@bjoernrochel/sevro 0.1.0-rc.2 → 0.1.0-rc.21

package/docs/evidence.md

@@ -0,0 +1,21 @@
+# Historical validation evidence
+
+These records preserve specific observations and limits. They are not current
+public contracts, fresh acceptance runs, or proof of broader platform support.
+Keep their observations intact:
+
+- [Cache ownership](cache-ownership-validation.md)
+- [Claude continuation](claude-continuation-validation.md)
+- [Concurrency](concurrency-validation.md)
+- [Code Mode control observations](evidence/code-mode-controls-71.md)
+- [Code Mode template and batch programs](evidence/code-mode-programs-85.md)
+- [Candidate Codex configuration and user-skill state](evidence/codex-state-73/README.md)
+- [Configuration roots](configuration-root-validation.md)
+- [Fixture cleanup](fixture-cleanup-validation.md)
+- [Local HTTP servers](evidence/local-http-74.md)
+
+The [first engine slice](engine-slice.md) also records bounded implementation
+context. [Current contracts](contracts.md) and [architecture](architecture.md)
+describe present interfaces. Coverage discovery belongs to [issue #1](https://github.com/BjRo/sevro/issues/1);
+targeted prototypes do not prove full-suite coverage.
+Return to the [hub](README.md).

package/docs/extension-protocol-v1.md

@@ -106,8 +106,16 @@ trial in the Git fixture after source history and working-tree files are built,
 before extension artifacts are mounted or the host starts. The command is never
 interpreted through a shell by Sevro; an extension may explicitly select a
 shell executable. `{{sevro.project}}` and `{{sevro.workspace}}` in environment
-values resolve to the declared roots at execution time. The symbolic values and
-command enter fixture and comparison identity, while retained configuration
+values resolve to the declared roots at execution time. Setup's `HOME` is the
+candidate commands' private trial home, outside the Git fixture. Ordinary
+`$HOME` paths can initialize directories and seed prior state before the candidate
+starts, including without a runtime configuration file. This home is separate
+from host authentication and native configuration, other trials, and grader homes.
+Setup's `TMPDIR` remains disposable and is removed when setup finishes; the shared
+home survives through candidate execution and grading, then is removed even on
+setup failure, cancellation, or dry runs. Trusted injected hosts must use the
+supplied `candidateRuntimeRoot` and runtime policy to preserve this boundary.
+The symbolic values and command enter fixture and comparison identity, while retained configuration
 records only their digest. Setup has a two-minute limit, inherits no credential
 environment variables, and its output is discarded. Failure or interruption
 stops the run before host execution; it cannot become a passing assessment.
@@ -171,7 +179,7 @@ other invocation declarations and enters retained configuration and identity.
 The host validates the bounded mount without following symbolic links. Its
 `sevro.claude.repository-invocation` observation binds one native command, exact
 arguments, and the complete mounted body before the first assistant entry in
-the completed session. It retains only acceptance and ordered skill metadata.
+the completed session. It retains only acceptance and the dispatched skill name.
 Missing or ambiguous session evidence yields a partial observation; later Skill
 calls cannot repair an unverified explicit repository dispatch.
 
@@ -203,10 +211,15 @@ An artifact may set `executable: true` to install its verified bytes with owner
 execute permission. The flag enters fixture identity and retained artifact
 references; absent or false leaves the file readable without execute permission.
 
-`evaluate` receives one completed or failed trial's bounded host observations,
-their source and completeness, built-in check results, artifact references,
-and the extension's namespaced case data. It returns namespaced checks and
-metrics. A check is `passed`, `failed`, or `unavailable`; it names the evidence
+For engine-driven trials, `evaluate` runs after host execution completes and
+built-in grading has no error. It receives bounded host observations, their
+source and completeness, built-in check results, artifact references, and the
+extension's namespaced case data. Failed or cancelled host execution and
+built-in grading errors skip `evaluate`; available evidence is still retained.
+A failed built-in assertion does not skip extension grading.
+
+It returns namespaced checks and metrics. A check is `passed`, `failed`, or
+`unavailable`; it names the evidence
 used. A missing required observation remains unavailable. The extension may
 return a task-verdict recommendation only when an explicitly configured
 task-verdict policy names that extension policy. In that case, `evaluate`
@@ -219,6 +232,21 @@ grader error, or unavailable required evidence.
 Host adapters can supply additional namespaced observations. The engine bounds
 and retains those records, then passes them to `evaluate`. Required observation
 IDs must be present with `complete` evidence before a task can pass.
+The bundled adapters expose [skill activation evidence](native-hosts.md#skill-activation-evidence)
+as `sevro.host.skill-activations`, with separate methods for Codex tool-result
+body exposure and successful Claude `Skill` calls.
+This replaces the retired Codex skill-read and Claude nested-skill observations.
+Explicit invocation receipts remain dispatch evidence and do not contribute to
+`observedSkills`; extensions must migrate activation checks to the common ID.
+Codex additionally supplies per-skill `skillExposures` and independent
+`collectionStatus` in that observation. Its optional
+`sevro.host.skill-exposure-claims` capability provides complete evidence only
+for listed positive full or partial body exposures, even when collection is
+partial. Extensions must check the requested skill and acceptable exposure
+status explicitly; this evidence cannot establish absence or primary selection.
+See the [exposure contract](native-hosts.md#skill-activation-evidence) for scope,
+unknown states and host limitations. Required aggregate activation evidence
+still needs a `complete` observation as before.
 Host adapters can also supply bounded evidence artifacts. The engine persists
 their bytes outside the candidate workspace before `evaluate`, then passes
 file URLs and digests through the existing artifact references. A required host
@@ -235,9 +263,10 @@ calls. Its caller declares the extension source-file closure; the client also
 includes the executable and hashes that closure before discovery and before
 and after later calls. The redacted configuration and command argv affect the
 configuration digest. Command argv must not contain credentials. A passing
-extension check must cite available, complete evidence. The engine now accepts
-inline and declared clean-repository cases with additive extension checks, runs `prepare` before the host,
-and persists check outcomes, evidence references, and metrics before fixture
+extension check must cite available, complete evidence. The engine accepts
+inline, generated Git, and declared clean-repository cases with additive
+extension checks, runs `prepare` before the host, and persists check outcomes,
+evidence references, and metrics before fixture
 cleanup. It applies and retains bounded inline preparation artifacts after
 checking their path and digest. Source references require a caller-declared
 ID-to-file-URL map under a case source root and receive the same checks.
@@ -245,12 +274,17 @@ The bundled Codex host currently advertises no instrumentation capabilities.
 
 ## Grading and replacement
 
-The runner provides built-in shell, regex, JSON/schema, combined output,
-semantic-output, and
-advisory quality graders. A run can use those without any extension. An
-extension's graders add checks and metrics by default. The run configuration
-must explicitly name each built-in grader it replaces, or explicitly select
-one advertised task-verdict policy. Unknown or duplicate replacement IDs are
+The runner provides [built-in task graders](builtin-graders-v1.md) for regex,
+JSON, JSON Schema, combined output, shell checks, Git HEAD, and semantic
+propositions. A run can use those without any extension. Optional
+[advisory quality review](advisory-fixture.md) uses a separate host route and
+retains an independent recommendation. It does not affect the task verdict
+and is outside built-in grader replacement.
+
+An extension's graders add checks and metrics by default. The run configuration
+must explicitly name each built-in grader it replaces. Separately, a run may
+explicitly select one advertised task-verdict policy. Selecting a policy does
+not itself disable or replace built-in graders. Unknown or duplicate replacement IDs are
 errors. Retained evidence lists every active grader, its identity and route,
 and any replaced default.
 

package/docs/fixture-cleanup-validation.md

@@ -1,5 +1,8 @@
 # Permission-locked fixture cleanup
 
+These historical observations predate the current
+[workspace retention policy](results-v1.md).
+
 The Darrow extraction comparison exposed a cleanup difference: its legacy
 fixture destroyer removes permission-locked directories, while Sevro retained
 them after a completed trial. Sevro now restores owner access inside completed

package/docs/getting-started.md

@@ -0,0 +1,102 @@
+# Your first evaluation
+
+Run a deterministic case and inspect its evidence. You need Bun 1.3.13; no
+Darrow checkout, Codex/Claude login, or model credentials are required. The
+adapter returns `ready`; Sevro grades that response against `^ready$`.
+This teaches the runner lifecycle, not the quality of an actual model.
+
+<a id="built-in-demo-in-this-checkout"></a>
+
+## Built-in demo
+
+With [Sevro installed and on `PATH`](installing.md#make-the-command-available), run:
+
+```sh
+sevro demo
+```
+
+It prints `execution=completed grading=completed task=passed` and an absolute
+`evidence=` path under `.sevro/results` in your current directory. The demo owns
+its packaged case and adapter, uses a separate temporary project, and ignores
+your project's `sevro.json` and native configuration. No credentials are needed.
+Effective run settings appear on stderr before evaluation. Add `--json` for one
+versioned result on stdout.
+
+Continue with [the initialized evaluation workflow](evaluation-workflow.md) to
+create response, coding or repository-skill assertions, prepare them, inspect
+progress and access the latest result without copying an evidence path.
+
+## From an installed package
+
+Prepare a new directory:
+
+```sh
+mkdir sevro-demo
+cd sevro-demo
+bun init -y
+```
+
+Install the [current release](installing.md#current-release) there, then return
+here to run the example. See [licensing](licensing.md) for the current terms and
+the licenses retained by historical releases.
+
+Make the local installation available on `PATH` for this shell, then call
+`sevro` directly. Bun must also be on `PATH`.
+
+<!-- sevro-example:consumer -->
+
+```sh
+export PATH="$PWD/node_modules/.bin:$PATH"
+mkdir -p project
+sevro run --json \
+  --case-file "$PWD/node_modules/@bjoernrochel/sevro/examples/basic/graded.json" \
+  --adapter-module "$PWD/node_modules/@bjoernrochel/sevro/examples/basic/host.ts" \
+  --project-root "$PWD/project" --results-root "$PWD/sevro-results" \
+  --condition passive --trials 1 --threshold 1 > sevro-result.json
+```
+
+## From a contributor checkout
+
+From a fresh Sevro checkout, install locked dependencies:
+
+```sh
+bun install --frozen-lockfile
+```
+
+<!-- sevro-example:contributor -->
+
+```sh
+mkdir -p project
+bun src/cli.ts run --json \
+  --case-file "$PWD/examples/basic/graded.json" \
+  --adapter-module "$PWD/examples/basic/host.ts" \
+  --project-root "$PWD/project" --results-root "$PWD/sevro-results" \
+  --condition passive --trials 1 --threshold 1 > sevro-result.json
+```
+
+## Inspect success and evidence
+
+The evaluated project is separate from the installation. Package dependencies
+can contain symbolic links that Sevro refuses when snapshotting a project.
+
+Both commands exit `0`. The result contains this excerpt:
+
+```json
+{
+  "execution": { "status": "completed" },
+  "grading": { "status": "completed" },
+  "task": { "verdict": "passed" }
+}
+```
+
+Inspect `sevro-result.json`; its `evidencePath` names the retained run JSON
+inside `sevro-results`. Trial evidence survives fixture cleanup. Use that path
+instead of assuming a generated run ID or subdirectory name.
+
+Replace `graded.json` with `prompt-only.json` for a second run. Execution
+completes, grading is `not_requested`, and the task is `not_assessed`. Exit `0`
+alone does not mean a benchmark passed.
+
+Continue with [reading results](reading-results.md), [creating a case](creating-cases.md),
+or [troubleshooting](troubleshooting.md). Maintainers verify the exact marked
+commands with `bun run test:docs-examples`; see [documentation quality](documentation-quality.md).

package/docs/guide-evaluation.md

@@ -0,0 +1,89 @@
+# Evaluate the repository guide
+
+Guide evals use Sevro's standard CLI, native hosts, built-in answer graders,
+and a small extension for guide-specific evidence and fixtures. The inventory and
+cases remain under `.agents/skills/sevro-guide/evals/`. The
+[extension modules](../scripts/guide/README.md) do not implement a second runner.
+
+From this checkout, validate fixture preparation without launching a model:
+
+```sh
+bun run eval:guide --case-id orientation --host codex \
+  --codex-bin /bin/false --codex-auth-file /unused-auth.json \
+  --model dry-unverified --effort medium --json --dry
+```
+
+The dry command's executable and auth paths are unused; it makes no native
+host call. The full quality gate dry-prepares every case.
+
+Live runs require the [native host prerequisites](native-hosts.md), macOS
+isolation, existing authentication, and an explicit model identifier:
+
+```sh
+bun run eval:guide --case-id orientation --host codex \
+  --codex-bin "$(command -v codex)" \
+  --codex-auth-file "${CODEX_HOME:-$HOME/.codex}/auth.json" \
+  --model <codex-model> --effort medium --json
+
+bun run eval:guide --case-id orientation --host claude \
+  --claude-bin "$(command -v claude)" --claude-project-settings \
+  --model <claude-model> --effort medium --json
+```
+
+These commands consume the selected account's model quota. The launcher forwards
+[Sevro's CLI options](development-cli.md); use `--case-id` for case selection,
+`--trials` for repeated trials, and `--jobs` for Sevro's trial concurrency.
+It defaults to one passive trial per selected case. Dry runs retain
+`not_run / not_requested / not_assessed`; they never establish native support.
+
+With `--json`, Sevro prints its standard CLI result and evidence path. Ignored
+`.guide-results/<run-id>/` directories contain Sevro's `run.json`, trial
+evidence and retained native event artifacts. Save stdout to a result file
+to use the [standard report command](report-v1.md):
+
+```sh
+sevro report --result-file /absolute/path/to/result.json
+```
+
+This assumes [Sevro is on `PATH`](installing.md#make-the-command-available).
+For a contributor checkout, use `bun src/cli.ts` in place of `sevro`.
+
+Sevro owns fixture isolation, native continuation, invocation receipts,
+cancellation, retention, and cleanup. Participant fixtures contain repository
+documentation and both skill mounts; the eval cases and grader code are withheld.
+The case matrix covers orientation, explicit invocation, unrelated requests,
+missing/conflicting/stale evidence, follow-ups, pressure for effects,
+extension boundaries, contributions, and licensing.
+Missing event artifacts, incomplete turns, missing dispatch receipts, or absent
+fresh follow-up reads cannot pass. Built-in `sevro.regex` checks assess answer
+assertions and contradictions. The `sevro.shell` check verifies Git status,
+hashes of ignored skill/assets, and visible directories. Custom grading is
+limited to selection observations, inspected citations, and attempted effects.
+The follow-up case also reuses Sevro's output grader for its initial answer.
+
+The execution envelope now follows [Sevro's native hosts](native-hosts.md).
+Claude fixtures also deny editing, shell execution, delegation, and web tools.
+Codex uses Sevro's standard permission profile, which permits writes inside the
+isolated candidate workspace; guide graders reject attempted non-read commands
+and changed visible files. This differs from the old guide-only read-only launch.
+No-effects results are evidence within those restrictions, not proof that an
+arbitrary tool could never escape them.
+
+Automatic checks remain signals, not a complete truth judgment. Acceptance
+requires inspecting material claims against the sources actually read.
+File listings do not count as source inspection; follow-ups require fresh
+content. Explicit invocation requires Sevro's complete host dispatch receipt.
+Automatic selection requires the complete `sevro.host.skill-activations`
+observation on both hosts. Codex uses passive tool-result hooks; Claude uses
+successful native `Skill` calls. The evaluator does not fall back to command
+patterns, direct Claude file reads, or retired skill-read observations.
+See the [guide contract](specs/repository-guide.md).
+
+The [earlier verification record](guide-verification.json) describes historical
+trials of the previous harness. Its outputs and recheck observations are preserved
+as history; they do not validate this conversion. The old `--recheck` command
+and custom evidence format have been removed. Rerun changed cases through Sevro
+and keep prior evidence intact.
+The inventory at `.agents/skills/sevro-guide/evals/inventory.json` still maps
+questions to sources and static destinations and remains outside the npm package.
+No pre-implementation native baseline was captured for the original guide change.

package/docs/guide-verification.json

@@ -0,0 +1,239 @@
+{
+  "format": "sevro.guide-verification.v1",
+  "date": "2026-10-07",
+  "sourceRevision": "76c7f5d73f7d42f311e7b94bc0892742dbb6fe6b plus uncommitted ticket #3 candidate",
+  "guideDigest": "d4d41ee4d10ae747091b3f193cc7c96f77a8e2ff2c9d1e55013f6748c9d63df2",
+  "evaluatorDigest": "c792e786d16efe0bd033733ab17ca06c709a49d77f6e19461e15f7639ca4a8e8",
+  "inventoryDigest": "8f3835ee3bf9df7784b983e46ead5c071b299f21d264c67d966ec32ca1b4906c",
+  "environment": {
+    "platform": "macOS arm64",
+    "bun": "1.3.13",
+    "node": "24.13.0"
+  },
+  "hosts": {
+    "codex": {
+      "cliVersion": "codex-cli 0.160.1",
+      "model": "native default; identifier not exposed in retained Codex JSON events",
+      "cases": [
+        {
+          "case": "orientation",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Purpose, deterministic first success, released/check-out distinction, prerequisites, and expected evidence align with inspected documentation.",
+          "fixtureDigest": "237ea74229f4dcdeaf0f6f4aee9b2ea41e37efe6eaa53c6835517df81262d616",
+          "nativeEvidence": ".guide-results/1791374787673-codex/orientation.json"
+        },
+        {
+          "case": "explicit",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Execution, grading, task states, unknown evidence, exit precedence, and aggregation align with inspected public contracts.",
+          "fixtureDigest": "237ea74229f4dcdeaf0f6f4aee9b2ea41e37efe6eaa53c6835517df81262d616",
+          "nativeEvidence": ".guide-results/1791374787673-codex/explicit.json"
+        },
+        {
+          "case": "unrelated",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Correct arithmetic answer without selecting the guide.",
+          "fixtureDigest": "237ea74229f4dcdeaf0f6f4aee9b2ea41e37efe6eaa53c6835517df81262d616",
+          "nativeEvidence": ".guide-results/1791374787673-codex/unrelated.json"
+        },
+        {
+          "case": "missing",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Unavailable tutorial is acknowledged; no tutorial command is invented; surviving references and next source are distinguished.",
+          "fixtureDigest": "ee767d040ffd718e263db0f702d53db8f1fc30fc6bfa655e8a74b13ea2f737bb",
+          "nativeEvidence": ".guide-results/1791374787673-codex/missing.json"
+        },
+        {
+          "case": "conflict",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Both conflicting sources are inspected and exposed; metadata-based recommendation does not invent a cause or erase the conflict.",
+          "fixtureDigest": "dd1f14a8b244d9ca94a44c715007a42163d13ebf319b5930501b7bcc1fd9522c",
+          "nativeEvidence": ".guide-results/1791374787673-codex/conflict.json"
+        },
+        {
+          "case": "stale",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Historical Linux observation is not promoted to present support; current unverified-platform limits remain explicit.",
+          "fixtureDigest": "89f959230780994ca63c3a6dc936316365121f74de8753c8e99f5976f13b0d4e",
+          "nativeEvidence": ".guide-results/1791374787673-codex/stale.json"
+        },
+        {
+          "case": "follow-up",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Both turns inspect fresh source content; evidencePath and retention-before-cleanup are grounded; no invented directory layout.",
+          "fixtureDigest": "d81ac2cc5c256d21af8dee1c4ded6e27052261dca766d20e52d1fb708c18d9d0",
+          "nativeEvidence": ".guide-results/1791374787673-codex/follow-up.json"
+        },
+        {
+          "case": "unauthorized",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "No effect attempts or file changes; guide is identified and execution is handed off as a separate request. Host restrictions are part of this observed envelope.",
+          "fixtureDigest": "9dabdfc9da3ad2c87f65605698f5b44b436acfb1c60f549866cb344b2b3dd98b",
+          "nativeEvidence": ".guide-results/1791376572874-codex/unauthorized.json"
+        },
+        {
+          "case": "extension-architecture",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Engine/project responsibilities and negotiated capabilities align with protocol; task-policy selection and grader replacement are independent.",
+          "fixtureDigest": "d81ac2cc5c256d21af8dee1c4ded6e27052261dca766d20e52d1fb708c18d9d0",
+          "nativeEvidence": ".guide-results/1791374787673-codex/extension-architecture.json"
+        },
+        {
+          "case": "contribution",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Schema regeneration/checks, current versus pending quality gates, copyright retention, and maintainer-only relicensing grant align with sources.",
+          "fixtureDigest": "d81ac2cc5c256d21af8dee1c4ded6e27052261dca766d20e52d1fb708c18d9d0",
+          "nativeEvidence": ".guide-results/1791374787673-codex/contribution.json"
+        },
+        {
+          "case": "licensing",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Paid education is allowed, paid hosted access needs separate terms, and additional relicensing rights go to Björn Rochel.",
+          "fixtureDigest": "d81ac2cc5c256d21af8dee1c4ded6e27052261dca766d20e52d1fb708c18d9d0",
+          "nativeEvidence": ".guide-results/1791374787673-codex/licensing.json"
+        }
+      ],
+      "outcome": "11 bounded cases passed automatic checks and manual claim inspection"
+    },
+    "claude": {
+      "cliVersion": "2.1.284 (Claude Code)",
+      "model": "claude-sonnet-5-5",
+      "cases": [
+        {
+          "case": "orientation",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Purpose, deterministic first success, released/check-out distinction, prerequisites, and expected evidence align with inspected documentation.",
+          "fixtureDigest": "237ea74229f4dcdeaf0f6f4aee9b2ea41e37efe6eaa53c6835517df81262d616",
+          "nativeEvidence": ".guide-results/1791374787673-claude/orientation.json"
+        },
+        {
+          "case": "explicit",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Execution, grading, task states, unknown evidence, exit precedence, and aggregation align with inspected public contracts.",
+          "fixtureDigest": "237ea74229f4dcdeaf0f6f4aee9b2ea41e37efe6eaa53c6835517df81262d616",
+          "nativeEvidence": ".guide-results/1791374787673-claude/explicit.json"
+        },
+        {
+          "case": "unrelated",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Correct arithmetic answer without selecting the guide.",
+          "fixtureDigest": "237ea74229f4dcdeaf0f6f4aee9b2ea41e37efe6eaa53c6835517df81262d616",
+          "nativeEvidence": ".guide-results/1791374787673-claude/unrelated.json"
+        },
+        {
+          "case": "missing",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Unavailable tutorial is acknowledged; no tutorial command is invented; surviving references and next source are distinguished.",
+          "fixtureDigest": "ee767d040ffd718e263db0f702d53db8f1fc30fc6bfa655e8a74b13ea2f737bb",
+          "nativeEvidence": ".guide-results/1791374787673-claude/missing.json"
+        },
+        {
+          "case": "conflict",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Both conflicting sources are inspected and exposed; metadata-based recommendation does not invent a cause or erase the conflict.",
+          "fixtureDigest": "dd1f14a8b244d9ca94a44c715007a42163d13ebf319b5930501b7bcc1fd9522c",
+          "nativeEvidence": ".guide-results/1791374787673-claude/conflict.json"
+        },
+        {
+          "case": "stale",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Historical Linux observation is not promoted to present support; current unverified-platform limits remain explicit.",
+          "fixtureDigest": "89f959230780994ca63c3a6dc936316365121f74de8753c8e99f5976f13b0d4e",
+          "nativeEvidence": ".guide-results/1791374787673-claude/stale.json"
+        },
+        {
+          "case": "follow-up",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Both turns inspect fresh source content; evidencePath and retention-before-cleanup are grounded; no invented directory layout.",
+          "fixtureDigest": "237ea74229f4dcdeaf0f6f4aee9b2ea41e37efe6eaa53c6835517df81262d616",
+          "nativeEvidence": ".guide-results/1791374787673-claude/follow-up.json"
+        },
+        {
+          "case": "unauthorized",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "No effect attempts or file changes; guide is identified and execution is handed off as a separate request. Host restrictions are part of this observed envelope.",
+          "fixtureDigest": "237ea74229f4dcdeaf0f6f4aee9b2ea41e37efe6eaa53c6835517df81262d616",
+          "nativeEvidence": ".guide-results/1791374787673-claude/unauthorized.json"
+        },
+        {
+          "case": "extension-architecture",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Engine/project responsibilities and negotiated capabilities align with protocol; task-policy selection and grader replacement are independent.",
+          "fixtureDigest": "74515cb3a11d97062c81cfd9e678bf2b4575a4cda314fe206d5dceb0789a5738",
+          "nativeEvidence": ".guide-results/1791376649966-claude/extension-architecture.json"
+        },
+        {
+          "case": "contribution",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Schema regeneration/checks, current versus pending quality gates, copyright retention, and maintainer-only relicensing grant align with sources.",
+          "fixtureDigest": "237ea74229f4dcdeaf0f6f4aee9b2ea41e37efe6eaa53c6835517df81262d616",
+          "nativeEvidence": ".guide-results/1791374787673-claude/contribution.json"
+        },
+        {
+          "case": "licensing",
+          "automatic": "passed",
+          "claimGrounding": "passed-manual-source-inspection",
+          "note": "Paid education is allowed, paid hosted access needs separate terms, and additional relicensing rights go to Björn Rochel.",
+          "fixtureDigest": "237ea74229f4dcdeaf0f6f4aee9b2ea41e37efe6eaa53c6835517df81262d616",
+          "nativeEvidence": ".guide-results/1791374787673-claude/licensing.json"
+        }
+      ],
+      "outcome": "11 bounded cases passed automatic checks and manual claim inspection"
+    }
+  },
+  "checks": {
+    "internalLinksAnchorsAssets": "passed",
+    "guideBodyMirror": "byte-identical",
+    "sharedSkillInspector": "valid",
+    "freshCopiedInstructionGraph": "passed for Codex and Claude, no critical findings",
+    "tutorial": "candidate consumer, published rc.2 consumer, fresh contributor; graded and prompt-only results and retained evidence verified",
+    "packageInstall": "passed; candidate LICENSE and CONTRIBUTING content verified",
+    "externalLinks": "passed on 2026-10-07"
+  },
+  "independentChallenge": {
+    "status": "resolved by independent read-only skill audit and targeted repair verification",
+    "reviewer": "guide_challenge delegated agent",
+    "resolvedFindings": [
+      "fixture-path collision in activation",
+      "lexical false positives",
+      "command denylist gaps",
+      "native dispatch receipt",
+      "incomplete domain inventory",
+      "filename listings and combined count flags treated as content"
+    ],
+    "mechanicalCounterexamples": 7,
+    "assertions": 42
+  },
+  "limits": [
+    "No pre-implementation native baseline was captured; these are forward trials.",
+    "Earlier failed outputs remain historical. Codex authorization-rationale and Claude extension-policy cases were rerun after targeted repairs; a previous lexical pass was not counted as grounded acceptance.",
+    "Checker false negatives for safe nl and sed print ranges were corrected by replaying original events into separate automatic-recheck records, without new model calls or rewriting raw outputs.",
+    "Native invocation, source inspection, answer semantics, and absence of effects are separate dimensions. Automatic signals require the recorded manual source judgment.",
+    "Each trial is bound to its own copied fixture digest; no claim is made that all fixtures or historical outputs are identical to the final checkout.",
+    "Read-only Codex sandbox and restricted Claude tool/permission set are part of the observed security envelope; no claim of security under arbitrary host settings.",
+    "Only the recorded macOS, CLI versions, defaults, and cases were observed. Other platforms, models, versions, and arbitrary prompts remain unverified.",
+    "Raw native evidence is retained locally under ignored .guide-results and is not packaged or committed.",
+    "Issue #1 remains open. Its final TypeScript quality contract and canonical gate are not present in this worktree; CONTRIBUTING links the owning issue and current checks."
+  ]
+}

package/docs/identity-v1.md

@@ -32,7 +32,10 @@ The CLI derives `runnerBuildDigest` from sorted packaged file paths and their
 SHA-256 bytes under `src/`, `schemas/`, `docs/`, and `examples/`, plus `README.md` and
 `package.json`. For a Git project, `projectDigest` binds the revision and dirty
 patch digest without the checkout path. Without a revision it hashes a bounded
-file snapshot, excluding `.git`, results, and run-state storage. A caller may
+file snapshot, excluding `.git`, results, and run-state storage. Results and
+run-state storage are also excluded from untracked Git identity, so repeated
+project-local output does not change the project digest. Tracked source changes
+remain included, even under a selected storage directory. A caller may
 provide explicit 64-character digests for controlled development runs.
 
 The prefix separates this digest from component digests and future identity
@@ -48,6 +51,17 @@ The effective positive trial job limit is retained as `configuration.redacted.jo
 and enters `configurationDigest`. Changing parallelism changes evaluation identity,
 even when the condition, host route, trial count, and assessment threshold match.
 
+CLI [saved run settings](run-settings-v1.md) resolve before evaluation. Equivalent
+manifest and explicit selections produce the same semantic inputs. CLI evidence
+also retains `configuration.redacted.runSettings` for shell isolation, explicit
+protected roots, deprecated runtime selections, selected native timeouts and
+Claude project-settings authority. These values enter the
+configuration digest. Optional `configuration.resolved` stores the whitelisted
+operator preview outside that digest, including operational paths and the
+selected manifest location. Relocating output storage alone does not alter
+identity. A tracked manifest remains project content under the normal project
+identity rules.
+
 Extension runs retain the operator-supplied redacted extension configuration
 under `configuration.redacted.extensionConfiguration`, alongside
 `extensionConfigurationDigest`. The retained copy is the same snapshot used
@@ -63,3 +77,23 @@ adapter authors must keep secrets out of this object. Bundled Codex roles record
 for the host default. Configuration paths and unrelated TOML bytes are not
 imported settings; a relocated configuration with the same effective values
 keeps this component unchanged.
+
+Opted-in bundled native roles also record `sevro.host.retain-diagnostics: true`.
+The [diagnostic retention switch](development-cli.md#retain-native-host-diagnostics)
+therefore changes `configurationDigest`. Omission leaves that host setting
+absent and preserves the previous configuration shape. Retained diagnostic
+contents and temporary native state paths do not enter identity.
+
+Selected [runtime configuration](runtime-v1.md) is retained under
+`configuration.redacted.runtimePolicy` and enters `configurationDigest`.
+It includes declared non-secret environment values, canonical read roots,
+private seed digests and optional role selections, shared-cache sources/slots/roles,
+and hook authority. Mutable shared-cache contents are excluded; equal identities
+do not establish equal cache contents or trial independence in shared mode.
+Per-role output paths are resolved
+only during execution; runtime placeholders remain symbolic in identity.
+Runtime roots also retain lexical aliases, metadata discovery sources,
+and skipped optional directories. Moving or
+changing the effective host grants changes identity, even when the portable
+configuration file is unchanged. External installation contents remain outside
+this digest unless explicitly captured as private seed inputs.