@stsepelin/checktrail 0.1.0-alpha.2 → 0.1.0-alpha.4

package/docs/ACCEPTANCE.md

@@ -5,17 +5,27 @@ verification. It does not replace the plan or promote an unverified capability.
 Local implementation, local native evidence, hosted CI and publication are
 separate states. Follow the linked evidence for tested versions and limits.
 
-| Milestone                         | Implemented scope and evidence                                                                                                                                                                                                                                                                                                                                                                                                          | Open acceptance work                                                                                                                                                                                                                                                   |
-| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| M0: public contracts              | Original public fixtures, MIT license, security/contribution guidance, schemas, explicit package allowlist, dependency notices and CI definitions. `STATUS.md`, `SECURITY.md`, `RELEASE.md`.                                                                                                                                                                                                                                            | Public source and npm alpha.1 are published. Hosted CI passed at `bfc8cc4`; alpha.2 requires its own release commit, CI and publication verification.                                                                                                                  |
-| M1: executable foundation         | Shared CLI/library/MCP engine, bounded inventory/runner, startup trust, native Node/Python/Go/PHP profiles, protocol and lifecycle regressions. `ARCHITECTURE.md`, `STATUS.md`, `MCP-COMPATIBILITY.md`. Fresh installed application-client profiles now have evidence in `CLIENTS.md`.                                                                                                                                                  | Application-client coverage beyond the named profiles. PHP remains unavailable when the consumer has no prepared runtime.                                                                                                                                              |
-| M2: practical language validation | Explicit JS/TS, Python, Go and PHP native tool profiles, structured diagnostics/test evidence, versions, environments, workspace selection, scope accounting, SARIF/JUnit and finding ratchets. `LANGUAGES.md`, adapter documents, `WORKSPACES.md`, `FINDING-POLICY.md`, `NATIVE-CI.md`.                                                                                                                                                | Hosted toolchain profiles passed at `52ba415`. Wider tool versions/framework configurations must be promoted separately; detection is not execution support.                                                                                                           |
-| M3: framework/contracts           | Native Laravel, Vue Router/Nuxt, Django/FastAPI assembly projections; imported runtime comparison, explicit architecture boundaries, producer/consumer schemas and a built package consumer. `RUNTIME-INVENTORY.md`, framework documents, `CONTRACTS.md`, `ARCHITECTURE-POLICY.md`, `examples/package-contract/README.md`.                                                                                                              | Broader native semantics/import collection and live service integration are not implemented. Synthetic evidence does not establish equivalent results in a private application; private integration feedback must remain private.                                      |
-| M4: ecosystem/distribution        | Bounded Rust, Java, C#, Ruby, Swift, Clang and actionlint profiles; trusted external adapters, pinned data-only pack distribution, fresh offline package checks, production notice audit, measured performance and unpublished registry metadata. `LANGUAGES.md`, `EXTERNAL-ADAPTERS.md`, `PACK-DISTRIBUTION.md`, `PERFORMANCE.md`, `RELEASE.md`.                                                                                       | Alpha.2 release verification and MCP Registry registration. Windows execution and the unimplemented subsequent integrations in `LANGUAGES.md` remain unsupported. Runtime/container/development dependency provenance is broader than the production npm notice audit. |
-| M5: measured assistance           | Advisory guidance, bounded Node mutation experiments, explicit-graph impact measurements, optional local/model review exchange, durable library task storage/worker, development evaluation and externally authored ESLint and Ruff integration cohorts. `GUIDANCE.md`, `MUTATIONS.md`, `IMPACT-MEASUREMENT.md`, `REVIEW-EXCHANGE.md`, `VALIDATION-TASKS.md`, `EVALUATION.md`, `EXTERNAL-EVALUATION.md`, `EXTERNAL-RUFF-EVALUATION.md`. | Standard MCP Tasks wire integration; wider held-out rule-family/review evidence, prior-workflow comparison and representative cost/latency measurement. No general equal-or-better review-quality claim is supported.                                                  |
+| Milestone                         | Implemented scope and evidence                                                                                                                                                                                                                                                                                                                                                                                                          | Open acceptance work                                                                                                                                                                                                                           |
+| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| M0: public contracts              | Original public fixtures, MIT license, security/contribution guidance, schemas, explicit package allowlist, dependency notices and CI definitions. `STATUS.md`, `SECURITY.md`, `RELEASE.md`.                                                                                                                                                                                                                                            | Public source, npm alpha.3 and its MCP Registry entry are published. Hosted CI passed at `b0b447d`; fresh registry installation was verified.                                                                                                  |
+| M1: executable foundation         | Shared CLI/library/MCP engine, bounded inventory/runner, startup trust, native Node/Python/Go/PHP profiles, protocol and lifecycle regressions. `ARCHITECTURE.md`, `STATUS.md`, `MCP-COMPATIBILITY.md`. Fresh installed application-client profiles now have evidence in `CLIENTS.md`.                                                                                                                                                  | Application-client coverage beyond the named profiles. PHP remains unavailable when the consumer has no prepared runtime.                                                                                                                      |
+| M2: practical language validation | Explicit JS/TS, Python, Go and PHP native tool profiles, structured diagnostics/test evidence, versions, environments, workspace selection, scope accounting, SARIF/JUnit and finding ratchets. `LANGUAGES.md`, adapter documents, `WORKSPACES.md`, `FINDING-POLICY.md`, `NATIVE-CI.md`.                                                                                                                                                | Hosted toolchain profiles passed at `52ba415`. Wider tool versions/framework configurations must be promoted separately; detection is not execution support.                                                                                   |
+| M3: framework/contracts           | Native Laravel, Vue Router/Nuxt, Django/FastAPI assembly projections; imported runtime comparison, explicit architecture boundaries, producer/consumer schemas and a built package consumer. `RUNTIME-INVENTORY.md`, framework documents, `CONTRACTS.md`, `ARCHITECTURE-POLICY.md`, `examples/package-contract/README.md`.                                                                                                              | Broader native semantics/import collection and live service integration are not implemented. Synthetic evidence does not establish equivalent results in a private application; private integration feedback must remain private.              |
+| M4: ecosystem/distribution        | Bounded Rust, Java, C#, Ruby, Swift, Clang and actionlint profiles; trusted external adapters, pinned data-only pack distribution, fresh offline package checks, production notice audit, measured performance and published MCP Registry metadata. `LANGUAGES.md`, `EXTERNAL-ADAPTERS.md`, `PACK-DISTRIBUTION.md`, `PERFORMANCE.md`, `RELEASE.md`.                                                                                     | npm tag cleanup remains unresolved. Windows execution and the unimplemented subsequent integrations in `LANGUAGES.md` remain unsupported. Runtime/container/development dependency provenance is broader than the production npm notice audit. |
+| M5: measured assistance           | Advisory guidance, bounded Node mutation experiments, explicit-graph impact measurements, optional local/model review exchange, durable library task storage/worker, development evaluation and externally authored ESLint and Ruff integration cohorts. `GUIDANCE.md`, `MUTATIONS.md`, `IMPACT-MEASUREMENT.md`, `REVIEW-EXCHANGE.md`, `VALIDATION-TASKS.md`, `EVALUATION.md`, `EXTERNAL-EVALUATION.md`, `EXTERNAL-RUFF-EVALUATION.md`. | Standard MCP Tasks wire integration; wider held-out rule-family/review evidence, prior-workflow comparison and representative cost/latency measurement. No general equal-or-better review-quality claim is supported.                          |
 
 ## Remaining work that can proceed locally
 
+[Public adoption measurements](PUBLIC-ADOPTION.md) now cover five pinned
+JavaScript, TypeScript, Python, Go and PHP libraries. They expose an older
+TypeScript compiler-option incompatibility and workflow/documentation/platform
+coverage friction. The [alpha.3 compiler fix](TYPESCRIPT.md) now passes the
+known TypeScript 4.9.5 case. [Setup guidance](SETUP-SCOPES.md) distinguishes
+workflow/documentation coverage; an unreleased [Go scope policy](GO-SCOPE.md)
+accounts for explicitly acknowledged native exclusions. Broader target coverage
+remains follow-up work. The observations do not establish full upstream CI coverage or
+general review effectiveness.
+
 1. Extend independently authored evaluation cohorts to additional implemented
    language/rule families, preserving the verifier freeze and recording exact
    selection, exclusions, native baselines and interpretation limits. New fixtures
@@ -43,11 +53,12 @@ run. The local worker/store are available independently; standard Tasks must sta
 unadvertised until routing and the integrated wire/lifecycle suite pass. See
 `MCP-COMPATIBILITY.md` for the reproduction and upstream issue.
 
-The public repository and npm preview `0.1.0-alpha.1` are published. The
-[hosted run at bfc8cc4](https://github.com/stsepelin/checktrail/actions/runs/35585998184)
-passed all jobs. Alpha.2 adds [setup commands](ONBOARDING.md); it requires its own
-release CI and publication. GitHub releases and MCP Registry registration remain
-pending. The repository's explicit-action requirements still apply.
+The public repository, npm preview `0.1.0-alpha.3` and its MCP Registry entry are
+published. The [hosted run at b0b447d](https://github.com/stsepelin/checktrail/actions/runs/35597877167)
+passed all jobs, and fresh public installation was verified. Alpha.3 adds
+[legacy compiler compatibility](TYPESCRIPT.md) to the existing [setup commands](ONBOARDING.md). The [GitHub prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.3)
+is also published with the verified tarball and checksum. npm tag cleanup remains
+unresolved. The repository's explicit-action requirements still apply.
 `RELEASE.md` defines the concrete
 candidate checks and the authorization sequence; a local green run does not
 replace external acceptance.

package/docs/CLIENTS.md

@@ -1,8 +1,9 @@
 # Application client compatibility
 
-The recorded snapshots below predate the Checktrail rename and retain their
-original package identities. A release candidate needs its own client checks;
-see [RENAMING.md](RENAMING.md).
+The [alpha.3 release record](measurements/release-alpha3.json) repeats the named
+profiles below against the exact published artifact. The original standalone
+snapshots predate the Checktrail rename and retain their original identities.
+A future release needs its own checks; see [RENAMING.md](RENAMING.md).
 
 The local package was installed offline into a fresh temporary consumer and tested
 with Claude Code 2.1.263 and Codex CLI 0.154.0 on macOS arm64, Node 26.8.1. These
@@ -106,4 +107,5 @@ The runtime digest identifies the installed `dist/src` tree independently.
 
 These local checks satisfy only the named client profiles. Claude Desktop,
 Cursor, VS Code integrations, other client versions and target operating systems
-remain unverified. No public package installation or hosted CI run is implied.
+remain unverified. These original snapshots do not establish public installation or hosted CI;
+alpha.3 publication and hosted evidence are recorded separately in [RELEASE.md](RELEASE.md).

package/docs/GO-RACE.md

@@ -10,8 +10,10 @@ cost and requires the operator to select this check.
 The native fixture runs two workers repeatedly updating one shared counter. The
 unprotected version must fail with an actual `DATA RACE` diagnostic; atomic
 updates must pass and yield the exact combined count. A passing run cannot
-establish freedom from races on paths it did not execute. Native package/file evidence now makes excluded source and untested packages
-incomplete; see [Go scope](GO-SCOPE.md). A build/OS matrix is not implemented.
+establish freedom from races on paths it did not execute. Native package/file evidence makes undeclared excluded source and untested packages
+incomplete; see [Go scope](GO-SCOPE.md) for the unreleased explicit exclusion policy.
+The source checkout also passes `-race` to package listing so it uses the same build
+constraints as the tests. A build/OS matrix is not implemented.
 
 A supported Go race platform and C compiler are required. Compilation and runtime
 errors are retained in detailed output; no compiler, library or toolchain is

package/docs/GO-SCOPE.md

@@ -1,15 +1,16 @@
 # Go scope and Staticcheck
 
-`go.vet`, `go.test`, `go.test-race` and `go.staticcheck` first run native
-`go list -json ./...`. A passing result requires the union of native Go, cgo and
-internal/external test source files to exactly match the inventoried Go files.
+`go.vet`, `go.test`, `go.test-race`, `go.staticcheck` and `go.golangci-lint` first run
+native `go list -json ./...`. The race profile includes `-race` in both listing and
+test execution, so their build constraints agree. By default, a passing result
+requires the union of native Go, cgo and internal/external test source files to
+exactly match the inventoried Go files.
 Malformed package output, missing packages, duplicate/unexpected files and load
 errors prevent completeness. Real diagnostic/test failures retain their failure
 status even when scope is incomplete.
 
 Files excluded by build tags, OS/architecture suffixes or Go directory conventions
-remain unverified. The current policy has no build-matrix or per-file exception
-contract, so such projects are conservatively incomplete. This includes intentional
+remain unverified. Without an explicit scope policy, such projects are conservatively incomplete. This includes intentional
 `testdata` Go files if they are inventoried but not compiled. Do not treat that as
 a source defect or remove valid platform-specific code to obtain a passing run.
 
@@ -26,6 +27,70 @@ programs. Cross-module workspace builds need a separate explicit profile. Native
 compiler/analyzer caches may be used; test result caching remains disabled.
 Dependencies and toolchains must be prepared separately.
 
+## Explicit exclusions in the source checkout (unreleased)
+
+The source checkout adds `checktrail.go-scope.json` at each Go module root.
+Published alpha.3 does not support this policy yet. Opt in only after reviewing
+which files the intended native run leaves unverified:
+
+```json
+{
+  "schemaVersion": 1,
+  "excludedFiles": [
+    {
+      "path": "platform_windows.go",
+      "reason": "Windows implementation; validated separately on its target"
+    }
+  ]
+}
+```
+
+Paths are exact, case-sensitive, module-relative inventoried `.go` files. Globs,
+parent traversal, absolute paths, duplicate entries, blank reasons, unknown fields,
+missing files and symlink/directory policy files are rejected. An empty list keeps
+strict coverage. Planning only reads this file; native commands still require
+operator trust. A reason records the operator's statement, not proof of another run.
+The schema is [go-scope-policy.schema.json](../schemas/go-scope-policy.schema.json).
+
+For each selected native check, every declared file must appear in Go's
+`IgnoredGoFiles`, and every other inventoried Go file must appear exactly once in
+its selected source lists. An exemption becomes stale if its file disappears or
+becomes selected. New omissions, duplicate/contradictory native entries, malformed
+or interrupted output remain incomplete. A whole package excluded from `./...`,
+`testdata`, dot/underscore files and arbitrary unlisted files cannot be excused by
+this policy unless native package evidence accounts for them as ignored Go files.
+
+The same policy applies to vet, tests, race tests, Staticcheck and golangci-lint.
+A file ignored by ordinary tests may be selected under `-race`; one shared
+exemption then cannot pass both profiles. Do not exempt active code to suppress a
+diagnostic. Real diagnostics/test failures still fail. Every tested package still
+needs a passing test; exempted source supplies no test evidence. Formatting ignores
+the scope policy and checks every inventoried Go file.
+
+Detailed plans and reports retain the declarations as `goScope`; the original
+`scope` remains the complete inventory. A passing native check covers that scope
+minus its reconciled exemptions. Summary plans and reports expose
+`goExcludedFileCount` without paths or reasons. This is the number declared, even
+on an incomplete or unexecuted plan; it does not independently establish that the
+exemptions reconciled. Other-platform and excluded build-tag behavior is unverified.
+
+This policy does not introduce build-tag flags, cross-compilation, cross-target
+test execution or a build matrix. Use separately prepared native target runs for
+coverage outside the selected profile. Existing protected Go settings stay intact.
+
+## Known-case replay
+
+The [pinned public UUID replay](measurements/go-scope-policy-replay.json) uses the
+same upstream revision as the alpha.2 adoption exercise, with an unreleased packed
+CLI/library/MCP. Default scope remains inconclusive for vet/tests. Explicitly
+acknowledging `node_js.go` makes those selected native checks pass while retaining
+the skipped test and the existing formatting failure. An injected failing test
+still fails through all three surfaces. The JavaScript-target file is unverified;
+this is a known-case regression replay, not independent effectiveness evidence.
+The upstream tracked files and original policy were preserved; temporary scope
+policy and failing control were removed. The record identifies the tested tarball
+and runtime source hashes; adding this record changes later package bytes.
+
 ## Staticcheck
 
 Select `go.staticcheck` explicitly. It requires the installed `staticcheck`

package/docs/INSTALLATION.md

@@ -1,11 +1,11 @@
 # Install the preview
 
-The published preview is `0.1.0-alpha.1` on
+The published preview is `0.1.0-alpha.3` on
 [npm](https://www.npmjs.com/package/@stsepelin/checktrail).
-Use the exact version below. The registry currently assigns both `next` and
-`latest` to that preview; `latest` is not a stable-release guarantee.
-The alpha.2 candidate adds [project setup and diagnosis](ONBOARDING.md) and is
-available from source or a reviewed candidate tarball until published.
+Use the exact version below. `next` points to alpha.3; `latest` still points to
+alpha.1 because npm rejected its removal. Neither tag implies a stable release.
+Alpha.3 includes [project setup and diagnosis](ONBOARDING.md) and the
+[TypeScript compatibility fix](TYPESCRIPT.md).
 
 Use Node.js 22 or newer on macOS or Linux. Windows execution is not supported.
 Install each project's compilers, linters and test runners separately; Checktrail
@@ -19,7 +19,7 @@ Skills install separately from the engine and MCP configuration.
 Install the exact version once:
 
 ```sh
-npm install --global --ignore-scripts @stsepelin/checktrail@0.1.0-alpha.1
+npm install --global --ignore-scripts @stsepelin/checktrail@0.1.0-alpha.3
 checktrail --version
 ```
 

package/docs/LANGUAGES.md

@@ -1,6 +1,6 @@
 # Language and ecosystem roadmap
 
-The alpha.2 candidate's [setup guide](ONBOARDING.md) describes conservative
+The [setup guide](ONBOARDING.md) describes conservative
 per-language configuration proposals and static tool diagnosis. Setup does not
 extend the execution capabilities or native evidence listed below.
 
@@ -115,3 +115,18 @@ skip, so its aggregate pass count is not evidence for every native profile.
 The prepared CI language profiles and native container helpers require exact
 regression names through `NATIVE-CI.md`. Their required results are separate from
 the optional skips allowed by a developer's general test suite.
+
+[Public adoption measurements](PUBLIC-ADOPTION.md) record alpha.2 on pinned
+JavaScript, TypeScript, Python, Go and PHP libraries. TypeScript 4.9.5 rejects
+alpha.2's `--noCheck` option; that published artifact does not support this profile.
+Go platform exclusions remain inconclusive even when native tests exit zero.
+
+The alpha.3 [TypeScript compatibility fix](TYPESCRIPT.md) exercises plain
+TypeScript 4.9.5 and 6.0.3 using native capability-aware arguments. Published
+alpha.2 retains the recorded older-compiler limitation; Vue and solution-build
+profiles retain their separately verified versions.
+
+The source checkout adds an unreleased [Go scope policy](GO-SCOPE.md) for exact,
+native-confirmed ignored files. It retains unverified exclusions in reports and
+does not claim a build matrix or add custom build-tag execution. Published alpha.3
+keeps the original strict exclusion behavior.

package/docs/MCP-COMPATIBILITY.md

@@ -46,6 +46,12 @@ extension handlers run. This was reproduced locally; `tasks/update` reaches its
 handler in the same probe. Upstream tracks the method-registry collision in
 [typescript-sdk#2598](https://github.com/modelcontextprotocol/typescript-sdk/issues/2598).
 
+Rechecked on 2026-09-21: npm's latest server/client SDK versions are still 2.0.0,
+the local probe still returns `-32601` for get/cancel and reaches update, and the
+[proposed upstream fix](https://github.com/modelcontextprotocol/typescript-sdk/pull/2599)
+remains open. The package retains its pinned SDK; no transport interception or
+protocol workaround is introduced.
+
 Run `npm run probe:mcp-tasks` from the source checkout to repeat the routing probe. Exit `2` means one or
 more handlers were unreachable; exit `0` means routing works. A routing success
 does not establish Tasks conformance. The probe is separate from the ordinary

package/docs/NATIVE-CI.md

@@ -22,6 +22,10 @@ checks. The separate PHP syntax helper checks its exact successful TAP test name
 the external-adapter helper already checks exact required native names for each
 of its different runtime containers.
 
+The main matrix also prepares the separately locked TypeScript 4.9.5 compiler
+from `scripts/typescript-legacy-tools/`. Its named native regression is mandatory
+in the `javascript` profile; root build tooling stays on its existing compiler.
+
 A tool version preflight remains useful but is not the acceptance condition.
 Installing the expected binary cannot compensate for a skipped, renamed, removed
 or failing required test. When intentionally renaming or replacing a regression,

package/docs/ONBOARDING.md

@@ -1,7 +1,13 @@
 # Project setup
 
-These commands are new in the unpublished `0.1.0-alpha.2` candidate. Use the
-source checkout or a reviewed candidate tarball, with Node.js 22+ on macOS/Linux.
+These commands are available since `0.1.0-alpha.2`. Follow the
+[installation guide](INSTALLATION.md), with Node.js 22+ on macOS/Linux.
+
+[Public adoption observations](PUBLIC-ADOPTION.md) show setup on real libraries,
+including nested documentation projects, workflow prerequisites and older compiler
+limitations. A narrowed policy can pass its selected checks while leaving other
+repository checks unverified. The [setup scope walkthrough](SETUP-SCOPES.md)
+shows how to inspect those boundaries and interpret an intentionally narrowed policy.
 
 ## Preview and create a policy
 

package/docs/PUBLIC-ADOPTION.md

@@ -0,0 +1,118 @@
+# Public repository adoption: alpha.2
+
+This exercise measures installation, policy setup and selected native checks on
+public libraries. It uses the published alpha.2 artifact, not an edited engine.
+The [selection plan](../scripts/public-adoption-plan.json) pins every upstream
+commit. Upstream sources and their licenses remain in ignored local checkouts;
+no upstream source is included in Checktrail's package or this report.
+
+The projects were chosen for a small initial-language adoption sample, before
+validation results were known. They were not replaced after failures. This is
+not a randomized sample, an independent rule-effectiveness holdout, a replacement
+for upstream CI, or a measurement of general false-positive rates.
+
+## Observations
+
+The [measurement record](measurements/public-adoption-alpha2.json) separates the
+policy created by `init` from an explicitly narrowed, root-language-only policy.
+`doctor` continues to identify omitted ecosystems in the narrower policy.
+A passing selected check does not mean the entire repository was validated.
+
+| Public project                                                                                                   | Selected language checks        | Native baseline and alpha.2 observation                                                                                                                                                                                                                     |
+| ---------------------------------------------------------------------------------------------------------------- | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [Nano ID](https://github.com/ai/nanoid/tree/57009b5eb8d757ae39bf5f4361dd30c9f23391b7)                            | Node tests                      | Both ran 79 tests successfully. The full policy remains incomplete without workflow configuration/tooling. Benchmark, browser tooling, size, prebuild, lint and declaration validation were not included.                                                   |
+| [mitt](https://github.com/developit/mitt/tree/6b41670516ed8e8b738612f60491995470aa63b3)                          | TypeScript 4.9.5                | Initial native checking needs the generated root declaration. After generating it, native typechecking passes; alpha.2 still fails with TS5023 because this compiler does not support `--noCheck`. Mocha and other package scripts were not run.            |
+| [more-itertools](https://github.com/more-itertools/more-itertools/tree/1da45ae4b61a832ed080f08a8833784aad0a9534) | unittest, Python 3.12           | Both ran 928 tests successfully. Full setup also discovers workflows and a separate documentation project; its selected unittest check has no candidate tests. Documentation builds, type stubs and workflow validation remain outside the narrowed result. |
+| [google/uuid](https://github.com/google/uuid/tree/2d3c2a9cc518326daf99a383f07c4d3c44317e4d)                      | gofmt, vet and tests, Go 1.27.1 | Native test events report 212 passes and one skip. Both formatting checks report the same seven files. Checktrail marks vet/tests inconclusive because the native platform selection omits `node_js.go`; the formatting failure makes the aggregate failed. |
+| [PSR Log](https://github.com/php-fig/log/tree/f16e1d5863e37f8d8c2a01719f5b34baa2b714d3)                          | PHP 8.4 syntax                  | All eight files pass native and Checktrail syntax checks. Host diagnosis reports PHP missing; prepared Linux execution succeeds. This provides no type, behavior or test evidence.                                                                          |
+
+Counts above describe this pinned snapshot and are reconciled with the linked
+record. Go's zero exit status from `gofmt -l` does not mean formatted source;
+its listed paths are findings. Its skipped test and platform-excluded file are
+retained instead of turning native exit zero into complete validation.
+
+Each checkout received an original, temporary failing control. Node, Python, Go
+and PHP detected the intended failure. Go retained its existing skip and formatting
+findings. TypeScript's native run diagnosed the inserted TS2322 error, but alpha.2
+stopped at the unsupported compiler option; that is not credited as detection.
+Controls were removed in `finally`, and tracked upstream file hashes remained
+unchanged. `init --write` preservation was checked byte for byte, and read-only
+operations were checked against the project tree.
+
+## What this changes in the roadmap
+
+- TypeScript needs a capability/version preflight for older compilers, with a
+  clear unavailable-tool explanation, or an explicitly tested compatible invocation.
+  Alpha.2's existing native verification covers TypeScript 6.0.3; this exercise
+  does not extend that support to 4.9.5.
+- Setup guidance should distinguish an executable language profile from workflow
+  tooling and documentation projects. Explicit narrowing must keep the omitted
+  coverage visible.
+- Go needs an explicit policy for platform/build-tag coverage before a developer
+  can distinguish intentional target exclusions from accidentally missed source.
+  This observation does not justify silently ignoring excluded files.
+
+These are recorded adoption gaps, not fixes applied to the immutable alpha.2
+package. No new engine version is published by this exercise.
+
+## Alpha.3 follow-up
+
+The [compiler compatibility fix](TYPESCRIPT.md) is published in alpha.3. Its exact
+release artifact passes the known-case mitt replay with TypeScript 4.9.5 through
+the CLI, library and MCP; see [release verification](RELEASE.md). The observations
+above still describe published alpha.2; they are not replaced by the fixed source
+checkout's results. The [setup scope guide](SETUP-SCOPES.md) explains omitted workflows and documentation.
+An unreleased [Go scope policy](GO-SCOPE.md) now supports exact native-confirmed
+exclusions; a target matrix remains separate work.
+
+## Reproduce
+
+Use macOS arm64 with Node 26.8.1 and Go 1.27.1 to reproduce the recorded host
+profile. PHP and Python use the image identities in the measurement record;
+Docker execution disables networking and mounts project inputs read-only.
+The host does not impose an OS network sandbox. No Sail is used.
+
+Download the tarball and `SHA256SUMS` from the
+[alpha.2 GitHub release](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.2),
+then verify SHA-256
+`ffd0564f40a12a238a52fe25fe8c34fb36cf6f6480be7b6994bab82a3bd657fb`.
+The original measurement installed the exact version from npm; reproduction
+installs that same verified tarball with lifecycle scripts disabled.
+
+```sh
+node scripts/prepare-public-adoption.mjs /new/adoption-directory /absolute/release.tgz
+```
+
+Preparation downloads pinned public Git revisions and installs the engine and
+explicit TypeScript tools. It does not run upstream package scripts. The TypeScript
+tool profile is compiler 4.9.5 plus `@types/chai` 4.3.20, `@types/mocha` 7.0.2,
+`@types/sinon` 9.0.11 and `@types/sinon-chai` 3.2.12. The preparation lockfile records
+transitive dependency resolutions; it is not an upstream lockfile or a claim that
+all upstream build/test dependencies were installed.
+
+Prepare the Python/Node image using `scripts/external-tools.Dockerfile`, and the
+PHP/Node image using `scripts/adoption-php.Dockerfile`. Compare local image IDs
+with the record. A rebuilt image may have a different ID: a run with different
+image bytes is a new environment observation, not a reproduction of that exact
+runtime. The recorded Python image must already be present for this harness.
+
+```sh
+docker build --network=none --pull=false -f scripts/adoption-php.Dockerfile -t checktrail-adoption-php:alpha2 scripts
+CHECKTRAIL_ADOPTION_PHP_IMAGE="$(docker image inspect checktrail-adoption-php:alpha2 --format '{{.Id}}')" \
+  node scripts/measure-public-adoption.mjs /new/adoption-directory /absolute/release.tgz
+```
+
+Measurement downloads nothing. It verifies installed engine files against the
+reviewed artifact, checks upstream revisions and tracked hashes, measures both
+policy scopes, compares native accounting, and applies/removes the original
+controls. mitt's generated declaration is prepared separately with the installed
+compiler and removed afterwards. Fresh checkouts are required for another run;
+the harness preserves detailed local evidence and created policies for inspection.
+
+Raw process outputs stay under the prepared directory's `observations/` folder.
+The committed record contains relative file names, counts, diagnostic codes,
+versions, hashes, outcomes and timing observations, not source or raw tool prose.
+Timings include CLI/process startup and, for containers, Docker invocation; cache
+state, native/wrapper order and scheduling are uncontrolled. They do not support
+a representative speed comparison. No model is invoked and no prior human/model
+review workflow is compared.

package/docs/RELEASE.md

@@ -1,20 +1,77 @@
-# Release preparation
-
-The source is public at [stsepelin/checktrail](https://github.com/stsepelin/checktrail);
-`@stsepelin/checktrail@0.1.0-alpha.1` is published on npm. Its downloaded artifact
-matched the reviewed tarball with SHA-256
-`84003e184805b6c5362c0801c702a72e415040ae5142fcd70f01eb9758637d04`.
-Fresh registry installation, CLI and MCP startup were verified. The alpha.2
-candidate adds [setup and diagnosis](ONBOARDING.md); it is not yet published.
-`server.json` describes the intended `io.github.stsepelin/checktrail` MCP Registry
-identity with the candidate's matching npm version. Registry registration remains
-pending. No credentials or automatic publishing workflow are stored here.
-
-Publication is configured for npm's `next` tag. After alpha.1 publication, the
-registry assigned both `next` and `latest` to that preview; attempts to remove
-`latest` returned HTTP 400. The cause is unresolved. Use exact versions and
-resolve the tag policy before publishing another candidate; do not treat `latest`
-as evidence of a stable release or republish an existing version.
+# Releases and publication
+
+The source is public at [stsepelin/checktrail](https://github.com/stsepelin/checktrail).
+The published preview is `@stsepelin/checktrail@0.1.0-alpha.3`.
+Its downloaded npm artifact and GitHub release asset match the reviewed SHA-256:
+
+```text
+261d10acbac14dcd5d74f4b248a390e5790f22461fecd597e29b8044aef2daeb
+```
+
+The [GitHub prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.3)
+and tag point to source commit `b0b447d5ea8973b3e427e179201a44b7baa1ca91` and include
+the same tarball plus `SHA256SUMS`. The [hosted release run](https://github.com/stsepelin/checktrail/actions/runs/35597877167)
+passed all jobs. The [MCP Registry entry](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.stsepelin%2Fchecktrail/versions/0.1.0-alpha.3)
+is active and matches `server.json`, with execution disabled. The Registry omits
+`isSecret: false`, whose schema default is false.
+
+Fresh public-registry installation verified CLI/library validation, generated
+npx startup with fresh/warm caches, onboarding, and MCP pass/fail/incomplete
+results, retained reports and execution denial. The exact artifact also passed
+offline installation, alpha.2 → alpha.3 → alpha.2 upgrade/rollback, the known mitt
+TypeScript 4.9.5 replay, Claude Code health/discovery and Codex direct MCP calls.
+The [release record](measurements/release-alpha3.json) links these observations to
+the artifact; client profile limits remain in [CLIENTS.md](CLIENTS.md).
+
+## Alpha.4 candidate (unpublished)
+
+The checkout prepares `0.1.0-alpha.4` with optional exact Go file exclusions in
+`checktrail.go-scope.json`. Native package evidence must account for each declared
+exclusion. Active, absent or otherwise unaccounted-for declarations cannot pass.
+Go formatting continues to cover the full source inventory, and race-test package
+discovery now uses the same `-race` constraints as execution. See [GO-SCOPE.md](GO-SCOPE.md).
+
+Detailed plan/report schemas add an optional `goScope` declaration and summaries
+add an optional `goExcludedFileCount`. Consumers that validate with older strict
+schemas must update their schemas before accepting these fields. The policy is
+opt-in; existing projects retain strict scope accounting. Dependencies are unchanged.
+
+Alpha.3 does not understand the new sidecar policy. Rolling back keeps its bytes
+on disk but restores strict Go accounting, so a project relying on exclusions can
+become incomplete. Exclusions never establish validation of another platform or
+custom build-tag configuration. No cross-target execution is added.
+
+Candidate verification and commit approval precede publication. The installed MCP
+SDK routing probe was rechecked on 2026-09-21: standard Tasks remains unavailable;
+see [MCP-COMPATIBILITY.md](MCP-COMPATIBILITY.md). The published preview and artifact
+described above remain alpha.3 until a new release is explicitly authorized and verified.
+
+## Alpha.3 scope
+
+Alpha.3 fixes the plain TypeScript adapter's unsupported `--noCheck` argument on
+the exercised TypeScript 4.9.5 profile, retaining the TypeScript 6.0.3 override and
+native file accounting. Vue uses the same capability helper with its verified
+modern toolchain; solution-build remains gated to TypeScript 6.0.3. See
+[TYPESCRIPT.md](TYPESCRIPT.md). Dependencies and report/policy schemas did not change.
+
+The release targets Node.js 22 or newer on macOS and Linux. It does not add
+standard MCP Tasks or legacy Vue support. The historical alpha.2
+[adoption record](PUBLIC-ADOPTION.md) remains unchanged; its initial failures are
+not rewritten as alpha.3 successes. The immutable tarball contains preparation-time
+candidate documentation; current source documentation records verified publication.
+
+## Distribution tags and previous release
+
+`next` points to alpha.3. `latest` remains on alpha.1 because npm rejected its
+removal. Use exact versions; neither tag implies a stable release. Never republish
+an existing version. No credentials or automatic publishing workflow are stored here.
+
+The [alpha.2 prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.2)
+introduced [setup and diagnosis](ONBOARDING.md), from source commit `4ce8398`.
+Its reviewed and downloaded artifact has SHA-256
+`ffd0564f40a12a238a52fe25fe8c34fb36cf6f6480be7b6994bab82a3bd657fb`.
+Its [hosted run](https://github.com/stsepelin/checktrail/actions/runs/35590670960)
+and fresh installation checks passed; its npm and Registry versions remain published.
 
 ## Prepared artifacts
 
@@ -32,8 +89,8 @@ as evidence of a stable release or republish an existing version.
   loads the installed metadata and verifies its actual startup command.
 - CI definitions cover the host suite and prepared native profiles. Local
   containers and package checks are evidence only for the environments actually
-  exercised. The [hosted run at bfc8cc4](https://github.com/stsepelin/checktrail/actions/runs/35585998184)
-  passed all jobs; the alpha.2 release commit requires its own run. The local Claude Code health/discovery and
+  exercised. The [hosted run at b0b447d](https://github.com/stsepelin/checktrail/actions/runs/35597877167)
+  passed all jobs for the alpha.3 release commit. The local Claude Code health/discovery and
   Codex direct app-server profiles have fresh-install evidence in `CLIENTS.md`.
 
 The metadata follows the official registry
@@ -69,7 +126,7 @@ After explicit approval and npm authentication for the `@stsepelin` scope, publi
 the approved file, not a newly packed working tree:
 
 ```sh
-npm publish /absolute/path/stsepelin-checktrail-0.1.0-alpha.2.tgz \
+npm publish /absolute/path/reviewed-new-version.tgz \
   --tag next --access public --ignore-scripts --registry=https://registry.npmjs.org
 ```