@am_shork/attest 0.7.0 → 0.7.2

package/CHANGELOG.md

@@ -13,6 +13,338 @@ input, removes/renames a public API or `--json` field, or changes a default
 runtime behavior an existing invocation relies on — diagnostic message text is
 not API.
 
+## [0.7.2] - 2026-08-07
+
+### Added
+
+- **Releases carry a provenance attestation, and the publish job proves it was
+  served rather than trusting its own exit code.** `npm publish --provenance`
+  exchanges a GitLab OIDC token for a Sigstore certificate and records, in the
+  public transparency log, that this tarball was built by this pipeline from
+  this commit — checkable by anyone with `npm audit signatures` or the package
+  page, without trusting us. Nothing about the package's *contents* changes:
+  same `files`, same tarball, same `prepack`/`prepublishOnly` gate.
+  *It is `npm` in a repository whose every other job is `pnpm`, and that is not
+  drift.* pnpm's publish has no provenance support at all — checked against the
+  pinned 10.28.0, there is no such flag — so the choice was npm for this one
+  command or no attestation. Two consequences worth writing down. `--no-git-checks`
+  disappears with it: that was a pnpm flag, needed only because pnpm inspects
+  the branch and CI builds tags in detached HEAD. And `COREPACK_ENABLE_STRICT=0`
+  is now required to call `npm` at all — `corepack enable` shims npm too, and
+  `packageManager` pins pnpm, so a bare `npm` aborts with "this project is
+  configured to use pnpm". Job-local rather than narrowing the shim in `.base`,
+  because every other job wants exactly that strictness.
+  *The check after the publish, and the one that looked right and was worthless.*
+  The obvious step is `npm audit signatures`, and here it would have been
+  decoration of precisely the kind the `audit` job's comment refuses: run in this
+  repository it audits *our own installed dependency tree*, which never contains
+  `@am_shork/attest` — green while attesting nothing. What runs instead reads the
+  registry's attestation endpoint for the version just published and fails unless
+  a `slsa.dev/provenance/` predicate is actually there. That is the consumer's
+  view, and it is what separates "npm accepted the tarball" from "the statement
+  is served". It retries for propagation, because it runs *after* an
+  irreversible step: the publish has happened, and a rerun cannot clear a red
+  since the republish fails `EPUBLISHCONFLICT` on a version that now exists — so
+  a registry that had not caught up would pin the release job red with nothing
+  wrong. A served response missing the predicate fails immediately; that answer
+  will not change. Both paths were run against the live registry — green on a
+  package known to carry provenance, red on `0.7.1`, which does not.
+  *Three preconditions, and npm rejects the publish rather than quietly shipping
+  unsigned if any is missing.* An `id_tokens` audience of exactly `sigstore`; a
+  `repository.url` matching `CI_PROJECT_URL`, so a repository rename fails here
+  first; and a public package on registry.npmjs.org, which
+  `publishConfig.access=public` already settles. The token is still an npm
+  automation token — the OIDC exchange signs the release, it does not authorise
+  it (see *Under consideration*).
+  *What is unmeasured, stated rather than implied.* There is no dry run for
+  provenance — `--dry-run` mints no token exchange — so none of this has executed
+  against a real tag pipeline. The next release is its first run. The commit SHA,
+  tag, pipeline URL and repository path become public record; all four are
+  already public here.
+
+### Fixed
+
+- **One unreadable file took the whole of `check` down with it.** A `params`
+  value nested 20,000 deep exhausts the call stack inside `ts.createSourceFile`
+  — TypeScript's own recursive-descent parser, so `literalValue`'s recursion is
+  never reached and hardening it would have changed nothing. Measured: `attest
+  check` answered a single `internal-error`, exit 1. It failed *closed*, which
+  is why this is a repair and not an emergency — but `check` is the command this
+  project tells people to run first, in a pipeline, on a merge request whose
+  contents they do not control, and one file an attacker owns could reduce the
+  entire report to that one line, permanently. Breadth is what `check` trades
+  for running no project code; a report of one crash is not a degraded `check`,
+  it is a different command.
+  Now a file that cannot be parsed is reported as **`unreadable-file`** and
+  skipped, and everything else in the run is still reported.
+  *Two sites, and a guard on one of them fixes nothing.* `static-registry.ts`
+  and `parser.ts` both open with the same call, so the spec parse takes it too —
+  measured separately, and a registry-only guard leaves `attest check` dying on
+  a hostile `*.spec.ts` exactly as before. The registry half sits at the loop
+  that reads the files rather than inside either reader, because what is being
+  kept is a property of the *run* — one file's failure is not the run's failure
+  — and both readers need it; `readRegistry` folds them with `Promise.all`,
+  where one rejection ends the command.
+  *Its own code, not `registry-invalid`.* A file that blew the parser's stack
+  did not fail schema validation, and a diagnostic saying it did sends the
+  reader to the wrong page. The archive gate refuses to run at all when a spec
+  is unreadable, rather than grading a change against a plan known to be short.
+  *A third read site turned up while reading the diff, and it was answering
+  wrongly rather than crashing.* An unreadable **proposed** spec declares no
+  scenarios, so the unclaimed check found it claimed by nothing and reported
+  `proposed-spec-unclaimed` — a true sentence about a file whose actual problem
+  is that it could not be read, and a fix hint pointing at work that must not be
+  done. That is the shape `[0.7.0]` fixed for `orphan-test` after a registry
+  fails to load, arriving again at a different site. It now reports
+  `unreadable-file` and stands down.
+  `parseSpecs` now returns its issues alongside the plan; `parseAllSpecFiles`
+  was deleted in passing, having had no callers.
+  **No `SCHEMA_VERSION` bump.** A new `code` value is additive to the `--json`
+  envelope, and a consumer that branches on codes it knows is unaffected — the
+  rule this project already applies to every new diagnostic.
+
+- **`attest status` printed one line the sanitiser never saw.** The `Change:`
+  header was built and printed in the CLI shell, three lines above a closing
+  line that put the same value through `inline()` — so a change name holding
+  control characters repainted the terminal from the header while the footer was
+  clean. A change name is a directory name in the repository under test, and the
+  workflow `init` writes tells an agent to run `attest status <name>`.
+  The header moved into `formatStatus`, which is a fix rather than a tidy-up: a
+  write that lives in `cli/index.ts` cannot be attested at all, because that
+  module runs the CLI at import — so the site was not merely unsanitised, it was
+  unreachable by any scenario. `ATX-37`'s site list gained the kind that had
+  been missing from it, **a write in the shell**, and the two `--out` echoes are
+  the remainder: sanitised now, and still carried as unattested, because the
+  trigger needs a filename holding a control character — which NTFS refuses and
+  Linux permits, so that half is unmeasured here.
+
+- **A param that is a scenario's *domain* could be shortened, and the run just
+  covered less.** Nothing in this repo executes here — it is the self-registry
+  and its measurement suite — but three of the holes were real, and one of them
+  was a security check. Found by re-measuring the tautology entry below after
+  `[0.7.1]`: twelve mutations of this registry, each followed by the whole gate.
+  Four went green, and three of those were **not** the tautology that experiment
+  was looking for. When a scenario loops over a list it read from `params`, that
+  list is the set of cases the run covers, so removing a member removes a case
+  and every assertion inside the loop still passes over what is left. The
+  expectation stays perfectly independent; what moved is the quantifier's
+  domain, which is why the rule shipped in `[0.5.0]` — *the expectation must not
+  be a function of the param the code under test consumed* — does not cover it.
+  What each one cost, measured: dropping `../../evil` from `ATX-13.rejectedNames`
+  stopped testing the change-name guard against path traversal; `ATX-40.languages: 1`
+  stopped checking `docs/zh/troubleshooting.md` **entirely**, which is the
+  mirror rule `CLAUDE.md` calls mandatory losing its only gate; and
+  `ATX-64.childRunCommands: ['verify']` stopped checking `archive` for the
+  stdout hole `ATX-64` exists to close — filed in the same release, three
+  scenarios deep, and silent.
+  *The repo had already invented the defence and not named it.* `ATX-16` asserts
+  its list against a literal and its comment says why — "so the spec cannot
+  quietly cover fewer of them than the intent promises" — and it was one of the
+  two lists that went red. A literal is the only independent term available when
+  what is at risk is the **size** of the set rather than a value in it, which is
+  also why this reads as a violation of "do not hardcode a value that lives in
+  `params`" and is not one: the pin asserts what the intent *is*, not what the
+  system does.
+  Every iterated list now carries that line. `ATX-40` needed both halves and
+  that is the instructive one: `toHaveLength(languages)` already caught the
+  count going *up* without a document, and could never catch it going down,
+  because the slice shrinks with it and the assertion stays true.
+  *The counter-pressure, and one thing it cannot reach.* A `DOMAINS` table in
+  `tests/intent-rule-candidates.spec.ts` now judges every list-valued param as
+  `iterated` or `inert`, with completeness swept from the registry so a new list
+  fails until someone decides, and each `iterated` row naming the pin that
+  guards it. The `QUANTIFIED` taxonomy gained the distinction this turned on:
+  a `roster` owned by the **code** grows with the code and is safe by
+  construction, a roster owned by the **registry** is data an author can shorten
+  — `ATX-64` was filed as the former and was the latter. What the sweep does not
+  reach is `ATX-40`, whose domain size is a *scalar*; it is judged by hand, and
+  a future scalar used that way would not be forced into the table by anything.
+  *The rot check needed a second attempt, which is worth recording.* Written
+  first as "the pin appears somewhere in `self/`", it passed with `ATX-64`'s pin
+  deleted — two requirements pin a list read into a local named `commands`, and
+  the grep matched the other one. It asserts **exactly one** match now. A check
+  satisfiable by an unrelated line is the failure it exists to prevent.
+
+- **A project under test could put its own verdict on stdout ahead of Attest's,
+  under `--json`.** `runAndCollect` starts Vitest with the parent's fd 1 in
+  play, and `quiet: true` does not close it: `silent: true` suppresses Vitest's
+  *console interception*, and a bare `process.stdout.write` in a spec never
+  enters it — measured at collection time and inside a scenario body, both. So
+  a spec writing `{"ok":true,…}` put that document **first** on the stream: a
+  consumer calling `JSON.parse` on the whole of stdout got a parse error at
+  position 46, and one reading line-wise or taking the first object got the
+  attacker's verdict instead of the report. `check`, `cover`, `render` and
+  `status` were never exposed — no Attest code was on the path at all, which is
+  precisely why `core/terminal.ts` and `sanitisedLogger` did not help.
+  *Why this is worse than the terminal half of the same hole.* Repainting a
+  terminal — `ESC[2K CR`, a forged `ERROR` header at column 0, an `OSC 0` window
+  retitle, all of which also arrive intact — is not a capability `verify`
+  lacked, because it executes project code by design. Forging the *machine*
+  verdict is different in kind: it inverts what the report is for, since the
+  commands carrying the risk are exactly the ones that run the repository being
+  gated. §9.1 recorded the machine surface as never exposed because
+  `JSON.stringify` escapes every C0 character — true, and about the bytes Attest
+  writes; it says nothing about bytes Attest does not write.
+  Under `--json`, stdout is now diverted to stderr for the duration of the
+  command and released before the report is rendered. Diverted rather than
+  dropped: a human debugging a red pipeline still needs the run output, and
+  stderr is the stream no consumer parses. Without `--json` nothing changes —
+  the promise is the flag's, and diverting unconditionally would take the child
+  run's output away from the reader it exists for.
+  *The fix is `runAction`'s, not `runner.ts`'s* — the same argument that put
+  `formatCrash` in `cli/report.ts` rather than a copy in each `catch`.
+  `runAction` is already the single convergence point for one output and one
+  exit code; `runner.ts` would have been made to hold a contract it does not
+  own. It moved to **`src/cli/action.ts`** to be testable at all: `cli/index.ts`
+  calls `program.parseAsync()` at import time, so importing it to cross the seam
+  would run the CLI. No behaviour of `index.ts` moved with it.
+  *What the regression test had to be, because the first one was wrong.* The
+  scenarios under **`ATX-64`** spawn the real CLI and read its pipes. The
+  in-process version looks equivalent and is not: they run inside a Vitest
+  worker, which patches `console` and re-routes worker output, so intercepting
+  `process.stdout.write` there observed neither the report nor the pollution and
+  went green against the unfixed code for three of three scenarios. What the
+  requirement is about is the bytes on the pipe, and only a real pipe has them.
+  The statement names its commands in `params` rather than quantifying over
+  "every command that executes project code" — a `roster` row rather than a
+  `sites` one, so a third such command cannot join without joining the
+  assertion.
+
+## [0.7.1] - 2026-08-05
+
+### Added
+
+- **`params` takes any JSON value, and the constraint moved to the place it was
+  actually protecting.** A param was a scalar or a list of scalars. The argument
+  for admitting lists — the values most likely to drift are the composite ones,
+  and rejecting them left exactly those outside the one mechanism built to pin
+  them — does not stop at a list: a `kind -> payload` table drifts harder than a
+  flat list of names, and it was the one shape still excluded. `null` comes with
+  it, because refusing it forces a sentinel (`''`, `-1`) that means something
+  else to every later reader.
+  What the old union was defending was not the registry but the **rendering**:
+  `{payloadKinds}` interpolated into a statement as `[object Object]`, in a
+  document reviewers and audit read as the system's promise. That is a property
+  of the interpolation point, so it is stated there — a new
+  **`non-scalar-interpolation`** ERROR from `check` and `verify`. Narrower and
+  truer: it refuses what actually breaks and admits the data a scenario reads,
+  which the schema rule could not tell apart. What the schema keeps is what does
+  not survive being written down — a function, a `Date`, a class instance, an
+  object whose prototype was swapped.
+  *The part that is not a schema edit.* Depth. Four obligations had exactly one
+  level of reach, which is correct only while a param cannot nest, and none of
+  them fails loudly: the canonical form behind `add-conflict` (an identical copy
+  written with its inner keys in another order would have conflicted with
+  itself), the ATX-58 control-character stripping (nested strings would have
+  gone unsanitised, reopening the hole `[0.7.0]` closed), the key order behind a
+  byte-stable rendering, and `splice.ts`, which writes a requirement back out as
+  TypeScript source and would have committed `[object Object]` into a
+  `*.reqs.ts` through `archive --apply`. Three of the four are ordering, and are
+  now one shared `sortDeep` in `order.ts` rather than three sorts a level deep —
+  they wanted the same guarantee for the same reason, which is what makes it one
+  function and not a helper each.
+  *Two divergences between the readers, which is what the differential suite is
+  for.* `null` is a keyword rather than a literal node, so the AST reader fell
+  off the end of `literalValue` and reported `registry-not-static` for the whole
+  file while the evaluating reader accepted it. And `{ __proto__: … }` swaps the
+  prototype instead of creating a key, so `z.record` copies own keys into a fresh
+  object and the taint is invisible one step later — the static reader refuses
+  that source at any depth, and the schema now refuses the object the evaluator
+  builds from it, both spellings (a literal `__proto__:` and the own key
+  `JSON.parse` produces).
+  *Rendering.* A structured param gets a fenced JSON block below the params
+  table, keys sorted at every depth (ATX-10: the same registry renders the same
+  bytes) with the fence measured against backtick runs in the value, as `code()`
+  already did. It is below the table rather than in it because a fence cannot
+  live in a table cell. And `render` defends the document on its own: it reads
+  the registry with no spec parse, so no `AttestPlan` and no `validateStructure`
+  — `attest render` runs to completion on a registry `check` refuses. Leaning on
+  the diagnostic would have left the document defended by a command nobody is
+  obliged to run first.
+  *The writing side of the `__proto__` rule.* `splice.ts` turns a requirement
+  back into TypeScript source for `--apply`, and it is the only site that does.
+  Extending it to depth meant it would have emitted a `__proto__` key as a bare
+  property — text whose *evaluation* swaps a prototype rather than being the
+  value it was handed. Unreachable through any command (the schema rejects a
+  nested `__proto__` and `z.record` drops a top-level one), and refused anyway
+  with a new `UnwritableValue`, reported as `internal-error` by the merge with
+  its account of what it had already written intact. Quoting is not the repair —
+  a quoted `__proto__` swaps the prototype in a literal exactly as the bare form
+  does, and the bracketed form that would create an own property is a computed
+  key no static reader will read. The reader's guard is worth nothing if the
+  writer can produce the file it exists to refuse.
+  *Not breaking, with one edge worth naming.* No previously-green registry goes
+  red — a structured param was `registry-invalid` before, so nothing that
+  compiled and passed now fails — and an all-scalar registry renders
+  byte-identical, so a committed `render --check` stays green across the
+  upgrade. What did widen is the exported type in a **read** position:
+  `Requirement['params'][string]` is now the recursive JSON value. The const
+  generic is untouched, so `reqs['AUTH-3'].params.idleTimeoutMin` is still the
+  literal `30` and every anti-drift test keeps its narrow type. A consumer only
+  notices if they assign an *undeclared* key to the old scalar-or-list union
+  (`Type 'null' is not assignable`), or wrote their own handler over that type
+  and does `String(v)` in it — which is the `[object Object]` defect this entry
+  fixes in `render` and `splice`, seen from outside.
+  *This overturns a standing rejection, and not on its stated terms.* *Nested
+  objects in `params`* sat under **Considered and rejected** since `[0.4.2]`,
+  raised by `mine-capablanca`, and that entry is removed by this release. Its
+  argument was that a param has two properties a table lacks: rendered as a value
+  a human checks at a glance, and read by a scenario as the one place the value
+  lives. The first is answered rather than waived — `non-scalar-interpolation`
+  keeps a table out of the *sentence*, so what a reader takes in at a glance is
+  still glance-sized, and the table is rendered below it as a block. The second
+  is answered by the criterion that admitted arrays in the first place: a
+  `kind -> payload` table drifts *harder* than a flat list, so the reason arrays
+  were let in is the reason this shape should have been.
+  **The reopening condition it named was never met, and that is worth stating
+  plainly.** The entry said it reopens on "a report where the value is genuinely
+  promised — a table an adopter owes their users"; none has been seen. This
+  shipped on the strength of the argument alone. What changed is the recognition
+  that the schema was answering the wrong question: *params for promises, plain
+  constants for tuning* is the rule, and a type can only ever check shape, so it
+  refused a promised table while admitting a list of tuning knobs. Design §11
+  now carries that as a judgement rather than a type, which is the permanent half
+  — and it is weaker than what it replaces, because nothing enforces a judgement.
+  New requirements: `ATX-7` rewritten, `ATX-63` added.
+
+### Changed
+
+- **Rationale that only a comment held now has a design section, and the comment
+  cites it.** Measured over the diffs in three eras split at `[0.3.0]` and
+  `[0.5.0]`: comment blocks got better by every specificity signal — naming a
+  symbol 50 → 60%, a measured number 3 → 13%, a causal argument 26 → 54% — and
+  roughly doubled per line of code, while the share citing a `§` went 15 → 12 →
+  11% and the design document stopped growing (sixteen sections since `[0.3.0]`,
+  105 lines against `src/`'s 2,862). **The anchoring did not fall; it never
+  scaled**, and a `§` is the only part of a comment any gate reads.
+  Nineteen blocks written since `[0.5.0]` carried the cost — ten lines or more,
+  fully argued, unanchored — and they split three ways. *Six were properties a
+  rewrite would have to preserve*, and now sit in the document: a new **§9.1**
+  for the artifacts Attest writes, an extension to **§8** (`--apply` acts on this
+  run's verdict), and one to **§5.4** (the two readers of one plan must descend
+  the same way). *Four were history* — a quadratic backtrack, a 27–84x constant
+  factor, a 47 MiB peak, an indexing cost filed as invisible — and were
+  compressed to the invariant a maintainer would otherwise re-break; every
+  measurement in them was already under `[0.7.0]`, so this deleted duplicates
+  rather than moving anything. *Ten were correct as they stood and were left
+  alone*, which is the half worth naming: `§` is low because the design document
+  stalled, not because comments are too long, so a pass that shortened comments
+  and left it at one in nine would have moved the wrong quantity and called it
+  done. Net `src/`: 29 lines removed, all of them comments and no code touched,
+  which is also how the deletion was checked.
+  **One of the six corrected the document rather than extending it.** §8
+  summarised a merge as renaming a proposed spec "in place", which is true of its
+  location and not of its imports — the delta it reads its proposed params from
+  is what moves to `archive/`, so the sentence hid the one specifier the merge
+  has to repoint.
+  *What the measurement cost.* A first pass reported the `§` share as halving,
+  25 → 12%, an artefact of bucketing by `git blame` over the current tree: that
+  sees only surviving lines, and `§`-citing comments survive better, being tied
+  to sections that do not move, so the early era was measured on its most durable
+  residue. Re-measuring from the diffs before building is what caught it.
+  The routing test this produced is in `pre-commit-check` §6, and the obligation
+  a new diagnostic code owes the CLI reference is now in §2.
+
 ## [0.7.0] - 2026-08-04
 
 ### Added
@@ -3022,82 +3354,46 @@ feedback reports are triaged into issues or `Unreleased` and deliberately not
 kept in this tree; that rule stands, and holds for anything with a reporter, a
 repro, or a state to track. What is kept here is the narrower thing this file
 already keeps one section of: a **decision with an argument attached**, where
-losing the argument would cost more than losing the task. The one entry left
-below came out of reading another repository against this one — `msw`.
-
-Eleven entries have left by being built: three together in `[0.6.0]`, and six
-under `[0.7.0]` — the verdict predicates, the nested `describe`, the runner
-the static commands loaded and could not start, the diagnosis for a spec file
-that failed to load, the six comments describing a property the code lacked, and
-the sketches now bound to the files they name — which are the first to leave by
-being **read** rather than by being reported or gated. The last of those left
-from `Under consideration` rather than from here, which is the move this file
-describes as going up before going out, and it went up on the strength of one
-thing: of its three candidates, exactly one could be measured against instances
-that had already happened.
-The second of those left *partially*: one of its three parts came back here as an
-entry of its own, because implementing the other two showed the estimate on it
-was wrong. An entry leaving is not evidence that all of it shipped, and this is
-the first time that has mattered. That returned part has now shipped as well, and
-it closed the way it said it would: the estimate was wrong because the fix was a
-new `Issue` code rather than a suppression, and what made it so was a decision
-recorded three lines from where the suppression would have gone. **The thing that
-cost the most was the thing already written down** — which is an argument for
-this section, since the note that corrected the estimate survived only because
-someone had filed the reasoning next to the code.
-`compiler-unsupported` came from building something queued here,
-which is one way an entry arrives: a gate that finds a defect on its first run
-files the defect, and the `typescript` matrix `[0.4.2]` added is what found this
-one.
-`--apply` came from an adoption report (`mine-capablanca`, 0.4.2, 34 requirements
-/ 56 scenarios / greenfield) — a third way an entry arrives: not a defect, but a
-shape the tool made an adopter work around eight times without ever erroring. It
-took `spec-in-change-dir` out with it, by a fourth way worth naming: designing one
-of `--apply`'s checks surfaced a different one, against a migration this file had
-itself shipped. **What a release costs its adopters is not fully known on the day
-it is cut** — and building the entry is what finds out, which is also how
-`--apply` discovered that one clause of its own argument here was wrong. Both are
-recorded under `[0.6.0]`, and two earlier entries from the same report left
-by shipping in `[0.5.0]` — a change's specs moving to their merged location, and
-the delta reading as the registry of what it adds — their arguments recorded
-there, including the part of the first one that turned out to be wrong.
-The entries added after `[0.6.0]` arrived a **fifth** way, and it is the
-one with no external input at all: a strict read of `src/` with nothing failing.
-Every gate in this repository was green while all three were true, which is the
-whole of what that way is for — a defect no test is shaped to ask about is
-reachable only by someone reading for it. **All three have now shipped under
-`[0.7.0]`**, and each closed having found something a strict read is
-apparently good for and a gate is not. The runner one: the gate that would have
-had to catch it *already* looked for the shape, so what the read bought was not a
-missing gate but a cost nobody had priced. The load-failure diagnosis: every gate
-was green because the report was *complete* — three ERRORs on a red run — and
-what was wrong was which three, a judgement no assertion in this repository is
-shaped to make. The third, eight items under one heading: six comments naming a
-property the code lacked and two costs beside them.
-
-**One entry has now left this section the other way — by being rejected** — and
-it is the first, which is why it is worth a line. The region-marked samples were
-decided *yes*, and building the count they rested on is what killed them: the two
-spans the entry named are not spans, and both carry a mark the entry's own rule
-excludes. It moved down with that measurement attached. The lesson is not about
-regions. **An entry can sit in `Planned` for releases on the strength of a figure
-nobody has checked**, because the section's discipline is aimed at keeping the
-*argument* rather than at re-testing the evidence under it — so the first act of
-building one should be re-measuring what it claims, not implementing what it
-proposes. That is what happened here, and it cost an hour instead of a mechanism.
-
-*What the fifth way cost and returned, now that all of it is spent.* Sixteen
-items, no external input, and nothing in the suite shaped to catch any of them.
-The returns were not evenly distributed and the split is the useful part: two
-defects a user could hit today (a report that misdiagnosed a load failure, a
-merge crossing midnight), two costs worth a second each on a real command
-(`check --eval` at 1 + N Vite servers, `control` at 27–84x), one fixed toll on
-every static invocation (~1 s), and the rest true-but-unobservable — identical
-output either way. Only the last group is genuinely optional, and it is also the
-group that would never have been found any other way, because *no observable
-symptom* is precisely the definition of what a gate cannot see. The transferable
-lesson is the batching: individually none of the unobservable ones justifies a
-commit, and together they cost about an hour.
+losing the argument would cost more than losing the task.
+
+**Where an entry went is recorded under the version that shipped it.** This
+section keeps no ledger of its own departures — one was maintained here by hand
+for several releases, and a count kept in prose with nothing to check it is a
+claim that goes wrong quietly. What is worth keeping is what the section learned
+about itself, which is three things.
+
+**An entry can sit here for releases on the strength of a figure nobody has
+checked.** The discipline aims at keeping the *argument*, not at re-testing the
+evidence under it, so the first act of building one is re-measuring what it
+claims rather than implementing what it proposes. That has paid twice: once
+killing an entry outright, when the spans it rested on turned out not to be
+spans; once correcting an entry's headline number before a line of it was
+written. **What a release costs its adopters is not known on the day it is cut**
+— several entries arrived from one adoption report, about shapes the tool made
+someone work around without ever erroring. And **the fixes with no observable
+symptom are worth batching**: individually none justifies a commit, together they
+cost about an hour, and they are the group no gate could have found, since having
+no symptom is the definition of what a gate cannot see.
+
+- **Telling adopters about the domain trap, which the shipped guidance
+  currently walks them into.** The repo half landed under `[Unreleased]`; the
+  user-facing half has not, and it is not merely absent. `skill.ts`'s "Four
+  things you must not do" says **"Do not hardcode a value that lives in
+  `params`"**, and the pin every fix in that entry adds is, read literally,
+  exactly that. An adopter who writes a roster param — which the design
+  actively pushes them toward, since a quantifier a scenario can iterate is the
+  shape `QUANTIFIED` recommends — gets an instruction that forbids the only
+  defence against shortening it. The distinction is real and one sentence long:
+  the rule is about the **expectation** the system is measured against, and the
+  pin asserts what the **intent** is. Nothing shipped draws it.
+  *Why it is filed rather than done in the same pass.* It reaches README §"killer
+  move", the `init` skill, `possible-drift`'s troubleshooting section and design
+  §11, in both languages — the same surface `[0.5.0]` rewrote, and that entry
+  records the lesson: rewording the central claim of the tool is not a line
+  appended, and it was held back once precisely so it could be done deliberately
+  and in one pass. The measurement it needs is already taken; what it needs next
+  is the pass. *Not* a `possible-drift` change: nothing here is detectable by
+  the engine, for the reason the entry below gives about prose judgement.
 
 - **Binding the `✗` samples to fixtures whose rejection is asserted.** A sample
   showing input the engine must *reject* can be bound the way a runnable one is,
@@ -3117,6 +3413,43 @@ commit, and together they cost about an hour.
   `[0.4.3]` — that the gate and the run proving the fixture still works live in
   different suites — applies here identically.
 
+- **`render`'s document can carry raw HTML and a forged requirement section.**
+  `sanitised` is the entry §9.1 names and it strips control characters and
+  nothing else, so `statement` and `rationale` reach the Markdown by
+  concatenation exactly as written. Measured: a `rationale` containing newlines
+  and `## ATX-999` renders a whole section — heading, statement, `**Why:**` —
+  for a requirement no registry holds, sitting between two real ones and worded
+  identically; `<script>` and `<img onerror>` survive the same way. `check` and
+  `cover` see only the real id, and `render --check` cannot object, because that
+  *is* what the registry renders to now.
+  *Not an accepted risk, which is the part worth pinning.* §9.1 and the
+  reference both scope their guarantee to control characters, and the
+  reference's heading over that paragraph is "Safe to read, and safe to keep",
+  with "a site generator" named in the threat it describes. What *is* a decision
+  is that prose may be marked up — `plain()` escapes a param value precisely
+  because it is data while the statement around it is not — and that decision
+  has never been separated from allowing raw HTML or a heading. So the entry is
+  as much about stating which of the three is intended as about the escaping,
+  and if the answer is that Markdown stays and HTML and headings go, that is a
+  fourth obligation in §9.1 rather than a patch at an emitter.
+
+- **`attest init` follows a symlink out of the project root.** `runInit` does
+  `mkdir(dirname(dest), { recursive: true })` and then `writeAtomic`, and
+  neither asks whether `dest` is still under `root`. A `.claude/skills/attest`
+  planted in the repository as a link to anywhere the user can write is followed
+  by both: measured on Windows with a junction, a file at the target holding
+  `USER OWNED FILE - DO NOT OVERWRITE` came back holding the skill. The report
+  prints the relative path, so nothing on screen says where it went.
+  *`write.ts` is not the gap and neither is `targets.ts`'s content.* The `wx`
+  flag defends the *temporary* path against a planted link and does exactly
+  that; the destination's directory was never in its scope. And `workflowBody()`
+  is a pure function of nothing, so no byte of the checked project reaches the
+  file — the exposure is the path, not the content, which is `targets.ts`'s
+  first rule ("Attest owns the path") being an assumption rather than a check.
+  The check belongs beside `resolveTargets`, which is already all-or-nothing for
+  the same reason: a name known to be unwritable must not leave half a set
+  behind.
+
 ## Under consideration
 
 Candidates with **no decision yet**, between the two sections either side of it
@@ -3129,6 +3462,25 @@ deletion. What each entry has to carry is the evidence currently blocking the
 decision, because that is what a re-proposal a year from now would otherwise
 have to gather again.
 
+- **Trusted publishing, which would delete `NPM_TOKEN` rather than add to it.**
+  The provenance work in `[Unreleased]` signs the release but does not change
+  what authorises it: a long-lived automation token, masked and protected, that
+  publishes as us to anyone holding it. npm's trusted publishing exchanges the
+  same OIDC identity the attestation already uses for a short-lived credential,
+  which would remove the stored secret entirely and grant provenance as a
+  property of the flow rather than a flag on the command. The deletion test
+  points the right way for once: what it removes is the only long-lived
+  credential this repository has.
+  *What blocks the decision, and it is evidence rather than principle.* Whether
+  npm's trusted publishers accept a **gitlab.com-hosted** project on the plan
+  this package publishes under has not been verified against this project — it
+  was not checked when the provenance job was written, and an entry claiming it
+  works would be exactly the unverified confidence the rest of this file avoids.
+  It also cannot be tested except by publishing: as with provenance, there is no
+  dry run, so a failed experiment is a release. The cheap next step is reading
+  npm's current trusted-publisher documentation for GitLab support before
+  writing any YAML.
+
 - **A static sweep for the two properties claimed over the whole of `src/`.**
   The quantifier table's first strict read left three rows wanting the same
   thing, and the repo already owns the idiom: `tests/import-boundary.spec.ts` is
@@ -3267,6 +3619,103 @@ have to gather again.
   assertion is still green, still silent, and still reachable — so this stays
   here rather than moving to `Considered and rejected`: documenting a trap is
   not the same as deciding not to detect it.
+  **Re-measured after `[0.7.1]` widened `params`, on this registry rather than
+  the reporter's — the first time this experiment has been run here.** Twelve
+  mutations, each followed by the whole gate. Two results matter, and they point
+  opposite ways.
+  *The shape is now reachable here, and the widening is why.* `self/render.spec.ts`
+  asserts `expect(md).toContain(JSON.stringify(kinds))` over the same
+  `payloadKinds` it feeds to the renderer — the expectation is a function of the
+  value under test, verbatim row 3, and it could not have been written before
+  the widening because the param could not be an object. The mechanism is
+  sharper than a frequency count and is the strongest thing this entry has
+  gained: **the prescribed remedy costs in proportion to the value's
+  complexity.** Same repo, adjacent files, same value shape — `ATX-7` pins two
+  numbers with literals and goes red; `ATX-63` would have had to hand-write a
+  rendered JSON block, so it echoed. Depth raises the defect rate and the cost
+  of avoiding it along one axis.
+  *And its cost here is nil, which is the honest other half.* Both composite
+  params are fixtures for the renderer and the validator; the numbers stand for
+  nothing, so the green is arguably correct. Blocker **(1)** is therefore only
+  half retired — the shape is reproduced in a second, mature repo, and the count
+  of *harmful* instances is still zero. Blocker **(2)** is reinforced rather than
+  weakened: all four green mutations were on params `src/` never reads, so the
+  reporter's "read from both a spec and a non-spec file" detector would have
+  flagged none of them. Blocker **(3)** is untouched.
+  *The frequency is no longer unmeasured, and it points away from building
+  anything.* Blocker **(1)** rested on 8 commits of one greenfield repo. Parsed
+  at every one of the **38** revisions that have touched this registry — all 38
+  readable by the current static reader, so nothing was skipped — the history is
+  **57 param keys added, 0 removed, and exactly 1 value changed**: `ATX-16.staticCommands`
+  gaining `status`. That single edit is a roster *widening*, the safe direction,
+  and it is on the one list that was already pinned, so it could not have been
+  made without updating the pin. Two independent codebases, one greenfield and
+  one at 64 requirements, and the event this whole entry is about has happened
+  zero times in either. What that argues is not that the hole is unreal — it is
+  reachable, demonstrated above — but that it is **rare and silent**, which is
+  the profile `divergent-param` was rejected on rather than the profile that
+  justifies an engine rule.
+  *The same number says the split-out fix below has also never been triggered.*
+  0 removals ever means no domain has ever been shortened here. Those pins close
+  a live *exposure*, not a live *loss*, and the case for them is that they cost
+  one line each against a failure with no symptom — not that anything was
+  currently broken.
+  *Blocker **(3)** assumed mutation testing was the only separator. A cheaper
+  candidate existed, has now been scored, and does not survive it.* The idea was
+  a **syntactic** discriminator over one test body — flag an assertion whose
+  expected value derives from a param that also reached the arrange/act part —
+  which is exactly the difference between the two cases the widening produced:
+  `renderMarkdown({params: {payloadKinds: kinds}})` … `toContain(JSON.stringify(kinds))`
+  against `expect(kinds.json.maxBytes).toBe(1_048_576)`. Scored the way
+  `divergent-param` should have been and was not: implemented in
+  `tests/intent-rule-candidates.spec.ts`, run over the specs that attest this
+  repo, and then **every param it fires on mutated with the whole gate run —
+  fifteen of them, one gate run each. Four went green; eleven went red.**
+  *Then the detector was found to be wrong, which is the more useful half.* Its
+  first implementation counted an identifier in any position as a read of a
+  local with that name, so `i.code` in `issues.map((i) => i.code)` looked like a
+  use of a param named `code` — and `code` is this repo's commonest param name.
+  Corrected to count reference positions only, it flags **8, not 15**, and the
+  seven it drops are exactly seven the mutations had already shown to be pinned
+  by `src/`. The honest score is therefore **4 of 8, not 4 of 15** — precision
+  50%, not 27%. The conclusion does not move, because it never rested on the
+  precision figure; what moves is how much of the original number was the
+  candidate failing and how much was the measurement being wrong, and that is
+  worth writing down rather than quietly restating.
+  The remaining false positives are not near-misses. They are independent terms
+  the detector cannot see: **the runtime is the term** — `ATX-14`'s
+  `inheritedKey` is `'toString'`, and a mutated spelling is not a prototype key
+  at all, so the behaviour under test changes; **`src/` is the term** —
+  `ATX-51`'s `code` is a second copy of a string the engine emits as a literal;
+  and **arithmetic is the term** — `threshold + 3` builds a derived expectation
+  that mutation breaks.
+  And the four true positives fail the second test, which is the one that
+  decides it: **none is harmful.** `ATX-10` and `ATX-3` assert that a value was
+  substituted or applied, where the identity of the number is not the
+  obligation; `ATX-51`'s is a path prefix and `ATX-63`'s a rendering fixture.
+  Telling those from a mine-density band that must not move is a judgement about
+  whether the value *means* anything — the ground truth §0 refuses to compute
+  for someone else's registry. **50% precision on the shape, 0% on the harm.**
+  Two limits on that number, stated because a score with an unstated method is
+  what this file exists to prevent. The mutation has **one direction per kind**
+  — numbers +1, lists drop-last, strings suffixed — and direction can decide the
+  verdict: `ATX-40.languages` is red at 2→3 and was green at 2→1 before it was
+  pinned, so the true-positive count is a floor. And **recall is unmeasured**:
+  the eight params mutated earlier that this detector does not flag all went
+  red, which is eight correct negatives and not a recall figure.
+  The detector and its verdict table are kept in the measurement suite, with the
+  reach recomputed on every run and the table asserted to cover exactly what
+  fires — because the reach figure quoted for `compound-requirement` went stale
+  in this very file for want of that.
+  *A scoping limit on all of the above.* This repo cannot settle blocker **(2)**.
+  `src/` reads no param at all — every `reqs[…].params` in it is a comment or a
+  doc string — so params here are test vocabulary, while in the reporter's repo
+  they are application constants the app itself consumes. The reporter's
+  detector keys on exactly that difference, so it is inert here and this corpus
+  is evidence neither for nor against it.
+  *What the re-measurement did find is a different defect, and it has been split
+  out below* — the entry is kept whole here because the two were measured in one
+  pass and separating them is the finding.
 
 - **Whether `check` and `verify` should refuse a half-loaded registry the way
   `cover` and `render` do.** Those two return early on `hasError(loadIssues)`,
@@ -3388,6 +3837,41 @@ have to gather again.
   because a project whose requirement count only rises should have decided in
   advance what would make one leave.
 
+- **The `cmd.exe` quoting in `tests/consumer.spec.ts` guards one character of
+  several.** `shellArg` asserts the argument holds no `"` and then quotes only
+  when it holds whitespace, so an argument with none goes to the shell bare —
+  and `&`, `|`, `^`, `<`, `>`, `(` are metacharacters there that the assertion
+  does not name. The fix is one character class, which is why the entry is not
+  about the fix.
+  *What blocks the decision is that no input reaches it.* Both arguments are
+  either a literal flag or a path from `mkdtemp`, `NEEDS_SHELL` is win32 only
+  and CI is Linux, and the one path an attacker could plausibly influence — the
+  checkout directory on a fork MR pipeline — comes from a GitLab project path,
+  whose character set excludes every metacharacter above. So this is an
+  observation with no attack path, and the honest question is not whether to
+  widen the class but whether the comment above it should stop claiming more
+  than the assertion covers: it says "the assertion keeps that true" about
+  arguments generally, where what it checks is one character. Widening the class
+  and leaving the prose is the change that would look like a fix and settle
+  nothing.
+
+- **A loader that fails to start leaves its scratch directory behind.**
+  `createLoader` calls `mkdtempSync` and writes the stub *before* `createServer`,
+  and the only `rm` of that directory is inside the `close` of the object
+  `createServer` returns — so a throw from it leaks one `attest-loader-*` per
+  invocation, which on a CI runner is one per build. That is the exact failure
+  shape the comment on `close` records as already fixed, surviving on the other
+  path.
+  *What blocks it is that nothing has been made to throw there.* With
+  `configFile: false` Vite still reads the `package.json` at the root to decide
+  `type`, so a malformed one in the checked project is the obvious candidate and
+  it is the project's to write — but it was not tried, and an entry claiming a
+  trigger it has not seen is the thing this section exists to not accumulate.
+  The repair is three lines (a `try` around the two calls that `rm`s and
+  rethrows) and is not what the decision turns on; measuring whether the throw
+  is reachable at all is, because if it is not, this is a leak with no input
+  that produces it.
+
 ## Considered and rejected
 
 Decisions **not** to build something, kept where they can be found before the
@@ -3712,42 +4196,8 @@ requirement, and human review at propose is still the whole answer. What is
 rejected is grouping as a way to assist it, and this reopens only on a
 contradiction that grouping would have caught.
 
-### Nested objects in `params`, so a lookup table can be registry-owned
-
-Raised by `mine-capablanca` (0.4.2) and explicitly not as a request, which is
-why it is recorded with its own answer rather than left as a complaint about a
-message. A `params` value is a scalar or a list of scalars; a table — piece kind
-to weight, tier to limit — is refused, and the only way to register one is to
-split it across parallel arrays, which reads worse in the rendered spec than it
-buys. *What rejected it: the two properties a param has, and a table has
-neither.* A param is **rendered into `SPEC.md` as a value a human checks at a
-glance**, and it is **read by a scenario as the one place that value lives**. A
-nested object fails the first by construction — there is no reading of a
-five-row table that a reviewer verifies the way they verify `30`. It fails the
-second more quietly: a table has many readers by definition, so "the one place"
-becomes "the one file", which is what an ordinary module already is. The
-schema's own comment records where the line was drawn and why arrays were let
-in — list constants are the most drift-prone values, and an array still has one
-owner read by one scenario. A table does not clear that bar; the reason arrays
-did is exactly the reason it does not.
-*The reporter's own resolution is the argument's strongest form.* The table went
-to a shared module, is not registry-owned, and **nothing was lost** — because a
-piece-value table is tuning, not a promise. That is the rule design §11 now
-states — *params for promises, plain constants for tuning* — derived
-independently by the same adopter before it was written anywhere. Under it this
-candidate is not a limitation of `params` at all: it is a value that was never a
-requirement's to hold, and §11 carries this rejection's own argument in the same
-paragraph, as the rule stated over the type rather than over the value.
-*What ships instead*, in `[0.5.0]`: the refusal now says what is accepted
-instead of `Invalid input`, and `troubleshooting.md` states the constraint and
-where such a value belongs — the reporter's actual ask, which was for the
-decision to be visible rather than discovered by reading the shipped `.d.ts`.
-The permanent half goes to design §11 with the params rule, not here.
-*This reopens on* a report where the value is genuinely promised — a table an
-adopter owes their users, whose rows a reviewer would want in the rendered spec.
-None has been seen; the one that raised it was tuning.
-
-[Unreleased]: https://gitlab.com/Pseudorca/attest/-/compare/v0.7.0...main
+[0.7.2]: https://gitlab.com/Pseudorca/attest/-/tags/v0.7.2
+[0.7.1]: https://gitlab.com/Pseudorca/attest/-/tags/v0.7.1
 [0.7.0]: https://gitlab.com/Pseudorca/attest/-/tags/v0.7.0
 [0.6.0]: https://gitlab.com/Pseudorca/attest/-/tags/v0.6.0
 [0.5.0]: https://gitlab.com/Pseudorca/attest/-/tags/v0.5.0