FalseGreen UI Verification V1

This repository is a contract-first, deterministic UI evidence runtime for consequential Dioxus interfaces. It produces normalized UI evidence; it does not issue FalseGreen Core outcomes.

The implementation is intentionally usable without network access after locked dependencies are installed. The authoritative observation path mounts the transfer application in upstream Dioxus, dispatches events through its runtime, observes the current mounted VirtualDom plus renderer-facing mutations, and only then normalizes evidence. The local software rasterizer produces supplemental pixels. Vello and wgpu are neither dependencies nor qualification claims in V1.

Quick start

# Prepare exact locked dependencies once.
cargo fetch --locked

# Run authoritative-path qualification without network access.
cargo test --workspace --offline
cargo run --locked --offline -p falsegreen-ui -- qualify
cargo run --locked --offline -p falsegreen-ui -- check \
  --source-tree-sha256 <CORE_NORMALIZED_SOURCE_V5_SHA256> \
  --cargo-lock Cargo.lock \
  --matrix-out .falsegreen/ui-evidence-matrix
cargo run --locked --offline -p falsegreen-ui -- inspect --cargo-lock Cargo.lock
cargo run --locked --offline -p falsegreen-ui -- verify \
  .falsegreen/ui-evidence-matrix/corrected/mobile-main
cargo run -p falsegreen-ui -- render --fixture account-normal --viewport mobile-main --out ./work/account-normal.png

check receives the one source identity computed by Core's normalized-source-v5 implementation; the producer has no competing source-hash algorithm. The --cargo-lock compatibility spelling accepts only the canonical regular, non-symlink root Cargo.lock beside the source root's Cargo.toml. Cargo must accept that exact pair through cargo metadata --locked --offline; detached or pseudo lockfiles fail before evidence generation. The resolved Dioxus version must match the mounted 0.7.10 runtime. The matrix covers all four exact profiles and ten intentionally defective specimens.

qualify records real Dioxus rebuild, irrelevant rerender, event, state transition, and conditional-render evidence. verify checks the exact regular-file set, artifact index, digests, contract/source/runtime copies, tree identities, and recomputed producer diagnostics.

Evidence-producing CLI outputs must be normalized relative paths below .falsegreen; absolute, parent-traversing, and symlink-component paths fail closed. Core excludes .falsegreen from normalized-source-v5, freezes the artifact-index digest, and remains responsible for authoritative predicate evaluation and final Job status.

Boundaries

• falsegreen-ui-core owns the versioned normalized tree and stable verification identities.
• falsegreen-ui-dioxus observes mounted VNodes and renderer mutations from the real Dioxus runtime and owns the narrow normalization adapter.
• falsegreen-ui-layout owns deterministic geometry observations.
• falsegreen-ui-render owns supplemental deterministic software capture.
• falsegreen-ui-harness owns the real Dioxus fixture, typed local action sink, and linked interaction record.
• falsegreen-ui-evidence owns obligations, normalized evidence, artifact digests, and diagnostic status.
• falsegreen-ui owns local diagnostics only.

No crate returns a Core Accepted result. The separate Core corrective candidate consumes the bundle and recomputes the frozen predicates through the normal verification-service lifecycle.

Registry packages

The supported external producer is the complete seven-crate workspace. All workspace links use the Cargo version plus path pattern, so local development uses one source tree while published packages resolve only versioned registry dependencies. Publish in this order: falsegreen-ui-core; then falsegreen-ui-dioxus, falsegreen-ui-layout, and falsegreen-ui-render; then falsegreen-ui-harness; then falsegreen-ui-evidence; finally the falsegreen-ui CLI.

The render package contains the byte-identical DejaVu Sans fixture, manifest, and license notice needed by registry-installed qualification. No package depends on a parent workspace file at build time or runtime.

See RUNTIME_CONTRACT.md, SECURITY.md, and docs/QUALIFICATION.md for the frozen boundary and known qualification limitations.