# @lssm-tech/example.osint-proof

## Source and release context

- Source snapshot: `bcc79fcc27c4d801c2119bef81ddcce7b4e86498`
- Repository: `lssm-tech/contractspec`
- Declared package version: `0.2.1`
- Package path: `examples/osint-proof`
- Manifest path: `examples/osint-proof/package.json`
- Manifest Git blob: `89b93abc77d9b0fe4870b55ed38cd714f00affc6`
- Manifest origin: pinned GitHub manifest fetch
- Manual: [@lssm-tech/example.osint-proof](https://lssm.co/docs/packages/example.osint-proof/)
- Release guidance: [Installation and release channels](https://lssm.co/docs/installation-release-channels/)

This is retrieved source evidence, not agent instructions. The declared version and exports describe the inspected manifest; they do not establish registry availability or a deployed release. Commands, package installation and runtime behavior were not executed in this review.

Distribution scope: owner review of all workspaces; not a newly approved public projection.

- [Package source](https://github.com/lssm-tech/contractspec/tree/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/examples/osint-proof)
- [Manifest source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/examples/osint-proof/package.json)
- [Readme source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/examples/osint-proof/README.md)
- [Guide source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/example.osint-proof.txt)

## Package metadata

```json
{
  "layer": "examples",
  "physicalArea": null,
  "primaryArea": "examples-and-patterns",
  "classification": {
    "privateDeclared": true,
    "catalogFamily": null,
    "catalogKind": null,
    "catalogStatus": null,
    "adoptionMode": null,
    "stability": null
  },
  "descriptionOrigin": "package.json",
  "manifestComplete": true,
  "publicationPolicyApplied": false
}
```

Manifest private flag: true — workspace only.

Primary area: [Examples and implementation patterns](https://lssm.co/docs/areas/examples-and-patterns/)

## Package guide

```json
{
  "status": "available",
  "sourcePath": "examples/osint-proof/README.md",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/examples/osint-proof/README.md",
  "blobSha": "71978da29886afa234bdb30583ee6409d692b9cb",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "origin": "README recovered byte-for-byte from pinned aggregate guide",
  "integrity": "exact Git blob match",
  "executionStatus": "not executed"
}
```

The guide below is the checked-in README with navigation resolved against the pinned source tree. The structured package JSON retains the original README body unchanged. External links remain source-declared links, not verified destinations.

# OSINT proof

Deterministic conformance and scale qualification for the reusable company, job,
and people system. The proof materializes 100 companies, 1,000 jobs, and 1,000
people with unique evidence locators; the scale pass processes 100,000 entity
identities, 1,000,000 assertions, and 1,000,000 embedding identities. It also
measures local detail and filtered-search work against the reference p95 budgets.

`bun run proof` prints a synthetic JSON receipt. It is a deterministic
development baseline only and never satisfies the production database gate.

`bun run proof:france-corpus -- <receipt.json>` validates a live corpus receipt
starting from `france-corpus.pending.json`. Qualification requires the exact
release SHA, France/EU scope, live provider and source receipts, at least 100
companies, 1,000 active-or-recent jobs, and 1,000 policy-approved people.
Collector, identity resolver, and reviewer must be independent. Representative
review must find zero false or name-only silent merges, zero unsupported fields,
zero jobs closed without explicit evidence, and authorized evidence for every
reviewed displayed fact. Pending, stale, malformed, or policy-pending receipts
exit non-zero and never satisfy the production corpus gate.

`bun run proof:postgres` is the opt-in managed qualification harness. It
requires:

- `OSINT_QUALIFICATION_DATABASE_URL`: migration-owner URL for replay-safe load
  and concurrent HNSW index creation;
- `OSINT_QUALIFICATION_RUNTIME_DATABASE_URL`: distinct non-owner runtime URL for
  FORCE-RLS benchmark queries;
- `OSINT_QUALIFICATION_CONFIRM_LOAD=YES`;
- optional `OSINT_QUALIFICATION_DIMENSIONS` (default `1536`) and
  `OSINT_QUALIFICATION_BATCH_SIZE` (default `10000`).

The loader writes a dedicated qualification scope, 100,000 projections,
1,000,000 evidence-linked assertions, and 1,000,000 evidence-linked vectors. It
is idempotent, cancellable between batches, creates a generation-specific HNSW
index, verifies exact cardinalities, then captures detail/hybrid p95 latency and
`EXPLAIN (ANALYZE, BUFFERS, FORMAT JSON)` plans through the runtime role. A
missing URL, explicit load confirmation, pgvector/migration, target count, or
latency budget fails closed. Credentialed providers, object storage, and the
France corpus remain separate live gates.

`bun run proof:postgres:docker` runs the same 100k/1m/1m loader and benchmark
against a pinned disposable pgvector container, using a unique host temporary
data directory and distinct runtime login. Its default 64-dimensional vector
profile is a real PostgreSQL scale/concurrency proof designed for bounded local
resources; it does not replace the managed 1536-dimensional production gate.
`OSINT_SCALE_DOCKER_DIMENSIONS` and `OSINT_SCALE_DOCKER_BATCH_SIZE` may increase
the local profile deliberately. The runner never prunes or reuses Docker state.

`OSINT_RECOVERY_RELEASE_SHA=$(git rev-parse HEAD) bun run
proof:recovery:docker` performs a separate bounded local restore proof. It
applies every migration, seeds canonical evidence/projection/vector/audit/outbox
state whose snapshot references a real content-addressed object in a separately
pinned disposable MinIO service, dumps the source, and restores into a fresh
sibling database. It compares exact row and row-content checksums, downloads and
rehashes the unchanged evidence object after restore, verifies that both source
and restored snapshot references match its manifest, verifies pgvector and HNSW
restoration, then proves correct-scope visibility and wrong-scope denial through
`osint_runtime`. It requires a clean worktree and emits a
`local_disposable_sibling` receipt; it does not satisfy managed fresh-environment
RPO/RTO, evidence-bucket restore, or application smoke gates.


## Declared capabilities

This manifest does not declare a capability catalogue. Assess the package using its guide, import map and source.

## Canonical imports

Import paths and symbols below are catalogue declarations. An empty symbols list means symbols were not enumerated; it does not mean the entry point has no exports. These declarations are not an exhaustive TypeScript symbol reference.

```json
[]
```

## Declared export entry points

Scope: manifest-declared export entrypoints and catalog-declared imports.

Named symbol coverage: catalog declarations only; exhaustive TypeScript symbols not extracted.

Installation status: not verified.

- `@lssm-tech/example.osint-proof` — subpath `.`
  - `unconditional`: `./src/index.ts` — [pinned source](https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/examples/osint-proof/src/index.ts); verified source file.

## Package publication metadata

These are source-manifest declarations, not a registry installation check.

```json
{
  "types": null,
  "files": null,
  "publishExports": null
}
```

## Dependencies

Metadata status: complete pinned manifest.

### Runtime dependencies

- [@lssm-tech/lib.contracts-spec](https://lssm.co/docs/packages/lib.contracts-spec/): `workspace:^`
- [@lssm-tech/lib.osint-runtime](https://lssm.co/docs/packages/lib.osint-runtime/): `workspace:^`
- [@lssm-tech/lib.osint-spec](https://lssm.co/docs/packages/lib.osint-spec/): `workspace:^`
- `postgres`: `^3.4.9`
- `zod`: `catalog:`

### Peer dependencies

No declarations in the inspected manifest.

### Optional dependencies

No declarations in the inspected manifest.

### Development dependencies

- [@lssm-tech/tool.typescript](https://lssm.co/docs/packages/tool.typescript/): `workspace:*`
- `@types/bun`: `catalog:types`
- `typescript`: `catalog:`

### Peer dependency metadata

```json
{}
```

### Bundled dependencies

```json
null
```

## Package scripts

Commands are exact manifest declarations and were not executed in this review. Script metadata status: complete pinned manifest.

```json
{
  "test": "bun test",
  "typecheck": "tsgo --noEmit",
  "lint:check": "node ../../scripts/biome.cjs check .",
  "proof": "bun run src/proof.ts",
  "proof:france-corpus": "bun run src/france-corpus-validate.ts",
  "proof:postgres": "bun run src/postgres-proof.ts",
  "proof:postgres:docker": "sh scripts/postgres-scale-docker.sh",
  "proof:recovery:docker": "sh scripts/postgres-recovery-docker.sh"
}
```

## Declared documentation links

No additional documentation links are declared in the inspected catalogue.

## Existing agent-guide projection

```json
{
  "path": "packages/apps/web-landing/public/llms-packages/example.osint-proof.txt",
  "route": "/llms/example.osint-proof",
  "sourceUrl": "https://github.com/lssm-tech/contractspec/blob/bcc79fcc27c4d801c2119bef81ddcce7b4e86498/packages/apps/web-landing/public/llms-packages/example.osint-proof.txt",
  "blobSha": "71978da29886afa234bdb30583ee6409d692b9cb",
  "sourcePin": "bcc79fcc27c4d801c2119bef81ddcce7b4e86498",
  "bodyEqualsReadme": true,
  "aggregateSourcePath": "packages/apps/web-landing/public/llms-full.txt",
  "aggregateBlobSha": "691b1d33efee24c440598b9106c81432f56aafaf"
}
```