Add provenance-bounded witness relocation candidates

[iperev]

Status

Blocked candidate. Do not implement until a prior-digest evidence owner is admitted. This issue preserves the proposal and is not implementation authority.

Problem

A moved witness may retain identical bytes at a new path, but current bindings must not gain a second authoritative path or accept a caller-provided prior digest as truth. Without owned baseline evidence, digest matching can be forged and has no proof value.

Promotion Predicate

Promote only after a typed content-addressed baseline owner records witness ID, prior path, prior digest and algorithm, source revision, evidence class, immutable reference, canonical semantic projection, producer/authentication non-claims, and freshness non-claims. The request must contain only baselineEvidenceRef, not a duplicate caller-owned prior digest.

Candidate Command

Add witness-relocation-scan as explicit_filesystem_scan with caller-selected --repo-root, existing binding witness ID/path, one baseline evidence reference, and an explicit bounded list of unique candidate paths different from the old path. Read only listed regular files under the canonical root.

Require baseline content address and source digest to equal SHA-256 of the full admitted semantic projection. Require resolved witness ID and prior path to equal the binding. Compare current file bytes only with the resolved prior digest.

State Partition

Let R be successfully read regular candidate files and M be members whose computed digest equals the resolved prior digest:

• |R| == 0 -> missing_candidate;
• |R| > 0 && |M| == 0 -> digest_mismatch;
• |M| == 1 -> candidate_relocation_match;
• |M| > 1 -> ambiguous_digest_match.

Unsafe, non-regular, unreadable, oversized, or race-changed existing paths fail execution rather than becoming missing. No state is proof-current. The command must never emit moved_pending_reverification; only a consumer owner may derive that after admitting the evidence class, and strict proof remains unsatisfied until fresh execution at the new path.

Required Falsifiers

• symlink/root escape, path collision/case policy, non-regular and oversized files, read race, duplicate/old/excessive candidate paths;
• zero, one, and multiple digest-match partitions;
• spoofed baseline ref/digest, witness/path/revision/evidence-class mutation, and duplicate prior-digest input;
• secret-shaped bytes never appear in report, stdout, or stderr;
• matching bytes without a fresh execution receipt remain unsatisfied.

Non-Claims

Content identity does not authenticate the baseline producer, prove source-revision freshness, prove semantic equivalence, update the binding path, prove witness execution, approve merge, release, rollout, or production readiness.

Rollback

Remove the scanner, descriptor/CLI and family-catalog rows, requirement/binding/witness owners, and tests. Existing binding witnessPath remains unchanged.