Workspace Projection Conformance

Workspace Projection Conformance—friendly name, the Projection Shepherd—proves that every supported source artifact in a governed workspace is an authorized, reproducible projection of canonical semantic authority.

The admission rule is absolute:

semantic ownership
+ projection authority
+ projection provenance
+ reproducible projected truth
+ byte equivalence
= admitted source artifact

There are no privileged categories for adapters, CLIs, governance code, tests, or infrastructure. The semantic kernel itself is a repository boundary and is not scanned by this capability; all supported source outside that boundary is governed identically.

Quick start

Requirements: Node.js 20 or newer and the sibling ../semantic-kernel repository.

npm install
npm test
npm run build
node dist/cli/invokes-workspace-projection-conformance.js verify C:\path\to\workspace

verify exits with 0 for a conforming workspace, 1 for a completed nonconforming scan, and 2 for invalid input or a failed scan. inspect emits the same JSON receipt but exits 0 after any completed scan.

Projection registry

The default registry is projection-registry.json in the workspace root. Each artifact names its semantic owner, projection authority, projector identity/version, canonical reproduced bytes, and all recorded SHA-256 hashes.

{
  "registryType": "workspace-projection-registry.v1",
  "semanticKernel": {
    "package": "@deterministic-solutions/semantic-kernel",
    "version": "0.1.0"
  },
  "artifacts": [
    {
      "path": "src/operation.ts",
      "authorizedPath": "src/operation.ts",
      "semanticOwner": {
        "authorityId": "operation",
        "authorityPath": ".projection/authority/operation.json",
        "authorityHash": "sha256:<64 lowercase hex characters>"
      },
      "projection": {
        "projectionId": "project-typescript-operation",
        "authorityPath": ".projection/projectors/typescript-operation.json",
        "authorityHash": "sha256:<64 lowercase hex characters>",
        "projectorId": "typescript-capability-projector",
        "projectorVersion": "1.0.0",
        "expectedSourcePath": ".projection/truth/src/operation.ts",
        "expectedBodyHash": "sha256:<64 lowercase hex characters>"
      }
    }
  ]
}

The canonical expected source is the deterministic output captured from the declared projector. The scanner verifies both authority inputs and that reproduced source before comparing it byte-for-byte with the observed workspace artifact. A later projector adapter can replace this materialized-output mechanism without changing the registry admission model.

Use --registry <relative-path> to select a different registry.

Findings

Code	Meaning
SG001	Source file has no semantic owner
SG002	Source file has no projection authority
SG003	Source file has no projection provenance
SG004	Authority hash mismatch
SG005	Projection cannot be reproduced
SG006	Source differs from projected truth
SG007	Expected projected source is missing
SG008	Undeclared supported source exists
SG009	Source is outside its authorized path
SG010	Workspace projection coverage is incomplete

Finding IDs, discovery order, artifact order, receipt hashes, and comparisons are deterministic. Runtime timestamps are intentionally absent from the conformance receipt.

Semantic-kernel execution

The public operation establishesWorkspaceProjectionConformance invokes the single semantic kernel using the declaration in semantic-authority/establish-workspace-projection-conformance.execution-model.v1.json. Filesystem scanning is seated as a port; the governance capability does not introduce another interpreter or policy kernel.

Current boundary

Version 0.1 implements byte-exact comparison and materialized canonical projector output. Structural/AST equivalence and live projector invocation are intentionally not treated as “close enough” fallbacks. Unsupported extensions are outside discovery; supported extensions default to TypeScript, JavaScript, C#, Python, and Java. Exclusion roots and language profiles can be supplied through the library API.