roadmap: v0.3 'Proof that travels' + v0.4 'Deeper evidence' (tracking)

[gkanitz]

Tracking issue — not ready for agents

Roadmap context: docs/superpowers/specs/2026-07-04-impact-roadmap-design.md
(PR #47, incl. same-day amendment). Each item below gets its own design pass
and vertical-slice issues when its wave is scheduled. Do not implement from
this issue.

Amendment 2026-07-04: the unified multi-source report was elevated into
v0.3 (owner decision). One career report spanning employer orgs, own private
repos, and public/OSS activity — "one document, not one fetch". Binding
design in the spec's Multi-source composition section. Revert-rate and
glue-work moved to v0.4.

v0.3 "Proof that travels"

• Attested canonical JSON artifact — report.json emitted and attested
  alongside HTML and PDF, byte-identical to the JSON embedded in the HTML
  (determinism test). Composition primitive for the merge; small enough to
  land early. Additionally embedded inside the PDF as a PDF/A-3-style
  file attachment (pure-Go post-step, e.g. pdfcpu, after Chromium print and
  before attestation; XMP preserved) — the file recruiters actually receive
  is simultaneously the human document, the canonical machine data, and the
  attested artifact. The career merge accepts such PDFs directly.
  Positioning (owner decision 2026-07-04): PDF is the deliverable, HTML
  is the attested interactive/hosted copy, JSON is for tooling — docs
  sweep tracked in the Launch readiness milestone.
• Selective disclosure / redactable reports — salted per-section digests
  (section_digests) in the attested JSON following the IETF SD-JWT pattern;
  coderepute redact strips chosen sections; the verify page validates the
  remaining sections against the digests. Coverage stamps are never
  redactable (anti-cherry-picking survives).
• Career merge / unified multi-source report — coderepute merge
  composes N attested source reports (org runs, personal-repo self-runs
  covering own private + public repos) into one career report. Deterministic
  and offline; CI-run merge attests the composite with input-JSON digests;
  composite embeds source JSONs + attestation pointers so verification needs
  no original files. Counts/shares unify only when coverage stamps are
  provably disjoint; medians stay per-context; cadence unions via
  active_dates; language mix recombines via total_lines (feat: verified tech-stack fingerprint — language mix from merged-PR diff lines #53). Career
  timeline framing, never org-vs-org comparison.
• Self-run setup docs — pulled forward into the Launch readiness
  milestone as docs: self-run setup guide — attested reports from a personal repo, no org needed #56 (docs-only, needed as the no-org trial path for the
  public push). Listed here because it remains the multi-source design's
  second trust domain.

v0.4 "Deeper evidence"

• Revert-rate lower bound — first outcome/survivability metric: platform
  revert PRs detected from PR metadata only (title pattern + cross-reference;
  matched text never quoted), reported as an explicit lower-bound heuristic
  with banded context (≈1 % OSS, 3–5 % industrial per the studies cited in
  the spec).
• Glue-work section — counts of issues opened/triaged/closed and
  discussions answered (GitHub Discussions is GraphQL-only; uses the
  diff-shape slice's GraphQL path). Approved data class: issue & discussion
  activity, subject-only aggregates.
• Org policy file — .github/coderepute-policy.yml (allowed windows,
  repo sets); reports stamp compliance so org admins approve once.
• Open Badges 3.0 export — headline claims as a W3C-VC-compatible
  credential JSON (OB3 finalized 2024; adoption still ramping — cheap
  future-proofing, not a bet).

Permanent anti-goals (bind all waves)

• No composite score, ranking, or grade.
• No within-team or named-colleague comparison.
• No source code, diff content, or file paths in any output.
• No hosted service; no credentials held by the project.