@redue/cli 0.1.0-alpha.3 → 0.1.0-alpha.31

package/docs/user/getting-started.md

@@ -57,9 +57,36 @@ prefix. Uninstalling the package does not remove local verification evidence;
 `redue remove-state` is a separate, explicit action. Alpha.1 remains available as
 historical software and is superseded for package identity, not a runtime defect.
 
+## Upgrading REDUE
+
+Stop every observer using the installation before upgrading, then restart each
+with the same config/state selection. See [the npm launcher notice](npm-launcher-notice.md)
+for exact commands. Do not remove state or delete receipts. Existing agent connections require a separate
+[preview/apply policy update](agents.md#update-an-existing-connection); installing
+the package alone does not update project instructions.
+
 ## First project
 
-From the project root:
+With Claude Code, one command does the steps below and connects the agent:
+
+```sh
+redue setup claude          # asks once; --yes for no prompts
+```
+
+It runs `init` when the project has no `redue.config.json`, `agent setup
+claude`, and `start`, then records each check that can qualify once, unless
+it is already CURRENT. It prints every file it writes, and running it again
+changes nothing that is already set up. When `.claude/settings.local.json`
+is not ignored by Git, it adds it to `.git/info/exclude`; it refuses when
+that file is committed. What setup created is noted in the clone's Git
+directory (`.git/redue-setup-<id>.json`, never committed). `redue remove`
+undoes exactly that: the integration (or only this machine's hooks, when the
+integration was already in the project), the observer and its state
+(receipts included), the local ignore line, and the config if setup wrote it
+and it has not been edited since. A config or observer state that existed
+before setup stays. `remove` asks before it deletes; Enter means no.
+
+Step by step, from the project root:
 
 ```sh
 redue init --dry-run
@@ -73,8 +100,13 @@ redue explain typecheck
 Use a check actually printed by `init`. For a workspace:
 `redue init --workspace @example/package --check typecheck`.
 Initialization previews detected commands and qualification confidence before writing
-`redue.config.json`. An existing config is never overwritten. No checks are run and
-no dependencies installed. A missing/unsupported boundary is explained.
+`redue.config.json`. An existing config is not overwritten (`init --no-time-limit`
+updates the rows of checks it [qualifies](sandbox.md#files-git-ignores-and-documentation)). No dependencies are
+installed; a check proposed for the sandboxed recipe runs once plainly and once or
+twice in the sandbox, and no results are recorded. A missing/unsupported boundary is explained. `init` tries
+the strict recipes first and uses the [general recipe](node-script.md) for a root
+typecheck or lint script none of them takes. Test scripts use the
+[sandboxed recipe](sandbox.md) first, then the [direct test recipe](tests-direct.md).
 
 “Ready to qualify” means REDUE has a supported recipe whose prerequisites will be
 validated. It is not a receipt. “Recording-only” can record PASS/FAIL without claiming
@@ -82,12 +114,15 @@ reusability. Qualification can change when configuration or installation changes
 
 `run` streams normal output and preserves execution environment and cancellation.
 For the narrow pnpm TypeScript contract, `init` explicitly shows the direct installed
-compiler invocation it selects; other scripts run through the package manager.
+compiler invocation it selects, and for npm the
+[local compiler recipe](direct-typescript.md). General checks and other scripts
+run through the package manager. No existing configuration is silently migrated.
 Only use configs and probes from trusted repositories: these execute local code.
 
-`status` is cached and conservative. `status --sync` and `explain` revalidate caller
-context and may execute read-only probes. Synchronization can be slower than a cheap
-check, especially on Windows. Choose deliberately. A timeout is UNVERIFIED, not green.
+`status` and `explain` revalidate caller context and may execute read-only probes
+(`status --sync` is the same as `status`). `status --cached` is the cached,
+conservative answer, without revalidating. Synchronization can be slower than a
+cheap check, especially on Windows. A timeout is UNVERIFIED, not green.
 
 ## Lifecycle and removal
 
@@ -125,3 +160,11 @@ all observed roots; its basename must start with `redue-` or legacy `vstate-`.
 For a removed checkout, `redue --state-dir /your/owned/redue-project-state remove-state`
 still works without rebuilding its compiler/configuration. Ownership/active-run conflicts
 are actionable errors, never resolved merely by deleting an old lock.
+
+## Connect an agent explicitly
+
+After initialization, use `redue agent setup codex --dry-run` (or `claude`) to
+review project-local instructions, then repeat with `--apply`. Start a fresh host
+session. `redue agent doctor` checks prerequisites without running verification.
+See [agent activation](agents.md) for loading rules, generic agents, and removal.
+For a fixed build and ordinary development evaluation, use the [opt-in pilot guide](pilot.md).

package/docs/user/json.md

@@ -1,7 +1,7 @@
 # Alpha JSON interface (schema 1)
 
-Use `status --json` for cached state, `status --sync --json` for caller-aware
-applicability, and `explain CHECK --json` for selected synchronized detail.
+Use `status --json` (or `status --sync --json`) for caller-aware applicability,
+`status --cached --json` for cached state, and `explain CHECK --json` for selected synchronized detail.
 `detail` remains an alias. Successful reads emit one JSON object, no human prose.
 
 ```json
@@ -30,6 +30,8 @@ Stable-enough-for-alpha fields:
 | `result` | Historical `PASS`, `FAIL`, or null. A failed invocation is not green even with CURRENT applicability. |
 | `freshness` | `CURRENT`, `STALE`, or `UNVERIFIED`, independent of result. |
 | `reuse_eligible` | True only for qualified, applicable passing evidence. Never derive permission to reuse from outcome alone. Missing means false. |
+| `run_facts` | Number of lookups outside the discovery certificate that the receipt's run made (direct TypeScript recipe). Status asks each again before answering CURRENT. Absent when there are none. |
+| `probe_deadline_ms` | Top level. How long the full state probes of one decision may take in total: each check's deadline (5 s to 60 s, from earlier probes and runs) times its probe count, summed. Callers wait at least this long plus 10 s for a synchronized answer. |
 | `reason` | Human explanation; not a stable machine enum. Do not parse it to authorize reuse. |
 | `changed_inputs` | Known changed relevant paths when available, possibly only the first difference; empty/missing is not proof of no changes. |
 | `invocation` | Null without a receipt; otherwise run ID, completion `status`, duration, exit code/signal when known. Status distinguishes exited, interrupted, and start/capture failure. |

package/docs/user/node-script.md

@@ -0,0 +1,177 @@
+# General recipe (typecheck and lint scripts)
+
+The general recipe records a project's own typecheck or lint script, run
+through its package manager, and reports later whether that result still
+applies to the files you have. It is a lower tier than the strict recipes:
+`redue init` tries the [direct TypeScript recipe](direct-typescript.md), the
+pnpm and Yarn TypeScript recipes, the [direct test recipe](tests-direct.md)
+and, on macOS and Linux, the [sandboxed recipe](sandbox.md) first. It uses
+the general recipe for a root typecheck or lint script none of them takes,
+and where the sandbox cannot run (at init, or at run time inside Claude
+Code's macOS sandbox). Test scripts use the direct test recipe or the
+sandboxed recipe; `init` does not propose the general recipe for them.
+
+It supports a project installed by npm, pnpm 9-12 (isolated or hoisted
+`node_modules`) or Yarn with the `node-modules` linker, with one lockfile kind
+matching any `packageManager` declaration, on macOS and Linux with Node 22 or
+24. Workspaces are supported for root scripts. `init --recipe node-script`
+writes general checks only.
+
+## Setup
+
+```sh
+redue init
+redue start
+redue run lint
+redue status --sync
+```
+
+The config gets one field for the recipe, written by `init`:
+
+```json
+{"name": "lint", "script": "lint", "kind": "lint", "qualification": "node-script-v1", "inputs": ["**", "..."]}
+```
+
+`redue run lint` runs `npm run lint` (or `pnpm run lint`, `yarn run lint`) with
+REDUE's recorder loaded in every Node process, and npm's and pnpm's update
+checks turned off. With the Claude Code hook, `npm run lint`, `pnpm lint` and,
+for a script that is one plain command such as `eslint .`, that command itself
+and `npx eslint .` are recognized like typecheck and test commands.
+`status` and the hook's skip message name the recipe that made the receipt.
+
+## What REDUE claims
+
+CURRENT means the last run's inputs are unchanged:
+
+- every file in the checkout, except `.git`, every `node_modules`, the runner
+  caches listed below and the files the run itself wrote;
+- the installed files in the root's and every workspace package's
+  `node_modules`, and Yarn's install state, by file identity;
+- the lockfile and `package.json`, as files of the checkout;
+- the package manager's executable and Node, by file identity, and the exact
+  script;
+- every environment variable the run's JavaScript read directly, and always
+  `TZ`, `LANG`, `PATH`, `HOME`, `CI`, `XDG_CONFIG_HOME` and every `NODE_*`,
+  `LC_*`, `VITE_*`, `DYLD_*`, `LD_*`, `npm_config_*`, `pnpm_config_*`,
+  `PNPM_*`, `COREPACK_*` and `YARN_*` variable;
+- the executables of npm, pnpm, Yarn and Corepack on PATH, by file identity,
+  since a script may run another package manager;
+- small files read outside the checkout (up to 1 MB), by content, and lookups
+  outside it, asked again before each answer.
+
+Runner caches are not inputs, and a run may read and write them: `.cache`,
+`.vite`, `.vitest`, `.turbo`, `.nx`, `.swc`, `.jest-cache`, `.parcel-cache`,
+`.angular/cache`, `.next/cache` and `.tmp` directories, `*.tsbuildinfo`,
+`.eslintcache`, `.stylelintcache`, `.prettiercache`, and the
+`_tmp_<pid>_<hex>` files pnpm writes and removes at every run. A file with
+such a path that git does not ignore is source: reading it makes the run
+UNVERIFIED. At the top of each `node_modules`, only `.cache`, `.vite`,
+`.vite-temp`, `.vitest` and `.vitest-cache` are left out, and `*.tsbuildinfo`
+anywhere in it.
+
+Two installed files are rewritten by tools during a run. pnpm rewrites
+`node_modules/.pnpm-workspace-state-v1.json` at the first run after an
+install, through a temporary `node_modules/.tmpXXXXXX` file, and on Linux
+writes a file with no name there (`O_TMPFILE`), whose writes the file
+watcher reports as `node_modules/#NUMBER`. vue-tsc writes
+`node_modules/.vue-global-types/*.d.ts` before it reads them. These files stay
+inputs. When they are the only files a run changed, and the run wrote them,
+the result is kept with the files as the run left them. A recorded process
+counts as writing a file it wrote; for pnpm's files, the pnpm executable must
+have run. A `#NUMBER` event counts only directly in the root `node_modules`,
+on Linux, when no file has that name. A later change to them makes the
+result STALE.
+
+It does not mean a rerun would give the same result: a test that depends on
+the time or on randomness can pass now and fail later on the same inputs.
+
+## Programs
+
+The recorder sees only Node processes. Every other program a run starts must be
+one REDUE can account for:
+
+- `sh` or `dash`, or `bash` without `BASH_ENV`, running a command that, read
+  as text, starts only Node programs, package managers and shell builtins
+  (`cd`, `echo`, `true`, `export`, `exec` and a few more). Words are looked up
+  on the PATH the shell got. A Node program is the Node executable, a file
+  whose `#!` line runs Node, or a pnpm launcher. A version manager's `node`
+  shim (asdf, nodenv) is a script and does not count. Other shells read
+  startup files and are refused. The shell must still have REDUE's recorder in
+  `NODE_OPTIONS`: npm's and pnpm's `node-options` setting replaces it, and a
+  run under such a setting is UNVERIFIED;
+- a pnpm launcher in `node_modules/.bin`: the `#!/bin/sh` script pnpm writes,
+  which runs `sed`, `dirname`, `uname` or `readlink` before it starts Node. It
+  is trusted only when its text is exactly one of the templates pnpm 8.0 to
+  12.14 write (`src/pnpm-shim-templates.json`), with only the bin file and
+  `NODE_PATH` filled in;
+- the pnpm executable (pnpm 12, also the copy Corepack downloads): REDUE cannot
+  see what it does, so the scripts it runs are read as text the same way,
+  their `pre` and `post` scripts included. Filters and recursive runs
+  (`--filter`, `-r`) are refused. At least one Node process it starts must
+  have loaded the recorder, and its configuration files outside the checkout
+  (`pnpm/rc`, `pnpm/config.yaml`, `~/.npmrc`, the global `npmrc`) are kept by
+  content;
+- `ps -A -o ppid,pid`, which pnpm loaded into Corepack runs.
+
+A process that replaces itself with another program through
+`process.execve` (TypeScript 7's `tsc` does this to start its native
+compiler) is judged the same way as a program it starts. `init` reads
+TypeScript 7's launchers (`tsc` from `typescript@7`, `tsgo` from
+`@typescript/native-preview`) as that native compiler and keeps such a script
+recording-only.
+
+Anything else makes the result UNVERIFIED and names the program: `git`,
+`sleep`, `find`, and native programs from installed packages such as esbuild,
+turbo, tsgo, tsgolint and biome, whose reads, writes and network use REDUE
+cannot see. `init` reads the script the same way. A typecheck or lint script
+gets the [sandboxed recipe](sandbox.md) first where it can run, which covers
+such programs; otherwise a script that starts one stays recording-only, with
+the program in the reason.
+
+A command line may use `&&`, `||`, `;`, `|`, quotes without expansions,
+globs in arguments and redirection to `/dev/null`. Variables, command
+substitution, input redirection, subshells, here-documents and `command -p`
+are refused. Setting or clearing `NODE_OPTIONS`, `PATH`, `REDUE_RUN_RECORD`,
+`BASH_ENV`, `ENV`, or npm's or pnpm's `node-options` or `script-shell` is
+refused, since it could stop a Node process from loading the recorder.
+`node --env-file` and Node's config-file options are refused: Node reads those
+files natively. `process.loadEnvFile` is recorded as a read.
+
+## The guard
+
+As in the [direct test recipe](tests-direct.md#the-guard), the result is kept
+but marked UNVERIFIED, with the reason, when the run read a git-ignored file
+REDUE does not observe and did not create first, changed an input during the
+run (a formatter's `--write`, a generated `version.ts`), listed a directory or
+read a large file outside the checkout, used the network, or started a program
+REDUE does not account for. Reads through a workspace package's link in
+`node_modules` count where the link leads.
+
+The package managers' own installations, Corepack's downloads and npm's log
+directory are toolchain, identified by the package manager's executable, not
+inputs.
+
+## Limits
+
+- On macOS, a file created and removed directly in the project root during a
+  run (pnpm 12 does this) can be reported by the file watcher as an event on
+  the root itself, an observation gap that makes the run UNVERIFIED. Linux
+  reports the file, which is not an input.
+- On Linux, any program's file with no name in the root `node_modules`,
+  written during a run that started the pnpm executable, is taken as pnpm's.
+  If that program gives the file a real name (any name, `node_modules`
+  included) and then writes through the open file, REDUE misses those
+  writes. A real file named `node_modules/#NUMBER` that is created and
+  removed within such a run is treated the same way. Outside a pnpm run,
+  these writes leave the run UNVERIFIED.
+- The pnpm executable and the pnpm launchers' helpers are trusted as
+  toolchain: what they read is not checked.
+- Code that copies the environment and reads the copy, and native code that
+  reads files or variables or starts programs (native addons such as
+  Rust-based resolvers), is not seen. Neither are files opened by
+  `node:sqlite` or preopened for `node:wasi`.
+- A project whose `.npmrc` sets `node-options` stays UNVERIFIED: npm replaces
+  `NODE_OPTIONS` with it, which drops REDUE's recorder.
+- A script that runs a build first (`npm run build && tsc --noEmit`) usually
+  starts esbuild or another native bundler and stays UNVERIFIED.
+- Windows is not supported; the check stays recording-only there.

package/docs/user/npm-launcher-notice.md

@@ -0,0 +1,42 @@
+# npm launcher applicability correction — alpha.4
+
+Alpha.4 withdraws automatic applicability for npm-backed TypeScript checks using
+`typescript-noemit-v1`. Alpha.3 was demonstrated to admit an npm invocation whose
+update notification consumes unobserved remote responses, cache and time. Those
+inputs can change the outer npm result without changing the tracked project or
+caller identity. The controlled reproduction does not establish a public registry
+malfunction, affected-user count, or compiler completion in the failing npm case.
+
+Npm commands still execute exactly as configured through `redue run CHECK`.
+They still record PASS/FAIL. Previous PASS remains historical PASS; applicability
+is now UNVERIFIED, including after synchronization or a successful new npm run.
+This is a correction to the claimed boundary, not evidence that the code failed.
+Supported Yarn/pnpm and independently reviewed explicit contracts are unchanged.
+
+Until upgraded, do not rely solely on automatic npm CURRENT to skip the npm
+invocation. A different verification recipe requires explicit selection and fresh
+evidence; it cannot reinterpret an old npm receipt. Alpha.4 does not ship the
+experimental npm direct-compiler recipe or agent activation.
+
+## Upgrade without losing history
+
+First stop **every observer using this installation**, using each original config
+and any explicit state directory. Then upgrade that same installation and restart
+each observer with the same selections:
+
+```sh
+redue --config /path/to/project/redue.config.json stop
+npm install --global @redue/cli@0.1.0-alpha.4
+redue --config /path/to/project/redue.config.json start
+redue --config /path/to/project/redue.config.json status --sync
+```
+
+Repeat the stop/start commands for each project. If you originally used
+`--state-dir`, supply the identical directory on every REDUE command. If installed
+with a custom npm `--prefix`, supply the same prefix during installation. On Windows
+use `npm.cmd`/`redue.cmd` if required by existing PowerShell policy; do not change it.
+
+**Do not delete receipts or use `remove-state` as an upgrade step.** An upgraded
+client refuses an obsolete running observer interpretation and asks for stop/start.
+Restart reconciles existing state and preserves immutable historical runs. This
+correction does not silently change your project config or configured command.

package/docs/user/pilot.md

@@ -0,0 +1,146 @@
+# Opt-in development pilot: alpha.18
+
+Use one fixed build for several ordinary development sessions. The owner will
+invite two or three willing testers and approve their projects; nothing is
+collected or uploaded automatically. External usage has **not started**. Earlier
+controlled compiler/agent trials are acceptance evidence, not independent adoption.
+
+## Check the boundary first
+
+Start with a trusted, single-package npm Git checkout, normally installed locked
+dependencies, and an existing standalone `tsc --noEmit` script without pre/post
+scripts. The direct recipe accepts only an official, unchanged TypeScript **5.x or
+6.0** package (a reviewed release, or one matching the tarball package-lock.json
+names in npm's cache) and Node **22 or 24**. No workspaces, named
+tsconfig selection, emitted/incremental/composite builds, custom loaders or
+outside-root inputs are added by this pilot. Do not downgrade or change your
+project to fit; record an unsupported setup as feedback.
+
+Development-mode source-map support, Node preloads/inspectors/compile-cache
+overrides and `TS_ETW_MODULE_PATH` are unsupported. A few inert Node settings
+are accepted; see [Node settings](direct-typescript.md#node-settings). The injected
+`NODE_USE_ENV_PROXY=1` context is reviewed only on Node **22.13.0**; leave the
+environment and security controls intact. See the [full recipe boundary](direct-typescript.md).
+
+CLI/package mechanics are tested on macOS/APFS, native Linux and Windows/NTFS;
+Linux also needs Python 3 and [supported native storage](getting-started.md).
+Actual fresh-session behavior was tested with Codex **0.162.0 on macOS**, Node
+22.13.0 and the approved exact checkout/state/socket access. This is not general
+sandbox compatibility. Claude mechanics are tested, and the
+[Claude Code typecheck hook](agents.md#claude-code-typecheck-hook) was exercised in
+Claude Code 2.1.302 (`claude -p`). Broader Claude behavior and cross-host handoff
+are **NOT RUN**. The recording shortcut is macOS/direct-recipe only.
+
+## Install and connect explicitly
+
+For a new default npm installation:
+
+```sh
+npm install --global @redue/cli@0.1.0-alpha.18
+redue --version
+cd my-project
+redue --config redue.config.json init --recipe typescript-direct --check typecheck --dry-run
+redue --config redue.config.json init --recipe typescript-direct --check typecheck
+redue --config redue.config.json agent setup codex --dry-run
+redue --config redue.config.json agent setup codex --apply
+redue --config redue.config.json start
+redue --config redue.config.json agent doctor codex --json
+```
+
+Use the discovered check name. Review both previews before applying. The recorded
+invocation is the resolved local Node/compiler with `--noEmit`, **not npm or its
+lifecycle scripts**. Neither init nor setup executes verification. An existing
+config is never overwritten; use the [deliberate check replacement procedure](direct-typescript.md#existing-npm-configuration-deliberate-replacement)
+without losing other checks or changing config/state identity. For an owned custom
+installation prefix or Windows command shims, use the [installation instructions](getting-started.md).
+
+Run doctor inside the agent's actual command boundary too. A healthy outside-shell
+result does not prove access. The owner must grant only the intended checkout,
+owned state directory and exact observer endpoint through supported host controls.
+The observer can write its index, run trusted configured probes in its own process
+context, reload receipts and stop; endpoint access is more than a file read.
+Do not disable sandboxing, bypass the proxy, or allow all sockets. If access is
+unavailable, record the limitation; an installed skill is not behavioral acceptance.
+See [access and diagnostics](agents.md). Doctor does not run verification or sync.
+
+Complete setup before the first real verification obligation. When that obligation
+arises, record the configured compiler check in the intended execution context:
+
+```sh
+redue --config redue.config.json run typecheck
+redue --config redue.config.json status --sync --json
+```
+
+A successful run may remain **UNVERIFIED**. Reuse needs understood schema, healthy
+observation, CURRENT, PASS and `reuse_eligible: true`; a receipt or exit code alone
+is insufficient. Recovery cannot repair a run's missing start observation. A later
+fully observed run can create new eligible evidence. Do not erase receipts to get green.
+
+Start a fresh agent session after connecting, then work normally. Keep ordinary
+task requests and explicit fresh-verification obligations; an explicit npm-script
+request still requires npm. Let later sessions occur naturally—do not manufacture
+edits, restarts or repeated queries to inflate reuse. Configured compiler evidence
+does not verify tests, npm lifecycle behavior or application correctness.
+
+## Update or leave without losing evidence
+
+Keep the pilot version fixed unless a real defect requires a reviewed update.
+Record any build boundary. Before replacing an installation, stop every observer
+using it; keep the same npm prefix, config and any explicit state selection.
+
+```sh
+redue --config redue.config.json stop
+npm install --global @redue/cli@0.1.0-alpha.18
+redue --config redue.config.json agent setup codex --dry-run
+redue --config redue.config.json agent setup codex --apply
+redue --config redue.config.json start
+redue --config redue.config.json status --sync --json
+```
+
+Package installation alone does not update project instructions. Setup updates
+intact owned content, preserves unrelated text and refuses edited managed content.
+Review conflicts; do not delete ownership records to force an update. Setup metadata
+can invalidate prior applicability; reassess normally and start a fresh agent session.
+Historical receipts remain. See [the complete update procedure](agents.md#update-an-existing-connection).
+
+To disconnect and uninstall, using the same installation prefix when applicable:
+
+```sh
+redue --config redue.config.json agent remove codex --dry-run
+redue --config redue.config.json agent remove codex --apply
+redue --config redue.config.json stop
+npm uninstall --global @redue/cli
+```
+
+This preserves project config and receipts. Do not use `remove-state` for an upgrade
+or pilot exit. Edited managed content is left intact with a conflict for review.
+
+## Voluntary notes, reviewed before sharing
+
+Keep a small local note per real verification obligation, including setup failures
+and abandoned attempts. Use existing local receipts/tool history only when you
+choose; do not enable automatic transcript capture. Suggested fields:
+
+| Field | Record |
+| --- | --- |
+| Context | Build, OS/Node/compiler/host versions, anonymous project/session label |
+| Obligation | What actually needed verification; explicit fresh execution if requested |
+| Decision | Consulted? Agent-visible CURRENT/PASS/eligible, STALE, unsupported or unavailable? |
+| Outcome | Actual reuse with no equivalent execution; wrapped run; execution outside REDUE; or unresolved |
+| Evidence | Local before/after receipt IDs and actual commands, reviewed locally |
+| Cost | Measured setup/restart/query/recording/execution durations, if available |
+| Friction | What failed or confused; why you continued or stopped using REDUE |
+
+A CURRENT query is not automatically a saved run; an inspection needing no
+verification is not an avoided check. Do not infer a counterfactual from a receipt.
+Label estimated avoided compiler cost and its assumptions separately from measured
+time. Include recording, restarts and required reruns. Whole-task time alone does
+not establish causal speedup. The question is whether natural later reuse repays
+the cost of creating and maintaining evidence.
+
+Share only a voluntary owner-reviewed, redacted summary through the
+[existing issue tracker](https://github.com/msiric/redue/issues). Keep private source,
+paths, configuration bodies, credentials, receipts and raw transcripts out of public
+issues. Sensitive correctness/security reports use the repository's private security
+reporting channel. Maintain one short friction list, prioritize correctness first,
+and choose the next development task from observed usage rather than a benchmark target.