{ "lock_id": "SSR-AGENTS-ANCHOR-LOCK-2026-10-27-V1", "schema_version": "ssr-agents-anchor-lock-v1", "published_date": "2026-10-27", "canonical_json_url": "https://simoneresearch.com/evidence/agents-anchor-lock.json", "verifier_script": "scripts/checks/verify-agents-anchor.mjs", "verifier_command": "node scripts/checks/verify-agents-anchor.mjs", "nanopublication_triad": { "assertion_subgraph": "Each anchor.assertion binds a human-readable engineering rule in AGENTS.md to its exact line span, required contract tokens, and LF-normalized SHA-256 digest.", "provenance_subgraph": "Each anchor.provenance_anchor binds the target implementation contract span (file path, line range, contract excerpt, and LF-normalized SHA-256 digest, analogous to a Kuhn & Dumontier Trusty URI).", "publication_info_subgraph": "Lock metadata (lock_id, schema_version, published_date, verification_oracle test commands, and scope limitations) separates provenance verification from held-out benchmark claims." }, "purpose_and_scope": "Demonstrates how natural-language repository rules in AGENTS.md can be bound to content-addressed source spans and executable test oracles so breaking contract mutations are refused while cosmetic edits outside the contract span pass with zero false-stale alerts. This is a deterministic repository integrity verifier and micro-harness, not the planned multi-repository 5-arm sequential benchmark.", "anchors": [ { "anchor_id": "SSR-ANCHOR-AGENTS-01-BALDIES-BUILD", "title": "Baldies desktop verification build & live browser-edition origin contract", "assertion": { "rule_summary": "Baldies remake facts are pinned to desktop build c37f1b5 (334 tests, 100 levels x 4 views, 3 x 3,000-action fuzz) and PLAY_LIVE_COMMITTED = true for play.simoneresearch.com.", "agents_md_span": { "file": "AGENTS.md", "start_line": 37, "end_line": 37, "required_tokens": [ "Baldies remake", "Verified on build c37f1b5: 334 tests" ], "sha256": "c5c1542a7e317e064d06449c46c989a0ba1a0a86a2c73212ff299d14ac42a366" } }, "provenance_anchor": { "target_symbol_or_invariant": "PLAY_LIVE_COMMITTED, PLAY_URL, playOrigin, playLive, embedUrl", "code_contract_span": { "file": "src/data/baldies.ts", "start_line": 15, "end_line": 21, "excerpt": "const PLAY_LIVE_COMMITTED = true;\nconst playOverride = resolvePlayOverride(import.meta.env[PLAY_URL_ENV]);\nexport const PLAY_URL = playOverride ?? PRODUCTION_PLAY_URL;\nexport const playOrigin = new URL(PLAY_URL).origin;\nexport const playLive = PLAY_LIVE_COMMITTED || playOverride !== null;\n// The game page loaded inside the homepage frame.\nexport const embedUrl = `${PLAY_URL}?embed=1`;", "sha256": "4f9e9def61d93a3de3afab5969551086c767e1efb8bc69d02d8c78fa408e519d" } }, "verification_oracle": { "test_file": "test/unit/baldies-live.test.mjs", "command": "node --test test/unit/baldies-live.test.mjs", "breaking_mutation_probe": { "description": "Flip PLAY_LIVE_COMMITTED from true to false without updating AGENTS.md", "find": "const PLAY_LIVE_COMMITTED = true;", "replace_with": "const PLAY_LIVE_COMMITTED = false;" }, "cosmetic_edit_probe": { "description": "Insert a non-behavioral comment at top of src/data/baldies.ts outside the contract span", "prepend_comment": "// Cosmetic formatting note outside anchored contract span.\n" } } }, { "anchor_id": "SSR-ANCHOR-AGENTS-02-GLOBAL-CSP", "title": "Single global /* CSP frame-src contract", "assertion": { "rule_summary": "The global /* CSP rule carries the only frame-src naming the play origin; /dog/ and /umbrella/ replace the global CSP and frame nothing.", "agents_md_span": { "file": "AGENTS.md", "start_line": 44, "end_line": 44, "required_tokens": [ "PLAY_LIVE_COMMITTED", "The global `/*` CSP carries the only `frame-src`", "scripts/checks/csp-policy.mjs" ], "sha256": "0c80c24a8903f6fd800c4a3eae2d077d74195b977aea615c2718ff2f57d6ac6b" } }, "provenance_anchor": { "target_symbol_or_invariant": "globalApprovedFor(playOrigin) frame-src and frame-ancestors directives", "code_contract_span": { "file": "scripts/checks/csp-policy.mjs", "start_line": 25, "end_line": 36, "excerpt": " // 'self' for Cloudflare's helper iframe; playOrigin for the Baldies embed.\n ['frame-src', [\"'self'\", playOrigin]],\n ['child-src', [\"'self'\", playOrigin]],\n ['object-src', [\"'none'\"]],\n ['base-uri', [\"'self'\"]],\n ['form-action', [\"'self'\"]],\n ['frame-ancestors', [\"'none'\"]],\n ['upgrade-insecure-requests', []],\n ]);\n}\n\nconst globalApproved = globalApprovedFor(PRODUCTION_PLAY_ORIGIN);", "sha256": "ecf6033feade4743ed7c40a1304d634e1234726e6c6a51b49c81cb76f95a8ed1" } }, "verification_oracle": { "test_file": "test/unit/csp-policy.test.mjs", "command": "node --test test/unit/csp-policy.test.mjs", "breaking_mutation_probe": { "description": "Drop playOrigin from global frame-src directive in scripts/checks/csp-policy.mjs", "find": "['frame-src', [\"'self'\", playOrigin]],", "replace_with": "['frame-src', [\"'none'\"]]," }, "cosmetic_edit_probe": { "description": "Insert a non-behavioral header comment in scripts/checks/csp-policy.mjs outside the contract span", "prepend_comment": "// Cosmetic comment shift test.\n" } } }, { "anchor_id": "SSR-ANCHOR-AGENTS-03-DATES-ONLY", "title": "Dates-only public copy & metadata guard contract", "assertion": { "rule_summary": "Calendar time uses dates only; no clock times of day, time zones, or session lengths appear in public copy, metadata, or published files.", "agents_md_span": { "file": "AGENTS.md", "start_line": 39, "end_line": 39, "required_tokens": [ "Calendar time uses dates only", "No clock times of day, time zones or session lengths in public copy" ], "sha256": "c94697c6d6d22b763a21521b47d6a3f8415feccd706150aa2c5ea361045996d9" } }, "provenance_anchor": { "target_symbol_or_invariant": "CLOCK, MIDNIGHT, HEALTH_ISO, DATE_FIELDS in scripts/checks/public-date-policy.mjs", "code_contract_span": { "file": "scripts/checks/public-date-policy.mjs", "start_line": 7, "end_line": 11, "excerpt": "const CLOCK =\n /\\b\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}(?::[\\d.]+)?(?:Z|[+-]\\d{2}:\\d{2})?|(?