@am_shork/attest 0.7.1 → 0.7.2

package/CHANGELOG.md

@@ -13,6 +13,203 @@ input, removes/renames a public API or `--json` field, or changes a default
 runtime behavior an existing invocation relies on — diagnostic message text is
 not API.
 
+## [0.7.2] - 2026-08-07
+
+### Added
+
+- **Releases carry a provenance attestation, and the publish job proves it was
+  served rather than trusting its own exit code.** `npm publish --provenance`
+  exchanges a GitLab OIDC token for a Sigstore certificate and records, in the
+  public transparency log, that this tarball was built by this pipeline from
+  this commit — checkable by anyone with `npm audit signatures` or the package
+  page, without trusting us. Nothing about the package's *contents* changes:
+  same `files`, same tarball, same `prepack`/`prepublishOnly` gate.
+  *It is `npm` in a repository whose every other job is `pnpm`, and that is not
+  drift.* pnpm's publish has no provenance support at all — checked against the
+  pinned 10.28.0, there is no such flag — so the choice was npm for this one
+  command or no attestation. Two consequences worth writing down. `--no-git-checks`
+  disappears with it: that was a pnpm flag, needed only because pnpm inspects
+  the branch and CI builds tags in detached HEAD. And `COREPACK_ENABLE_STRICT=0`
+  is now required to call `npm` at all — `corepack enable` shims npm too, and
+  `packageManager` pins pnpm, so a bare `npm` aborts with "this project is
+  configured to use pnpm". Job-local rather than narrowing the shim in `.base`,
+  because every other job wants exactly that strictness.
+  *The check after the publish, and the one that looked right and was worthless.*
+  The obvious step is `npm audit signatures`, and here it would have been
+  decoration of precisely the kind the `audit` job's comment refuses: run in this
+  repository it audits *our own installed dependency tree*, which never contains
+  `@am_shork/attest` — green while attesting nothing. What runs instead reads the
+  registry's attestation endpoint for the version just published and fails unless
+  a `slsa.dev/provenance/` predicate is actually there. That is the consumer's
+  view, and it is what separates "npm accepted the tarball" from "the statement
+  is served". It retries for propagation, because it runs *after* an
+  irreversible step: the publish has happened, and a rerun cannot clear a red
+  since the republish fails `EPUBLISHCONFLICT` on a version that now exists — so
+  a registry that had not caught up would pin the release job red with nothing
+  wrong. A served response missing the predicate fails immediately; that answer
+  will not change. Both paths were run against the live registry — green on a
+  package known to carry provenance, red on `0.7.1`, which does not.
+  *Three preconditions, and npm rejects the publish rather than quietly shipping
+  unsigned if any is missing.* An `id_tokens` audience of exactly `sigstore`; a
+  `repository.url` matching `CI_PROJECT_URL`, so a repository rename fails here
+  first; and a public package on registry.npmjs.org, which
+  `publishConfig.access=public` already settles. The token is still an npm
+  automation token — the OIDC exchange signs the release, it does not authorise
+  it (see *Under consideration*).
+  *What is unmeasured, stated rather than implied.* There is no dry run for
+  provenance — `--dry-run` mints no token exchange — so none of this has executed
+  against a real tag pipeline. The next release is its first run. The commit SHA,
+  tag, pipeline URL and repository path become public record; all four are
+  already public here.
+
+### Fixed
+
+- **One unreadable file took the whole of `check` down with it.** A `params`
+  value nested 20,000 deep exhausts the call stack inside `ts.createSourceFile`
+  — TypeScript's own recursive-descent parser, so `literalValue`'s recursion is
+  never reached and hardening it would have changed nothing. Measured: `attest
+  check` answered a single `internal-error`, exit 1. It failed *closed*, which
+  is why this is a repair and not an emergency — but `check` is the command this
+  project tells people to run first, in a pipeline, on a merge request whose
+  contents they do not control, and one file an attacker owns could reduce the
+  entire report to that one line, permanently. Breadth is what `check` trades
+  for running no project code; a report of one crash is not a degraded `check`,
+  it is a different command.
+  Now a file that cannot be parsed is reported as **`unreadable-file`** and
+  skipped, and everything else in the run is still reported.
+  *Two sites, and a guard on one of them fixes nothing.* `static-registry.ts`
+  and `parser.ts` both open with the same call, so the spec parse takes it too —
+  measured separately, and a registry-only guard leaves `attest check` dying on
+  a hostile `*.spec.ts` exactly as before. The registry half sits at the loop
+  that reads the files rather than inside either reader, because what is being
+  kept is a property of the *run* — one file's failure is not the run's failure
+  — and both readers need it; `readRegistry` folds them with `Promise.all`,
+  where one rejection ends the command.
+  *Its own code, not `registry-invalid`.* A file that blew the parser's stack
+  did not fail schema validation, and a diagnostic saying it did sends the
+  reader to the wrong page. The archive gate refuses to run at all when a spec
+  is unreadable, rather than grading a change against a plan known to be short.
+  *A third read site turned up while reading the diff, and it was answering
+  wrongly rather than crashing.* An unreadable **proposed** spec declares no
+  scenarios, so the unclaimed check found it claimed by nothing and reported
+  `proposed-spec-unclaimed` — a true sentence about a file whose actual problem
+  is that it could not be read, and a fix hint pointing at work that must not be
+  done. That is the shape `[0.7.0]` fixed for `orphan-test` after a registry
+  fails to load, arriving again at a different site. It now reports
+  `unreadable-file` and stands down.
+  `parseSpecs` now returns its issues alongside the plan; `parseAllSpecFiles`
+  was deleted in passing, having had no callers.
+  **No `SCHEMA_VERSION` bump.** A new `code` value is additive to the `--json`
+  envelope, and a consumer that branches on codes it knows is unaffected — the
+  rule this project already applies to every new diagnostic.
+
+- **`attest status` printed one line the sanitiser never saw.** The `Change:`
+  header was built and printed in the CLI shell, three lines above a closing
+  line that put the same value through `inline()` — so a change name holding
+  control characters repainted the terminal from the header while the footer was
+  clean. A change name is a directory name in the repository under test, and the
+  workflow `init` writes tells an agent to run `attest status <name>`.
+  The header moved into `formatStatus`, which is a fix rather than a tidy-up: a
+  write that lives in `cli/index.ts` cannot be attested at all, because that
+  module runs the CLI at import — so the site was not merely unsanitised, it was
+  unreachable by any scenario. `ATX-37`'s site list gained the kind that had
+  been missing from it, **a write in the shell**, and the two `--out` echoes are
+  the remainder: sanitised now, and still carried as unattested, because the
+  trigger needs a filename holding a control character — which NTFS refuses and
+  Linux permits, so that half is unmeasured here.
+
+- **A param that is a scenario's *domain* could be shortened, and the run just
+  covered less.** Nothing in this repo executes here — it is the self-registry
+  and its measurement suite — but three of the holes were real, and one of them
+  was a security check. Found by re-measuring the tautology entry below after
+  `[0.7.1]`: twelve mutations of this registry, each followed by the whole gate.
+  Four went green, and three of those were **not** the tautology that experiment
+  was looking for. When a scenario loops over a list it read from `params`, that
+  list is the set of cases the run covers, so removing a member removes a case
+  and every assertion inside the loop still passes over what is left. The
+  expectation stays perfectly independent; what moved is the quantifier's
+  domain, which is why the rule shipped in `[0.5.0]` — *the expectation must not
+  be a function of the param the code under test consumed* — does not cover it.
+  What each one cost, measured: dropping `../../evil` from `ATX-13.rejectedNames`
+  stopped testing the change-name guard against path traversal; `ATX-40.languages: 1`
+  stopped checking `docs/zh/troubleshooting.md` **entirely**, which is the
+  mirror rule `CLAUDE.md` calls mandatory losing its only gate; and
+  `ATX-64.childRunCommands: ['verify']` stopped checking `archive` for the
+  stdout hole `ATX-64` exists to close — filed in the same release, three
+  scenarios deep, and silent.
+  *The repo had already invented the defence and not named it.* `ATX-16` asserts
+  its list against a literal and its comment says why — "so the spec cannot
+  quietly cover fewer of them than the intent promises" — and it was one of the
+  two lists that went red. A literal is the only independent term available when
+  what is at risk is the **size** of the set rather than a value in it, which is
+  also why this reads as a violation of "do not hardcode a value that lives in
+  `params`" and is not one: the pin asserts what the intent *is*, not what the
+  system does.
+  Every iterated list now carries that line. `ATX-40` needed both halves and
+  that is the instructive one: `toHaveLength(languages)` already caught the
+  count going *up* without a document, and could never catch it going down,
+  because the slice shrinks with it and the assertion stays true.
+  *The counter-pressure, and one thing it cannot reach.* A `DOMAINS` table in
+  `tests/intent-rule-candidates.spec.ts` now judges every list-valued param as
+  `iterated` or `inert`, with completeness swept from the registry so a new list
+  fails until someone decides, and each `iterated` row naming the pin that
+  guards it. The `QUANTIFIED` taxonomy gained the distinction this turned on:
+  a `roster` owned by the **code** grows with the code and is safe by
+  construction, a roster owned by the **registry** is data an author can shorten
+  — `ATX-64` was filed as the former and was the latter. What the sweep does not
+  reach is `ATX-40`, whose domain size is a *scalar*; it is judged by hand, and
+  a future scalar used that way would not be forced into the table by anything.
+  *The rot check needed a second attempt, which is worth recording.* Written
+  first as "the pin appears somewhere in `self/`", it passed with `ATX-64`'s pin
+  deleted — two requirements pin a list read into a local named `commands`, and
+  the grep matched the other one. It asserts **exactly one** match now. A check
+  satisfiable by an unrelated line is the failure it exists to prevent.
+
+- **A project under test could put its own verdict on stdout ahead of Attest's,
+  under `--json`.** `runAndCollect` starts Vitest with the parent's fd 1 in
+  play, and `quiet: true` does not close it: `silent: true` suppresses Vitest's
+  *console interception*, and a bare `process.stdout.write` in a spec never
+  enters it — measured at collection time and inside a scenario body, both. So
+  a spec writing `{"ok":true,…}` put that document **first** on the stream: a
+  consumer calling `JSON.parse` on the whole of stdout got a parse error at
+  position 46, and one reading line-wise or taking the first object got the
+  attacker's verdict instead of the report. `check`, `cover`, `render` and
+  `status` were never exposed — no Attest code was on the path at all, which is
+  precisely why `core/terminal.ts` and `sanitisedLogger` did not help.
+  *Why this is worse than the terminal half of the same hole.* Repainting a
+  terminal — `ESC[2K CR`, a forged `ERROR` header at column 0, an `OSC 0` window
+  retitle, all of which also arrive intact — is not a capability `verify`
+  lacked, because it executes project code by design. Forging the *machine*
+  verdict is different in kind: it inverts what the report is for, since the
+  commands carrying the risk are exactly the ones that run the repository being
+  gated. §9.1 recorded the machine surface as never exposed because
+  `JSON.stringify` escapes every C0 character — true, and about the bytes Attest
+  writes; it says nothing about bytes Attest does not write.
+  Under `--json`, stdout is now diverted to stderr for the duration of the
+  command and released before the report is rendered. Diverted rather than
+  dropped: a human debugging a red pipeline still needs the run output, and
+  stderr is the stream no consumer parses. Without `--json` nothing changes —
+  the promise is the flag's, and diverting unconditionally would take the child
+  run's output away from the reader it exists for.
+  *The fix is `runAction`'s, not `runner.ts`'s* — the same argument that put
+  `formatCrash` in `cli/report.ts` rather than a copy in each `catch`.
+  `runAction` is already the single convergence point for one output and one
+  exit code; `runner.ts` would have been made to hold a contract it does not
+  own. It moved to **`src/cli/action.ts`** to be testable at all: `cli/index.ts`
+  calls `program.parseAsync()` at import time, so importing it to cross the seam
+  would run the CLI. No behaviour of `index.ts` moved with it.
+  *What the regression test had to be, because the first one was wrong.* The
+  scenarios under **`ATX-64`** spawn the real CLI and read its pipes. The
+  in-process version looks equivalent and is not: they run inside a Vitest
+  worker, which patches `console` and re-routes worker output, so intercepting
+  `process.stdout.write` there observed neither the report nor the pollution and
+  went green against the unfixed code for three of three scenarios. What the
+  requirement is about is the bytes on the pipe, and only a real pipe has them.
+  The statement names its commands in `params` rather than quantifying over
+  "every command that executes project code" — a `roster` row rather than a
+  `sites` one, so a third such command cannot join without joining the
+  assertion.
+
 ## [0.7.1] - 2026-08-05
 
 ### Added
@@ -3178,6 +3375,26 @@ symptom are worth batching**: individually none justifies a commit, together the
 cost about an hour, and they are the group no gate could have found, since having
 no symptom is the definition of what a gate cannot see.
 
+- **Telling adopters about the domain trap, which the shipped guidance
+  currently walks them into.** The repo half landed under `[Unreleased]`; the
+  user-facing half has not, and it is not merely absent. `skill.ts`'s "Four
+  things you must not do" says **"Do not hardcode a value that lives in
+  `params`"**, and the pin every fix in that entry adds is, read literally,
+  exactly that. An adopter who writes a roster param — which the design
+  actively pushes them toward, since a quantifier a scenario can iterate is the
+  shape `QUANTIFIED` recommends — gets an instruction that forbids the only
+  defence against shortening it. The distinction is real and one sentence long:
+  the rule is about the **expectation** the system is measured against, and the
+  pin asserts what the **intent** is. Nothing shipped draws it.
+  *Why it is filed rather than done in the same pass.* It reaches README §"killer
+  move", the `init` skill, `possible-drift`'s troubleshooting section and design
+  §11, in both languages — the same surface `[0.5.0]` rewrote, and that entry
+  records the lesson: rewording the central claim of the tool is not a line
+  appended, and it was held back once precisely so it could be done deliberately
+  and in one pass. The measurement it needs is already taken; what it needs next
+  is the pass. *Not* a `possible-drift` change: nothing here is detectable by
+  the engine, for the reason the entry below gives about prose judgement.
+
 - **Binding the `✗` samples to fixtures whose rejection is asserted.** A sample
   showing input the engine must *reject* can be bound the way a runnable one is,
   to a fixture whose rejection is the thing under test — which is what
@@ -3196,32 +3413,6 @@ no symptom is the definition of what a gate cannot see.
   `[0.4.3]` — that the gate and the run proving the fixture still works live in
   different suites — applies here identically.
 
-- **The child run's stdout is not Attest's, and `--json` promises it is.**
-  `runAndCollect` starts Vitest with the parent's fd 1 inherited, so a spec file
-  in the project under test writes straight to the same stream the report goes
-  to. `quiet: true` does not close it: `silent: true` suppresses Vitest's
-  *console interception*, and a bare `process.stdout.write` in a spec — at
-  collection time or inside a scenario body, both measured — goes past it
-  untouched. Neither `core/terminal.ts` nor `sanitisedLogger` is on that path at
-  all, because no Attest code is.
-  *The machine surface is the half that is actually new.* `cli/index.ts` opens
-  by stating that under `--json` "the only thing written to stdout is one
-  machine-readable report", and §9.1 records that this path "was never exposed —
-  `JSON.stringify` escapes every C0 character". Both hold for `check`, `cover`,
-  `render` and `status`, and neither holds for `verify` or `archive`: measured,
-  a spec writing `{"ok":true,"POLLUTION":"…"}` puts that document **first** on
-  stdout, ahead of the real report, so `JSON.parse` of the whole stream fails
-  (position 46) while anything reading line-wise or taking the first object
-  reads the attacker's verdict. The terminal half is the same hole and the
-  smaller finding — `ESC[2K CR` plus a forged `ERROR` header at column 0 and an
-  `OSC 0` window retitle all arrive intact — but `verify` executes project code
-  by design, so repainting a terminal is not a capability that path lacked.
-  *The fix belongs to `runAction`, not to `runner.ts`.* That function is already
-  the single convergence point for "one output, one exit code", which is the
-  same argument that put `formatCrash` in `cli/report.ts` rather than leaving a
-  copy in each `catch`: `runner.ts` would be made to hold a contract it does not
-  own, while `runAction` is the only place the promise is made.
-
 - **`render`'s document can carry raw HTML and a forged requirement section.**
   `sanitised` is the entry §9.1 names and it strips control characters and
   nothing else, so `statement` and `rationale` reach the Markdown by
@@ -3259,36 +3450,6 @@ no symptom is the definition of what a gate cannot see.
   the same reason: a name known to be unwritable must not leave half a set
   behind.
 
-- **A deeply nested literal takes `check` down before either reader sees it.**
-  40 KB of `[[[…]]]` in a `params` value exhausts the stack inside
-  `ts.createSourceFile` — TypeScript's own recursive-descent parser, so
-  `literalValue`'s recursion is never reached and hardening it would change
-  nothing. `parser.ts` opens with the same call, so `verify` takes it too, and
-  `loadRegistry` reads with `Promise.all`, so one file ends the whole command.
-  *It fails closed, which is why this is a repair and not an emergency.*
-  Measured: `internal-error`, `ok: false`, exit 1, and a well-formed `--json`
-  envelope. What it costs is that the command this project tells people to run
-  first on an untrusted fork MR can be made to say nothing but that, forever.
-  The shape of the fix is already in `locate.ts`: `unreadableFiles` exists to
-  say "this file could not be read" without ending the run, and a `RangeError`
-  out of a single `read` or `parseSpecFile` is that, so a hostile file scraps
-  only itself and `check`'s breadth contract survives it.
-
-- **`status` prints one line the sanitiser never sees.** `cli/index.ts` writes
-  `Change: ${result.change}` bare, while `formatStatus` puts the same value
-  through `inline` twice, three lines apart in the same output. Measured with a
-  directory named with U+009B — the C1 CSI the class in `control` exists for,
-  and one NTFS permits — the header carried `c2 9b` raw while the closing
-  `Not a verdict:` line carried a space. A change name is a directory name in
-  the repository under test, and the workflow `init` writes tells an agent to
-  run `attest status <name>`, so the value is the project's to choose.
-  *One `inline()` call, and the entry is here for the reason rather than the
-  fix.* §9.1 says a stream has no entry, only writes, so the obligation sits on
-  every write or not at all — and this is the second time a single missed write
-  has been the whole defect, after the two `catch` blocks that printed a raw
-  stack beside sanitised diagnostics. The sweep filed above under `ATX-37` is
-  what would have found it; this is one more measurement in favour of it.
-
 ## Under consideration
 
 Candidates with **no decision yet**, between the two sections either side of it
@@ -3301,6 +3462,25 @@ deletion. What each entry has to carry is the evidence currently blocking the
 decision, because that is what a re-proposal a year from now would otherwise
 have to gather again.
 
+- **Trusted publishing, which would delete `NPM_TOKEN` rather than add to it.**
+  The provenance work in `[Unreleased]` signs the release but does not change
+  what authorises it: a long-lived automation token, masked and protected, that
+  publishes as us to anyone holding it. npm's trusted publishing exchanges the
+  same OIDC identity the attestation already uses for a short-lived credential,
+  which would remove the stored secret entirely and grant provenance as a
+  property of the flow rather than a flag on the command. The deletion test
+  points the right way for once: what it removes is the only long-lived
+  credential this repository has.
+  *What blocks the decision, and it is evidence rather than principle.* Whether
+  npm's trusted publishers accept a **gitlab.com-hosted** project on the plan
+  this package publishes under has not been verified against this project — it
+  was not checked when the provenance job was written, and an entry claiming it
+  works would be exactly the unverified confidence the rest of this file avoids.
+  It also cannot be tested except by publishing: as with provenance, there is no
+  dry run, so a failed experiment is a release. The cheap next step is reading
+  npm's current trusted-publisher documentation for GitLab support before
+  writing any YAML.
+
 - **A static sweep for the two properties claimed over the whole of `src/`.**
   The quantifier table's first strict read left three rows wanting the same
   thing, and the repo already owns the idiom: `tests/import-boundary.spec.ts` is
@@ -3439,6 +3619,103 @@ have to gather again.
   assertion is still green, still silent, and still reachable — so this stays
   here rather than moving to `Considered and rejected`: documenting a trap is
   not the same as deciding not to detect it.
+  **Re-measured after `[0.7.1]` widened `params`, on this registry rather than
+  the reporter's — the first time this experiment has been run here.** Twelve
+  mutations, each followed by the whole gate. Two results matter, and they point
+  opposite ways.
+  *The shape is now reachable here, and the widening is why.* `self/render.spec.ts`
+  asserts `expect(md).toContain(JSON.stringify(kinds))` over the same
+  `payloadKinds` it feeds to the renderer — the expectation is a function of the
+  value under test, verbatim row 3, and it could not have been written before
+  the widening because the param could not be an object. The mechanism is
+  sharper than a frequency count and is the strongest thing this entry has
+  gained: **the prescribed remedy costs in proportion to the value's
+  complexity.** Same repo, adjacent files, same value shape — `ATX-7` pins two
+  numbers with literals and goes red; `ATX-63` would have had to hand-write a
+  rendered JSON block, so it echoed. Depth raises the defect rate and the cost
+  of avoiding it along one axis.
+  *And its cost here is nil, which is the honest other half.* Both composite
+  params are fixtures for the renderer and the validator; the numbers stand for
+  nothing, so the green is arguably correct. Blocker **(1)** is therefore only
+  half retired — the shape is reproduced in a second, mature repo, and the count
+  of *harmful* instances is still zero. Blocker **(2)** is reinforced rather than
+  weakened: all four green mutations were on params `src/` never reads, so the
+  reporter's "read from both a spec and a non-spec file" detector would have
+  flagged none of them. Blocker **(3)** is untouched.
+  *The frequency is no longer unmeasured, and it points away from building
+  anything.* Blocker **(1)** rested on 8 commits of one greenfield repo. Parsed
+  at every one of the **38** revisions that have touched this registry — all 38
+  readable by the current static reader, so nothing was skipped — the history is
+  **57 param keys added, 0 removed, and exactly 1 value changed**: `ATX-16.staticCommands`
+  gaining `status`. That single edit is a roster *widening*, the safe direction,
+  and it is on the one list that was already pinned, so it could not have been
+  made without updating the pin. Two independent codebases, one greenfield and
+  one at 64 requirements, and the event this whole entry is about has happened
+  zero times in either. What that argues is not that the hole is unreal — it is
+  reachable, demonstrated above — but that it is **rare and silent**, which is
+  the profile `divergent-param` was rejected on rather than the profile that
+  justifies an engine rule.
+  *The same number says the split-out fix below has also never been triggered.*
+  0 removals ever means no domain has ever been shortened here. Those pins close
+  a live *exposure*, not a live *loss*, and the case for them is that they cost
+  one line each against a failure with no symptom — not that anything was
+  currently broken.
+  *Blocker **(3)** assumed mutation testing was the only separator. A cheaper
+  candidate existed, has now been scored, and does not survive it.* The idea was
+  a **syntactic** discriminator over one test body — flag an assertion whose
+  expected value derives from a param that also reached the arrange/act part —
+  which is exactly the difference between the two cases the widening produced:
+  `renderMarkdown({params: {payloadKinds: kinds}})` … `toContain(JSON.stringify(kinds))`
+  against `expect(kinds.json.maxBytes).toBe(1_048_576)`. Scored the way
+  `divergent-param` should have been and was not: implemented in
+  `tests/intent-rule-candidates.spec.ts`, run over the specs that attest this
+  repo, and then **every param it fires on mutated with the whole gate run —
+  fifteen of them, one gate run each. Four went green; eleven went red.**
+  *Then the detector was found to be wrong, which is the more useful half.* Its
+  first implementation counted an identifier in any position as a read of a
+  local with that name, so `i.code` in `issues.map((i) => i.code)` looked like a
+  use of a param named `code` — and `code` is this repo's commonest param name.
+  Corrected to count reference positions only, it flags **8, not 15**, and the
+  seven it drops are exactly seven the mutations had already shown to be pinned
+  by `src/`. The honest score is therefore **4 of 8, not 4 of 15** — precision
+  50%, not 27%. The conclusion does not move, because it never rested on the
+  precision figure; what moves is how much of the original number was the
+  candidate failing and how much was the measurement being wrong, and that is
+  worth writing down rather than quietly restating.
+  The remaining false positives are not near-misses. They are independent terms
+  the detector cannot see: **the runtime is the term** — `ATX-14`'s
+  `inheritedKey` is `'toString'`, and a mutated spelling is not a prototype key
+  at all, so the behaviour under test changes; **`src/` is the term** —
+  `ATX-51`'s `code` is a second copy of a string the engine emits as a literal;
+  and **arithmetic is the term** — `threshold + 3` builds a derived expectation
+  that mutation breaks.
+  And the four true positives fail the second test, which is the one that
+  decides it: **none is harmful.** `ATX-10` and `ATX-3` assert that a value was
+  substituted or applied, where the identity of the number is not the
+  obligation; `ATX-51`'s is a path prefix and `ATX-63`'s a rendering fixture.
+  Telling those from a mine-density band that must not move is a judgement about
+  whether the value *means* anything — the ground truth §0 refuses to compute
+  for someone else's registry. **50% precision on the shape, 0% on the harm.**
+  Two limits on that number, stated because a score with an unstated method is
+  what this file exists to prevent. The mutation has **one direction per kind**
+  — numbers +1, lists drop-last, strings suffixed — and direction can decide the
+  verdict: `ATX-40.languages` is red at 2→3 and was green at 2→1 before it was
+  pinned, so the true-positive count is a floor. And **recall is unmeasured**:
+  the eight params mutated earlier that this detector does not flag all went
+  red, which is eight correct negatives and not a recall figure.
+  The detector and its verdict table are kept in the measurement suite, with the
+  reach recomputed on every run and the table asserted to cover exactly what
+  fires — because the reach figure quoted for `compound-requirement` went stale
+  in this very file for want of that.
+  *A scoping limit on all of the above.* This repo cannot settle blocker **(2)**.
+  `src/` reads no param at all — every `reqs[…].params` in it is a comment or a
+  doc string — so params here are test vocabulary, while in the reporter's repo
+  they are application constants the app itself consumes. The reporter's
+  detector keys on exactly that difference, so it is inert here and this corpus
+  is evidence neither for nor against it.
+  *What the re-measurement did find is a different defect, and it has been split
+  out below* — the entry is kept whole here because the two were measured in one
+  pass and separating them is the finding.
 
 - **Whether `check` and `verify` should refuse a half-loaded registry the way
   `cover` and `render` do.** Those two return early on `hasError(loadIssues)`,
@@ -3919,7 +4196,7 @@ requirement, and human review at propose is still the whole answer. What is
 rejected is grouping as a way to assist it, and this reopens only on a
 contradiction that grouping would have caught.
 
-[Unreleased]: https://gitlab.com/Pseudorca/attest/-/compare/v0.7.1...main
+[0.7.2]: https://gitlab.com/Pseudorca/attest/-/tags/v0.7.2
 [0.7.1]: https://gitlab.com/Pseudorca/attest/-/tags/v0.7.1
 [0.7.0]: https://gitlab.com/Pseudorca/attest/-/tags/v0.7.0
 [0.6.0]: https://gitlab.com/Pseudorca/attest/-/tags/v0.6.0

package/README.md

@@ -157,7 +157,7 @@ Every diagnostic carries a `code`, and every code has a section in
 ```
 ERROR   registry-not-static (requirements/upload.reqs.ts:5)
     Value is not a literal.
-    → https://gitlab.com/Pseudorca/attest/-/blob/v0.7.1/docs/en/troubleshooting.md#registry-not-static
+    → https://gitlab.com/Pseudorca/attest/-/blob/v0.7.2/docs/en/troubleshooting.md#registry-not-static
 ```
 
 The anchor **is** the code, so the link cannot point somewhere the section

package/dist/cli/action.d.ts

@@ -0,0 +1,48 @@
+import { type JsonCommand, type JsonReport } from './json.js';
+/** What an action produces: the machine report plus how to render it for humans. */
+export interface Rendered {
+    report: JsonReport;
+    human: () => void;
+}
+export interface ActionOptions {
+    json?: boolean;
+}
+/**
+ * Send everything written to `process.stdout` to stderr until the returned
+ * function is called.
+ *
+ * This is what keeps the `--json` promise against output Attest does not write
+ * — the third obligation on the machine surface in design §9.1, stated there
+ * because it belongs to the command shell rather than to any emitter, and
+ * attested by ATX-64. The child Vitest run of `verify`/`archive` executes
+ * project code,
+ * and a bare `process.stdout.write` in a spec reaches this stream — `silent:
+ * true` only suppresses Vitest's *console interception*, which such a write
+ * never enters. Measured: the child's writes do arrive through the parent's
+ * `process.stdout.write` rather than through a separately inherited descriptor,
+ * which is why patching it here is sufficient and a change of Vitest pool is
+ * the thing that could quietly make it insufficient. The scenario under ATX-64
+ * runs a real child run for that reason, rather than asserting on this function
+ * with a stub.
+ *
+ * Diverted, not discarded: a human reading a red pipeline still needs the run
+ * output, and stderr is the stream no `--json` consumer parses. It is not
+ * sanitised on the way — `verify` executes project code by design, so painting
+ * the terminal is not a capability this path lacked (design §9.1 scopes its
+ * guarantee to what Attest itself writes).
+ */
+export declare function divertStdout(): () => void;
+/**
+ * Run one command's work with a single output + exit-code contract:
+ *  - success: print the JSON report (`--json`) or the human rendering, and set
+ *    the exit code from `report.ok` — the one source of the verdict.
+ *  - failure: under `--json`, still emit one parseable `internal-error`
+ *    envelope on stdout; otherwise print the stack on stderr. Exit code 1.
+ *
+ * Under `--json` the action runs with stdout diverted, so the report is the
+ * only thing on that stream. The divert is released before either rendering
+ * runs — the report has to reach the real stdout, and the human path was never
+ * under the promise.
+ */
+export declare function runAction(command: JsonCommand, opts: ActionOptions, action: () => Promise<Rendered>): Promise<void>;
+//# sourceMappingURL=action.d.ts.map

package/dist/cli/action.js

@@ -0,0 +1,100 @@
+// The convergence point every command passes through: one output, one exit
+// code (design §9). It lives here rather than in `cli/index.ts` because that
+// module calls `program.parseAsync()` at import time — importing it to test the
+// contract would run the CLI. The interface is the test surface, so the
+// contract moved to where a scenario can cross the same seam a command does.
+import { renderJson, errorReport } from './json.js';
+import { formatCrash } from './report.js';
+import { packageVersion } from '../core/version.js';
+const VERSION = packageVersion();
+/**
+ * Send everything written to `process.stdout` to stderr until the returned
+ * function is called.
+ *
+ * This is what keeps the `--json` promise against output Attest does not write
+ * — the third obligation on the machine surface in design §9.1, stated there
+ * because it belongs to the command shell rather than to any emitter, and
+ * attested by ATX-64. The child Vitest run of `verify`/`archive` executes
+ * project code,
+ * and a bare `process.stdout.write` in a spec reaches this stream — `silent:
+ * true` only suppresses Vitest's *console interception*, which such a write
+ * never enters. Measured: the child's writes do arrive through the parent's
+ * `process.stdout.write` rather than through a separately inherited descriptor,
+ * which is why patching it here is sufficient and a change of Vitest pool is
+ * the thing that could quietly make it insufficient. The scenario under ATX-64
+ * runs a real child run for that reason, rather than asserting on this function
+ * with a stub.
+ *
+ * Diverted, not discarded: a human reading a red pipeline still needs the run
+ * output, and stderr is the stream no `--json` consumer parses. It is not
+ * sanitised on the way — `verify` executes project code by design, so painting
+ * the terminal is not a capability this path lacked (design §9.1 scopes its
+ * guarantee to what Attest itself writes).
+ */
+export function divertStdout() {
+    const stream = process.stdout;
+    // The prior *state* of the property, not the function it held. `write` is
+    // inherited from `Writable.prototype`, so the patch below is a new own
+    // property and undoing it means removing that property — assigning the old
+    // function back would leave a bound copy shadowing the prototype forever, and
+    // would silently swallow anyone else's patch on a nested divert.
+    const owned = Object.getOwnPropertyDescriptor(stream, 'write');
+    const divert = (chunk, encoding, callback) => typeof encoding === 'function'
+        ? process.stderr.write(chunk, encoding)
+        : process.stderr.write(chunk, encoding, callback);
+    stream.write = divert;
+    return () => {
+        if (owned)
+            Object.defineProperty(stream, 'write', owned);
+        else
+            Reflect.deleteProperty(stream, 'write');
+    };
+}
+/**
+ * Run one command's work with a single output + exit-code contract:
+ *  - success: print the JSON report (`--json`) or the human rendering, and set
+ *    the exit code from `report.ok` — the one source of the verdict.
+ *  - failure: under `--json`, still emit one parseable `internal-error`
+ *    envelope on stdout; otherwise print the stack on stderr. Exit code 1.
+ *
+ * Under `--json` the action runs with stdout diverted, so the report is the
+ * only thing on that stream. The divert is released before either rendering
+ * runs — the report has to reach the real stdout, and the human path was never
+ * under the promise.
+ */
+export async function runAction(command, opts, action) {
+    try {
+        const { report, human } = await withStdoutDiverted(opts.json === true, action);
+        if (opts.json)
+            console.log(renderJson(report));
+        else
+            human();
+        process.exitCode = report.ok ? 0 : 1;
+    }
+    catch (err) {
+        if (opts.json) {
+            // Unsanitised on purpose: `JSON.stringify` escapes every C0 character,
+            // so these bytes cannot carry one out (see report.ts). That is a claim
+            // about what this line writes and nothing wider — what the project under
+            // test writes is the divert's business, above.
+            console.log(renderJson(errorReport(VERSION, command, err)));
+        }
+        else {
+            console.error(formatCrash(err));
+        }
+        process.exitCode = 1;
+    }
+}
+/** Run `action` with stdout diverted when `divert`, restoring on every path. */
+async function withStdoutDiverted(divert, action) {
+    if (!divert)
+        return action();
+    const release = divertStdout();
+    try {
+        return await action();
+    }
+    finally {
+        release();
+    }
+}
+//# sourceMappingURL=action.js.map

package/dist/cli/index.js

@@ -7,14 +7,22 @@
 // The exit code is always derived from that report's `ok`, so the JSON verdict
 // and the process status can never disagree — including on the crash path,
 // where the report is an `internal-error` envelope instead of a bare stack.
+//
+// Both halves of that promise are kept by `runAction` (cli/action.ts), which is
+// where the contract is stated and tested; this file only supplies the work.
 import { Command } from 'commander';
 import chalk from 'chalk';
 import { resolve } from 'node:path';
 import { writeAtomic } from '../core/write.js';
 import { runCheck, runVerify, runCover, runArchive, runArchiveApply, runInit, runRender, runRenderCheck, runStatus, DEFAULT_TARGET, TARGET_NAMES, } from '../core/pipeline.js';
 import { hasError } from '../core/types.js';
+// The one project-derived value this shell still interpolates itself. `--out`
+// is argv, which on a fork MR pipeline is written by the repository's own CI
+// config — so it is the project's text, not the operator's (ATX-37).
+import { inline } from '../core/terminal.js';
+import { runAction } from './action.js';
 import { formatArchiveVerdict, formatCrash, formatIssues, formatScope, summarize, formatCoverage, formatStatus, } from './report.js';
-import { archiveReport, checkReport, coverReport, errorReport, initReport, renderJson, renderReport, statusReport, verifyReport, } from './json.js';
+import { archiveReport, checkReport, coverReport, initReport, renderReport, statusReport, verifyReport, } from './json.js';
 import { packageVersion } from '../core/version.js';
 const VERSION = packageVersion();
 /** `runArchive` in the shape `--apply` returns, so the two share one call site. */
@@ -47,34 +55,6 @@ const VITEST_CONFIG_HELP = 'load this Vitest config in the child run (transforms
 function vitestConfig(opts) {
     return opts.vitestConfig ? resolve(process.cwd(), opts.vitestConfig) : undefined;
 }
-/**
- * Run one command's work with a single output + exit-code contract:
- *  - success: print the JSON report (`--json`) or the human rendering, and set
- *    the exit code from `report.ok` — the one source of the verdict.
- *  - failure: under `--json`, still emit one parseable `internal-error`
- *    envelope on stdout; otherwise print the stack on stderr. Exit code 1.
- */
-async function runAction(command, opts, action) {
-    try {
-        const { report, human } = await action();
-        if (opts.json)
-            console.log(renderJson(report));
-        else
-            human();
-        process.exitCode = report.ok ? 0 : 1;
-    }
-    catch (err) {
-        if (opts.json) {
-            // Unsanitised on purpose: `JSON.stringify` escapes every C0 character, so
-            // the machine surface was never the exposed one (see report.ts).
-            console.log(renderJson(errorReport(VERSION, command, err)));
-        }
-        else {
-            console.error(formatCrash(err));
-        }
-        process.exitCode = 1;
-    }
-}
 program
     .command('check')
     .description('Static structural validation (fast CI pre-check); runs no project code.')
@@ -168,7 +148,7 @@ program
                 report: renderReport(VERSION, issues, opts.out),
                 human: () => {
                     if (issues.length === 0)
-                        console.log(chalk.green(`✓ ${opts.out} is up to date.`));
+                        console.log(chalk.green(`✓ ${inline(opts.out ?? '')} is up to date.`));
                     else {
                         console.log(formatIssues(issues));
                         console.log(summarize(issues));
@@ -188,7 +168,7 @@ program
                     console.log(summarize(issues));
                 }
                 else if (dest) {
-                    console.log(chalk.green(`✓ Wrote ${opts.out}`));
+                    console.log(chalk.green(`✓ Wrote ${inline(opts.out ?? '')}`));
                 }
                 else {
                     process.stdout.write(markdown);
@@ -261,7 +241,6 @@ program
                 console.log(summarize(result.issues));
                 return;
             }
-            console.log(chalk.bold(`Change: ${result.change}`));
             console.log(formatStatus(result));
         },
     };

package/dist/cli/report.js

@@ -166,7 +166,15 @@ const STATE_MARK = {
  * the argument that keeps `render --check` comparing documents rather than bytes.
  */
 export function formatStatus(result) {
-    const lines = [];
+    // The header is built here rather than in the CLI action, and that is a fix
+    // rather than a tidy-up. It was interpolated and printed in `cli/index.ts`,
+    // which put it past the sanitiser — three lines above a closing line that
+    // puts the same value through `inline`. `ATX-37` covers "everything the CLI
+    // writes to a terminal", and a write that lives in the shell can only be
+    // attested by spawning a process, because `cli/index.ts` runs the CLI at
+    // import. Moving the line to the module that already owns this report makes
+    // the obligation reachable by a scenario — the interface is the test surface.
+    const lines = [chalk.bold(`Change: ${inline(result.change)}`)];
     if (result.rows.length === 0) {
         lines.push(chalk.dim('(this change adds no requirements)'));
     }

package/dist/core/docs.d.ts

@@ -8,7 +8,7 @@
  * and the `##` headings of both language documents, so landing here cannot
  * produce a dead link.
  */
-export declare const ISSUE_CODES: readonly ["add-conflict", "add-invalid", "added-id-unmerged", "apply-no-prefix-owner", "apply-unsupported-delta", "change-not-found", "compiler-unsupported", "declared-not-run", "duplicate-prefix", "duplicate-requirement", "empty-spec", "internal-error", "invalid-change-name", "missing-spec-doc", "modify-invalid", "modify-missing", "never-red", "non-scalar-interpolation", "orphan-test", "possible-drift", "proposed-spec-name-taken", "proposed-spec-unclaimed", "rationale-placeholder", "registry-invalid", "registry-no-default", "registry-not-static", "rename-source-missing", "rename-target-exists", "rename-target-invalid", "spec-in-change-dir", "spec-load-failed", "stale-spec-doc", "tests-red", "unbound-param", "uncovered-requirement", "unknown-target"];
+export declare const ISSUE_CODES: readonly ["add-conflict", "add-invalid", "added-id-unmerged", "apply-no-prefix-owner", "apply-unsupported-delta", "change-not-found", "compiler-unsupported", "declared-not-run", "duplicate-prefix", "duplicate-requirement", "empty-spec", "internal-error", "invalid-change-name", "missing-spec-doc", "modify-invalid", "modify-missing", "never-red", "non-scalar-interpolation", "orphan-test", "possible-drift", "proposed-spec-name-taken", "proposed-spec-unclaimed", "rationale-placeholder", "registry-invalid", "registry-no-default", "registry-not-static", "rename-source-missing", "rename-target-exists", "rename-target-invalid", "spec-in-change-dir", "spec-load-failed", "stale-spec-doc", "tests-red", "unbound-param", "uncovered-requirement", "unknown-target", "unreadable-file"];
 export type IssueCode = (typeof ISSUE_CODES)[number];
 /**
  * The page explaining `code`, or `undefined` when nothing explains it.

package/dist/core/docs.js

@@ -55,6 +55,7 @@ export const ISSUE_CODES = [
     'unbound-param',
     'uncovered-requirement',
     'unknown-target',
+    'unreadable-file',
 ];
 const DOCUMENTED = new Set(ISSUE_CODES);
 const REPO = 'https://gitlab.com/Pseudorca/attest/-/blob';

package/dist/core/locate.d.ts

@@ -152,9 +152,10 @@ export declare function idPrefix(id: string): string;
  * development platform could produce (see CHANGELOG.md, `Under consideration`).
  * The memory here needed no such evidence — it is arithmetic, and portable.
  */
-export declare function parseSpecs(files: string[], displayRoot: string): Promise<AttestPlan>;
-/** Parse every `*.spec.ts` under root into one merged plan (file paths shown relative to root). */
-export declare function parseAllSpecFiles(root: string): Promise<AttestPlan>;
+export declare function parseSpecs(files: string[], displayRoot: string): Promise<{
+    plan: AttestPlan;
+    issues: Issue[];
+}>;
 /**
  * Spec-shaped files sitting under `root/changes` — the location a change's
  * specs used to live at, and which nothing walks any more (design §7).

package/dist/core/locate.js

@@ -95,6 +95,43 @@ export async function scanProject(root) {
     }
     return { reqsFiles, specFiles, proposedSpecFiles };
 }
+/**
+ * The message an unreadable file gets, in one place because two call sites
+ * raise it — a registry and a spec — and they must not drift into two
+ * descriptions of one condition (ATX-65).
+ */
+function unreadableIssue(err) {
+    // `RangeError` in practice, from the call stack running out inside
+    // TypeScript's recursive-descent parser. Caught as `unknown` rather than
+    // narrowed to it: the guard's promise is that *no* throw from one file ends
+    // the run, and narrowing would make that promise true only of the one trigger
+    // that has been measured.
+    const detail = err instanceof Error ? err.message : String(err);
+    return {
+        level: 'ERROR',
+        code: 'unreadable-file',
+        message: `Could not be read, so nothing in it was checked: ${detail}. ` +
+            `Everything else in this run was still reported.`,
+    };
+}
+/**
+ * `reader.read`, with a throw turned into an issue about that file.
+ *
+ * At the loop rather than inside either reader, because what is being kept is a
+ * property of the *run* — one file's failure is not the run's failure — and
+ * both readers need it. `readRegistry` folds these concurrently, so an
+ * uncaught throw here rejects the whole `Promise.all` and ends the command:
+ * measured, a 20,000-deep literal in one `params` value reduced `attest check`
+ * to a single `internal-error` (design §5.1, ATX-65).
+ */
+async function readGuarded(reader, file) {
+    try {
+        return await reader.read(file);
+    }
+    catch (err) {
+        return { issue: unreadableIssue(err) };
+    }
+}
 /**
  * Read registries by **executing** the module through the Vite loader.
  *
@@ -207,7 +244,7 @@ export async function loadRegistry(root, reader, files) {
     const paths = files ?? (await scanProject(root)).reqsFiles;
     // Read the files concurrently, then fold the results in sorted file order:
     // the issue list stays deterministic regardless of which one finished first.
-    const loaded = await Promise.all(paths.map(async (file) => ({ file, outcome: await reader.read(file) })));
+    const loaded = await Promise.all(paths.map(async (file) => ({ file, outcome: await readGuarded(reader, file) })));
     const registry = {};
     const issues = [];
     const unreadableFiles = [];
@@ -309,12 +346,24 @@ export async function parseSpecs(files, displayRoot) {
     // Indexed rather than appended, so the merge below follows the input order
     // whatever order the reads finish in.
     const parsed = new Array(files.length);
+    // Same index space, so a file contributes either a parse or an issue and the
+    // two lists cannot disagree about which file is which.
+    const failures = new Array(files.length);
     let next = 0;
     const worker = async () => {
         for (let i = next++; i < files.length; i = next++) {
             const file = files[i];
-            const source = await readFile(file, 'utf8');
-            parsed[i] = parseSpecFile(relativePath(displayRoot, file), source);
+            const display = relativePath(displayRoot, file);
+            // Per file, for the reason `readGuarded` exists above: these run
+            // concurrently, so one throw rejects the whole `Promise.all` and takes
+            // the command with it. A hostile spec scraps only itself (ATX-65).
+            try {
+                parsed[i] = parseSpecFile(display, await readFile(file, 'utf8'));
+            }
+            catch (err) {
+                parsed[i] = { scenarios: [], paramRefs: [] };
+                failures[i] = { ...unreadableIssue(err), file: display };
+            }
         }
     };
     await Promise.all(Array.from({ length: Math.min(PARSE_CONCURRENCY, files.length) }, worker));
@@ -323,11 +372,7 @@ export async function parseSpecs(files, displayRoot) {
         plan.scenarios.push(...one.scenarios);
         plan.paramRefs.push(...one.paramRefs);
     }
-    return plan;
-}
-/** Parse every `*.spec.ts` under root into one merged plan (file paths shown relative to root). */
-export async function parseAllSpecFiles(root) {
-    return parseSpecs(await findFiles(root, isSpecFile), root);
+    return { plan, issues: failures.filter((i) => i !== undefined) };
 }
 /**
  * Spec-shaped files sitting under `root/changes` — the location a change's

package/dist/core/pipeline.js

@@ -109,9 +109,13 @@ export async function runCheck(root, options = {}) {
     // only one where that distinction is worth anything.
     return withLoader(options, async (loader) => {
         const { registry, issues, unreadableFiles } = await readRegistry(root, options, scan.reqsFiles, loader);
-        const plan = await parseSpecs(scan.specFiles, root);
+        const { plan, issues: unreadableSpecs } = await parseSpecs(scan.specFiles, root);
         return [
             ...issues,
+            // A spec the parser could not read is reported here rather than dropped:
+            // `check`'s contract is breadth, and a file silently contributing no
+            // scenarios reads as a file with no scenarios (ATX-65).
+            ...unreadableSpecs,
             // `check` keeps reporting on a registry that only half-loaded,
             // deliberately: its contract is breadth, and the findings from the files
             // that *did* load are all still true. What it must not do is advise work
@@ -220,7 +224,14 @@ async function unclaimedProposedSpecIssues(root, scan, options, loader) {
             for (const id of claimedIds(read.delta))
                 claimed.add(id);
     }
-    const proposed = await parseSpecs(scan.proposedSpecFiles, root);
+    const { plan: proposed, issues: unreadable } = await parseSpecs(scan.proposedSpecFiles, root);
+    issues.push(...unreadable);
+    // A file that would not parse declares no scenarios, so the loop below would
+    // find it claimed by nothing and call it unclaimed — a true sentence about a
+    // file whose real problem is that it could not be read, and a fix hint
+    // pointing at work that must not be done. Same shape as `orphan-test` after a
+    // registry fails to load (ATX-62), and refused here for the same reason.
+    const unreadableFiles = new Set(unreadable.map((i) => i.file));
     const claimedFiles = new Set(proposed.scenarios.filter((s) => claimed.has(s.reqId)).map((s) => s.file));
     // Reported per file, not per scenario: the file is the unit a run includes,
     // so it is the unit that did or did not execute, and one line per scenario
@@ -230,7 +241,7 @@ async function unclaimedProposedSpecIssues(root, scan, options, loader) {
     // nothing for a second reason, and reading the plan alone cannot see it.
     for (const abs of scan.proposedSpecFiles) {
         const file = relativePath(root, abs);
-        if (claimedFiles.has(file))
+        if (claimedFiles.has(file) || unreadableFiles.has(file))
             continue;
         issues.push({
             level: 'ERROR',
@@ -287,7 +298,9 @@ export async function runVerify(root, options = {}) {
         registry = loaded.registry;
         issues.push(...loaded.issues);
         unreadableFiles = loaded.unreadableFiles;
-        plan = await parseSpecs(scan.specFiles, root);
+        const parsedSpecs = await parseSpecs(scan.specFiles, root);
+        plan = parsedSpecs.plan;
+        issues.push(...parsedSpecs.issues);
     }
     finally {
         await loader.close();
@@ -365,7 +378,7 @@ export async function runCover(root, options = {}) {
     const { registry, issues: loadIssues } = await readRegistry(root, options, scan.reqsFiles);
     if (hasError(loadIssues))
         return { rows: [], issues: loadIssues };
-    const plan = await parseSpecs(scan.specFiles, root);
+    const { plan, issues: unreadableSpecs } = await parseSpecs(scan.specFiles, root);
     const counts = new Map();
     for (const s of plan.scenarios) {
         counts.set(s.reqId, (counts.get(s.reqId) ?? 0) + 1);
@@ -381,7 +394,7 @@ export async function runCover(root, options = {}) {
         covered: (counts.get(reqId) ?? 0) > 0,
         scenarioCount: counts.get(reqId) ?? 0,
     }));
-    return { rows, issues: [...loadIssues, ...uncoveredIssues(registry, plan)] };
+    return { rows, issues: [...loadIssues, ...unreadableSpecs, ...uncoveredIssues(registry, plan)] };
 }
 /**
  * Markdown projection of the intent layer (design §9: `attest render`).
@@ -607,10 +620,15 @@ function claimedByDelta(proposed, delta) {
  * walking the tree again, so a caller that already scanned does not repeat it.
  */
 async function changeMergedPlan(root, delta, scan) {
-    const basePlan = await parseSpecs(scan.specFiles, root);
-    const proposed = await parseSpecs(scan.proposedSpecFiles, root);
-    const claimed = claimedByDelta(proposed, delta);
+    const base = await parseSpecs(scan.specFiles, root);
+    const proposedSpecs = await parseSpecs(scan.proposedSpecFiles, root);
+    const basePlan = base.plan;
+    const claimed = claimedByDelta(proposedSpecs.plan, delta);
     return {
+        // A spec neither parse could read blocks the gate rather than vanishing
+        // from it: an unreadable proposed spec is a scenario the gate would
+        // otherwise report as absent (ATX-65).
+        issues: [...base.issues, ...proposedSpecs.issues],
         merged: {
             scenarios: [...basePlan.scenarios, ...claimed.scenarios],
             paramRefs: [...basePlan.paramRefs, ...claimed.paramRefs],
@@ -722,7 +740,12 @@ async function archiveRun(root, changeName, options = {}) {
         // Static plan = merged base suite + this change's specs (design §8), by the
         // same function `status` reports against — a progress report computed over a
         // different spec set than the gate uses would be a report about nothing.
-        const { merged: plan, claimed } = await changeMergedPlan(root, delta, scan);
+        const { merged: plan, claimed, issues: unreadableSpecs } = await changeMergedPlan(root, delta, scan);
+        // Before the run, not after: an unreadable spec means the gate cannot see
+        // what that file declared, so letting the suite start would grade the
+        // change against a plan known to be short (ATX-65).
+        if (unreadableSpecs.length > 0)
+            return { issues: unreadableSpecs };
         // Other proposals need no exclude glob of their own: the include list below
         // is the plan's own files, and the plan holds only the proposed specs this
         // delta claims. That is what replaced `**/changes/<sibling>/**` — with the

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@am_shork/attest",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "TDD-native spec framework: tests are the source of truth for verification, ID-bound requirements the source of truth for intent.",
   "type": "module",
+  "packageManager": "pnpm@10.28.0",
   "engines": {
     "node": ">=20.19"
   },
@@ -36,6 +37,24 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "clean": "node -e \"require('fs').rmSync('dist', {recursive: true, force: true})\"",
+    "build": "pnpm run clean && tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck:all": "tsc -p tsconfig.typecheck.json",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:consumer": "pnpm run build && vitest run --config vitest.consumer.config.ts",
+    "lint": "eslint .",
+    "prepack": "pnpm run build",
+    "prepublishOnly": "pnpm run test:consumer",
+    "attest": "node bin/attest.js",
+    "check:self": "node bin/attest.js check self",
+    "verify:self": "node bin/attest.js verify self",
+    "cover:self": "node bin/attest.js cover self",
+    "render:self": "node bin/attest.js render self --out self/requirements/SPEC.md",
+    "render:self:check": "node bin/attest.js render self --out self/requirements/SPEC.md --check"
+  },
   "keywords": [
     "tdd",
     "spec",
@@ -62,20 +81,13 @@
     "vite": "^8.1.5",
     "vitest": "^4.1.10"
   },
-  "scripts": {
-    "clean": "node -e \"require('fs').rmSync('dist', {recursive: true, force: true})\"",
-    "build": "pnpm run clean && tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "typecheck:all": "tsc -p tsconfig.typecheck.json",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:consumer": "pnpm run build && vitest run --config vitest.consumer.config.ts",
-    "lint": "eslint .",
-    "attest": "node bin/attest.js",
-    "check:self": "node bin/attest.js check self",
-    "verify:self": "node bin/attest.js verify self",
-    "cover:self": "node bin/attest.js cover self",
-    "render:self": "node bin/attest.js render self --out self/requirements/SPEC.md",
-    "render:self:check": "node bin/attest.js render self --out self/requirements/SPEC.md --check"
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "esbuild"
+    ],
+    "overrides": {
+      "brace-expansion@<5.0.9": ">=5.0.9",
+      "js-yaml@<4.3.1": ">=4.3.1"
+    }
   }
-}
+}