@dailephd/my-frontend-observer 0.9.1 → 0.10.1

package/docs/reports/v0.7-pre-release-readiness.md

@@ -1,337 +1,337 @@
-# v0.7 Pre-Release Readiness Report
-
-**Verdict: `PASS_READY_FOR_RELEASE_PREP`**
-
-This report documents a pre-release readiness validation pass over the completed,
-audited v0.7 implementation. It proves the implementation is ready to enter a
-separate release-preparation stage. It does **not** authorize publication, does
-**not** bump the package version, and does **not** merge to `master`.
-
-## Commit identity
-
-| Label | Commit |
-|---|---|
-| Audited v0.7 baseline (starting point) | `4b2a51c62f47fd1244ceab42cb37bb111cb90259` — "Add v0.7 implementation-completeness audit report" |
-| Documentation reconciliation commit | `8b6c669` |
-| **VALIDATED_CANDIDATE_HEAD** (cross-platform CI run 34054085344 validated this exact commit) | `b2286bdc9550d70fa1047a1f732968a8eca46a1e` — "Close v0.7 pre-release readiness coverage gap in packed-candidate smoke" |
-| **REPORT_COMMIT** | this commit (added after the successful CI run; contains only this report — no product/readiness behavior changes) |
-
-Branch: `validation/v0.7-pre-release`, created from the exact audited v0.7 HEAD
-(`4b2a51c`), fast-forwarded by exactly one readiness-infrastructure commit
-(`b2286bd`), then this report commit. No product source under `src/` changed at
-any point in this readiness stage.
-
-Preflight confirmed the full Prompt 1–8 commit lineage is present and ancestors
-of HEAD, the working tree was clean, and Prompt 1's preserved speculative-write
-stash (`stash@{0}`, "stray-fork-writes-preserved-for-reference") remains
-untouched — never applied, dropped, committed, or used as test evidence.
-
-## Readiness infrastructure change (the only tracked change in this stage)
-
-Commit `b2286bd` on `validation/v0.7-pre-release`:
-
-1. **Closed a real v0.7 packed-candidate coverage gap.** Inspecting the
-   existing CI smoke (`scripts/ci/runPackedObservationSmoke.mjs`) before
-   running it showed thorough v0.1–v0.6 installed-candidate coverage but
-   **zero** v0.7 coverage — no `import-reference`/`approve-reference`/
-   `evaluate-reference-fidelity` CLI exercise, and none of the v0.7
-   programmatic exports (`evaluateReferenceCandidateFidelityFromArtifactRoots`,
-   `prepareReferenceCorrection`, `reviewReferenceCorrectionAttempt`). Per the
-   task's readiness-coverage-gap rule, this was treated as a readiness gap,
-   not a product defect, and closed narrowly inside the existing smoke script
-   rather than building a second parallel framework:
-   - Real CLI help-flag assertions for all three new v0.7 commands.
-   - A real external-reference image imported and approved through the
-     installed CLI, with explicit regions (`nav-region`/`workspace-region`/
-     `rail-region`), three requirement kinds (`region-property`,
-     `region-relationship`, and tolerance kinds `exact`/`absolute-reference-px`),
-     and declared `applicability.viewport`.
-   - Explicit region↔runtime-target bindings, reusing the same runtime
-     targets (`navigation`/`workspace`/`rail`) already used by the existing
-     v0.5 contract-fixture geometry — no second fixture was built.
-   - A genuine fidelity **PASS** (against the already-captured "success"
-     candidate) and a genuine fidelity **FAIL** (against the already-captured
-     "protected-regression" candidate), each checked both with and without
-     `--enforce`, mirroring the existing `evaluate-contract` PASS/FAIL/
-     `--enforce` proof pattern already in the script.
-   - An `observe --state-file` call proving `requestConfig.explicitState`
-     round-trips through the installed candidate.
-   - Programmatic exercise of `evaluateReferenceCandidateFidelityFromArtifactRoots`,
-     `readExternalReferenceArtifact`, `prepareReferenceCorrection` (asserting
-     `status: 'handoff-ready'` and a bounded-agent-context artifact with the
-     correct `artifactKind`, exercising v0.7 Prompt 7's bounded fidelity
-     projection and the v0.6 bounded-agent-context integration together), and
-     `reviewReferenceCorrectionAttempt` against both the success candidate
-     (`overallState: 'pass'`, `approvalEligible: true`) and the regression
-     candidate (`overallState: 'fail'`, `approvalEligible: false`) — all
-     resolved from the installed package's own `node_modules`, never the
-     source checkout.
-   - A re-hash of the pre-existing source observation manifest to confirm the
-     new v0.7 calls did not mutate it (observer source immutability).
-2. **Fixed an unrelated lint gap.** `eslint.config.js`'s `ignores` list
-   predates this task's mandated `.my-dev-kit-workflow/` project-local
-   workflow convention (npm cache, temp consumer installs, candidate
-   tarballs, Playwright browser downloads) and only covered
-   `.my-dev-kit/`/`.my-dev-kit-orchestrator/`. Running `npm run lint` with
-   Chromium downloaded to `.my-dev-kit-workflow/pw-browsers/` surfaced 20
-   `no-undef` errors from ESLint parsing Chromium's own bundled JS resources.
-   Added `.my-dev-kit-workflow/**` and `.my-dev-kit-context/**` to the ignore
-   list. This is a dev-tooling config fix, not a production behavior change.
-
-No production source (`src/**`) changed. No test was weakened, skipped, or
-deleted. No package metadata changed.
-
-## Local full validation (on `b2286bd`)
-
-Environment: Windows 11, Node `v24.11.0`, npm `11.14.0` (satisfies the
-repository's `"node": ">=24"` engines constraint). All caches/temp
-state/candidate artifacts kept under `.my-dev-kit-workflow/` (gitignored,
-project-local — npm cache, Playwright browser downloads, and the readiness
-output directory), never under `C:\`.
-
-| Step | Result |
-|---|---|
-| `npm ci` | clean install, 132 packages, 0 vulnerabilities |
-| Chromium install (`playwright install chromium`, `PLAYWRIGHT_BROWSERS_PATH` project-local) | succeeded |
-| `npm run typecheck` | clean |
-| `npm run lint` | clean (after the ignore-list fix above) |
-| `npm test` | **1000/1000 unit tests passed** (50 files) — matches the expected ~1000 baseline exactly |
-| `npm run test:browser` | **124/124 browser tests passed** (10 files, real Chromium) — matches the expected ~124 baseline exactly |
-| `npm run test:security` | **68/68 passed** (5 in `tests/unit/policy.test.ts` + 63 in `tests/browser/chromiumAdapter.test.ts`) |
-| `npm run build` | clean |
-| `npm run check:docs` | "Documentation check passed (17 required files)." |
-| `git diff --check` | clean (no whitespace errors) |
-| `npm pack --dry-run` | 207 entries, only `dist/**`, `README.md`, `CHANGELOG.md`, `docs/**`, `package.json` — no `.my-dev-kit-*`, no `node_modules`, no test/script files |
-
-No unexplained test-count reduction — every count matches the previous audited
-baseline exactly. No flake was encountered locally or in CI (see "Known flake
-investigation" below).
-
-## Version-specific v0.7 validation
-
-All of the following remain covered by passing unit and/or browser tests
-(confirmed present in `tests/unit/` and `tests/browser/` and passing in the
-1000+124 counts above): external-reference artifact/lifecycle
-(`externalReference.test.ts`, `externalReferenceArtifactWriter.test.ts`,
-`externalReferencePersistenceService.test.ts`, `cliExternalReference.test.ts`),
-regions/geometry (`externalReferenceRegions.test.ts`,
-`externalReferenceRegionRelationships.test.ts`), selected requirements
-(`externalReferenceRequirements.test.ts`,
-`externalReferenceRequirementIdentity.test.ts`), reference adequacy (covered
-within the requirements suite), explicit state/applicability
-(`explicitState.test.ts`, `externalReferenceApplicability.test.ts`),
-reference/candidate compatibility (`externalReferenceCompatibility.test.ts`),
-region↔runtime-target binding (`externalReferenceRuntimeBinding.test.ts`),
-fidelity evaluation (`externalReferenceFidelity.test.ts`,
-`cliEvaluateReferenceFidelity.test.ts`), bounded fidelity projection /
-bounded-agent-context integration (`boundedAgentContextProjection.test.ts`,
-`boundedAgentContext.test.ts`), and the end-to-end correction workflow
-(`referenceCorrectionWorkflow.test.ts`, a **browser** test using real
-Chromium). This readiness stage additionally proved every one of these
-capabilities through the **installed npm package**, not just the source
-checkout (see candidate coverage below) — something the pre-existing unit/
-browser suites alone do not prove.
-
-## Command smoke (built CLI, source checkout)
-
-`node dist/cli.js --help` and per-command `--help` were exercised for every
-v0.7 and inherited command. All present and exiting 0:
-`import-reference`, `approve-reference`, `evaluate-reference-fidelity`,
-`observe`, `compare`, `approve-baseline`, `save-change-contract`,
-`evaluate-contract`.
-
-## Package content inspection
-
-`npm pack --dry-run --json` on `b2286bd`: 207 files, package size 475.4 kB,
-unpacked 2.0 MB. Contents are exactly `dist/**` (built JS/`.d.ts`/source maps),
-`README.md`, `CHANGELOG.md`, `docs/**` (including the nine v0.7 prompt
-implementation reports and the documentation-reconciliation report), and
-`package.json`. No `.my-dev-kit-*` directory, no `node_modules`, no local
-cache, no temporary consumer files, no candidate logs, no secret/private
-file, and no Prompt 1 stash content appears anywhere in the inventory. No
-package inclusion rule was changed — the existing `"files"` policy already
-produces a correct inventory.
-
-## Candidate identity
-
-One exact candidate tarball was built from the validated `b2286bd` source
-state and used unmodified across the entire cross-platform matrix.
-
-| Field | Value |
-|---|---|
-| Candidate filename | `my-frontend-observer-0.6.0.tgz` |
-| Source commit | `b2286bdc9550d70fa1047a1f732968a8eca46a1e` |
-| Package version | `0.6.0` (unchanged) |
-| **CI-built candidate SHA-256 (the one validated cross-platform)** | `0347b1f3cfd5d311e13b405c0c2fbc2f507e250cb63223d58b4d2d31df029414` |
-| Package contents | identical 207-entry inventory described above |
-
-Note: a separate local `npm pack` invocation on the same commit (used for a
-local pre-push packed-smoke dry run under `.my-dev-kit-workflow/readiness/`,
-never pushed or distributed) produced a different SHA
-(`ab8c2b6432285c113026e2d4399f238cb13aea2617bc80ec5bbbe4318cb3189b`) — this is
-expected and immaterial: `npm pack` tarballs are not byte-reproducible across
-separate invocations (gzip/tar timestamp metadata differs) even for identical
-file content. The only SHA-256 that matters for the cross-platform readiness
-claim is the one the CI **candidate** job produced once and that all three
-matrix lanes independently verified — see below.
-
-## Local clean-consumer install / packed smoke
-
-The repository's existing packed-observation smoke
-(`scripts/ci/runPackedObservationSmoke.mjs`, extended as described above) was
-run locally against the exact locally-built candidate tarball before pushing.
-It installs the tarball into a fresh, disposable consumer directory (a
-temp directory, per this pre-existing script's own established design —
-matching what CI's `windows-latest`/`ubuntu-latest`/`macos-latest` runners
-also do, since GitHub-hosted runners have no meaningfully more "project-local"
-location for an ephemeral job container), installs Chromium through that
-consumer's own installed Playwright dependency (never the source checkout's),
-and exercises the installed bin/exports directly. Result: `SMOKE PASS`, with
-every `summary.*Ok` flag `true`, including the new `v07PackedSmokeOk`.
-
-## Security validation
-
-`npm run test:security` (68/68 passed) plus source/test inspection of v0.7
-security-sensitive surfaces:
-
-- **External image file input**: format/dimension detection reads only
-  bounded header bytes (`externalReferenceImage.ts`), never decodes pixel
-  data; malformed/truncated/oversized inputs are rejected with structured
-  diagnostics (`externalReferenceImage.test.ts`).
-- **Region/requirements/applicability config input**: all three CLI file
-  loaders (`loadRegionsFile`/`loadRequirementsFile`/`loadApplicabilityFile`)
-  own only root-shape/JSON-parse syntax; every content rule (bounds, id
-  patterns, category/tolerance/subject validity) is owned by the domain
-  validators they call into, covered by
-  `externalReferenceRegions.test.ts`/`externalReferenceRequirements.test.ts`/
-  `externalReferenceApplicability.test.ts`.
-- **State-file input**: `loadStateFile` is root-shape-only; label pattern and
-  `authenticatedState` enum are enforced by `isValidExplicitStateDimensions`
-  (`explicitState.test.ts`). The state vocabulary is explicitly documented as
-  never a place for credentials/tokens/cookies/session ids.
-- **Bindings file**: `loadBindingsFile` is root-shape-only; every bound-region
-  existence/uniqueness/pattern rule is owned by
-  `isValidReferenceRuntimeBindingDeclarations`
-  (`externalReferenceRuntimeBinding.test.ts`).
-- **Path traversal / operational-path privacy**: the extended smoke itself
-  re-verifies (as the pre-existing v0.4/v0.5/v0.6 sections already did) that
-  no operational absolute filesystem path (consumer dir, artifact roots,
-  config file paths) leaks into any persisted manifest, across the new v0.7
-  calls too.
-- **No credential-bearing explicit-state data**: confirmed by the
-  `ExplicitStateDimensions`/`ExternalReferenceApplicability` closed field
-  vocabularies (`theme`/`applicationState`/`authenticatedState`/`viewport`
-  only) — no field exists for tokens/cookies/headers.
-- **Reference/observation artifact immutability**: the extended smoke
-  re-hashes the pre-existing baseline observation manifest after running all
-  new v0.7 CLI/programmatic calls and confirms it is byte-identical.
-- **No external AI/network upload**: `referenceCorrectionWorkflow.ts`'s own
-  module doc explicitly states it "never calls a remote AI provider"; grep of
-  `src/` confirms no `fetch`/network client exists outside the browser
-  automation and observer's own disposable local HTTP fixture use in tests.
-- **No observer source editing**: `prepareReferenceCorrection`/
-  `reviewReferenceCorrectionAttempt` are pure, synchronous, in-memory
-  functions with no filesystem write capability — they return structured
-  results only; source-editing is explicitly the external actor's own
-  separate responsibility per the module's documented contract.
-
-No security failure, resolved or unresolved, was found.
-
-## Cross-platform CI result
-
-- **Run**: [34054085344](https://github.com/dailephd/my-frontend-observer/actions/runs/34054085344) ("Pre-release readiness"), triggered by the push of `validation/v0.7-pre-release` at commit `b2286bd`.
-- **Candidate job** ("Package exact candidate (Linux, Node 24)"): **success**, 1m34s. Node `v24.20.0`, npm `11.19.0`. Reproduced the exact same test counts as local: 1000 unit / 124 browser / 5+63 security. Produced exactly one tarball and one SHA-256.
-- **Windows matrix** (`windows-latest exact-candidate smoke`): **success**, 1m22s. Node `v24.19.0`.
-- **Linux matrix** (`ubuntu-latest exact-candidate smoke`): **success**, 54s. Node `v24.20.0`.
-- **macOS matrix** (`macos-latest exact-candidate smoke`): **success**, 36s. Node `v24.20.0`.
-
-### Same-candidate hash verification
-
-The candidate job produced exactly one tarball and computed its SHA-256 once
-(`0347b1f3cfd5d311e13b405c0c2fbc2f507e250cb63223d58b4d2d31df029414`). Each
-matrix lane downloaded that same uploaded `candidate-package` artifact and
-independently recomputed its SHA-256 before running any smoke step:
-
-```
-windows-latest: expected=0347b1f3... actual=0347b1f3...  (match)
-ubuntu-latest:  expected=0347b1f3... actual=0347b1f3...  (match)
-macos-latest:   expected=0347b1f3... actual=0347b1f3...  (match)
-```
-
-No matrix lane ran `npm pack` itself — the workflow's `matrix-smoke` job has
-no packaging step at all, only a download-and-verify step followed by the
-smoke script. Same-candidate architecture confirmed intact.
-
-### v0.7 cross-platform proof
-
-All three matrix lanes' `smoke-summary-<os>.json` artifacts carry
-`"v07PackedSmokeOk": true` plus every individual v0.7 flag true
-(`packedImportReferenceOk`, `packedApproveReferenceOk`,
-`packedExplicitStateOk`, `packedReferenceFidelityPassOk`,
-`packedReferenceFidelityFailOk`, `packedProgrammaticFidelityOk`,
-`packedPrepareReferenceCorrectionOk`,
-`packedReviewReferenceCorrectionAttemptOk`), confirmed directly from each
-job's raw log output (not merely inferred from the job's green checkmark).
-
-### v0.1–v0.6 regression proof (same candidate, same run)
-
-The same three logs also carry the pre-existing v0.1–v0.6 flags unchanged and
-still true: `legacyCssObservationPassed`, `windowScrollScenarioPassed`,
-`targetScrollScenarioPassed` (v0.1/v0.3), semantic-locator target coverage
-(v0.2), `comparableCompareOk`/`incomparableCompareOk` (v0.4),
-`packedApproveBaselineOk`/`packedSaveChangeContractOk`/`packedEvaluatePassOk`
-(v0.5), `v06PackedSmokeOk` (v0.6). No old assertion was removed or weakened to
-make room for the new v0.7 section — it was appended.
-
-## Known flake investigation
-
-Prompt 6 previously observed one unrelated browser-test flake that passed on
-rerun; Prompts 7/8 reported clean runs. No test failure of any kind occurred
-during this readiness stage, locally or in CI — nothing required
-investigation or rerun.
-
-## Ecosystem documentation
-
-`docs/ecosystem/TOOL_ECOSYSTEM_REFERENCE.txt` and
-`docs/ecosystem/WORKFLOW_PROMPT_ASSEMBLY_RULES.txt` do not exist in this
-repository. Ecosystem docs inspected; no update needed.
-
-## Report/commit discipline
-
-- `VALIDATED_CANDIDATE_HEAD` = `b2286bdc9550d70fa1047a1f732968a8eca46a1e` — this is the exact commit the successful cross-platform CI run (34054085344) validated.
-- `REPORT_COMMIT` = the commit that adds this file, made after the CI run completed successfully, containing only this report — no product or readiness-infrastructure behavior changes. Per the task's own instruction, the readiness workflow is not re-run a second time merely to fold the report commit's own SHA into itself.
-
-## Remaining risks
-
-- The packed-smoke script's temporary consumer install directory uses
-  `node:os`'s `tmpdir()` rather than a project-local path (a pre-existing
-  characteristic of `scripts/ci/runPackedObservationSmoke.mjs`, unchanged by
-  this readiness stage — modifying it was out of scope per the instruction
-  not to build a second, parallel package-smoke architecture, and CI's own
-  hosted runners have no more "project-local" location for an ephemeral job
-  container in any case). This does not affect the truth of any readiness
-  claim in this report.
-- `package.json`'s `engines.node` requires `>=24` with no upper bound;
-  runtime drift on future Node majors is a normal, unremarkable release-prep
-  concern, not a v0.7-specific risk.
-- No new product defect was discovered during this readiness stage.
-
-## Final verdict
-
-**`PASS_READY_FOR_RELEASE_PREP`**
-
-All conditions in the task's PASS-verdict checklist are satisfied: audited
-baseline present, clean install, typecheck, lint, full unit tests (1000),
-full browser tests (124), security tests (68), build, docs check, diff
-check, and pack dry-run all pass; one exact candidate tarball was built and
-its SHA-256 recorded; a clean consumer installed it and the installed-
-candidate smoke passed, meaningfully exercising the full v0.7 public surface
-(CLI + programmatic) in addition to preserving v0.1–v0.6 regression coverage;
-GitHub Actions' candidate job and all three (Windows/Linux/macOS) matrix
-lanes passed, each independently verifying the identical candidate SHA-256
-with no lane building a replacement tarball; no unresolved security,
-product, or coverage-gap issue exists; the package version remains `0.6.0`;
-no tag, release, or publish action occurred; and the repository's tracked
-state is clean at completion. This means the v0.7 implementation is **ready
-for release preparation** — not that release preparation has already
-happened.
+# v0.7 Pre-Release Readiness Report
+
+**Verdict: `PASS_READY_FOR_RELEASE_PREP`**
+
+This report documents a pre-release readiness validation pass over the completed,
+audited v0.7 implementation. It proves the implementation is ready to enter a
+separate release-preparation stage. It does **not** authorize publication, does
+**not** bump the package version, and does **not** merge to `master`.
+
+## Commit identity
+
+| Label | Commit |
+|---|---|
+| Audited v0.7 baseline (starting point) | `4b2a51c62f47fd1244ceab42cb37bb111cb90259` — "Add v0.7 implementation-completeness audit report" |
+| Documentation reconciliation commit | `8b6c669` |
+| **VALIDATED_CANDIDATE_HEAD** (cross-platform CI run 34054085344 validated this exact commit) | `b2286bdc9550d70fa1047a1f732968a8eca46a1e` — "Close v0.7 pre-release readiness coverage gap in packed-candidate smoke" |
+| **REPORT_COMMIT** | this commit (added after the successful CI run; contains only this report — no product/readiness behavior changes) |
+
+Branch: `validation/v0.7-pre-release`, created from the exact audited v0.7 HEAD
+(`4b2a51c`), fast-forwarded by exactly one readiness-infrastructure commit
+(`b2286bd`), then this report commit. No product source under `src/` changed at
+any point in this readiness stage.
+
+Preflight confirmed the full Prompt 1–8 commit lineage is present and ancestors
+of HEAD, the working tree was clean, and Prompt 1's preserved speculative-write
+stash (`stash@{0}`, "stray-fork-writes-preserved-for-reference") remains
+untouched — never applied, dropped, committed, or used as test evidence.
+
+## Readiness infrastructure change (the only tracked change in this stage)
+
+Commit `b2286bd` on `validation/v0.7-pre-release`:
+
+1. **Closed a real v0.7 packed-candidate coverage gap.** Inspecting the
+   existing CI smoke (`scripts/ci/runPackedObservationSmoke.mjs`) before
+   running it showed thorough v0.1–v0.6 installed-candidate coverage but
+   **zero** v0.7 coverage — no `import-reference`/`approve-reference`/
+   `evaluate-reference-fidelity` CLI exercise, and none of the v0.7
+   programmatic exports (`evaluateReferenceCandidateFidelityFromArtifactRoots`,
+   `prepareReferenceCorrection`, `reviewReferenceCorrectionAttempt`). Per the
+   task's readiness-coverage-gap rule, this was treated as a readiness gap,
+   not a product defect, and closed narrowly inside the existing smoke script
+   rather than building a second parallel framework:
+   - Real CLI help-flag assertions for all three new v0.7 commands.
+   - A real external-reference image imported and approved through the
+     installed CLI, with explicit regions (`nav-region`/`workspace-region`/
+     `rail-region`), three requirement kinds (`region-property`,
+     `region-relationship`, and tolerance kinds `exact`/`absolute-reference-px`),
+     and declared `applicability.viewport`.
+   - Explicit region↔runtime-target bindings, reusing the same runtime
+     targets (`navigation`/`workspace`/`rail`) already used by the existing
+     v0.5 contract-fixture geometry — no second fixture was built.
+   - A genuine fidelity **PASS** (against the already-captured "success"
+     candidate) and a genuine fidelity **FAIL** (against the already-captured
+     "protected-regression" candidate), each checked both with and without
+     `--enforce`, mirroring the existing `evaluate-contract` PASS/FAIL/
+     `--enforce` proof pattern already in the script.
+   - An `observe --state-file` call proving `requestConfig.explicitState`
+     round-trips through the installed candidate.
+   - Programmatic exercise of `evaluateReferenceCandidateFidelityFromArtifactRoots`,
+     `readExternalReferenceArtifact`, `prepareReferenceCorrection` (asserting
+     `status: 'handoff-ready'` and a bounded-agent-context artifact with the
+     correct `artifactKind`, exercising v0.7 Prompt 7's bounded fidelity
+     projection and the v0.6 bounded-agent-context integration together), and
+     `reviewReferenceCorrectionAttempt` against both the success candidate
+     (`overallState: 'pass'`, `approvalEligible: true`) and the regression
+     candidate (`overallState: 'fail'`, `approvalEligible: false`) — all
+     resolved from the installed package's own `node_modules`, never the
+     source checkout.
+   - A re-hash of the pre-existing source observation manifest to confirm the
+     new v0.7 calls did not mutate it (observer source immutability).
+2. **Fixed an unrelated lint gap.** `eslint.config.js`'s `ignores` list
+   predates this task's mandated `.my-dev-kit-workflow/` project-local
+   workflow convention (npm cache, temp consumer installs, candidate
+   tarballs, Playwright browser downloads) and only covered
+   `.my-dev-kit/`/`.my-dev-kit-orchestrator/`. Running `npm run lint` with
+   Chromium downloaded to `.my-dev-kit-workflow/pw-browsers/` surfaced 20
+   `no-undef` errors from ESLint parsing Chromium's own bundled JS resources.
+   Added `.my-dev-kit-workflow/**` and `.my-dev-kit-context/**` to the ignore
+   list. This is a dev-tooling config fix, not a production behavior change.
+
+No production source (`src/**`) changed. No test was weakened, skipped, or
+deleted. No package metadata changed.
+
+## Local full validation (on `b2286bd`)
+
+Environment: Windows 11, Node `v24.11.0`, npm `11.14.0` (satisfies the
+repository's `"node": ">=24"` engines constraint). All caches/temp
+state/candidate artifacts kept under `.my-dev-kit-workflow/` (gitignored,
+project-local — npm cache, Playwright browser downloads, and the readiness
+output directory), never under `C:\`.
+
+| Step | Result |
+|---|---|
+| `npm ci` | clean install, 132 packages, 0 vulnerabilities |
+| Chromium install (`playwright install chromium`, `PLAYWRIGHT_BROWSERS_PATH` project-local) | succeeded |
+| `npm run typecheck` | clean |
+| `npm run lint` | clean (after the ignore-list fix above) |
+| `npm test` | **1000/1000 unit tests passed** (50 files) — matches the expected ~1000 baseline exactly |
+| `npm run test:browser` | **124/124 browser tests passed** (10 files, real Chromium) — matches the expected ~124 baseline exactly |
+| `npm run test:security` | **68/68 passed** (5 in `tests/unit/policy.test.ts` + 63 in `tests/browser/chromiumAdapter.test.ts`) |
+| `npm run build` | clean |
+| `npm run check:docs` | "Documentation check passed (17 required files)." |
+| `git diff --check` | clean (no whitespace errors) |
+| `npm pack --dry-run` | 207 entries, only `dist/**`, `README.md`, `CHANGELOG.md`, `docs/**`, `package.json` — no `.my-dev-kit-*`, no `node_modules`, no test/script files |
+
+No unexplained test-count reduction — every count matches the previous audited
+baseline exactly. No flake was encountered locally or in CI (see "Known flake
+investigation" below).
+
+## Version-specific v0.7 validation
+
+All of the following remain covered by passing unit and/or browser tests
+(confirmed present in `tests/unit/` and `tests/browser/` and passing in the
+1000+124 counts above): external-reference artifact/lifecycle
+(`externalReference.test.ts`, `externalReferenceArtifactWriter.test.ts`,
+`externalReferencePersistenceService.test.ts`, `cliExternalReference.test.ts`),
+regions/geometry (`externalReferenceRegions.test.ts`,
+`externalReferenceRegionRelationships.test.ts`), selected requirements
+(`externalReferenceRequirements.test.ts`,
+`externalReferenceRequirementIdentity.test.ts`), reference adequacy (covered
+within the requirements suite), explicit state/applicability
+(`explicitState.test.ts`, `externalReferenceApplicability.test.ts`),
+reference/candidate compatibility (`externalReferenceCompatibility.test.ts`),
+region↔runtime-target binding (`externalReferenceRuntimeBinding.test.ts`),
+fidelity evaluation (`externalReferenceFidelity.test.ts`,
+`cliEvaluateReferenceFidelity.test.ts`), bounded fidelity projection /
+bounded-agent-context integration (`boundedAgentContextProjection.test.ts`,
+`boundedAgentContext.test.ts`), and the end-to-end correction workflow
+(`referenceCorrectionWorkflow.test.ts`, a **browser** test using real
+Chromium). This readiness stage additionally proved every one of these
+capabilities through the **installed npm package**, not just the source
+checkout (see candidate coverage below) — something the pre-existing unit/
+browser suites alone do not prove.
+
+## Command smoke (built CLI, source checkout)
+
+`node dist/cli.js --help` and per-command `--help` were exercised for every
+v0.7 and inherited command. All present and exiting 0:
+`import-reference`, `approve-reference`, `evaluate-reference-fidelity`,
+`observe`, `compare`, `approve-baseline`, `save-change-contract`,
+`evaluate-contract`.
+
+## Package content inspection
+
+`npm pack --dry-run --json` on `b2286bd`: 207 files, package size 475.4 kB,
+unpacked 2.0 MB. Contents are exactly `dist/**` (built JS/`.d.ts`/source maps),
+`README.md`, `CHANGELOG.md`, `docs/**` (including the nine v0.7 prompt
+implementation reports and the documentation-reconciliation report), and
+`package.json`. No `.my-dev-kit-*` directory, no `node_modules`, no local
+cache, no temporary consumer files, no candidate logs, no secret/private
+file, and no Prompt 1 stash content appears anywhere in the inventory. No
+package inclusion rule was changed — the existing `"files"` policy already
+produces a correct inventory.
+
+## Candidate identity
+
+One exact candidate tarball was built from the validated `b2286bd` source
+state and used unmodified across the entire cross-platform matrix.
+
+| Field | Value |
+|---|---|
+| Candidate filename | `my-frontend-observer-0.6.0.tgz` |
+| Source commit | `b2286bdc9550d70fa1047a1f732968a8eca46a1e` |
+| Package version | `0.6.0` (unchanged) |
+| **CI-built candidate SHA-256 (the one validated cross-platform)** | `0347b1f3cfd5d311e13b405c0c2fbc2f507e250cb63223d58b4d2d31df029414` |
+| Package contents | identical 207-entry inventory described above |
+
+Note: a separate local `npm pack` invocation on the same commit (used for a
+local pre-push packed-smoke dry run under `.my-dev-kit-workflow/readiness/`,
+never pushed or distributed) produced a different SHA
+(`ab8c2b6432285c113026e2d4399f238cb13aea2617bc80ec5bbbe4318cb3189b`) — this is
+expected and immaterial: `npm pack` tarballs are not byte-reproducible across
+separate invocations (gzip/tar timestamp metadata differs) even for identical
+file content. The only SHA-256 that matters for the cross-platform readiness
+claim is the one the CI **candidate** job produced once and that all three
+matrix lanes independently verified — see below.
+
+## Local clean-consumer install / packed smoke
+
+The repository's existing packed-observation smoke
+(`scripts/ci/runPackedObservationSmoke.mjs`, extended as described above) was
+run locally against the exact locally-built candidate tarball before pushing.
+It installs the tarball into a fresh, disposable consumer directory (a
+temp directory, per this pre-existing script's own established design —
+matching what CI's `windows-latest`/`ubuntu-latest`/`macos-latest` runners
+also do, since GitHub-hosted runners have no meaningfully more "project-local"
+location for an ephemeral job container), installs Chromium through that
+consumer's own installed Playwright dependency (never the source checkout's),
+and exercises the installed bin/exports directly. Result: `SMOKE PASS`, with
+every `summary.*Ok` flag `true`, including the new `v07PackedSmokeOk`.
+
+## Security validation
+
+`npm run test:security` (68/68 passed) plus source/test inspection of v0.7
+security-sensitive surfaces:
+
+- **External image file input**: format/dimension detection reads only
+  bounded header bytes (`externalReferenceImage.ts`), never decodes pixel
+  data; malformed/truncated/oversized inputs are rejected with structured
+  diagnostics (`externalReferenceImage.test.ts`).
+- **Region/requirements/applicability config input**: all three CLI file
+  loaders (`loadRegionsFile`/`loadRequirementsFile`/`loadApplicabilityFile`)
+  own only root-shape/JSON-parse syntax; every content rule (bounds, id
+  patterns, category/tolerance/subject validity) is owned by the domain
+  validators they call into, covered by
+  `externalReferenceRegions.test.ts`/`externalReferenceRequirements.test.ts`/
+  `externalReferenceApplicability.test.ts`.
+- **State-file input**: `loadStateFile` is root-shape-only; label pattern and
+  `authenticatedState` enum are enforced by `isValidExplicitStateDimensions`
+  (`explicitState.test.ts`). The state vocabulary is explicitly documented as
+  never a place for credentials/tokens/cookies/session ids.
+- **Bindings file**: `loadBindingsFile` is root-shape-only; every bound-region
+  existence/uniqueness/pattern rule is owned by
+  `isValidReferenceRuntimeBindingDeclarations`
+  (`externalReferenceRuntimeBinding.test.ts`).
+- **Path traversal / operational-path privacy**: the extended smoke itself
+  re-verifies (as the pre-existing v0.4/v0.5/v0.6 sections already did) that
+  no operational absolute filesystem path (consumer dir, artifact roots,
+  config file paths) leaks into any persisted manifest, across the new v0.7
+  calls too.
+- **No credential-bearing explicit-state data**: confirmed by the
+  `ExplicitStateDimensions`/`ExternalReferenceApplicability` closed field
+  vocabularies (`theme`/`applicationState`/`authenticatedState`/`viewport`
+  only) — no field exists for tokens/cookies/headers.
+- **Reference/observation artifact immutability**: the extended smoke
+  re-hashes the pre-existing baseline observation manifest after running all
+  new v0.7 CLI/programmatic calls and confirms it is byte-identical.
+- **No external AI/network upload**: `referenceCorrectionWorkflow.ts`'s own
+  module doc explicitly states it "never calls a remote AI provider"; grep of
+  `src/` confirms no `fetch`/network client exists outside the browser
+  automation and observer's own disposable local HTTP fixture use in tests.
+- **No observer source editing**: `prepareReferenceCorrection`/
+  `reviewReferenceCorrectionAttempt` are pure, synchronous, in-memory
+  functions with no filesystem write capability — they return structured
+  results only; source-editing is explicitly the external actor's own
+  separate responsibility per the module's documented contract.
+
+No security failure, resolved or unresolved, was found.
+
+## Cross-platform CI result
+
+- **Run**: [34054085344](https://github.com/dailephd/my-frontend-observer/actions/runs/34054085344) ("Pre-release readiness"), triggered by the push of `validation/v0.7-pre-release` at commit `b2286bd`.
+- **Candidate job** ("Package exact candidate (Linux, Node 24)"): **success**, 1m34s. Node `v24.20.0`, npm `11.19.0`. Reproduced the exact same test counts as local: 1000 unit / 124 browser / 5+63 security. Produced exactly one tarball and one SHA-256.
+- **Windows matrix** (`windows-latest exact-candidate smoke`): **success**, 1m22s. Node `v24.19.0`.
+- **Linux matrix** (`ubuntu-latest exact-candidate smoke`): **success**, 54s. Node `v24.20.0`.
+- **macOS matrix** (`macos-latest exact-candidate smoke`): **success**, 36s. Node `v24.20.0`.
+
+### Same-candidate hash verification
+
+The candidate job produced exactly one tarball and computed its SHA-256 once
+(`0347b1f3cfd5d311e13b405c0c2fbc2f507e250cb63223d58b4d2d31df029414`). Each
+matrix lane downloaded that same uploaded `candidate-package` artifact and
+independently recomputed its SHA-256 before running any smoke step:
+
+```
+windows-latest: expected=0347b1f3... actual=0347b1f3...  (match)
+ubuntu-latest:  expected=0347b1f3... actual=0347b1f3...  (match)
+macos-latest:   expected=0347b1f3... actual=0347b1f3...  (match)
+```
+
+No matrix lane ran `npm pack` itself — the workflow's `matrix-smoke` job has
+no packaging step at all, only a download-and-verify step followed by the
+smoke script. Same-candidate architecture confirmed intact.
+
+### v0.7 cross-platform proof
+
+All three matrix lanes' `smoke-summary-<os>.json` artifacts carry
+`"v07PackedSmokeOk": true` plus every individual v0.7 flag true
+(`packedImportReferenceOk`, `packedApproveReferenceOk`,
+`packedExplicitStateOk`, `packedReferenceFidelityPassOk`,
+`packedReferenceFidelityFailOk`, `packedProgrammaticFidelityOk`,
+`packedPrepareReferenceCorrectionOk`,
+`packedReviewReferenceCorrectionAttemptOk`), confirmed directly from each
+job's raw log output (not merely inferred from the job's green checkmark).
+
+### v0.1–v0.6 regression proof (same candidate, same run)
+
+The same three logs also carry the pre-existing v0.1–v0.6 flags unchanged and
+still true: `legacyCssObservationPassed`, `windowScrollScenarioPassed`,
+`targetScrollScenarioPassed` (v0.1/v0.3), semantic-locator target coverage
+(v0.2), `comparableCompareOk`/`incomparableCompareOk` (v0.4),
+`packedApproveBaselineOk`/`packedSaveChangeContractOk`/`packedEvaluatePassOk`
+(v0.5), `v06PackedSmokeOk` (v0.6). No old assertion was removed or weakened to
+make room for the new v0.7 section — it was appended.
+
+## Known flake investigation
+
+Prompt 6 previously observed one unrelated browser-test flake that passed on
+rerun; Prompts 7/8 reported clean runs. No test failure of any kind occurred
+during this readiness stage, locally or in CI — nothing required
+investigation or rerun.
+
+## Ecosystem documentation
+
+`docs/ecosystem/TOOL_ECOSYSTEM_REFERENCE.txt` and
+`docs/ecosystem/WORKFLOW_PROMPT_ASSEMBLY_RULES.txt` do not exist in this
+repository. Ecosystem docs inspected; no update needed.
+
+## Report/commit discipline
+
+- `VALIDATED_CANDIDATE_HEAD` = `b2286bdc9550d70fa1047a1f732968a8eca46a1e` — this is the exact commit the successful cross-platform CI run (34054085344) validated.
+- `REPORT_COMMIT` = the commit that adds this file, made after the CI run completed successfully, containing only this report — no product or readiness-infrastructure behavior changes. Per the task's own instruction, the readiness workflow is not re-run a second time merely to fold the report commit's own SHA into itself.
+
+## Remaining risks
+
+- The packed-smoke script's temporary consumer install directory uses
+  `node:os`'s `tmpdir()` rather than a project-local path (a pre-existing
+  characteristic of `scripts/ci/runPackedObservationSmoke.mjs`, unchanged by
+  this readiness stage — modifying it was out of scope per the instruction
+  not to build a second, parallel package-smoke architecture, and CI's own
+  hosted runners have no more "project-local" location for an ephemeral job
+  container in any case). This does not affect the truth of any readiness
+  claim in this report.
+- `package.json`'s `engines.node` requires `>=24` with no upper bound;
+  runtime drift on future Node majors is a normal, unremarkable release-prep
+  concern, not a v0.7-specific risk.
+- No new product defect was discovered during this readiness stage.
+
+## Final verdict
+
+**`PASS_READY_FOR_RELEASE_PREP`**
+
+All conditions in the task's PASS-verdict checklist are satisfied: audited
+baseline present, clean install, typecheck, lint, full unit tests (1000),
+full browser tests (124), security tests (68), build, docs check, diff
+check, and pack dry-run all pass; one exact candidate tarball was built and
+its SHA-256 recorded; a clean consumer installed it and the installed-
+candidate smoke passed, meaningfully exercising the full v0.7 public surface
+(CLI + programmatic) in addition to preserving v0.1–v0.6 regression coverage;
+GitHub Actions' candidate job and all three (Windows/Linux/macOS) matrix
+lanes passed, each independently verifying the identical candidate SHA-256
+with no lane building a replacement tarball; no unresolved security,
+product, or coverage-gap issue exists; the package version remains `0.6.0`;
+no tag, release, or publish action occurred; and the repository's tracked
+state is clean at completion. This means the v0.7 implementation is **ready
+for release preparation** — not that release preparation has already
+happened.