@iowarp/clio-coder 0.4.7 → 0.4.8

package/docs/process/release-cut-checklist.md

@@ -1,223 +1,116 @@
 # Release-Cut Checklist
 
-> **Visual blueprint:** The source checkout includes the complete
-> [Release-Cut Checklist visual reference](https://github.com/iowarp/clio-coder/blob/main/docs/html/release_checklist_blueprint.html).
-
-This document provides the standard procedure for cutting a release of Clio Coder.
-Releases are cut from an annotated tag on canonical main. The GitHub release is
-produced by GitHub Actions, while package publication to npm is an authorized manual
-step performed by a maintainer. Everything before the authorization boundary is local,
-repeatable, and reversible. Every step following the authorization boundary affects
-canonical remote state or publishes immutable packages.
-
-## Part 1: Candidate Preparation on a Local Compact Branch
-
-Maintainers prepare release candidates on a local-only compact branch named after
-the version without punctuation, such as `v046` for version `0.4.6`. Dotted branch
-names like `v0.4.6` are forbidden because dotted names belong exclusively to immutable
-tags. The canonical repository hosts only `main`, and no release candidate branch is
-ever pushed to canonical origin.
-
-1. Ensure the working tree is clean and updated from canonical origin:
-
-   ```bash
-   git checkout -b v046 origin/main
-   ```
-
-2. Update `version` in `package.json` and `assets/acp-registry/agent.json` to the
-   release version. Update the README's source-install tag and remove any
-   development-only notices. Keep historical release records, protocol schema
-   versions, dependency versions, and migration fixtures unchanged.
-
-3. Retitle the active changelog section in `CHANGELOG.md` from `## Unreleased` to
-   `## <version> - YYYY-MM-DD`. The release gate in `scripts/check-release.mjs` requires
-   the first version header to match the version in `package.json`.
-
-4. Commit the release candidate preparation locally:
-
-   ```bash
-   git commit -am "chore(release): prepare <version>"
-   ```
-
-## Part 2: Local Candidate Verification Gate
-
-Run deterministic local checks on the candidate commit before requesting authorization.
-
-1. Execute the release gate:
-
-   ```bash
-   pnpm run ci:release
-   ```
-
-   This gate runs `pnpm run ci` followed by `node scripts/check-release.mjs`. It verifies
-   type checking, Biome formatting, hygiene rules, architecture boundary invariants,
-   the build, the contract and smoke test suites, trace-viewer tests, and dist integrity.
-   The packaging audit checks executable entry shebangs, ensures forbidden files like
-   source maps and caches are omitted, verifies runtime resources from `scripts/release-manifest.json`,
-   and enforces size limits (10 MB packed, 50 MB unpacked).
-
-2. Optionally validate a live model turn against a configured target:
-
-   ```bash
-   node dist/cli/index.js run --target <id> --autonomy read-only "Reply with exactly: CLIO_LIVE_OK"
-   ```
-
-3. Run the real-home smoke test against the operator configuration:
-
-   ```bash
-   pnpm run smoke:real-home --target <id> --strict
-   ```
-
-   This runs `scripts/smoke-real-home.sh` using a copy of operator settings in a scratch
-   `CLIO_CODER_HOME`. The `--strict` flag ensures any failing rows from `clio-coder doctor`
-   fail the smoke run.
-
-4. Inspect the npm package contents with a dry run:
-
-   ```bash
-   npm pack --dry-run
-   ```
-
-   Confirm the complete `library/` tree and `.claude-plugin/marketplace.json`
-   accompany `dist/`, `src/`, and the documented runtime resources. The repository's
-   `.agents/skills/` symlinks are clone conveniences and are not tarball contents.
-
-5. Validate an installed tarball in a clean temporary directory:
-
-   Create a temporary directory, pack the tarball, install it via npm, and verify
-   installed binary lifecycle commands in an isolated environment with an empty `CLIO_CODER_HOME`:
-
-   ```bash
-   clio-coder --version
-   clio-coder --help
-   clio-coder doctor
-   clio-coder uninstall --dry-run
-   ```
-
-## Part 3: Candidate Review and Authorization Boundary
-
-Before touching any remote ref, summarize the candidate for maintainer review:
-- Candidate commit SHA
-- Results of `pnpm run ci:release`
-- Verification output from real-home smoke and installed package testing
-- Changelog contents and target npm version
-
-Every step below changes canonical remote refs, creates a release, or publishes
-an immutable package. Do not execute any of them without explicit maintainer authorization.
-
-## Part 4: Fast-forward Canonical Main
-
-1. Fetch the latest remote status from origin:
-
-   ```bash
-   git fetch origin
-   ```
-
-2. Confirm `origin/main` is an ancestor of the local candidate branch.
-
-3. Fast-forward local `main` to the candidate commit:
-
-   ```bash
-   git checkout main
-   git merge --ff-only v046
-   ```
-
-4. Verify that local `main` matches the reviewed candidate SHA exactly.
-
-5. Push `main` to canonical origin:
-
-   ```bash
-   git push origin refs/heads/main:refs/heads/main
-   ```
-
-   No release branch is ever pushed to origin.
-
-## Part 5: Tagging and GitHub Release
-
-1. Wait for GitHub Actions CI on canonical `main` to finish green for the pushed SHA.
-
-2. Create an annotated git tag matching the version:
-
-   ```bash
-   git tag -a v<version> -m "Clio Coder <version>"
-   ```
-
-3. Push only the release tag to canonical origin:
-
-   ```bash
-   git push origin refs/tags/v<version>
-   ```
-
-4. Pushing the tag triggers `.github/workflows/release.yml`. The workflow:
-   - Verifies the tag matches `package.json`.
-   - Runs `pnpm run ci:release` on the tagged commit.
-   - Packs the release tarball with `npm pack`.
-   - Extracts the version changelog section from `CHANGELOG.md`.
-   - Creates the GitHub Release with the tarball attached using `gh release create`.
-
-5. Inspect the GitHub Actions workflow run and confirm the GitHub release is published.
-
-6. Reconcile the release milestone against the tagged commits and each ticket's
-   acceptance evidence. `Fixes #123` or `Resolves #123` in a commit closes that
-   ticket when the commit reaches default-branch `main`; a bare `#123`, changelog
-   mention, tag, or GitHub release does not. Verify the resulting issue state.
-   Explicitly close completed tickets missed by automatic closure and retain
-   their implementing commit and validation references. Carry incomplete work
-   forward with its remaining criteria, then close the reconciled milestone.
-   Never infer completion from a release-note mention alone.
-
-## Part 6: Package Publication to npm
-
-Publishing to npm is a manual maintainer step performed from the tagged commit.
-
-1. Confirm authentication and registry status:
-
-   ```bash
-   npm whoami
-   ```
-
-2. Confirm the version does not already exist on npm:
-
-   ```bash
-   npm view @iowarp/clio-coder@<version>
-   ```
-
-3. Publish the package from the tagged checkout:
-
-   ```bash
-   npm publish
-   ```
-
-   The `prepublishOnly` lifecycle script sets `CLIO_CODER_RELEASE_CONTEXT=publish` and
-   re-executes `pnpm run ci:release` as a mandatory release-mode verification gate before
-   files are uploaded. When publishing a pre-release channel, append `--tag <channel>`.
-
-## Part 7: Post-Publish Verification and Branch Closeout
-
-1. Verify package availability on npm:
-
-   ```bash
-   npm view @iowarp/clio-coder version
-   ```
-
-2. On a clean machine, install the package globally and run basic lifecycle checks:
-
-   ```bash
-   npm install -g @iowarp/clio-coder@<version>
-   clio-coder --version
-   clio-coder doctor
-   ```
-
-3. Remove the local compact candidate branch:
-
-   ```bash
-   git branch -d v046
-   ```
-
-   The canonical repository remains in its steady state containing only `main` and immutable tags.
-
-## Part 8: Rollback and Error Recovery
-
-npm package publication is irreversible. A published version cannot be removed or overwritten.
-Any issue discovered after publication must be resolved through a subsequent release. Prior
-to pushing git tags or publishing to npm, local candidate commits can be amended or reset freely.
+Qualify one committed candidate and its exact npm tarball. Publication uses a fast
+preflight of that evidence. Development investigations are separate and are never
+implicitly repeated by a publish lifecycle hook.
+
+## Prepare locally
+
+1. Inspect `git status --short --branch`. Preserve operator work. Use one local
+   candidate branch; do not push main, candidate branches, or tags without authorization.
+2. Set the approved version in `package.json` and `assets/acp-registry/agent.json`,
+   date the matching top changelog section, and align the README install tag.
+3. Commit all candidate changes. Qualification refuses tracked or untracked source
+   changes. Ignored operator files are not candidate inputs; ignored `dist/` bytes
+   are verified through the actual npm package.
+4. Install once with `pnpm install --frozen-lockfile`. Record cold installation time
+   separately when comparing hosted gate times.
+
+## Qualify the candidate
+
+```bash
+pnpm run ci:release
+```
+
+This runs:
+
+- The routine gate: root types, lint/hygiene and library pins, one build, core
+  safety/session/provider/accounting/extension contracts, three real CLI/ACP/process
+  smoke files, and the web authentication and runtime boundary tests.
+- Web TypeScript checks and the shipped dependency advisory/package audit.
+- One exact npm tarball install with normal lifecycle scripts, installed resources,
+  lazy chunks, CLI and extension/library behavior, both web workers and a real Chrome
+  boot/reconnect against that installed server.
+- Native invocation timing with delayed real HTTP headers, durable call timing and
+  eval first-call selection.
+
+No real model, npm login or publication occurs. An unavailable registry or advisory
+service fails qualification. Chrome must be installed at `/usr/bin/google-chrome` on
+Linux. Windows subprocess semantics have a separate narrow CI lane; a Linux pass is
+not evidence of a full Windows or macOS pass.
+
+The command prints the qualified SHA, tarball path and SHA-256. Evidence lives outside
+the checkout under `~/.cache/clio-coder/qualification/<checkout-id>/`, bounded to one
+candidate per checkout. Starting qualification deletes the earlier receipt. A failed
+or cancelled run cannot leave an older qualification available for publication.
+Qualification also repacks after testing and refuses changed package bytes.
+
+Do not run the full suite, rebuild, repack for manual installation, or repeat the
+routine gate afterward. Relevant development regressions should be exercised while
+implementing the change, before qualifying the final committed candidate.
+
+## Review and authorize remote changes
+
+Present the exact commit, package digest, verification results and release notes.
+Every remote main/tag update, GitHub release and npm publication requires explicit
+maintainer authorization.
+
+After authorization, fetch origin, check that `origin/main` is an ancestor of the
+candidate, and fast-forward local main. Verify the SHA is unchanged. Fetch once more
+and stop on unexpected remote movement before pushing only main. After required CI
+passes for that SHA, create and push only the annotated version tag matching
+`package.json`. Never use a dotted release-tag name for a branch.
+
+A temporary `ci-scratch-*` branch is permitted only when explicitly authorized for
+hosted verification. Its CI runs candidate qualification. Delete that owned remote
+branch after inspection. Routine main/PR CI runs `pnpm run ci` as `ci (22)` and cancels superseded
+runs. The required `ci (24)` check tests only engine, provider and durable-session
+compatibility on the other supported Node major, without another build or full gate.
+
+## GitHub release
+
+The tag workflow qualifies the exact tagged source with read-only permissions. It
+uploads the tested tarball and checksum. A separate `release` job has `needs: qualify`,
+verifies the downloaded checksum and creates the release using the matching changelog
+section. Only that job has `contents: write`. Failure or cancellation of qualification
+prevents release creation. No retries, `continue-on-error`, independent repacking or
+npm publication are part of the workflow.
+
+## Publish after authorization
+
+From the unchanged locally qualified checkout, with the same Node version:
+
+```bash
+pnpm run release:preflight
+npm publish
+```
+
+`prepublishOnly` performs the same fast preflight. It checks the clean source SHA,
+Node version, qualification age (maximum 24 hours), original tarball digest, current
+npm package digest, and dated matching release notes. Current packaging includes
+ignored build output, so changing a chunk also invalidates the qualification. Missing,
+stale or changed inputs fail closed and require `pnpm run ci:release` again.
+
+Use normal npm authentication separately when publication is authorized. Confirm the
+version is available before publishing; do not log in or publish merely to test this
+pipeline. No `--ignore-scripts`, bypass flags or hand-authored "already tested" markers.
+
+Verify npm availability and installation after publication, reconcile completed and
+outstanding milestone issues, and close out the local candidate branch only after its
+work is proven on canonical main. Published tags are immutable.
+
+## Optional development investigations
+
+```bash
+pnpm run test:file -- tests/extended/<file>.test.ts
+pnpm run test:full
+pnpm run test:web:full
+pnpm --filter @iowarp/clio-coder-web verify
+pnpm run smoke:real-home -- --target <configured-target-id> --strict
+```
+
+The full root/web suites, browser viewport/accessibility matrix, live models, native
+host interoperability and operator-home checks support development and investigations.
+They are not publication gates. Keep scratch outside the checkout, bound it, clean it,
+and retain subprocess ownership until children settle. Never move an unresolved
+correctness failure out of a required gate to obtain a green release.

package/docs/process/scientific-validation.md

@@ -1,8 +1,5 @@
 # Clio Coder Scientific Validation Contracts
 
-> **Visual blueprint:** The source checkout includes the complete
-> [Clio Coder Scientific Validation Contracts visual reference](https://github.com/iowarp/clio-coder/blob/main/docs/html/validation_blueprint.html).
-
 Scientific software development cannot treat simple file presence as proof of correctness. A simulation script that crashes on rank 48, or writes out NetCDF arrays filled with `NaN`s, may still successfully write a file to the disk. 
 
 Clio Coder recognizes a **scientific validation contract** as an opt-in signal for a higher evidence bar. One strict loader in `src/domains/safety/validation-contract.ts` reads the first of `.clio-coder/validation.yaml`, `.clio-coder/validation.yml`, `validation.yaml`, or `validation.yml` at the workspace root and parses it under the version-1 schema below. A contract that parses raises the default rigor level to `high`. A contract that does not parse (empty, malformed YAML, unknown field, unsupported version, over the 256 KiB cap) leaves rigor at `normal` and is diagnosed with the exact fault: `clio-coder doctor` reports it in the `validation contract` row, the interactive session prints it once at startup, and `clio-coder verifiers author` repeats it. A Markdown `VALIDATION.md` is recognized as present but is never parsed and never raises rigor on its own; it is advisory prose for developers, project agents, and external validators.
@@ -143,5 +140,5 @@ File readback establishes artifact inspection, not executed scientific validatio
    - If mutating tool calls occurred in that window without executed validation evidence or a `limitation` receipt, `finishContractRegistration` (`src/domains/safety/finish-contract-registration.ts`) emits a `request_continuation` middleware effect accompanied by a reminder (`HIGH_RIGOR_REVALIDATION_MESSAGE`). At normal rigor, it emits an advisory reminder without blocking.
    - The gate checks structural evidence presence; it does not grade the empirical correctness of scientific code. Runtime turn budgets, deadline limits, operator cancellation, and tool failures still apply.
    - A limitation receipt never converts missing or failing checks into a pass; it formally records the limitation so callers and operators know the scientific result is incomplete.
-   - Verified by contracts `tests/contracts/materio-plugin.test.ts` and `tests/contracts/safety-policy-remediation.test.ts`.
+   - Verified by contracts `tests/extended/materio-plugin.test.ts` and `tests/extended/safety-policy-remediation.test.ts`.
 

package/library/registry.yaml

@@ -185,9 +185,9 @@ entries:
       - run Clio contract tests
       - test ACP over stdio
       - Clio mock provider harness
-    version: 0.3.0
+    version: 0.3.1
     sourceUrl: skills/meta/clio-coder-test
-    sha256: 8832464dfd5e5d827c770f1dddc860a1cb397748435ae61e8e68a0032add249e
+    sha256: fc8b0f3f7748070456bcf5366a0cf0bb41bf1737549592d3064b7b81cc9b0512
     provides:
       - kind: skill
         name: clio-coder-test

package/library/skills/meta/clio-coder-test/SKILL.md

@@ -7,7 +7,7 @@ triggers:
   - run Clio contract tests
   - test ACP over stdio
   - Clio mock provider harness
-version: 0.3.0
+version: 0.3.1
 license: Apache-2.0
 clio-coder:
   registry-id: iowarp/clio-coder
@@ -20,10 +20,11 @@ clio-coder:
 
 # Clio Test
 
-The root Node suite has two test lanes. Contract tests import `src/` directly
-through tsx; smoke tests spawn the built `dist/cli/index.js`. The import-boundary
-checker runs under lint rather than `npm test`. The trace viewer and Workbench
-have separate application gates.
+The root Node suite has a small required contract/process lane, an installed-package
+qualification lane, and explicit extended development regressions. Contract tests
+import source through tsx; CLI tests use the current built binary. Lint owns static
+import boundaries and library pins. Publication performs only an exact-candidate
+preflight after successful qualification.
 
 For the question of whether a change may leave your machine (commit, push, or
 PR), use `clio-coder-dev`. **REQUIRED SUB-SKILL:** `clio-coder-dev` for the
@@ -38,15 +39,24 @@ npm run skills:check                      # catalog pins and marketplace index
 npm run test:file -- tests/contracts/<file>.test.ts
 npm run build                             # tsup plus the codewiki asset
 npm run test:file -- tests/smoke/<file>.test.ts  # requires a current build
-npm run test                              # every contract and smoke file
-npm run test:trace-viewer                 # apps/trace-viewer
+npm run test                              # required contracts and three process smoke files
+npm run test:full                         # explicit extended root investigation
+npm run test:web:full                     # explicit extended web investigation
+pnpm --filter @iowarp/clio-coder-web verify # app types, lint, tests, build, browser
 npm run ci                                # deterministic root gate
-npm run ci:release                        # root gate plus package/release audit
+npm run ci:release                        # qualify clean committed source and exact installed tarball
+npm run release:preflight                 # fast check of the unchanged qualified package
 ```
 
-The Workbench is not part of the root `npm run ci` command. From
-`apps/workbench`, run `deno task verify` for its format, lint, type check, test,
-and build gate.
+The required web tests cover authentication, permissions, cancellation, worker RPC,
+egress and process ownership. The installed-package lane includes one real browser
+boot/reconnect against the installed server. The full web `verify` command is an
+explicit development investigation, including its viewport/accessibility matrix.
+Do not run full development tests repeatedly during release or publication.
+
+The separate trace viewer is retired. `apps/workbench/` is retained reference
+source, excluded from builds, publication and product gates. Use `test:web` for
+the required app tests alone; app `verify` requires headless Chrome.
 
 No deterministic gate contacts a real model. When a task explicitly requires
 live validation, build first and run `node dist/cli/index.js run` against a
@@ -63,8 +73,7 @@ settings with the result.
 | Any import edit under `src/` | `npm run lint` | Hygiene invokes all six boundary rules. |
 | CLI, entry, process lifecycle, or ACP stdio flow | Build, then the closest file under `tests/smoke/` | Smoke executes the built binary. |
 | Published package contents | Build, then `tests/smoke/installed-package.test.ts` | The test packs and installs the actual artifact. |
-| Trace viewer | `npm run test:trace-viewer` | It has a separate Node package and test command. |
-| Workbench | `deno task verify` in `apps/workbench` | Its Deno/Vite gate is independent of the root npm gate. |
+| Unified web application | `npm run test:web` | Required authentication/runtime boundaries; full `verify` is optional development work. |
 
 Read `references/test-map.md` for the current file map and exact subset
 commands.
@@ -93,7 +102,7 @@ The authoritative definitions and exceptions are in
 ## Source and configuration reload
 
 Contract tests and hygiene read current source, so they need no build. Smoke
-tests run `dist/`, so rebuild first or keep `npm run dev` (`tsup --watch`)
+tests run `dist/`, so rebuild first or keep `npm run dev` (`scripts/build.ts --watch`)
 running. A running Clio process does not reload changed ESM modules; restart it
 after a fresh build.
 
@@ -115,7 +124,8 @@ three buckets:
 3. Run the narrowest related contract or application test.
 4. If the built boundary changed, build and run the closest smoke file.
 5. Run `npm run ci` before handing back a broad root change. Use
-   `npm run ci:release` when release packaging is in scope.
+   `npm run ci:release` on the clean committed candidate when packaging is in scope.
+   It records the exact source/artifact; use only `release:preflight` afterward.
 6. Report exactly what ran and what remains unverified.
 
 For one test file or an `it.only` while debugging:

package/library/skills/meta/clio-coder-test/evals.md

@@ -18,14 +18,14 @@ Expected:
 Prompt: "I edited `src/cli/run.ts`. How do I verify end-to-end?"
 Expected:
 - Builds (or relies on `npm run dev` watch), then starts with
-  `npm run test:file -- tests/smoke/cli-core.test.ts`.
+  `npm run test:file -- tests/extended-smoke/cli-core.test.ts`.
 - Explains smoke spawns `dist/cli/index.js`, so it only sees built code.
 
 ## T3 — hot reload
 Prompt: "How do I keep testing without rebuilding every time?"
 Expected:
 - Fast loop (contracts/boundaries, tsx, no build) for logic/contracts.
-- `npm run dev` (`tsup --watch`) keeps `dist/` fresh for smoke.
+- `npm run dev` (`scripts/build.ts --watch`) keeps `dist/` fresh for smoke.
 - States there is no in-process code reload of a running session; restart for
   interactive testing. Distinguishes this from config hot-reload (classify.ts).
 
@@ -46,3 +46,17 @@ Expected:
 
 One representative scenario via `clio-coder eval skill` against Nemo-3.5-Lightning
 (30B local, llamacpp on mini), full-auto sandbox. NOT CLEANLY RUN: scenario id is T1; driver's --scenario S1 exited 2; re-run did not land before the time-box.
+
+## T5 — current application gates
+Prompt: "The web API changed. Which checks belong to this release?"
+Expected:
+- Builds the root CLI for ACP fixtures, then runs
+  `pnpm --filter @iowarp/clio-coder-web verify` with temporary state outside the checkout.
+- Names app type, API/worker boundary, test, client build and headless-browser checks.
+- Explains root `ci:release` includes web tests and the installed package audit.
+- Does not run the retired trace viewer or reference-only Workbench gates.
+
+RED: the prior 0.3.0 instructions prescribe both obsolete application lanes.
+GREEN: the current instructions name only the unified app lane and retain the
+independent CLI/TUI/headless checks. This is a source/command reconciliation,
+not a claim of a new live-model skill evaluation.

package/library/skills/meta/clio-coder-test/plugin.json

@@ -1,7 +1,7 @@
 {
 	"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
 	"name": "clio-coder-test",
-	"version": "0.3.0",
+	"version": "0.3.1",
 	"description": "Verifies a Clio Coder source change against the current contract, smoke, boundary, and application test lanes, including temporary-state and local-provider harnesses. Not for deciding what may change; use clio-coder-dev.",
 	"license": "Apache-2.0",
 	"extensions": {

package/library/skills/meta/clio-coder-test/references/test-map.md

@@ -1,27 +1,28 @@
 # Where Clio's tests live
 
-The root repository has contract and smoke tests under `tests/`; import
-boundaries run through the lint hygiene checker. Add a test beside the closest
-current behavior, and create a new file only for a genuinely new cluster.
+Routine contracts and three process smoke files protect core product boundaries.
+The installed-package and real native timing checks belong to qualification.
+Extended regressions are explicit development investigations.
 
 ## Layout
 
-| Lane | Path | Runner | Build needed |
+| Lane | Path | Command | Build needed |
 |---|---|---|---|
-| Contracts | `tests/contracts/*.test.ts` | `npm run test:file -- <file-or-files>` through tsx and the temp-root preload | No; imports `src/` |
-| Smoke | `tests/smoke/*.test.ts` | `npm run test:file -- <file-or-files>` | Yes; spawns `dist/cli/index.js` |
-| Boundaries | `tests/boundaries/check-boundaries.ts` | `npm run lint` through `scripts/check-hygiene.ts` | No |
-| Root full suite | Contract and smoke files | `npm run test` | Yes for current smoke behavior |
-| Trace viewer | `apps/trace-viewer/tests/*.test.mjs` | `npm run test:trace-viewer` | No |
-| Workbench | `apps/workbench/tests/` | `deno task verify` from `apps/workbench` | The command builds the app |
-
-`npm run ci` orders typecheck, lint, skill-pin verification, build, the root
-suite, and trace-viewer tests. `npm run ci:release` adds the release audit. The
-Workbench gate is separate.
+| Required contracts | `tests/contracts/*.test.ts` | `npm run test:file -- <file>` | CLI tests require current dist |
+| Required process smoke | ACP, binary boot, process lifecycle under `tests/smoke/` | `npm run test` includes them | Yes |
+| Package qualification | Installed package and native call timing under `tests/smoke/` | `npm run ci:release` | Built once by qualification |
+| Extended regressions | `tests/extended/`, `tests/extended-smoke/` | `npm run test:full` or a focused `test:file` | Yes for CLI scenarios |
+| Static boundaries and pins | `scripts/check-hygiene.ts` | `npm run lint` | No |
+| Required web boundaries | Selected files in `apps/clio-coder-web/tests/` | `npm run test:web` | Root build |
+| Full web investigation | All web tests and browser matrix | `pnpm --filter @iowarp/clio-coder-web verify` | Yes |
+
+`npm run ci` runs the routine lane. `npm run ci:release` qualifies a clean,
+committed candidate and its exact tarball; `npm run release:preflight` checks
+that qualification without repeating development tests. See CONTRIBUTING.md.
 
 ## Contract files
 
-| Area | Current files under `tests/contracts/` |
+| Area | Required or extended focused files |
 |---|---|
 | Authentication | `auth-login-write-failure`, `auth-storage-durability` |
 | Context, session, and state | `context-lifecycle`, `memory-scope`, `project-bootstrap`, `session-durability`, `state-file-lock`, `task-board-done`, `working-set-core` |
@@ -32,7 +33,7 @@ Workbench gate is separate.
 | Safety and tools | `bash-exec-settlement`, `rejection-feedback`, `safe-resource-write`, `safety-gates`, `tool-boundaries` |
 | Evidence, eval, and release | `eval-boundary`, `evidence-integrity`, `metering-integrity`, `release-boundary` |
 | Extensions, interop, and skills | `extension-compatibility`, `extension-reload-coordinator`, `extension-reload-slash`, `extension-resources`, `extension-snapshot`, `interop-boundary`, `marketplace-offer`, `skill-install` |
-| Documentation server | `docs-server` |
+| Documentation navigation | `docs-server` |
 
 Append `.test.ts` to every stem in the table. Use `rg` over the files before
 choosing a lane; related behavior can span more than one focused contract.
@@ -70,12 +71,12 @@ Child fixtures in `tests/fixtures/` are
 
 ```bash
 # all contracts (the shell expands the file pattern)
-npm run test:file -- tests/contracts/*.test.ts
+npm run test:full
 
 # one contract or smoke file
 npm run test:file -- tests/contracts/skill-install.test.ts
 npm run build
-npm run test:file -- tests/smoke/cli-core.test.ts
+npm run test:file -- tests/extended-smoke/cli-core.test.ts
 
 # only it.only or describe.only within one file
 npm run test:file -- --test-only tests/contracts/skill-install.test.ts

package/library/skills/registry.yaml

@@ -65,8 +65,8 @@ skills:
     sha256: 8980f3bed0f06c24685bc0a02f3ffbbcdac9442616dc3ce54122265b666ae0d7
   - name: clio-coder-test
     path: meta/clio-coder-test
-    version: 0.3.0
-    sha256: 87f6689d083080e4b80294304f2b2fd36f70ce941ab7265cb573e84e4c5e6a12
+    version: 0.3.1
+    sha256: 1e8c839b3668e50cd8ed7c69e7ae3ccc5afa15a1db72eb2b8babb1672134fba1
   - name: credentials
     path: meta/credentials
     version: 0.2.0

package/library/skills/skill-marketplace.json

@@ -220,7 +220,7 @@
 				"Clio mock provider harness"
 			],
 			"sourceUrl": "https://github.com/iowarp/clio-coder/tree/main/library/skills/meta/clio-coder-test",
-			"version": "0.3.0",
+			"version": "0.3.1",
 			"audit": "pass",
 			"category": "meta"
 		},