Require coverage manifests before agent-authored changes can qualify #67

Outcome

Require a machine-readable coverage manifest before qualification can mark an agent-authored change green.

Current behavior

The forge can record tests and deployment receipts, but it does not prove that a verifier inspected a complete program. Missing submodules, dependencies, generated files, or failed scanners can produce a green result that structurally could not have been red.

Source: docs/episode-triage.md, episodes 252, 264, and 265.

Contract

• Bind the manifest to the exact commit, repository, verifier version, and qualification attempt.
• Record materialized dependencies, submodules, generated inputs, included and excluded paths, tool versions, and program digests.
• Record scanner and oracle failures separately from clean findings.
• Refuse a confident green result when required inputs are missing or unverifiable.
• Attach the manifest digest and bounded summary to the qualification receipt.
• Apply repository visibility and redact private paths and credentials.

Acceptance criteria

• A missing required submodule or dependency blocks qualification with a typed incomplete-program result.
• A verifier crash or skipped oracle cannot appear as a clean result.
• Re-running the same manifest against the same commit is reproducible.
• The issue timeline can show what the verifier covered without exposing private source.
• Policy can exempt a repository or change class only through an explicit, audited rule.

Verification

Cover complete, incomplete, stale-commit, verifier-failure, private-repository, and exemption cases. Run focused tests and mix precommit.

Dependencies

Depends on #10 and the accepted-outcome contract issue in project 3.