Daniel Meppiel (danielmeppiel) · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026
@@ -9,6 +9,9 @@
     "deployed-prompt-audit": "APM claims the proposed deployed-prompt-audit capability (req-pl-019, req-pl-020), subject to the pending Section 9.3 amendment process, not adopted-spec approval. APM's own Consumer deployment implementation supplies the definitions: project and user scopes follow TargetProfile deployment roots and PrimitiveMapping formats, including shared native hook settings via native_hook_config. The target-by-target locations, supported formats, prompt applicability and exclusions are published in docs/src/content/docs/reference/cli/audit.md. ContentScanner checks hidden or suspicious Unicode code points that may conceal instructions, not semantic prompt-injection detection; a clean result is not a guarantee that prompt text is safe. App SQLite state and unrelated transcripts are excluded. Detection does not grant execution, ownership or remediation authority.",
     "staged-replacement-recovery": "APM implements the proposed staged-replacement recovery capability (req-lk-023). Section 9.3 review and public comment remain pending; this source statement does not establish specification adoption or released CLI support. The conformance oracles exercise real filesystem state with injected operation denials. Actual non-admin Windows acceptance is established separately by the native lifecycle job, not inferred from collection or portable tests."
   },
+  "proposed_amendments": {
+    "uninstall-reachability": "req-lk-024 is the proposed general uninstall reachability obligation for issue #2270, not an optional source-replacement capability or an adopted amendment. Classification, revision selection, non-author approvals, the subsequent 14-day public comment period, applicable migration and publication remain pending. The requirement binds the existing installed-CLI sequential-diamond oracle, extended to local and hermetic remote-backed sources, both removal orders, coherent local anchors, required installed bytes, final cleanup, personal content and read-only preview. Additional installed-CLI cases cover missing/malformed/unreadable manifests, unsafe remote containment and ambiguous local ancestry. POSIX read-denial cases do not establish native Windows permission behavior. Collection status is not a test-run result, specification approval, public deployment or released CLI support."
+  },
   "requirements": [
     {
       "conformance_class": "consumer",
@@ -400,6 +403,28 @@
         "tests/spec_conformance/test_staging_recovery_reqs.py::test_staged_recovery_preserves_errors_and_recoverable_bytes[relocation]"
       ]
     },
+    {
+      "conformance_class": "consumer",
+      "id": "req-lk-024",
+      "keyword": "MUST",
+      "section": "5.2.2",
+      "status": "active",
+      "test_count": 12,
+      "tests": [
+        "tests/spec_conformance/test_uninstall_reachability_reqs.py::test_sequential_diamond_lifecycle[root-a-local]",
+        "tests/spec_conformance/test_uninstall_reachability_reqs.py::test_sequential_diamond_lifecycle[root-a-remote]",
+        "tests/spec_conformance/test_uninstall_reachability_reqs.py::test_sequential_diamond_lifecycle[root-b-local]",
+        "tests/spec_conformance/test_uninstall_reachability_reqs.py::test_sequential_diamond_lifecycle[root-b-remote]",
+        "tests/spec_conformance/test_uninstall_reachability_reqs.py::test_uncertain_manifest_preserves_material_and_preview[malformed-local]",
+        "tests/spec_conformance/test_uninstall_reachability_reqs.py::test_uncertain_manifest_preserves_material_and_preview[malformed-remote]",
+        "tests/spec_conformance/test_uninstall_reachability_reqs.py::test_uncertain_manifest_preserves_material_and_preview[missing-local]",
+        "tests/spec_conformance/test_uninstall_reachability_reqs.py::test_uncertain_manifest_preserves_material_and_preview[missing-remote]",
+        "tests/spec_conformance/test_uninstall_reachability_reqs.py::test_uncertain_manifest_preserves_material_and_preview[unreadable-local]",
+        "tests/spec_conformance/test_uninstall_reachability_reqs.py::test_uncertain_manifest_preserves_material_and_preview[unreadable-remote]",
+        "tests/spec_conformance/test_uninstall_reachability_reqs.py::test_uncertain_path_preserves_candidate_and_external_content[ambiguous]",
+        "tests/spec_conformance/test_uninstall_reachability_reqs.py::test_uncertain_path_preserves_candidate_and_external_content[unsafe]"
+      ]
+    },
     {
       "conformance_class": "producer",
       "id": "req-mf-001",
@@ -1838,7 +1863,7 @@
   "spec_version": "v0.1.1",
   "summary_by_class": {
     "consumer": {
-      "active": 101,
+      "active": 102,
       "skipped": 1,
       "unbound": 0,
       "xfail": 0
@@ -1862,5 +1887,5 @@
       "xfail": 0
     }
   },
-  "total_requirements": 136
+  "total_requirements": 137
 }
@@ -26,6 +26,10 @@ APM claims the proposed deployed-prompt-audit capability (req-pl-019, req-pl-020
 
 APM implements the proposed staged-replacement recovery capability (req-lk-023). Section 9.3 review and public comment remain pending; this source statement does not establish specification adoption or released CLI support. The conformance oracles exercise real filesystem state with injected operation denials. Actual non-admin Windows acceptance is established separately by the native lifecycle job, not inferred from collection or portable tests.
 
+## Proposed uninstall reachability
+
+req-lk-024 is the proposed general uninstall reachability obligation for issue #2270, not an optional source-replacement capability or an adopted amendment. Classification, revision selection, non-author approvals, the subsequent 14-day public comment period, applicable migration and publication remain pending. The requirement binds the existing installed-CLI sequential-diamond oracle, extended to local and hermetic remote-backed sources, both removal orders, coherent local anchors, required installed bytes, final cleanup, personal content and read-only preview. Additional installed-CLI cases cover missing/malformed/unreadable manifests, unsafe remote containment and ambiguous local ancestry. POSIX read-denial cases do not establish native Windows permission behavior. Collection status is not a test-run result, specification approval, public deployment or released CLI support.
+
 ## Consumer user-scope disclosure
 
 - Manifest: `~/.apm/apm.yml`
@@ -37,7 +41,7 @@ APM implements the proposed staged-replacement recovery capability (req-lk-023).
 | Class | Active | Skipped | Xfail | Unbound |
 |-------|-------:|--------:|------:|--------:|
 | Producer | 12 | 0 | 0 | 0 |
-| Consumer | 101 | 1 | 0 | 0 |
+| Consumer | 102 | 1 | 0 | 0 |
 | Registry | 1 | 0 | 0 | 0 |
 | Governance | 21 | 0 | 0 | 0 |
 
@@ -73,6 +77,7 @@ APM implements the proposed staged-replacement recovery capability (req-lk-023).
 | [req-lk-021](docs/src/content/docs/specs/openapm-v0.1.md#req-lk-021) | MUST | 5.2 | consumer | active | 3 | - |
 | [req-lk-022](docs/src/content/docs/specs/openapm-v0.1.md#req-lk-022) | MUST | 5.2 | consumer | active | 6 | - |
 | [req-lk-023](docs/src/content/docs/specs/openapm-v0.1.md#req-lk-023) | MUST | 5.2.1 | consumer | active | 7 | - |
+| [req-lk-024](docs/src/content/docs/specs/openapm-v0.1.md#req-lk-024) | MUST | 5.2.2 | consumer | active | 12 | - |
 | [req-mf-001](docs/src/content/docs/specs/openapm-v0.1.md#req-mf-001) | MUST | 4.1 | producer | active | 4 | - |
 | [req-mf-002](docs/src/content/docs/specs/openapm-v0.1.md#req-mf-002) | MUST | 4.1 | producer | active | 1 | - |
 | [req-mf-003](docs/src/content/docs/specs/openapm-v0.1.md#req-mf-003) | MUST | 4.1 | producer | active | 1 | - |

@@ -242,6 +242,11 @@ requirements:
     section: "5.2.1"
     conformance_class: consumer
     notes: "PROPOSED amendment 0.1.52, not adopted: staged replacement retains original and secondary errors, recoverable prior data, independent restoration, safe staging and committed replacements after disposal failure; native Windows acceptance is separate from the portable conformance oracles"
+  - id: req-lk-024
+    keyword: MUST
+    section: "5.2.2"
+    conformance_class: consumer
+    notes: "PROPOSED #2270 amendment, classification/revision and Section 9.3 approval/publication pending: preserve reachable entries and required material, coherent lifecycle anchors, final-parent cleanup, fail-closed uncertainty and read-only preview; not ratification of conditional req-rpl-002"
   - id: req-pl-001
     keyword: MUST
     section: "6.1"

@@ -121,6 +121,28 @@ What gets removed, in order:
    entries.
 7. Lockfile entries. If no dependencies remain, `apm.lock.yaml` is deleted.
 
+### Shared transitive dependencies
+
+If `security-kit` and `release-kit` both need `company-standards`, removing
+either parent keeps the shared lock entry, installed package and required
+deployed content. APM updates a removed parent's anchor to a verified surviving
+parent, including the relative source path for local dependencies. Removing
+the final parent can then clean up the shared dependency normally.
+
+Missing, malformed, unreadable, unsafe or ambiguous evidence is not proof that
+a dependency is unused. APM preserves uncertain candidates and reports the
+verification failure; restore the affected manifests or permissions, or correct
+the path/anchor evidence before retrying. A permission refusal can stop the
+command rather than complete cleanup. `--dry-run` makes the same orphan decision
+without repairing anchors or writing package state; the lifecycle-script caveat
+below still applies.
+
+The [proposed OpenAPM obligation](../../../specs/openapm-v01/#req-lk-024)
+formalizes these outcomes. Its review, version decision and publication are
+pending; it is not an adopted specification amendment or a new release claim.
+
+### Cleanup failures and ownership
+
 `Cleaned N stale deployed files for DEPENDENCY` identifies the affected
 dependency, not the deletion location. An absolute local path in that message
 names the source package; cleanup removes its deployed files, not source files.

@@ -290,7 +290,7 @@ with one locked coordinate, not a durable catalog trust identity.
 | `source` | string | no | `"local"` for path dependencies, `"registry"` for dedicated-registry resolutions. Absent for Git deps. |
 | `resolved_url` | string | registry only | Fully-qualified download URL used to re-fetch registry archives. |
 | `resolved_hash` | string | registry only | SHA-256 digest of the registry archive bytes, verified on every install. |
-| `local_path` | string | no | Original path from `apm.yml` for local deps, relative to project root. |
+| `local_path` | string | no | Manifest-declared local source path. A direct relative path anchors on the project root; a transitive relative path anchors on its declaring parent's source directory. Absolute paths remain absolute. Uninstall repairs this together with `resolved_by` when a verified surviving parent uses a different relative spelling. |
 | `content_hash` | string | no | SHA-256 of the materialized package tree, computed from sorted relative paths and raw file bytes. GitCache-backed git-subpath checkouts pin `core.autocrlf=false` so LF-committed content is not rewritten as CRLF on checkout; this pin does not override `.gitattributes` or `core.eol`. Bytes that are committed as CRLF stay CRLF. For remote dependencies it verifies that downloaded or cached content still matches the lock; for local path dependencies it detects source-tree changes. |
 | `is_dev` | bool | no | `true` when the dep was declared under `devDependencies`. |
 | `discovered_via` | string | no | Marketplace name that surfaced this package (provenance). |
@@ -308,6 +308,15 @@ with one locked coordinate, not a durable catalog trust identity.
 Fields are emitted only when set. A minimal entry is just `repo_url` plus
 `resolved_commit`.
 
+`resolved_by` is one parent anchor, not a complete list of incoming dependency
+edges. Uninstall checks surviving declared dependencies before deleting a
+transitive entry, preserves uncertain entries with a diagnostic, and can repair
+a rescued entry's parent/path pair without changing its identity or selected
+version. Later final-parent removal remains eligible for safe cleanup.
+Resolution-time constraint provenance is not an orphan-removal oracle.
+See the [proposed reachability contract](../../specs/openapm-v01/#req-lk-024);
+its normal specification review and publication remain pending.
+
 Azure DevOps uses the same generic `host` and `repo_url` fields as every other
 Git provider. APM derives its transient organization, project, and repository
 coordinates when reconstructing the dependency reference; no ADO-specific

@@ -28,7 +28,23 @@ uv run --extra dev python -m tests.spec_conformance.gen_statement
 git diff -- CONFORMANCE.md CONFORMANCE.json  # compare to the in-repo copies
 ```
 
-The first command runs every requirement-bound test and reports per-requirement results. The second regenerates the statement from those results; the final command shows whether the generated artifacts still match the checked-in copies.
+The first command executes the requirement-bound tests for which prerequisites
+are available. The generator uses the full collection's marker map, not runtime
+pass/fail results. `active` means an assertion-bearing test is bound; it is not
+a passing-run certificate. After a targeted run, collect the full suite before
+generating the final statement:
+
+```bash
+uv run --extra dev pytest tests/spec_conformance --collect-only -q
+uv run --extra dev python -m tests.spec_conformance.gen_statement
+```
+
+The proposed [uninstall reachability obligation](../openapm-v01/#req-lk-024)
+reuses the installed-CLI sequential-diamond scenario for local and
+remote-backed sources, then adds incomplete-evidence cases. Set `APM_BINARY_PATH`
+to the CLI built or installed from the checkout being verified. POSIX permission
+denial evidence does not certify Windows ACL behavior. Its collected bindings
+do not establish specification approval, publication or released CLI support.
 
 ## What conformance does NOT cover