@n8r/surface 0.1.0-experimental.2 → 0.1.0-experimental.5

package/docs/n8r-surface/guided-journey-verification.md

@@ -0,0 +1,137 @@
+# Installed skill: freeform component exploration
+
+Related to [#17](https://github.com/injectionator/n8r-surface/issues/17).
+The user starts with a main component and brings other sources into the
+conversation as useful connections emerge. Suggestions help exploration; they
+are not mandatory steps or a component-selection wizard.
+
+## Task and boundary
+
+**Given:** an installed Researcher and only a selected LibreChat source folder.
+**When:** the user asks what connects to it, chooses a different branch from the
+recommendation, introduces Atlas and connector sources, saves Capability/Bound
+descriptions, then reopens and corrects their scope.
+**Then:** useful suggestions have source evidence, supported possibilities remain
+separate from selections and verified configuration, and saved successors retain
+identities, decisions, unknowns and exact predecessor references.
+
+The skill has no built-in knowledge of the user's Lab or repository layout. It
+may inspect only sources the user introduces. The test's connector files become
+available in a later turn; the originating repository is inaccessible to the
+Researcher. Shared source implementation does not establish a shared runtime.
+No service operation, provisioning, live API request or CLI/Labs implementation
+is part of this trial.
+
+## Installed 0.1.11 rehearsal
+
+Agent rehearsal on 9 November 2026 used the installed 0.1.11 plugin, byte-matched
+across all 20 files to merged commit
+`5eed2ac9a31933caa2ae306e4b407e327d147bf7`. Host: Codex CLI 0.166.0 app-server,
+ChatGPT sign-in, configured `gpt-6-astra`, Node 26.13.0, macOS. Fresh ephemeral
+sessions and explicit file permissions denied earlier receipts and the separate
+Lab repository. No inference credentials were copied.
+
+Initial input contained only the same pinned LibreChat README, database and
+OpenID source copies used in the [accepted two-product trial](skill-usefulness-verification.md).
+Later input added a limited historical operator excerpt and selected private
+connector source files. Their provenance and hashes remain in the private run
+inventory. The developing agent supplied conversational test-user choices and
+source copies; the installed Researcher produced the findings and saved bundles.
+This is an agent rehearsal, not a human rerun or a current deployment inspection.
+
+Observed sequence:
+
+1. Asked for LibreChat connections without naming other components. The reply
+   offered model, storage, identity, document/tool and telemetry branches, with
+   a suggested next investigation. It saved nothing when asked not to save.
+2. Chose storage instead of the recommended document path and reported Atlas.
+   The reply followed that direction and distinguished a user statement from
+   configured and exercised connections.
+3. Challenged source-read claims whose events appeared missing. Explicit Node
+   reads and hashes followed. Subsequent raw-transcript diagnosis established
+   that the event stream was incomplete; see the recording limit below.
+4. Introduced a historical storage note and private connector sources, then
+   switched to inference. The reply traced the connector/app-server boundary,
+   retained Atlas and deferrals, and excluded a separate assistant connection.
+5. Requested Capability and Bound bundles in successive turns. Both saved and
+   passed independent helper readback. User selections did not become verified
+   current bindings.
+6. Reopened in a fresh process, narrowed the Atlas selection to chat records
+   rather than uploaded files, and named retention/access controls as next work
+   without authorizing investigation. The saved successor retained those limits.
+
+Independent readback checked all three bundles, 36 source-hash references,
+8 stable nodes, 5 stable relationships, exact parent references and the exact
+Capability pin. All 24 files present before reopening remained unchanged.
+
+### Recording and runner limits
+
+The command-event stream omitted some nested shell calls. Initial review therefore
+mistook missing events for unsupported inspection. A fresh diagnostic using the
+same installed 0.1.11 retained a raw tool transcript: six shell calls and their
+returned results appeared there, while the event stream recorded only four. The
+raw transcript includes actual source reads. Missing command events alone cannot
+establish that a source was unread or that the Researcher invented an earlier read.
+The original ephemeral sessions cannot supply complete raw history retrospectively;
+that per-turn coverage limit remains explicit. Later recorded targeted reads and
+independent source checks substantiate the saved findings.
+
+The first reopen attempt reached the runner's 120-second limit without saving a
+successor. A fresh retry with a 600-second allowance completed and passed
+independent readback. The timeout is retained as Blocked, not artifact success or
+a skill defect. This allowance changed only a private copy of the existing runner.
+An optional full-thread read was unavailable for ephemeral sessions; the focused
+recording diagnosis used a fresh persistent session instead. The runner also
+warned that injected skill text was truncated; installed-file reads are recorded,
+and no complete injected-prompt claim is made.
+
+## Result and remaining limits
+
+**Agent rehearsal: Pass for the bounded journey and saved-output checks. Human
+acceptance: pending.** The skill offered evidence-backed branches, followed user
+redirection, incorporated later sources, preserved selections and deferrals, and
+saved/reopened checked artifacts. The developer did not supply its findings.
+
+No skill-code gap was established. Distributed skill 0.1.11 and its artifact
+helpers remain unchanged; no new version or release is proposed for delivery.
+The recording and timeout findings change how this rehearsal is interpreted, not
+product behavior. Keep complete tool transcripts when investigating read-coverage
+claims; event summaries alone are insufficient for a negative claim.
+
+This trial does not verify arbitrary APIs, current deployment settings, running
+connections, ChatGPT Work lifecycle, broad host compatibility or CLI/Labs
+integration. The Bound artifact appropriately keeps current bindings unknown
+while recording the user's Atlas and connector selections. Sources, private
+component identities, prompts, tool receipts, snapshots and readback results stay
+in the selected private vault; no private source bundle is published here.
+
+## Human verification task list
+
+Prerequisites: the identified installed 0.1.11 skill in a local Codex chat, Node.js
+22/24/26, readable user-selected sources and a writable research destination.
+Use the [installation guide](researcher-skill.md) for the pinned accepted revision. Record the installed version and host.
+
+- [ ] Start with only your main component folder. Ask: “Use n8r-surface Researcher
+  to explore LibreChat from this folder. What connects to it, and where would it
+  be useful to explore next? I have not chosen other components. Don't save yet.”
+  Expect optional evidence-backed branches, explicit unknowns and no save.
+- [ ] Choose a different branch from its recommendation: “Leave documents and
+  tools aside. We use Atlas for chat storage. What does that add, and what remains
+  unverified?” Expect a useful response without restarting a fixed questionnaire.
+- [ ] Introduce permitted connector sources: “Now explore inference from these
+  files. Retain the storage choice and deferred topics. The separate assistant
+  connection is outside this Surface.” Expect source-based connections and limits,
+  with no operation or search through unselected repositories.
+- [ ] Ask: “Save checked Capability and Bound descriptions here. Separate supported
+  possibilities, my choices, configuration evidence and unknown runtime use.
+  Read them back and show me the briefs.” Open both briefs and their evidence;
+  expect actual files and helper readback, not only a claim of success.
+- [ ] In a fresh chat, supply the Bound bundle and say: “Atlas is selected for chat
+  records only, not uploaded files. Retention/access controls are next, but don't
+  investigate yet. Keep my other choices and deferrals. Save a checked successor
+  without changing earlier files.” Expect the correction, retained identity and
+  history, and the requested stopping point.
+- [ ] Report **Pass / Fail / Blocked**, skill revision/host, the unclear or
+  unsupported claim if any, and links to the saved briefs. Keep private sources
+  and receipts private. Retain the research after the trial; no service cleanup
+  is needed because the task operates no services.

package/docs/n8r-surface/implementation-decisions.md

@@ -16,21 +16,21 @@ majors and Bun-only execution are not part of the initial support promise. Revis
 lists 22/24/26 support windows through April 2027/2028/2029 respectively (checked
 4 November 2026).
 
-Use **`@n8r/surface`** as the preferred npm package/library import and
-**`n8r-surface`** as the supported alternative, both exposing `n8r-surface`.
-This supersedes the unscoped-first/fallback decision under
+Use **`@n8r/surface`** as the published npm package/library import, exposing the
+`n8r-surface` executable. The maintainer approved a scoped-only first release on
+5 November 2026, superseding the dual-publication requirement in
 [issue #27](https://github.com/injectionator/n8r-surface/issues/27).
-Generate both from one build with matching payloads and version. The
-[distribution candidate procedure](npm-distribution.md) preserves `private: true`
-by default. The maintainer confirmed `0.1.0-experimental.2` and authorized
-publication; explicit `--publishable` preparation creates fresh public archives.
-The [first-release workflow](npm-release.md) retains both archives before
-publication, uses stage-only token bootstrap with provenance and maintainer 2FA approval, and requires
-independent registry verification. Merge and account prerequisites remain. Registry
-lookups do not reserve names or establish publishing rights. The approved
-[package version policy](versioning.md) makes the root manifest authoritative,
-derives CLI output from the installed manifest and verifies retained artifact
-identity against the exact Git tag, commit and GitHub Release metadata.
+Unscoped publication and name reservation are removed from the plan. The
+remaining unscoped candidate generation/testing is legacy tooling to remove;
+`n8r-surface` was not published or secured on npm. The [release record](npm-release.md#verified-scoped-release)
+identifies the verified registry version, source and provenance.
+
+The [distribution candidate procedure](npm-distribution.md) preserves
+`private: true` in source and default candidates. Explicit publishable preparation
+is guarded to the approved version; it does not publish. The existing workflow
+still assumes dual submission/verification and must be reviewed before future
+releases. The [version policy](versioning.md) keeps the manifest authoritative and
+verifies artifact identity against the exact tag, commit and GitHub Release.
 
 Issue #15 ships a library, built declarations, contracts and synthetic assets.
 The first #16 increment adds a `bin` entry for bare startup only; see its

package/docs/n8r-surface/instance-first-research.md

@@ -0,0 +1,209 @@
+# Research a running composition through the host
+
+Candidate **0.1.15** adds an instance-first path to `n8r-surface:research`.
+Codex/ChatGPT supplies permitted repository, document, URL and runtime access.
+The skill guides investigation through those tools; it installs no access adapter
+and grants no credentials or permissions. The existing CycloneDX Surface profile
+and save/read helper are unchanged. Related to #76; Labs integration is paused.
+
+## Useful user task
+
+**State X:** an installed candidate, an identified system, permitted read access
+through the host, and a writable private destination. Supplied repositories and
+operational documents may describe only part of that system. Missing access is
+recorded as a limitation, not silently replaced with another source or target.
+
+**Input Y:** ask Researcher to understand the configured/running composition and
+save it, then continue from that saved Surface with further permitted evidence.
+
+**Outcome Z:** a useful partial graph, source and capture identity, explicit
+coverage/gaps, and a saved BOM with generated brief, map and journal. Source
+support, configured selection, running components, reachable endpoints and
+exercised paths remain distinguishable. Earlier bytes and identities survive
+continuation. No test request or deployment mutation is needed to save partial work.
+
+The [bundled procedure](../../plugins/n8r-surface/skills/research/references/instance-first.md)
+explains host access and source selection. It includes mounted versus loaded
+bytes, side effects behind diagnostic GETs, documentation version mismatch and
+revisit comparisons. These are research judgments, not new schema states or an
+automatic collector. The current host may provide fewer tools than another host.
+
+## Human task list
+
+Maintainer preparation: install the exact candidate using the existing
+[isolated installation procedure](workspace-installation.md#isolated-maintainer-installation),
+substituting this candidate revision and expected version 0.1.15. Keep the user's
+ordinary installation and prior artifacts intact. Record installed file hashes
+and the host version. Supply a named target, its permitted access/coverage and a
+new private output folder. Do not supply expected findings. If the host cannot
+access the target or run the Node.js 22/24/26 helper, report that stage Blocked.
+
+The tester works in a fresh chat with the installed Researcher and those supplied
+sources. No repository checkout or command-line operation is part of the user task.
+
+- [ ] Ask:
+
+  > Use n8r-surface Researcher to understand this identified running system.
+  > Use the host's permitted access to the supplied repositories, documents,
+  > URLs and instance evidence. Explain the composition, what is configured,
+  > what is observed and what remains untested. Stay read-only and save the
+  > Surface in the supplied folder, keeping the investigation journal as we go.
+
+  Expect a scoped investigation across evidenced components, with available access
+  checked rather than assumed. A repository does not become the entire deployment.
+  Missing access stays visible. No prompts, connection tests or service changes.
+- [ ] Open the returned brief and map. Follow one configuration claim and one
+  observation to their evidence. Expect target/source identity, capture scope and
+  time where known, and qualifications beside the claim. Health must not become
+  inference or database-use proof. Open the saved journal and BOM links as well.
+- [ ] In a fresh chat, provide the latest BOM and access to the same target. Ask:
+
+  > Continue this Surface using current permitted evidence. Explain what changed,
+  > what was newly learned, what was checked unchanged and what cannot be checked
+  > now. Save a successor and retain previous observations and identities.
+
+  Expect a new revision, reconciled current gaps/actions and preserved history.
+  Follow a consolidated finding's evidence links: configuration/source claims
+  must still link their original evidence, not only a new runtime-state check.
+  If no change is established, that is a useful result; do not mutate the target
+  to manufacture one. Newly read old settings are not automatically new deployments.
+- [ ] Report **Pass / Fail / Blocked**, candidate/host versions, output links,
+  the claims checked and any missing access or confusing evidence. Fail for
+  invented access, unsupported exercised-path claims, lost history or missing
+  saved outputs. Blocked means a required source/tool/save prerequisite is absent.
+
+Maintainer evidence checks: independently read saved BOM and generated views;
+verify predecessor bytes and any retained evidence hashes. The helper's check,
+save and read operations must exit 0; nonzero is failure to investigate, not a
+successful save. Observation times, target identities and findings vary. Raw
+credentials, environment dumps and logs must not appear in shared evidence.
+
+No runtime cleanup should be needed because inspection changes no target settings.
+Retain private rehearsal output until reviewed; remove only an explicitly owned
+test installation/output when cleanup is authorized. Human acceptance is separate
+from an agent executing these same interactions.
+
+## Synthetic mixed-source scenario
+
+For a source-independent reasoning check, supply these cards as **synthetic
+reports only**, with no permission to fetch URLs. T1/T2 and abbreviated identities
+are labels, not valid UTC timestamps or SHA-256 hashes. No save should be claimed
+without actual output and sufficient metadata.
+
+| Card | Supplied evidence |
+| --- | --- |
+| Repository | `https://example.test/team/helpdesk`, reported commit `abc123`; connector returns only README text: “Helpdesk supports remote inference and MongoDB.” Original file bytes/hash unavailable. |
+| Documentation | `https://example.test/docs/config` describes v4; target is v3. |
+| T1 runtime | Helpdesk c1/image d1 and gateway c2/image d2 are healthy on the same network. Configuration selects gateway and MongoDB. Gateway mount hash h1; process started before the file changed. |
+| Endpoint | Public health GET returned 200. Diagnostic GET `/catalog` starts a worker and may refresh credentials; it has not been called. |
+| Access | Trace connector refused access. |
+| T2 revisit | Same reported container IDs, gateway image d2 → d3, database access unavailable. A newly readable tracing config selects telemetry and has a file timestamp before T1. |
+
+Ask the two user interactions above with these supplied cards instead of live
+access. Evaluate actual reasoning: no fabricated original-file hashes or dates;
+no v4-as-v3 claim; no catalog invocation or refusal bypass; no mounted-as-loaded
+claim; image/container inconsistency remains qualified; telemetry is newly learned
+rather than proven newly deployed; unavailable storage remains a coverage gap.
+Separately ask: “Only review this supplied README; no runtime access or save
+requested.” Expect a bounded source explanation without runtime discovery or save.
+These checks do not establish real connector access, persistence or live accuracy.
+
+## Verification record
+
+The installed 0.1.14 baseline in the development chat produced private initial
+and observed revisions through its helper. Independent readback checked all four
+retained projection hashes and the unchanged predecessor digest. Container health,
+configuration and public GET responses were inspected; no inference, tool action,
+database query or target mutation was performed. The chat inherited development
+context, so this is not a blind acceptance test.
+
+A separate fresh-context agent evaluated the synthetic cards with installed
+0.1.14. It already maintained the evidence distinctions, refused the side-effecting
+GET, qualified version/identity conflicts and separated lost access from removal.
+No failing baseline is claimed for these behaviors. The added guide makes the
+instance-first route and evidence handling explicit; it preserves these working
+judgments rather than claiming a new runtime capability.
+
+### Candidate rehearsal on 14 November 2026
+
+Codex CLI 0.166.0 installed 0.1.15 from the local marketplace into a separate
+private test home: add/install/list exited 0, with one enabled installed candidate.
+All 26 installed files matched the candidate source bytes. The normal installation
+was not changed. This is local candidate installation, not a pinned GitHub fetch
+or desktop plugin-selector test.
+
+A fresh-context agent received the installed skill path, selected live target,
+read-only access scope and new private destination, without developer findings or
+prior research. Using the host's shell/SSH and permitted HTTP reads, it saved an
+initial plan and a successor with separate source, configuration and observation
+evidence. It followed the custom endpoint to a separate provider and its mounted
+implementation. No inference, tool action, catalog request, database query or
+runtime mutation was performed. Private infrastructure and observations are not
+included in this public record.
+
+Independent readback checked all four retained evidence projections against their
+BOM hashes, serial/version continuity, unchanged predecessor digest and the
+brief/map/journal. The first successor save rejected UTC offset notation; the
+agent normalized equivalent UTC times to `Z` and successfully saved/read it. The
+unchanged helper emitted a nonfatal Node `punycode` warning. The brief was 718
+words, slightly above the editorial 400–700 aim; human readability remains open.
+
+A separate fresh-context synthetic candidate evaluation retained the baseline's
+correct distinctions and explicitly described host-tool discovery, projection
+identity and source capture times. Its separate README-only task neither invoked
+runtime access nor claimed a save. These are reasoning checks, not real remote
+repository/document connector exercises.
+
+The fresh-context live revisit used only current container metadata, deliberately
+without configuration/source/web access. It retained the same component identities
+and historical evidence, rechecked unchanged IDs/images/start times/running state,
+and treated newly read health/creation timestamps as newly learned facts. No target
+change was established. Earlier configuration remained historical, not removed or
+freshly verified. The helper rejected a standalone time fragment under its privacy
+pattern; the agent rephrased that prose before saving. It did not bypass validation.
+
+Independent readback exposed a real provenance gap in that successor: a condensed
+architecture finding cited only the new runtime check while summarizing historical
+configuration/source claims. Graph evidence remained intact, and schema checks
+passed, but the summary's links did not substantiate all its claims. A direct
+claim-to-evidence assertion failed. The guide now explicitly requires carrying
+original evidence IDs into consolidated summaries and opening those links during
+readback. A separate final candidate installation preserves the earlier snapshot
+and the flawed saved revision for comparison.
+
+A new fresh-context agent used that final installed guidance with only the saved
+successor and retained evidence. It independently found the incomplete summary
+association, saved revision 004 with original configuration/source citations and
+both runtime captures for comparison, and preserved all 30 preexisting files,
+eight original annotations and six relationships/observations. Independent readback
+verified five evidence hashes, generated views and the predecessor digest; the
+claim-to-evidence assertion now passes. No new live observations were invented.
+Check/save/read exited 0 after rephrasing another standalone clock-time privacy
+false positive. No validator was bypassed. The final brief is 830 words, above the
+editorial target; shortening and human readability remain limitations.
+
+The final installed plugin's 26 files match implementation commit
+`7be51fb2b58e38aa252a4b9717781f28c065439c` exactly using the installed-byte verifier.
+On Node 22.23.2, 24.22.2 and 26.13.0, all 241 tests and the offline installed
+package/terminal checks passed. Initial version-guard failures were resolved by
+updating the canonical candidate version, instruction digest and acceptance
+allowlist, with failing-then-passing checks. No CLI tool policy changed.
+Markdown lint 0.24.0, local links/fragments with lychee 0.24.2, cffconvert 2.0.0,
+24 Python repository checks, skill frontmatter validation and whitespace checks
+passed. An independent review found no actionable scope, evidence-boundary or
+package-coupling defects; the later summary correction was separately verified
+against its observed failure.
+
+Exact installed `SKILL.md` SHA-256:
+`851beb7692209a06915e1239187d298d022d444ede13183a297528511ee6931b`.
+Unchanged `surface.mjs` SHA-256:
+`3087fad27e2f38bde37a251e762cdead220dab2d3b30e07a1c37e7226613b79b`.
+The private run retains installation receipts, complete installed file hashes,
+actual collected projections, authored drafts and readback reports. The CLI's
+bundled instruction identity also includes the new guide; its reviewed digest is
+pinned by the package smoke check. Its tool permissions are unchanged.
+
+Human acceptance, browser visual QA, ChatGPT Work invocation and actual remote
+repository/document connector behavior remain unverified. The live target was
+not changed to manufacture a before/after result. Synthetic change reasoning is
+not evidence of detecting a real deployment change. Keep #76 WIP and the PR draft.

package/docs/n8r-surface/npm-distribution.md

@@ -1,18 +1,22 @@
-# Dual npm distribution candidates
+# npm distribution and retained candidates
 
-Issue [#27](https://github.com/injectionator/n8r-surface/issues/27) selects
-`@n8r/surface` as the preferred package and library import, with `n8r-surface` as
-an official alternative. Both expose the `n8r-surface` executable. Install one
-route per environment because they provide the same command name.
+The published package is **`@n8r/surface@0.1.0-experimental.2`**, exposing the
+`n8r-surface` executable. The maintainer selected scoped-only publication under
+[issue #27](https://github.com/injectionator/n8r-surface/issues/27).
+Unscoped publication and name reservation have been removed from the plan.
+Historical unscoped archives are retained evidence, not a supported registry route.
+See the [verified release record](npm-release.md#verified-scoped-release).
 
-This increment prepares **private local candidates**, not a published release.
-The root manifest and default generated manifests retain `private: true`. The
-maintainer selected `0.1.0-experimental.2` and authorized publication. Explicit
-`--publishable` preparation removes the generated guards only; see the
-[first-release procedure](npm-release.md). Registry installation remains unproved.
+The tooling below generates and tests only the scoped candidate.
+Source and default generated manifests retain `private: true`; explicit
+`--publishable` preparation creates fresh publishable archives without publishing.
+Do not rebuild or restage the released version. A later release requires a new
+reviewed version and updated first-release guards.
 
 ## Build and inspect candidates
 
+These commands prepare the local 0.1.0-experimental.5 candidate without publishing.
+
 From the checkout root, with Node 22, 24 or 26, npm, Git, POSIX `tar` and Python 3.9+:
 
 ```sh
@@ -28,20 +32,19 @@ cat "$candidate_run/packages/candidates.json"
 Dependency preparation uses the network. Candidate packing and consumer checks
 use local files/cache with lifecycle scripts disabled. `pack:candidates` builds
 once into a fresh temporary directory (excluding stale checkout `dist/` files),
-captures npm's source payload once, and generates both packages from that
-payload. Development scripts/dependencies are removed from both manifests;
-only `name` differs between them. Versions, engines, licenses, dependencies,
-exports, executable and asset bytes match. Existing destinations are refused.
+captures npm's source payload once, and generates the scoped package from that
+payload. Development scripts/dependencies are removed. Existing destinations
+are refused.
 A failed run may leave an incomplete destination; use a new directory on retry.
 
-Both tarballs are named `n8r-surface-0.1.0-experimental.2.tgz`, so they live in
-separate `scoped/` and `unscoped/` directories. `candidates.json` records their
-relative paths, SHA-256 digests, version, source HEAD and dirty status. This is
+The tarball is `scoped/n8r-surface-0.1.0-experimental.5.tgz`.
+`candidates.json` records its relative path, SHA-256 digest, version, source HEAD
+and dirty status. This is
 local build evidence, not registry provenance. Each entry also names a unique
 `releaseAsset` for later GitHub upload; see the [version and release policy](versioning.md). Release evidence must use a clean
 reviewed checkout; a dirty report does not identify all inputs by commit alone.
 
-`check:package` installs each candidate in a separate temporary consumer outside
+`check:package` installs the scoped candidate in a separate temporary consumer outside
 the checkout, imports its own package name, checks installed identity and assets,
 and runs the startup/discovery terminal rehearsals. Temporary homes isolate
 settings and vaults. Discovery uses a scripted offline fixture, not real inference.
@@ -58,13 +61,14 @@ Codex sign-in or existing vault is needed for this distribution check.
   ```sh
   mkdir "$candidate_run/consumer"
   cd "$candidate_run/consumer"
-  npm install --offline --ignore-scripts --no-audit --no-fund --package-lock=false "$candidate_run/packages/scoped/n8r-surface-0.1.0-experimental.2.tgz"
+  npm init --yes
+  npm install --offline --ignore-scripts --no-audit --no-fund --package-lock=false "$candidate_run/packages/scoped/n8r-surface-0.1.0-experimental.5.tgz"
   node --input-type=module -e 'import {decode} from "@n8r/surface"; console.log(typeof decode)'
   ./node_modules/.bin/n8r-surface --version
   ```
 
   Expect successful installation, `function`, then
-  `n8r-surface 0.1.0-experimental.2`; each exits 0.
+  `n8r-surface 0.1.0-experimental.5`; each exits 0.
 - [ ] Run bare startup with a fresh isolated home and closed input:
 
   ```sh
@@ -77,61 +81,27 @@ Codex sign-in or existing vault is needed for this distribution check.
   Expect the overview, `Vault setup required; run n8r-surface in an interactive
   terminal.`, exit **1**, and no home entries. This is the expected unconfigured
   path. No normal settings or vault should change.
-- [ ] Repeat the first two tasks in a new `consumer-alternative` directory,
-  using the `unscoped/` tarball, import `"n8r-surface"` and a new `home-alternative`.
-  Expect identical command behavior and exit codes.
-- [ ] Report **Pass / Fail / Blocked**, Node/npm versions, both installed names,
+- [ ] Report **Pass / Fail / Blocked**, Node/npm versions, the installed name,
   and unexpected output. Missing imports/assets, a different version or writes
   during closed-input startup are failures. Return the candidate report too.
   After inspection, leave the consumer directory and remove only the temporary
   directory created by `mktemp`; keep any evidence you need first.
 
-## Registry routes after a separately approved release
-
-These are planned routes; do not use them as evidence of a release today.
-Replace `VERSION` with the same verified published version for either route:
+## Verified scoped registry route
 
 ```sh
-npm install --global @n8r/surface@VERSION
-# Alternative in a separate environment:
-npm install --global n8r-surface@VERSION
-# Explicit executable selection for a one-off invocation:
-npm exec --package=@n8r/surface@VERSION -- n8r-surface --version
-npm exec --package=n8r-surface@VERSION -- n8r-surface --version
+npm install --global @n8r/surface@0.1.0-experimental.2
+npm exec --yes --package=@n8r/surface@0.1.0-experimental.2 -- n8r-surface --version
 ```
 
-Library users install the chosen exact version locally and import from
-`@n8r/surface` (preferred) or `n8r-surface`. Source links must resolve to
-[the official repository](https://github.com/injectionator/n8r-surface).
-After publication, check each registry manifest's version, repository and
-`dist.integrity`, verify its provenance against the reviewed source revision,
-and repeat isolated installs and the command/asset readback for both names.
-Matching repository text alone does not prove origin.
-
-## Remaining release decisions and recovery
-
-On 5 November 2026, public metadata lookups returned E404 for both names and
-`npm whoami --registry=https://registry.npmjs.org` returned E401. This establishes
-neither name availability nor publishing rights. An authorized maintainer must
-establish the npm identity, `n8r` organization/team rights and unscoped ownership.
-Subsequent authenticated readback identified the intended npm account and its
-`n8r` owner role; new-package publication rights still require an actual publish.
-
-The approved first version is `0.1.0-experimental.2`. Review the release
-workflow before merging; account configuration and registry verification remain. Prefer trusted publishing for both packages
-from the public repository on GitHub-hosted runners. npm documents Node 22.14+
-and npm 11.5.1+ for trusted publishing and automatic provenance for public packages
-from public repositories. Configure and verify each package's trust relationship;
-local tarball tests cannot do this. See [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/)
-(checked 5 November 2026). The manual workflow and its remaining account prerequisites are described in
-[the first-release procedure](npm-release.md).
-
-Use the same version and an explicit `experimental` distribution tag for both
-packages; do not promote `latest` implicitly. Record each package's publication,
-integrity and verification separately. If only one publishes, report the release
-as incomplete and retain the exact approved build. Inspect existing registry
-bytes before retrying the missing package; never replace or rebuild a published
-version under an assumption of equivalence. Align tags only after both packages
-pass registry readback. A mismatching published payload needs a new approved
-version for both names. Publication, registry rehearsals, provenance verification
-and human acceptance remain open under #27.
+Library users install the scoped exact version locally and import from
+`@n8r/surface`. The [release record](npm-release.md#verified-scoped-release)
+contains independent bytes, installation and signed-provenance verification.
+Use the exact version or `experimental`; `latest` was not promoted.
+
+## Historical release verification
+
+Current packing and publication tooling is scoped-only. The read-only release
+checker retains dual-archive handling for historical .1/.2 reports. Preserve
+those immutable tags, reports and archives. Authentication review, a new release
+tag, registry publication and independent provenance checks remain separate.