, tracked reports under `python-bindings/parity-artifacts/`, and affected files under `docs/implementation/python_api_parity/baseline/` when generated results legitimately change.
 
 ## Data Publish Workflows
 
@@ -180,6 +201,7 @@ Primary workflows:
 
 | Workflow | Purpose |
 | --- | --- |
+| `ci-binding-compliance.yml` | Blocking umbrella: same-revision reusable participant workflows, then full authenticated receipt aggregation |
 | `ci-cpp.yml` | CXX parity plus CLI and GUI build/test pipeline |
 | `ci-rust.yml` | Rust format, lint, build, and test pipeline |
 | `ci-typescript.yml` | Node parity, declaration freshness, and runtime tests |

.claude/skills/classic-project-guide/references/repo-guide.md

@@ -9,8 +9,8 @@ This file supplements `AGENTS.md`. Keep always-on architecture rules there; keep
 | Rust-only crates | `cargo fmt`, `cargo clippy`, focused `cargo test`; set `PYO3_PYTHON` first if PyO3 can build | Affected `docs/api/` pages for public contracts |
 | `classic-cli/` or `classic-gui/` | PowerShell wrappers in `Native C++ Wrappers` | Packaging/install output only when requested; CLI integration fixtures may require submodules |
 | `cpp-bindings/classic-cpp-bridge/` or Rust APIs exposed through C++ | CXX parity gate, then CLI/GUI wrapper tests for changed consumers | `docs/implementation/cxx_api_parity/baseline/`; `docs/api/cxx-parity-gate.md` |
-| `node-bindings/classic-node/` or Rust APIs exposed through Node | Node parity gate, declaration freshness, Bun and Node tests | `index.d.ts`, Node runtime coverage registry, `docs/implementation/node_api_parity/baseline/` |
-| `python-bindings/` or Rust APIs exposed through Python | Python parity gate, stub validation, rebuild, pytest | `.pyi` files, Python runtime coverage registry, `python-bindings/parity-artifacts/`, `docs/implementation/python_api_parity/baseline/` |
+| `node-bindings/classic-node/` or Rust APIs exposed through Node | Node parity gate, declaration freshness, Bun and Node tests | `index.d.ts`, shared conformance packs and receipts, `docs/implementation/node_api_parity/baseline/` |
+| `python-bindings/` or Rust APIs exposed through Python | Python parity gate, stub validation, rebuild, pytest | `.pyi` files, shared conformance packs and receipts, `python-bindings/parity-artifacts/`, `docs/implementation/python_api_parity/baseline/` |
 | `CLASSIC Data/databases/` or schema-version behavior | Schema drift guard and YAML publish validator | `docs/api/yaml-update-delivery.md` for loader, manifest, or delivery contract changes |
 | `CLASSIC Data/app-notification.yaml` or notification publish tooling | Notification source validator, dry-run harness, publish-tool tests | `docs/api/app-update-notification-delivery.md` and affected update/path/error API docs |
 | Linux or cloud validation | Rust-only subsets and source-only gates first | Note any skipped Windows/MSVC-native checks explicitly |
@@ -85,6 +85,27 @@ Use the `--group drift-guards` form when the schema drift guard or YAML publish
 
 ## Binding Parity Workflows
 
+The canonical contributor entrypoint is the Binding Compliance Suite. Run the
+source profile first; run applicable scenario launchers against built native
+bindings; aggregate a directory containing every family and execution instance
+only when requesting repository-wide proof:
+
+```powershell
+python tools/binding_compliance/check_compliance.py --repo-root . --profile ci
+python tools/binding_compliance/run_semantic_conformance.py --family <family> --participant <rust|node|python>
+pwsh -ExecutionPolicy Bypass -File tools/binding_compliance/conformance/adapters/run_cxx_conformance.ps1 -Family <family> -Compiler msvc
+pwsh -ExecutionPolicy Bypass -File tools/binding_compliance/conformance/adapters/run_cxx_conformance.ps1 -Family <family> -Compiler clang-cl
+python tools/binding_compliance/check_compliance.py --repo-root . --profile full --receipt-directory <receipt-directory>
+```
+
+Use the dedicated Scan Run/User Settings/consumer launchers listed in
+`docs/api/binding-compliance-suite.md` for those packs. Missing or stale receipts
+fail the full profile; source profiles and individual family jobs cannot certify
+the repository. Preserve sibling immutable plans when moving receipt artifacts.
+The old runtime registries, their loaders, claim-only summaries, and migration
+ledger are removed. The commands below remain focused source diagnostics and
+intentional baseline refresh tools; they do not grant runtime proof.
+
 ### CXX
 
 Use this when bridge source, `cpp-bindings/classic-cpp-bridge/build.rs`, or a Rust public API exposed through the bridge changes.
@@ -120,7 +141,7 @@ bun run parity:gate:local:vsdev
 bun run shell:vsdev           # interactive VS dev shell in this directory
 ```
 
-Use `parity:gate:local` only for intentional source-backed drift; it refreshes `index.d.ts`, updates the tracked Node baseline, and verifies declaration freshness. Commit affected files under `docs/implementation/node_api_parity/baseline/`, `node-bindings/classic-node/index.d.ts`, and `node-bindings/classic-node/__test__/fixtures/runtime_coverage_registry.json` when ownership changes. Do not commit `node-bindings/classic-node/parity-artifacts/` or generated `index.js`.
+Use `parity:gate:local` only for intentional source-backed drift; it refreshes `index.d.ts`, updates the tracked Node baseline, and verifies declaration freshness. Commit affected files under `docs/implementation/node_api_parity/baseline/`, `node-bindings/classic-node/index.d.ts` when source ownership changes. Do not commit `node-bindings/classic-node/parity-artifacts/` or generated `index.js`.
 
 ### Python
 
@@ -143,7 +164,7 @@ uv sync --project python-bindings --inexact --group drift-guards
 uv run --project python-bindings python tools/schema_version_gate.py --repo-root .
 ```
 
-Commit touched `.pyi` files, runtime coverage registry changes under `python-bindings/tests/fixtures/`, tracked reports under `python-bindings/parity-artifacts/`, and affected files under `docs/implementation/python_api_parity/baseline/` when generated results legitimately change.
+Commit touched `.pyi` files, shared conformance pack/adapter changes, tracked reports under `python-bindings/parity-artifacts/`, and affected files under `docs/implementation/python_api_parity/baseline/` when generated results legitimately change.
 
 ## Data Publish Workflows
 
@@ -180,6 +201,7 @@ Primary workflows:
 
 | Workflow | Purpose |
 | --- | --- |
+| `ci-binding-compliance.yml` | Blocking umbrella: same-revision reusable participant workflows, then full authenticated receipt aggregation |
 | `ci-cpp.yml` | CXX parity plus CLI and GUI build/test pipeline |
 | `ci-rust.yml` | Rust format, lint, build, and test pipeline |
 | `ci-typescript.yml` | Node parity, declaration freshness, and runtime tests |

.gitattributes

@@ -27,5 +27,8 @@
 tests/fixtures/autoscan_report_goldens/cases/*/expected.md -text
 tests/fixtures/autoscan_report_goldens/fcx-game/Fallout4.exe -text
 
+# Recovery conformance hashes malformed bytes exactly; checkout conversion would change the oracle.
+tests/fixtures/crash_log_scan_run/malformed-local-ignore.yaml -text
+
 # Use bd merge for beads JSONL files
 .beads/issues.jsonl merge=beads

.github/workflows/ci-binding-compliance.yml

@@ -0,0 +1,97 @@
+name: CI - Binding Compliance
+
+on:
+  push:
+    branches: [classic-next]
+  pull_request:
+    branches: [classic-next]
+
+permissions:
+  contents: read
+
+jobs:
+  rust:
+    uses: ./.github/workflows/ci-rust.yml
+  node:
+    uses: ./.github/workflows/ci-typescript.yml
+  python:
+    uses: ./.github/workflows/ci-python-bindings.yml
+  native:
+    uses: ./.github/workflows/ci-cpp.yml
+
+  full:
+    name: Full Repository Conformance
+    needs: [rust, node, python, native]
+    if: ${{ !cancelled() }}
+    runs-on: windows-latest
+    timeout-minutes: 360
+    env:
+      RUST_BACKTRACE: 1
+      CARGO_TERM_COLOR: always
+      PYO3_PYTHON: ${{ github.workspace }}\python-bindings\.venv\Scripts\python.exe
+    steps:
+      # Reusable workflows and this default checkout share the event revision
+      # and Windows workspace layout. Immutable plans are never rewritten.
+      - uses: actions/checkout@v6
+
+      - name: Download current-run conformance artifacts
+        uses: actions/download-artifact@v8
+        with:
+          pattern: '*conformance*'
+          path: tools/binding_compliance/artifacts/downloaded
+          merge-multiple: false
+
+      - name: Require every retained participant job to pass
+        if: ${{ !cancelled() }}
+        env:
+          PARTICIPANT_RESULTS: ${{ toJSON(needs) }}
+        run: |
+          $results = $env:PARTICIPANT_RESULTS | ConvertFrom-Json -AsHashtable
+          if ($results.Count -ne 4 -or @($results.Values | Where-Object { $_.result -ne 'success' }).Count -ne 0) {
+            throw 'Every retained participant workflow must pass before repository conformance can pass.'
+          }
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+
+      - name: Install Bun
+        uses: oven-sh/setup-bun@v2
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+
+      - name: Install conformance YAML parser
+        run: python -m pip install --disable-pip-version-check "ruamel.yaml>=0.18,<0.19"
+
+      - name: Install Node dependencies
+        working-directory: node-bindings/classic-node
+        run: bun install --frozen-lockfile
+
+      - name: Build Node binding for retained runtime gates
+        working-directory: node-bindings/classic-node
+        run: bun run build
+
+      # Full runs every retained gate, including the Python sync/rebuild. Failed
+      # or missing participant receipts cannot borrow another job's success.
+      - name: Run full binding compliance
+        if: ${{ !cancelled() }}
+        run: python tools/binding_compliance/check_compliance.py --repo-root . --profile full --receipt-directory tools/binding_compliance/artifacts/downloaded --output-dir tools/binding_compliance/artifacts/full
+
+      - name: Upload full binding compliance diagnostics
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: full-binding-compliance-report
+          path: tools/binding_compliance/artifacts/full/
+          if-no-files-found: warn
+          retention-days: 7