chore(openspec): archive signature-coverage-statement

openspec/changes/signature-coverage-statement/tasks.md → openspec/changes/archive/2026-09-02-signature-coverage-statement/tasks.md

@@ -17,4 +17,4 @@ One PR. A single requirement gains two sentences.
 
 ## 3. Close out
 
-- [ ] 3.1 Archive the change
+- [x] 3.1 Archive the change. Archiving is what promotes the delta into the standing spec, so until this ran the coverage statement lived only in the change directory and `openspec/specs/cli-rule-reconciliation/spec.md` did not carry it

openspec/specs/cli-rule-reconciliation/spec.md

@@ -15,10 +15,21 @@ before the **first** `;` is the algoVersion and SHALL be read up to that one del
 detect the version (and therefore the normalization procedure and hash algorithm) before
 any `key=value` parameters are parsed. Signatures SHALL be compared as whole strings.
 
+The algoVersion SHALL also determine **what the signature covers**. A signature at
+algoVersion `1` covers exactly one file: the engine's `ruleFile` from the rule layout
+table, which is `check.ts` for the runtime engine. An engine that requires more than one
+file to be signed SHALL do so under a later algoVersion.
+
+**Rationale.** Coverage is a property of the signature scheme, not of the delivery that
+carries a signature. Stating it on the version keeps a payload from having to say which
+of its files is the signed one, and gives a future multi-file scheme a mechanism that
+already exists rather than a new payload shape. Leaving it unstated is what let both
+teams hold the same binding as a private assumption.
+
 #### Scenario: Envelope is emitted for algoVersion 1
 
 - **WHEN** the CLI computes a signature for a rule file's bytes using algoVersion 1
-- **THEN** the result SHALL be a string `1;h=sha-256;d=<hex>` with `<hex>` lowercase
+- **THEN** the signature SHALL be the string `1;h=sha-256;d=<hex>` for that file's normalized bytes
 
 #### Scenario: Version is read before parameters
 
@@ -31,6 +42,11 @@ any `key=value` parameters are parsed. Signatures SHALL be compared as whole str
 - **WHEN** the CLI compares two signatures for equality
 - **THEN** it SHALL compare the full envelope strings, not the bare digests
 
+#### Scenario: A v1 signature covers the engine's rule file
+
+- **WHEN** a runtime rule carries a signature at algoVersion 1
+- **THEN** that signature SHALL be over `check.ts` and over no other file in the rule directory
+
 ### Requirement: Signature normalization procedure (algoVersion 1)
 
 The CLI SHALL compute an algoVersion-1 digest as `SHA-256( normalize(fileText) )`,