@stsepelin/checktrail 0.1.0-alpha.2 → 0.1.0-alpha.3

package/README.md

@@ -4,22 +4,28 @@ Local code validation with a CLI, MCP tools, and evidence of what actually ran.
 
 Formerly Repo Verifier. See the [rename guide](docs/RENAMING.md) for existing source checkouts.
 
-**Published preview: 0.1.0-alpha.1; alpha.2 is in preparation.** Public source is available at
+**Published preview: 0.1.0-alpha.2; source candidate: 0.1.0-alpha.3.** Public source is available at
 [stsepelin/checktrail](https://github.com/stsepelin/checktrail).
 See [implementation status](docs/STATUS.md), the [plan](docs/PLAN.md) and the
 [language matrix](docs/LANGUAGES.md) before relying on an adapter.
 [Installation](docs/INSTALLATION.md) covers the CLI, Claude Code and Codex.
 [Agent skills](docs/SKILLS.md) provides setup, validation and review workflows
 installable with `npx skills add stsepelin/checktrail`.
-[Project setup](docs/ONBOARDING.md) covers the alpha.2 candidate's `init`, `doctor`
+[Project setup](docs/ONBOARDING.md) covers `init`, `doctor`
 and MCP configuration generator.
 [Release preparation](docs/RELEASE.md) records publication and verification gates. The
 [milestone audit](docs/ACCEPTANCE.md) separates implemented profiles from open
 acceptance work; [client checks](docs/CLIENTS.md) record actual application coverage.
-
-The [hosted matrix](https://github.com/stsepelin/checktrail/actions/runs/35585998184)
-passed at `bfc8cc4` on Linux and macOS. That result predates the alpha.2 candidate;
-new release changes require their own CI run and package verification.
+[Public adoption](docs/PUBLIC-ADOPTION.md) records the published package on five
+pinned libraries, including setup friction and compatibility gaps.
+The alpha.3 candidate fixes the recorded [TypeScript 4.9.5 incompatibility](docs/TYPESCRIPT.md);
+it has not been published.
+
+The [hosted matrix](https://github.com/stsepelin/checktrail/actions/runs/35590670960)
+passed at release commit `4ce8398` on Linux and macOS. The exact npm tarball and
+fresh CLI/MCP installations were verified. The
+[MCP Registry entry](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.stsepelin%2Fchecktrail/versions/0.1.0-alpha.2)
+is active; execution remains disabled by default.
 
 Checktrail discovers projects, plans registered checks, invokes native tools
 when explicitly trusted, and reports results without turning skipped or empty

package/dist/src/types.d.ts

@@ -1,6 +1,6 @@
 import type { ExternalIdentity } from "./external-adapter.js";
 import type { RuntimeInventory } from "./runtime-inventory.js";
-export declare const VERSION = "0.1.0-alpha.2";
+export declare const VERSION = "0.1.0-alpha.3";
 export declare const PARSERS: readonly ["vue-router-json", "nuxt-json", "exit", "empty", "node-events", "unittest", "go-scope-test", "go-scope-analysis", "golangci-json", "staticcheck-json", "go-json", "typescript-build-json", "tsc-files", "eslint-json", "vitest-json", "playwright-json", "jest-json", "pytest-json", "fastapi-json", "django-json", "laravel-json", "rust-json", "clang-json", "java-json", "dotnet-json", "actionlint-json", "external-json", "ruby-syntax", "silent-syntax", "ruff-json", "mypy-json", "phpstan-json", "phpunit-junit", "pint-json"];
 export type Status = "passed" | "failed" | "unavailable" | "skipped" | "error" | "inconclusive";
 export type Outcome = "passed" | "failed" | "incomplete";

package/dist/src/types.js

@@ -1,4 +1,4 @@
-export const VERSION = "0.1.0-alpha.2";
+export const VERSION = "0.1.0-alpha.3";
 export const PARSERS = [
     "vue-router-json",
     "nuxt-json",

package/dist/src/typescript-arguments.d.ts

@@ -0,0 +1,4 @@
+import type { parseCommandLine } from "typescript";
+export declare function typecheckArguments(compiler: {
+    parseCommandLine: typeof parseCommandLine;
+}, args: string[]): string[];

package/dist/src/typescript-arguments.js

@@ -0,0 +1,10 @@
+export function typecheckArguments(compiler, args) {
+    const probe = compiler.parseCommandLine(["--noCheck", "false"]);
+    if (probe.errors.length === 0 && probe.options.noCheck === false)
+        return [...args, "--noCheck", "false"];
+    if (probe.errors.length === 1 &&
+        probe.errors[0].code === 5023 &&
+        probe.options.noCheck === undefined)
+        return args;
+    throw new Error("Cannot establish the compiler's noCheck option support");
+}

package/dist/src/typescript-runner.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/typescript-runner.js

@@ -0,0 +1,19 @@
+import { createRequire } from "node:module";
+import path from "node:path";
+import { withinRoot } from "./inventory.js";
+import { typecheckArguments } from "./typescript-arguments.js";
+async function main() {
+    const [entry, root, ...args] = process.argv.slice(2);
+    if (!entry || !root)
+        throw new Error("Invalid TypeScript compiler arguments");
+    const tool = await withinRoot(root, path.relative(root, entry));
+    const api = await withinRoot(root, path.relative(root, path.resolve(path.dirname(tool), "../lib/typescript.js")));
+    const load = createRequire(tool);
+    const ts = load(api);
+    process.argv = [process.execPath, tool, ...typecheckArguments(ts, args)];
+    load(tool);
+}
+main().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : "TypeScript checking failed"}\n`);
+    process.exitCode = 2;
+});

package/dist/src/typescript.js

@@ -16,18 +16,12 @@ export async function typescriptCheck(source, project, vue = false) {
                 {
                     executable: process.execPath,
                     args: [
-                        ...(vue
-                            ? [
-                                fileURLToPath(new URL("./vue-tsc-runner.js", import.meta.url)),
-                                compiler,
-                                source.root,
-                            ]
-                            : [compiler]),
+                        fileURLToPath(new URL(vue ? "./vue-tsc-runner.js" : "./typescript-runner.js", import.meta.url)),
+                        compiler,
+                        source.root,
                         "--project",
                         "./tsconfig.json",
                         "--noEmit",
-                        "--noCheck",
-                        "false",
                         "--pretty",
                         "false",
                         "--incremental",

package/dist/src/vue-tsc-runner.js

@@ -1,5 +1,6 @@
 import { createRequire } from "node:module";
 import path from "node:path";
+import { typecheckArguments } from "./typescript-arguments.js";
 import { withinRoot } from "./inventory.js";
 async function main() {
     const [entry, root, ...args] = process.argv.slice(2);
@@ -15,7 +16,7 @@ async function main() {
         throw new Error("Vue template checking is disabled by skipTemplateCodegen");
     const compiler = load(tool);
     const tsc = await resolve("typescript/lib/tsc.js");
-    process.argv = [process.execPath, tool, ...args];
+    process.argv = [process.execPath, tool, ...typecheckArguments(ts, args)];
     compiler.run(tsc);
 }
 main().catch((error) => {

package/docs/ACCEPTANCE.md

@@ -5,17 +5,25 @@ verification. It does not replace the plan or promote an unverified capability.
 Local implementation, local native evidence, hosted CI and publication are
 separate states. Follow the linked evidence for tested versions and limits.
 
-| Milestone                         | Implemented scope and evidence                                                                                                                                                                                                                                                                                                                                                                                                          | Open acceptance work                                                                                                                                                                                                                                                   |
-| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| M0: public contracts              | Original public fixtures, MIT license, security/contribution guidance, schemas, explicit package allowlist, dependency notices and CI definitions. `STATUS.md`, `SECURITY.md`, `RELEASE.md`.                                                                                                                                                                                                                                            | Public source and npm alpha.1 are published. Hosted CI passed at `bfc8cc4`; alpha.2 requires its own release commit, CI and publication verification.                                                                                                                  |
-| M1: executable foundation         | Shared CLI/library/MCP engine, bounded inventory/runner, startup trust, native Node/Python/Go/PHP profiles, protocol and lifecycle regressions. `ARCHITECTURE.md`, `STATUS.md`, `MCP-COMPATIBILITY.md`. Fresh installed application-client profiles now have evidence in `CLIENTS.md`.                                                                                                                                                  | Application-client coverage beyond the named profiles. PHP remains unavailable when the consumer has no prepared runtime.                                                                                                                                              |
-| M2: practical language validation | Explicit JS/TS, Python, Go and PHP native tool profiles, structured diagnostics/test evidence, versions, environments, workspace selection, scope accounting, SARIF/JUnit and finding ratchets. `LANGUAGES.md`, adapter documents, `WORKSPACES.md`, `FINDING-POLICY.md`, `NATIVE-CI.md`.                                                                                                                                                | Hosted toolchain profiles passed at `52ba415`. Wider tool versions/framework configurations must be promoted separately; detection is not execution support.                                                                                                           |
-| M3: framework/contracts           | Native Laravel, Vue Router/Nuxt, Django/FastAPI assembly projections; imported runtime comparison, explicit architecture boundaries, producer/consumer schemas and a built package consumer. `RUNTIME-INVENTORY.md`, framework documents, `CONTRACTS.md`, `ARCHITECTURE-POLICY.md`, `examples/package-contract/README.md`.                                                                                                              | Broader native semantics/import collection and live service integration are not implemented. Synthetic evidence does not establish equivalent results in a private application; private integration feedback must remain private.                                      |
-| M4: ecosystem/distribution        | Bounded Rust, Java, C#, Ruby, Swift, Clang and actionlint profiles; trusted external adapters, pinned data-only pack distribution, fresh offline package checks, production notice audit, measured performance and unpublished registry metadata. `LANGUAGES.md`, `EXTERNAL-ADAPTERS.md`, `PACK-DISTRIBUTION.md`, `PERFORMANCE.md`, `RELEASE.md`.                                                                                       | Alpha.2 release verification and MCP Registry registration. Windows execution and the unimplemented subsequent integrations in `LANGUAGES.md` remain unsupported. Runtime/container/development dependency provenance is broader than the production npm notice audit. |
-| M5: measured assistance           | Advisory guidance, bounded Node mutation experiments, explicit-graph impact measurements, optional local/model review exchange, durable library task storage/worker, development evaluation and externally authored ESLint and Ruff integration cohorts. `GUIDANCE.md`, `MUTATIONS.md`, `IMPACT-MEASUREMENT.md`, `REVIEW-EXCHANGE.md`, `VALIDATION-TASKS.md`, `EVALUATION.md`, `EXTERNAL-EVALUATION.md`, `EXTERNAL-RUFF-EVALUATION.md`. | Standard MCP Tasks wire integration; wider held-out rule-family/review evidence, prior-workflow comparison and representative cost/latency measurement. No general equal-or-better review-quality claim is supported.                                                  |
+| Milestone                         | Implemented scope and evidence                                                                                                                                                                                                                                                                                                                                                                                                          | Open acceptance work                                                                                                                                                                                                                           |
+| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| M0: public contracts              | Original public fixtures, MIT license, security/contribution guidance, schemas, explicit package allowlist, dependency notices and CI definitions. `STATUS.md`, `SECURITY.md`, `RELEASE.md`.                                                                                                                                                                                                                                            | Public source, npm alpha.2 and its MCP Registry entry are published. Hosted CI passed at `4ce8398`; fresh registry installation was verified.                                                                                                  |
+| M1: executable foundation         | Shared CLI/library/MCP engine, bounded inventory/runner, startup trust, native Node/Python/Go/PHP profiles, protocol and lifecycle regressions. `ARCHITECTURE.md`, `STATUS.md`, `MCP-COMPATIBILITY.md`. Fresh installed application-client profiles now have evidence in `CLIENTS.md`.                                                                                                                                                  | Application-client coverage beyond the named profiles. PHP remains unavailable when the consumer has no prepared runtime.                                                                                                                      |
+| M2: practical language validation | Explicit JS/TS, Python, Go and PHP native tool profiles, structured diagnostics/test evidence, versions, environments, workspace selection, scope accounting, SARIF/JUnit and finding ratchets. `LANGUAGES.md`, adapter documents, `WORKSPACES.md`, `FINDING-POLICY.md`, `NATIVE-CI.md`.                                                                                                                                                | Hosted toolchain profiles passed at `52ba415`. Wider tool versions/framework configurations must be promoted separately; detection is not execution support.                                                                                   |
+| M3: framework/contracts           | Native Laravel, Vue Router/Nuxt, Django/FastAPI assembly projections; imported runtime comparison, explicit architecture boundaries, producer/consumer schemas and a built package consumer. `RUNTIME-INVENTORY.md`, framework documents, `CONTRACTS.md`, `ARCHITECTURE-POLICY.md`, `examples/package-contract/README.md`.                                                                                                              | Broader native semantics/import collection and live service integration are not implemented. Synthetic evidence does not establish equivalent results in a private application; private integration feedback must remain private.              |
+| M4: ecosystem/distribution        | Bounded Rust, Java, C#, Ruby, Swift, Clang and actionlint profiles; trusted external adapters, pinned data-only pack distribution, fresh offline package checks, production notice audit, measured performance and published MCP Registry metadata. `LANGUAGES.md`, `EXTERNAL-ADAPTERS.md`, `PACK-DISTRIBUTION.md`, `PERFORMANCE.md`, `RELEASE.md`.                                                                                     | npm tag cleanup remains unresolved. Windows execution and the unimplemented subsequent integrations in `LANGUAGES.md` remain unsupported. Runtime/container/development dependency provenance is broader than the production npm notice audit. |
+| M5: measured assistance           | Advisory guidance, bounded Node mutation experiments, explicit-graph impact measurements, optional local/model review exchange, durable library task storage/worker, development evaluation and externally authored ESLint and Ruff integration cohorts. `GUIDANCE.md`, `MUTATIONS.md`, `IMPACT-MEASUREMENT.md`, `REVIEW-EXCHANGE.md`, `VALIDATION-TASKS.md`, `EVALUATION.md`, `EXTERNAL-EVALUATION.md`, `EXTERNAL-RUFF-EVALUATION.md`. | Standard MCP Tasks wire integration; wider held-out rule-family/review evidence, prior-workflow comparison and representative cost/latency measurement. No general equal-or-better review-quality claim is supported.                          |
 
 ## Remaining work that can proceed locally
 
+[Public adoption measurements](PUBLIC-ADOPTION.md) now cover five pinned
+JavaScript, TypeScript, Python, Go and PHP libraries. They expose an older
+TypeScript compiler-option incompatibility and workflow/documentation/platform
+coverage friction. An [unreleased compiler fix](TYPESCRIPT.md) now passes the
+known TypeScript 4.9.5 case; workflow/documentation and platform coverage remain
+follow-up work. The observations do not establish full upstream CI coverage or
+general review effectiveness.
+
 1. Extend independently authored evaluation cohorts to additional implemented
    language/rule families, preserving the verifier freeze and recording exact
    selection, exclusions, native baselines and interpretation limits. New fixtures
@@ -43,11 +51,12 @@ run. The local worker/store are available independently; standard Tasks must sta
 unadvertised until routing and the integrated wire/lifecycle suite pass. See
 `MCP-COMPATIBILITY.md` for the reproduction and upstream issue.
 
-The public repository and npm preview `0.1.0-alpha.1` are published. The
-[hosted run at bfc8cc4](https://github.com/stsepelin/checktrail/actions/runs/35585998184)
-passed all jobs. Alpha.2 adds [setup commands](ONBOARDING.md); it requires its own
-release CI and publication. GitHub releases and MCP Registry registration remain
-pending. The repository's explicit-action requirements still apply.
+The public repository, npm preview `0.1.0-alpha.2` and its MCP Registry entry are
+published. The [hosted run at 4ce8398](https://github.com/stsepelin/checktrail/actions/runs/35590670960)
+passed all jobs, and fresh public installation was verified. Alpha.2 adds
+[setup commands](ONBOARDING.md). The [GitHub prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.2)
+is also published with the verified tarball and checksum. npm tag cleanup remains
+unresolved. The repository's explicit-action requirements still apply.
 `RELEASE.md` defines the concrete
 candidate checks and the authorization sequence; a local green run does not
 replace external acceptance.

package/docs/INSTALLATION.md

@@ -1,11 +1,10 @@
 # Install the preview
 
-The published preview is `0.1.0-alpha.1` on
+The published preview is `0.1.0-alpha.2` on
 [npm](https://www.npmjs.com/package/@stsepelin/checktrail).
-Use the exact version below. The registry currently assigns both `next` and
-`latest` to that preview; `latest` is not a stable-release guarantee.
-The alpha.2 candidate adds [project setup and diagnosis](ONBOARDING.md) and is
-available from source or a reviewed candidate tarball until published.
+Use the exact version below. `next` points to alpha.2; `latest` still points to
+alpha.1 because npm rejected its removal. Neither tag implies a stable release.
+Alpha.2 includes [project setup and diagnosis](ONBOARDING.md).
 
 Use Node.js 22 or newer on macOS or Linux. Windows execution is not supported.
 Install each project's compilers, linters and test runners separately; Checktrail
@@ -19,7 +18,7 @@ Skills install separately from the engine and MCP configuration.
 Install the exact version once:
 
 ```sh
-npm install --global --ignore-scripts @stsepelin/checktrail@0.1.0-alpha.1
+npm install --global --ignore-scripts @stsepelin/checktrail@0.1.0-alpha.2
 checktrail --version
 ```
 

package/docs/LANGUAGES.md

@@ -1,6 +1,6 @@
 # Language and ecosystem roadmap
 
-The alpha.2 candidate's [setup guide](ONBOARDING.md) describes conservative
+The [setup guide](ONBOARDING.md) describes conservative
 per-language configuration proposals and static tool diagnosis. Setup does not
 extend the execution capabilities or native evidence listed below.
 
@@ -115,3 +115,13 @@ skip, so its aggregate pass count is not evidence for every native profile.
 The prepared CI language profiles and native container helpers require exact
 regression names through `NATIVE-CI.md`. Their required results are separate from
 the optional skips allowed by a developer's general test suite.
+
+[Public adoption measurements](PUBLIC-ADOPTION.md) record alpha.2 on pinned
+JavaScript, TypeScript, Python, Go and PHP libraries. TypeScript 4.9.5 rejects
+the adapter's `--noCheck` option; this older version is not verified support.
+Go platform exclusions remain inconclusive even when native tests exit zero.
+
+The unreleased [TypeScript compatibility fix](TYPESCRIPT.md) exercises plain
+TypeScript 4.9.5 and 6.0.3 using native capability-aware arguments. Published
+alpha.2 retains the recorded older-compiler limitation; Vue and solution-build
+profiles retain their separately verified versions.

package/docs/NATIVE-CI.md

@@ -22,6 +22,10 @@ checks. The separate PHP syntax helper checks its exact successful TAP test name
 the external-adapter helper already checks exact required native names for each
 of its different runtime containers.
 
+The main matrix also prepares the separately locked TypeScript 4.9.5 compiler
+from `scripts/typescript-legacy-tools/`. Its named native regression is mandatory
+in the `javascript` profile; root build tooling stays on its existing compiler.
+
 A tool version preflight remains useful but is not the acceptance condition.
 Installing the expected binary cannot compensate for a skipped, renamed, removed
 or failing required test. When intentionally renaming or replacing a regression,

package/docs/ONBOARDING.md

@@ -1,7 +1,12 @@
 # Project setup
 
-These commands are new in the unpublished `0.1.0-alpha.2` candidate. Use the
-source checkout or a reviewed candidate tarball, with Node.js 22+ on macOS/Linux.
+These commands are available in `0.1.0-alpha.2`. Follow the
+[installation guide](INSTALLATION.md), with Node.js 22+ on macOS/Linux.
+
+[Public adoption observations](PUBLIC-ADOPTION.md) show setup on real libraries,
+including nested documentation projects, workflow prerequisites and older compiler
+limitations. A narrowed policy can pass its selected checks while leaving other
+repository checks unverified.
 
 ## Preview and create a policy
 

package/docs/PUBLIC-ADOPTION.md

@@ -0,0 +1,116 @@
+# Public repository adoption: alpha.2
+
+This exercise measures installation, policy setup and selected native checks on
+public libraries. It uses the published alpha.2 artifact, not an edited engine.
+The [selection plan](../scripts/public-adoption-plan.json) pins every upstream
+commit. Upstream sources and their licenses remain in ignored local checkouts;
+no upstream source is included in Checktrail's package or this report.
+
+The projects were chosen for a small initial-language adoption sample, before
+validation results were known. They were not replaced after failures. This is
+not a randomized sample, an independent rule-effectiveness holdout, a replacement
+for upstream CI, or a measurement of general false-positive rates.
+
+## Observations
+
+The [measurement record](measurements/public-adoption-alpha2.json) separates the
+policy created by `init` from an explicitly narrowed, root-language-only policy.
+`doctor` continues to identify omitted ecosystems in the narrower policy.
+A passing selected check does not mean the entire repository was validated.
+
+| Public project                                                                                                   | Selected language checks        | Native baseline and alpha.2 observation                                                                                                                                                                                                                     |
+| ---------------------------------------------------------------------------------------------------------------- | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [Nano ID](https://github.com/ai/nanoid/tree/57009b5eb8d757ae39bf5f4361dd30c9f23391b7)                            | Node tests                      | Both ran 79 tests successfully. The full policy remains incomplete without workflow configuration/tooling. Benchmark, browser tooling, size, prebuild, lint and declaration validation were not included.                                                   |
+| [mitt](https://github.com/developit/mitt/tree/6b41670516ed8e8b738612f60491995470aa63b3)                          | TypeScript 4.9.5                | Initial native checking needs the generated root declaration. After generating it, native typechecking passes; alpha.2 still fails with TS5023 because this compiler does not support `--noCheck`. Mocha and other package scripts were not run.            |
+| [more-itertools](https://github.com/more-itertools/more-itertools/tree/1da45ae4b61a832ed080f08a8833784aad0a9534) | unittest, Python 3.12           | Both ran 928 tests successfully. Full setup also discovers workflows and a separate documentation project; its selected unittest check has no candidate tests. Documentation builds, type stubs and workflow validation remain outside the narrowed result. |
+| [google/uuid](https://github.com/google/uuid/tree/2d3c2a9cc518326daf99a383f07c4d3c44317e4d)                      | gofmt, vet and tests, Go 1.27.1 | Native test events report 212 passes and one skip. Both formatting checks report the same seven files. Checktrail marks vet/tests inconclusive because the native platform selection omits `node_js.go`; the formatting failure makes the aggregate failed. |
+| [PSR Log](https://github.com/php-fig/log/tree/f16e1d5863e37f8d8c2a01719f5b34baa2b714d3)                          | PHP 8.4 syntax                  | All eight files pass native and Checktrail syntax checks. Host diagnosis reports PHP missing; prepared Linux execution succeeds. This provides no type, behavior or test evidence.                                                                          |
+
+Counts above describe this pinned snapshot and are reconciled with the linked
+record. Go's zero exit status from `gofmt -l` does not mean formatted source;
+its listed paths are findings. Its skipped test and platform-excluded file are
+retained instead of turning native exit zero into complete validation.
+
+Each checkout received an original, temporary failing control. Node, Python, Go
+and PHP detected the intended failure. Go retained its existing skip and formatting
+findings. TypeScript's native run diagnosed the inserted TS2322 error, but alpha.2
+stopped at the unsupported compiler option; that is not credited as detection.
+Controls were removed in `finally`, and tracked upstream file hashes remained
+unchanged. `init --write` preservation was checked byte for byte, and read-only
+operations were checked against the project tree.
+
+## What this changes in the roadmap
+
+- TypeScript needs a capability/version preflight for older compilers, with a
+  clear unavailable-tool explanation, or an explicitly tested compatible invocation.
+  Alpha.2's existing native verification covers TypeScript 6.0.3; this exercise
+  does not extend that support to 4.9.5.
+- Setup guidance should distinguish an executable language profile from workflow
+  tooling and documentation projects. Explicit narrowing must keep the omitted
+  coverage visible.
+- Go needs an explicit policy for platform/build-tag coverage before a developer
+  can distinguish intentional target exclusions from accidentally missed source.
+  This observation does not justify silently ignoring excluded files.
+
+These are recorded adoption gaps, not fixes applied to the immutable alpha.2
+package. No new engine version is published by this exercise.
+
+## Unreleased follow-up
+
+The [compiler compatibility fix](TYPESCRIPT.md) now passes a known-case mitt replay
+with TypeScript 4.9.5 through a locally packed CLI, library and MCP. The observations
+above still describe published alpha.2; they are not replaced by the fixed source
+checkout's results. Workflow/documentation setup and Go platform coverage remain
+separate work.
+
+## Reproduce
+
+Use macOS arm64 with Node 26.8.1 and Go 1.27.1 to reproduce the recorded host
+profile. PHP and Python use the image identities in the measurement record;
+Docker execution disables networking and mounts project inputs read-only.
+The host does not impose an OS network sandbox. No Sail is used.
+
+Download the tarball and `SHA256SUMS` from the
+[alpha.2 GitHub release](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.2),
+then verify SHA-256
+`ffd0564f40a12a238a52fe25fe8c34fb36cf6f6480be7b6994bab82a3bd657fb`.
+The original measurement installed the exact version from npm; reproduction
+installs that same verified tarball with lifecycle scripts disabled.
+
+```sh
+node scripts/prepare-public-adoption.mjs /new/adoption-directory /absolute/release.tgz
+```
+
+Preparation downloads pinned public Git revisions and installs the engine and
+explicit TypeScript tools. It does not run upstream package scripts. The TypeScript
+tool profile is compiler 4.9.5 plus `@types/chai` 4.3.20, `@types/mocha` 7.0.2,
+`@types/sinon` 9.0.11 and `@types/sinon-chai` 3.2.12. The preparation lockfile records
+transitive dependency resolutions; it is not an upstream lockfile or a claim that
+all upstream build/test dependencies were installed.
+
+Prepare the Python/Node image using `scripts/external-tools.Dockerfile`, and the
+PHP/Node image using `scripts/adoption-php.Dockerfile`. Compare local image IDs
+with the record. A rebuilt image may have a different ID: a run with different
+image bytes is a new environment observation, not a reproduction of that exact
+runtime. The recorded Python image must already be present for this harness.
+
+```sh
+docker build --network=none --pull=false -f scripts/adoption-php.Dockerfile -t checktrail-adoption-php:alpha2 scripts
+CHECKTRAIL_ADOPTION_PHP_IMAGE="$(docker image inspect checktrail-adoption-php:alpha2 --format '{{.Id}}')" \
+  node scripts/measure-public-adoption.mjs /new/adoption-directory /absolute/release.tgz
+```
+
+Measurement downloads nothing. It verifies installed engine files against the
+reviewed artifact, checks upstream revisions and tracked hashes, measures both
+policy scopes, compares native accounting, and applies/removes the original
+controls. mitt's generated declaration is prepared separately with the installed
+compiler and removed afterwards. Fresh checkouts are required for another run;
+the harness preserves detailed local evidence and created policies for inspection.
+
+Raw process outputs stay under the prepared directory's `observations/` folder.
+The committed record contains relative file names, counts, diagnostic codes,
+versions, hashes, outcomes and timing observations, not source or raw tool prose.
+Timings include CLI/process startup and, for containers, Docker invocation; cache
+state, native/wrapper order and scheduling are uncontrolled. They do not support
+a representative speed comparison. No model is invoked and no prior human/model
+review workflow is compared.

package/docs/RELEASE.md

@@ -1,20 +1,42 @@
 # Release preparation
 
 The source is public at [stsepelin/checktrail](https://github.com/stsepelin/checktrail);
-`@stsepelin/checktrail@0.1.0-alpha.1` is published on npm. Its downloaded artifact
+`@stsepelin/checktrail@0.1.0-alpha.2` is published on npm. Its downloaded artifact
 matched the reviewed tarball with SHA-256
-`84003e184805b6c5362c0801c702a72e415040ae5142fcd70f01eb9758637d04`.
-Fresh registry installation, CLI and MCP startup were verified. The alpha.2
-candidate adds [setup and diagnosis](ONBOARDING.md); it is not yet published.
-`server.json` describes the intended `io.github.stsepelin/checktrail` MCP Registry
-identity with the candidate's matching npm version. Registry registration remains
-pending. No credentials or automatic publishing workflow are stored here.
+`ffd0564f40a12a238a52fe25fe8c34fb36cf6f6480be7b6994bab82a3bd657fb`.
+Fresh registry installation, CLI/library validation, generated npx startup with
+fresh/warm caches and MCP pass/fail/incomplete results were verified. Alpha.2 adds
+[setup and diagnosis](ONBOARDING.md). The
+[MCP Registry entry](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.stsepelin%2Fchecktrail/versions/0.1.0-alpha.2)
+is active and matches the alpha.2 release metadata, with execution disabled. The Registry omits
+`isSecret: false`, whose schema default is false. No credentials or automatic
+publishing workflow are stored here.
+The [GitHub prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.2)
+points to source commit `4ce8398` and includes the same tarball plus `SHA256SUMS`.
+The downloaded release asset was verified against the digest above.
 
 Publication is configured for npm's `next` tag. After alpha.1 publication, the
 registry assigned both `next` and `latest` to that preview; attempts to remove
-`latest` returned HTTP 400. The cause is unresolved. Use exact versions and
-resolve the tag policy before publishing another candidate; do not treat `latest`
-as evidence of a stable release or republish an existing version.
+`latest` returned HTTP 400. Alpha.2 publication updated `next` while leaving
+`latest` on alpha.1. Cleanup remains unresolved; use exact versions, do not treat
+`latest` as evidence of a stable release, and never republish an existing version.
+
+## Alpha.3 candidate (unpublished)
+
+The source candidate is `0.1.0-alpha.3`. It fixes the plain TypeScript adapter's
+unsupported `--noCheck` argument on the exercised TypeScript 4.9.5 profile, while
+retaining the TypeScript 6.0.3 override and native file accounting. Vue uses the
+same capability helper with its existing verified modern toolchain; the separate
+solution-build profile remains gated to TypeScript 6.0.3. See [TYPESCRIPT.md](TYPESCRIPT.md).
+No dependencies or report/policy schemas change in this release preparation.
+The alpha.2 adoption record remains historical evidence.
+
+The candidate still targets Node.js 22 or newer on macOS and Linux. It does not
+add standard MCP Tasks or legacy Vue support. Registry metadata keeps execution
+disabled by default. Publication will use npm's `next` tag after release checks
+and hosted CI succeed; the alpha.2 publication evidence above does not verify
+this candidate. Exact artifact, client and upgrade/rollback evidence is retained
+outside the package allowlist until publication is verified.
 
 ## Prepared artifacts
 
@@ -32,8 +54,8 @@ as evidence of a stable release or republish an existing version.
   loads the installed metadata and verifies its actual startup command.
 - CI definitions cover the host suite and prepared native profiles. Local
   containers and package checks are evidence only for the environments actually
-  exercised. The [hosted run at bfc8cc4](https://github.com/stsepelin/checktrail/actions/runs/35585998184)
-  passed all jobs; the alpha.2 release commit requires its own run. The local Claude Code health/discovery and
+  exercised. The [hosted run at 4ce8398](https://github.com/stsepelin/checktrail/actions/runs/35590670960)
+  passed all jobs for the alpha.2 release commit. The local Claude Code health/discovery and
   Codex direct app-server profiles have fresh-install evidence in `CLIENTS.md`.
 
 The metadata follows the official registry
@@ -69,7 +91,7 @@ After explicit approval and npm authentication for the `@stsepelin` scope, publi
 the approved file, not a newly packed working tree:
 
 ```sh
-npm publish /absolute/path/stsepelin-checktrail-0.1.0-alpha.2.tgz \
+npm publish /absolute/path/stsepelin-checktrail-0.1.0-alpha.3.tgz \
   --tag next --access public --ignore-scripts --registry=https://registry.npmjs.org
 ```
 

package/docs/STATUS.md

@@ -3,15 +3,26 @@
 This is an experimental foundation with public source at
 [stsepelin/checktrail](https://github.com/stsepelin/checktrail).
 Check the [installation guide](INSTALLATION.md) for package availability and setup.
-The `0.1.0-alpha.1` preview is published on npm. The newer
-[hosted run at bfc8cc4](https://github.com/stsepelin/checktrail/actions/runs/35585998184)
-passed all jobs; earlier toolchain evidence remains in `NATIVE-CI.md`.
-The alpha.2 candidate adds setup commands and requires its own release CI and
-publication. MCP Registry registration remains pending.
+The `0.1.0-alpha.2` preview is published on npm and active in the MCP Registry.
+The [hosted run at 4ce8398](https://github.com/stsepelin/checktrail/actions/runs/35590670960)
+passed all jobs. The published tarball matched the reviewed artifact; fresh
+registry installation, CLI/library validation, generated npx startup and MCP
+execution/trust behavior were verified. Earlier toolchain evidence remains in
+`NATIVE-CI.md`; release details and tag limitations are in `RELEASE.md`.
+The GitHub alpha.2 prerelease includes the verified artifact and checksum.
+[Public adoption](PUBLIC-ADOPTION.md) records the published package on five pinned
+libraries, including incomplete coverage and a TypeScript 4.9.5 incompatibility.
+
+## Alpha.3 candidate (unpublished)
+
+- [TypeScript compatibility](TYPESCRIPT.md): plain typechecking now passes the
+  native 4.9.5 regression while retaining the 6.0.3 `noCheck` override and native
+  file accounting. A packed CLI/library/MCP replay fixes the recorded mitt case.
+  Published alpha.2 and its immutable adoption record retain the original failure.
 
 ## Implemented
 
-- Alpha.2 candidate: conservative multi-language `init`, execution-free `doctor`,
+- Alpha.2: conservative multi-language `init`, execution-free `doctor`,
   and version-pinned MCP configuration output for Codex, Claude Code/Desktop,
   Cursor and VS Code. Existing files are preserved. See [ONBOARDING.md](ONBOARDING.md)
   for scope, ambiguity handling and package upgrade/rollback verification.
@@ -153,11 +164,11 @@ a general speedup/graph-completeness claim.
 
 ## Release preparation
 
-`server.json` and npm `mcpName` describe the `0.1.0-alpha.1` preview.
-The metadata passed the pinned official registry schema; a native SDK-client test
-starts its command and verifies execution remains disabled. This does not establish
-registry acceptance or npm publication. Hosted source evidence is recorded
-separately in `NATIVE-CI.md`. See `RELEASE.md`.
+`server.json`, the npm package and the engine identify the unpublished
+`0.1.0-alpha.3` candidate. The currently published npm and Registry release is
+alpha.2. The candidate adds legacy TypeScript compatibility; publication requires
+its source commit to pass hosted CI and its exact tarball to pass release checks.
+Historical publication evidence and the candidate sequence are in `RELEASE.md`.
 
 ## Pinned pack distribution
 

package/docs/TYPESCRIPT.md

@@ -0,0 +1,78 @@
+# TypeScript compiler compatibility
+
+The source checkout's `javascript.typescript` profile now supports the exercised
+TypeScript 4.9.5 and 6.0.3 configurations. This fix is included in the
+**unpublished alpha.3 candidate**. Published alpha.2 still passes an option that
+TypeScript 4.9.5 rejects. The original
+[public adoption record](PUBLIC-ADOPTION.md) remains unchanged as release evidence.
+Other compiler versions require their own native verification.
+
+## Invocation and boundaries
+
+Planning locates the project-local or root-hoisted compiler without importing it.
+During explicitly trusted execution, a runner loads the selected compiler API
+and uses its public command-line parser to check support for `--noCheck false`.
+Supported compilers receive that override, so `noCheck: true` cannot disable the
+selected type check. Older compilers that reject this option receive the remaining
+arguments; an unexpected capability response stops before the compiler CLI starts.
+The probe parses fixed arguments and does not parse project configuration.
+
+The compiler entry and API must resolve inside the configured root. They are
+trusted executable dependencies; this check is not a sandbox. No compiler is
+installed or downloaded during planning or execution. `doctor` remains static
+and does not perform this runtime capability probe.
+
+Checks still disable emitted output and incremental state and require every
+inventoried TypeScript source in the native file list. A successful compiler exit
+with omitted source is incomplete. A legacy compiler's unsupported project options
+remain compiler errors; the runner does not rewrite `tsconfig.json`.
+
+The Vue runner uses the same capability helper. Its separately tested Vue 3.5.43,
+vue-tsc 3.3.11 and TypeScript 6.0.3 profile retains type-error detection and the
+`skipTemplateCodegen` rejection. This does not establish legacy Vue compatibility.
+The solution-build adapter remains gated to TypeScript 6.0.3; see
+[TYPESCRIPT-BUILD.md](TYPESCRIPT-BUILD.md).
+
+## Verification
+
+The new 4.9.5 regression failed on the previous adapter's TS5023 error. With this
+change it accepts valid code, rejects a real TS2322 error, accounts for excluded
+source, identifies the actual tool version, supports a root-hoisted compiler and
+paths with spaces, and leaves emitted/incremental files absent. Existing native
+6.0.3 and Vue regressions still reject type errors even with `noCheck: true`.
+Separate regressions reject an escaping compiler API and an ambiguous capability
+response before the compiler CLI executes. Planning is checked against executable
+traps in both the CLI and API files.
+
+The [known-case replay](measurements/typescript-legacy-replay.json) uses mitt at
+the same pinned revision and the same TypeScript 4.9.5 tool profile as the alpha.2
+adoption exercise. After generating its required root declaration, native checking
+and the packed fix pass; an original injected TS2322 error fails through the CLI,
+library and MCP. The policy and tracked upstream files stay unchanged, and the
+injected source and generated declaration are removed afterwards. This is a
+regression replay after observing the failure, not a new independent holdout.
+The record identifies the tested local tarball and adapter source hashes; it is
+not the published alpha.2 artifact.
+
+## Prepare the legacy regression
+
+The old compiler has a separate locked installation so its `tsc` binary cannot
+replace the compiler used to build Checktrail:
+
+```sh
+mkdir -p .checktrail/typescript-legacy-tools
+cp scripts/typescript-legacy-tools/package.json scripts/typescript-legacy-tools/package-lock.json .checktrail/typescript-legacy-tools/
+npm ci --prefix .checktrail/typescript-legacy-tools --ignore-scripts --no-audit --no-fund
+npm run build
+node --test dist/test/typescript.test.js dist/test/vue-tsc.test.js dist/test/typescript-build.test.js
+```
+
+The general suite explicitly skips the legacy native case when this installation
+is absent. The hosted main matrix prepares it and the `javascript` required-native
+profile rejects a skipped or missing legacy regression. A local pass does not
+establish hosted CI results.
+
+TypeScript introduced the public `noCheck` option in
+[TypeScript 5.6](https://www.typescriptlang.org/docs/handbook/release-notes/typescript-5-6.html#the--nocheck-option).
+The runner checks actual parser behavior instead of assuming capabilities from a
+package version string.