feat(contracts): add result envelope v1

contracts/exit-codes.json

@@ -0,0 +1,39 @@
+{
+  "contract": "clawsec.cli-exit-codes/v1",
+  "contract_version": "1",
+  "passthrough_child_exit_codes": false,
+  "entries": [
+    {
+      "code": 0,
+      "outcome": "pass"
+    },
+    {
+      "code": 1,
+      "outcome": "error"
+    },
+    {
+      "code": 2,
+      "outcome": "finding"
+    },
+    {
+      "code": 3,
+      "outcome": "blocked"
+    },
+    {
+      "code": 4,
+      "outcome": "degraded"
+    },
+    {
+      "code": 5,
+      "outcome": "unsupported"
+    },
+    {
+      "code": 6,
+      "outcome": "not_applicable"
+    },
+    {
+      "code": 42,
+      "outcome": "confirmation_required"
+    }
+  ]
+}

contracts/fixtures/result-v1/valid/core-doctor-error-unknown-version-nanoclaw-v2.json

@@ -0,0 +1,31 @@
+{
+  "schema": "clawsec.result/v1",
+  "executor": {
+    "schema": "clawsec.component-ref/v1",
+    "name": "clawsec-core-nanoclaw",
+    "version": "0.1.0-rc.1",
+    "harness": "nanoclaw",
+    "role": "core",
+    "metadata_digest": "sha256:765f343f11e9367051b5ed95daed35ff318945c672df0f5509c0dbcd1276eea5"
+  },
+  "subject": {
+    "kind": "executor"
+  },
+  "invocation": {
+    "id": "11111111-1111-4111-8111-111111111111",
+    "operation": "core.doctor",
+    "harness": {
+      "name": "nanoclaw",
+      "version": null
+    },
+    "scope": {
+      "kind": "nanoclaw.checkout",
+      "ref": "nanoclaw-v2-lab-01"
+    }
+  },
+  "reported_at": "2026-07-23T10:00:00Z",
+  "outcome": "error",
+  "reason_code": "internal_failure",
+  "summary": "NanoClaw version detection failed before doctor checks could complete.",
+  "effects": []
+}

contracts/fixtures/result-v1/valid/core-doctor-pass-nanoclaw-v2.json

@@ -0,0 +1,31 @@
+{
+  "schema": "clawsec.result/v1",
+  "executor": {
+    "schema": "clawsec.component-ref/v1",
+    "name": "clawsec-core-nanoclaw",
+    "version": "0.1.0-rc.1",
+    "harness": "nanoclaw",
+    "role": "core",
+    "metadata_digest": "sha256:765f343f11e9367051b5ed95daed35ff318945c672df0f5509c0dbcd1276eea5"
+  },
+  "subject": {
+    "kind": "executor"
+  },
+  "invocation": {
+    "id": "22222222-2222-4222-8222-222222222222",
+    "operation": "core.doctor",
+    "harness": {
+      "name": "nanoclaw",
+      "version": "2.1.17"
+    },
+    "scope": {
+      "kind": "nanoclaw.checkout",
+      "ref": "nanoclaw-v2-lab-01"
+    }
+  },
+  "reported_at": "2026-07-23T10:01:00Z",
+  "outcome": "pass",
+  "reason_code": "operation_completed",
+  "summary": "Synthetic contract fixture: the executor reports NanoClaw core doctor completion.",
+  "effects": []
+}

contracts/result-operation-policy.json

@@ -0,0 +1,245 @@
+{
+  "contract": "clawsec.result-operation-policy/v1",
+  "contract_version": "1",
+  "operations": {
+    "core.doctor": {
+      "effect_class": "read_only",
+      "subject_kinds": [
+        "executor"
+      ]
+    },
+    "core.evaluate-advisories": {
+      "effect_class": "read_only",
+      "subject_kinds": [
+        "scope"
+      ]
+    },
+    "core.install-release": {
+      "effect_class": "mutation",
+      "subject_kinds": [
+        "component"
+      ]
+    },
+    "core.inventory": {
+      "effect_class": "read_only",
+      "subject_kinds": [
+        "scope"
+      ]
+    },
+    "core.plan-release": {
+      "effect_class": "planning",
+      "subject_kinds": [
+        "component"
+      ]
+    },
+    "core.remove-release": {
+      "effect_class": "mutation",
+      "subject_kinds": [
+        "component"
+      ]
+    },
+    "core.update-release": {
+      "effect_class": "mutation",
+      "subject_kinds": [
+        "component"
+      ]
+    },
+    "core.verify-feed": {
+      "effect_class": "read_only",
+      "subject_kinds": [
+        "scope"
+      ]
+    },
+    "core.verify-receipt": {
+      "effect_class": "read_only",
+      "subject_kinds": [
+        "component"
+      ]
+    },
+    "core.verify-release": {
+      "effect_class": "read_only",
+      "subject_kinds": [
+        "component",
+        "scope"
+      ]
+    },
+    "guardian.status": {
+      "effect_class": "read_only",
+      "subject_kinds": [
+        "executor"
+      ]
+    },
+    "posture.diff": {
+      "effect_class": "read_only",
+      "subject_kinds": [
+        "scope"
+      ]
+    },
+    "posture.snapshot": {
+      "effect_class": "read_only",
+      "subject_kinds": [
+        "scope"
+      ]
+    },
+    "posture.verify": {
+      "effect_class": "read_only",
+      "subject_kinds": [
+        "scope"
+      ]
+    },
+    "suite.catalog": {
+      "effect_class": "read_only",
+      "subject_kinds": [
+        "scope"
+      ]
+    },
+    "suite.disable": {
+      "effect_class": "mutation",
+      "subject_kinds": [
+        "component"
+      ]
+    },
+    "suite.doctor": {
+      "effect_class": "read_only",
+      "subject_kinds": [
+        "executor"
+      ]
+    },
+    "suite.enable": {
+      "effect_class": "mutation",
+      "subject_kinds": [
+        "component"
+      ]
+    },
+    "suite.install": {
+      "effect_class": "mutation",
+      "subject_kinds": [
+        "component"
+      ]
+    },
+    "suite.recommend": {
+      "effect_class": "planning",
+      "subject_kinds": [
+        "scope"
+      ]
+    },
+    "suite.recurring-advisory-verification": {
+      "effect_class": "mutation",
+      "subject_kinds": [
+        "scope"
+      ]
+    },
+    "suite.status": {
+      "effect_class": "read_only",
+      "subject_kinds": [
+        "scope"
+      ]
+    }
+  },
+  "effect_classes": {
+    "mutation": {
+      "blocked": {
+        "allowed_states": [
+          "proposed"
+        ],
+        "minimum_count": 0
+      },
+      "confirmation_required": {
+        "allowed_states": [
+          "proposed"
+        ],
+        "minimum_count": 1
+      },
+      "degraded": null,
+      "error": {
+        "allowed_states": [
+          "applied",
+          "failed",
+          "proposed",
+          "rolled_back"
+        ],
+        "minimum_count": 0
+      },
+      "finding": null,
+      "not_applicable": {
+        "allowed_states": [],
+        "minimum_count": 0
+      },
+      "pass": {
+        "allowed_states": [
+          "applied"
+        ],
+        "minimum_count": 1
+      },
+      "unsupported": {
+        "allowed_states": [],
+        "minimum_count": 0
+      }
+    },
+    "planning": {
+      "blocked": {
+        "allowed_states": [
+          "proposed"
+        ],
+        "minimum_count": 0
+      },
+      "confirmation_required": null,
+      "degraded": {
+        "allowed_states": [
+          "proposed"
+        ],
+        "minimum_count": 0
+      },
+      "error": {
+        "allowed_states": [],
+        "minimum_count": 0
+      },
+      "finding": null,
+      "not_applicable": {
+        "allowed_states": [],
+        "minimum_count": 0
+      },
+      "pass": {
+        "allowed_states": [
+          "proposed"
+        ],
+        "minimum_count": 1
+      },
+      "unsupported": {
+        "allowed_states": [],
+        "minimum_count": 0
+      }
+    },
+    "read_only": {
+      "blocked": {
+        "allowed_states": [],
+        "minimum_count": 0
+      },
+      "confirmation_required": null,
+      "degraded": {
+        "allowed_states": [],
+        "minimum_count": 0
+      },
+      "error": {
+        "allowed_states": [],
+        "minimum_count": 0
+      },
+      "finding": {
+        "allowed_states": [],
+        "minimum_count": 0
+      },
+      "not_applicable": {
+        "allowed_states": [],
+        "minimum_count": 0
+      },
+      "pass": {
+        "allowed_states": [],
+        "minimum_count": 0
+      },
+      "unsupported": {
+        "allowed_states": [],
+        "minimum_count": 0
+      }
+    }
+  }
+}

contracts/result-outcomes.json

@@ -0,0 +1,38 @@
+{
+  "contract": "clawsec.result-outcomes/v1",
+  "contract_version": "1",
+  "outcomes": [
+    {
+      "name": "blocked",
+      "description": "The executor reports that policy or a required prerequisite prevented completion."
+    },
+    {
+      "name": "confirmation_required",
+      "description": "The executor reports that it stopped before mutation and needs explicit operator confirmation; authorization requires a typed plan result."
+    },
+    {
+      "name": "degraded",
+      "description": "The executor reports useful information with weaker assurance or coverage than intended."
+    },
+    {
+      "name": "error",
+      "description": "The executor reports that execution failed because of invalid input or an internal failure."
+    },
+    {
+      "name": "finding",
+      "description": "The executor reports that the operation completed and found a security-relevant condition."
+    },
+    {
+      "name": "not_applicable",
+      "description": "The executor reports that the operation is valid but unnecessary for the current subject."
+    },
+    {
+      "name": "pass",
+      "description": "The executor reports that the operation completed as intended; this outcome alone is not proof of verification or mutation."
+    },
+    {
+      "name": "unsupported",
+      "description": "The executor reports that a declared operation cannot be provided for the current harness or scope."
+    }
+  ]
+}