@sleepy_panda_srl/portulan 0.1.3 → 0.3.0

package/evals/releases/0.2.0.json

@@ -0,0 +1,146 @@
+{
+    "portulan": {
+        "releaseEval": "1"
+    },
+    "version": "0.2.0",
+    "captured": "2026-09-30",
+    "source": {
+        "commit": "0b150002910d34a0a79408e82439cb81e1a0a0b9",
+        "clean": true
+    },
+    "host": {
+        "node": "v26.9.0",
+        "platform": "darwin"
+    },
+    "recipes": [
+        {
+            "id": "docs",
+            "exit": 0
+        },
+        {
+            "id": "json",
+            "exit": 0
+        },
+        {
+            "id": "doctor",
+            "exit": 0
+        },
+        {
+            "id": "tests",
+            "exit": 0
+        },
+        {
+            "id": "plugin",
+            "exit": 0
+        },
+        {
+            "id": "compile",
+            "exit": 0
+        },
+        {
+            "id": "workflow-filters",
+            "exit": 0
+        },
+        {
+            "id": "index",
+            "exit": 0
+        },
+        {
+            "id": "context",
+            "exit": 0
+        },
+        {
+            "id": "ledger",
+            "exit": 0
+        },
+        {
+            "id": "control-chars",
+            "exit": 0
+        },
+        {
+            "id": "comments",
+            "exit": 0
+        },
+        {
+            "id": "rule-carriers",
+            "exit": 0
+        },
+        {
+            "id": "pack-version",
+            "exit": 0
+        },
+        {
+            "id": "pack-identity",
+            "exit": 0
+        },
+        {
+            "id": "payload",
+            "exit": 0
+        },
+        {
+            "id": "eval-bundle",
+            "exit": 0
+        },
+        {
+            "id": "goldens",
+            "exit": 0
+        },
+        {
+            "id": "mutants",
+            "exit": 0
+        },
+        {
+            "id": "fuzz-shell",
+            "exit": 0
+        },
+        {
+            "id": "version-carriers",
+            "exit": 0
+        },
+        {
+            "id": "skill-goldens",
+            "exit": 0
+        },
+        {
+            "id": "review-loop",
+            "exit": 0
+        },
+        {
+            "id": "telemetry",
+            "exit": 0
+        },
+        {
+            "id": "drills",
+            "exit": 0
+        },
+        {
+            "id": "ab",
+            "exit": 0
+        },
+        {
+            "id": "ab-grade",
+            "exit": 0
+        },
+        {
+            "id": "ab-run",
+            "exit": 0
+        },
+        {
+            "id": "tools/github:actions-pinned",
+            "exit": 0
+        }
+    ],
+    "excluded": [
+        {
+            "id": "release-eval",
+            "why": "a capture cannot be accurate about the record it is inside — captured before the record is written it is red for the record's absence, and captured after it is stale the moment the register is rendered. Its verdict for this release is the rail's own run on the pull request carrying this file."
+        }
+    ],
+    "abBaseline": {
+        "snapshot": "evals/ab/baseline.json",
+        "register": "evals/ab/baseline.md",
+        "captured": "2026-08-31T09:05:32.699Z",
+        "commit": "a642d551eec6c146c67ef0acfe3f8ba535c5ce6e",
+        "clean": false
+    }
+}

package/evals/releases/0.2.0.md

@@ -0,0 +1,67 @@
+# Eval result — Portulan 0.2.0
+
+> **Generated. Do not edit.** Rendered from [`evals/releases/0.2.0.json`](0.2.0.json) by [`cli/release-eval.mjs`](../../cli/release-eval.mjs) and byte-compared by the `release-eval` verify recipe. This is the eval result milestone 8 requires a release to carry — `docs/plan.md`, Protocol → Versioning.
+
+## What this release was measured at
+
+| | |
+|---|---|
+| Version | `0.2.0` |
+| Captured | 2026-09-30 |
+| Commit | `0b150002910d34a0a79408e82439cb81e1a0a0b9` |
+| Tree at capture | clean |
+| Node | `v26.9.0` |
+| Platform | `darwin` |
+
+## The rails, and what each returned
+
+29 of the 30 recipes this workspace yielded at capture. The set is derived from [`cli/recipe-set.mjs`](../../cli/recipe-set.mjs) and never listed by hand.
+
+| Recipe | Verdict |
+|---|---|
+| `docs` | green |
+| `json` | green |
+| `doctor` | green |
+| `tests` | green |
+| `plugin` | green |
+| `compile` | green |
+| `workflow-filters` | green |
+| `index` | green |
+| `context` | green |
+| `ledger` | green |
+| `control-chars` | green |
+| `comments` | green |
+| `rule-carriers` | green |
+| `pack-version` | green |
+| `pack-identity` | green |
+| `payload` | green |
+| `eval-bundle` | green |
+| `goldens` | green |
+| `mutants` | green |
+| `fuzz-shell` | green |
+| `version-carriers` | green |
+| `skill-goldens` | green |
+| `review-loop` | green |
+| `telemetry` | green |
+| `drills` | green |
+| `ab` | green |
+| `ab-grade` | green |
+| `ab-run` | green |
+| `tools/github:actions-pinned` | green |
+
+**`release-eval` is excluded**, and the reason is printed rather than the row silently dropped: a capture cannot be accurate about the record it is inside — captured before the record is written it is red for the record's absence, and captured after it is stale the moment the register is rendered. Its verdict for this release is the rail's own run on the pull request carrying this file.
+
+## The A/B baseline this release ships against
+
+[`evals/ab/baseline.md`](https://github.com/sleepy-panda-srl/portulan/blob/v0.2.0/evals/ab/baseline.md), rendered from `evals/ab/baseline.json` — captured 2026-08-31T09:05:32.699Z at `a642d551eec6c146c67ef0acfe3f8ba535c5ce6e`, over a tree that was **not clean**.
+
+**Its figures are not repeated here.** They have one carrier and this is not it.
+
+## What this record does not establish
+
+- **A green says this record agrees with its own capture — never that the release is good.** Every line below is what the recipes returned at one commit, and a recipe's own green establishes only what that recipe's documentation says it establishes.
+- **The recipes were not run at the tag.** They ran at `0b150002910d34a0a79408e82439cb81e1a0a0b9`, and this record is committed *in* the cut change — so the tagged tree is this commit plus whatever that change still adds after the capture, the record itself at minimum. A record cannot be captured at a commit that does not exist yet, and printing the one it was captured at is the only honest form.
+- **`release-eval` is excluded from the rows above**, because a capture cannot be accurate about the record it is inside. Its verdict for this release is the rail's own run on the pull request that carries this file.
+- **This record measures the Portulan repository's own build**, at the commit named above — never the workspace, project or package this release is installed into. Nothing here has looked at your tree.
+- **The tree was clean at capture**, so the commit named above is what was measured.
+- **The A/B baseline's figures are NOT restated here.** This record names which baseline the release ships against; the figures and everything that may not be concluded from them live in that register alone.

package/evals/releases/0.3.0.json

@@ -0,0 +1,150 @@
+{
+    "portulan": {
+        "releaseEval": "1"
+    },
+    "version": "0.3.0",
+    "captured": "2026-11-03",
+    "source": {
+        "commit": "c08515fee0693cb0fc07fc6077fb152aa46bc28b",
+        "clean": false
+    },
+    "host": {
+        "node": "v26.12.1",
+        "platform": "darwin"
+    },
+    "recipes": [
+        {
+            "id": "docs",
+            "exit": 0
+        },
+        {
+            "id": "json",
+            "exit": 0
+        },
+        {
+            "id": "doctor",
+            "exit": 0
+        },
+        {
+            "id": "tests",
+            "exit": 0
+        },
+        {
+            "id": "plugin",
+            "exit": 0
+        },
+        {
+            "id": "compile",
+            "exit": 0
+        },
+        {
+            "id": "workflow-filters",
+            "exit": 0
+        },
+        {
+            "id": "index",
+            "exit": 0
+        },
+        {
+            "id": "context",
+            "exit": 0
+        },
+        {
+            "id": "ledger",
+            "exit": 0
+        },
+        {
+            "id": "control-chars",
+            "exit": 0
+        },
+        {
+            "id": "comments",
+            "exit": 0
+        },
+        {
+            "id": "rule-carriers",
+            "exit": 0
+        },
+        {
+            "id": "pack-version",
+            "exit": 0
+        },
+        {
+            "id": "pack-identity",
+            "exit": 0
+        },
+        {
+            "id": "payload",
+            "exit": 0
+        },
+        {
+            "id": "eval-bundle",
+            "exit": 0
+        },
+        {
+            "id": "goldens",
+            "exit": 0
+        },
+        {
+            "id": "mutants",
+            "exit": 0
+        },
+        {
+            "id": "fuzz-shell",
+            "exit": 0
+        },
+        {
+            "id": "version-carriers",
+            "exit": 0
+        },
+        {
+            "id": "skill-goldens",
+            "exit": 0
+        },
+        {
+            "id": "review-loop",
+            "exit": 0
+        },
+        {
+            "id": "telemetry",
+            "exit": 0
+        },
+        {
+            "id": "drills",
+            "exit": 0
+        },
+        {
+            "id": "ab",
+            "exit": 0
+        },
+        {
+            "id": "ab-grade",
+            "exit": 0
+        },
+        {
+            "id": "ab-run",
+            "exit": 0
+        },
+        {
+            "id": "tools/github:actions-pinned",
+            "exit": 0
+        },
+        {
+            "id": "tools/local-llm:runner-rails",
+            "exit": 0
+        }
+    ],
+    "excluded": [
+        {
+            "id": "release-eval",
+            "why": "a capture cannot be accurate about the record it is inside — captured before the record is written it is red for the record's absence, and captured after it is stale the moment the register is rendered. Its verdict for this release is the rail's own run on the pull request carrying this file."
+        }
+    ],
+    "abBaseline": {
+        "snapshot": "evals/ab/baseline.json",
+        "register": "evals/ab/baseline.md",
+        "captured": "2026-08-31T09:05:32.699Z",
+        "commit": "a642d551eec6c146c67ef0acfe3f8ba535c5ce6e",
+        "clean": false
+    }
+}

package/evals/releases/0.3.0.md

@@ -0,0 +1,68 @@
+# Eval result — Portulan 0.3.0
+
+> **Generated. Do not edit.** Rendered from [`evals/releases/0.3.0.json`](0.3.0.json) by [`cli/release-eval.mjs`](../../cli/release-eval.mjs) and byte-compared by the `release-eval` verify recipe. This is the eval result milestone 8 requires a release to carry — `docs/plan.md`, Protocol → Versioning.
+
+## What this release was measured at
+
+| | |
+|---|---|
+| Version | `0.3.0` |
+| Captured | 2026-11-03 |
+| Commit | `c08515fee0693cb0fc07fc6077fb152aa46bc28b` |
+| Tree at capture | **not clean** |
+| Node | `v26.12.1` |
+| Platform | `darwin` |
+
+## The rails, and what each returned
+
+30 of the 31 recipes this workspace yielded at capture. The set is derived from [`cli/recipe-set.mjs`](../../cli/recipe-set.mjs) and never listed by hand.
+
+| Recipe | Verdict |
+|---|---|
+| `docs` | green |
+| `json` | green |
+| `doctor` | green |
+| `tests` | green |
+| `plugin` | green |
+| `compile` | green |
+| `workflow-filters` | green |
+| `index` | green |
+| `context` | green |
+| `ledger` | green |
+| `control-chars` | green |
+| `comments` | green |
+| `rule-carriers` | green |
+| `pack-version` | green |
+| `pack-identity` | green |
+| `payload` | green |
+| `eval-bundle` | green |
+| `goldens` | green |
+| `mutants` | green |
+| `fuzz-shell` | green |
+| `version-carriers` | green |
+| `skill-goldens` | green |
+| `review-loop` | green |
+| `telemetry` | green |
+| `drills` | green |
+| `ab` | green |
+| `ab-grade` | green |
+| `ab-run` | green |
+| `tools/github:actions-pinned` | green |
+| `tools/local-llm:runner-rails` | green |
+
+**`release-eval` is excluded**, and the reason is printed rather than the row silently dropped: a capture cannot be accurate about the record it is inside — captured before the record is written it is red for the record's absence, and captured after it is stale the moment the register is rendered. Its verdict for this release is the rail's own run on the pull request carrying this file.
+
+## The A/B baseline this release ships against
+
+[`evals/ab/baseline.md`](https://github.com/sleepy-panda-srl/portulan/blob/v0.3.0/evals/ab/baseline.md), rendered from `evals/ab/baseline.json` — captured 2026-08-31T09:05:32.699Z at `a642d551eec6c146c67ef0acfe3f8ba535c5ce6e`, over a tree that was **not clean**.
+
+**Its figures are not repeated here.** They have one carrier and this is not it.
+
+## What this record does not establish
+
+- **A green says this record agrees with its own capture — never that the release is good.** Every line below is what the recipes returned at one commit, and a recipe's own green establishes only what that recipe's documentation says it establishes.
+- **The recipes were not run at the tag.** They ran at `c08515fee0693cb0fc07fc6077fb152aa46bc28b`, and this record is committed *in* the cut change — so the tagged tree is this commit plus whatever that change still adds after the capture, the record itself at minimum. A record cannot be captured at a commit that does not exist yet, and printing the one it was captured at is the only honest form.
+- **`release-eval` is excluded from the rows above**, because a capture cannot be accurate about the record it is inside. Its verdict for this release is the rail's own run on the pull request that carries this file.
+- **This record measures the Portulan repository's own build**, at the commit named above — never the workspace, project or package this release is installed into. Nothing here has looked at your tree.
+- **The tree was NOT clean at capture** — the diff of the cut change is the only record of what was uncommitted, which is weaker than a sha and is printed rather than hidden.
+- **The A/B baseline's figures are NOT restated here.** This record names which baseline the release ships against; the figures and everything that may not be concluded from them live in that register alone.

package/evals/releases/README.md

@@ -1,8 +1,8 @@
 # `evals/releases/`
 
-The eval result each release carries, one pair per version — milestone 8's ninth clause. The argument,
-the limits and the two designs a fresh context reversed are in [`../README.md`](../README.md); the
-mechanism is [`../../cli/release-eval.mjs`](../../cli/release-eval.mjs). This file does not restate
+The eval result each release carries, one pair per version — milestone 8's ninth clause. The limits are
+in [`../README.md`](../README.md); the argument, the mechanism and the two designs a fresh context
+reversed are in [`../../cli/release-eval.mjs`](../../cli/release-eval.mjs). This file does not restate
 either, because a rule with two carriers is obeyed at the narrower one.
 
 - `<version>.json` — the **capture**: the verdict every recipe the workspace yielded returned, at a named

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleepy_panda_srl/portulan",
-  "version": "0.1.3",
+  "version": "0.3.0",
   "description": "Portulan — an agentic-engineering framework whose product is its files. The CLI wraps the file-based mechanics for hosts beyond Claude Code.",
   "license": "Apache-2.0",
   "type": "module",
@@ -26,7 +26,10 @@
     "!cli/ab.mjs",
     "!cli/ab-run.mjs",
     "!cli/ab-grade.mjs",
-    "!cli/payload.mjs"
+    "!cli/local-routing.mjs",
+    "!cli/warm.mjs",
+    "!cli/payload.mjs",
+    "!cli/roster.mjs"
   ],
   "repository": {
     "type": "git",

package/packs/.claude-plugin/plugin.json

@@ -17,6 +17,7 @@
     "supervision"
   ],
   "skills": [
-    "./rituals/checkpoints/skills/"
+    "./rituals/checkpoints/skills/",
+    "./tools/local-llm/skills/"
   ]
 }

package/packs/README.md

@@ -31,7 +31,9 @@ registers nothing, silently, while a validator walking deeper counts three;
 manifests therefore sit in this tree and they answer different questions: the repository's own at
 [`../.claude-plugin/plugin.json`](../.claude-plugin/plugin.json), which declares
 `./packs/rituals/checkpoints/skills/` because *its* root is the repository; and this one, whose root is
-`packs/`. Neither is redundant, and the paths differ by exactly the prefix their roots differ by.
+`packs/`. Neither is redundant, and the paths differ by exactly the prefix their roots differ by. Both
+also declare `tools/local-llm`'s `skills/` root, the same way, since this repository's workspace composes
+that pack too; the plugin's name and version here are the checkpoints pack's.
 
 **The version here mirrors the pack's own** — `portulan.version` in
 [`rituals/checkpoints/pack.json`](rituals/checkpoints/pack.json), which the Pack Definition names as how
@@ -45,7 +47,8 @@ observed through a *local* marketplace over a copy of this directory. The quoted
 exists and the feed's pin moves to it. Until then the green is demonstrated on the payload and inferred
 for the feed — a distinction this repository would rather write down than round off.
 
-> **Two packs exist.** [`rituals/checkpoints`](rituals/checkpoints/README.md), the supervised-build
-> ritual; and [`tools/github`](tools/github/README.md), one verify recipe. `stacks/` is still empty and
-> says why.
+> **Three packs exist.** [`rituals/checkpoints`](rituals/checkpoints/README.md), the supervised-build
+> ritual; [`tools/github`](tools/github/README.md), one verify recipe; and
+> [`tools/local-llm`](tools/local-llm/README.md), hybrid local-model execution under a zero-floor input
+> budget and a verify-gated rollback loop. `stacks/` is still empty and says why.
 

package/packs/rituals/checkpoints/README.md

@@ -100,7 +100,7 @@ under, and the checkpoint section of that project's own gate map.
 
 **The evidence is that project's build record**, cited as provenance rather than as procedure: the
 fresh-context checkpoints changed *designs* rather than wording at two consecutive milestones — the
-story is in [milestone 4's record](https://github.com/sleepy-panda-srl/portulan/blob/main/docs/milestones/m04.md),
+story is in [milestone 4's record](https://github.com/sleepy-panda-srl/portulan/blob/8a33f9b/docs/milestones/m04.md),
 beside [the protocol itself](https://github.com/sleepy-panda-srl/portulan/blob/main/docs/plan.md) —
 while adopters received no artifact for the ritual that produced them. This pack is that artifact.
 

package/packs/tools/README.md

@@ -3,12 +3,12 @@
 Tool packs — integrations for the tools and MCP servers an agent drives (issue trackers, cloud
 CLIs, design tools, databases), with the how-to and the gate classification for each.
 
-> **One tool pack exists** — [`github/`](github/README.md). The machinery that reads one is a gate policy in a
-> host-neutral vocabulary, dispatched on by [`../../cli/compile.mjs`](../../cli/compile.mjs) — and the
-> cascade's missing middle (`core < pack < workspace`) is now bridged: a pack's `contributes.gates`
-> fragments are resolved and merged into the policy, **tighten-only**, by the same compiler.
+> **Two tool packs exist** — [`github/`](github/README.md) and [`local-llm/`](local-llm/README.md). The
+> machinery that reads one is a gate policy in a host-neutral vocabulary, dispatched on by
+> [`../../cli/compile.mjs`](../../cli/compile.mjs) — and the cascade's missing middle (`core < pack < workspace`)
+> is bridged: a pack's `contributes.gates` fragments are resolved and merged into the policy,
+> **tighten-only**, by the same compiler.
 >
-> The first pack to use it is a *ritual* one ([`../rituals/checkpoints/`](../rituals/checkpoints/)), so
-> the promise this file has carried since it was written — that a tool pack ships "with the gate
-> classification for each" — is now buildable and still unbuilt. A tool pack becomes worth writing when
-> a workspace here drives a tool that needs one.
+> [`local-llm/`](local-llm/README.md) is the first tool pack to ship a gate classification
+> (`local-llm-off-loopback` at `propose`) alongside a persona and an offline verify recipe,
+> fulfilling the promise this file has carried since it was written.

package/packs/tools/github/verify/actions-pinned.sh

@@ -1,34 +1,13 @@
 #!/usr/bin/env bash
-#
 # Every `uses:` in a GitHub Actions workflow is pinned to a full 40-character commit SHA.
-#
-# Exit 0 green · 1 red · 2 could not run. The third is load-bearing here, as everywhere in this
-# project: a recipe that could not look must never report what a recipe that looked and found nothing
-# reports. See `README.md` beside this file for what the check does NOT cover and why it exists at all
-# given that GitHub can enforce pinning itself.
-#
-# Composed into an adopting workspace through `pack.json`'s `contributes.verify`, whose `run` names
-# this file through `${PACK_ROOT}` — the pack does not know the adopter's layout and must not guess it.
+# Exit 0 green · 1 red · 2 could not run.
 
 set -uo pipefail
 
+# Relative to the working directory, the adopter's root: where the pack sits says nothing about it.
 WORKFLOWS=".github/workflows"
 
-# ---------------------------------------------------------------------------------------------
-# The tools this recipe invokes, checked before it invokes them.
-#
-# Without this the failure is SILENT and GREEN: the two loops below read from process substitutions,
-# so a missing `find` or `grep` yields no lines at all, every counter stays zero, `status` stays 0 —
-# and the recipe reports a pass having examined nothing. That is the false green — "nothing looked"
-# reported as "nothing wrong" — and it is precisely what `.portulan/memory/verify-preconditions-fail-closed.md`
-# exists to refuse. The header below already cited that rule for the workflows DIRECTORY and did not
-# apply it to the recipe's own dependencies: a rule obeyed at one of its two sites, in a file that
-# quotes the rule. Copilot round 5.
-#
-# `requires` in `pack.json` declares the same list. Two carriers, deliberately — the manifest's is
-# what a host reads to decide whether to run at all, this one is what fires when it ran anyway — and
-# they are checked against each other by nothing, which is stated here rather than implied.
-# ---------------------------------------------------------------------------------------------
+# `pack.json`'s `requires` lists these tools too, and nothing checks that the two agree.
 missing=""
 for tool in find grep sed sort cut wc tr; do
     command -v "$tool" >/dev/null 2>&1 || missing="$missing $tool"
@@ -40,16 +19,6 @@ if [ -n "$missing" ]; then
     exit 2
 fi
 
-# ---------------------------------------------------------------------------------------------
-# Preconditions fail closed. Enumeration is the precondition here exactly as it is in this project's
-# own recipes (`.portulan/memory/verify-preconditions-fail-closed.md`): a green computed over a
-# directory that was not there is a green about nothing.
-#
-# Both the absent directory and the present-but-empty one are could-not-run rather than vacuously
-# green, and the distinction between them is kept in the MESSAGE rather than in the exit code —
-# a workspace with no workflows has composed a pack that cannot do its job, and should hear that
-# sentence rather than a green it might mistake for coverage.
-# ---------------------------------------------------------------------------------------------
 if [ ! -d "$WORKFLOWS" ]; then
     printf 'actions-pinned: COULD NOT RUN — there is no %s directory in this repository.\n' "$WORKFLOWS" >&2
     printf '  A workspace with no GitHub Actions workflows has nothing for this recipe to check;\n' >&2
@@ -57,8 +26,6 @@ if [ ! -d "$WORKFLOWS" ]; then
     exit 2
 fi
 
-# `find` rather than a glob, so a directory holding only subdirectories is not mistaken for one
-# holding workflows. Sorted so the report is stable between runs and between machines.
 files=$(find "$WORKFLOWS" -maxdepth 1 -type f \( -name '*.yml' -o -name '*.yaml' \) | sort)
 
 if [ -z "$files" ]; then
@@ -69,30 +36,21 @@ fi
 status=0
 examined=0
 pinned=0
-local_refs=0
+exempt=0
 
 while IFS= read -r file; do
-    # One `uses:` per line is the shape every workflow in the wild uses; a folded or flow-mapping
-    # spelling would slip past this, which is stated in README.md as a known limit rather than
-    # covered by a matcher that would claim more than it reads.
+    # One `uses:` per line: a folded or flow-mapping spelling is not seen.
     while IFS= read -r line; do
         value=$(printf '%s\n' "$line" | sed -E 's/^[[:space:]]*-?[[:space:]]*uses:[[:space:]]*//; s/[[:space:]]*(#.*)?$//; s/^["'"'"']//; s/["'"'"']$//')
         [ -n "$value" ] || continue
 
-        # `examined` counts only references this recipe can actually judge, and the exempt ones are
-        # counted separately below. Counting them here made the summary print a ratio like `2 of 3
-        # pinned` on a run where every non-exempt reference WAS pinned — a green whose own number
-        # looked like a partial pass. Copilot round 2.
         case "$value" in
             ./*)
-                # A local action lives in this repository and moves with it — there is no third-party
-                # commit to pin, and demanding one would be a check that cannot be satisfied.
-                local_refs=$((local_refs + 1))
+                exempt=$((exempt + 1))
                 continue
                 ;;
             docker://*)
-                # A container reference is pinned by digest, not by commit. Out of scope and named.
-                local_refs=$((local_refs + 1))
+                exempt=$((exempt + 1))
                 continue
                 ;;
         esac
@@ -102,10 +60,7 @@ while IFS= read -r file; do
         if [ "$ref" = "$value" ]; then
             printf '  UNPINNED %s: `uses: %s` carries no `@ref` at all\n' "$file" "$value" >&2
             status=1
-        # Case-insensitive: a git object name is hex and hex is case-insensitive, so an uppercase or
-        # mixed-case SHA is a pinned SHA. Matching lowercase only would have reported a correctly
-        # pinned action as unpinned — a FALSE RED, which is the failure mode this project treats as
-        # worse than a missed catch, because it is the one that gets a check switched off.
+        # Case-insensitive, as hex is: an uppercase SHA is still a pinned one.
         elif printf '%s' "$ref" | grep -Eqi '^[0-9a-f]{40}$'; then
             pinned=$((pinned + 1))
         else
@@ -120,8 +75,8 @@ count=$(printf '%s\n' "$files" | wc -l | tr -d ' ')
 if [ "$status" -eq 0 ]; then
     printf 'actions-pinned: %s of %s `uses:` reference(s) pinned to a full commit SHA across %s workflow file(s)' \
         "$pinned" "$examined" "$count"
-    if [ "$local_refs" -gt 0 ]; then
-        printf ', %s local or container reference(s) exempt' "$local_refs"
+    if [ "$exempt" -gt 0 ]; then
+        printf ', %s local or container reference(s) exempt' "$exempt"
     fi
     printf '\n\nGREEN — verify recipe passed.\n'
 else