@bjoernrochel/sevro 0.1.0-rc.3 → 0.1.0-rc.5

package/CONTRIBUTING.md

@@ -26,8 +26,9 @@ by applicable law.
 
 ## Set up development
 
-Use Bun 1.3.13, Git, Node 24, and npm. Full suite isolation needs macOS and
-`sandbox-exec`; Linux/Windows acceptance is unverified. From a fresh checkout:
+Use Bun 1.3.13, Git, Node 24, and npm. Full suite isolation uses `sandbox-exec`
+on macOS or `bubblewrap` and `socat` on Ubuntu. Windows acceptance is unverified.
+From a fresh checkout:
 
 ```sh
 bun install --frozen-lockfile
@@ -51,8 +52,10 @@ bun run check:typescript
 It performs frozen installation, schema freshness, formatting, lint, typing,
 documentation and guide dry-run checks, tutorial examples, the real Bun suite,
 coverage integrity and thresholds, and installed-package validation. Statements
-and branches must each reach at least 95% using raw exact counts over the complete
-authored production inventory, including unimported files. The five explicitly
+and branches must each reach at least 95% using raw exact counts over the
+platform-reachable authored production inventory, including unimported files.
+The macOS and Ubuntu gates each measure their reachable host modules; the exact
+module and branch-outcome exclusions are recorded in coverage artifacts. The five explicitly
 inventoried generated AJV validators are excluded from coverage because this
 target measures authored runner behavior; their syntax, schema freshness, typed
 boundaries and runtime tests remain checked. Tests and fixtures remain linted and
@@ -68,9 +71,44 @@ Run `bun run check:docs:external` separately and [triage network failures](docs/
 Guide changes also need [native evals](docs/guide-evaluation.md).
 Documentation checks supplement #1 rather than replacing its contract.
 
+## Delivery and CI ownership
+
+An implementation PR is complete only when required CI checks pass for its exact
+published commit. A request to open or update a PR includes monitoring CI and
+repairing in-scope failures; it does not authorize merging or unrelated changes.
+
+- Use GitHub CI in `.github/workflows/verify.yml` for full acceptance validation.
+  It provides the configured OS, architecture, runtime and native-tool versions,
+  non-root user, and isolation prerequisites. Reproducing that environment locally
+  with Docker is optional for diagnosis and is not a publication prerequisite.
+- After the local pre-commit checks, publish the authorized candidate to its PR
+  and require `bun run check:typescript` to succeed in GitHub CI before reporting
+  delivery as complete. A local run, fast check, targeted suite, or historical
+  result does not establish that the current Ubuntu gate passes.
+- Keep the quality bar intact. Repair behavior or add meaningful coverage for
+  accepted behavior; do not lower thresholds, exempt authored sources, skip tests,
+  bypass checks, or add artificial tests just to move a counter. Remove impossible
+  branches by clarifying validated invariants rather than inventing impossible inputs.
+- Bind validation to the candidate's exact source and commit. Changes to source,
+  tests, tooling, dependencies, schemas, workflows, or guidance invalidate prior
+  candidate evidence; require the applicable CI gates on the updated published head.
+- After authorized publication, observe required checks for the exact PR head
+  until they finish. Queued or running checks, a successful older commit, and a
+  passing subset are not completion.
+- On failure, inspect the failed job and retained artifacts, reproduce the cause
+  locally when useful, repair within the authorized scope, and publish a non-force
+  update to the same PR. Continue monitoring without waiting for the user to notice
+  the failure or request correction; do not open a duplicate PR or merge it.
+- If an external blocker prevents progress, report its concrete evidence and the
+  unfinished checks. Keep the PR's status and description honest; do not report
+  delivery as complete while required checks remain failing or unobserved.
+
+Release metadata follows `docs/releases.md` and its existing verified-source CI
+reuse policy; these implementation gates do not require release test reruns.
+
 ## Tests, fixtures, and schemas
 
-Preserve real Bun filesystem/process integration tests and macOS isolation.
+Preserve real Bun filesystem/process integration tests and native isolation.
 Use deterministic fixtures under `tests/fixtures/`; keep evaluator-only inputs
 outside candidate workspaces. Keep credentials and raw trial evidence out of Git.
 Add meaningful regression coverage for reproducible bugs. Fixtures should
@@ -102,7 +140,16 @@ native trials or remote CI results.
 
 ## Maintainer releases
 
-Follow [releases](docs/releases.md): choose a new version, prepare and inspect
-the exact tarball, verify its license/provenance, and validate that artifact.
+Follow [releases](docs/releases.md): reuse successful source CI, choose a new
+version, and submit the release commit through a PR. Release PRs reuse the
+existing full quality gate and run static metadata checks; releases do not
+rerun local or CI tests. After the PR merges, prepare and inspect the exact
+tarball and verify its license, provenance, and checksums before publication.
+After changing `package.json.version`, run `bun run docs:sync` to refresh the
+[current release](docs/installing.md#current-release). `check:docs`, release
+preparation, and package-install validation reject stale release documentation.
+Package-install, native, and Darrow compatibility tests belong to development
+or an explicitly requested diagnostic, not the release process. Darrow's
+dependency update is a separate PR.
 Publication, tags, registry changes, and alternative licensing are separate
 maintainer actions; preparing a contribution does not authorize them.

package/README.md

@@ -16,15 +16,15 @@ account is required.
 ## Status and environments
 
 Sevro is under active development. The npm package is `@bjoernrochel/sevro`;
-its command is `sevro`. Release candidate `0.1.0-rc.3` includes runtime
+its command is `sevro`. The [current release](docs/installing.md#current-release) includes runtime
 configuration, native goals, selected plugin hooks, and the current licensing terms.
 Earlier `rc.1` and `rc.2` packages retain their original BSL grants.
 See [installation and release differences](docs/installing.md).
 
-Use Bun 1.3.13. The full deterministic suite and native isolation target macOS;
-bundled Codex/Claude routes and isolated shell checks need `sandbox-exec`.
+Use Bun 1.3.13. The development checkout runs native isolation on macOS with
+`sandbox-exec` and on Ubuntu with `bubblewrap` and `socat`.
 Contributor package/release checks also need Node 24 and npm.
-Linux and Windows support is unverified. The basic example uses an injected
+Windows support is unverified. The basic example uses an injected
 deterministic adapter and needs no native model credentials.
 
 ## Install and get a first result
@@ -33,9 +33,9 @@ deterministic adapter and needs no native model credentials.
 mkdir sevro-demo
 cd sevro-demo
 bun init -y
-bun add --exact @bjoernrochel/sevro@0.1.0-rc.3
 ```
 
+Install the [current release](docs/installing.md#current-release) in that directory.
 Continue with [your first evaluation](docs/getting-started.md): the exact command,
 expected `passed` result, and retained evidence. Read [installation](docs/installing.md)
 for updates, removal, and source checkouts.
@@ -72,7 +72,7 @@ environment.
 
 ## License and acknowledgements
 
-Release candidate `0.1.0-rc.3` uses the [Sevro Source Available License 1.0](LICENSE).
+The [current release](docs/installing.md#current-release) uses the [Sevro Source Available License 1.0](LICENSE).
 Use is free in every context, including commercial work and paid education.
 Selling copies, rebranded versions, or hosted access to Sevro's functionality
 requires a separate license. Modification and free redistribution remain allowed.

package/docs/builtin-graders-v1.md

@@ -38,7 +38,7 @@ The shell-check process runner accepts a bounded evaluator-owned `run` string,
 optional `expectedExitCode` and `timeoutMs`, plus `expectExact`, `expectRegex`,
 `notRegex`, and regex `flags` for stdout. Exact matching removes one final
 newline; regex matching always uses multiline mode. The runner executes with
-`sh -e`. On macOS it runs through the outer sandbox with network access denied,
+`sh -e`. On macOS and Linux it runs through the outer sandbox with network access denied,
 a credential-free environment, and caller-declared protected roots. Without a
 stdout assertion, process output is discarded. With one, the runner captures
 at most 1 MiB in memory and retains only its digest and byte length. Oversized
@@ -87,3 +87,11 @@ grading an error. Checks are grouped by source, so response and document checks
 remain independent in the same trial. Artifact outcomes retain the resolved
 path and content digest. The semantic host uses an empty workspace and receives
 the document as untrusted data.
+
+When [native transcripts are enabled](runtime-v1.md#native-transcript-access),
+shell checks and semantic hosts can read retained candidate native files through
+`SEVRO_CANDIDATE_TRANSCRIPTS`. The view has `index.json` plus a `codex/` or
+`claude/` native tree. It is read-only and separate from the grading host's own
+live native tree. Native transcripts are untrusted candidate evidence; a grader
+must not follow instructions inside them. Missing or partial capture remains
+explicit in the index and does not establish required complete evidence.

package/docs/codex-host.md

@@ -130,16 +130,16 @@ available through the engine's injected host interface and the development
 CLI's explicit `--host codex` route. Its protocol and evidence host ID is
 `sevro.host.codex`; `codex` remains the CLI route selector.
 
-`prepareMacSandboxCommand` provides the macOS shell-grading boundary. Callers
+`prepareMacSandboxCommand` and `prepareLinuxSandboxCommand` provide the shell-grading boundary. Callers
 provide absolute protected roots and a private state root; the primitive
 canonicalizes them, refuses overlap with the fixture workspace, and creates a
-temporary `sandbox-exec` profile that denies reads and writes. It fails if
-macOS isolation is unavailable. The caller releases the profile after the
+temporary native sandbox that denies reads and writes. It fails if
+isolation is unavailable. The caller releases the sandbox resources after the
 process exits. The runner assembles the same protected-root set for Codex
 candidate commands and shell grading.
 
 Codex cannot start its native sandbox inside an outer `sandbox-exec` process
-on this host. Its runner-generated permission profile therefore sets an
+on macOS. Its runner-generated permission profile therefore sets an
 explicit workspace rule, denies all other filesystem roots except minimal
 runtime files and the selected executable's install directories, and
 specifically denies protected roots and the private Codex home. An executable

package/docs/development-cli.md

@@ -107,7 +107,7 @@ The same worktree protection applies to other declared source and private roots;
 a package without Git metadata remains usable. Result and active-run storage
 stay independent through `--results-root` and `--run-state-root`.
 
-A bundled Claude Code candidate route is available on macOS:
+A bundled Claude Code candidate route is available on macOS and Linux:
 
 ```sh
 sevro run --json \
@@ -133,7 +133,7 @@ values are excluded from retained evidence and configuration digests. Pass
 `--claude-credential-file` with an absolute path to select a separate saved login.
 It accepts declared Claude
 plugin directories and explicit skill invocations from extension preparation.
-It runs candidate tools under Claude Code's native macOS sandbox with private,
+It runs candidate tools under Claude Code's native sandbox with private,
 source, and result paths denied. The route disables hooks by default and does not expose
 the Write tool. It currently supports passive candidate turns only. Use
 `--protected-root` to exclude additional private paths from the candidate's
@@ -317,8 +317,8 @@ For shell checks, add
 `--shell-isolation` and repeat `--protected-root /absolute/path` for every
 additional source worktree or private root. The engine always protects the
 selected project, results, runner source, user home, configured host homes,
-and active peer fixtures. Shell checks require macOS `sandbox-exec` in this
-development slice.
+and active peer fixtures. Shell checks require macOS `sandbox-exec` or Linux
+`bubblewrap`.
 Injected host adapters may return namespaced observations and bounded evidence
 artifacts. A case can list their IDs in `requiredEvidence`; missing or partial
 host evidence produces unavailable grading rather than a passing task. The

package/docs/documentation-quality.md

@@ -15,6 +15,17 @@ marked tutorial commands in fresh consumer/contributor directories, including
 expected verdicts and saved evidence. Candidate and released-package runs are
 reported separately. These commands create and clean temporary directories.
 
+`package.json.version` is the authoritative current version. `bun run docs:sync`
+updates only the marked [Current release](installing.md#current-release) section
+with its exact installation command. Keep its markers and heading in place;
+the command refuses missing, duplicate, or reversed markers and invalid versions.
+The rest of the page stays ordinary Markdown. `check:docs` compares this section
+without writing; release preparation and package-install validation also reject
+stale output. Run synchronization after a version bump and include the resulting
+documentation change. Link installation and update instructions to this section.
+Keep historical versions, licensing transitions, and minimum supported versions
+fixed and explain their purpose beside each reference.
+
 ## External links
 
 Run `bun run check:docs:external` separately. Transient failures are retried

package/docs/getting-started.md

@@ -7,17 +7,17 @@ This teaches the runner lifecycle, not the quality of an actual model.
 
 ## From an installed package
 
-Install the release candidate in a new directory:
+Prepare a new directory:
 
 ```sh
 mkdir sevro-demo
 cd sevro-demo
 bun init -y
-bun add --exact @bjoernrochel/sevro@0.1.0-rc.3
 ```
 
-Version `rc.3` includes the current docs and source-available license; earlier
-`rc.2` packages retain their original BSL terms. Read [version differences](installing.md#published-package-and-checkout).
+Install the [current release](installing.md#current-release) there, then return
+here to run the example. Read [version differences](installing.md#published-package-and-checkout)
+for the current docs, source-available license, and earlier BSL releases.
 
 Make the local installation available on `PATH` for this shell, then call
 `sevro` directly. Bun must also be on `PATH`.

package/docs/identity-v1.md

@@ -69,3 +69,8 @@ Selected [runtime configuration](runtime-v1.md) is retained under
 It includes declared non-secret environment values, canonical read roots,
 private seed digests, and hook authority. Per-role output paths are resolved
 only during execution; runtime placeholders remain symbolic in identity.
+Runtime roots also retain lexical aliases, metadata discovery sources,
+and skipped optional directories. Moving or
+changing the effective host grants changes identity, even when the portable
+configuration file is unchanged. External installation contents remain outside
+this digest unless explicitly captured as private seed inputs.

package/docs/installing.md

@@ -10,13 +10,26 @@ Linux and Windows are unverified.
 mkdir sevro-demo
 cd sevro-demo
 bun init -y
-bun add --exact @bjoernrochel/sevro@0.1.0-rc.3
 ```
 
+Then install the [current release](#current-release) in that directory.
+
 Run the [packaged deterministic example](getting-started.md#from-an-installed-package)
 to verify installation. It needs neither model credentials nor Darrow.
 Local installation records the selected version in the project lockfile.
 
+<!-- sevro-current-release:start -->
+
+## Current release
+
+The current release is `0.1.0-rc.5`. Install this exact version:
+
+```sh
+bun add --exact @bjoernrochel/sevro@0.1.0-rc.5
+```
+
+<!-- sevro-current-release:end -->
+
 ## Make the command available
 
 The examples call `sevro` from `PATH`. For a local installation, run this from
@@ -33,10 +46,11 @@ no adjustment is needed. Bun must also be on `PATH`: the executable uses
 
 ## Published package and checkout
 
-The commands above pin release candidate `0.1.0-rc.3`, which includes runtime
+The [current release](#current-release) includes runtime
 configuration, native goals, selected plugin hooks, current onboarding, and
 [source-available licensing terms](licensing.md). Earlier `rc.1` and `rc.2`
-packages retain BUSL-1.1. Source checkouts can include changes beyond their
+packages retain BUSL-1.1. The license transition began with `0.1.0-rc.3`.
+Source checkouts can include changes beyond their
 package version; compare the exact release tag when establishing provenance.
 
 The candidate npm package contains sources, schemas, examples, documentation,
@@ -57,14 +71,10 @@ directories; it does not publish. [Contributing](../CONTRIBUTING.md) lists check
 
 ## Update
 
-Review a release's license and compatibility, then install its exact version:
-
-```sh
-bun add --exact @bjoernrochel/sevro@0.1.0-rc.3
-```
-
-This selects `rc.3` explicitly. For later updates, substitute the intended
-published version, then rerun the example.
+Review a release's license and compatibility, then use the exact installation
+command for the [current release](#current-release) from your existing project.
+To select a different published version, substitute that exact version in the
+command, then rerun the [packaged example](getting-started.md#from-an-installed-package).
 Rollback uses the prior exact version and another verification run.
 [Releases](releases.md) explains artifact provenance.
 

package/docs/native-hosts.md

@@ -1,7 +1,8 @@
 # Run native model hosts
 
 The basic tutorial needs none of this setup. Bundled model routes and isolated
-shell checks require macOS `sandbox-exec`, a supported native CLI, and model
+shell checks require macOS `sandbox-exec` or Linux `bubblewrap` (and `socat` for
+Claude Code), a supported native CLI, and model
 authentication. Complete commands/rules live in the [CLI reference](development-cli.md)
 and [Codex host reference](codex-host.md).
 

package/docs/releases.md

@@ -7,7 +7,7 @@ exact semantic version; development versions containing `-dev` are not release
 candidates. Darrow pins the published version in development dependencies and
 its lockfile. Marketplace plugins do not depend on Sevro.
 
-Release candidate `0.1.0-rc.3` uses the current [licensing terms](licensing.md).
+The [current release](installing.md#current-release) uses the current [licensing terms](licensing.md).
 Published `rc.1` and `rc.2` retain their original BSL grants. Always select a new
 version for publication; a local development tarball does not replace an
 already published artifact.
@@ -28,8 +28,9 @@ The record identifies the package, version, release tag, distribution tag,
 tarball SHA-256 and npm SHA-512 integrity, and the preparation runtimes.
 Preparation does not publish a package or create a Git tag.
 
-The package installation check accepts `--tarball <absolute file>` to verify
-that exact candidate without repacking. The supplied tarball remains intact.
+For development or explicitly requested diagnostics, the package installation
+check accepts `--tarball <absolute file>` to verify an exact candidate without
+repacking. It is not a release step. The supplied tarball remains intact.
 Its installed name and version must match the source metadata. Installation,
 CLI execution, generic grading, prompt-only execution, release provenance,
 reporting, and supported deterministic native fixtures run without source Git
@@ -37,56 +38,78 @@ metadata in the installed package.
 
 ## Maintainer workflow
 
-1. Select the license, update `package.json` to the intended release version,
-   and commit those changes. Preserve the existing public schemas and document
-   behavior changes. Set `publishConfig.tag` to `latest` for the recommended
-   default or `next` for an opt-in preview. A prerelease does not establish full
-   Darrow migration completion.
-2. Run frozen installation, typecheck, formatting, and the full test suite.
-3. Prepare and test the exact candidate:
+Release already verified code. Do not rerun tests locally or in CI as part of a
+release: reuse the successful source CI run. Code, dependencies, schemas, tests,
+examples, license changes, and other quality inputs belong in ordinary changes
+with their own CI before starting the release.
+
+1. Start a release branch from verified `main`. Update `package.json.version`
+   to a new release version, keep the selected license, and run `bun run docs:sync`.
+   Set `publishConfig.tag` to `latest` for the recommended default or `next`
+   for an opt-in preview. Commit and open a pull request; every release commit
+   must reach `main` through a PR. Never attempt a direct release push to `main`.
+2. Merge the release PR after its static checks and reused CI evidence pass.
+   Release CI compares the candidate against a successful ancestor run on
+   `main`, permitting only version/distribution-tag changes and the exact
+   release documentation and workflow files inventoried in
+   [the CI selector](../.github/scripts/release-ci.py). All other tracked inputs
+   must match. The original run must have completed the full quality gate;
+   another release's reused status is insufficient. CI retains the source SHA
+   and run URL in `release-ci.json`. Missing evidence fails the release check;
+   it does not trigger another test run. Ordinary code changes and explicit
+   workflow dispatches continue to run the full gate.
+3. From the clean, merged release commit, use macOS, Bun 1.3.13, Node 24,
+   and npm to prepare one exact candidate:
 
    ```sh
+   bun install --frozen-lockfile
    bun run release:prepare --tag "v${SEVRO_RELEASE_VERSION:?set the selected new release version}" --output /absolute/new/release-directory
-   bun run test:package-install --tarball "/absolute/new/release-directory/bjoernrochel-sevro-${SEVRO_RELEASE_VERSION}.tgz"
    ```
 
-4. Run Darrow's public integration against that same tarball:
+4. Inspect the version, repository, license, distribution tag, file inventory,
+   and retained checksums. Publish that tarball with lifecycle scripts disabled
+   using the commands below. Do not run `check:typescript`, `test:package-install`,
+   Darrow's archive/installed gates, or native trials during release. Diagnostic
+   tests require a separate explicit request.
+5. Once npm serves the version, compare `dist.integrity` with `release.json`
+   and verify the intended distribution tag:
 
    ```sh
-   SEVRO_PACKAGE_TARBALL="/absolute/new/release-directory/bjoernrochel-sevro-${SEVRO_RELEASE_VERSION}.tgz" bun run test:eval-package
+   npm view "@bjoernrochel/sevro@${SEVRO_RELEASE_VERSION}" version dist.integrity --json
+   npm view @bjoernrochel/sevro dist-tags --json
    ```
 
-5. Review the changes, file inventory, retained checks, and compatibility
-   limitations before authorizing publication. Keep the reviewed tarball and
-   its checksums. Publish that artifact rather than repacking after review.
-6. After publication, verify registry integrity, install the exact version in
-   Darrow, and run its frozen installed compatibility gate. Retain the prior
-   version's evidence for updates. Roll back through a new dependency/lockfile
-   commit and rerun the installed gate; never relabel failed-version evidence.
+   npm may take a few minutes to process the accepted upload. Wait for the
+   registry record rather than republishing. Retain the reviewed tarball,
+   checksums, and original CI evidence.
 
-## Manual release workflow
+6. Create the matching Git tag at the merged release commit and push only the tag:
 
-`.github/workflows/release.yml` runs only through explicit dispatch against a
-release tag. Its default prepares and checks the artifact. `publish: true`
-additionally publishes that verified artifact using npm trusted publishing.
-No push or pull-request event publishes a package.
+   ```sh
+   git tag -a "v${SEVRO_RELEASE_VERSION}" -m "Release ${SEVRO_RELEASE_VERSION}"
+   git push origin "refs/tags/v${SEVRO_RELEASE_VERSION}"
+   ```
+
+Darrow dependency/lockfile updates and compatibility gates are a separate
+Darrow PR, not prerequisites for npm publication. A prerelease does not establish
+full Darrow migration completion. Preserve prior-version evidence for updates
+and rollback; never relabel failed-version evidence.
+
+## Local macOS publication
 
-Before the first publication, an npm owner must establish the package and its
-publishing authorization. The initial reviewed tarball can be published
-manually with an authenticated npm account:
+There is no GitHub release job. The maintainer prepares, inspects, and publishes
+the reviewed tarball from macOS with an authenticated npm account. Check its
+retained checksum immediately before publication:
 
 ```sh
-npm publish /absolute/reviewed/bjoernrochel-sevro-0.1.0-rc.1.tgz --ignore-scripts --access public --tag latest
+cd /absolute/reviewed
+shasum -a 256 -c SHA256SUMS
+npm publish ./bjoernrochel-sevro-0.1.0-rc.1.tgz --ignore-scripts --access public --tag latest
 ```
 
-After the package exists, configure its trusted publisher for GitHub owner
-`BjRo`, repository `sevro`, and workflow filename `release.yml`. The workflow
-uses a GitHub-hosted runner, Node 24, npm 11.20.0, and job-scoped `id-token: write`.
-The package repository URL must match this public repository. See npm's
-[trusted publishing documentation](https://docs.npmjs.com/trusted-publishers/).
-The workflow checks the downloaded artifact's SHA-256 before publishing and
-retains its release record. Configuring an owner or workflow does not itself
-authorize this coding session to publish or push.
+Replace the example version and distribution tag with the reviewed candidate's
+values. The package repository URL must match this public repository. Preparing
+a tarball or opening a pull request does not authorize publication.
 
 An existing published candidate can become the default without republishing:
 
@@ -99,7 +122,7 @@ Promotion changes the registry tag; it does not update the published tarball.
 
 The first published candidate was `0.1.0-rc.1`, using the owner-selected
 `BUSL-1.1` license. Its `LICENSE` preserves Darrow's terms and parameters,
-changing only the Licensed Work name and description to Sevro. Neither local
-checks nor a workflow file claim a remote CI run or publication. Darrow's exact
+changing only the Licensed Work name and description to Sevro. Local checks do
+not claim a remote CI run or publication. Darrow's exact
 registry pin, default caller switch, remaining workflow migrations, focused live validation, and
 generic runner removal remain separate extraction gates.

package/docs/results-v1.md

@@ -116,3 +116,46 @@ reports `failed` / `not_requested` / `not_assessed` with exit code `2`. A final
 message that happens to match a check cannot turn that failure into a pass.
 Claude retains its bounded event stream and, when present, up to 64 KiB of
 stderr as private host artifacts. Failure bodies do not appear in CLI diagnostics.
+
+## Native transcript bundles
+
+With [runtime transcript opt-in](runtime-v1.md#native-transcript-access), each
+bundled host captures full native files before removing its private state.
+Candidate artifact `sevro.native-transcripts.bundle` has format
+`sevro.native-transcripts.v1`. It contains `host` (`codex` or `claude`), `role`,
+native `rootSessionId` (or `null`), `completeness`, `issues`, and `files`.
+Each file records its native relative `path`, SHA-256 `sha256`, and exact bytes
+as `bytesBase64`. Decode the bytes without rewriting native records. Native
+session paths, root/child records and sidecar metadata preserve associations;
+the bundle does not normalize model, effort, timing, token, or cost statistics.
+Existing unknown metrics remain unknown.
+
+`sevro.host.native-transcripts` records the same capture state and file hashes
+without raw bytes. Semantic and advisory bundles retain their role in the
+bundle and use the existing `sevro.semantic[.<source digest>].` and
+`sevro.advisory.` artifact ID prefixes. Run/trial artifact references supply
+stable private file URLs and whole-bundle hashes after native home cleanup.
+Extensions receive these references through the existing `evaluate` protocol;
+benchmarks can use the same references and decode the native files.
+
+Capture includes native transcript-tree sidecars and refuses descendant links,
+special files and escaping paths. It is bounded to 4,096 directory entries,
+5 MiB of native file bytes and 7 MiB of encoded file metadata/content. The
+bundle remains inside the existing 8 MiB item and 32 MiB host artifact budgets;
+it groups sessions instead of spending an artifact per child. Limits produce
+`byte_limit`, `entry_limit`, or `bundle_limit` issues. Unreadable, unsafe or
+changing entries, malformed/empty native records, malformed JSON sidecars,
+an unknown/missing original session, or incomplete host
+execution produce explicit partial/unavailable capture. `complete` means the
+identified root's tree was captured within those bounds after completed host
+execution and generic syntax/basic record validation. JSONL must contain
+nonempty JSON object records with a nonempty string `type`; JSON sidecars must
+parse as JSON. UTF-8 decoding is strict. One trailing newline and CRLF are
+accepted; blank interior records, invalid encoding and truncated JSON are
+malformed. Unknown native fields and record types remain valid. Issues
+`empty_transcript`, `malformed_transcript` and `malformed_sidecar` downgrade
+capture without rewriting or discarding retained bytes. This validates basic
+structure, not native semantic correctness.
+An empty/missing native JSONL tree is `unavailable`. Failure, cancellation and
+timeout retain available native bytes with incomplete capture state. Raw
+bundles and views are private evidence and must stay out of Git.