@am_shork/attest 0.7.1 → 0.7.3

package/CHANGELOG.md

@@ -13,6 +13,485 @@ input, removes/renames a public API or `--json` field, or changes a default
 runtime behavior an existing invocation relies on — diagnostic message text is
 not API.
 
+## [0.7.3] - 2026-08-07
+
+### Fixed
+
+- **A loader that never opened left its scratch directory behind — one per
+  `attest` invocation, i.e. one per CI build.** `createLoader` creates the
+  directory and writes the stub, and the only `rm` of it lives inside the `close`
+  of the object it returns — so nothing between those two points can be cleaned
+  up by anyone, because until the caller holds that object no `close` exists to
+  call. It is the exact leak the comment on `close` records as already fixed,
+  surviving on the other side of the same function. The window is now closed by
+  the function that opened it.
+  *Stated over the window rather than over `createServer`, which is where it was
+  found.* `writeFileSync` is inside it too, and a full disk or a temp directory
+  that turns read-only between the two calls reaches it with no project
+  involved — so scoping the repair to the call it was noticed at would have left
+  half of it.
+  *The trigger this was filed on does not reproduce, and that is the useful
+  half.* The entry proposed a malformed `package.json` at the root, on the
+  reasoning that `configFile: false` still leaves Vite reading it for `type`.
+  Measured: it starts a server cleanly, as do eight other shapes — a
+  `package.json` holding an array, one that is a directory, an unknown `type`, a
+  `node_modules` occupied by a file, a `node_modules/.vite` occupied by a file, a
+  `.env` that is a directory, a deleted root, and a well-formed control. Nine
+  candidates, zero throws. **`configFile: false` is why**, and it is worth
+  recording as a property rather than an accident: the option set chosen to stop
+  the loader reading a project's Vite config, and to stop it opening a socket,
+  also leaves almost no project I/O that can fail hard. The throw surface was
+  closed as a side effect of decisions taken for other reasons.
+  *So the repair is justified by ownership rather than by a symptom*, which is a
+  weaker case than this file usually accepts and is why the alternative was to
+  reject the entry outright. What decides it is the asymmetry of cost: the fan-out
+  entry below stays open because bounding concurrency changes how every run
+  behaves, whereas a `try` around a window nothing currently reaches changes
+  nothing observable on any path that exists. A resource whose ownership transfer
+  is conditional on nothing throwing is a shape, and the shape is what recurs.
+  *A cleanup that fails must not replace the error that caused it*, so the `rm`
+  swallows its own failure and the original throw propagates unchanged. The
+  regression test asserts the identity of what comes out, not its wording.
+  **`close` had the same hazard and now makes the same choice, which is a change
+  to an existing path rather than a new one.** Its `rm` runs in a `finally`, so a
+  failed cleanup replaced whatever `close` was doing — and all five callers in
+  `pipeline.ts` call `close` from a `finally` of their own, where the damage is
+  larger than symmetry: a real error on the way out is lost, and a *successful*
+  command becomes a crash about a temp directory. What that reader is handed is a
+  misdiagnosis pointing at their own correct files, which this project already
+  treats as worse than the gap it fills — the argument `ATX-49` records against
+  reporting a load failure as a wall of skipped scenarios, in a much smaller
+  place. Given up with it: the one signal a failed cleanup could have raised,
+  which no caller could have acted on.
+  *The test goes red without the fix, which is the only reason it is worth
+  having.* Verified by reverting `src/` and re-running: `expected [
+  'attest-loader-z7jhoK' ] to deeply equal []`, the leaked directory named in the
+  failure. It injects the throw at the module boundary — no project input could
+  produce one — and mocks `tmpdir` to a directory of its own, because on the
+  throwing path there is no loader to ask for its `scratchDir` and counting
+  `attest-loader-*` in the shared temp directory is the flake the lifecycle test
+  beside it already documents.
+  *It is its own file*, which is a rule this repo already wrote down and which
+  the first draft broke: `tests/locate-fanout.spec.ts` is separate because
+  `vi.mock` is file-scoped and it mocks a Node builtin, and the four lifecycle
+  tests boot the *real* Vite loader — sharing a module registry with a
+  `createServer` that throws is exactly what that convention exists to prevent.
+  The first attempt scoped the mocks with `doMock` and `resetModules` inside the
+  shared file instead, which is machinery bought to work around a constraint the
+  repo had already decided how to solve. Following it deleted the machinery.
+  *No new requirement, and the precedent cuts the other way, so it is worth
+  saying why.* `ATX-36` is the sibling property — what a live loader leaves on the
+  user's machine, stated as a count, with a scenario in `self/` — and "leaves no
+  scratch directory" is the same shape. What decides against filing one here is
+  that the success-path half has never had a requirement either, so a new one
+  covering only the throwing path would state half a contract and cost a
+  permanent scenario for the half nothing reaches. If it is ever filed it should
+  be filed whole, and that is a larger change than this fix.
+
+- **The `cmd.exe` guard in `tests/consumer.spec.ts` checked one character of a
+  class, and the comment above it claimed the quoting was doing work it cannot
+  do here.** `shellArg` asserted the argument held no `"` and then quoted only
+  when it held whitespace, so an argument with neither went to the shell bare
+  with `&`, `|`, `^`, `<`, `>`, `(` unexamined. Measured against the twelve
+  shapes: the old assertion let **11 of 12** through.
+  *What decided it, and it is the thing the entry this replaces did not have.*
+  That entry framed the choice as "widen the class, or fix the prose", and
+  argued that widening while leaving the prose is the change that looks like a
+  fix and settles nothing. Both halves turn on a fact neither named: **every
+  command this suite spawns is a `.cmd`**, which is the whole reason
+  `NEEDS_SHELL` exists, and a batch file expands `%*` into its own line *before*
+  anything parses it — so a metacharacter survives double quotes and is acted on
+  at the far end. That is the argument-injection hole Node closed in 22.x,
+  arrived at the long way round. So the quoting is not a defence that the
+  assertion merely backstops; **the assertion is the only defence**, and a
+  defence that covers one character of its class is the defect rather than the
+  prose being generous. Both are fixed together: the class is named, and the
+  comment now says the quotes do whitespace and nothing else.
+  *`%` and `!` are in the class for a different reason* — expansion rather than
+  syntax, and `!` only under delayed expansion, which the spawned shell does not
+  enable but a batch file can enable for itself. Neither costs anything to
+  refuse.
+  *The cost, which is real and is the right cost.* Windows permits `&`, `(` and
+  `%` in a user name, and `os.tmpdir()` sits under it — so on such a machine this
+  suite now stops with *"argument would need escaping, not quoting"* instead of
+  running. That is correct rather than a false red: through a batch target those
+  arguments genuinely are not safe, and the invariant the assertion guards is
+  that every argument is a literal flag or a path from `mkdtemp`. Stopping is
+  right even where quoting would have survived it, because the value is then not
+  the kind of value the helper accepts.
+  *What is measured, and what is not.* `pnpm test:consumer` was run on Windows,
+  where `NEEDS_SHELL` is true and the changed path actually executes: 11 tests
+  passed, none skipped — the distinction that matters, since the failure this
+  file's own comment records reported ten tests as *skipped* at zero run. CI is
+  Linux, where `shellArg` returns before the assertion, so the pipeline says
+  nothing about this either way. Not measured end to end: an argument carrying a
+  metacharacter actually reaching the guard, because no call site can produce
+  one — the class is verified as a predicate over the twelve shapes above and
+  the sixteen arguments the suite really passes, not by driving the suite red.
+
+- **A statement or rationale can no longer become HTML, or open a section of
+  its own.** `sanitised` is the entry §9.1 names and it strips control
+  characters and nothing else, so `statement` and `rationale` reached the
+  Markdown by concatenation exactly as written. Measured: a `rationale`
+  containing a newline and `## ATX-999` rendered a whole section — heading,
+  statement, `**Why:**` — for a requirement no registry holds, sitting between
+  two real ones and worded identically, with the overview table above it listing
+  three ids and the body carrying four sections. `<script>` and `<img onerror>`
+  survived the same way into a file that is committed and served. `check` and
+  `cover` saw nothing, because the id is in no registry, and `render --check`
+  could not object, because that *was* what the registry rendered to.
+  *Which of the three is intended, which is the part the fix had to decide.*
+  Marking prose up stays — `plain` escapes a param value precisely because the
+  value is data and the sentence around it is not — and that decision had never
+  been separated from allowing raw HTML or a heading. It is now a **fifth
+  obligation in design §9.1** rather than a patch at an emitter: prose may be
+  marked up, it may not become a tag, and it may not open a section. Stated as a
+  count over the document — one heading per requirement id — because what a
+  reader trusts is that a section means a requirement (`ATX-67`).
+  *Escaped rather than refused, on an asymmetry.* A rule that misses something
+  ships the document it ships today; a rule that fires wrongly makes a
+  legitimate rationale a hard error in the one command whose value is that it
+  always produces the document — the `ATX-29` argument about `--check` seen from
+  the other side. So there is no new diagnostic and no exit code moves.
+  *And escaped for the position, which is what keeps it lossless.* A code span
+  is literal text in every renderer, so `&lt;` written inside one is **visible**
+  — Markdown does not decode entities there, and this repository documents
+  `attest status <change>` in a statement. The scan therefore tracks spans and
+  leaves their contents alone, conservatively: a backtick run opens a span only
+  if a run of exactly that length closes it, and an unmatched run is text with
+  the defence still applied after it.
+  *One rendering change beyond the fix, and it is a repair.* A param
+  substituted inside the author's own code span was emitted as `**value**`,
+  which in a code span is two asterisks around the value; knowing the position
+  is what removes them. `SPEC.md` in this repository moves by 12 lines, all of
+  that shape — `` `**changes/<name>/first-run.json**` `` becomes
+  `` `changes/<name>/first-run.json` `` — and no `&lt;` appears anywhere in it,
+  which is the measurement that the span exception works on real prose.
+  *The defence had the defect it was written next to, and `ATX-59` gained a
+  third shape because of it.* The first code-span scan searched forward from
+  each backtick run for a run of the same length, so a rationale whose runs are
+  all of *different* lengths paid a scan to the end of the string for every one
+  of them: 500 KB cost 1.6 s and 2 MB cost 15 s, from `attest render` with no
+  flag, on text the registry chooses — the same "a registry must not decide what
+  rendering costs" defect the padded statement and the backtick-run param
+  already stand for. The runs are now read once and indexed by length, each
+  length holding a forward-only cursor, which is linear: 40 ms at 2 MB. It is
+  filed under `ATX-59` rather than here because the obligation is that one, and
+  it is worth saying where the site came from — the *defence another requirement
+  added*, which is the direction the next one will arrive from too.
+  *This leaves `Planned`.* The forged section was reproduced first, then the
+  four scenarios were run against the pre-fix renderer: three went red, and the
+  fourth — the setext underline, which heads the line *above* it — went green,
+  because counting `##` lines cannot see a heading that has no `##` in it. That
+  scenario was rewritten to assert the neutralised underline instead. A scenario
+  that cannot fail is the defect `archive` exists to catch, and it was caught
+  here only by running it against the old code.
+
+- **`attest init` no longer follows a symbolic link out of the project, and
+  refuses the whole run when a destination leads there.** `runInit` did
+  `join(root, target.file)`, `mkdir -p` and then the write, and nothing asked
+  whether the path was still under `root` once the filesystem had had its say.
+  A `.claude/skills/attest` planted in a repository as a link to anywhere the
+  user can write was followed by both: measured on Windows with a junction, a
+  file at the far end holding `USER OWNED FILE - DO NOT OVERWRITE` came back
+  holding the skill, and the report printed the relative path, so nothing on
+  screen said where it had gone. Every destination is now resolved segment by
+  segment before the first byte of any of them is written, and one that escapes
+  is an `unsafe-target-path` ERROR that writes nothing at all (`ATX-66`).
+  *What the exposure was, stated precisely, because two nearby things are not
+  it.* `writeAtomic`'s exclusive creation is not the gap and was never scoped to
+  be one: it defends the *temporary* path against a planted link, and it does
+  that perfectly in whichever directory the destination turns out to be. And
+  `workflowBody()` is a pure function of nothing, so no byte of the checked
+  project reaches the file — there is nothing to exfiltrate. What was exposed is
+  the **path**, which is `targets.ts`'s first scoping rule ("Attest owns the
+  path") having been an assumption rather than a check.
+  *Why the check is a resolution rather than a comparison.* `join` normalises
+  `..`, so a lexical containment test was already satisfied — the escape is a
+  segment that *is* a link, which only `realpath` can see. Containment itself
+  goes through `isInside` in `src/core/paths.ts`, asked as a relative path
+  rather than a string prefix: `/repo-backup` starts with `/repo`, and on
+  Windows a path on another drive has no relative spelling at all, so
+  `path.relative` answers with an absolute one instead of a chain of `..`. Both
+  read as contained under `startsWith`.
+  *The limit, recorded rather than papered over.* A link planted between the
+  resolution and the write is not caught, and no check outside the filesystem
+  can catch it. The exposure this closes is one committed to a repository, which
+  is the one a fresh clone and every merge-request checkout hands you.
+  *Behaviour change:* an `init` that used to write through such a link now
+  fails with exit 1. The only input that reaches it is a path that was already
+  leaving the project. The JSON surface is unchanged beyond one more `code`
+  value, which is additive — no `SCHEMA_VERSION` bump.
+  *This leaves `Planned`*, where it was filed with the measurement above; the
+  first act of building it was re-running that measurement, and it reproduced.
+
+### Changed
+
+- **The guidance now draws the line between a literal that is drift and a literal
+  that is a pin — the shipped text forbade the only defence against a shortened
+  domain.** `[0.7.2]` fixed the repo half: every param a scenario iterates gained
+  a literal pinning its extent, after three of that release's four green
+  mutations turned out to be a domain silently losing cases rather than the
+  tautology the experiment was looking for. The user-facing half was held back,
+  and it was not merely absent. The `init` skill's "Four things you must not do"
+  says **"Do not hardcode a value that lives in `params`"**, and the pin every one
+  of those fixes adds is, read literally, exactly that. An adopter who writes a
+  roster param — which the design actively pushes them toward, since a quantifier
+  a scenario can iterate is the shape `QUANTIFIED` recommends — was being handed
+  an instruction that forbids the only thing standing between them and a run that
+  covers less every time someone edits the list.
+  *The distinction is real and one sentence long*, and it is now drawn in all four
+  places the claim is made: the rule is about the **expectation** the system is
+  measured against, and the pin asserts what the **intent** is. A list a scenario
+  loops over is not a value under test — it is the set of cases the run covers,
+  so dropping a member removes a case while every assertion inside still passes,
+  with the expectation as independent as it ever was. That is why the `[0.5.0]`
+  rule (*the expectation must not be a function of the param the code under test
+  consumed*) does not reach it, and why a literal is the **only** independent term
+  available: anything derived from the list shrinks with it, so a length assertion
+  written as a function of the list is true at every length.
+  *Where it landed, and why it is four documents rather than one line appended.*
+  README §"killer move", the `init` skill (a sibling bullet in the model section
+  and a carve-out inside rule 3 itself, where the contradiction was), the
+  `possible-drift` troubleshooting section with a worked ✓/✗ pair, and design §11
+  as a residual weakness beside the tautology bullet it shares a gap with — both
+  languages. `[0.5.0]` records the reason this shape of change is done in one
+  deliberate pass rather than incrementally: it is the central claim of the tool
+  being reworded, and the last time it was split the halves disagreed.
+  *No engine change, and none is proposed here.* Nothing in this is detectable —
+  which surface a statement claims is prose judgement, the same judgement §11
+  already records as the reason obligation counting can never be an engine rule.
+  The counter-pressure that exists is a hand-judged table, and §11 now says so,
+  including what it cannot reach: a domain whose size is carried by a scalar.
+  *This leaves `Planned`*, where it was filed with the measurement above; the
+  measurement was already taken, and what it needed was the pass.
+
+- **The release publishes through `pnpm` again, and the check that read the
+  attestation back is gone.** Two corrections to the provenance job shipped in
+  `[0.7.2]`, both from what the first real tag pipeline showed.
+  *`pnpm publish --provenance` works on the pinned 10.28.0; the claim that it
+  did not was read off `pnpm publish --help`, where the flag is absent.* The
+  parser knows it — `--provenanceX` is rejected with *"Did you mean
+  'provenance'?"*, and `--provenance --dry-run` runs clean. A help text is a
+  document, not the interface; checking a flag means asking the parser. So the
+  job is pnpm like every other job here, `--no-git-checks` comes back with it
+  (pnpm inspects the branch, CI builds tags in detached HEAD), and
+  `COREPACK_ENABLE_STRICT=0` goes away, since it existed only so a bare `npm`
+  could run under a `packageManager` that pins pnpm.
+  *The post-publish check failed the 0.7.2 release, and the publish it failed
+  was correctly signed.* Six attempts over a minute all got a 404 from the
+  registry's attestation endpoint; the same endpoint now serves
+  `slsa.dev/provenance/v0.2` for `0.7.2`. Lengthening the budget was the wrong
+  repair, and the entry it replaces already contains the reason without drawing
+  the conclusion: the check runs *after* an irreversible step, so its red cannot
+  be cleared — the republish that would rerun it fails `EPUBLISHCONFLICT` on a
+  version that now exists. Every failure it can reach is therefore either a
+  false one or an unfixable one, on a job nobody can make green again, which
+  makes it a machine for teaching that red is routine — the exact habit the
+  `audit` job's comment refuses. A gate has to sit where the answer can still
+  change what happens. Verification moves to where it can: `npm audit
+  signatures` in an installing project, or the package page's Provenance panel.
+  *What is unchanged:* the attestation itself, the three preconditions, and the
+  fact that npm rejects the publish rather than degrading to an unsigned one if
+  any is missing. `0.7.2` is signed, and shipped signed, despite the red job.
+
+## [0.7.2] - 2026-08-07
+
+### Added
+
+- **Releases carry a provenance attestation, and the publish job proves it was
+  served rather than trusting its own exit code.** `npm publish --provenance`
+  exchanges a GitLab OIDC token for a Sigstore certificate and records, in the
+  public transparency log, that this tarball was built by this pipeline from
+  this commit — checkable by anyone with `npm audit signatures` or the package
+  page, without trusting us. Nothing about the package's *contents* changes:
+  same `files`, same tarball, same `prepack`/`prepublishOnly` gate.
+  *It is `npm` in a repository whose every other job is `pnpm`, and that is not
+  drift.* pnpm's publish has no provenance support at all — checked against the
+  pinned 10.28.0, there is no such flag — so the choice was npm for this one
+  command or no attestation. Two consequences worth writing down. `--no-git-checks`
+  disappears with it: that was a pnpm flag, needed only because pnpm inspects
+  the branch and CI builds tags in detached HEAD. And `COREPACK_ENABLE_STRICT=0`
+  is now required to call `npm` at all — `corepack enable` shims npm too, and
+  `packageManager` pins pnpm, so a bare `npm` aborts with "this project is
+  configured to use pnpm". Job-local rather than narrowing the shim in `.base`,
+  because every other job wants exactly that strictness.
+  *The check after the publish, and the one that looked right and was worthless.*
+  The obvious step is `npm audit signatures`, and here it would have been
+  decoration of precisely the kind the `audit` job's comment refuses: run in this
+  repository it audits *our own installed dependency tree*, which never contains
+  `@am_shork/attest` — green while attesting nothing. What runs instead reads the
+  registry's attestation endpoint for the version just published and fails unless
+  a `slsa.dev/provenance/` predicate is actually there. That is the consumer's
+  view, and it is what separates "npm accepted the tarball" from "the statement
+  is served". It retries for propagation, because it runs *after* an
+  irreversible step: the publish has happened, and a rerun cannot clear a red
+  since the republish fails `EPUBLISHCONFLICT` on a version that now exists — so
+  a registry that had not caught up would pin the release job red with nothing
+  wrong. A served response missing the predicate fails immediately; that answer
+  will not change. Both paths were run against the live registry — green on a
+  package known to carry provenance, red on `0.7.1`, which does not.
+  *Three preconditions, and npm rejects the publish rather than quietly shipping
+  unsigned if any is missing.* An `id_tokens` audience of exactly `sigstore`; a
+  `repository.url` matching `CI_PROJECT_URL`, so a repository rename fails here
+  first; and a public package on registry.npmjs.org, which
+  `publishConfig.access=public` already settles. The token is still an npm
+  automation token — the OIDC exchange signs the release, it does not authorise
+  it (see *Under consideration*).
+  *What is unmeasured, stated rather than implied.* There is no dry run for
+  provenance — `--dry-run` mints no token exchange — so none of this has executed
+  against a real tag pipeline. The next release is its first run. The commit SHA,
+  tag, pipeline URL and repository path become public record; all four are
+  already public here.
+
+### Fixed
+
+- **One unreadable file took the whole of `check` down with it.** A `params`
+  value nested 20,000 deep exhausts the call stack inside `ts.createSourceFile`
+  — TypeScript's own recursive-descent parser, so `literalValue`'s recursion is
+  never reached and hardening it would have changed nothing. Measured: `attest
+  check` answered a single `internal-error`, exit 1. It failed *closed*, which
+  is why this is a repair and not an emergency — but `check` is the command this
+  project tells people to run first, in a pipeline, on a merge request whose
+  contents they do not control, and one file an attacker owns could reduce the
+  entire report to that one line, permanently. Breadth is what `check` trades
+  for running no project code; a report of one crash is not a degraded `check`,
+  it is a different command.
+  Now a file that cannot be parsed is reported as **`unreadable-file`** and
+  skipped, and everything else in the run is still reported.
+  *Two sites, and a guard on one of them fixes nothing.* `static-registry.ts`
+  and `parser.ts` both open with the same call, so the spec parse takes it too —
+  measured separately, and a registry-only guard leaves `attest check` dying on
+  a hostile `*.spec.ts` exactly as before. The registry half sits at the loop
+  that reads the files rather than inside either reader, because what is being
+  kept is a property of the *run* — one file's failure is not the run's failure
+  — and both readers need it; `readRegistry` folds them with `Promise.all`,
+  where one rejection ends the command.
+  *Its own code, not `registry-invalid`.* A file that blew the parser's stack
+  did not fail schema validation, and a diagnostic saying it did sends the
+  reader to the wrong page. The archive gate refuses to run at all when a spec
+  is unreadable, rather than grading a change against a plan known to be short.
+  *A third read site turned up while reading the diff, and it was answering
+  wrongly rather than crashing.* An unreadable **proposed** spec declares no
+  scenarios, so the unclaimed check found it claimed by nothing and reported
+  `proposed-spec-unclaimed` — a true sentence about a file whose actual problem
+  is that it could not be read, and a fix hint pointing at work that must not be
+  done. That is the shape `[0.7.0]` fixed for `orphan-test` after a registry
+  fails to load, arriving again at a different site. It now reports
+  `unreadable-file` and stands down.
+  `parseSpecs` now returns its issues alongside the plan; `parseAllSpecFiles`
+  was deleted in passing, having had no callers.
+  **No `SCHEMA_VERSION` bump.** A new `code` value is additive to the `--json`
+  envelope, and a consumer that branches on codes it knows is unaffected — the
+  rule this project already applies to every new diagnostic.
+
+- **`attest status` printed one line the sanitiser never saw.** The `Change:`
+  header was built and printed in the CLI shell, three lines above a closing
+  line that put the same value through `inline()` — so a change name holding
+  control characters repainted the terminal from the header while the footer was
+  clean. A change name is a directory name in the repository under test, and the
+  workflow `init` writes tells an agent to run `attest status <name>`.
+  The header moved into `formatStatus`, which is a fix rather than a tidy-up: a
+  write that lives in `cli/index.ts` cannot be attested at all, because that
+  module runs the CLI at import — so the site was not merely unsanitised, it was
+  unreachable by any scenario. `ATX-37`'s site list gained the kind that had
+  been missing from it, **a write in the shell**, and the two `--out` echoes are
+  the remainder: sanitised now, and still carried as unattested, because the
+  trigger needs a filename holding a control character — which NTFS refuses and
+  Linux permits, so that half is unmeasured here.
+
+- **A param that is a scenario's *domain* could be shortened, and the run just
+  covered less.** Nothing in this repo executes here — it is the self-registry
+  and its measurement suite — but three of the holes were real, and one of them
+  was a security check. Found by re-measuring the tautology entry below after
+  `[0.7.1]`: twelve mutations of this registry, each followed by the whole gate.
+  Four went green, and three of those were **not** the tautology that experiment
+  was looking for. When a scenario loops over a list it read from `params`, that
+  list is the set of cases the run covers, so removing a member removes a case
+  and every assertion inside the loop still passes over what is left. The
+  expectation stays perfectly independent; what moved is the quantifier's
+  domain, which is why the rule shipped in `[0.5.0]` — *the expectation must not
+  be a function of the param the code under test consumed* — does not cover it.
+  What each one cost, measured: dropping `../../evil` from `ATX-13.rejectedNames`
+  stopped testing the change-name guard against path traversal; `ATX-40.languages: 1`
+  stopped checking `docs/zh/troubleshooting.md` **entirely**, which is the
+  mirror rule `CLAUDE.md` calls mandatory losing its only gate; and
+  `ATX-64.childRunCommands: ['verify']` stopped checking `archive` for the
+  stdout hole `ATX-64` exists to close — filed in the same release, three
+  scenarios deep, and silent.
+  *The repo had already invented the defence and not named it.* `ATX-16` asserts
+  its list against a literal and its comment says why — "so the spec cannot
+  quietly cover fewer of them than the intent promises" — and it was one of the
+  two lists that went red. A literal is the only independent term available when
+  what is at risk is the **size** of the set rather than a value in it, which is
+  also why this reads as a violation of "do not hardcode a value that lives in
+  `params`" and is not one: the pin asserts what the intent *is*, not what the
+  system does.
+  Every iterated list now carries that line. `ATX-40` needed both halves and
+  that is the instructive one: `toHaveLength(languages)` already caught the
+  count going *up* without a document, and could never catch it going down,
+  because the slice shrinks with it and the assertion stays true.
+  *The counter-pressure, and one thing it cannot reach.* A `DOMAINS` table in
+  `tests/intent-rule-candidates.spec.ts` now judges every list-valued param as
+  `iterated` or `inert`, with completeness swept from the registry so a new list
+  fails until someone decides, and each `iterated` row naming the pin that
+  guards it. The `QUANTIFIED` taxonomy gained the distinction this turned on:
+  a `roster` owned by the **code** grows with the code and is safe by
+  construction, a roster owned by the **registry** is data an author can shorten
+  — `ATX-64` was filed as the former and was the latter. What the sweep does not
+  reach is `ATX-40`, whose domain size is a *scalar*; it is judged by hand, and
+  a future scalar used that way would not be forced into the table by anything.
+  *The rot check needed a second attempt, which is worth recording.* Written
+  first as "the pin appears somewhere in `self/`", it passed with `ATX-64`'s pin
+  deleted — two requirements pin a list read into a local named `commands`, and
+  the grep matched the other one. It asserts **exactly one** match now. A check
+  satisfiable by an unrelated line is the failure it exists to prevent.
+
+- **A project under test could put its own verdict on stdout ahead of Attest's,
+  under `--json`.** `runAndCollect` starts Vitest with the parent's fd 1 in
+  play, and `quiet: true` does not close it: `silent: true` suppresses Vitest's
+  *console interception*, and a bare `process.stdout.write` in a spec never
+  enters it — measured at collection time and inside a scenario body, both. So
+  a spec writing `{"ok":true,…}` put that document **first** on the stream: a
+  consumer calling `JSON.parse` on the whole of stdout got a parse error at
+  position 46, and one reading line-wise or taking the first object got the
+  attacker's verdict instead of the report. `check`, `cover`, `render` and
+  `status` were never exposed — no Attest code was on the path at all, which is
+  precisely why `core/terminal.ts` and `sanitisedLogger` did not help.
+  *Why this is worse than the terminal half of the same hole.* Repainting a
+  terminal — `ESC[2K CR`, a forged `ERROR` header at column 0, an `OSC 0` window
+  retitle, all of which also arrive intact — is not a capability `verify`
+  lacked, because it executes project code by design. Forging the *machine*
+  verdict is different in kind: it inverts what the report is for, since the
+  commands carrying the risk are exactly the ones that run the repository being
+  gated. §9.1 recorded the machine surface as never exposed because
+  `JSON.stringify` escapes every C0 character — true, and about the bytes Attest
+  writes; it says nothing about bytes Attest does not write.
+  Under `--json`, stdout is now diverted to stderr for the duration of the
+  command and released before the report is rendered. Diverted rather than
+  dropped: a human debugging a red pipeline still needs the run output, and
+  stderr is the stream no consumer parses. Without `--json` nothing changes —
+  the promise is the flag's, and diverting unconditionally would take the child
+  run's output away from the reader it exists for.
+  *The fix is `runAction`'s, not `runner.ts`'s* — the same argument that put
+  `formatCrash` in `cli/report.ts` rather than a copy in each `catch`.
+  `runAction` is already the single convergence point for one output and one
+  exit code; `runner.ts` would have been made to hold a contract it does not
+  own. It moved to **`src/cli/action.ts`** to be testable at all: `cli/index.ts`
+  calls `program.parseAsync()` at import time, so importing it to cross the seam
+  would run the CLI. No behaviour of `index.ts` moved with it.
+  *What the regression test had to be, because the first one was wrong.* The
+  scenarios under **`ATX-64`** spawn the real CLI and read its pipes. The
+  in-process version looks equivalent and is not: they run inside a Vitest
+  worker, which patches `console` and re-routes worker output, so intercepting
+  `process.stdout.write` there observed neither the report nor the pollution and
+  went green against the unfixed code for three of three scenarios. What the
+  requirement is about is the bytes on the pipe, and only a real pipe has them.
+  The statement names its commands in `params` rather than quantifying over
+  "every command that executes project code" — a `roster` row rather than a
+  `sites` one, so a third such command cannot join without joining the
+  assertion.
+
 ## [0.7.1] - 2026-08-05
 
 ### Added
@@ -3196,99 +3675,6 @@ no symptom is the definition of what a gate cannot see.
   `[0.4.3]` — that the gate and the run proving the fixture still works live in
   different suites — applies here identically.
 
-- **The child run's stdout is not Attest's, and `--json` promises it is.**
-  `runAndCollect` starts Vitest with the parent's fd 1 inherited, so a spec file
-  in the project under test writes straight to the same stream the report goes
-  to. `quiet: true` does not close it: `silent: true` suppresses Vitest's
-  *console interception*, and a bare `process.stdout.write` in a spec — at
-  collection time or inside a scenario body, both measured — goes past it
-  untouched. Neither `core/terminal.ts` nor `sanitisedLogger` is on that path at
-  all, because no Attest code is.
-  *The machine surface is the half that is actually new.* `cli/index.ts` opens
-  by stating that under `--json` "the only thing written to stdout is one
-  machine-readable report", and §9.1 records that this path "was never exposed —
-  `JSON.stringify` escapes every C0 character". Both hold for `check`, `cover`,
-  `render` and `status`, and neither holds for `verify` or `archive`: measured,
-  a spec writing `{"ok":true,"POLLUTION":"…"}` puts that document **first** on
-  stdout, ahead of the real report, so `JSON.parse` of the whole stream fails
-  (position 46) while anything reading line-wise or taking the first object
-  reads the attacker's verdict. The terminal half is the same hole and the
-  smaller finding — `ESC[2K CR` plus a forged `ERROR` header at column 0 and an
-  `OSC 0` window retitle all arrive intact — but `verify` executes project code
-  by design, so repainting a terminal is not a capability that path lacked.
-  *The fix belongs to `runAction`, not to `runner.ts`.* That function is already
-  the single convergence point for "one output, one exit code", which is the
-  same argument that put `formatCrash` in `cli/report.ts` rather than leaving a
-  copy in each `catch`: `runner.ts` would be made to hold a contract it does not
-  own, while `runAction` is the only place the promise is made.
-
-- **`render`'s document can carry raw HTML and a forged requirement section.**
-  `sanitised` is the entry §9.1 names and it strips control characters and
-  nothing else, so `statement` and `rationale` reach the Markdown by
-  concatenation exactly as written. Measured: a `rationale` containing newlines
-  and `## ATX-999` renders a whole section — heading, statement, `**Why:**` —
-  for a requirement no registry holds, sitting between two real ones and worded
-  identically; `<script>` and `<img onerror>` survive the same way. `check` and
-  `cover` see only the real id, and `render --check` cannot object, because that
-  *is* what the registry renders to now.
-  *Not an accepted risk, which is the part worth pinning.* §9.1 and the
-  reference both scope their guarantee to control characters, and the
-  reference's heading over that paragraph is "Safe to read, and safe to keep",
-  with "a site generator" named in the threat it describes. What *is* a decision
-  is that prose may be marked up — `plain()` escapes a param value precisely
-  because it is data while the statement around it is not — and that decision
-  has never been separated from allowing raw HTML or a heading. So the entry is
-  as much about stating which of the three is intended as about the escaping,
-  and if the answer is that Markdown stays and HTML and headings go, that is a
-  fourth obligation in §9.1 rather than a patch at an emitter.
-
-- **`attest init` follows a symlink out of the project root.** `runInit` does
-  `mkdir(dirname(dest), { recursive: true })` and then `writeAtomic`, and
-  neither asks whether `dest` is still under `root`. A `.claude/skills/attest`
-  planted in the repository as a link to anywhere the user can write is followed
-  by both: measured on Windows with a junction, a file at the target holding
-  `USER OWNED FILE - DO NOT OVERWRITE` came back holding the skill. The report
-  prints the relative path, so nothing on screen says where it went.
-  *`write.ts` is not the gap and neither is `targets.ts`'s content.* The `wx`
-  flag defends the *temporary* path against a planted link and does exactly
-  that; the destination's directory was never in its scope. And `workflowBody()`
-  is a pure function of nothing, so no byte of the checked project reaches the
-  file — the exposure is the path, not the content, which is `targets.ts`'s
-  first rule ("Attest owns the path") being an assumption rather than a check.
-  The check belongs beside `resolveTargets`, which is already all-or-nothing for
-  the same reason: a name known to be unwritable must not leave half a set
-  behind.
-
-- **A deeply nested literal takes `check` down before either reader sees it.**
-  40 KB of `[[[…]]]` in a `params` value exhausts the stack inside
-  `ts.createSourceFile` — TypeScript's own recursive-descent parser, so
-  `literalValue`'s recursion is never reached and hardening it would change
-  nothing. `parser.ts` opens with the same call, so `verify` takes it too, and
-  `loadRegistry` reads with `Promise.all`, so one file ends the whole command.
-  *It fails closed, which is why this is a repair and not an emergency.*
-  Measured: `internal-error`, `ok: false`, exit 1, and a well-formed `--json`
-  envelope. What it costs is that the command this project tells people to run
-  first on an untrusted fork MR can be made to say nothing but that, forever.
-  The shape of the fix is already in `locate.ts`: `unreadableFiles` exists to
-  say "this file could not be read" without ending the run, and a `RangeError`
-  out of a single `read` or `parseSpecFile` is that, so a hostile file scraps
-  only itself and `check`'s breadth contract survives it.
-
-- **`status` prints one line the sanitiser never sees.** `cli/index.ts` writes
-  `Change: ${result.change}` bare, while `formatStatus` puts the same value
-  through `inline` twice, three lines apart in the same output. Measured with a
-  directory named with U+009B — the C1 CSI the class in `control` exists for,
-  and one NTFS permits — the header carried `c2 9b` raw while the closing
-  `Not a verdict:` line carried a space. A change name is a directory name in
-  the repository under test, and the workflow `init` writes tells an agent to
-  run `attest status <name>`, so the value is the project's to choose.
-  *One `inline()` call, and the entry is here for the reason rather than the
-  fix.* §9.1 says a stream has no entry, only writes, so the obligation sits on
-  every write or not at all — and this is the second time a single missed write
-  has been the whole defect, after the two `catch` blocks that printed a raw
-  stack beside sanitised diagnostics. The sweep filed above under `ATX-37` is
-  what would have found it; this is one more measurement in favour of it.
-
 ## Under consideration
 
 Candidates with **no decision yet**, between the two sections either side of it
@@ -3301,6 +3687,25 @@ deletion. What each entry has to carry is the evidence currently blocking the
 decision, because that is what a re-proposal a year from now would otherwise
 have to gather again.
 
+- **Trusted publishing, which would delete `NPM_TOKEN` rather than add to it.**
+  The provenance work in `[0.7.2]` signs the release but does not change
+  what authorises it: a long-lived automation token, masked and protected, that
+  publishes as us to anyone holding it. npm's trusted publishing exchanges the
+  same OIDC identity the attestation already uses for a short-lived credential,
+  which would remove the stored secret entirely and grant provenance as a
+  property of the flow rather than a flag on the command. The deletion test
+  points the right way for once: what it removes is the only long-lived
+  credential this repository has.
+  *What blocks the decision, and it is evidence rather than principle.* Whether
+  npm's trusted publishers accept a **gitlab.com-hosted** project on the plan
+  this package publishes under has not been verified against this project — it
+  was not checked when the provenance job was written, and an entry claiming it
+  works would be exactly the unverified confidence the rest of this file avoids.
+  It also cannot be tested except by publishing: as with provenance, there is no
+  dry run, so a failed experiment is a release. The cheap next step is reading
+  npm's current trusted-publisher documentation for GitLab support before
+  writing any YAML.
+
 - **A static sweep for the two properties claimed over the whole of `src/`.**
   The quantifier table's first strict read left three rows wanting the same
   thing, and the repo already owns the idiom: `tests/import-boundary.spec.ts` is
@@ -3439,6 +3844,103 @@ have to gather again.
   assertion is still green, still silent, and still reachable — so this stays
   here rather than moving to `Considered and rejected`: documenting a trap is
   not the same as deciding not to detect it.
+  **Re-measured after `[0.7.1]` widened `params`, on this registry rather than
+  the reporter's — the first time this experiment has been run here.** Twelve
+  mutations, each followed by the whole gate. Two results matter, and they point
+  opposite ways.
+  *The shape is now reachable here, and the widening is why.* `self/render.spec.ts`
+  asserts `expect(md).toContain(JSON.stringify(kinds))` over the same
+  `payloadKinds` it feeds to the renderer — the expectation is a function of the
+  value under test, verbatim row 3, and it could not have been written before
+  the widening because the param could not be an object. The mechanism is
+  sharper than a frequency count and is the strongest thing this entry has
+  gained: **the prescribed remedy costs in proportion to the value's
+  complexity.** Same repo, adjacent files, same value shape — `ATX-7` pins two
+  numbers with literals and goes red; `ATX-63` would have had to hand-write a
+  rendered JSON block, so it echoed. Depth raises the defect rate and the cost
+  of avoiding it along one axis.
+  *And its cost here is nil, which is the honest other half.* Both composite
+  params are fixtures for the renderer and the validator; the numbers stand for
+  nothing, so the green is arguably correct. Blocker **(1)** is therefore only
+  half retired — the shape is reproduced in a second, mature repo, and the count
+  of *harmful* instances is still zero. Blocker **(2)** is reinforced rather than
+  weakened: all four green mutations were on params `src/` never reads, so the
+  reporter's "read from both a spec and a non-spec file" detector would have
+  flagged none of them. Blocker **(3)** is untouched.
+  *The frequency is no longer unmeasured, and it points away from building
+  anything.* Blocker **(1)** rested on 8 commits of one greenfield repo. Parsed
+  at every one of the **38** revisions that have touched this registry — all 38
+  readable by the current static reader, so nothing was skipped — the history is
+  **57 param keys added, 0 removed, and exactly 1 value changed**: `ATX-16.staticCommands`
+  gaining `status`. That single edit is a roster *widening*, the safe direction,
+  and it is on the one list that was already pinned, so it could not have been
+  made without updating the pin. Two independent codebases, one greenfield and
+  one at 64 requirements, and the event this whole entry is about has happened
+  zero times in either. What that argues is not that the hole is unreal — it is
+  reachable, demonstrated above — but that it is **rare and silent**, which is
+  the profile `divergent-param` was rejected on rather than the profile that
+  justifies an engine rule.
+  *The same number says the split-out fix below has also never been triggered.*
+  0 removals ever means no domain has ever been shortened here. Those pins close
+  a live *exposure*, not a live *loss*, and the case for them is that they cost
+  one line each against a failure with no symptom — not that anything was
+  currently broken.
+  *Blocker **(3)** assumed mutation testing was the only separator. A cheaper
+  candidate existed, has now been scored, and does not survive it.* The idea was
+  a **syntactic** discriminator over one test body — flag an assertion whose
+  expected value derives from a param that also reached the arrange/act part —
+  which is exactly the difference between the two cases the widening produced:
+  `renderMarkdown({params: {payloadKinds: kinds}})` … `toContain(JSON.stringify(kinds))`
+  against `expect(kinds.json.maxBytes).toBe(1_048_576)`. Scored the way
+  `divergent-param` should have been and was not: implemented in
+  `tests/intent-rule-candidates.spec.ts`, run over the specs that attest this
+  repo, and then **every param it fires on mutated with the whole gate run —
+  fifteen of them, one gate run each. Four went green; eleven went red.**
+  *Then the detector was found to be wrong, which is the more useful half.* Its
+  first implementation counted an identifier in any position as a read of a
+  local with that name, so `i.code` in `issues.map((i) => i.code)` looked like a
+  use of a param named `code` — and `code` is this repo's commonest param name.
+  Corrected to count reference positions only, it flags **8, not 15**, and the
+  seven it drops are exactly seven the mutations had already shown to be pinned
+  by `src/`. The honest score is therefore **4 of 8, not 4 of 15** — precision
+  50%, not 27%. The conclusion does not move, because it never rested on the
+  precision figure; what moves is how much of the original number was the
+  candidate failing and how much was the measurement being wrong, and that is
+  worth writing down rather than quietly restating.
+  The remaining false positives are not near-misses. They are independent terms
+  the detector cannot see: **the runtime is the term** — `ATX-14`'s
+  `inheritedKey` is `'toString'`, and a mutated spelling is not a prototype key
+  at all, so the behaviour under test changes; **`src/` is the term** —
+  `ATX-51`'s `code` is a second copy of a string the engine emits as a literal;
+  and **arithmetic is the term** — `threshold + 3` builds a derived expectation
+  that mutation breaks.
+  And the four true positives fail the second test, which is the one that
+  decides it: **none is harmful.** `ATX-10` and `ATX-3` assert that a value was
+  substituted or applied, where the identity of the number is not the
+  obligation; `ATX-51`'s is a path prefix and `ATX-63`'s a rendering fixture.
+  Telling those from a mine-density band that must not move is a judgement about
+  whether the value *means* anything — the ground truth §0 refuses to compute
+  for someone else's registry. **50% precision on the shape, 0% on the harm.**
+  Two limits on that number, stated because a score with an unstated method is
+  what this file exists to prevent. The mutation has **one direction per kind**
+  — numbers +1, lists drop-last, strings suffixed — and direction can decide the
+  verdict: `ATX-40.languages` is red at 2→3 and was green at 2→1 before it was
+  pinned, so the true-positive count is a floor. And **recall is unmeasured**:
+  the eight params mutated earlier that this detector does not flag all went
+  red, which is eight correct negatives and not a recall figure.
+  The detector and its verdict table are kept in the measurement suite, with the
+  reach recomputed on every run and the table asserted to cover exactly what
+  fires — because the reach figure quoted for `compound-requirement` went stale
+  in this very file for want of that.
+  *A scoping limit on all of the above.* This repo cannot settle blocker **(2)**.
+  `src/` reads no param at all — every `reqs[…].params` in it is a comment or a
+  doc string — so params here are test vocabulary, while in the reporter's repo
+  they are application constants the app itself consumes. The reporter's
+  detector keys on exactly that difference, so it is inert here and this corpus
+  is evidence neither for nor against it.
+  *What the re-measurement did find is a different defect, and it has been split
+  out below* — the entry is kept whole here because the two were measured in one
+  pass and separating them is the finding.
 
 - **Whether `check` and `verify` should refuse a half-loaded registry the way
   `cover` and `render` do.** Those two return early on `hasError(loadIssues)`,
@@ -3560,41 +4062,6 @@ have to gather again.
   because a project whose requirement count only rises should have decided in
   advance what would make one leave.
 
-- **The `cmd.exe` quoting in `tests/consumer.spec.ts` guards one character of
-  several.** `shellArg` asserts the argument holds no `"` and then quotes only
-  when it holds whitespace, so an argument with none goes to the shell bare —
-  and `&`, `|`, `^`, `<`, `>`, `(` are metacharacters there that the assertion
-  does not name. The fix is one character class, which is why the entry is not
-  about the fix.
-  *What blocks the decision is that no input reaches it.* Both arguments are
-  either a literal flag or a path from `mkdtemp`, `NEEDS_SHELL` is win32 only
-  and CI is Linux, and the one path an attacker could plausibly influence — the
-  checkout directory on a fork MR pipeline — comes from a GitLab project path,
-  whose character set excludes every metacharacter above. So this is an
-  observation with no attack path, and the honest question is not whether to
-  widen the class but whether the comment above it should stop claiming more
-  than the assertion covers: it says "the assertion keeps that true" about
-  arguments generally, where what it checks is one character. Widening the class
-  and leaving the prose is the change that would look like a fix and settle
-  nothing.
-
-- **A loader that fails to start leaves its scratch directory behind.**
-  `createLoader` calls `mkdtempSync` and writes the stub *before* `createServer`,
-  and the only `rm` of that directory is inside the `close` of the object
-  `createServer` returns — so a throw from it leaks one `attest-loader-*` per
-  invocation, which on a CI runner is one per build. That is the exact failure
-  shape the comment on `close` records as already fixed, surviving on the other
-  path.
-  *What blocks it is that nothing has been made to throw there.* With
-  `configFile: false` Vite still reads the `package.json` at the root to decide
-  `type`, so a malformed one in the checked project is the obvious candidate and
-  it is the project's to write — but it was not tried, and an entry claiming a
-  trigger it has not seen is the thing this section exists to not accumulate.
-  The repair is three lines (a `try` around the two calls that `rm`s and
-  rethrows) and is not what the decision turns on; measuring whether the throw
-  is reachable at all is, because if it is not, this is a leak with no input
-  that produces it.
-
 ## Considered and rejected
 
 Decisions **not** to build something, kept where they can be found before the
@@ -3919,7 +4386,8 @@ requirement, and human review at propose is still the whole answer. What is
 rejected is grouping as a way to assist it, and this reopens only on a
 contradiction that grouping would have caught.
 
-[Unreleased]: https://gitlab.com/Pseudorca/attest/-/compare/v0.7.1...main
+[0.7.3]: https://gitlab.com/Pseudorca/attest/-/tags/v0.7.3
+[0.7.2]: https://gitlab.com/Pseudorca/attest/-/tags/v0.7.2
 [0.7.1]: https://gitlab.com/Pseudorca/attest/-/tags/v0.7.1
 [0.7.0]: https://gitlab.com/Pseudorca/attest/-/tags/v0.7.0
 [0.6.0]: https://gitlab.com/Pseudorca/attest/-/tags/v0.6.0