@stsepelin/checktrail 0.1.0-alpha.3 → 0.1.0-alpha.5

package/dist/src/schemas.js

@@ -1,3 +1,7 @@
+import { goBuildSelectionSchema } from "./go-build.js";
+export { goBuildPolicySchema } from "./go-build.js";
+import { goScopePolicySchema } from "./go-scope-policy.js";
+export { goScopePolicySchema } from "./go-scope-policy.js";
 import { externalIdentitySchema } from "./external-adapter.js";
 export { externalManifestSchema, externalReferenceSchema, externalRequestSchema, externalResultSchema, } from "./external-adapter.js";
 export { actionlintConfigSchema } from "./actionlint.js";
@@ -124,6 +128,8 @@ export const reportSchema = z.strictObject({
         adapter: z.string(),
         project: z.string(),
         scope: strings,
+        goScope: goScopePolicySchema.optional(),
+        goBuild: goBuildSelectionSchema.optional(),
         status,
         reason: z.string(),
         processes: z.array(processResult),
@@ -161,7 +167,13 @@ export const reportSchema = z.strictObject({
 export const reportSummarySchema = z.strictObject({
     ...reportMetadata,
     selection: selectionSummary.optional(),
-    checks: z.array(z.strictObject({ id: z.string(), status, tests: tests.optional() })),
+    checks: z.array(z.strictObject({
+        id: z.string(),
+        status,
+        tests: tests.optional(),
+        goExcludedFileCount: count.optional(),
+        goBuildTagCount: count.optional(),
+    })),
 });
 export const planSchema = z.strictObject({
     ...metadata,
@@ -182,6 +194,8 @@ export const planSchema = z.strictObject({
         adapter: z.string(),
         project: z.string(),
         scope: strings,
+        goScope: goScopePolicySchema.optional(),
+        goBuild: goBuildSelectionSchema.optional(),
         kind,
         parser: z.enum(PARSERS),
         commands: z.array(command),
@@ -197,7 +211,13 @@ export const planSummarySchema = z.strictObject({
     projectCount: count,
     adapters: strings,
     excludedCount: count,
-    checks: z.array(z.strictObject({ id: z.string(), kind, ready: z.boolean() })),
+    checks: z.array(z.strictObject({
+        id: z.string(),
+        kind,
+        ready: z.boolean(),
+        goExcludedFileCount: count.optional(),
+        goBuildTagCount: count.optional(),
+    })),
 });
 export const junitImportSchema = z.strictObject({
     ...metadata,

package/dist/src/types.d.ts

@@ -1,6 +1,8 @@
+import type { GoBuildSelection } from "./go-build.js";
+import type { GoScopePolicy } from "./go-scope-policy.js";
 import type { ExternalIdentity } from "./external-adapter.js";
 import type { RuntimeInventory } from "./runtime-inventory.js";
-export declare const VERSION = "0.1.0-alpha.3";
+export declare const VERSION = "0.1.0-alpha.5";
 export declare const PARSERS: readonly ["vue-router-json", "nuxt-json", "exit", "empty", "node-events", "unittest", "go-scope-test", "go-scope-analysis", "golangci-json", "staticcheck-json", "go-json", "typescript-build-json", "tsc-files", "eslint-json", "vitest-json", "playwright-json", "jest-json", "pytest-json", "fastapi-json", "django-json", "laravel-json", "rust-json", "clang-json", "java-json", "dotnet-json", "actionlint-json", "external-json", "ruby-syntax", "silent-syntax", "ruff-json", "mypy-json", "phpstan-json", "phpunit-junit", "pint-json"];
 export type Status = "passed" | "failed" | "unavailable" | "skipped" | "error" | "inconclusive";
 export type Outcome = "passed" | "failed" | "incomplete";
@@ -44,6 +46,8 @@ export interface ToolEvidence {
     path?: string;
 }
 export interface Check {
+    goScope?: GoScopePolicy;
+    goBuild?: GoBuildSelection;
     external?: ExternalIdentity;
     id: string;
     adapter: string;
@@ -115,6 +119,8 @@ export interface Finding {
     line?: number;
 }
 export interface CheckResult {
+    goScope?: GoScopePolicy;
+    goBuild?: GoBuildSelection;
     external?: ExternalIdentity & {
         tools?: {
             name: string;

package/dist/src/types.js

@@ -1,4 +1,4 @@
-export const VERSION = "0.1.0-alpha.3";
+export const VERSION = "0.1.0-alpha.5";
 export const PARSERS = [
     "vue-router-json",
     "nuxt-json",

package/docs/ACCEPTANCE.md

@@ -7,7 +7,7 @@ separate states. Follow the linked evidence for tested versions and limits.
 
 | Milestone                         | Implemented scope and evidence                                                                                                                                                                                                                                                                                                                                                                                                          | Open acceptance work                                                                                                                                                                                                                           |
 | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| M0: public contracts              | Original public fixtures, MIT license, security/contribution guidance, schemas, explicit package allowlist, dependency notices and CI definitions. `STATUS.md`, `SECURITY.md`, `RELEASE.md`.                                                                                                                                                                                                                                            | Public source, npm alpha.2 and its MCP Registry entry are published. Hosted CI passed at `4ce8398`; fresh registry installation was verified.                                                                                                  |
+| M0: public contracts              | Original public fixtures, MIT license, security/contribution guidance, schemas, explicit package allowlist, dependency notices and CI definitions. `STATUS.md`, `SECURITY.md`, `RELEASE.md`.                                                                                                                                                                                                                                            | Public source, npm alpha.4 and its MCP Registry entry are published. Hosted CI passed at `ebe7f5c`; fresh registry installation was verified.                                                                                                  |
 | M1: executable foundation         | Shared CLI/library/MCP engine, bounded inventory/runner, startup trust, native Node/Python/Go/PHP profiles, protocol and lifecycle regressions. `ARCHITECTURE.md`, `STATUS.md`, `MCP-COMPATIBILITY.md`. Fresh installed application-client profiles now have evidence in `CLIENTS.md`.                                                                                                                                                  | Application-client coverage beyond the named profiles. PHP remains unavailable when the consumer has no prepared runtime.                                                                                                                      |
 | M2: practical language validation | Explicit JS/TS, Python, Go and PHP native tool profiles, structured diagnostics/test evidence, versions, environments, workspace selection, scope accounting, SARIF/JUnit and finding ratchets. `LANGUAGES.md`, adapter documents, `WORKSPACES.md`, `FINDING-POLICY.md`, `NATIVE-CI.md`.                                                                                                                                                | Hosted toolchain profiles passed at `52ba415`. Wider tool versions/framework configurations must be promoted separately; detection is not execution support.                                                                                   |
 | M3: framework/contracts           | Native Laravel, Vue Router/Nuxt, Django/FastAPI assembly projections; imported runtime comparison, explicit architecture boundaries, producer/consumer schemas and a built package consumer. `RUNTIME-INVENTORY.md`, framework documents, `CONTRACTS.md`, `ARCHITECTURE-POLICY.md`, `examples/package-contract/README.md`.                                                                                                              | Broader native semantics/import collection and live service integration are not implemented. Synthetic evidence does not establish equivalent results in a private application; private integration feedback must remain private.              |
@@ -19,9 +19,11 @@ separate states. Follow the linked evidence for tested versions and limits.
 [Public adoption measurements](PUBLIC-ADOPTION.md) now cover five pinned
 JavaScript, TypeScript, Python, Go and PHP libraries. They expose an older
 TypeScript compiler-option incompatibility and workflow/documentation/platform
-coverage friction. An [unreleased compiler fix](TYPESCRIPT.md) now passes the
-known TypeScript 4.9.5 case; workflow/documentation and platform coverage remain
-follow-up work. The observations do not establish full upstream CI coverage or
+coverage friction. The [alpha.3 compiler fix](TYPESCRIPT.md) now passes the
+known TypeScript 4.9.5 case. [Setup guidance](SETUP-SCOPES.md) distinguishes
+workflow/documentation coverage; the alpha.4 [Go scope policy](GO-SCOPE.md)
+accounts for explicitly acknowledged native exclusions. Unreleased [per-check build-tag profiles](GO-BUILD.md)
+add explicit tag selection; broader target coverage remains follow-up work. The observations do not establish full upstream CI coverage or
 general review effectiveness.
 
 1. Extend independently authored evaluation cohorts to additional implemented
@@ -51,10 +53,11 @@ run. The local worker/store are available independently; standard Tasks must sta
 unadvertised until routing and the integrated wire/lifecycle suite pass. See
 `MCP-COMPATIBILITY.md` for the reproduction and upstream issue.
 
-The public repository, npm preview `0.1.0-alpha.2` and its MCP Registry entry are
-published. The [hosted run at 4ce8398](https://github.com/stsepelin/checktrail/actions/runs/35590670960)
-passed all jobs, and fresh public installation was verified. Alpha.2 adds
-[setup commands](ONBOARDING.md). The [GitHub prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.2)
+The public repository, npm preview `0.1.0-alpha.4` and its MCP Registry entry are
+published. The [hosted run at ebe7f5c](https://github.com/stsepelin/checktrail/actions/runs/35603451711)
+passed all jobs, and fresh public installation was verified. Alpha.4 adds
+[explicit Go exclusions](GO-SCOPE.md) alongside [legacy compiler compatibility](TYPESCRIPT.md)
+and the [setup commands](ONBOARDING.md). The [GitHub prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.4)
 is also published with the verified tarball and checksum. npm tag cleanup remains
 unresolved. The repository's explicit-action requirements still apply.
 `RELEASE.md` defines the concrete

package/docs/CLIENTS.md

@@ -1,8 +1,9 @@
 # Application client compatibility
 
-The recorded snapshots below predate the Checktrail rename and retain their
-original package identities. A release candidate needs its own client checks;
-see [RENAMING.md](RENAMING.md).
+The [alpha.4 release record](measurements/release-alpha4.json) repeats the named
+profiles below against the exact published artifact. The original standalone
+snapshots predate the Checktrail rename and retain their original identities.
+A future release needs its own checks; see [RENAMING.md](RENAMING.md).
 
 The local package was installed offline into a fresh temporary consumer and tested
 with Claude Code 2.1.263 and Codex CLI 0.154.0 on macOS arm64, Node 26.8.1. These
@@ -106,4 +107,5 @@ The runtime digest identifies the installed `dist/src` tree independently.
 
 These local checks satisfy only the named client profiles. Claude Desktop,
 Cursor, VS Code integrations, other client versions and target operating systems
-remain unverified. No public package installation or hosted CI run is implied.
+remain unverified. These original snapshots do not establish public installation or hosted CI;
+alpha.4 publication and hosted evidence are recorded separately in [RELEASE.md](RELEASE.md).

package/docs/EXECUTION.md

@@ -21,6 +21,13 @@ an unavailable runtime or external service does not count as verification.
 
 ## M2
 
+- Alpha.5 candidate, unpublished: named per-check Go build-tag profiles with independent
+  exclusions, matching listing/execution settings, unchanged formatting scope,
+  strict missing/ambiguous assignment handling and summary privacy. Native
+  Go/Staticcheck/golangci-lint cases and CLI/library/MCP replay cover the selected
+  configuration; repeated-check and cross-target matrices remain pending.
+  See `GO-BUILD.md` and `examples/go-build`.
+
 - Implemented: explicit local TypeScript and ESLint adapters with file accounting.
 - Implemented: TypeScript project-reference solution validation using fresh
   in-memory declarations, source accounting and normalized compiler diagnostics.

package/docs/GO-BUILD.md

@@ -0,0 +1,106 @@
+# Go build-tag profiles (alpha.5 candidate)
+
+The source checkout supports named build-tag profiles in module-local
+`checktrail.go-build.json`. Published alpha.4 does not support this file. It
+selects additional Go build constraints for each check and keeps that check's
+exclusions explicit. It does not introduce cross-compilation or a target matrix.
+
+## Configure
+
+Continue selecting checks in `checktrail.json`. A build profile does not enable
+checks: `go.test-race`, Staticcheck and golangci-lint still need explicit selection.
+Use the [runnable synthetic example](../examples/go-build/checktrail.go-build.json)
+with [its check selection](../examples/go-build/checktrail.json), or configure:
+
+```json
+{
+  "schemaVersion": 1,
+  "profiles": [
+    {
+      "name": "integration",
+      "tags": ["integration"],
+      "checks": ["go.vet", "go.test"],
+      "excludedFiles": []
+    }
+  ]
+}
+```
+
+Every selected native Go check must be assigned exactly one profile. Missing
+assignments are unavailable; they never silently fall back to an untagged run.
+Profile names and check assignments must be unique. A profile may share its tags
+and exclusions across several checks; other profiles can use different settings.
+Unselected checks are not executed, even if a profile names them. Each check runs
+once. Repeating one check across several profiles is not implemented.
+
+Tags are an array of distinct ASCII identifiers matching
+`[A-Za-z_][A-Za-z0-9_]*`, each at most 64 characters, with at most 32 tags.
+An empty array adds no tags. Profile names start with an ASCII letter and allow
+letters, digits, underscores and hyphens, up to 64 characters. Up to five profiles
+can assign the five supported native checks. Unknown fields, malformed JSON,
+nonregular policy files and invalid exclusions make native checks unavailable.
+
+Each profile has its own `excludedFiles`, using the exact paths and nonblank
+reasons described in [Go scope](GO-SCOPE.md). Excluded files must still be
+inventoried and confirmed by native `IgnoredGoFiles`. An active or stale exclusion
+cannot pass. Listing a source file as excluded never suppresses an actual finding.
+Do not combine this file with `checktrail.go-scope.json`; their overlapping policy
+is rejected. To migrate, move exclusions into each applicable profile and remove
+the old scope policy after reviewing the complete configuration.
+
+## Execution and evidence
+
+Go listing, vet, tests and Staticcheck receive identical `-tags` settings within
+each check. Race tests also keep `-race` in listing and execution. Golangci-lint
+receives the profile tags in its generated configuration; its project's own
+`run.build-tags` remains unsupported to avoid a second source of settings.
+Existing protected Go settings, version checks and tool requirements still apply.
+
+Formatting checks the full inventory once and ignores build profiles. Native
+checks retain their whole inventory and reconcile selected and excluded files
+separately. Tests still need a passing test in each package; test counts and
+failures come from native events. A passing ordinary test does not cover a file
+selected only by the race profile. An exclusion's reason is an operator statement,
+not independent evidence that another check ran or covered it.
+
+Detailed plans/reports add `goBuild` with the profile name and tags alongside
+`goScope` with that profile's exclusions. Summary plans/reports expose only
+`goBuildTagCount` and `goExcludedFileCount`; names, tags and reasons remain private
+unless detailed output is enabled. Counts describe declarations, not proof of
+execution. Older strict report-schema consumers must update before accepting the
+new optional fields. The [policy schema](../schemas/go-build-policy.schema.json)
+defines the data shape; planning also checks duplicate assignments and inventoried
+file membership.
+
+Planning reads data only. Execution still requires CLI/library/operator startup
+trust. Policy files cannot set environment values or arbitrary command arguments.
+Tags do not set `GOOS`, `GOARCH`, the compiler version or enable race instrumentation;
+only the selected race check adds instrumentation. No unselected tag combinations
+or other operating systems are claimed as validated.
+
+## Reproduce
+
+From a built source checkout with Go and a supported race toolchain prepared:
+
+```sh
+node dist/src/cli.js plan --root examples/go-build --detailed
+node dist/src/cli.js run --root examples/go-build --trust-project --detailed --timeout-ms 120000
+node --test dist/test/go-build.test.js
+node scripts/verify-required-native-tests.mjs go
+```
+
+The example's ordinary profile selects the integration test and acknowledges the
+race-only test. The instrumented profile selects both. This demonstrates source
+selection; the arithmetic example does not itself demonstrate race detection.
+The separate [race regression](GO-RACE.md) exercises an actual data race.
+
+The native regression suite exercises tagged compiler errors and assertions,
+valid near misses, undeclared omissions, stale exclusions, missing assignments,
+independent ordinary/race settings, analyzer diagnostics, nonexecuting planning,
+summary privacy and CLI/MCP agreement. Standard schema checks cover the exported
+policy and report shapes. Prepared CI requires these named cases to run; unavailable
+native tools cannot satisfy the required profile.
+
+References: [Go build constraints](https://pkg.go.dev/cmd/go#hdr-Build_constraints),
+[Staticcheck CLI](https://staticcheck.dev/docs/running-staticcheck/cli/),
+[golangci-lint configuration](https://golangci-lint.run/docs/configuration/file/).

package/docs/GO-RACE.md

@@ -10,8 +10,12 @@ cost and requires the operator to select this check.
 The native fixture runs two workers repeatedly updating one shared counter. The
 unprotected version must fail with an actual `DATA RACE` diagnostic; atomic
 updates must pass and yield the exact combined count. A passing run cannot
-establish freedom from races on paths it did not execute. Native package/file evidence now makes excluded source and untested packages
-incomplete; see [Go scope](GO-SCOPE.md). A build/OS matrix is not implemented.
+establish freedom from races on paths it did not execute. Native package/file evidence makes undeclared excluded source and untested packages
+incomplete; see [Go scope](GO-SCOPE.md) for the explicit exclusion policy available since alpha.4.
+Alpha.4 also passes `-race` to package listing so it uses the same build
+constraints as the tests. The unpublished alpha.5 source candidate adds
+[per-check build-tag profiles](GO-BUILD.md), allowing race and ordinary tests to
+use different tags and exclusions. A build/OS matrix is not implemented.
 
 A supported Go race platform and C compiler are required. Compilation and runtime
 errors are retained in detailed output; no compiler, library or toolchain is

package/docs/GO-SCOPE.md

@@ -1,15 +1,16 @@
 # Go scope and Staticcheck
 
-`go.vet`, `go.test`, `go.test-race` and `go.staticcheck` first run native
-`go list -json ./...`. A passing result requires the union of native Go, cgo and
-internal/external test source files to exactly match the inventoried Go files.
+`go.vet`, `go.test`, `go.test-race`, `go.staticcheck` and `go.golangci-lint` first run
+native `go list -json ./...`. The race profile includes `-race` in both listing and
+test execution, so their build constraints agree. By default, a passing result
+requires the union of native Go, cgo and internal/external test source files to
+exactly match the inventoried Go files.
 Malformed package output, missing packages, duplicate/unexpected files and load
 errors prevent completeness. Real diagnostic/test failures retain their failure
 status even when scope is incomplete.
 
 Files excluded by build tags, OS/architecture suffixes or Go directory conventions
-remain unverified. The current policy has no build-matrix or per-file exception
-contract, so such projects are conservatively incomplete. This includes intentional
+remain unverified. Without an explicit scope policy, such projects are conservatively incomplete. This includes intentional
 `testdata` Go files if they are inventoried but not compiled. Do not treat that as
 a source defect or remove valid platform-specific code to obtain a passing run.
 
@@ -26,6 +27,79 @@ programs. Cross-module workspace builds need a separate explicit profile. Native
 compiler/analyzer caches may be used; test result caching remains disabled.
 Dependencies and toolchains must be prepared separately.
 
+## Explicit exclusions (alpha.4 and later)
+
+Alpha.4 adds `checktrail.go-scope.json` at each Go module root. Earlier releases
+do not support this policy. Opt in only after reviewing
+which files the intended native run leaves unverified:
+
+```json
+{
+  "schemaVersion": 1,
+  "excludedFiles": [
+    {
+      "path": "platform_windows.go",
+      "reason": "Windows implementation; validated separately on its target"
+    }
+  ]
+}
+```
+
+Paths are exact, case-sensitive, module-relative inventoried `.go` files. Globs,
+parent traversal, absolute paths, duplicate entries, blank reasons, unknown fields,
+missing files and symlink/directory policy files are rejected. An empty list keeps
+strict coverage. Planning only reads this file; native commands still require
+operator trust. A reason records the operator's statement, not proof of another run.
+The schema is [go-scope-policy.schema.json](../schemas/go-scope-policy.schema.json).
+
+For each selected native check, every declared file must appear in Go's
+`IgnoredGoFiles`, and every other inventoried Go file must appear exactly once in
+its selected source lists. An exemption becomes stale if its file disappears or
+becomes selected. New omissions, duplicate/contradictory native entries, malformed
+or interrupted output remain incomplete. A whole package excluded from `./...`,
+`testdata`, dot/underscore files and arbitrary unlisted files cannot be excused by
+this policy unless native package evidence accounts for them as ignored Go files.
+
+The same policy applies to vet, tests, race tests, Staticcheck and golangci-lint.
+A file ignored by ordinary tests may be selected under `-race`; one shared
+exemption then cannot pass both profiles. Do not exempt active code to suppress a
+diagnostic. Real diagnostics/test failures still fail. Every tested package still
+needs a passing test; exempted source supplies no test evidence. Formatting ignores
+the scope policy and checks every inventoried Go file.
+
+Detailed plans and reports retain the declarations as `goScope`; the original
+`scope` remains the complete inventory. A passing native check covers that scope
+minus its reconciled exemptions. Summary plans and reports expose
+`goExcludedFileCount` without paths or reasons. This is the number declared, even
+on an incomplete or unexecuted plan; it does not independently establish that the
+exemptions reconciled. Other-platform and excluded build-tag behavior is unverified.
+
+This policy does not introduce build-tag flags, cross-compilation, cross-target
+test execution or a build matrix. Use separately prepared native target runs for
+coverage outside the selected profile. Existing protected Go settings stay intact.
+
+The source checkout separately adds [per-check build-tag profiles](GO-BUILD.md).
+They use their own per-profile exclusions and cannot coexist with this module-wide
+policy. That capability is in the unpublished alpha.5 candidate; alpha.4 retains the behavior above.
+
+## Known-case replay
+
+The [pinned public UUID replay](measurements/go-scope-policy-replay.json) uses the
+same upstream revision as the alpha.2 adoption exercise, with an unreleased packed
+CLI/library/MCP. Default scope remains inconclusive for vet/tests. Explicitly
+acknowledging `node_js.go` makes those selected native checks pass while retaining
+the skipped test and the existing formatting failure. An injected failing test
+still fails through all three surfaces. The JavaScript-target file is unverified;
+this is a known-case regression replay, not independent effectiveness evidence.
+The upstream tracked files and original policy were preserved; temporary scope
+policy and failing control were removed. The record identifies the tested tarball
+and runtime source hashes; adding this record changes later package bytes.
+
+The exact alpha.4 release candidate repeated this replay before publication; see
+the [release record](measurements/release-alpha4.json). Its synthetic upgrade test
+also confirms that rolling back to alpha.3 preserves the policy file but restores
+strict scope accounting: a project relying on exclusions becomes incomplete.
+
 ## Staticcheck
 
 Select `go.staticcheck` explicitly. It requires the installed `staticcheck`

package/docs/GOLANGCI-LINT.md

@@ -14,8 +14,8 @@ linters:
   enable: [govet, staticcheck, unused]
 ```
 
-Other linters, nonempty custom settings, formatters and Go build-version/tag
-profiles are incomplete until separately verified. This is deliberately a
+Other linters, nonempty custom settings, formatters and Go version/tag overrides
+in `.golangci.*` are incomplete until separately verified. This is deliberately a
 constrained profile, not support for every golangci-lint configuration. YAML
 duplicates, unsupported tags and excessive aliases are rejected. Planning only
 discovers the local config and source; parsing/native execution occurs with trust.
@@ -27,6 +27,9 @@ read-only module resolution, absolute JSON locations and no extra output files.
 Output and native analyzer cache use a fresh temporary directory, removed after
 normal completion. Existing project config and output paths are not rewritten.
 Native Go source accounting follows [the shared contract](GO-SCOPE.md).
+The alpha.5 source candidate adds [Checktrail build-tag profiles](GO-BUILD.md).
+Those tags are passed to both package listing and the generated native config;
+`.golangci.*` still cannot supply a separate `run.build-tags` setting.
 
 Native `nolint` and Staticcheck ignore directives are currently unsupported and
 make the check incomplete. The wrapper scans Go comment boundaries, including

package/docs/INSTALLATION.md

@@ -1,10 +1,11 @@
 # Install the preview
 
-The published preview is `0.1.0-alpha.2` on
+The published preview is `0.1.0-alpha.4` on
 [npm](https://www.npmjs.com/package/@stsepelin/checktrail).
-Use the exact version below. `next` points to alpha.2; `latest` still points to
+Use the exact version below. `next` points to alpha.4; `latest` still points to
 alpha.1 because npm rejected its removal. Neither tag implies a stable release.
-Alpha.2 includes [project setup and diagnosis](ONBOARDING.md).
+Alpha.4 includes [project setup and diagnosis](ONBOARDING.md), the
+[TypeScript compatibility fix](TYPESCRIPT.md), and explicit [Go scope exclusions](GO-SCOPE.md).
 
 Use Node.js 22 or newer on macOS or Linux. Windows execution is not supported.
 Install each project's compilers, linters and test runners separately; Checktrail
@@ -18,7 +19,7 @@ Skills install separately from the engine and MCP configuration.
 Install the exact version once:
 
 ```sh
-npm install --global --ignore-scripts @stsepelin/checktrail@0.1.0-alpha.2
+npm install --global --ignore-scripts @stsepelin/checktrail@0.1.0-alpha.4
 checktrail --version
 ```
 

package/docs/LANGUAGES.md

@@ -118,10 +118,19 @@ the optional skips allowed by a developer's general test suite.
 
 [Public adoption measurements](PUBLIC-ADOPTION.md) record alpha.2 on pinned
 JavaScript, TypeScript, Python, Go and PHP libraries. TypeScript 4.9.5 rejects
-the adapter's `--noCheck` option; this older version is not verified support.
+alpha.2's `--noCheck` option; that published artifact does not support this profile.
 Go platform exclusions remain inconclusive even when native tests exit zero.
 
-The unreleased [TypeScript compatibility fix](TYPESCRIPT.md) exercises plain
+The alpha.3 [TypeScript compatibility fix](TYPESCRIPT.md) exercises plain
 TypeScript 4.9.5 and 6.0.3 using native capability-aware arguments. Published
 alpha.2 retains the recorded older-compiler limitation; Vue and solution-build
 profiles retain their separately verified versions.
+
+Alpha.4 adds a [Go scope policy](GO-SCOPE.md) for exact,
+native-confirmed ignored files. It retains unverified exclusions in reports and
+does not claim a build matrix or add custom build-tag execution. Published alpha.3
+keeps the original strict exclusion behavior.
+
+The alpha.5 source candidate adds [Go build-tag profiles](GO-BUILD.md) for
+per-check tags and exclusions across vet, tests, race tests, Staticcheck and
+golangci-lint. This is one configuration per selected check, not a target matrix.

package/docs/MCP-COMPATIBILITY.md

@@ -46,6 +46,12 @@ extension handlers run. This was reproduced locally; `tasks/update` reaches its
 handler in the same probe. Upstream tracks the method-registry collision in
 [typescript-sdk#2598](https://github.com/modelcontextprotocol/typescript-sdk/issues/2598).
 
+Rechecked on 2026-09-21: npm's latest server/client SDK versions are still 2.0.0,
+the local probe still returns `-32601` for get/cancel and reaches update, and the
+[proposed upstream fix](https://github.com/modelcontextprotocol/typescript-sdk/pull/2599)
+remains open. The package retains its pinned SDK; no transport interception or
+protocol workaround is introduced.
+
 Run `npm run probe:mcp-tasks` from the source checkout to repeat the routing probe. Exit `2` means one or
 more handlers were unreachable; exit `0` means routing works. A routing success
 does not establish Tasks conformance. The probe is separate from the ordinary

package/docs/ONBOARDING.md

@@ -1,12 +1,13 @@
 # Project setup
 
-These commands are available in `0.1.0-alpha.2`. Follow the
+These commands are available since `0.1.0-alpha.2`. Follow the
 [installation guide](INSTALLATION.md), with Node.js 22+ on macOS/Linux.
 
 [Public adoption observations](PUBLIC-ADOPTION.md) show setup on real libraries,
 including nested documentation projects, workflow prerequisites and older compiler
 limitations. A narrowed policy can pass its selected checks while leaving other
-repository checks unverified.
+repository checks unverified. The [setup scope walkthrough](SETUP-SCOPES.md)
+shows how to inspect those boundaries and interpret an intentionally narrowed policy.
 
 ## Preview and create a policy
 

package/docs/PUBLIC-ADOPTION.md

@@ -55,13 +55,17 @@ operations were checked against the project tree.
 These are recorded adoption gaps, not fixes applied to the immutable alpha.2
 package. No new engine version is published by this exercise.
 
-## Unreleased follow-up
+## Release follow-ups
 
-The [compiler compatibility fix](TYPESCRIPT.md) now passes a known-case mitt replay
-with TypeScript 4.9.5 through a locally packed CLI, library and MCP. The observations
+The [compiler compatibility fix](TYPESCRIPT.md) is published in alpha.3. Its exact
+release artifact passes the known-case mitt replay with TypeScript 4.9.5 through
+the CLI, library and MCP; see [release verification](RELEASE.md). The observations
 above still describe published alpha.2; they are not replaced by the fixed source
-checkout's results. Workflow/documentation setup and Go platform coverage remain
-separate work.
+checkout's results. The [setup scope guide](SETUP-SCOPES.md) explains omitted workflows and documentation.
+Alpha.4 publishes the [Go scope policy](GO-SCOPE.md) for exact native-confirmed
+exclusions. Its [release record](measurements/release-alpha4.json) repeats the known
+UUID case with the exact artifact later published; the excluded JavaScript target stays unverified.
+A target matrix remains separate work.
 
 ## Reproduce