@cassiomc1/forgeloop 1.10.0 → 1.10.2

package/docs/diagrams/forgeloop-verification-trust-flow.workflow.json

@@ -11,78 +11,357 @@
       {
         "id": "scope-resolution",
         "label": "Resolve verification scope",
-        "focus": ["claims", "changes", "checker", "cycle", "fingerprints", "scope"],
+        "focus": [
+          "claims",
+          "changes",
+          "checker",
+          "cycle",
+          "fingerprints",
+          "scope"
+        ],
         "note": "Follow the trusted inputs that determine whether a checker may narrow its execution."
       },
       {
         "id": "exact-execution",
         "label": "Bind exact execution",
-        "focus": ["scope", "argv", "observed"],
-        "note": "See how the resolved scope binds the exact argv and observed execution evidence."
+        "focus": [
+          "scope",
+          "argv",
+          "observed"
+        ],
+        "note": "run-check proves execution; manual-review is explicit. Test filters do not establish canonical verification scope."
       },
       {
         "id": "fail-closed",
         "label": "Fail closed when trust is missing",
-        "focus": ["checker", "full", "unresolved", "reject"],
+        "focus": [
+          "checker",
+          "full",
+          "unresolved",
+          "reject"
+        ],
         "note": "No trusted checker means AUTO uses FULL; explicit narrowing without one is unresolved."
       }
     ],
     "legend": {
       "mode": "auto",
       "entries": {
-        "backend": { "label": "Task/provider state" },
-        "database": { "label": "Bound evidence" },
-        "security": { "label": "Trust boundary" },
-        "messagebus": { "label": "Fail-closed result" },
-        "external": { "label": "Task input" }
+        "backend": {
+          "label": "Task/provider state"
+        },
+        "database": {
+          "label": "Bound evidence"
+        },
+        "security": {
+          "label": "Trust boundary"
+        },
+        "messagebus": {
+          "label": "Fail-closed result"
+        },
+        "external": {
+          "label": "Task input"
+        }
       }
     },
-    "viewBox": [720, 900]
+    "viewBox": [
+      850,
+      900
+    ]
   },
   "lanes": [
-    { "id": "inputs", "label": "Task + Revision Inputs" },
-    { "id": "policy", "label": "Trust and Scope Policy" },
-    { "id": "execution", "label": "Exact Execution" },
-    { "id": "evidence", "label": "Observed Evidence" },
-    { "id": "exceptions", "label": "Fail-Closed Outcomes", "variant": "exception" },
-    { "id": "closure", "label": "Verification Boundary" }
+    {
+      "id": "inputs",
+      "label": "Task + Revision Inputs"
+    },
+    {
+      "id": "policy",
+      "label": "Trust and Scope Policy"
+    },
+    {
+      "id": "execution",
+      "label": "Exact Execution"
+    },
+    {
+      "id": "evidence",
+      "label": "Observed Evidence"
+    },
+    {
+      "id": "exceptions",
+      "label": "Fail-Closed Outcomes",
+      "variant": "exception"
+    },
+    {
+      "id": "closure",
+      "label": "Verification Boundary"
+    }
   ],
   "phases": [
-    { "id": "inputs", "label": "Collect bound inputs", "fromCol": 0, "toCol": 1 },
-    { "id": "resolve", "label": "Resolve safe scope", "fromCol": 2, "toCol": 3, "variant": "emphasis" },
-    { "id": "execute", "label": "Execute and observe", "fromCol": 4, "toCol": 5, "variant": "dashed" }
+    {
+      "id": "inputs",
+      "label": "Collect bound inputs",
+      "fromCol": 0,
+      "toCol": 1
+    },
+    {
+      "id": "resolve",
+      "label": "Resolve safe scope",
+      "fromCol": 2,
+      "toCol": 3,
+      "variant": "emphasis"
+    },
+    {
+      "id": "execute",
+      "label": "Execute and observe",
+      "fromCol": 4,
+      "toCol": 5,
+      "variant": "dashed"
+    }
   ],
   "groups": [
-    { "id": "scope_boundary", "label": "Verification scope boundary", "lane": "policy", "fromCol": 2, "toCol": 5, "variant": "emphasis" },
-    { "id": "fail_closed_boundary", "label": "No guessed narrowing", "lane": "exceptions", "fromCol": 2, "toCol": 5, "variant": "security" }
+    {
+      "id": "scope_boundary",
+      "label": "Verification scope boundary",
+      "lane": "policy",
+      "fromCol": 2,
+      "toCol": 5,
+      "variant": "emphasis"
+    },
+    {
+      "id": "fail_closed_boundary",
+      "label": "No guessed narrowing",
+      "lane": "exceptions",
+      "fromCol": 2,
+      "toCol": 5,
+      "variant": "security"
+    }
+  ],
+  "mainPath": [
+    "claims",
+    "changes",
+    "checker",
+    "cycle",
+    "fingerprints",
+    "scope",
+    "argv",
+    "observed"
   ],
-  "mainPath": ["claims", "changes", "checker", "cycle", "fingerprints", "scope", "argv", "observed"],
   "nodes": [
-    { "id": "claims", "lane": "inputs", "col": 0, "type": "external", "label": "Claims", "sublabel": "write scope", "width": 64 },
-    { "id": "changes", "lane": "inputs", "col": 1, "type": "backend", "label": "Changes", "sublabel": "provider", "width": 70 },
-    { "id": "checker", "lane": "policy", "col": 2, "type": "security", "label": "Checker", "sublabel": "trusted scope", "tag": "capability", "width": 64 },
-    { "id": "cycle", "lane": "policy", "col": 3, "type": "backend", "label": "Cycle", "sublabel": "fresh", "width": 50 },
-    { "id": "fingerprints", "lane": "policy", "col": 4, "type": "security", "label": "Bind", "sublabel": "contract/repo", "width": 58 },
-    { "id": "scope", "lane": "evidence", "col": 4, "type": "database", "label": "verify-scope", "sublabel": "AUTO / explicit", "tag": "scope", "width": 82 },
-    { "id": "argv", "lane": "execution", "col": 5, "type": "security", "label": "argv", "sublabel": "paths", "tag": "exact", "width": 50 },
-    { "id": "observed", "lane": "evidence", "col": 5, "type": "database", "label": "Evidence", "sublabel": "executionRef", "tag": "observed", "width": 70 },
-    { "id": "full", "lane": "exceptions", "col": 2, "type": "messagebus", "label": "AUTO → FULL", "sublabel": "no checker", "tag": "safe", "width": 76 },
-    { "id": "unresolved", "lane": "exceptions", "col": 3, "type": "security", "label": "Open", "sublabel": "narrow", "tag": "unresolved", "width": 50 },
-    { "id": "reject", "lane": "exceptions", "col": 4, "type": "security", "label": "Reject", "sublabel": "pre-launch", "tag": "argv drift", "width": 50 },
-    { "id": "boundary", "lane": "closure", "col": 5, "type": "security", "label": "Boundary", "sublabel": "scope/coverage", "width": 64 }
+    {
+      "id": "claims",
+      "lane": "inputs",
+      "col": 0,
+      "type": "external",
+      "label": "Claims",
+      "sublabel": "write scope",
+      "width": 64
+    },
+    {
+      "id": "changes",
+      "lane": "inputs",
+      "col": 1,
+      "type": "backend",
+      "label": "Changes",
+      "sublabel": "provider",
+      "width": 70
+    },
+    {
+      "id": "checker",
+      "lane": "policy",
+      "col": 2,
+      "type": "security",
+      "label": "Checker",
+      "sublabel": "trusted scope",
+      "tag": "capability",
+      "width": 64
+    },
+    {
+      "id": "cycle",
+      "lane": "policy",
+      "col": 3,
+      "type": "backend",
+      "label": "Cycle",
+      "sublabel": "fresh",
+      "width": 50
+    },
+    {
+      "id": "fingerprints",
+      "lane": "policy",
+      "col": 4,
+      "type": "security",
+      "label": "Bind",
+      "sublabel": "contract/repo",
+      "width": 58
+    },
+    {
+      "id": "scope",
+      "lane": "evidence",
+      "col": 4,
+      "type": "database",
+      "label": "verify-scope",
+      "sublabel": "AUTO / explicit",
+      "tag": "scope",
+      "width": 82
+    },
+    {
+      "id": "argv",
+      "lane": "execution",
+      "col": 5,
+      "type": "security",
+      "label": "argv",
+      "sublabel": "paths",
+      "tag": "exact",
+      "width": 50
+    },
+    {
+      "id": "observed",
+      "lane": "evidence",
+      "col": 5,
+      "type": "database",
+      "label": "Evidence",
+      "sublabel": "executionRef",
+      "tag": "observed",
+      "width": 70
+    },
+    {
+      "id": "full",
+      "lane": "exceptions",
+      "col": 2,
+      "type": "messagebus",
+      "label": "AUTO \u2192 FULL",
+      "sublabel": "no checker",
+      "tag": "safe",
+      "width": 76
+    },
+    {
+      "id": "unresolved",
+      "lane": "exceptions",
+      "col": 3,
+      "type": "security",
+      "label": "Open",
+      "sublabel": "narrow",
+      "tag": "unresolved",
+      "width": 50
+    },
+    {
+      "id": "reject",
+      "lane": "exceptions",
+      "col": 4,
+      "type": "security",
+      "label": "Reject",
+      "sublabel": "pre-launch",
+      "tag": "argv drift",
+      "width": 50
+    },
+    {
+      "id": "boundary",
+      "lane": "closure",
+      "col": 5,
+      "type": "security",
+      "label": "Boundary",
+      "sublabel": "scope/coverage",
+      "width": 64
+    }
   ],
   "edges": [
-    { "id": "claims-changes", "from": "claims", "to": "changes", "variant": "emphasis" },
-    { "id": "changes-checker", "from": "changes", "to": "checker", "variant": "default", "route": "drop", "fromSide": "bottom", "toSide": "top" },
-    { "id": "checker-cycle", "from": "checker", "to": "cycle", "variant": "emphasis" },
-    { "id": "cycle-fingerprints", "from": "cycle", "to": "fingerprints", "variant": "security", "fromSide": "bottom", "toSide": "bottom", "route": "bottom-channel", "channelY": 312 },
-    { "id": "fingerprints-scope", "from": "fingerprints", "to": "scope", "variant": "emphasis", "fromSide": "bottom", "toSide": "top", "route": "drop" },
-    { "id": "scope-argv", "from": "scope", "to": "argv", "variant": "security", "fromSide": "right", "toSide": "left", "route": "bottom-channel", "channelY": 408 },
-    { "id": "argv-observed", "from": "argv", "to": "observed", "variant": "dashed", "fromSide": "bottom", "toSide": "top", "route": "drop" },
-    { "id": "checker-full", "from": "checker", "to": "full", "variant": "dashed", "role": "branch", "fromSide": "left", "toSide": "right", "route": "return-left" },
-    { "id": "checker-unresolved", "from": "checker", "to": "unresolved", "variant": "security", "role": "error", "fromSide": "bottom", "toSide": "top", "route": "drop" },
-    { "id": "scope-reject", "from": "scope", "to": "reject", "variant": "security", "role": "error", "fromSide": "bottom", "toSide": "top", "route": "drop" },
-    { "id": "observed-boundary", "from": "observed", "to": "boundary", "variant": "dashed", "role": "branch", "fromSide": "left", "toSide": "right", "route": "return-left" }
+    {
+      "id": "claims-changes",
+      "from": "claims",
+      "to": "changes",
+      "variant": "emphasis"
+    },
+    {
+      "id": "changes-checker",
+      "from": "changes",
+      "to": "checker",
+      "variant": "default",
+      "route": "drop",
+      "fromSide": "bottom",
+      "toSide": "top"
+    },
+    {
+      "id": "checker-cycle",
+      "from": "checker",
+      "to": "cycle",
+      "variant": "emphasis"
+    },
+    {
+      "id": "cycle-fingerprints",
+      "from": "cycle",
+      "to": "fingerprints",
+      "variant": "security",
+      "fromSide": "bottom",
+      "toSide": "bottom",
+      "route": "bottom-channel",
+      "channelY": 312
+    },
+    {
+      "id": "fingerprints-scope",
+      "from": "fingerprints",
+      "to": "scope",
+      "variant": "emphasis",
+      "fromSide": "bottom",
+      "toSide": "top",
+      "route": "drop"
+    },
+    {
+      "id": "scope-argv",
+      "from": "scope",
+      "to": "argv",
+      "variant": "security",
+      "fromSide": "right",
+      "toSide": "left",
+      "route": "bottom-channel",
+      "channelY": 408
+    },
+    {
+      "id": "argv-observed",
+      "from": "argv",
+      "to": "observed",
+      "variant": "dashed",
+      "fromSide": "bottom",
+      "toSide": "top",
+      "route": "drop"
+    },
+    {
+      "id": "checker-full",
+      "from": "checker",
+      "to": "full",
+      "variant": "dashed",
+      "role": "branch",
+      "fromSide": "left",
+      "toSide": "right",
+      "route": "return-left"
+    },
+    {
+      "id": "checker-unresolved",
+      "from": "checker",
+      "to": "unresolved",
+      "variant": "security",
+      "role": "error",
+      "fromSide": "bottom",
+      "toSide": "top",
+      "route": "drop"
+    },
+    {
+      "id": "scope-reject",
+      "from": "scope",
+      "to": "reject",
+      "variant": "security",
+      "role": "error",
+      "fromSide": "bottom",
+      "toSide": "top",
+      "route": "drop"
+    },
+    {
+      "id": "observed-boundary",
+      "from": "observed",
+      "to": "boundary",
+      "variant": "dashed",
+      "role": "branch",
+      "fromSide": "left",
+      "toSide": "right",
+      "route": "return-left"
+    }
   ],
   "cards": [
     {
@@ -91,7 +370,8 @@
       "items": [
         "AUTO uses CHANGED or CLAIMED only with a trusted scoped checker",
         "Without that capability, AUTO resolves safely to FULL",
-        "Explicit CHANGED or CLAIMED without a checker returns unresolved"
+        "Explicit CHANGED or CLAIMED without a checker returns unresolved",
+        "A test name or file filter is not a canonical scope boundary"
       ]
     },
     {
@@ -100,7 +380,8 @@
       "items": [
         "RevisionProvider changes and task claims are canonical inputs",
         "Contract, repository, and cycle fingerprints bind the scope",
-        "argv prefix and selected paths are checked before launch"
+        "argv prefix and selected paths are checked before launch",
+        "Manual evidence declares manual-review; command metadata is not execution"
       ]
     },
     {

package/docs/diagrams/reviews/forgeloop-code-attestation-flow.review.json

@@ -3,8 +3,8 @@
   "diagramId": "forgeloop-code-attestation-flow",
   "status": "approved",
   "binding": {
-    "sourceSha256": "669966fba9e69df0525a3581baa4e90075923dbe3069f81f706761a40abf9073",
-    "svgSha256": "0af63dd51683d07981fc681042c437377a78ae8a7e6a7175c18a1def02e6280a"
+    "sourceSha256": "33bb9c3c4f3fb4a793febeab34b2d07ca7bf2c058d4f5e7575dba3a6065eedeb",
+    "svgSha256": "3a768148886ffdfcce75221c11e51ee77a3702510e90917bf6e8ba0581ebdb44"
   },
   "checks": {
     "darkThemeLegible": true,
@@ -15,6 +15,6 @@
     "textFallbackEquivalent": true,
     "accessibleMetadataPresent": true
   },
-  "reviewedBy": "repository-maintainer",
-  "reviewedAt": "2026-08-29"
+  "reviewedBy": "Codex visual review",
+  "reviewedAt": "2026-09-05"
 }

package/docs/diagrams/reviews/forgeloop-engineering-flow.review.json

@@ -3,8 +3,8 @@
   "diagramId": "forgeloop-engineering-flow",
   "status": "approved",
   "binding": {
-    "sourceSha256": "a83128a8639db5db497ac552cfdbc318839e6451c718581fbfcd064e3e869981",
-    "svgSha256": "37244a07cc862e3fe4a7188f5236a509a4adf565d5b785ba3c0932057ac6f3a8"
+    "sourceSha256": "0bfd5bbf8d6bbeaec23db543deb1e99844321c77b3c7feb21ee0cc877bbba9a9",
+    "svgSha256": "ef3effe7e756494c7dffef9ee315e970bbbdb9fddc0ee0a1e4bfccfbb0c05534"
   },
   "checks": {
     "darkThemeLegible": true,
@@ -15,6 +15,6 @@
     "textFallbackEquivalent": true,
     "accessibleMetadataPresent": true
   },
-  "reviewedBy": "repository-maintainer",
-  "reviewedAt": "2026-08-29"
+  "reviewedBy": "Codex visual review",
+  "reviewedAt": "2026-09-05"
 }

package/docs/diagrams/reviews/forgeloop-verification-trust-flow.review.json

@@ -3,8 +3,8 @@
   "diagramId": "forgeloop-verification-trust-flow",
   "status": "approved",
   "binding": {
-    "sourceSha256": "6fe11b0530cc6640f7b0f07d0f2d7e5a1f961745491f39016b340bc354af0e79",
-    "svgSha256": "e225c69f2ec90f403c394d88b5d41af75363c7fa336181ee85664f5d495f4555"
+    "sourceSha256": "ba0016d705a7d89be0cdff7529b29112e844ef806ae9f87a1bbff8db8c109043",
+    "svgSha256": "5c63af3190251de5b6268c62ea5a6ae6fb325fe20fd9a69e996a95566fe6ebd0"
   },
   "checks": {
     "darkThemeLegible": true,
@@ -15,6 +15,6 @@
     "textFallbackEquivalent": true,
     "accessibleMetadataPresent": true
   },
-  "reviewedBy": "repository-maintainer",
-  "reviewedAt": "2026-08-29"
+  "reviewedBy": "Codex visual review",
+  "reviewedAt": "2026-09-05"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cassiomc1/forgeloop",
-  "version": "1.10.0",
+  "version": "1.10.2",
   "description": "Portable, verifiable engineering protocol for AI coding environments and developer workflows",
   "repository": {
     "type": "git",
@@ -52,6 +52,7 @@
     "docs/GETTING_STARTED.md",
     "docs/CROSS_HARNESS_CONTINUITY.md",
     "docs/ADVISORY_CONTEXT.md",
+    "docs/RIPWIRE_ADAPTER.md",
     "docs/CLI_REFERENCE.md",
     "docs/ARTIFACT_REFERENCE.md",
     "docs/TROUBLESHOOTING.md",
@@ -59,6 +60,7 @@
     "docs/STRUCTURAL_QUALITY.md",
     "docs/DOCUMENTATION_GUIDE.md",
     "docs/RELEASE_CHECKLIST.md",
+    "docs/PACKAGE_CONTENTS.md",
     "scripts/CI_VALIDATORS.md",
     "docs/MCP.md",
     "docs/UNIVERSAL_INTEGRATION.md",
@@ -85,7 +87,11 @@
     "scripts/check-changelog-freshness.mjs",
     "scripts/write-forgeloop-attestation-summary.mjs",
     "completions",
-    "integrations/generic-ci"
+    "integrations/generic-ci",
+    "!src/core/gates.js",
+    "!src/core/decision-classification.js",
+    "!src/core/workflow-compatibility.js",
+    "!src/core/cli-metadata.js"
   ],
   "scripts": {
     "test": "node scripts/run-tests.js",
@@ -123,11 +129,15 @@
     "benchmark:profiles:check": "node scripts/validate-execution-profile-benchmarks.mjs",
     "benchmark:profiles:outliers": "node scripts/report-execution-profile-outliers.mjs",
     "benchmark:profiles:tail-analysis": "node scripts/report-tail-interpretation.mjs",
-    "benchmark:profiles:regression": "node scripts/check-efficiency-regression.mjs"
+    "benchmark:profiles:regression": "node scripts/check-efficiency-regression.mjs",
+    "transactions:compact": "node scripts/compact-transactions.mjs",
+    "complexity:check": "node scripts/check-complexity.mjs"
   },
   "devDependencies": {
     "c8": "^12.0.0",
-    "eslint": "^9.39.5"
+    "eslint": "^9.39.5",
+    "typescript": "7.0.2",
+    "yaml": "2.9.0"
   },
   "exports": {
     ".": "./src/cli.js",

package/scripts/CI_VALIDATORS.md

@@ -40,3 +40,27 @@ Maintainers should distinguish between actual documentation link failures and ex
 
 - **Link-content failure (`Lychee`)**: The link checking step runs with `--verbose` and outputs the exact failing URL along with the HTTP status code (e.g. 404, 403). If a documentation URL is broken, update the link in the source Markdown. If a legitimate external host blocks shared CI runners or aggressively rate-limits CI automation, add a minimal, targeted exclusion in `.lychee.toml` with an explanatory comment.
 - **Action-download / Runner infrastructure failure (GitHub 429/502/503)**: When GitHub Actions fails during action checkout or tool download before running the test steps, this is a transient infrastructure issue rather than a project defect. Rerun the workflow without modifying project files.
+
+## Node verification and receipt availability
+
+The documentation workflow runs the documentation/tooling gates once on
+Linux with Node 24. Full suites cover Linux 20/22/24 and macOS/Windows 20/24,
+with no repeated platform/version pair in that workflow. Node 24 Linux also
+collects coverage. Package-content tests share one pack listing within their
+process. The dedicated Windows main-branch workflow remains separate.
+
+The historical required status `validate (22)` is retained as an aggregate
+gate over validation, the full portability matrix, and diagram checks. It
+fails if any prerequisite fails, is cancelled, or is skipped. This preserves
+the existing branch ruleset without running another duplicate test suite.
+
+`npm run lint`, `npm run complexity:check`, and
+`npm run critical-coverage:check` retain independent purposes: syntax and
+usage correctness, hotspot growth, and coverage of critical modules. Packed
+TypeScript consumers validate the public declarations; YAML-based tests
+validate workflow semantics. The core runtime remains dependency-free.
+
+`scripts/audit-receipts.mjs` runs after checkout. It audits supplied scoped
+receipts with explicit task IDs, fails on an invalid audit, and reports
+`NOT_VERIFIED` when none are supplied. This repository job does not create
+lifecycle evidence from CI test results.

package/scripts/check-critical-coverage.mjs

@@ -8,6 +8,15 @@ const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url))
 const summaryPath = path.join(repositoryRoot, "coverage", "coverage-summary.json");
 
 export const CRITICAL_COVERAGE_THRESHOLDS = Object.freeze({
+  "src/core/next-action.js": { lines: 90, branches: 80 },
+  "src/core/next-action-phases.js": { lines: 70, branches: 70 },
+  "src/core/verification-execution.js": { lines: 85, branches: 70 },
+  "src/core/transaction.js": { lines: 90, branches: 75 },
+  "src/core/completion.js": { lines: 85, branches: 55 },
+  "src/core/preflight.js": { lines: 90, branches: 75 },
+  "src/core/events.js": { lines: 85, branches: 75 },
+  "src/core/installation-authority.js": { lines: 95, branches: 90 },
+  "src/core/trusted-authority.js": { lines: 85, branches: 70 },
   "src/core/repository.js": { lines: 80, branches: 60 },
   "src/core/policy-discovery.js": { lines: 75, branches: 45 },
   "src/core/policy-adapters.js": { lines: 70, branches: 45 },