feat(skills): retain native evidence and audit dependencies

.gitattributes

@@ -0,0 +1 @@
+vendor/parquet/src/bin/parquet-fromcsv-help.txt whitespace=-blank-at-eol

.github/workflows/quality.yml

@@ -64,7 +64,7 @@ jobs:
         with:
           tool: cargo-deny@0.19.2
       - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0
-      - run: timeout -k 5 60 cargo +1.95 fmt --all -- --check
+      - run: timeout -k 5 60 cargo +1.95 fmt --package allstack -- --check
       - run: timeout -k 5 60 cargo +1.95 fmt --manifest-path examples/spendcheck/Cargo.toml -- --check
       - run: timeout -k 5 90 cargo +1.95 deny check
       - run: timeout -k 5 270 cargo +1.95 clippy --all-targets --locked -- -D warnings

Cargo.toml

@@ -22,6 +22,9 @@ uuid = { version = "1", features = ["v4"] }
 [dev-dependencies]
 tempfile = "3"
 
+[patch.crates-io]
+parquet = { path = "vendor/parquet" }
+
 [[test]]
 name = "workspace"
 harness = false

docs/README.md

@@ -2,6 +2,8 @@
 
 ## Design
 
+- [2026-10-27: Native evidence checkpoints and Chronis qualification](plans/2026-10-27-native-evidence-and-chronis-design.md) — hosted-proof lessons in existing skills, preserved receipt streams, and real CLI integrity acceptance across Codex and Claude.
+
 - [2026-10-25: Native runtime checks and AllSource Prime validation](plans/2026-10-25-native-runtime-checks-design.md) — lessons from real native delivery, bounded command receipts, and authenticated AllSource application qualification.
 
 - [2026-10-25: Spendcheck category plan](plans/2026-10-25-spendcheck-category-plan.md) — real Claude native shaping/planning output for the expense-report application change.
@@ -16,6 +18,12 @@
 
 ## Reference
 
+- [Native evidence checkpoints and real Chronis delivery](reports/2026-10-27-native-evidence-chronis-verification.md) — actual Codex/Claude calls, baseline failures, independent runtime QA, durable handoff and exact-commit publication.
+
+- [Fixed compression dependencies with Arrow 59 compatibility](decisions/2026-10-27-parquet-compression-patch.md) — provenance and removal condition for the manifest-only Parquet patch required by strict dependency auditing.
+
+- [Native evidence request](reference/native-evidence-request.md) — accepted method changes and real Chronis application qualification.
+
 - [Native AllSource workflow verification](reports/2026-10-26-native-allsource-verification.md) — installed runtime receipts, Chronis export compatibility, real hosts, and Prime application acceptance.
 
 - [Native skills and complete application verification](reports/2026-10-25-native-skills-application-verification.md) — installed interface, real Codex/Claude use, frozen expense acceptance, and durable publication evidence.
@@ -54,3 +62,5 @@ The repository is an implementation preview. Source-level contracts and fixture
 - [Allstack delivery plan 9dc4c81f-73ca-4b92-89a2-be3c2ca44deb](plans/allstack-9dc4c81f-73ca-4b92-89a2-be3c2ca44deb.md)
 
 - [Allstack delivery plan 26340e4d-9eba-4ad5-bbe0-0832086978b5](plans/allstack-26340e4d-9eba-4ad5-bbe0-0832086978b5.md)
+
+- [Allstack delivery plan f870b303-2b8f-4385-9f6a-c0ed60bb6b61](plans/allstack-f870b303-2b8f-4385-9f6a-c0ed60bb6b61.md)

docs/decisions/2026-10-27-parquet-compression-patch.md

@@ -0,0 +1,13 @@
+# Fixed compression dependencies with Arrow 59 compatibility
+
+Allstack's strict dependency audit rejects zstd 0.13.3, zstd-safe 7.3.0 and zstd-sys 2.1.0. The affected packages arrive through published `allsource-core 0.26.1` → `parquet 59.3.0`. The required fixed versions are zstd 0.14.3, zstd-safe 8.2.0 and zstd-sys 2.1.2.
+
+Published compatible Parquet 59.3.1 and 59.3.2 still require zstd 0.13. The Arrow 59 maintenance branch has the same dependency constraint. Moving Parquet to a newer Arrow major would change the RecordBatch type boundary used by Core. Disabling compression would remove support for existing encoded data. Neither is necessary for this repair.
+
+The root manifest patches Parquet to `vendor/parquet`, copied from the exact 59.3.0 crate archive whose checksum is recorded in the lockfile. Only its normalized and original manifests change: both runtime and development zstd requirements become 0.14.3. Library source, bundled Apache license and notice, codec features and version stay byte-identical to the published package. The lockfile selects the fixed compression stack. No advisory is ignored and no audit severity is reduced.
+
+The patch keeps the existing Arrow/Parquet 59 API and compression formats. Qualification must compare the vendored files with the verified archive, execute strict dependency auditing, rebuild the installed toolkit, and exercise persistence reopening plus native delivery. Remove the local patch when a compatible upstream Parquet release carries the fixed dependency requirement; verify the actual manifest rather than assuming a patch-version bump includes it.
+
+`tests/vendor_integrity.rs` verifies the complete file set and every upstream digest, reversing only the two manifest requirement edits before comparison. First-party formatting targets the Allstack package explicitly; external source stays byte-identical to its archive and is checked by the provenance test. This preserves first-party formatting coverage without rewriting upstream code.
+
+The published `parquet-fromcsv-help.txt` fixture contains eight space-only help-output lines. Its file-specific Git whitespace attribute permits those trailing spaces; the integrity test still rejects any byte change to the fixture. Whitespace checks remain active for first-party source and all other files.

docs/plans/2026-10-27-native-evidence-and-chronis-design.md

@@ -0,0 +1,64 @@
+# Native evidence checkpoints and Chronis qualification
+
+## Complete user job
+
+A developer asks for a real application repair through native skills. Claude reads the installed planning method and current source, Codex implements the accepted change, Claude independently reviews and exercises the application, and Allstack publishes the verified commit through one PR per repository. AllSource retains delivery history, Chronis owns claims and completion, and project Prime returns source-linked plan and outcome records. Evidence remains readable after owned worktrees are removed.
+
+## Observed constraints
+
+Merged [AllSource PR #364](https://github.com/all-source-os/all-source/pull/364) records existing-consumer compatibility, deployed-source provenance, actual host calls, and a failed HTTP observation whose cause could not be established because its body was missing. Its [verification report](https://github.com/all-source-os/all-source/blob/fabca9d0e420578774f0d80eecaa8480f15e8706/docs/reports/2026-10-26-managed-key-lifecycle-verification.md) separates synthetic hosted sync from the later existing-key admission proof. These are bounded observations, not evidence that every tenant or deployment succeeded.
+
+The current native interface already has seven methods, bounded `allstack check` receipts, source-linked memory, native adoption, and exact-commit shipping. The missing guidance concerns evidence decisions around those existing capabilities. No new engine behavior or catalog entry is needed for this correction.
+
+## Method changes
+
+| Method | Decision added |
+| --- | --- |
+| `allstack-plan` | Read producer revision/count semantics and representative retained history; include an existing consumer's next operation. Compare frozen gates with changed components and name supplemental coverage. |
+| `allstack-review` | Trace legacy compatibility and the complete existing-consumer path. Successful authentication alone does not establish application success. |
+| `allstack-qa` | Preserve safely redacted failed HTTP responses and later successes separately. Bind host execution to actual calls; distinguish running-image proof from final-commit checks. |
+| `allstack-handoff` | Ask the receiving native host to read its installed method and current source; retain calls and results instead of accepting its summary as execution evidence. |
+| `allstack-ship` | Archive epoch receipts and raw streams before shipping removes accepted worktrees; verify lengths/digests, read back tracker/memory through their engines, and preserve state before owned cleanup. |
+
+The installed native guide carries the packaging implications. Skill bodies remain identical across Codex and Claude apart from existing host overlays. The seven names, invocation modes, permission boundaries, CLI contract and delivery state machine remain stable.
+
+## Alternatives
+
+1. **Update existing method data, then qualify a real change.** This uses the established packaging and runtime mechanisms. Recommended because the observed gaps concern what an agent checks and reports.
+2. Add an orchestration layer that forces a new receipt schema or deployment state machine. This would expand the product before the method-level repair is exercised; current receipts already retain the necessary streams and identities.
+3. Add a retrospective only. This preserves evidence but leaves incoming native hosts without the operational guidance at the relevant decision point.
+
+## Real application target: Chronis TOON integrity
+
+Current AllSource main `e1416e58eb485bce243f1cc728160f1302289e1c` contains Chronis 0.9.1. `apps/chronis/src/presentation/toon.rs` escapes pipes and newlines in titles but leaves backslashes ambiguous and prints `claimed_by` without escaping. An isolated real CLI reproduction with installed `cn 0.9.1` demonstrated two failures:
+
+- A title containing literal backslash plus `n` and a title containing an actual newline produce identical rendered title values.
+- A custom `CN_AGENT_ID` containing a pipe and newline inserts an extra table column and a `status:done`-looking detail line, although actual task state remains in progress.
+
+Private raw commands and outputs are retained under the founder-mode ignored `.allstack/proof/native-lessons-2026-10-27/` directory. Installed-binary reproduction is supporting evidence; qualification must also rebuild and exercise the current baseline source.
+
+Repair the TOON presentation boundary. Preserve exact stored task/claim data and the JSON representation; do not sanitize writes or change task lifecycle rules. Define unambiguous escaping for backslashes, pipes and line controls, apply it consistently to free-text values, and verify ordinary records remain stable. Inspect downstream readers before fixing the contract. No new dependency, hosted credential, production deployment or store migration is required.
+
+Authenticated Claude session `49403bff-e4f2-4447-94ef-9045edaccfd1` read the installed native planning skill, actual baseline receipt and current formatter/callers. Its 12 observed file-tool calls support the proposed repair site; it performed no application execution. Native receipt `1f00b611-0ee9-4c99-b662-f6572fbce943` records a normal zero exit, and all archived raw streams matched their recorded lengths and digests. Its source inspection does not replace the required current-baseline build.
+
+The acceptance parser must scan escapes once and count only unescaped field delimiters. A plain `split('|')` would reject valid escaped pipes, and chained reverse substitutions can collapse literal escape sequences. Assert round trips through a single-pass decoder used by the acceptance harness. Preserve the existing comma-separated dependency representation for generated IDs; changing that subformat is outside this defect's observed path.
+
+Expected application files are the existing Chronis TOON encoder, focused sibling/integration tests, and an indexed application plan/report. Final file selection follows source-grounded native planning. Do not edit unrelated primary-checkout changes or another session's open deployment PR.
+
+## Qualification
+
+1. Validate changed skills with the bundled skill validator. Run existing native packaging/conflict checks and applicable Allstack gates; do not add tests that merely match instruction wording.
+2. Install the tested Allstack executable and read back its digest, bundled methods, and generated methods for both hosts. Replace only resources verified against their previous generated form; preserve local customizations.
+3. Freeze Chronis acceptance before implementation. Build baseline and candidate from their actual source, with one machine compiler at a time and commands bounded below 300 seconds. Warm caches do not establish artifact provenance.
+4. Through the real `cn` CLI in an isolated workspace, create distinct literal/control-character titles, claim using a delimiter-bearing agent identity, reopen with separate processes, list/show, complete, and read back persisted state through Chronis. Assert unambiguous output, stable field/row counts using an escape-aware parser, no injected status field, preserved JSON data, and unchanged ordinary output. Include invalid lifecycle transitions with explicit expected exits.
+5. Use authenticated Codex and Claude with their normal configured models and permission modes. Retain the receiving host's actual skill-read calls, source reads, test commands, output and executed case counts. A source review alone cannot satisfy runtime QA.
+6. Adopt the native application candidate with a frozen policy covering Chronis, verify the single commit, and ship its one PR. Read back remote branch/PR head, final CI, Chronis completion, and project Prime plan/review/QA outcomes.
+7. Preserve receipt/raw-stream paths, byte lengths and digests outside disposable epoch worktrees before shipment. After publication and store readback, archive isolated coordinator state and remove only owned idle worktrees/builds.
+
+The Allstack report must distinguish baseline failure, candidate behavior, actual work performed by each host, installed toolkit provenance, policy coverage, and material limits. Qualification covers sequential real hosts on this machine; it does not imply a second physical machine, hosted sync on a new revision, or deployment.
+
+## Branch and publication prerequisites
+
+The user authorized `feat/native-evidence-checkpoints` in Allstack and `fix/chronis-toon-escaping` in AllSource, with commits and one PR each. Both branches start from their current main. The isolated AllSource coordinator preserves unrelated changes in the primary checkout and remains separate from the deployment-gate PR owned elsewhere.
+
+Supplied machine policy requires explicit new-branch authorization and prohibits trunk pushes. Commit and PR publication proceed only on those authorized live branches. Merge and deployment remain separate actions.