@stsepelin/checktrail 0.1.0-alpha.4 → 0.1.0-alpha.5

package/docs/INSTALLATION.md

@@ -1,11 +1,11 @@
 # Install the preview
 
-The published preview is `0.1.0-alpha.3` on
+The published preview is `0.1.0-alpha.4` on
 [npm](https://www.npmjs.com/package/@stsepelin/checktrail).
-Use the exact version below. `next` points to alpha.3; `latest` still points to
+Use the exact version below. `next` points to alpha.4; `latest` still points to
 alpha.1 because npm rejected its removal. Neither tag implies a stable release.
-Alpha.3 includes [project setup and diagnosis](ONBOARDING.md) and the
-[TypeScript compatibility fix](TYPESCRIPT.md).
+Alpha.4 includes [project setup and diagnosis](ONBOARDING.md), the
+[TypeScript compatibility fix](TYPESCRIPT.md), and explicit [Go scope exclusions](GO-SCOPE.md).
 
 Use Node.js 22 or newer on macOS or Linux. Windows execution is not supported.
 Install each project's compilers, linters and test runners separately; Checktrail
@@ -19,7 +19,7 @@ Skills install separately from the engine and MCP configuration.
 Install the exact version once:
 
 ```sh
-npm install --global --ignore-scripts @stsepelin/checktrail@0.1.0-alpha.3
+npm install --global --ignore-scripts @stsepelin/checktrail@0.1.0-alpha.4
 checktrail --version
 ```
 

package/docs/LANGUAGES.md

@@ -126,7 +126,11 @@ TypeScript 4.9.5 and 6.0.3 using native capability-aware arguments. Published
 alpha.2 retains the recorded older-compiler limitation; Vue and solution-build
 profiles retain their separately verified versions.
 
-The source checkout adds an unreleased [Go scope policy](GO-SCOPE.md) for exact,
+Alpha.4 adds a [Go scope policy](GO-SCOPE.md) for exact,
 native-confirmed ignored files. It retains unverified exclusions in reports and
 does not claim a build matrix or add custom build-tag execution. Published alpha.3
 keeps the original strict exclusion behavior.
+
+The alpha.5 source candidate adds [Go build-tag profiles](GO-BUILD.md) for
+per-check tags and exclusions across vet, tests, race tests, Staticcheck and
+golangci-lint. This is one configuration per selected check, not a target matrix.

package/docs/PUBLIC-ADOPTION.md

@@ -55,15 +55,17 @@ operations were checked against the project tree.
 These are recorded adoption gaps, not fixes applied to the immutable alpha.2
 package. No new engine version is published by this exercise.
 
-## Alpha.3 follow-up
+## Release follow-ups
 
 The [compiler compatibility fix](TYPESCRIPT.md) is published in alpha.3. Its exact
 release artifact passes the known-case mitt replay with TypeScript 4.9.5 through
 the CLI, library and MCP; see [release verification](RELEASE.md). The observations
 above still describe published alpha.2; they are not replaced by the fixed source
 checkout's results. The [setup scope guide](SETUP-SCOPES.md) explains omitted workflows and documentation.
-An unreleased [Go scope policy](GO-SCOPE.md) now supports exact native-confirmed
-exclusions; a target matrix remains separate work.
+Alpha.4 publishes the [Go scope policy](GO-SCOPE.md) for exact native-confirmed
+exclusions. Its [release record](measurements/release-alpha4.json) repeats the known
+UUID case with the exact artifact later published; the excluded JavaScript target stays unverified.
+A target matrix remains separate work.
 
 ## Reproduce
 

package/docs/RELEASE.md

@@ -1,77 +1,109 @@
 # Releases and publication
 
 The source is public at [stsepelin/checktrail](https://github.com/stsepelin/checktrail).
-The published preview is `@stsepelin/checktrail@0.1.0-alpha.3`.
+The published preview is `@stsepelin/checktrail@0.1.0-alpha.4`.
 Its downloaded npm artifact and GitHub release asset match the reviewed SHA-256:
 
 ```text
-261d10acbac14dcd5d74f4b248a390e5790f22461fecd597e29b8044aef2daeb
+4cc6dca5877b29cb452595c1c50233b0d377248f6f6e84e18ffe1b74b2031f8c
 ```
 
-The [GitHub prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.3)
-and tag point to source commit `b0b447d5ea8973b3e427e179201a44b7baa1ca91` and include
-the same tarball plus `SHA256SUMS`. The [hosted release run](https://github.com/stsepelin/checktrail/actions/runs/35597877167)
-passed all jobs. The [MCP Registry entry](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.stsepelin%2Fchecktrail/versions/0.1.0-alpha.3)
+The [GitHub prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.4)
+and tag point to source commit `ebe7f5c114428aebc5084a2a33d38113cad13583` and include
+the same tarball plus `SHA256SUMS`. The [hosted release run](https://github.com/stsepelin/checktrail/actions/runs/35603451711)
+passed all jobs. The [MCP Registry entry](https://registry.modelcontextprotocol.io/v0.1/servers/io.github.stsepelin%2Fchecktrail/versions/0.1.0-alpha.4)
 is active and matches `server.json`, with execution disabled. The Registry omits
 `isSecret: false`, whose schema default is false.
 
 Fresh public-registry installation verified CLI/library validation, generated
 npx startup with fresh/warm caches, onboarding, and MCP pass/fail/incomplete
 results, retained reports and execution denial. The exact artifact also passed
-offline installation, alpha.2 → alpha.3 → alpha.2 upgrade/rollback, the known mitt
-TypeScript 4.9.5 replay, Claude Code health/discovery and Codex direct MCP calls.
-The [release record](measurements/release-alpha3.json) links these observations to
+offline installation, alpha.3 → alpha.4 → alpha.3 upgrade/rollback, the known UUID
+scope replay, Claude Code health/discovery and Codex direct MCP calls. A clean
+archive of the committed source, rebuilt with the same installed compiler and
+dependencies on the same host, produced an identical tarball. This does not
+establish cross-platform reproducibility.
+The [release record](measurements/release-alpha4.json) links these observations to
 the artifact; client profile limits remain in [CLIENTS.md](CLIENTS.md).
 
-## Alpha.4 candidate (unpublished)
-
-The checkout prepares `0.1.0-alpha.4` with optional exact Go file exclusions in
-`checktrail.go-scope.json`. Native package evidence must account for each declared
-exclusion. Active, absent or otherwise unaccounted-for declarations cannot pass.
-Go formatting continues to cover the full source inventory, and race-test package
-discovery now uses the same `-race` constraints as execution. See [GO-SCOPE.md](GO-SCOPE.md).
+## Alpha.5 candidate (unpublished)
+
+The current source metadata identifies `0.1.0-alpha.5`; it has not been published.
+Alpha.4 remains the public preview. Alpha.5 adds named per-check Go build-tag
+profiles in `checktrail.go-build.json`, with independent explicit exclusions.
+Native listing and execution use the same tags, including race and analyzer
+checks. Missing assignments, ambiguous declarations and stale exclusions cannot
+pass. Formatting still checks the full inventory. See [GO build profiles](GO-BUILD.md).
+
+Detailed plans/reports add optional `goBuild` profile/tag metadata. Summary output
+adds only `goBuildTagCount`, alongside the existing exclusion count. Older strict
+schema consumers must update before accepting these fields. Projects must choose
+between the new build-profile policy and the module-wide scope policy; combining
+both is rejected. Each selected check runs once. Repeated-check, cross-target and
+cross-compilation matrices remain unsupported.
+
+Alpha.4 does not understand the new build-profile sidecar. Rolling back preserves
+its bytes but does not apply its tags or exclusions. Revalidate after rollback;
+a project relying on profile-selected files can become incomplete. No claim of
+coverage transfers from one profile or package version to another.
+
+The installed MCP SDK 2.0.0 routing probe was repeated on 2026-09-22: standard
+Tasks remains unavailable and is not advertised by this candidate.
+
+The candidate also makes the task-retention regression deterministic by controlling
+its clock and checking the exact expiry boundary. Production retention logic is
+unchanged. CI action pins have been updated; npm dependency versions are unchanged.
+The source before release preparation passed all 13 [hosted jobs](https://github.com/stsepelin/checktrail/actions/runs/35614737518)
+after retrying an actionlint download that received HTTP 504. The release commit
+still needs its own hosted CI run. Candidate checks and artifact identity belong
+in the concrete release review; this section does not claim publication.
+
+## Alpha.4 scope
+
+Alpha.4 adds optional exact Go file exclusions in `checktrail.go-scope.json`.
+Native package evidence must account for each declared exclusion. Active, absent
+or otherwise unaccounted-for declarations cannot pass. Go formatting continues
+to cover the full source inventory, and race-test package discovery now uses the
+same `-race` constraints as execution. See [GO-SCOPE.md](GO-SCOPE.md).
 
 Detailed plan/report schemas add an optional `goScope` declaration and summaries
 add an optional `goExcludedFileCount`. Consumers that validate with older strict
 schemas must update their schemas before accepting these fields. The policy is
 opt-in; existing projects retain strict scope accounting. Dependencies are unchanged.
 
-Alpha.3 does not understand the new sidecar policy. Rolling back keeps its bytes
-on disk but restores strict Go accounting, so a project relying on exclusions can
-become incomplete. Exclusions never establish validation of another platform or
-custom build-tag configuration. No cross-target execution is added.
-
-Candidate verification and commit approval precede publication. The installed MCP
-SDK routing probe was rechecked on 2026-09-21: standard Tasks remains unavailable;
-see [MCP-COMPATIBILITY.md](MCP-COMPATIBILITY.md). The published preview and artifact
-described above remain alpha.3 until a new release is explicitly authorized and verified.
-
-## Alpha.3 scope
+Alpha.3 does not understand the new sidecar policy. The synthetic Go upgrade test
+verified that rollback keeps its bytes on disk but restores strict Go accounting:
+a project relying on exclusions becomes incomplete. Exclusions never establish
+validation of another platform or custom build-tag configuration. No cross-target
+execution is added.
 
-Alpha.3 fixes the plain TypeScript adapter's unsupported `--noCheck` argument on
-the exercised TypeScript 4.9.5 profile, retaining the TypeScript 6.0.3 override and
-native file accounting. Vue uses the same capability helper with its verified
-modern toolchain; solution-build remains gated to TypeScript 6.0.3. See
-[TYPESCRIPT.md](TYPESCRIPT.md). Dependencies and report/policy schemas did not change.
+The installed MCP SDK routing probe was rechecked on 2026-09-21: standard Tasks
+remains unavailable; see [MCP-COMPATIBILITY.md](MCP-COMPATIBILITY.md). The release
+targets Node.js 22 or newer on macOS and Linux. The immutable tarball contains
+preparation-time candidate documentation; current source documentation records
+verified publication.
 
-The release targets Node.js 22 or newer on macOS and Linux. It does not add
-standard MCP Tasks or legacy Vue support. The historical alpha.2
-[adoption record](PUBLIC-ADOPTION.md) remains unchanged; its initial failures are
-not rewritten as alpha.3 successes. The immutable tarball contains preparation-time
-candidate documentation; current source documentation records verified publication.
+## Distribution tags and previous releases
 
-## Distribution tags and previous release
-
-`next` points to alpha.3. `latest` remains on alpha.1 because npm rejected its
+`next` points to alpha.4. `latest` remains on alpha.1 because npm rejected its
 removal. Use exact versions; neither tag implies a stable release. Never republish
 an existing version. No credentials or automatic publishing workflow are stored here.
 
+The [alpha.3 prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.3)
+fixed the plain TypeScript adapter's unsupported `--noCheck` argument on the
+exercised TypeScript 4.9.5 profile, retaining the TypeScript 6.0.3 override and
+native file accounting. Vue and solution-build retain their separately verified
+versions; see [TYPESCRIPT.md](TYPESCRIPT.md). The [alpha.3 record](measurements/release-alpha3.json)
+preserves its source, artifact, CI and known mitt replay evidence.
+
 The [alpha.2 prerelease](https://github.com/stsepelin/checktrail/releases/tag/v0.1.0-alpha.2)
 introduced [setup and diagnosis](ONBOARDING.md), from source commit `4ce8398`.
 Its reviewed and downloaded artifact has SHA-256
 `ffd0564f40a12a238a52fe25fe8c34fb36cf6f6480be7b6994bab82a3bd657fb`.
 Its [hosted run](https://github.com/stsepelin/checktrail/actions/runs/35590670960)
 and fresh installation checks passed; its npm and Registry versions remain published.
+The historical alpha.2 [adoption record](PUBLIC-ADOPTION.md) remains unchanged;
+its initial failures are not rewritten as later-release successes.
 
 ## Prepared artifacts
 
@@ -89,8 +121,8 @@ and fresh installation checks passed; its npm and Registry versions remain publi
   loads the installed metadata and verifies its actual startup command.
 - CI definitions cover the host suite and prepared native profiles. Local
   containers and package checks are evidence only for the environments actually
-  exercised. The [hosted run at b0b447d](https://github.com/stsepelin/checktrail/actions/runs/35597877167)
-  passed all jobs for the alpha.3 release commit. The local Claude Code health/discovery and
+  exercised. The [hosted run at ebe7f5c](https://github.com/stsepelin/checktrail/actions/runs/35603451711)
+  passed all jobs for the alpha.4 release commit. The local Claude Code health/discovery and
   Codex direct app-server profiles have fresh-install evidence in `CLIENTS.md`.
 
 The metadata follows the official registry

package/docs/STATUS.md

@@ -3,21 +3,30 @@
 This is an experimental foundation with public source at
 [stsepelin/checktrail](https://github.com/stsepelin/checktrail).
 Check the [installation guide](INSTALLATION.md) for package availability and setup.
-The `0.1.0-alpha.3` preview is published on npm and active in the MCP Registry.
-The [hosted run at b0b447d](https://github.com/stsepelin/checktrail/actions/runs/35597877167)
+The `0.1.0-alpha.4` preview is published on npm and active in the MCP Registry.
+The [hosted run at ebe7f5c](https://github.com/stsepelin/checktrail/actions/runs/35603451711)
 passed all jobs. The published tarball matched the reviewed artifact; fresh
 registry installation, CLI/library validation, generated npx startup and MCP
 execution/trust behavior were verified. Earlier toolchain evidence remains in
 `NATIVE-CI.md`; release details and tag limitations are in `RELEASE.md`.
-The GitHub alpha.3 prerelease includes the verified artifact and checksum.
+The GitHub alpha.4 prerelease includes the verified artifact and checksum.
 [Public adoption](PUBLIC-ADOPTION.md) records alpha.2 on five pinned libraries, including incomplete
 coverage and the TypeScript 4.9.5 incompatibility fixed in alpha.3.
 
-## Alpha.4 candidate (unpublished)
+## Alpha.5 candidate (unpublished)
 
-The checkout version is `0.1.0-alpha.4`. Release verification is in progress;
-alpha.3 remains the published preview. No alpha.4 publication or hosted release
-verification is claimed.
+Package, engine and Registry metadata now identify `0.1.0-alpha.5`. The public
+preview remains alpha.4 until the candidate is approved, published and verified.
+
+- [Go build-tag profiles](GO-BUILD.md): each selected native check can use its own
+  named tags and exclusions. Listing and execution agree, formatting remains
+  whole-inventory, and missing or ambiguous assignments are unavailable. Each
+  check runs once; repeating checks across a target matrix is not implemented.
+
+## Alpha.4 release
+
+The [release record](measurements/release-alpha4.json) ties the published artifact
+to hosted CI, fresh installation, client profiles and upgrade/rollback checks.
 
 - [Go scope policy](GO-SCOPE.md): exact per-file declarations can acknowledge
   native build-constraint exclusions. Go must confirm every exemption; stale
@@ -177,7 +186,7 @@ a general speedup/graph-completeness claim.
 ## Release preparation
 
 `server.json`, the npm package and the engine identify the published
-`0.1.0-alpha.3` preview. Its source commit passed hosted CI, the published tarball
+`0.1.0-alpha.4` preview. Its source commit passed hosted CI, the published tarball
 matched the reviewed artifact, and fresh CLI/library/MCP installation checks passed.
 Publication evidence and the sequence for future releases are in `RELEASE.md`.
 
@@ -537,15 +546,23 @@ performance claim follows from these samples.
 
 ## Next implementation work
 
-1. Broaden runtime matrices and native PHP tooling.
-2. Framework-specific scope and integration contracts.
-3. Framework integration and additional verified linter profiles.
-4. Additional ecosystem adapters and their native evidence.
-5. Semantic framework rules and native runtime collectors. Public check profiles,
-   finding ratchets and local private policy overlays are implemented; existing
-   private instruction files have not been migrated.
-6. Durable Tasks support after a compatible SDK passes the routing probe; the
-   lifecycle and persistence acceptance gates are in `MCP-COMPATIBILITY.md`.
+1. Extend the unreleased per-check [Go build-tag profiles](GO-BUILD.md) toward
+   repeated-check and target matrices only after their identities, aggregation
+   and native target evidence are defined. Existing profiles validate only each
+   selected check's configuration.
+2. Integrate standard MCP Tasks after a compatible SDK passes the routing probe.
+   Then verify negotiation, ordinary-call fallback, worker/store integration,
+   cancellation, restart and privacy together; see `MCP-COMPATIBILITY.md`.
+3. Extend independently authored evaluation cohorts to further implemented
+   language/rule families. Preserve frozen evidence and separate known-case
+   replays from independent measurements; see `ACCEPTANCE.md`.
+4. Broaden runtime/tool versions, framework contracts and native collectors only
+   with their own broken/fixed/near-miss evidence and required CI profiles;
+   see `LANGUAGES.md` and `NATIVE-CI.md`.
+5. Resolve the baseline, labeled public cases and adjudication for the planned
+   prior-workflow comparison; see `PRIOR-WORKFLOW-EVALUATION.md`. Existing private
+   instruction files have not been migrated, and publication does not establish
+   equal-or-better review quality.
 
 Complete dependency/tool/environment fingerprints, automatically inferred workspace graphs,
 remote/executable private plugins, native import-graph collection, remote serving, durable Tasks,