@dailephd/my-frontend-observer 0.10.0 → 0.10.1

package/docs/reports/v0.8.1-implementation-completeness-documentation-reconciliation.md

@@ -1,114 +1,114 @@
-# v0.8.1 Hardened Documentation and Implementation-Completeness Audit
-
-## Verdict
-
-PASS_V081_HARDENED_DOCUMENTATION_AND_IMPLEMENTATION_COMPLETENESS_AUDIT
-
-Starting candidate: `85ff1cbaa6c9cf86aa7de59cf3abeb09cbaa6877`.
-Source-of-truth order was the task contract, current Git/package state,
-preservation policy and durable product documents, frozen v0.8.1 plan,
-current implementation/tests, then predecessor reports. The Prompt 1 and
-Prompt 2 reports were corroborating evidence only.
-
-## Capability matrix
-
-| Capability | Plan source | Implementation | Tests | Documentation | Result |
-| --- | --- | --- | --- | --- | --- |
-| Config v1.0 compatibility | Plan §§3, 6 | `projectConfig.ts` | `projectWorkflow.test.ts` | COMMANDS | PASS |
-| Config v1.1 acceptance | Plan §6 | `projectConfig.ts`, `checkAcceptance.ts` | project workflow/check tests | COMMANDS | PASS |
-| Project discovery/managed state | Plan Prompt 1 | `projectDiscovery.ts`, `projectPaths.ts` | project workflow tests | ARCHITECTURE | PASS |
-| Alias grammar/atomic catalog | Plan Prompt 1 | `projectConfig.ts`, `aliasCatalog.ts` | project workflow tests | COMMANDS | PASS |
-| Immutable evidence/alias replacement | Plan Prompt 1 | project workflow service | browser workflow tests | WORKFLOWS | PASS |
-| `init` and `capture` | Plan Prompt 1 | CLI/project workflow service | CLI/browser/packed tests | README, COMMANDS | PASS |
-| Reserved `current` | Plan Prompt 2 | project workflow service/catalog validator | unit/browser tests | COMMANDS | PASS |
-| Project-aware `view` | Plan Prompt 1 | CLI/viewer service/projection | viewer/browser/packed tests | README, COMMANDS | PASS |
-| Standalone `view --root` | Plan Prompt 1 | existing view dispatch | viewer regression tests | COMMANDS | PASS |
-| Alias-first navigation/provenance | Plan Prompt 1 | evidence projection/React list | real Chromium/packed tests | ARCHITECTURE | PASS |
-| Explicit/default baseline | Plan Prompt 2 | `projectCheckService.ts` | check-service/browser tests | COMMANDS | PASS |
-| Current capture/history | Plan Prompt 2 | capture workflow/check service | browser tests | WORKFLOWS | PASS |
-| Canonical comparison/config reuse | Plan Prompt 2 | comparison service composition | browser/unit tests | ARCHITECTURE | PASS |
-| Contract orchestration | Plan Prompt 2 | contract evaluator composition | browser/unit/packed tests | COMMANDS | PASS |
-| Approved-reference governance/bindings/fidelity | Plan Prompt 2 | reference reader/fidelity composition | browser/unit tests | SECURITY, COMMANDS | PASS |
-| PASS/FAIL/REVIEW_REQUIRED/BLOCKED precedence | Plan Prompt 2 | `checkResult.ts` | unit/CLI/browser tests | COMMANDS | PASS |
-| Human check output | Plan Prompt 2 | CLI formatter | CLI/browser tests | WORKFLOWS | PASS |
-| Bounded `check --json` | Plan Prompt 2 | `checkResult.ts` | bounded projection tests | COMMANDS | PASS |
-| Check exit codes 0/1/2/3 | Plan Prompt 2 | CLI mapping | CLI/browser tests | COMMANDS, CI_CD | PASS |
-| No check artifact/no second engine | Plan Prompt 2 | check application composition | architecture/source audit | ARCHITECTURE | PASS |
-| Coding-agent FAIL-to-PASS loop | Plan Prompt 2 | check + canonical evaluators | browser/packed tests | WORKFLOWS | PASS |
-| Acceptance paths/realpath containment | Plan Prompt 2 | config/acceptance resolver | unit/browser junction tests | SECURITY | PASS |
-| Installed-package workflow | Plan Prompt 2 | packed viewer smoke | local/CI packed smoke | CI_CD, DEVELOPMENT | PASS |
-| Advanced-command compatibility | Plan Prompt 1/2 | preserved CLI services | unit/browser/packed observation tests | COMMANDS | PASS |
-
-No `MISSING_IMPLEMENTATION`, `MISSING_TEST`, `MISSING_DOCUMENTATION`, or
-`IMPLEMENTATION_DOCUMENTATION_DRIFT` remained after the reconciliation.
-
-## ROADMAP and CLI/help audit
-
-ROADMAP now correctly says v0.8.1 is implemented in the repository, package
-metadata remains `0.8.0`, and publication has not happened. v0.9 and v0.10
-remain future work; the v0.9 alias/canonical-identity invariant and v0.10
-reuse of `check <baseline> --json` are explicit.
-
-Built CLI help was captured under the prerelease audit root for every public
-command. The common surface is `init`, `capture`, `check`, `view`; advanced
-commands remain `observe`, `compare`, `approve-baseline`,
-`save-change-contract`, `evaluate-contract`, `import-reference`,
-`approve-reference`, and `evaluate-reference-fidelity`. Documentation now
-states that `view` discovers initialized project evidence without `--root`,
-while `view --root` remains the standalone compatibility form.
-
-Documentation records check exits exactly as PASS 0, FAIL 1,
-REVIEW_REQUIRED 2, BLOCKED 3. Comparison alone is evidence and yields
-REVIEW_REQUIRED, never PASS. JSON is documented as a bounded ephemeral
-workflow projection rather than a persisted artifact.
-
-## Architecture and code-rot audit
-
-Direct source tracing found one canonical semantic owner for browser
-observation (`observationPersistence`), comparison (`comparisonEngine`),
-frontend-contract evaluation (`frontendContractEvaluation`), reference
-compatibility, explicit binding, reference fidelity, bounded context,
-runtime/static correlation, discovery, catalog persistence, project-check
-orchestration, and check-result projection. `projectCheckService` composes
-those owners; it neither spawns the CLI nor adds an evaluation engine.
-
-The packed check helper that duplicated the viewer/project workflow was
-removed. `runPackedViewerSmoke.mjs` is now the single installed-package
-project/viewer smoke owner and covers REVIEW_REQUIRED plus unchanged-criteria
-FAIL-to-PASS before alias-aware viewer checks. `runPackedObservationSmoke.mjs`
-retains its lower-level legacy responsibility. Windows npm installation in
-both smoke owners invokes npm's CLI through Node with `shell: false`; no
-project-controlled value is shell command text.
-
-Historical release reports and frozen plans retain their older descriptions as
-historical evidence. Current-state documentation no longer presents v0.8.1 as
-merely planned or `view --root` as universally required.
-
-## Security and package truth
-
-The audit reconfirmed portable acceptance paths, realpath/junction containment,
-alias/catalog containment, immutable `current` replacement, project-relative
-JSON, approved-reference-only governance, explicit bindings, loopback/read-only
-viewer routing, media traversal containment, and PWA no-stale-evidence tests.
-The dynamic-execution search found `spawn` only in controlled viewer opening
-and CI/developer smoke infrastructure; production project/config/evidence
-inputs do not become executable command text. A real-Chromium source-hash test
-proves `capture`, `check`, and `view` do not modify target frontend source.
-
-`npm pack --dry-run --json` is audited in Phase B. Package metadata remains
-`0.8.0`; v0.8.1 is implemented in source but not released, tagged, or
-published. CHANGELOG remains release history and has no released v0.8.1 entry.
-
-## Validation and next gate
-
-Phase A reruns typecheck, lint, unit tests, build, documentation checks,
-browser tests, security tests, and `git diff --check` after reconciliation.
-Results: typecheck PASS; lint PASS; build PASS; unit suite PASS (68 files,
-1,180 tests); documentation check PASS; browser suite PASS (21 files,
-186 tests); security subset PASS (97 unit plus 77 browser tests); and diff
-whitespace check PASS.
-Phase B starts only from the clean reconciliation commit and independently
-repeats local/package/security/packed validation before exact-candidate
-cross-platform CI.
-
-Next stage: formal v0.8.1 pre-release readiness.
+# v0.8.1 Hardened Documentation and Implementation-Completeness Audit
+
+## Verdict
+
+PASS_V081_HARDENED_DOCUMENTATION_AND_IMPLEMENTATION_COMPLETENESS_AUDIT
+
+Starting candidate: `85ff1cbaa6c9cf86aa7de59cf3abeb09cbaa6877`.
+Source-of-truth order was the task contract, current Git/package state,
+preservation policy and durable product documents, frozen v0.8.1 plan,
+current implementation/tests, then predecessor reports. The Prompt 1 and
+Prompt 2 reports were corroborating evidence only.
+
+## Capability matrix
+
+| Capability | Plan source | Implementation | Tests | Documentation | Result |
+| --- | --- | --- | --- | --- | --- |
+| Config v1.0 compatibility | Plan §§3, 6 | `projectConfig.ts` | `projectWorkflow.test.ts` | COMMANDS | PASS |
+| Config v1.1 acceptance | Plan §6 | `projectConfig.ts`, `checkAcceptance.ts` | project workflow/check tests | COMMANDS | PASS |
+| Project discovery/managed state | Plan Prompt 1 | `projectDiscovery.ts`, `projectPaths.ts` | project workflow tests | ARCHITECTURE | PASS |
+| Alias grammar/atomic catalog | Plan Prompt 1 | `projectConfig.ts`, `aliasCatalog.ts` | project workflow tests | COMMANDS | PASS |
+| Immutable evidence/alias replacement | Plan Prompt 1 | project workflow service | browser workflow tests | WORKFLOWS | PASS |
+| `init` and `capture` | Plan Prompt 1 | CLI/project workflow service | CLI/browser/packed tests | README, COMMANDS | PASS |
+| Reserved `current` | Plan Prompt 2 | project workflow service/catalog validator | unit/browser tests | COMMANDS | PASS |
+| Project-aware `view` | Plan Prompt 1 | CLI/viewer service/projection | viewer/browser/packed tests | README, COMMANDS | PASS |
+| Standalone `view --root` | Plan Prompt 1 | existing view dispatch | viewer regression tests | COMMANDS | PASS |
+| Alias-first navigation/provenance | Plan Prompt 1 | evidence projection/React list | real Chromium/packed tests | ARCHITECTURE | PASS |
+| Explicit/default baseline | Plan Prompt 2 | `projectCheckService.ts` | check-service/browser tests | COMMANDS | PASS |
+| Current capture/history | Plan Prompt 2 | capture workflow/check service | browser tests | WORKFLOWS | PASS |
+| Canonical comparison/config reuse | Plan Prompt 2 | comparison service composition | browser/unit tests | ARCHITECTURE | PASS |
+| Contract orchestration | Plan Prompt 2 | contract evaluator composition | browser/unit/packed tests | COMMANDS | PASS |
+| Approved-reference governance/bindings/fidelity | Plan Prompt 2 | reference reader/fidelity composition | browser/unit tests | SECURITY, COMMANDS | PASS |
+| PASS/FAIL/REVIEW_REQUIRED/BLOCKED precedence | Plan Prompt 2 | `checkResult.ts` | unit/CLI/browser tests | COMMANDS | PASS |
+| Human check output | Plan Prompt 2 | CLI formatter | CLI/browser tests | WORKFLOWS | PASS |
+| Bounded `check --json` | Plan Prompt 2 | `checkResult.ts` | bounded projection tests | COMMANDS | PASS |
+| Check exit codes 0/1/2/3 | Plan Prompt 2 | CLI mapping | CLI/browser tests | COMMANDS, CI_CD | PASS |
+| No check artifact/no second engine | Plan Prompt 2 | check application composition | architecture/source audit | ARCHITECTURE | PASS |
+| Coding-agent FAIL-to-PASS loop | Plan Prompt 2 | check + canonical evaluators | browser/packed tests | WORKFLOWS | PASS |
+| Acceptance paths/realpath containment | Plan Prompt 2 | config/acceptance resolver | unit/browser junction tests | SECURITY | PASS |
+| Installed-package workflow | Plan Prompt 2 | packed viewer smoke | local/CI packed smoke | CI_CD, DEVELOPMENT | PASS |
+| Advanced-command compatibility | Plan Prompt 1/2 | preserved CLI services | unit/browser/packed observation tests | COMMANDS | PASS |
+
+No `MISSING_IMPLEMENTATION`, `MISSING_TEST`, `MISSING_DOCUMENTATION`, or
+`IMPLEMENTATION_DOCUMENTATION_DRIFT` remained after the reconciliation.
+
+## ROADMAP and CLI/help audit
+
+ROADMAP now correctly says v0.8.1 is implemented in the repository, package
+metadata remains `0.8.0`, and publication has not happened. v0.9 and v0.10
+remain future work; the v0.9 alias/canonical-identity invariant and v0.10
+reuse of `check <baseline> --json` are explicit.
+
+Built CLI help was captured under the prerelease audit root for every public
+command. The common surface is `init`, `capture`, `check`, `view`; advanced
+commands remain `observe`, `compare`, `approve-baseline`,
+`save-change-contract`, `evaluate-contract`, `import-reference`,
+`approve-reference`, and `evaluate-reference-fidelity`. Documentation now
+states that `view` discovers initialized project evidence without `--root`,
+while `view --root` remains the standalone compatibility form.
+
+Documentation records check exits exactly as PASS 0, FAIL 1,
+REVIEW_REQUIRED 2, BLOCKED 3. Comparison alone is evidence and yields
+REVIEW_REQUIRED, never PASS. JSON is documented as a bounded ephemeral
+workflow projection rather than a persisted artifact.
+
+## Architecture and code-rot audit
+
+Direct source tracing found one canonical semantic owner for browser
+observation (`observationPersistence`), comparison (`comparisonEngine`),
+frontend-contract evaluation (`frontendContractEvaluation`), reference
+compatibility, explicit binding, reference fidelity, bounded context,
+runtime/static correlation, discovery, catalog persistence, project-check
+orchestration, and check-result projection. `projectCheckService` composes
+those owners; it neither spawns the CLI nor adds an evaluation engine.
+
+The packed check helper that duplicated the viewer/project workflow was
+removed. `runPackedViewerSmoke.mjs` is now the single installed-package
+project/viewer smoke owner and covers REVIEW_REQUIRED plus unchanged-criteria
+FAIL-to-PASS before alias-aware viewer checks. `runPackedObservationSmoke.mjs`
+retains its lower-level legacy responsibility. Windows npm installation in
+both smoke owners invokes npm's CLI through Node with `shell: false`; no
+project-controlled value is shell command text.
+
+Historical release reports and frozen plans retain their older descriptions as
+historical evidence. Current-state documentation no longer presents v0.8.1 as
+merely planned or `view --root` as universally required.
+
+## Security and package truth
+
+The audit reconfirmed portable acceptance paths, realpath/junction containment,
+alias/catalog containment, immutable `current` replacement, project-relative
+JSON, approved-reference-only governance, explicit bindings, loopback/read-only
+viewer routing, media traversal containment, and PWA no-stale-evidence tests.
+The dynamic-execution search found `spawn` only in controlled viewer opening
+and CI/developer smoke infrastructure; production project/config/evidence
+inputs do not become executable command text. A real-Chromium source-hash test
+proves `capture`, `check`, and `view` do not modify target frontend source.
+
+`npm pack --dry-run --json` is audited in Phase B. Package metadata remains
+`0.8.0`; v0.8.1 is implemented in source but not released, tagged, or
+published. CHANGELOG remains release history and has no released v0.8.1 entry.
+
+## Validation and next gate
+
+Phase A reruns typecheck, lint, unit tests, build, documentation checks,
+browser tests, security tests, and `git diff --check` after reconciliation.
+Results: typecheck PASS; lint PASS; build PASS; unit suite PASS (68 files,
+1,180 tests); documentation check PASS; browser suite PASS (21 files,
+186 tests); security subset PASS (97 unit plus 77 browser tests); and diff
+whitespace check PASS.
+Phase B starts only from the clean reconciliation commit and independently
+repeats local/package/security/packed validation before exact-candidate
+cross-platform CI.
+
+Next stage: formal v0.8.1 pre-release readiness.

package/docs/reports/v0.8.1-prerelease-readiness-cross-platform-security-code-rot.md

@@ -1,170 +1,170 @@
-# v0.8.1 Pre-release Readiness
-
-## 1. Purpose and scope
-
-This report records formal readiness evidence for the source-complete v0.8.1
-project workflow. It is not release preparation: package metadata remains
-`0.8.0`; no npm publication, tag, GitHub Release, or master push occurs here.
-
-## 2. Entry gate and starting state
-
-The readiness branch began from master commit
-`85ff1cbaa6c9cf86aa7de59cf3abeb09cbaa6877`, with a clean tracked worktree.
-`origin/master` was an ancestor of local master. The documentation
-reconciliation commit is `02a930d295c84fc0f47521bac226ab5fb3553542`.
-
-## 3. Filesystem policy
-
-All generated readiness state is confined to
-`.my-dev-kit-workflow/v0.8.1/prerelease-readiness`, including temp/cache,
-audit snapshots, logs, packed candidate, consumer, fixture, browser, and CI
-state. Process-local TEMP/TMP/npm cache settings point there. No sibling
-project or repository-root disposable frontend is used.
-
-## 4. Documentation/completeness and architecture audits
-
-The companion
-`v0.8.1-implementation-completeness-documentation-reconciliation.md` report
-passes the bidirectional capability matrix. It found one CI-readiness/code-rot
-defect: v0.8.1 packed `check` proof was isolated in a separate helper rather
-than the established packed viewer owner. The helper was removed and
-`runPackedViewerSmoke.mjs` now proves installed `init`, `capture baseline`,
-`check --json` REVIEW_REQUIRED, unchanged-contract FAIL-to-PASS, `baseline`
-and `current` aliases, canonical-ID detail, and the viewer. The lower-level
-packed observation smoke remains separate by responsibility.
-
-Source tracing confirms one semantic owner each for browser observation,
-relationships, comparison, contract evaluation, reference compatibility,
-explicit binding, reference fidelity, bounded context, runtime/static
-correlation, discovery, catalog persistence, project-check orchestration, and
-check projection. `check` only composes canonical owners and creates no
-persisted check artifact or second evaluation engine.
-
-## 5. Local validation
-
-From the clean reconciliation commit: typecheck PASS; lint PASS; build PASS;
-unit PASS (68 files, 1,180 tests); browser PASS (21 files, 186 tests);
-security PASS (97 unit plus 77 browser tests); documentation check PASS; and
-`git diff --check` PASS. A real-Chromium source-hash regression test confirms
-that capture, check, and view do not modify a target frontend source file.
-
-## 6. Package-content and API audit
-
-`npm pack --dry-run --json` reports 314 files and no workflow state, evidence,
-consumer, fixture, browser profile, coverage, `.claude`, or nested tarball.
-Required compiled CLI, library, project-check, check-result, and viewer files
-are present. Built exports include `CHECK_RESULT_SCHEMA_VERSION` and
-`CHECK_WORKFLOW_STATUSES`; type-only check result interfaces are present in the
-published declarations.
-
-## 7. Security and code-rot audit
-
-Project discovery stops at the nearest config. Alias/catalog validation and
-atomic catalog persistence are fail-closed. Acceptance paths are portable and
-realpath-contained; a Windows junction escape is rejected by real browser
-coverage. `current` replacement changes catalog metadata only and preserves
-canonical history. Check JSON uses project-relative paths, bounded collections,
-and no image bytes. Imported references are not approved authority; bindings
-remain explicit; contract FAIL cannot be overridden by reference PASS.
-
-Viewer security regressions cover loopback binding, read-only methods,
-traversal/media containment, symlink/junction containment, and no stale PWA
-evidence. Production source has no eval/new-Function/vm execution. The only
-process spawns are controlled viewer opening and development/CI smoke tooling;
-Windows packed npm invocation uses Node's npm CLI with `shell: false`.
-
-## 8. Local packed candidate and workflow audit
-
-LOCAL_CANDIDATE_TARBALL: `my-frontend-observer-0.8.0.tgz`
-
-LOCAL_CANDIDATE_SHA256: `5e9ded9170c59de0f7c0205144fb1d6bb375ce6c6a5b70adef57f5223db43e3a`
-
-Local installed-package observation smoke: PASS (final candidate).
-
-Local installed-package project/viewer smoke: PASS (final candidate).
-
-The GitHub workflow builds and hashes one candidate in its Linux candidate job,
-uploads that tarball, downloads it on Windows/Linux/macOS, verifies the
-candidate SHA on every matrix runner, and runs both installed-package smokes.
-
-## 9. Historical failed exact-candidate evidence
-
-The latest candidate run was `35015180719` for commit
-`b32fe9759187c024cc5828b73cf0c6a682de95b0`. Its candidate job completed all
-validation, packaging, and artifact-hash steps successfully; the exact
-downloaded candidate passed both installed-package smokes on Windows and
-Ubuntu. macOS failed only the project/viewer smoke because that test compares
-the logical temporary path returned by Node (`/var/...`) to the physical path
-reported by the viewer (`/private/var/...`) in `/api/status`.
-
-This is a smoke-harness realpath presentation mismatch, not an evidence,
-containment, or product-workflow failure. It is nevertheless a formal matrix
-failure and therefore cannot be represented as cross-platform PASS.
-
-Previous run `35012678176` identified the original raw CLI artifact-path
-assumption. Run `35013965786` validated the first correction through candidate
-and Windows/Ubuntu, then identified the macOS logical/physical temporary-root
-mismatch.
-
-## 10. Authorized macOS realpath correction
-
-Classification: **TEST/READINESS PORTABILITY DEFECT**.
-
-Product behavior affected: **NO**.
-
-The viewer is permitted to report the physical evidence root. The defect was
-only the readiness smoke's raw string comparison of the caller-visible
-`/var/...` spelling with the physical `/private/var/...` spelling. The smoke
-now compares canonical physical identity with `fs.realpath()` and reports both
-the original spellings and canonical paths if a genuine mismatch occurs. On
-Windows, a smoke-local junction regression self-check proves that an alias and
-its target compare equal while a distinct directory compares unequal.
-
-Security semantics weakened: **NO**. This helper is limited to an
-already-authorized smoke assertion; project acceptance-path containment remains
-owned by production realpath validation and is unchanged.
-
-MACOS_REALPATH_TARGETED_CORRECTION: PASS
-
-## 11. Exact-candidate and cross-platform results
-
-OLD_FAILED_RUN: `35015180719`
-
-OLD_FAILED_COMMIT: `b32fe9759187c024cc5828b73cf0c6a682de95b0`
-
-ROOT_CAUSE: logical-vs-physical temporary path comparison on macOS
-
-The next run must build a new candidate once and validate that exact SHA on
-Windows, Linux, and macOS. This historical failed candidate is never rewritten
-as passing evidence.
-
-## 12. Corrected formal exact-candidate result
-
-CORRECTION_COMMIT: `d5986b5297a2b466b3373a6c896a447cdabe2bdb`
-
-NEW_GITHUB_ACTIONS_RUN_ID: `35018400346`
-
-FINAL_VALIDATED_COMMIT: `d5986b5297a2b466b3373a6c896a447cdabe2bdb`
-
-FORMAL_CANDIDATE_TARBALL: `my-frontend-observer-0.8.0.tgz`
-
-FORMAL_CANDIDATE_SHA256:
-`1ae46575595451e56f7c851273387ee4808e546940077e08a40cebcc1c4f8d30`
-
-WINDOWS: PASS
-
-LINUX: PASS
-
-MACOS: PASS
-
-CANDIDATE_SHA_PARITY: PASS
-
-The candidate job and all three exact-candidate jobs passed. The macOS packed
-project/viewer smoke passed the corrected filesystem-identity assertion.
-
-## 13. Release-state truth and next decision
-
-The source is not released as v0.8.1. Package version is `0.8.0`; npm
-publication, tag, GitHub Release, and master push are all absent. The final
-verdict is `PASS_V081_PRERELEASE_READINESS`; the next authorized stage is
-release preparation, not publication.
+# v0.8.1 Pre-release Readiness
+
+## 1. Purpose and scope
+
+This report records formal readiness evidence for the source-complete v0.8.1
+project workflow. It is not release preparation: package metadata remains
+`0.8.0`; no npm publication, tag, GitHub Release, or master push occurs here.
+
+## 2. Entry gate and starting state
+
+The readiness branch began from master commit
+`85ff1cbaa6c9cf86aa7de59cf3abeb09cbaa6877`, with a clean tracked worktree.
+`origin/master` was an ancestor of local master. The documentation
+reconciliation commit is `02a930d295c84fc0f47521bac226ab5fb3553542`.
+
+## 3. Filesystem policy
+
+All generated readiness state is confined to
+`.my-dev-kit-workflow/v0.8.1/prerelease-readiness`, including temp/cache,
+audit snapshots, logs, packed candidate, consumer, fixture, browser, and CI
+state. Process-local TEMP/TMP/npm cache settings point there. No sibling
+project or repository-root disposable frontend is used.
+
+## 4. Documentation/completeness and architecture audits
+
+The companion
+`v0.8.1-implementation-completeness-documentation-reconciliation.md` report
+passes the bidirectional capability matrix. It found one CI-readiness/code-rot
+defect: v0.8.1 packed `check` proof was isolated in a separate helper rather
+than the established packed viewer owner. The helper was removed and
+`runPackedViewerSmoke.mjs` now proves installed `init`, `capture baseline`,
+`check --json` REVIEW_REQUIRED, unchanged-contract FAIL-to-PASS, `baseline`
+and `current` aliases, canonical-ID detail, and the viewer. The lower-level
+packed observation smoke remains separate by responsibility.
+
+Source tracing confirms one semantic owner each for browser observation,
+relationships, comparison, contract evaluation, reference compatibility,
+explicit binding, reference fidelity, bounded context, runtime/static
+correlation, discovery, catalog persistence, project-check orchestration, and
+check projection. `check` only composes canonical owners and creates no
+persisted check artifact or second evaluation engine.
+
+## 5. Local validation
+
+From the clean reconciliation commit: typecheck PASS; lint PASS; build PASS;
+unit PASS (68 files, 1,180 tests); browser PASS (21 files, 186 tests);
+security PASS (97 unit plus 77 browser tests); documentation check PASS; and
+`git diff --check` PASS. A real-Chromium source-hash regression test confirms
+that capture, check, and view do not modify a target frontend source file.
+
+## 6. Package-content and API audit
+
+`npm pack --dry-run --json` reports 314 files and no workflow state, evidence,
+consumer, fixture, browser profile, coverage, `.claude`, or nested tarball.
+Required compiled CLI, library, project-check, check-result, and viewer files
+are present. Built exports include `CHECK_RESULT_SCHEMA_VERSION` and
+`CHECK_WORKFLOW_STATUSES`; type-only check result interfaces are present in the
+published declarations.
+
+## 7. Security and code-rot audit
+
+Project discovery stops at the nearest config. Alias/catalog validation and
+atomic catalog persistence are fail-closed. Acceptance paths are portable and
+realpath-contained; a Windows junction escape is rejected by real browser
+coverage. `current` replacement changes catalog metadata only and preserves
+canonical history. Check JSON uses project-relative paths, bounded collections,
+and no image bytes. Imported references are not approved authority; bindings
+remain explicit; contract FAIL cannot be overridden by reference PASS.
+
+Viewer security regressions cover loopback binding, read-only methods,
+traversal/media containment, symlink/junction containment, and no stale PWA
+evidence. Production source has no eval/new-Function/vm execution. The only
+process spawns are controlled viewer opening and development/CI smoke tooling;
+Windows packed npm invocation uses Node's npm CLI with `shell: false`.
+
+## 8. Local packed candidate and workflow audit
+
+LOCAL_CANDIDATE_TARBALL: `my-frontend-observer-0.8.0.tgz`
+
+LOCAL_CANDIDATE_SHA256: `5e9ded9170c59de0f7c0205144fb1d6bb375ce6c6a5b70adef57f5223db43e3a`
+
+Local installed-package observation smoke: PASS (final candidate).
+
+Local installed-package project/viewer smoke: PASS (final candidate).
+
+The GitHub workflow builds and hashes one candidate in its Linux candidate job,
+uploads that tarball, downloads it on Windows/Linux/macOS, verifies the
+candidate SHA on every matrix runner, and runs both installed-package smokes.
+
+## 9. Historical failed exact-candidate evidence
+
+The latest candidate run was `35015180719` for commit
+`b32fe9759187c024cc5828b73cf0c6a682de95b0`. Its candidate job completed all
+validation, packaging, and artifact-hash steps successfully; the exact
+downloaded candidate passed both installed-package smokes on Windows and
+Ubuntu. macOS failed only the project/viewer smoke because that test compares
+the logical temporary path returned by Node (`/var/...`) to the physical path
+reported by the viewer (`/private/var/...`) in `/api/status`.
+
+This is a smoke-harness realpath presentation mismatch, not an evidence,
+containment, or product-workflow failure. It is nevertheless a formal matrix
+failure and therefore cannot be represented as cross-platform PASS.
+
+Previous run `35012678176` identified the original raw CLI artifact-path
+assumption. Run `35013965786` validated the first correction through candidate
+and Windows/Ubuntu, then identified the macOS logical/physical temporary-root
+mismatch.
+
+## 10. Authorized macOS realpath correction
+
+Classification: **TEST/READINESS PORTABILITY DEFECT**.
+
+Product behavior affected: **NO**.
+
+The viewer is permitted to report the physical evidence root. The defect was
+only the readiness smoke's raw string comparison of the caller-visible
+`/var/...` spelling with the physical `/private/var/...` spelling. The smoke
+now compares canonical physical identity with `fs.realpath()` and reports both
+the original spellings and canonical paths if a genuine mismatch occurs. On
+Windows, a smoke-local junction regression self-check proves that an alias and
+its target compare equal while a distinct directory compares unequal.
+
+Security semantics weakened: **NO**. This helper is limited to an
+already-authorized smoke assertion; project acceptance-path containment remains
+owned by production realpath validation and is unchanged.
+
+MACOS_REALPATH_TARGETED_CORRECTION: PASS
+
+## 11. Exact-candidate and cross-platform results
+
+OLD_FAILED_RUN: `35015180719`
+
+OLD_FAILED_COMMIT: `b32fe9759187c024cc5828b73cf0c6a682de95b0`
+
+ROOT_CAUSE: logical-vs-physical temporary path comparison on macOS
+
+The next run must build a new candidate once and validate that exact SHA on
+Windows, Linux, and macOS. This historical failed candidate is never rewritten
+as passing evidence.
+
+## 12. Corrected formal exact-candidate result
+
+CORRECTION_COMMIT: `d5986b5297a2b466b3373a6c896a447cdabe2bdb`
+
+NEW_GITHUB_ACTIONS_RUN_ID: `35018400346`
+
+FINAL_VALIDATED_COMMIT: `d5986b5297a2b466b3373a6c896a447cdabe2bdb`
+
+FORMAL_CANDIDATE_TARBALL: `my-frontend-observer-0.8.0.tgz`
+
+FORMAL_CANDIDATE_SHA256:
+`1ae46575595451e56f7c851273387ee4808e546940077e08a40cebcc1c4f8d30`
+
+WINDOWS: PASS
+
+LINUX: PASS
+
+MACOS: PASS
+
+CANDIDATE_SHA_PARITY: PASS
+
+The candidate job and all three exact-candidate jobs passed. The macOS packed
+project/viewer smoke passed the corrected filesystem-identity assertion.
+
+## 13. Release-state truth and next decision
+
+The source is not released as v0.8.1. Package version is `0.8.0`; npm
+publication, tag, GitHub Release, and master push are all absent. The final
+verdict is `PASS_V081_PRERELEASE_READINESS`; the next authorized stage is
+release preparation, not publication.