From b5c26f52e865f84b2571d97ea36337d8a0273538 Mon Sep 17 00:00:00 2001
From: Marius Ciepluch <11855163+norandom@users.noreply.github.com>
Date: Fri, 30 Oct 2026 18:00:59 +0100
Subject: [PATCH] docs(detection-core): bind integration phase into roadmap and
 task plan

---
 .kiro/specs/detection-core/tasks.md | 26 +++++++++++++++++++++
 .kiro/steering/roadmap.md           | 35 +++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+)

diff --git a/.kiro/specs/detection-core/tasks.md b/.kiro/specs/detection-core/tasks.md
index d3c6325..aa56216 100644
--- a/.kiro/specs/detection-core/tasks.md
+++ b/.kiro/specs/detection-core/tasks.md
@@ -133,3 +133,29 @@ _Requirement IDs use N.M where N is the requirement number in requirements.md an
   - _Requirements: 5.1, 5.2, 7.3, 11.1_
   - _Boundary: end-to-end integration_
   - _Depends: 6.3, 7.1_
+
+- [ ] 8. Integration with existing specs (binding phase, roadmap 2026-10-30)
+- [ ] 8.1 Prover native conformance to the core trace contract
+  - access-control-prover's Trace implements core TraceRecord natively; hunt/core_adapter.py is removed once conformance tests pass; behavior byte-identical (admission suite regression gate).
+  - Done when test_core_adapter.py equivalents pass against native types and the adapter module is deleted.
+  - _Requirements: 1.1, 1.2, 11.3_
+  - _Boundary: prover arm_
+  - _Depends: 3.1_
+- [ ] 8.2 Fact-pack workstream from the recognition-coverage table
+  - valid-detection-benchmark task 7.1's manifest-derived table becomes reviewed fact packs admitted via core/factpack.py, family-tagged and digest-stamped; measured on pool-train, admission-gated on the untouched pilot.
+  - Done when one new ecosystem pack passes admission gates and appears with its family in the report.
+  - _Requirements: 10.1, 10.2, 7.3_
+  - _Boundary: fact-pack contract + benchmark_
+  - _Depends: 6.1, 4.2_
+- [ ] 8.3 Pre-push hook consumes the core consumer contract
+  - pre-push-safety-net builds PushRequest and consumes PushVerdict via core/consumer.py; budget from the measured per-class derivation; one real dev-pool push E2E.
+  - Done when an E2E hook run on a dev-pool repo emits a PushVerdict with witnesses/reasons and a measured-class budget.
+  - _Requirements: 4.2, 11.1, 11.3_
+  - _Boundary: pre-push transaction_
+  - _Depends: 6.2, 2.2_
+- [ ] 8.4 Proof layer attaches demonstrated evidence to verdicts
+  - search-with-proof attaches proof artifacts to PushVerdict claims; BLOCK only on proven claims; bounded-silence entries stay advisory.
+  - Done when a demonstrated-finding fixture blocks and an unproven claim stays advisory in a test.
+  - _Requirements: 9.2, 11.2_
+  - _Boundary: proof layer_
+  - _Depends: 6.2_
diff --git a/.kiro/steering/roadmap.md b/.kiro/steering/roadmap.md
index 4af3eba..62f9375 100644
--- a/.kiro/steering/roadmap.md
+++ b/.kiro/steering/roadmap.md
@@ -1,5 +1,40 @@
 # Roadmap
 
+## Binding phase -- detection-core as the shared contract (2026-10-30)
+
+This section supersedes ordering questions below it for detection work. `detection-core`
+(spec complete, validated GO at 1cd6a39) is now the binding element: its contract package
+(`src/openultrasast/core/`) owns the canonical trace, verdict, coverage, measured budget,
+provenance, admission, probes, fact-pack and consumer contracts. Existing specs adopt it;
+they do not grow parallel runner contracts.
+
+### Integration sequence (each step admission-gated on the untouched pilot)
+
+1. **Prover native conformance** -- `access-control-prover`'s `Trace` implements
+   `core.TraceRecord` directly; `hunt/core_adapter.py` is deleted once conformance tests
+   pass. Touchpoint: access-control-prover.
+2. **Fact-pack workstream (recognition breadth)** -- `valid-detection-benchmark` task 7.1's
+   manifest-derived recognition table becomes reviewed fact packs admitted via
+   `core/factpack.py` (families tagged, digest-stamped). Target ecosystems: the valid
+   pool's Express/FastAPI/NestJS/Koa/MCP-style servers. Touchpoints: valid-detection-benchmark,
+   ruleset loader.
+3. **Resolution depth** -- interprocedural call resolution (today 11.9% complete) in the
+   engine/frontends; measured via `core/coverage.py` buckets. Touchpoint: contributor-scan
+   (engine internals stay out of detection-core).
+4. **Hook consumes the core** -- `pre-push-safety-net` builds `PushRequest` and consumes
+   `PushVerdict` via `core/consumer.py`, budget from the measured per-class derivation
+   (`benchmarks/measurements/2026-10-30-detection-core-budget/`), one real push E2E on a
+   dev-pool repo. Touchpoints: pre-push-safety-net.
+5. **Proof layer attaches** -- `search-with-proof` attaches demonstrated evidence to
+   `PushVerdict` claims; BLOCK only on proven claims. Touchpoint: search-with-proof.
+6. **Model lane bounded** -- `hunter-learning-loop` proposes only; every fitted component
+   passes `core/probes.py` (reversed-pair + holdout + admission GO). Touchpoint:
+   hunter-learning-loop.
+
+Stop conditions from `detection-quality.md` apply unchanged: two consecutive admission
+NO-GOs on the same arm park it for a strategy review; the fallback is the narrowed
+one-ecosystem advisory product plus proof-based BLOCK.
+
 ## Roadmap -- admission read, stop conditions (2026-10-30)
 
 This section supersedes the ordering below it for detection claims. The 2026-10-30 admission