@dailephd/my-dev-kit-lab 0.4.4 → 0.4.5

package/CHANGELOG.md

@@ -0,0 +1,468 @@
+# Changelog
+
+All notable changes to my-dev-kit-lab are documented here.
+
+## [0.4.5] - 2026-08-01
+
+Context-integrity validation for the published my-dev-kit v1.10.4 and my-dev-kit-orchestrator v1.2.3 contracts.
+
+- Added exact readers for the frozen local my-dev-kit v1.10.4 condition-aware producer contract (`roleConditionCoverage`, allocation/spillover `GroupTruncationEntry` fields, `truncation.requiredEvidenceLost`) in `src/evaluation/upstreamArtifacts`.
+- Added allocation, spillover, condition-coverage, and producer-condition agreement metrics in `src/evaluation/stageContextMetrics`.
+- Added exact readers and selectors for the frozen local my-dev-kit-orchestrator v1.2.3 run-integrity contract (`RunIntegrityGateResult`, `JudgeIntegrityResult`, `FinalReportEligibilityResult`, and `artifact-state.json` lifecycle records) in `src/evaluation/upstreamArtifacts` and `src/evaluation/stageContextSelectors`.
+- Added run-integrity agreement calculators (readiness/prompt, readiness/expected-judge, expected/actual-judge, judge/correction, judge/final-eligibility, eligibility/final-artifact, and lifecycle-integrity agreement), composed additively into the existing `evaluateProducerReadinessBridge`.
+- Added a frozen, hash-verified ecosystem regression fixture pair under `tests/fixtures/ecosystem/context-integrity/v0.4.5/`: a byte-exact real historical failed run, and a corrected-replay fixture that is a hand-distilled representation of the exact validated local v1.10.4/v1.2.3 contracts for the same request, target, and index identity — not a live capture of a complete ten-stage workflow, and not proof that every future run will behave identically. Added manifest/hash verification, determinism, and fixture self-immutability checks.
+- Added a bounded `ContextIntegrityReportV1` JSON/text/HTML report layer in `src/report/experiments`, reusing the existing bounded-list/availability report primitives rather than duplicating them.
+- All new inputs are read from fixtures or supplied programmatically; there is no CLI flag or command for this evaluation. No composite score, grade, ranking, or winner is produced, and no upstream producer, readiness, judge, correction, or lifecycle policy is duplicated. The orchestrator agreement evidence does not read a literal upstream `promptMode` field; `stageMayRenderNormalPrompt`, derived from structured blocked-stage evidence, is the bounded substitute used instead.
+
+## [0.4.4] - 2026-07-29
+
+- Added exact readers for the frozen my-dev-kit-orchestrator supplemental implementation/test-context packet and retrieval-report documents and a bounded plain-object adapter for the orchestrator readiness result.
+- Added deterministic owner, allocation, truncation-cause, supplemental/raw agreement, readiness-agreement, and criticality-overlay metrics.
+- Added an additive producer-readiness bridge evaluator wired into the existing `combined-bounded-stage-context` strategy and reported through the existing bounded `report.json`/`report.html`/`report.txt` pipeline as an optional section.
+- All new inputs are optional and programmatic; existing v0.4.3 strategies, fixtures, and reports are unaffected when they are absent. No public CLI flags were added, and no upstream owner-selection, allocation, producer-parity, or readiness policy was duplicated.
+- Release documentation finalized to post-publication state; coordinated upstream my-dev-kit@1.10.3 + orchestrator@1.2.2 verified published before lab release.
+
+## [0.4.3] - 2026-07-22
+
+`v0.4.3` (stage-specific bounded-context and workflow-instruction evaluation) is published. `v0.4.4` is the current release. Its complete scope, dependencies, exclusions, and acceptance criteria are preserved in [docs/ROADMAP.md](docs/ROADMAP.md).
+
+### Added
+
+- Added exact, non-normalizing readers for the my-dev-kit `ContextCapsule` and `RetrievalAuditRecord` and the my-dev-kit-orchestrator `WorkflowInstructionPacket`, each with schema-major validation and explicit failure on malformed or unsupported input.
+- Extended the existing `context-strategy-comparison` plugin with six new stage-context strategies — `architecture-context-only`, `architecture-plus-implementation-refresh`, `architecture-plus-implementation-and-test-refresh`, `full-workflow-library`, `bounded-workflow-instruction-packet`, and `combined-bounded-stage-context` — selected through programmatic configuration alongside the preserved `raw-full-file` and `my-dev-kit-guided` strategies.
+- Added an explicit stage-context expectation fixture contract (required/allowed/forbidden evidence, expected artifact states) and deterministic expectation matching against selected evidence.
+- Added evidence-centered metrics: required-evidence recall, allowed-evidence coverage, forbidden-evidence inclusion, irrelevant-file/irrelevant-instruction inclusion, required-provenance recall, responsibility-mapping completeness, state comparisons, and context-size measurement, each reporting explicit `available`/`unavailable`/`not-applicable` status rather than coercing missing data to zero.
+- Added read-only target-immutability snapshots (configured-file hashes and Git state) and before/after comparison, and repeated-run determinism (1–10 runs, canonical-serialization SHA-256 digests) as run-assurance evidence.
+- Added bounded, deterministic `report.json`, `report.html`, and `report.txt` outputs for the new stage-context evidence through the existing `src/report/experiments` plugin report system, with a neutral interpretation that does not calculate a composite score, grade, ranking, or winning strategy.
+
+### Compatibility and limitations
+
+- No new CLI flags were added for the six new strategies; they are configured programmatically, not through `experiment:run` options.
+- Plots, screenshots, and gallery integration for the new stage-context evidence are not part of this implementation.
+- The published upstream artifacts do not expose considered-but-unselected reads or unnecessary-read evidence; those metrics are reported as `unavailable` with an explicit reason.
+- Estimated token counts use `ceil(characterCount / 4)` per source and are not provider telemetry.
+
+## [0.4.2] - 2026-07-12
+
+Extended the existing general security audit adapter with Android-aware validation.
+
+### Added
+
+- Extended the existing general security audit adapter with an explicit `--android` opt-in when `--types` includes `security`, and added `--help`/`-h` to the `audit` CLI.
+- Added direct programmatic Android validation reusing the existing `SecurityFinding`-to-`AuditIssue` mapping, with Android requested/applicable/status/verdict summaries, confirmed-finding and mapped-issue counts, and separate `CandidateEvidence` summaries that are never mapped to a confirmed `AuditIssue`.
+- Added contained Android text/JSON report references and a bounded Android section in both the generic audit text report and the generic audit JSON report (a 17th top-level `androidSecurity` field), with text/JSON parity.
+- Isolated Android validator failures from the rest of the audit run: a thrown Android error is captured as a bounded, stack-trace-free failure status without discarding already-collected non-Android issues.
+- Preserved deterministic issue ordering and aggregation: non-Android issues are ordered first, Android issues follow in check/finding order, and repeated runs against unchanged fixtures produce identical issue IDs, order, and summary counts.
+- Preserved standalone `security:validate` as the authoritative source of complete Android validation evidence; the audit adapter only reuses and links to it.
+- Added a required `Check documentation consistency` (`npm run docs:check`) step to both the pre-release Node 26 readiness workflow and ordinary CI, running on every operating system in the existing Windows/macOS/Linux matrix, so documentation/roadmap consistency is verified cross-platform before broader validation.
+
+### Compatibility and limitations
+
+- The default audit path starts no Android validation. The opted-in Android path remains static and starts zero Gradle, external-tool, and network processes by default.
+- Manual pentest, runtime/device analysis, APK/AAB inspection, signing verification, and automatic fixes remain out of scope.
+
+## [0.4.1] - 2026-07-12
+
+Added advanced Android security validation on top of v0.4.0. At publication, v0.4.1 superseded v0.4.0.
+
+### Added
+
+- Added the advanced Android rule/evidence substrate and eleven internal advanced check families: Network Security Config and cleartext traffic review, backup and data-extraction-rules review, debuggable and release configuration review, redacted hardcoded-secret detection, signing-configuration leak review, WebView and FileProvider analysis, sensitive storage/logging/clipboard analysis, and Firebase and Google services configuration and local rules review.
+- Added opt-in Semgrep, OSV-Scanner, Android Lint, and OWASP Dependency-Check evidence with closed tool IDs, bounded artifacts, and default network denial.
+- Activated nineteen default Android checks (eight `v0.4.0` checks plus eleven `v0.4.1` advanced internal checks) and added explicit `--android-external-tools` and `--android-external-network` CLI options.
+- Added CandidateEvidence presentation plus advanced-security, external-tool, artifact, and candidate summaries to both text and JSON reports, with text/JSON parity.
+
+### Compatibility and limitations
+
+- Default Android validation starts zero Gradle operations, zero external-tool processes, and zero network operations.
+- Advanced checks remain static-analysis-based and conservative: no APK/AAB inspection, no signing verification, no emulator/device validation, and no Play compliance or manual penetration testing.
+- Optional Semgrep/OSV-Scanner/Android Lint/Dependency-Check evidence depends on external tool availability; missing tools are skipped, not treated as failures.
+- Android AuditIssue mapping remains future `v0.4.2` work.
+
+## [0.4.0] - 2026-07-11
+
+Android/mobile validation MVP published as `v0.4.0`.
+
+### Added
+
+- Added the Android/mobile validation substrate and the canonical `security:validate --profile android` path.
+- Added Android project detection and classification (application, library, multi-module, mixed, partial, and non-Android targets) and Compose/XML/mixed/uncertain UI-toolkit classification.
+- Added independent `AndroidManifest.xml` parsing across modules, with permission, exported-component, intent-filter, and deep-link audit families producing conservative `SecurityFinding` evidence.
+- Added static Gradle wrapper and module metadata extraction: namespace, applicationId, versionCode/versionName, minSdk/targetSdk/compileSdk, build-type/source-set metadata, Android Gradle Plugin/Kotlin Android/Compose evidence, and version-catalog evidence.
+- Added an explicitly opt-in, five-operation allowlisted Gradle validation path (`--android-gradle-operations wrapper-version,tasks,assemble-debug,unit-test-debug,lint-debug`) that never executes arbitrary Gradle tasks and is disabled by default.
+- Added Android text and JSON reports under the existing `reports/security/` root, an Android verdict policy, release-metadata summaries, Play-readiness checklist placeholders, and target-mutation evidence.
+- Added `security:validate --help` / `-h` no-work help handling and unknown top-level option rejection.
+
+### Compatibility and limitations
+
+- `v0.4.0` preserves the existing `security:validate` command surface and report root; it adds the `android` profile and `--android-gradle-operations` option without changing any other profile's behavior.
+- Android manifests are parsed independently and are not merged; selected local references are resolved conservatively while full overlays are not; Gradle files are parsed statically and are not evaluated; dynamic Gradle values may remain unresolved.
+- `v0.4.0` does not inspect APK/AAB contents, validate signing, run emulators/devices, verify Digital Asset Links or domain ownership, check live Google Play policy, upload applications, or provide automatic fixes.
+- `v0.4.1` advanced Android checks and `v0.4.2` Android audit-adapter mapping remain planned and out of scope. Manual pentest remains a deferred, post-v1 / version-TBD workflow, not assigned to v0.4.x.
+
+## [0.3.4] - 2026-07-10
+
+Published package version 0.3.4, superseding v0.3.3.
+
+### Added
+
+- Added mixed-language audit stability coverage across the committed Batch 1 fixture corpus and full detector registry.
+- Added repeated-run audit report determinism coverage for JSON/text output, security-summary isolation, and run-order stability.
+- Added focused cross-platform/path and CRLF/LF stability coverage in `tests/audits/crossPlatformPathStability.test.ts`, including separator normalization, paths with spaces, report output safety, security report filename-prefix sanitization, and Java/Kotlin/docs-code-mismatch line-ending robustness.
+
+### Changed
+
+- Hardened `collectSourceFacts()` to normalize inventory `relativePath` values before reading files or returning source-fact identities, so separator-only path variants do not leak into analyzer inputs, report evidence, or downstream lookups.
+- Reconciled README/current-state/roadmap/architecture/commands/workflows/project-overview/security docs with the published `v0.3.4` state, with `v0.3.3` documented as the previous published baseline.
+
+### Compatibility and limitations
+
+- `v0.3.4` preserves the existing command surface: it does not change audit/security command names, add new CLI commands, or modify the audit report schema or `SourceFacts` schema.
+- `v0.3.4` keeps `quality`, `project`, and `all` audit types planned and not implemented.
+- `v0.3.4` keeps Android validation, Gradle/Maven execution, Java/Kotlin compiler execution, JVM dependency freshness checks, and JVM package/environment rot detection out of scope.
+
+## [0.3.3] - 2026-07-10
+
+Java/Kotlin code-rot support, published on top of the previously published `v0.3.2` baseline. Package metadata is `0.3.3`; the npm registry now contains `0.3.3`. `v0.3.2` remains the previous published baseline.
+
+### Added
+
+- Added dependency-free Java and Kotlin source-facts analyzers (`src/audits/core/javaAnalyzer.ts`, `src/audits/core/kotlinAnalyzer.ts`) and registered them in the language analyzer registry alongside the existing TypeScript/JavaScript and Python analyzers.
+- Added JVM project metadata collection (`src/audits/core/jvmProjectMetadata.ts`) for static Gradle/Maven/wrapper/source-set presence and a best-effort project name. It never executes Gradle, Maven, compilers, or target tests.
+- Added shared JVM source-facts helpers (`src/audits/codeRot/utils/jvmSourceFactsUtils.ts`) reused by Java/Kotlin detector integrations.
+- Added Java/Kotlin source-facts-aware signals to the existing `dead-code-candidate`, `duplicate-implementation-candidate`, and `test-rot` detectors, with conservative JVM-specific evidence wording.
+- Added Java/Kotlin docs-code-mismatch support for backtick-quoted FQCN-shaped symbol claims and static Gradle/Maven command/feature claims. Android current-state mismatch detection remains part of the existing docs-code-mismatch mechanism only.
+- Added focused Java/Kotlin analyzer, JVM metadata, detector, and mixed-language integration coverage under `tests/audits/`.
+
+### Changed
+
+- Preserved the existing audit command surface: `npm run audit -- --types code-rot`, `--types security`, and `--types code-rot,security` remain the implemented audit paths, with `code-rot` still the only default audit type.
+- Preserved the existing audit report schema: no `SourceFacts` schema change, no new top-level audit report field, and no new audit type were added for `v0.3.3`.
+
+### Compatibility and limitations
+
+- Java/Kotlin analysis is conservative and scanner-based. It does not perform compiler parsing, type resolution, classpath/symbol resolution, runtime reachability analysis, or target-project test execution.
+- Java/Kotlin support does not execute Gradle, Maven, Android tooling, or network-backed dependency checks. Static JVM metadata is presence/simple-text-extraction only.
+- Java/Kotlin field/property extraction, Java text-block special handling, Kotlin extension-function receiver semantics, and method/constructor-level dead-code detection are not implemented.
+- JVM package/environment rot remains deferred because the existing `dependency-environment-rot` detector is still npm/Node-specific.
+- `security:validate` remains preserved and unchanged from `v0.3.2`.
+- `quality`, `project`, and `all` audit types remain planned; `--types quality`/`project`/`all` still fail cleanly with exit code 2.
+- Android validation remains planned and out of scope for `v0.3.3`.
+
+## [0.3.2] - 2026-07-09
+
+Python code-rot support and a first security-validation audit adapter, implemented on top of the published `v0.3.1` baseline. Published.
+
+### Added
+
+- Added a dependency-free Python source-facts analyzer (`src/audits/core/pythonAnalyzer.ts`) that extracts imports (including relative dotted imports), `__all__`, and module-level/class-body declarations from `.py` files, registered in the language analyzer registry alongside the existing TypeScript/JavaScript analyzer.
+- Added Python project/config metadata collection (`src/audits/core/pythonProjectMetadata.ts`): presence detection for `pyproject.toml`, `requirements.txt`, `setup.py`, `setup.cfg`, `tox.ini`, and `pytest.ini`, plus a best-effort project name and pytest-configuration flag. Never executes Python/pip/pytest/tox tooling.
+- Added Python-aware signals to the existing `dead-code-candidate`, `duplicate-implementation-candidate`, and `test-rot` code-rot detectors, using an analyzer-id-scoped grouping key so the pre-existing TypeScript/JavaScript duplicate-declaration grouping is unaffected.
+- Added `sourceFacts.filesWithDiagnosticsCount` to the audit report's source-facts summary — a language-agnostic count of analyzed files carrying at least one per-file diagnostic.
+- Added `pythonProjectMetadata` as a top-level audit report field (JSON and text), populated unconditionally alongside `sourceFacts`.
+- Added the security-validation audit adapter (`src/audits/security/securityAuditAdapter.ts`, `mapSecurityFindingToAuditIssue.ts`, `securityAuditTypes.ts`): `npm run audit -- --types security` and `npm run audit -- --types code-rot,security` now run security validation through the shared audit/report surface by calling `runSecurityValidation()` directly (no shelling out to `security:validate`, no console-text parsing).
+- Added `securitySummary` as a top-level audit report field (JSON and text): verdict, check counts by status, finding counts by severity, mapped-issue count, and paths to the original `reports/security/*.txt`/`*.json` report.
+- Added mapping of `SecurityFinding` results into audit-issue-shaped entries (`auditType: "security"`), preserving severity (blocker/major/minor/informational → blocker/high/medium/info), affected files, recommendation text, and release/implementation-blocking semantics. Skipped optional security checks never appear as issues or as a passed result.
+- `security` is now an implemented `--types` value (`IMPLEMENTED_AUDIT_TYPES`), deliberately kept out of `DEFAULT_AUDIT_TYPES` so a default, no-flag `npm run audit` run is unchanged (still `code-rot` only).
+
+### Changed
+
+- Extracted the `SecurityReport`-object-assembly step out of `scripts/security/validate.ts` into `src/securityValidation/report/buildSecurityReport.ts` so the audit adapter can reuse it without duplicating logic. Output of `security:validate` is unchanged.
+- Widened `reportFilenamePrefix()`'s parameter type to a narrow `Pick<SecurityValidationTarget, ...>` so the audit adapter can call it without re-resolving the validation target a second time. All existing callers are unaffected.
+
+### Compatibility and limitations
+
+- `npm run security:validate` (self and `--target <path>`) is unchanged — verified against the full existing security test suite plus a live smoke run.
+- `npm run audit -- --types code-rot` is unchanged.
+- The audit report's top-level schema grows from 14 fields (`v0.3.1`) to 16 fields: `pythonProjectMetadata` and `securitySummary` are additive; `schemaVersion` stays `"1.0"`.
+- Python static analysis remains conservative: regex/line-based, dependency-free, single-file. It does not perform Python runtime execution, type checking, dependency resolution, or cross-file call-graph analysis. `references` are intentionally left empty for Python (no call/identifier tracking).
+- Java and Kotlin remain fallback-only; no analyzer is registered for them.
+- `quality`, `project`, and `all` audit types remain planned; `--types quality`/`project`/`all` still fail cleanly with exit code 2.
+- The security audit adapter runs the same default check groups `security:validate` uses with no flags (`deps`, `package`, `static`, `cli-adversarial`, `fuzz`); there is no `--checks`/`--profile` passthrough on the `audit` command.
+
+## [0.3.1] - 2026-07-09
+
+Language-aware code-rot substrate plus TypeScript/JavaScript support. Published.
+
+### Added
+
+- Added normalized language and file-role metadata to the audit inventory scanner, including `filesByLanguage` and `filesByRole` report summaries.
+- Added the source facts model, source facts collector, language analyzer registry, and fallback behavior for eligible source/test files without a registered analyzer.
+- Added the syntax-only TypeScript/JavaScript analyzer for `.ts`, `.tsx`, `.mts`, `.cts`, `.js`, `.jsx`, `.mjs`, and `.cjs` files.
+- Added source-facts-aware code-rot signals:
+  - `dead-code-candidate` merges parsed relative import/re-export basenames into reverse-reference checks.
+  - `duplicate-implementation-candidate` adds source-facts-derived duplicate exported declaration candidate signals.
+  - `test-rot` uses analyzer-recorded relative imports, including dynamic `import()`, to find missing targets missed by regex-only scanning.
+- Added source-facts summaries to JSON and text audit reports. JSON reports include top-level `sourceFacts`; text reports include a `Source facts` section.
+- Added end-to-end and focused tests for source facts collection, TypeScript/JavaScript analyzer behavior, detector integration, report model/rendering, and the real audit registry path.
+- Added the latest-Node cross-platform readiness workflow for `windows-latest`, `macos-latest`, and `ubuntu-latest` on Node `26.5.0`.
+
+### Fixed
+
+- Fixed `.mts` and `.cts` source-role eligibility for source-facts collection.
+- Fixed audit text rendering so an evidence entry with both `message` and `excerpt` renders both.
+- Fixed the audit validation reliability issue by isolating the expensive `security:validate` smoke path in the audit command tests and pinning Vitest worker settings with `vitest.config.ts`.
+
+### Compatibility and limitations
+
+- No audit command flags were added or changed.
+- Audit issue shape remains unchanged.
+- Python, Java, and Kotlin remain fallback-only in `v0.3.1`; no parser/analyzer is registered for them.
+- TypeScript/JavaScript analysis is syntax-only and single-file. It does not perform TypeScript Program semantic analysis, type checking, full module resolution, `tsconfig` path alias resolution, coverage analysis, clone detection, runtime reachability analysis, or target-file modification.
+- Audit findings remain heuristic and conservative; they are candidates for review, not proof of a defect.
+
+## [0.3.0] - Published
+
+Generic audit framework and code-rot detector. Published; superseded by `v0.3.1` as the current published baseline.
+
+### Added
+
+- Added `npm run audit` command (`scripts/audits/runAudit.ts`) as the audit framework CLI entrypoint.
+- Added the generic audit framework in `src/audits`: target resolution, config/flag parsing (`--target`, `--types`, `--include`, `--format`, `--fail-on`, `--out`), detector registry, and exit-code policy (`0`/`1`/`2`).
+- Added a project inventory scanner and a source-of-truth collector so detectors read pre-collected, consistent project state instead of re-scanning.
+- Added the code-rot detector family: `stale-command-reference`, `docs-code-mismatch`, `package-release-rot`, `duplicate-implementation-candidate`, `dead-code-candidate`, `test-rot`, `architecture-drift`, `dependency-environment-rot`, `cross-platform-rot`, `security-validation-assumption-rot` (10 detectors).
+- Added a stable, versioned audit report schema (`schemaVersion` `"1.0"`, 13 top-level fields) with text and JSON renderers and a sanitized text-report writer.
+- Added fail-on severity policy (`blocker`, `high`, `medium`, `low`, `none`) shared between the runner and the report model.
+- Added external-target-safe report writing: audits against a local target project do not modify target files; generated reports stay under the tool root's `reports/audits/` unless `--out` redirects them.
+- Added integration hardening and regression test coverage under `tests/audits/` and `tests/audits/codeRot/` (CLI options, target resolution, inventory, source-of-truth, detectors, report schema/writer, fail-on behavior, external targets, self-audit smoke, detector-error hardening).
+- Kept the audit framework and `security:validate` independent: `npm run audit` does not call `security:validate`, and `security:validate` does not call the audit framework.
+- Validated cross-platform behavior on the latest Node.js LTS-adjacent release (v26.4.0) across Windows, Linux, and macOS.
+
+### Fixed
+
+- Fixed a test flake in `securityProfileSelectionIntegration.test.ts`.
+- Fixed a cross-platform bug in `resolveCommand` (`src/core`): the POSIX branch never checked `PATH` for a matching executable, so `security:validate` could falsely report a blocker on Linux/macOS when optional static-analysis tools (e.g. Semgrep) were absent from expected locations but present on `PATH`.
+
+### Limitations
+
+- Only the `code-rot` audit type is implemented. `quality`, `security`, `project`, and `all` audit types are recognized as valid `--types` identifiers but are rejected with a clear message and exit code `2` rather than running.
+- Audit findings are heuristic and conservative; they are candidates for review, not proof of a defect.
+
+## [0.2.2] - 2026-07-07
+
+### Added
+
+- Implemented the `v0.2.2` automated security-validation fortification work; version bumped and release-preparation validation completed.
+- Added `security:validate` support for `--checks`, `--profile`, `--format`, `--fail-on`, and `--out` while preserving backward-compatible no-flag and `--target` behavior.
+- Added the attack-scenario framework, reusable security profiles, payload/evidence models, and concrete boundary, subprocess, secrets, and network scenarios.
+- Added fail-on threshold behavior, profile-aware default check selection, scoped-run reporting, and verdict-reason summaries.
+- Added metadata-driven `verdictImpact` categorization and `reportSchemaGuard` baseline-diff structural-injection protection.
+- Added schema/report hardening, text-report sanitization regression coverage, and output format/location consistency validation.
+
+### Fixed
+
+- Fixed a cross-platform bug in the path-traversal attack scenario where a backslash-style traversal payload was incorrectly expected to be rejected on POSIX platforms (Linux/macOS), where `\` is a literal filename character rather than a path separator. Verified via the project's own CI matrix (ubuntu-latest/macos-latest/windows-latest x Node 20/22).
+
+### Documentation
+
+- Synchronized current-state, architecture, command, security-validation, and project-overview documentation with the `v0.2.2` implementation and package version.
+- Replaced the stale roadmap with a semantically ordered plan from v0.2.1 through v1.4.0, placing stable v1.0.0 after all prerequisite v0.x work.
+- Clarified that automated security validation is implemented, while the generic audit framework, code rot and quality detectors, unified audits, and manual pentest framework are planned.
+
+## [0.2.1] - 2026-06-25
+
+Target-aware security-validation correction.
+
+### Fixed
+
+- Corrected external-target `test:security` execution so it runs in the selected target project, including installed-package validation paths.
+
+## [0.2.0] - 2026-06-23
+
+Generic experiment-plugin foundation, first plugin conversion, target-aware execution, plugin-aware reports, and user-facing command surface.
+
+### Added
+
+- Added generic experiment plugin contracts, registry, execution context, target model, config validation result, and normalized result model.
+- Added shared local target metadata resolution used by both experiment targets and security validation targets.
+- Added `context-strategy-comparison` as the first registered experiment plugin for the existing raw-full-file vs my-dev-kit-guided workflow.
+- Added plugin result metadata output at `experiment-plugin-result.json` while preserving the existing `experiment-summary.json`, `experiment-runs.json`, and `experiment-comparisons.json` artifacts.
+- Added target-aware experiment execution for explicit local projects via `experiment:run -- --target <path>`.
+- Added plugin-aware JSON and HTML reports with plugin, target, variant, case, metric, artifact, warning, skip, and failure metadata.
+- Added `experiment:list`.
+- Added `experiment:describe`.
+- Added `experiment:run`.
+- Documented `context-strategy-comparison` as the first experiment plugin.
+
+### Changed
+
+- Routed the existing controlled experiment command wrapper through the `context-strategy-comparison` plugin without changing the public command arguments or legacy artifact behavior.
+- Preserved existing raw-vs-indexed workflow behavior through the plugin runner and kept old controlled-experiment commands available.
+
+### Validation
+
+- `npm install`
+- `npm run build`
+- `npm run test`
+- `npm run verify`
+- `npm run security:deps`
+- `npm run security:package`
+- `npm run security:codeql`
+- `npm run security:semgrep`
+- `npm run test:security`
+- `npm run test:fuzz:smoke`
+- `npm run security:validate`
+- `npm run security:validate -- --target "Z:\Users\newuser\Projects\my-dev-kit-v1"`
+- `npm run security:validate -- --target "Z:\Users\newuser\Projects\scientific-literature-explorer-v1"`
+- `npm run experiment:list`
+- `npm run experiment:describe -- --experiment context-strategy-comparison`
+- `npm run experiment:describe -- --experiment does-not-exist`
+- `npm run experiment:run -- --experiment context-strategy-comparison --target "Z:\Users\newuser\Projects\my-dev-kit-v1" --case todo-ts-create-task --agents fake-agent --complexities short --no-screenshot`
+- `npm run experiment:run -- --experiment context-strategy-comparison --target "Z:\Users\newuser\Projects\scientific-literature-explorer-v1" --case todo-ts-create-task --agents fake-agent --complexities short --no-screenshot`
+- `npm run run-controlled-experiment -- --cases examples/token-savings-cases.json --out lab-output/legacy-v0.2.0-smoke --kit-command "node tests/fixtures/fake-my-dev-kit-cli.js" --agents fake-agent --complexities short --no-screenshot`
+- `npm pack --dry-run`
+
+## [0.1.4] - 2026-06-22
+
+Final security-validation gate with reusable multi-project target support.
+
+### Added (reusable target support)
+
+- Added `--target <path>` option to `security:validate`, `security:deps`, `security:package`, `security:semgrep`, and `security:codeql` to validate any local project, not just my-dev-kit-lab itself.
+- Added `SecurityValidationTarget` type separating the validation target from the tool root (my-dev-kit-lab).
+- Added `resolveValidationTarget(targetPath?, toolRoot)` — validates target path, reads package.json/lockfile/git metadata gracefully; returns null fields on missing metadata rather than crashing.
+- Added `reportFilenamePrefix(target)` — generates collision-free filename prefixes: `v0.1.4` for self, `my-dev-kit-v1.2.0` for scoped packages, `biolit-v1` for name-only packages, directory basename for projects with no package.json.
+- Added `targetDescription(target)` — human-readable label for report headers.
+- Added `isSelf` flag for backward-compatible self-validation when no `--target` is given.
+- Added `--out <dir>` option to control report output directory (default: `reports/security/`).
+- Added `--report-prefix <name>` option to override the generated filename prefix.
+- Report headers now distinguish self-validation (`Package: ...`) from external target validation (`Tool: ..., Target: ...`).
+- CLI adversarial tests and fuzz smoke always run against the tool root and are labeled clearly as "tool self-tests, not target-specific."
+- Added 23 new unit tests for target resolution in `tests/security/securityValidationTarget.test.ts`.
+- Exported `resolveValidationTarget`, `reportFilenamePrefix`, `targetDescription`, `SecurityValidationTarget` from `src/securityValidation/index.ts`.
+
+### Added (security-validation gate)
+
+- Added static scan integration for CodeQL and Semgrep.
+  - CodeQL: local CLI availability check; full analysis delegates to GitHub Actions.
+  - Semgrep: local or npx fallback; `.semgrep.yml` covers subprocess safety, path traversal, unsafe fs.rm, and secret leakage.
+  - Both scanners return structured `skipped` results when unavailable — never crash.
+- Added bounded fuzz smoke tests (`test:fuzz:smoke`) for 9 security-sensitive parsers and helpers.
+  - Seeded PRNG (`0xDEADBEEF`) for deterministic CI reproduction.
+  - Completes in under 1 second at default settings (50 iterations per target).
+- Added `security:validate` release-gate command that orchestrates all checks and produces a verdict.
+- Added text and JSON security-validation report generation to `reports/security/<prefix>-security-validation.{txt,json}`.
+- Added release verdict calculation from normalized check results (four verdict categories).
+- Added documentation for mandatory checks, optional scanner availability, findings, skipped checks, and release verdicts in `docs/COMMANDS.md`.
+- Fixed defensive null guard in `parseNpmOutdated` when JSON value entries contain null.
+
+### Validation
+
+- `npm run build`
+- `npm run test` (407 tests, 88 files)
+- `npm run verify`
+- `npm run security:deps`
+- `npm run security:package`
+- `npm run security:codeql`
+- `npm run security:semgrep`
+- `npm run test:security` (165 tests, 12 files)
+- `npm run test:fuzz:smoke` (9 targets, 450 iterations)
+- `npm run security:validate` (verdict: ready except optional manual checks)
+- `npm pack --dry-run`
+
+### Notes
+
+- CodeQL, Semgrep, and OSV-Scanner may be skipped locally if unavailable. Absence is reported as `ready except optional manual checks`, not a blocker.
+- Generated security reports are not committed by default (`.gitignore` excludes `reports/security/` outputs).
+- This release completes the initial security-validation release-gate track.
+
+## [0.1.2] - 2026-06-22
+
+Security validation foundation and package checks.
+
+### Added
+
+- Added security-validation planning and framework documentation for the staged release-security track.
+- Added security validation core types, configuration, command runner, and test matrix scaffolding.
+- Added dependency validation through `security:deps`.
+- Added package-content validation through `security:package`.
+- Added initial security unit coverage through `test:security`.
+- Added Windows-safe npm command resolution for security scripts.
+- Added parsers and runners for `npm audit`, `npm audit --omit=dev`, `npm ls --all`, `npm outdated`, and optional OSV-Scanner execution.
+- Added forbidden package-content detection and structured `npm pack --dry-run` parsing.
+
+### Validation
+
+- `npm run build`
+- `npm run test`
+- `npm run verify`
+- `npm run security:deps`
+- `npm run security:package`
+- `npm pack --dry-run`
+
+### Limitations
+
+- full CLI adversarial harness is planned next
+- malformed artifact, JSON stdout/stderr, and Graphviz safety tests are not complete yet
+- CodeQL and Semgrep integration is planned
+- fuzz smoke tests are planned
+- `security:validate` and final release security report generation are planned
+
+## [0.1.1] - 2026-06-22
+
+Public release hygiene and cross-platform assurance patch.
+
+### Changed
+
+- cleaned package metadata for the public npm release, including repository, funding, keyword, engine, and bin metadata
+- restricted published package contents to runtime assets and the deterministic fake my-dev-kit fixture used by local demos
+- improved cross-platform command parsing and Windows `.cmd` shim execution, especially for commands and script paths that contain spaces
+- added cross-platform CI coverage for `windows-latest`, `macos-latest`, and `ubuntu-latest`
+- updated quickstart and workflow docs with PowerShell guidance and clearer notes about current baseline capabilities versus future roadmap items
+
+### Validation
+
+- `npm run build`
+- `npm run test`
+- `npm run verify`
+- `npm pack --dry-run`
+
+### Notes
+
+- this patch does not add the full security-validation framework
+- generic experiment-plugin architecture remains planned for a later release
+
+## [0.1.0] - 2026-06-16
+
+### Initial public baseline
+
+**Experiment pipeline**
+- Raw-vs-indexed context experiment: compares `raw-full-file` and `my-dev-kit-guided` strategies across benchmark cases
+- Controlled experiment runner with paired run comparison by case, project, agent, and prompt complexity
+- Deterministic correctness scoring from benchmark answer keys (not semantic LLM judging)
+- Token usage, duration, and status comparisons between matched strategy pairs
+
+**Benchmark projects**
+- `todo-ts`, `todo-js`, `todo-python`, `todo-mixed-ts-py` — small baseline projects
+- `task-workflow-medium-ts` — medium TypeScript project
+- `task-analytics-large-mixed` — large mixed TypeScript/Python project
+- Project complexity metrics: file count, lines of code, language count, import count, exported symbol estimate, complexity score (0–100 weighted)
+
+**Agent adapters**
+- Fake-agent adapter for deterministic smoke and demo validation (no external CLI required)
+- Codex adapter for real-agent campaigns (requires local Codex CLI and usage capacity)
+- Claude adapter for real-agent campaigns (requires local Claude CLI; token totals not exposed)
+- Windows-safe CLI command resolution
+
+**Report, plot, screenshot, and gallery pipeline**
+- HTML experiment report rendering with project profile, strategy comparisons, correctness, token savings, and warnings
+- Static SVG plot generation
+- Optional PNG screenshot capture via headless browser
+- Gallery manifest and static gallery index output
+
+**Documentation**
+- Full user-facing documentation: README, PROJECT_OVERVIEW, ARCHITECTURE, WORKFLOWS, COMMANDS, TUTORIAL, METRICS, ROADMAP, GALLERY, CURRENT_STATE
+- Metric glossary (docs/METRICS.md)
+- Real-agent campaign report and final batch handoff notes
+
+### Known limitations
+
+- Token savings in fake-agent runs are estimated from character counts, not provider billing telemetry
+- Claude does not expose token totals; token savings comparisons are unavailable for Claude runs
+- Codex runs may produce timeouts, invalid output, or hit session limits
+- Small projects may show negative token savings because raw-full-file is cheaper when the entire project fits in context
+- Current baseline does not yet prove every future value claim; stronger evidence requires future experiment types
+
+### Roadmap at release time
+
+At v0.1.0 the generic experiment-plugin framework was planned. It was subsequently implemented in v0.2.0 with `context-strategy-comparison` as the first plugin. Later planned plugins cover warm-index reuse, incremental-change staleness, context-window scaling, retrieval precision/recall, and agent-success-rate experiments.

package/README.md

@@ -4,7 +4,7 @@ my-dev-kit-lab is the experiment, audit, and evidence companion for [my-dev-kit]
 
 my-dev-kit provides local repository indexing and graph-guided retrieval. my-dev-kit-lab supplies the controlled benchmarks, agent adapters, metrics, security checks, and reports needed to evaluate when that retrieval is useful. Results are evidence for a specific target and configuration; they do not guarantee token savings or security.
 
-The latest published release is v0.4.4 (producer-readiness bridge). See [docs/CURRENT_STATE.md](docs/CURRENT_STATE.md).
+The latest published release is v0.4.5 (context-integrity validation), compatible with published `@dailephd/my-dev-kit@1.10.4` and `@dailephd/my-dev-kit-orchestrator@1.2.3`. See [docs/CURRENT_STATE.md](docs/CURRENT_STATE.md).
 
 ## Current capabilities
 
@@ -15,6 +15,7 @@ The latest published release is v0.4.4 (producer-readiness bridge). See [docs/CU
 - **Review evidence:** generate JSON and HTML reports, SVG plots, optional screenshots, visualization demos, and a static gallery.
 - **Evaluate stage-context strategies:** compare the two legacy strategies against six additional bounded stage-context strategies — `architecture-context-only`, `architecture-plus-implementation-refresh`, `architecture-plus-implementation-and-test-refresh`, `full-workflow-library`, `bounded-workflow-instruction-packet`, and `combined-bounded-stage-context` — selected through programmatic configuration, not CLI flags. Each strategy's evidence is reported through bounded `report.json`, `report.html`, and `report.txt` output with an explicit `available`/`unavailable`/`not-applicable` metric-availability model and no composite score, grade, ranking, or winning strategy.
 - **Evaluate the producer-readiness bridge (v0.4.4):** optionally extend `combined-bounded-stage-context` with the frozen my-dev-kit-orchestrator supplemental implementation/test-context packet and retrieval-report documents plus an observed readiness result, all supplied programmatically (there is no CLI flag), to measure owner, allocation, truncation-cause, supplemental/raw agreement, readiness-agreement, and criticality-overlay evidence without reimplementing upstream owner-selection, allocation, producer-parity, or readiness policy.
+- **Evaluate context integrity (v0.4.5):** compare condition-aware producer evidence from my-dev-kit v1.10.4 (role condition coverage, allocation/spillover, required-evidence-loss) against my-dev-kit-orchestrator v1.2.3 run-integrity evidence (run-integrity gate, judge integrity, final-report eligibility, artifact lifecycle state), reporting agreement or contradiction between them rather than re-deriving a verdict. Evaluation runs against a frozen, hash-verified regression fixture pair — a byte-exact real historical failed run and a hand-distilled corrected-replay counterpart representing the same validated contracts — and is programmatic/test-driven only. `npm run report:context-integrity-smoke` renders both fixtures' reports for manual inspection; it takes no arguments and is a developer convenience, not a configurable evaluation CLI.
 
 ## Quickstart
 
@@ -167,6 +168,7 @@ See [docs/METRICS.md](docs/METRICS.md) for full metric definitions.
 - The six new stage-context strategies have no CLI flags yet, are configured programmatically, and do not yet include plots, screenshots, or gallery integration
 - The published upstream artifacts the stage-context strategies read do not expose considered-but-unselected reads or unnecessary-read evidence; those metrics report `unavailable` rather than zero
 - The v0.4.4 producer-readiness bridge is released. All bridge inputs are programmatic — there is no CLI flag. The coordinated upstream releases my-dev-kit@1.10.3 and orchestrator@1.2.2 were verified published before lab publication.
+- The v0.4.5 context-integrity evaluation is released. It has no CLI flags, no plots/screenshot/gallery integration, and produces no composite score, grade, ranking, or winner. Its corrected-replay fixture is a hand-distilled representation of the validated my-dev-kit v1.10.4 and my-dev-kit-orchestrator v1.2.3 contracts, not a live capture of a complete ten-stage workflow. The orchestrator agreement evidence does not read a literal upstream `promptMode` field; `stageMayRenderNormalPrompt`, derived from structured blocked-stage evidence, is the bounded substitute used instead.
 
 ---
 

package/dist/scripts/report-context-integrity-smoke.js

@@ -0,0 +1,70 @@
+// v0.4.5 context-integrity evaluation: report smoke script. Loads the frozen failed-run and
+// corrected-replay fixtures, evaluates them through the existing producer-readiness bridge,
+// and writes JSON/text/HTML reports for manual inspection. Not part of any release-readiness
+// gate; a developer convenience for inspecting ContextIntegrityReportV1 output.
+import { mkdirSync, writeFileSync } from "node:fs";
+import { loadContextIntegrityFixture } from "../src/evaluation/ecosystemFixtures/loadContextIntegrityFixture.js";
+import { evaluateProducerReadinessBridge } from "../src/evaluation/stageContextMetrics/evaluateProducerReadinessBridge.js";
+import { calculateStageContextDeterminism } from "../src/evaluation/stageContextDeterminism/calculateStageContextDeterminism.js";
+import { buildContextIntegrityReport } from "../src/report/experiments/buildContextIntegrityReport.js";
+import { renderContextIntegrityJsonReport } from "../src/report/experiments/renderContextIntegrityJsonReport.js";
+import { renderContextIntegrityText } from "../src/report/experiments/renderContextIntegrityText.js";
+import { renderContextIntegrityHtml } from "../src/report/experiments/renderContextIntegrityHtml.js";
+const CASES = [
+    {
+        kind: "failed-run",
+        root: "tests/fixtures/ecosystem/context-integrity/v0.4.5/failed-run",
+        manifest: "tests/fixtures/ecosystem/context-integrity/v0.4.5/manifests/failed-run-manifest.json"
+    },
+    {
+        kind: "corrected-replay",
+        root: "tests/fixtures/ecosystem/context-integrity/v0.4.5/corrected-replay",
+        manifest: "tests/fixtures/ecosystem/context-integrity/v0.4.5/manifests/corrected-replay-manifest.json"
+    }
+];
+async function main() {
+    const outDir = "lab-output/context-integrity-report-smoke";
+    mkdirSync(outDir, { recursive: true });
+    for (const c of CASES) {
+        const fixture = await loadContextIntegrityFixture(c.root, c.manifest);
+        if (!fixture.ok) {
+            console.error(`Fixture load failed for ${c.kind}:`, fixture.issues);
+            process.exitCode = 1;
+            continue;
+        }
+        const bridgeResult = evaluateProducerReadinessBridge({
+            implementation: { role: "implementation", contextCapsule: fixture.implementationCapsule, retrievalAuditRecord: fixture.implementationAudit },
+            readiness: fixture.runIntegrityEvidence?.gate.implementationContext,
+            runIntegrityEvidence: fixture.runIntegrityEvidence,
+            expectations: {
+                schemaVersion: "1.0.0",
+                caseId: "CASE-SMOKE",
+                title: "smoke",
+                description: "smoke",
+                expectedEvidence: [],
+                expectedStates: {},
+                warnings: [],
+                producerReadinessExpectations: {}
+            }
+        });
+        const determinism = calculateStageContextDeterminism([
+            { runNumber: 1, value: bridgeResult },
+            { runNumber: 2, value: bridgeResult }
+        ]);
+        const report = buildContextIntegrityReport({
+            fixtureKind: c.kind,
+            manifest: fixture.manifest,
+            hashVerification: fixture.hashVerification,
+            capsule: fixture.implementationCapsule,
+            audit: fixture.implementationAudit,
+            bridgeResult,
+            determinism,
+            fixtureSelfImmutable: true
+        });
+        writeFileSync(`${outDir}/${c.kind}.report.json`, renderContextIntegrityJsonReport(report), "utf8");
+        writeFileSync(`${outDir}/${c.kind}.report.txt`, renderContextIntegrityText(report), "utf8");
+        writeFileSync(`${outDir}/${c.kind}.report.html`, renderContextIntegrityHtml(report), "utf8");
+        console.log(`Wrote ${c.kind} reports. endToEnd=${report.endToEnd?.category}`);
+    }
+}
+main();

package/dist/src/evaluation/ecosystemFixtures/index.js

@@ -0,0 +1,3 @@
+export { isSafeFixtureRelativePath, validateEcosystemFixtureManifest } from "./validateManifest.js";
+export { verifyFixtureHashes } from "./verifyFixtureHashes.js";
+export { loadContextIntegrityFixture } from "./loadContextIntegrityFixture.js";