@stsepelin/checktrail 0.1.0-alpha.3 → 0.1.0-alpha.4

package/README.md

@@ -4,7 +4,7 @@ Local code validation with a CLI, MCP tools, and evidence of what actually ran.
 
 Formerly Repo Verifier. See the [rename guide](docs/RENAMING.md) for existing source checkouts.
 
-**Published preview: 0.1.0-alpha.2; source candidate: 0.1.0-alpha.3.** Public source is available at
+**Published preview: 0.1.0-alpha.3.** Public source is available at
 [stsepelin/checktrail](https://github.com/stsepelin/checktrail).
 See [implementation status](docs/STATUS.md), the [plan](docs/PLAN.md) and the
 [language matrix](docs/LANGUAGES.md) before relying on an adapter.
@@ -18,13 +18,15 @@ and MCP configuration generator.
 acceptance work; [client checks](docs/CLIENTS.md) record actual application coverage.
 [Public adoption](docs/PUBLIC-ADOPTION.md) records the published package on five
 pinned libraries, including setup friction and compatibility gaps.
-The alpha.3 candidate fixes the recorded [TypeScript 4.9.5 incompatibility](docs/TYPESCRIPT.md);
-it has not been published.
+Alpha.3 fixes the recorded [TypeScript 4.9.5 incompatibility](docs/TYPESCRIPT.md).
+The [setup scope guide](docs/SETUP-SCOPES.md) explains language, documentation and workflow coverage.
+The local checkout prepares **0.1.0-alpha.4**, adding explicit [Go scope exclusions](docs/GO-SCOPE.md)
+and matching race-test package discovery. Alpha.4 is not published yet.
 
-The [hosted matrix](https://github.com/stsepelin/checktrail/actions/runs/35590670960)
-passed at release commit `4ce8398` on Linux and macOS. The exact npm tarball and
+The [hosted matrix](https://github.com/stsepelin/checktrail/actions/runs/35597877167)
+passed at release commit `b0b447d` on Linux and macOS. The exact npm tarball and
 fresh CLI/MCP installations were verified. The
-[MCP Registry entry](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.stsepelin%2Fchecktrail/versions/0.1.0-alpha.2)
+[MCP Registry entry](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.stsepelin%2Fchecktrail/versions/0.1.0-alpha.3)
 is active; execution remains disabled by default.
 
 Checktrail discovers projects, plans registered checks, invokes native tools

package/dist/src/adapters.js

@@ -1,3 +1,4 @@
+import { applyGoScopePolicy } from "./go-scope-policy.js";
 import { actionlintCheck, workflowRoot } from "./actionlint.js";
 import { clangCheck } from "./clang.js";
 import { javaCheck } from "./java.js";
@@ -312,7 +313,7 @@ export async function checksFor(source, project, requested) {
                         ...env,
                         CGO_ENABLED: "1",
                         GORACE: "exitcode=66 log_path=stderr",
-                    }),
+                    }, true),
                     {
                         executable: "go",
                         args: ["test", "-race", "-json", "-count=1", "./..."],
@@ -354,6 +355,7 @@ export async function checksFor(source, project, requested) {
             });
         if (explicit)
             checks.push(await golangciCheck(source, project));
+        await applyGoScopePolicy(source, project, checks);
         return checks;
     }
     if (project.adapter === "infrastructure") {

package/dist/src/architecture.d.ts

@@ -78,6 +78,7 @@ export declare const architectureReportSchema: z.ZodObject<{
 }, z.core.$strict>;
 export declare const architectureSummarySchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
+    reason: z.ZodString;
     engineVersion: z.ZodString;
     provenance: z.ZodLiteral<"imported-dependency-graph">;
     outcome: z.ZodEnum<{
@@ -85,7 +86,6 @@ export declare const architectureSummarySchema: z.ZodObject<{
         failed: "failed";
         incomplete: "incomplete";
     }>;
-    reason: z.ZodString;
     counts: z.ZodObject<{
         projects: z.ZodNumber;
         verifiedProjects: z.ZodNumber;

package/dist/src/contract-schema.d.ts

@@ -64,6 +64,7 @@ export declare const contractReportSchema: z.ZodObject<{
 export type ContractReport = z.infer<typeof contractReportSchema>;
 export declare const contractSummarySchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
+    reason: z.ZodString;
     engineVersion: z.ZodString;
     provenance: z.ZodLiteral<"imported-contract-samples">;
     outcome: z.ZodEnum<{
@@ -71,7 +72,6 @@ export declare const contractSummarySchema: z.ZodObject<{
         failed: "failed";
         incomplete: "incomplete";
     }>;
-    reason: z.ZodString;
     counts: z.ZodObject<{
         contracts: z.ZodNumber;
         passed: z.ZodNumber;

package/dist/src/contracts.d.ts

@@ -5,10 +5,10 @@ export declare function validateContracts(input: unknown, options?: {
 }): Promise<ContractReport>;
 export declare function projectContractReport(result: ContractReport, detailed: boolean): {
     schemaVersion: 1;
+    reason: string;
     engineVersion: string;
     provenance: "imported-contract-samples";
     outcome: "passed" | "failed" | "incomplete";
-    reason: string;
     counts: {
         contracts: number;
         passed: number;

package/dist/src/evidence.js

@@ -172,6 +172,7 @@ function goTests(text, allowPackageFailures = false) {
 }
 export function evaluate(check, processes, root) {
     const result = {
+        ...(check.goScope ? { goScope: check.goScope } : {}),
         ...(check.external ? { external: check.external } : {}),
         id: check.id,
         adapter: check.adapter,
@@ -223,7 +224,7 @@ export function evaluate(check, processes, root) {
                 ...(native.tests ? { tests: native.tests } : {}),
             };
         if (!goScopeComplete(check, processes[0], root, check.kind === "test" ? processes[1]?.stdout : undefined))
-            return set("inconclusive", "Native Go selection omitted inventoried source, a package has no passing test, or scope could not be established.");
+            return set("inconclusive", "Native Go selection or declared exclusions did not reconcile, a package has no passing test, or scope could not be established.");
         return { ...result, ...(native.tests ? { tests: native.tests } : {}) };
     }
     if (check.parser === "eslint-json")

package/dist/src/finding-policy-schema.d.ts

@@ -115,6 +115,7 @@ export declare const findingComparisonSchema: z.ZodObject<{
 export type FindingComparison = z.infer<typeof findingComparisonSchema>;
 export declare const findingComparisonSummarySchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
+    reason: z.ZodString;
     engineVersion: z.ZodString;
     provenance: z.ZodLiteral<"finding-comparison">;
     outcome: z.ZodEnum<{
@@ -122,7 +123,6 @@ export declare const findingComparisonSummarySchema: z.ZodObject<{
         failed: "failed";
         incomplete: "incomplete";
     }>;
-    reason: z.ZodString;
     counts: z.ZodObject<{
         current: z.ZodNumber;
         new: z.ZodNumber;

package/dist/src/go-scope-policy.d.ts

@@ -0,0 +1,11 @@
+import { z } from "zod";
+import type { Check, Inventory, Project } from "./types.js";
+export declare const goScopePolicySchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    excludedFiles: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type GoScopePolicy = z.infer<typeof goScopePolicySchema>;
+export declare function applyGoScopePolicy(source: Inventory, project: Project, checks: Check[]): Promise<void>;

package/dist/src/go-scope-policy.js

@@ -0,0 +1,50 @@
+import { lstat } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { readProjectFile } from "./inventory.js";
+export const goScopePolicySchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    excludedFiles: z
+        .array(z.strictObject({
+        path: z
+            .string()
+            .max(4096)
+            .regex(/^(?!\/)(?!.*(?:^|\/)\.{1,2}(?:\/|$))(?!.*\/\/)(?!.*[\\*?[\]{}])[\u0020-\u007e\u0080-\uffff]+\.go$/),
+        reason: z.string().min(1).max(1000).regex(/\S/),
+    }))
+        .max(1000),
+});
+export async function applyGoScopePolicy(source, project, checks) {
+    const file = path.posix.join(project.path, "checktrail.go-scope.json");
+    const scoped = checks.filter((check) => check.id !== "go.format");
+    try {
+        let entry;
+        try {
+            entry = await lstat(path.join(source.root, file));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        if (!entry.isFile() ||
+            entry.isSymbolicLink() ||
+            source.excluded.includes(file))
+            throw new Error("Go scope policy must be an inventoried regular file");
+        if (!source.files.includes(file))
+            throw new Error("Go scope policy is not inventoried");
+        const policy = goScopePolicySchema.parse(JSON.parse(await readProjectFile(source.root, file)));
+        const paths = policy.excludedFiles.map((entry) => entry.path);
+        if (new Set(paths).size !== paths.length)
+            throw new Error("Duplicate Go scope exclusion");
+        if (paths.some((file) => !project.files.includes(file)))
+            throw new Error("Go scope exclusions must name inventoried project files");
+        for (const check of scoped)
+            check.goScope = policy;
+    }
+    catch (error) {
+        for (const check of scoped)
+            check.unavailableReason =
+                error instanceof Error ? error.message : "Invalid Go scope policy";
+    }
+}

package/dist/src/go-scope.d.ts

@@ -7,5 +7,5 @@ export declare const goEnvironment: {
     GOENV: string;
     GOCACHEPROG: string;
 };
-export declare function goScopeCommand(project: string, env?: Record<string, string>): Command;
+export declare function goScopeCommand(project: string, env?: Record<string, string>, race?: boolean): Command;
 export declare function goScopeComplete(check: Check, process: ProcessResult | undefined, root: string | undefined, testOutput?: string): boolean;

package/dist/src/go-scope.js

@@ -1,3 +1,4 @@
+import { goScopePolicySchema } from "./go-scope-policy.js";
 import path from "node:path";
 import { z } from "zod";
 export const goEnvironment = {
@@ -8,10 +9,10 @@ export const goEnvironment = {
     GOENV: "off",
     GOCACHEPROG: "",
 };
-export function goScopeCommand(project, env = goEnvironment) {
+export function goScopeCommand(project, env = goEnvironment, race = false) {
     return {
         executable: "go",
-        args: ["list", "-json", "./..."],
+        args: ["list", "-json", ...(race ? ["-race"] : []), "./..."],
         cwd: project,
         env,
     };
@@ -60,6 +61,7 @@ const packageSchema = z.object({
     CgoFiles: names,
     TestGoFiles: names,
     XTestGoFiles: names,
+    IgnoredGoFiles: names,
     Error: z.unknown().optional(),
     DepsErrors: z.array(z.unknown()).optional(),
 });
@@ -68,11 +70,26 @@ export function goScopeComplete(check, process, root, testOutput) {
         !process ||
         process.exitCode !== 0 ||
         process.stderr.trim() ||
+        process.timedOut ||
+        process.cancelled ||
+        process.truncated ||
+        process.signal !== null ||
+        process.errorCode !== undefined ||
         !check.scope.length)
         return false;
     try {
         const packages = objects(process.stdout).map((value) => packageSchema.parse(value));
         const expected = new Set(check.scope.map((file) => path.resolve(root, check.project, file)));
+        if (expected.size !== check.scope.length)
+            return false;
+        const policy = check.goScope === undefined
+            ? undefined
+            : goScopePolicySchema.parse(check.goScope);
+        const exclusions = new Set((policy?.excludedFiles ?? []).map((entry) => path.resolve(root, check.project, entry.path)));
+        if (exclusions.size !== (policy?.excludedFiles.length ?? 0) ||
+            [...exclusions].some((file) => !expected.has(file)))
+            return false;
+        const ignored = new Set();
         const seen = new Set();
         const ids = new Set();
         for (const item of packages) {
@@ -88,13 +105,30 @@ export function goScopeComplete(check, process, root, testOutput) {
                 ...item.TestGoFiles,
                 ...item.XTestGoFiles,
             ]) {
-                if (path.basename(file) !== file || !file.endsWith(".go"))
+                if (path.basename(file) !== file ||
+                    file.includes("\\") ||
+                    !file.endsWith(".go"))
                     return false;
                 const resolved = path.resolve(item.Dir, file);
-                if (!expected.has(resolved) || seen.has(resolved))
+                if (!expected.has(resolved) ||
+                    exclusions.has(resolved) ||
+                    seen.has(resolved) ||
+                    ignored.has(resolved))
                     return false;
                 seen.add(resolved);
             }
+            for (const file of item.IgnoredGoFiles) {
+                if (path.basename(file) !== file ||
+                    file.includes("\\") ||
+                    !file.endsWith(".go"))
+                    return false;
+                const resolved = path.resolve(item.Dir, file);
+                if (!exclusions.has(resolved) ||
+                    ignored.has(resolved) ||
+                    seen.has(resolved))
+                    return false;
+                ignored.add(resolved);
+            }
         }
         if (testOutput !== undefined) {
             const tested = new Set();
@@ -114,7 +148,10 @@ export function goScopeComplete(check, process, root, testOutput) {
             if (tested.size !== ids.size)
                 return false;
         }
-        return ids.size > 0 && seen.size === expected.size;
+        return (ids.size > 0 &&
+            seen.size > 0 &&
+            ignored.size === exclusions.size &&
+            seen.size + ignored.size === expected.size);
     }
     catch {
         return false;

package/dist/src/output.js

@@ -22,6 +22,9 @@ export function projectPlan(plan, detailed) {
         excludedCount: plan.excluded.length,
         checks: plan.checks.map((check) => ({
             id: check.id,
+            ...(check.goScope
+                ? { goExcludedFileCount: check.goScope.excludedFiles.length }
+                : {}),
             kind: check.kind,
             ready: !check.unavailableReason,
         })),
@@ -41,6 +44,9 @@ export function projectReport(report, detailed) {
         sourceError: report.sourceError,
         checks: report.checks.map((check) => ({
             id: check.id,
+            ...(check.goScope
+                ? { goExcludedFileCount: check.goScope.excludedFiles.length }
+                : {}),
             status: check.status,
             ...(check.tests ? { tests: check.tests } : {}),
         })),

package/dist/src/report-validation.d.ts

@@ -39,6 +39,13 @@ export declare function validatedReport(input: unknown): {
                 source: "adapter-reported";
             }[] | undefined;
         } | undefined;
+        goScope?: {
+            schemaVersion: 1;
+            excludedFiles: {
+                path: string;
+                reason: string;
+            }[];
+        } | undefined;
         tests?: {
             total: number;
             passed: number;

package/dist/src/runtime-inventory.d.ts

@@ -72,6 +72,7 @@ export declare const runtimeComparisonSchema: z.ZodObject<{
 }, z.core.$strict>;
 export declare const runtimeComparisonSummarySchema: z.ZodObject<{
     schemaVersion: z.ZodLiteral<1>;
+    reason: z.ZodString;
     engineVersion: z.ZodString;
     provenance: z.ZodLiteral<"imported-runtime-comparison">;
     outcome: z.ZodEnum<{
@@ -79,7 +80,6 @@ export declare const runtimeComparisonSummarySchema: z.ZodObject<{
         failed: "failed";
         incomplete: "incomplete";
     }>;
-    reason: z.ZodString;
     beforeFingerprint: z.ZodString;
     afterFingerprint: z.ZodString;
     counts: z.ZodObject<{
@@ -95,10 +95,10 @@ export type RuntimeComparison = z.infer<typeof runtimeComparisonSchema>;
 export declare function compareRuntimeInventories(beforeInput: unknown, afterInput: unknown): RuntimeComparison;
 export declare function projectRuntimeComparison(result: RuntimeComparison, detailed: boolean): {
     schemaVersion: 1;
+    reason: string;
     engineVersion: string;
     provenance: "imported-runtime-comparison";
     outcome: "passed" | "failed" | "incomplete";
-    reason: string;
     beforeFingerprint: string;
     afterFingerprint: string;
     counts: {

package/dist/src/schemas.d.ts

@@ -1,3 +1,4 @@
+export { goScopePolicySchema } from "./go-scope-policy.js";
 export { externalManifestSchema, externalReferenceSchema, externalRequestSchema, externalResultSchema, } from "./external-adapter.js";
 export { actionlintConfigSchema } from "./actionlint.js";
 export { dotnetConfigSchema } from "./dotnet.js";
@@ -50,6 +51,13 @@ export declare const reportSchema: z.ZodObject<{
         adapter: z.ZodString;
         project: z.ZodString;
         scope: z.ZodArray<z.ZodString>;
+        goScope: z.ZodOptional<z.ZodObject<{
+            schemaVersion: z.ZodLiteral<1>;
+            excludedFiles: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                reason: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
         status: z.ZodEnum<{
             error: "error";
             passed: "passed";
@@ -200,6 +208,7 @@ export declare const reportSummarySchema: z.ZodObject<{
             failed: z.ZodNumber;
             skipped: z.ZodNumber;
         }, z.core.$strict>>;
+        goExcludedFileCount: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
     runId: z.ZodString;
     outcome: z.ZodEnum<{
@@ -256,6 +265,13 @@ export declare const planSchema: z.ZodObject<{
         adapter: z.ZodString;
         project: z.ZodString;
         scope: z.ZodArray<z.ZodString>;
+        goScope: z.ZodOptional<z.ZodObject<{
+            schemaVersion: z.ZodLiteral<1>;
+            excludedFiles: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                reason: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
         kind: z.ZodEnum<{
             format: "format";
             analysis: "analysis";
@@ -354,6 +370,7 @@ export declare const planSummarySchema: z.ZodObject<{
             unsupported: "unsupported";
         }>;
         ready: z.ZodBoolean;
+        goExcludedFileCount: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
     schemaVersion: z.ZodLiteral<1>;
     engineVersion: z.ZodString;

package/dist/src/schemas.js

@@ -1,3 +1,5 @@
+import { goScopePolicySchema } from "./go-scope-policy.js";
+export { goScopePolicySchema } from "./go-scope-policy.js";
 import { externalIdentitySchema } from "./external-adapter.js";
 export { externalManifestSchema, externalReferenceSchema, externalRequestSchema, externalResultSchema, } from "./external-adapter.js";
 export { actionlintConfigSchema } from "./actionlint.js";
@@ -124,6 +126,7 @@ export const reportSchema = z.strictObject({
         adapter: z.string(),
         project: z.string(),
         scope: strings,
+        goScope: goScopePolicySchema.optional(),
         status,
         reason: z.string(),
         processes: z.array(processResult),
@@ -161,7 +164,12 @@ export const reportSchema = z.strictObject({
 export const reportSummarySchema = z.strictObject({
     ...reportMetadata,
     selection: selectionSummary.optional(),
-    checks: z.array(z.strictObject({ id: z.string(), status, tests: tests.optional() })),
+    checks: z.array(z.strictObject({
+        id: z.string(),
+        status,
+        tests: tests.optional(),
+        goExcludedFileCount: count.optional(),
+    })),
 });
 export const planSchema = z.strictObject({
     ...metadata,
@@ -182,6 +190,7 @@ export const planSchema = z.strictObject({
         adapter: z.string(),
         project: z.string(),
         scope: strings,
+        goScope: goScopePolicySchema.optional(),
         kind,
         parser: z.enum(PARSERS),
         commands: z.array(command),
@@ -197,7 +206,12 @@ export const planSummarySchema = z.strictObject({
     projectCount: count,
     adapters: strings,
     excludedCount: count,
-    checks: z.array(z.strictObject({ id: z.string(), kind, ready: z.boolean() })),
+    checks: z.array(z.strictObject({
+        id: z.string(),
+        kind,
+        ready: z.boolean(),
+        goExcludedFileCount: count.optional(),
+    })),
 });
 export const junitImportSchema = z.strictObject({
     ...metadata,

package/dist/src/types.d.ts

@@ -1,6 +1,7 @@
+import type { GoScopePolicy } from "./go-scope-policy.js";
 import type { ExternalIdentity } from "./external-adapter.js";
 import type { RuntimeInventory } from "./runtime-inventory.js";
-export declare const VERSION = "0.1.0-alpha.3";
+export declare const VERSION = "0.1.0-alpha.4";
 export declare const PARSERS: readonly ["vue-router-json", "nuxt-json", "exit", "empty", "node-events", "unittest", "go-scope-test", "go-scope-analysis", "golangci-json", "staticcheck-json", "go-json", "typescript-build-json", "tsc-files", "eslint-json", "vitest-json", "playwright-json", "jest-json", "pytest-json", "fastapi-json", "django-json", "laravel-json", "rust-json", "clang-json", "java-json", "dotnet-json", "actionlint-json", "external-json", "ruby-syntax", "silent-syntax", "ruff-json", "mypy-json", "phpstan-json", "phpunit-junit", "pint-json"];
 export type Status = "passed" | "failed" | "unavailable" | "skipped" | "error" | "inconclusive";
 export type Outcome = "passed" | "failed" | "incomplete";
@@ -44,6 +45,7 @@ export interface ToolEvidence {
     path?: string;
 }
 export interface Check {
+    goScope?: GoScopePolicy;
     external?: ExternalIdentity;
     id: string;
     adapter: string;
@@ -115,6 +117,7 @@ export interface Finding {
     line?: number;
 }
 export interface CheckResult {
+    goScope?: GoScopePolicy;
     external?: ExternalIdentity & {
         tools?: {
             name: string;

package/dist/src/types.js

@@ -1,4 +1,4 @@
-export const VERSION = "0.1.0-alpha.3";
+export const VERSION = "0.1.0-alpha.4";
 export const PARSERS = [
     "vue-router-json",
     "nuxt-json",

package/docs/ACCEPTANCE.md

@@ -7,7 +7,7 @@ separate states. Follow the linked evidence for tested versions and limits.
 
 | Milestone                         | Implemented scope and evidence                                                                                                                                                                                                                                                                                                                                                                                                          | Open acceptance work                                                                                                                                                                                                                           |
 | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| M0: public contracts              | Original public fixtures, MIT license, security/contribution guidance, schemas, explicit package allowlist, dependency notices and CI definitions. `STATUS.md`, `SECURITY.md`, `RELEASE.md`.                                                                                                                                                                                                                                            | Public source, npm alpha.2 and its MCP Registry entry are published. Hosted CI passed at `4ce8398`; fresh registry installation was verified.                                                                                                  |
+| M0: public contracts              | Original public fixtures, MIT license, security/contribution guidance, schemas, explicit package allowlist, dependency notices and CI definitions. `STATUS.md`, `SECURITY.md`, `RELEASE.md`.                                                                                                                                                                                                                                            | Public source, npm alpha.3 and its MCP Registry entry are published. Hosted CI passed at `b0b447d`; fresh registry installation was verified.                                                                                                  |
 | M1: executable foundation         | Shared CLI/library/MCP engine, bounded inventory/runner, startup trust, native Node/Python/Go/PHP profiles, protocol and lifecycle regressions. `ARCHITECTURE.md`, `STATUS.md`, `MCP-COMPATIBILITY.md`. Fresh installed application-client profiles now have evidence in `CLIENTS.md`.                                                                                                                                                  | Application-client coverage beyond the named profiles. PHP remains unavailable when the consumer has no prepared runtime.                                                                                                                      |
 | M2: practical language validation | Explicit JS/TS, Python, Go and PHP native tool profiles, structured diagnostics/test evidence, versions, environments, workspace selection, scope accounting, SARIF/JUnit and finding ratchets. `LANGUAGES.md`, adapter documents, `WORKSPACES.md`, `FINDING-POLICY.md`, `NATIVE-CI.md`.                                                                                                                                                | Hosted toolchain profiles passed at `52ba415`. Wider tool versions/framework configurations must be promoted separately; detection is not execution support.                                                                                   |
 | M3: framework/contracts           | Native Laravel, Vue Router/Nuxt, Django/FastAPI assembly projections; imported runtime comparison, explicit architecture boundaries, producer/consumer schemas and a built package consumer. `RUNTIME-INVENTORY.md`, framework documents, `CONTRACTS.md`, `ARCHITECTURE-POLICY.md`, `examples/package-contract/README.md`.                                                                                                              | Broader native semantics/import collection and live service integration are not implemented. Synthetic evidence does not establish equivalent results in a private application; private integration feedback must remain private.              |
@@ -19,9 +19,11 @@ separate states. Follow the linked evidence for tested versions and limits.
 [Public adoption measurements](PUBLIC-ADOPTION.md) now cover five pinned
 JavaScript, TypeScript, Python, Go and PHP libraries. They expose an older
 TypeScript compiler-option incompatibility and workflow/documentation/platform
-coverage friction. An [unreleased compiler fix](TYPESCRIPT.md) now passes the
-known TypeScript 4.9.5 case; workflow/documentation and platform coverage remain
-follow-up work. The observations do not establish full upstream CI coverage or
+coverage friction. The [alpha.3 compiler fix](TYPESCRIPT.md) now passes the
+known TypeScript 4.9.5 case. [Setup guidance](SETUP-SCOPES.md) distinguishes
+workflow/documentation coverage; an unreleased [Go scope policy](GO-SCOPE.md)
+accounts for explicitly acknowledged native exclusions. Broader target coverage
+remains follow-up work. The observations do not establish full upstream CI coverage or
 general review effectiveness.
 
 1. Extend independently authored evaluation cohorts to additional implemented
@@ -51,10 +53,10 @@ run. The local worker/store are available independently; standard Tasks must sta
 unadvertised until routing and the integrated wire/lifecycle suite pass. See
 `MCP-COMPATIBILITY.md` for the reproduction and upstream issue.
 
-The public repository, npm preview `0.1.0-alpha.2` and its MCP Registry entry are
-published. The [hosted run at 4ce8398](https://github.com/stsepelin/checktrail/actions/runs/35590670960)
-passed all jobs, and fresh public installation was verified. Alpha.2 adds
-[setup commands](ONBOARDING.md). The [GitHub prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.2)
+The public repository, npm preview `0.1.0-alpha.3` and its MCP Registry entry are
+published. The [hosted run at b0b447d](https://github.com/stsepelin/checktrail/actions/runs/35597877167)
+passed all jobs, and fresh public installation was verified. Alpha.3 adds
+[legacy compiler compatibility](TYPESCRIPT.md) to the existing [setup commands](ONBOARDING.md). The [GitHub prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.3)
 is also published with the verified tarball and checksum. npm tag cleanup remains
 unresolved. The repository's explicit-action requirements still apply.
 `RELEASE.md` defines the concrete

package/docs/CLIENTS.md

@@ -1,8 +1,9 @@
 # Application client compatibility
 
-The recorded snapshots below predate the Checktrail rename and retain their
-original package identities. A release candidate needs its own client checks;
-see [RENAMING.md](RENAMING.md).
+The [alpha.3 release record](measurements/release-alpha3.json) repeats the named
+profiles below against the exact published artifact. The original standalone
+snapshots predate the Checktrail rename and retain their original identities.
+A future release needs its own checks; see [RENAMING.md](RENAMING.md).
 
 The local package was installed offline into a fresh temporary consumer and tested
 with Claude Code 2.1.263 and Codex CLI 0.154.0 on macOS arm64, Node 26.8.1. These
@@ -106,4 +107,5 @@ The runtime digest identifies the installed `dist/src` tree independently.
 
 These local checks satisfy only the named client profiles. Claude Desktop,
 Cursor, VS Code integrations, other client versions and target operating systems
-remain unverified. No public package installation or hosted CI run is implied.
+remain unverified. These original snapshots do not establish public installation or hosted CI;
+alpha.3 publication and hosted evidence are recorded separately in [RELEASE.md](RELEASE.md).

package/docs/GO-RACE.md

@@ -10,8 +10,10 @@ cost and requires the operator to select this check.
 The native fixture runs two workers repeatedly updating one shared counter. The
 unprotected version must fail with an actual `DATA RACE` diagnostic; atomic
 updates must pass and yield the exact combined count. A passing run cannot
-establish freedom from races on paths it did not execute. Native package/file evidence now makes excluded source and untested packages
-incomplete; see [Go scope](GO-SCOPE.md). A build/OS matrix is not implemented.
+establish freedom from races on paths it did not execute. Native package/file evidence makes undeclared excluded source and untested packages
+incomplete; see [Go scope](GO-SCOPE.md) for the unreleased explicit exclusion policy.
+The source checkout also passes `-race` to package listing so it uses the same build
+constraints as the tests. A build/OS matrix is not implemented.
 
 A supported Go race platform and C compiler are required. Compilation and runtime
 errors are retained in detailed output; no compiler, library or toolchain is