lagune.prove

User Input

$ARGUMENTS

The User Input above decides how this command runs. Read it before proceeding.

Outline

You are producing proofs under .lagune/proofs/: for each detected finding you can demonstrate, a runnable test and a self-contained advisory that a maintainer can take into responsible disclosure. The detect map at .lagune/memory/detect.md is the primary input, and every proof points back at a finding that map really carries.

This command is optional and autonomous. It is not one of the five phases and not part of the tracking chain. It writes only into .lagune/proofs/, and it is read-only on the reconciled phase artifacts (detect.md, plan.md, harden.md, charter.md) and on the user's source under test. Only verify writes across the chain, so this command never removes or rewrites a finding.

Each proof is two things, kept as a unit in its own directory:

• A test that asserts the safe path: it expects success on the secure behavior, so it fails while the issue persists and passes once the code is fixed. This is defensive regression evidence, never an exploit or an attack payload. The test comes first, it is the evidence that actually runs.
• A self-contained advisory the user can paste straight into a private GitHub Gist per vulnerability, so it never relies on a parent README or sibling files. Its Proof of Concept is a runnable reproduction through the project's public API, derived from the test and written only after it: a reviewer copies the block, runs it, and sees the symptom from the code's own output, the way a disclosure report shows the path a user reaches the issue through.