fix(assessment): keep release origin unproven

docs/CAPABILITY_AND_INFRASTRUCTURE_FIT.md

@@ -389,7 +389,7 @@ that observation to the assessment and signed catalog:
   --output /var/tmp/govoplan-fit-review.json
 ```
 
-The collector follows the strict version `0.2.0`
+The collector follows the strict version `0.3.0`
 [`installed-composition-evidence.schema.json`](installed-composition-evidence.schema.json)
 contract. It enumerates all installed distributions whose normalized name starts
 with `govoplan-`, compares the enabled assessed package and module-manifest
@@ -399,37 +399,47 @@ entries and evidence-backed conclusions.
 
 For each distribution, the collector also:
 
-- verifies every supported SHA-256 immutable wheel-payload entry in installed
-  `RECORD` metadata,
-  within fixed limits of 256 GovOPlaN distributions, 10,000 files and 512 MiB
-  hashed per distribution, 50,000 files and 2 GiB hashed for one collection,
-  and 64 MiB for any single file;
+- reads the installed wheel `RECORD` file directly, with a 4 MiB metadata bound,
+  rather than relying on an interpreted distribution file list; missing files,
+  duplicate or malformed declarations, mismatched declared sizes and hashes all
+  prevent a `verified` result;
+- verifies every supported SHA-256 wheel-payload declaration in that local
+  metadata, within fixed limits of 256 GovOPlaN distributions, 10,000 files and
+  512 MiB hashed per distribution, 50,000 files and 2 GiB hashed for one
+  collection, and 64 MiB for any single file;
 - accepts package-owned data-file targets below the installation prefix and
   declared `console_scripts`, while rejecting other traversal, undeclared
   scripts, paths outside the prefix and leaf symlinks before opening a file;
 - reports pip-generated, unhashed `__pycache__/*.pyc` entries separately only
   when their derived source is a hashed payload entry, including generated
   files below a confined package-owned runtime-data prefix;
-- distinguishes coherent PEP 610 Git commits and archive hashes from editable installs,
-  local directories, package-index/unknown origins and malformed metadata;
+- labels every PEP 610 observation with the explicit
+  `local-pep610-metadata` basis and distinguishes coherent declared Git commits
+  and archive hashes from editable installs, local directories,
+  package-index/unknown origins and malformed metadata;
 - compares a non-editable VCS commit with the assessment commit and, when one is
   present, the signed catalog `selected_units` commit;
 - records only package/module identifiers, versions, bounded counters, hashes
   and stable error codes. It never writes direct URLs, paths, hostnames,
   usernames, exception text or file contents.
 
-`RECORD` `verified` means complete matching coverage of the immutable wheel
-payload, not every runtime byte. The proof scope exposes the aggregate count of
-generated unhashed bytecode; runtime activation remains unchecked. `RECORD`
-agreement proves that payload files agree with installed metadata, but does not
-make self-consistent metadata a trusted release origin. Similarly, a version
-string is not artifact integrity. PEP 610 VCS evidence is accepted only for
+`RECORD` `verified` means complete matching coverage of the wheel payload
+declared by the local metadata, not every runtime byte and not a release-origin
+binding. The proof scope exposes the aggregate count of generated unhashed
+bytecode; runtime activation remains unchecked. `RECORD` agreement proves that
+payload files agree with installed metadata, but does not make self-consistent
+metadata a trusted release origin. Similarly, a version string is not artifact
+integrity. PEP 610 VCS metadata is accepted only for
 `vcs: git`, a full 40–64 hexadecimal commit, one mutually exclusive provenance
 form and a coherent bounded URL shape. Editable and directory-backed installs
 remain mutable even when their small editable-install `RECORD` is valid. Archive
 or index artifacts without a hash anchored by the assessed release remain
-unanchored. These conditions cause review rather than being promoted to
-immutable installed-release proof.
+unanchored. A matching declaration is reported under
+`installed_source_provenance` as local consistency only, with
+`release_origin_bound: false`. The separate `installed_release_origin` scope
+remains unchecked until an independently anchored artifact digest or signed
+installer receipt binds each installed payload to the signed catalog. The tool
+does not accept a digest merely asserted inside the installed evidence document.
 
 Only evidence produced in-process by `--collect-installed-evidence` is a local
 observation, and it must be no more than five minutes old (with at most 30
@@ -466,7 +476,10 @@ claims use `passed` or `failed`; production claims use `approved` or `rejected`.
 One claim per scope, unique control/artifact IDs, `issued_at < expires_at`, current
 validity and exact digest binding are mandatory. Any schema, binding, time,
 signature or authority blocker leaves every supplied boundary claim unchecked;
-an authorized negative result is checked but requires review.
+one malformed authority member or invalid validity interval invalidates the
+supplied authority set as a whole. An authorized negative result is checked but
+requires review only after every prerequisite, including installed
+release-origin binding, is established.
 Signatures cover UTF-8 JSON with the `signatures` member omitted, object keys
 sorted, compact `,`/`:` separators and non-ASCII characters escaped, matching
 the tool's deterministic canonicalization.
@@ -483,11 +496,13 @@ the tool's deterministic canonicalization.
 
 With `--installed-evidence`, this command performs comparison and proof-binding
 diagnostics only: the imported installed document is unsigned, so neither it nor
-the boundary claim becomes accepted proof. An accepted boundary review requires
-a trusted orchestrator to retain the direct in-process observation, obtain the
-external signature over its digest, and call the review library within the
-five-minute observation window. A future signed collector-attestation format
-should make that exchange durable across processes.
+the boundary claim becomes accepted proof. Direct in-process collection removes
+that unsigned-import gap, but still establishes only local metadata consistency.
+No boundary claim is admitted by the current format because it has no separately
+anchored artifact digest or signed installer receipt. A future evidence contract
+must bind such an independently trusted release-artifact receipt to the installed
+evidence digest; a signed collector-attestation format should also make that
+exchange durable across processes.
 
 Target-environment and production-approval claims must use the assessment's
 `deployment_profile.id` as `subject_id`. External-provider claims require the
@@ -499,8 +514,10 @@ The authority keyring is a governance trust root. Do not download or generate it
 from the proof bundle being checked. The checker rejects proof-authority public
 keys reused by either the published or independently trusted catalog keyring,
 and rejects the same proof public-key material assigned to multiple authority
-IDs. Authority `not_after` is exclusive. A target operator or approver must validate
-the referenced drill/result artifacts before signing. The rerun verifies the
+IDs. A malformed key, an invalid or empty validity interval, or ambiguous key
+identity invalidates the supplied authority set. Authority `not_after` is
+exclusive. A target operator or approver must validate the referenced
+drill/result artifacts before signing. The rerun verifies the
 attestation and its bindings; it does not fetch or reinterpret those artifacts.
 `--verification-time` exists only for reproducible historical review. Supplying
 it always marks the machine and human report as a **HISTORICAL override**; callers