clinkx 1.1.0 → 1.1.2

package/docs/verification/project-checks.md

@@ -0,0 +1,444 @@
+# Installed project checks
+
+`verification_run` and `verification_inspect` are tools on the npm-installed
+ClinkX MCP server. Your MCP client can run explicit commands from your project's
+reviewed JSON manifest and inspect retained evidence through that connection.
+No client shell access, ClinkX checkout, Git, browser, or ClinkX development
+dependencies are required. Install Node 24 or newer, ClinkX, and whatever your
+own check commands require on the MCP server's host.
+
+Project execution v1 supports macOS and Linux/POSIX hosts because cleanup owns
+POSIX process groups. A Windows run returns a prerequisite error. Provider
+readiness is a separate tool, [`provider_doctor`](../configuration.md#provider-readiness-doctor).
+
+## Configure project and evidence access
+
+Paths refer to the **MCP server's filesystem**. Configure `CLINKX_ALLOWED_ROOTS`
+in your MCP server launch configuration, then reconnect the client. Use narrowly
+scoped project and private evidence directories; both must exist. For example,
+these entries in your MCP client's server configuration authorize one project
+and its separate evidence parent:
+
+```json
+{
+  "command": "npx",
+  "args": ["-y", "clinkx"],
+  "env": {
+    "CLINKX_ALLOWED_ROOTS": "/absolute/path/to/your-project,/absolute/path/to/private-evidence/."
+  }
+}
+```
+
+The `/.` suffix makes the evidence entry artifact-only: it permits evidence I/O
+without granting it as project source. The project must resolve within an allowed
+source root; an artifact-only root cannot be used as the project. Evidence must
+resolve within an allowed I/O root and outside both the project and installed
+ClinkX package. The server also grants its configured workflow state/artifact
+roots for artifact I/O. These grants do not authorize them as source projects.
+The default project source root is the server's working directory, which may
+differ from the client's project directory; explicit configuration avoids that
+ambiguity.
+
+Allow-roots validate the tool's project and evidence paths. They do not sandbox
+manifest commands or grant permission to execute an unreviewed manifest.
+
+## Define the checks
+
+Save a manifest such as `verification.json` inside your project. Adapt the
+[packaged example](project-checks.example.json) to files and commands that exist
+in your project. The example declares `tests/unit.test.mjs` as an input and runs
+it with Node's test runner; it does not create that test file or supply its
+assertions.
+
+```json
+{
+  "version": 1,
+  "inputs": ["tests/unit.test.mjs"],
+  "checks": [
+    {
+      "id": "unit-tests",
+      "command": "node",
+      "args": ["--test", "tests/unit.test.mjs"],
+      "cwd": ".",
+      "timeout_seconds": 300,
+      "env_allowlist": []
+    }
+  ]
+}
+```
+
+| Field | Contract |
+| --- | --- |
+| `version` | Exactly `1`. Unknown fields are rejected. |
+| `inputs` | 1–1000 unique project-relative regular files whose bytes must remain unchanged, up to 16 MiB each and 64 MiB total. Include the source, tests, configuration, and lockfiles needed to identify your check's target. Directories, absolute paths, escapes, and symlink traversal are rejected. |
+| `checks` | 1–100 required checks, executed sequentially. |
+| `checks[].id` | Unique identifier, 1–64 ASCII letters, digits, underscores, or hyphens; the first character must be a letter or digit. |
+| `checks[].command` | Executable to spawn. No shell string or template substitution. |
+| `checks[].args` | Required argv array, up to 100 entries. Use `[]` for no arguments. Each value is passed literally. |
+| `checks[].cwd` | Optional project-relative working directory, default `.`. Must remain within the project without traversing symlinks. |
+| `checks[].timeout_seconds` | Optional integer timeout, default `300`, range `1`–`3600`. |
+| `checks[].env_allowlist` | Optional environment-variable names to inherit in addition to `PATH`, `HOME`, `USER`, `LANG`, and `TMPDIR`. Default empty. |
+
+Review the manifest before running it. Commands execute with your account's
+permissions and are **not sandboxed**. They can modify your project or access
+resources available to your account. There is no implicit shell, but choosing a
+shell executable explicitly still executes shell code. Keep credentials out of
+arguments and recorded output; allowlist only the environment your check needs.
+
+## Run and retain the owner pin
+
+Select an authorized existing project directory and a new evidence directory
+under an authorized existing parent. The attempt directory must not already
+exist. Call the MCP tool with absolute project and evidence paths and a
+project-relative manifest path:
+
+```json
+{
+  "name": "verification_run",
+  "arguments": {
+    "project": "/absolute/path/to/your-project",
+    "manifest": "verification.json",
+    "evidence": "/absolute/path/to/private-evidence/attempt-001"
+  }
+}
+```
+
+The runner creates the attempt directory privately (mode `0700`) and retained
+files with mode `0600`. It records the manifest, declared input hashes, verifier
+runtime identity, Node version, frozen required checks, host results, and bounded
+stdout/stderr captures. The MCP summary does not echo raw check output. Output
+capture is limited to 1 MiB per stream; truncation fails the affected check.
+
+Keep the original run's `expectations_sha256` digest separately from the editable
+attempt directory, under the evidence owner's control. Keep it with the review
+record that identifies this run. An expectations file or cached summary inside
+the attempt is not an independent owner pin.
+
+Each command's successful exit establishes only that command's contract. Write
+assertions in the test or checking command: a command that prints "passed" and
+exits zero without testing anything provides no useful product proof.
+
+## Inspect the retained evidence
+
+Use the same project, manifest, evidence directory, and the original digest:
+
+```json
+{
+  "name": "verification_inspect",
+  "arguments": {
+    "project": "/absolute/path/to/your-project",
+    "manifest": "verification.json",
+    "evidence": "/absolute/path/to/private-evidence/attempt-001",
+    "expectations_sha256": "<digest retained from the original run>"
+  }
+}
+```
+
+Inspection executes no project commands. It reparses retained host results,
+checks identities and digests, and recomputes coverage without trusting a cached
+success summary. Missing, changed, extra, or conflicting evidence cannot establish
+a complete result. Keep the same installed verifier version and project input
+bytes available when you intend to inspect the original run; changes make the
+original evidence inapplicable. Run a new attempt to qualify a new state.
+
+The runner rehashes declared inputs before and after execution. A command may
+write outputs not listed as inputs, but changing a declared input makes the run
+inapplicable. A command failure, timeout, capture failure, or cleanup failure
+takes precedence over input drift.
+
+| MCP outcome | Meaning |
+| --- | --- |
+| `status:"complete"`, `isError:false` | All required checks have complete evidence for the identified state. |
+| `status:"failed"`, `"incomplete"`, or `"inapplicable"`, `isError:true` | Verification did not establish a pass. Read the returned reasons. |
+| Invalid parameters (`-32602`) | Malformed tool arguments or unauthorized project/evidence paths. |
+| Runtime/prerequisite error, `isError:true` | The attempt cannot establish success; use the diagnostic to correct the prerequisite. |
+
+Readiness, project verification and workflow attachment share a per-server operation slot. An
+additional overlapping call fails immediately with a busy result; it is not
+queued. Wait for the admitted call to finish before retrying. Calls cannot set a
+tool-level timeout or supply inline commands; individual check timeouts belong
+in the reviewed manifest.
+
+The runner owns detached child process groups and stops them on timeout, capture
+failure, MCP request cancellation, and server shutdown, with bounded escalation.
+Cancellation stops remaining checks and drains owned processes before the
+request is released; an interrupted attempt cannot pass. A cancelled request
+has no final MCP result. If an attempt directory was created and you retained
+the original digest, inspect that evidence to establish its status.
+The tool never recursively deletes your evidence directory. Retain evidence
+until review is finished, then remove only the attempts you own.
+
+## Proof limits
+
+This control automatically binds the manifest bytes alongside the **declared
+input files**. Verifier identity covers `package.json`, selected compiled MCP
+handler/shared doctor/collector modules, and the coverage evaluator. The Node
+version is also recorded. It does not bind every runtime dependency's bytes, external executables,
+or environment values. It does not snapshot the whole project or discover
+undeclared dependencies, remote services, browser state, or production behavior.
+Include relevant inputs and choose commands that actually observe the behavior
+you need to qualify.
+
+Evidence capture is a trusted local collector, not attestation against a
+malicious command or host. Raw captures can contain secrets and belong in private
+storage; the tool does not establish that captured output is safe to share.
+Environment filtering limits what is inherited but does not prevent a command
+from reading credentials available elsewhere on the host.
+
+The MCP server does not automatically invoke project verification for workflows.
+Call these tools explicitly from your client. To retain an inspected-at view
+beside an existing workflow, use the attachment tool below.
+
+A complete result grants no acceptance, merge, deployment, or publication
+authority. Record the evidence and have the appropriate owner or independent
+verifier make that decision. ClinkX's own source-checkout regression fixtures
+remain separate; see the [verification overview](README.md).
+
+## Attach an inspected-at record to a workflow
+
+`workflow_verification_attach` re-runs the existing inspector and appends a
+strict `clinkx-workflow-verification-v1` record to an existing retained workflow
+run. This new command/sidecar contract leaves manifest v1, run-state v1, and the
+existing doctor/run/inspect tool inputs unchanged.
+
+```json
+{
+  "name": "workflow_verification_attach",
+  "arguments": {
+    "schema_version": "clinkx-workflow-verification-v1",
+    "request_id": "a9783375-5061-4a43-94b2-5ab9bfe3ba29",
+    "run_id": "your-retained-workflow-run",
+    "project": "/absolute/path/to/your-project",
+    "manifest": "checks.json",
+    "evidence": "/absolute/path/to/private-evidence/attempt-001",
+    "expectations_sha256": "<ORIGINAL independently retained digest>"
+  }
+}
+```
+
+Use a fresh UUID `request_id` for a new inspection. Identical replay returns the
+original record; reusing its UUID with changed evidence/pin/facts fails. History
+is append-only and bounded to 16 records and 160 KiB total per run (128 KiB per
+record). Failed, incomplete, and
+inapplicable inspections are retained with their original supplied pin. A wrong
+pin never authenticates the expected identity or required-check count; both are
+reported as unknown. Neither the attachment nor dashboard substitutes a new pin
+from editable evidence. A run needs retained workflow/input snapshots and its
+original start timestamp; changed snapshot bytes or bindings make the attachment
+unavailable.
+
+The records bind run ID, original start timestamp, and verified workflow/input
+snapshot hashes under a separately versioned generation identity. This identity
+survives read-only Docker mount path/device remapping. A byte-identical copied run
+remains the same historical record; the collector is trusted local storage, not
+tamper-resistant attestation.
+
+`workflow_run_status` and dashboard detail show **historical inspected-at
+coverage**, original expectations digests, declared identity scope, and missing
+or failed checks. They do not re-inspect current source/runtime applicability.
+Current retention is separate: `unknown` means no authorized probe roots were
+provided; `outside_mount` means the original evidence path is outside the reader's
+known mounted roots; `present` confirms only the directory exists; `missing` and
+`unavailable` cannot establish current retention. The Compose dashboard does not
+mount arbitrary private host evidence roots. Re-run `verification_inspect` with
+the same original pin to assess current evidence, then use a new attachment UUID
+to retain that new inspection.
+
+Browser/status projections expose safe digest references and coverage metadata,
+never raw captures or private evidence paths. Caller progress-report test counts
+are self-reported and cannot create a verified badge. Workflow execution,
+verification coverage, and owner acceptance remain independent; acceptance is
+not recorded by this tool.
+
+
+## Native verified repair
+
+The installed `verified-repair` workflow combines scoped replacements with these
+native checks. Invoke it through [`run_workflow`](../engineering-recipes.md#built-in-native-verified-repair).
+For Claude Code or Codex to prepare the inputs and run the repair, use the
+[agent-runtime prompt](../engineering-recipes.md#using-verified-repair-from-an-agent-runtime).
+This is opt-in repair of existing regular UTF-8 files, with at most eight files
+per batch, 64 KiB per file, 128 KiB replacement text per batch and 256 KiB
+serialized proposals. Create/delete/rename, binary files, symlinks and mode
+changes are rejected. No Git changes are performed.
+
+Before invoking, review the defect, source files and manifests and give the run
+exclusive write ownership of the declared paths. Configure three existing,
+nonoverlapping host locations outside the installed package:
+
+```json
+{
+  "command": "npx",
+  "args": ["-y", "clinkx"],
+  "env": {
+    "CLINKX_ALLOWED_ROOTS": "/absolute/project,/absolute/private-evidence/.,/absolute/repair-copies"
+  }
+}
+```
+
+The selected project and disposable-copy parent require **source** roots.
+Artifact-only evidence roots cannot authorize either. The reviewed contract may
+live in the evidence root: root admission reads it as bounded contract data and
+freezes it without widening engine roots or passing the original path to a
+provider. Evidence and copy locations must be outside the selected project.
+Paths are canonical absolute paths on the MCP server host, not on a remote
+client. Symlink aliases are rejected; on macOS use `/private/tmp/...` rather
+than `/tmp/...` when that is the real path. All three directories must already
+exist. The caller may prepare a missing regression harness before admission;
+the workflow itself cannot create a target file.
+
+Write `repair-contract.json` in the evidence directory. Write the regression,
+required-check and copy-preparation manifests inside the selected project at
+the project-relative paths named by the contract. Manifest paths are resolved
+from `project_path`, not from the contract or evidence directory; absolute
+manifest references are invalid. All named source and manifest files must
+already exist on the MCP host before admission.
+
+Example `repair-contract.json`:
+
+```json
+{
+  "schema_version": "clinkx-verified-repair-input-v1",
+  "project_path": "/absolute/project",
+  "evidence_parent": "/absolute/private-evidence",
+  "verification_copy_parent": "/absolute/repair-copies",
+  "defect": {
+    "description": "normalize accepts an invalid empty identifier",
+    "expected_behavior": "normalize rejects empty identifiers"
+  },
+  "source_inputs": ["source.mjs", "regression.mjs"],
+  "regression_paths": ["regression.mjs"],
+  "implementation_paths": ["source.mjs"],
+  "regression_manifest": "regression-checks.json",
+  "required_manifest": "required-checks.json",
+  "copy_preparation": {"status": "declared", "manifest": "copy-preparation.json"},
+  "observation": {
+    "schema_version": "clinkx-regression-outcome-v1",
+    "case_id": "empty_identifier",
+    "assertion_id": "rejects_empty",
+    "check_id": "regression"
+  },
+  "exclusive_write_ownership": true
+}
+```
+
+Each reviewed manifest must include exactly the declared `source_inputs`, with
+no missing or undeclared input. The host captures all their bytes, including
+uncommitted changes, and all manifest bytes before provider dispatch. Writable
+paths must be declared inputs and the regression and implementation sets must
+be disjoint; manifests are immutable throughout the run.
+
+Credential-like paths and detected credential material are rejected before
+the host persists a capture or applies a batch. Vendor token shapes in repair
+artifacts are rejected before workflow publication. Ambient context-builder
+secret settings cannot waive these gates. Detection is bounded and conservative;
+provider filesystem access still has only prompt restrictions.
+
+For the example, `regression-checks.json` uses native manifest v1:
+
+```json
+{
+  "version": 1,
+  "inputs": ["source.mjs", "regression.mjs"],
+  "checks": [{"id": "regression", "command": "node", "args": ["regression.mjs"]}]
+}
+```
+
+The regression manifest must contain exactly its bound observation check.
+`regression.mjs` must print one strict JSON outcome on stdout:
+
+```json
+{"schema_version":"clinkx-regression-outcome-v1","case_id":"empty_identifier","assertion_id":"rejects_empty","outcome":"assertion_failed"}
+```
+
+Use `assertion_failed` plus a nonzero exit only for that exact assertion failure;
+use `assertion_passed` plus exit 0 after it passes. Setup/import/syntax/dependency
+failures must not report an assertion failure. A `harness_error`, wrong identity,
+timeout, signal, excess output, failed cleanup or malformed output blocks
+reproduction. Keep diagnostic noise on bounded stderr; native captures cap each
+stream at 1 MiB. The same test bytes and command must produce the before/fixed
+and independent-copy observations.
+
+Complete the minimal self-contained `.mjs` example with
+`required-checks.json`:
+
+```json
+{
+  "version": 1,
+  "inputs": ["source.mjs", "regression.mjs"],
+  "checks": [
+    {"id": "syntax", "command": "node", "args": ["--check", "source.mjs"]},
+    {"id": "regression", "command": "node", "args": ["regression.mjs"]}
+  ]
+}
+```
+
+For a real project, include the relevant build and test commands and capture
+their required source/configuration files too. Required checks need successful
+exit codes; only the bound regression check requires the strict outcome object.
+Manifests are captured automatically, so they need not be listed in
+`source_inputs`.
+
+`copy-preparation.json` uses the same native format. This example has no external
+dependencies and explicitly declares a no-op:
+
+```json
+{
+  "version": 1,
+  "inputs": ["source.mjs", "regression.mjs"],
+  "checks": [{"id": "prepare", "command": "node", "args": ["-e", "process.exit(0)"]}]
+}
+```
+
+For a dependency-bearing project, use reviewed commands that supply only
+project-declared dependencies in the captured copy. Preparation must not change
+captured source or regression bytes. It is not sandboxed. Do not copy credentials
+or undeclared dependency trees. Commands run in the project/copy root by default;
+they use literal argv, so shell operators in `args` do not create a shell script.
+If preparation cannot be supplied, declare
+`{"status":"unavailable","reason":"<specific prerequisite>"}` instead;
+the repair cannot become verified without independent execution.
+
+All commands use literal argv, without a shell. Providers cannot invent or
+replace reviewed commands. Generic provider filesystem restrictions are prompt
+instructions, not enforced isolation; declared-input drift is detected but the
+workflow does not protect the entire environment from external writers.
+
+The host applies admitted batches one file at a time through rename and records
+completed writes. This is not a multi-file transaction. A partial write,
+failed check or cancellation preserves edited files and evidence. Interrupted
+or ambiguous mutations cannot resume; status and inspection remain available.
+Never infer owner acceptance from workflow completion or reviewer approval.
+
+Independent review must bind the exact fixed source and original proof pins,
+return `approve` and contain zero material findings. Nonblocking findings are
+retained. The host then runs the frozen regression in its captured disposable
+copy, removes only the admitted implementation changes there, observes the same
+failure, restores the fixed bytes and observes the pass. It never undoes the fix
+in the selected working tree. Final native required coverage and attachment
+identify the actual selected tree; copy evidence identifies the copy only.
+
+Read `workflow_run_status` with `include_result:true` for the terminal repair
+record. `verified`, `blocked`, `incomplete` and `failed` remain separate from
+execution status and `owner_acceptance: not_recorded`. The dashboard projects
+historical published facts and inspection history, not a new current-source
+inspection. Retain original expectation pins independently; do not extract a
+replacement pin from editable evidence.
+
+Every repair status read validates the retained record within a 256 KiB bound;
+`include_result` controls whether that body is returned. Equal-size corruption
+is unavailable. If a worker dies before terminal publication, the root MCP
+server can read the retained capture and independently pinned admitted batches
+to classify declared files as original, replacement or unknown. This is an
+`inspected_at` interruption record with no successful proof or cleanup claim.
+It executes no commands, performs no writes and cannot resume the mutation.
+An altered proposal cannot authenticate later owner bytes. The dashboard has
+no project capability, so an interrupted run without a published record stays
+unavailable there.
+
+A hard process death before rename or cleanup can leave a
+`.clinkx-repair-*.tmp` file beside a declared target. Interrupted inspection
+does not delete it; confirm run ownership before manual cleanup. A cancelled
+command retains its failed native check, while interruption before a command
+has no completed check. Repair qualification and execution status report those
+facts separately.

package/docs/verification/workflow-handoff.md

@@ -0,0 +1,113 @@
+# Workflow evidence handoff
+
+This source-checkout procedure qualifies the actual YAML loader, `ClinkSession`,
+`WorkflowEngine`, validators, and `ArtifactStore` using a controlled MCP child.
+Two parallel producers write independently assigned checks; one final consumer
+opens the delivered files and reports their bytes. The host compares the
+persisted artifacts and consumer reads with requirements frozen before dispatch.
+The consumer's `complete` verdict does not establish coverage.
+
+The child is a local deterministic fixture. This procedure does not authenticate
+an LLM provider, exercise native Codex execution, or prove dashboard behavior.
+It adds no installed workflow or public MCP tool.
+
+Installed project-check evidence can separately be attached to a retained
+workflow through the versioned `workflow_verification_attach` tool; see
+[the project-check guide](project-checks.md#attach-an-inspected-at-record-to-a-workflow).
+The dashboard shows historical inspected-at proof, with current retention and
+owner acceptance separate. This fixture remains a source-checkout procedure and
+does not itself manufacture that project-command attachment.
+
+## Prerequisites and ownership
+
+- Node 24 or later, repository dependencies installed, and a full build.
+- A private evidence root outside the source checkout. Each run creates a new
+  attempt directory; it refuses to reuse an existing one.
+- One build owner. Do not edit sources, install dependencies, or rebuild while
+  an attempt is running. Source and compiled-file byte digests bind the attempt
+  to the state it exercises.
+- Retain the original expectations digest outside the attempt. Inspection uses
+  that owner-selected digest rather than trusting an editable cached summary.
+
+## Run and inspect
+
+Build once:
+
+```bash
+npm run build:all
+```
+
+Choose an existing private root, then a fresh attempt name. The procedure sends
+no provider prompts or credentials. Its stdout is one JSON result; diagnostics
+go to stderr.
+
+```bash
+: "${EVIDENCE_ROOT:?set an existing private evidence root outside the checkout}"
+ATTEMPT="$EVIDENCE_ROOT/workflow-handoff-001"
+node scripts/verify-workflow-handoff.mjs run "$ATTEMPT" \
+  > "$EVIDENCE_ROOT/workflow-handoff-001.result.json"
+```
+
+Require exit zero and `status:"complete"`. Preserve `expectations_sha256` from
+the result outside the attempt. For example:
+
+```bash
+EXPECTED_SHA="$(node -e 'const fs=require("node:fs"); const r=JSON.parse(fs.readFileSync(process.argv[1],"utf8")); if(r.status!=="complete" || !/^[a-f0-9]{64}$/.test(r.expectations_sha256)) process.exit(1); process.stdout.write(r.expectations_sha256)' \
+  "$EVIDENCE_ROOT/workflow-handoff-001.result.json")"
+node scripts/verify-workflow-handoff.mjs inspect "$ATTEMPT" \
+  --expectations-sha256 "$EXPECTED_SHA"
+```
+
+Inspection reparses retained producer, consumer, and execution evidence. It
+ignores the cached coverage in `proof.json`, checks recorded artifact sizes and
+digests, and compares applicability with the current source and build. A changed
+checkout requires a new run. Rebuild only after the earlier run has finished.
+
+## Evidence and outcomes
+
+Keep the attempt directory and the owner-selected expectations digest together
+with the command and exit status. The retained records include:
+
+- `expected.json`: nonempty check set, producer-to-check ownership, attempt
+  identities, expected artifact paths, and source/build/procedure digests.
+- The generated YAML and producer artifacts: the actual loader input and
+  validated bytes saved by `ArtifactStore`.
+- The consumer artifact: actual delivered paths, byte sizes, and SHA-256 values.
+- `process-result.json` and the controlled child's exit record: execution and
+  cleanup evidence, with the fixture boundary stated explicitly.
+- `proof.json`: record references and digests, published after execution and
+  cleanup. Its cached coverage is a convenience, not the inspection oracle.
+
+`complete` requires every authorized check with readable matching bytes and
+successful execution. Missing producer evidence is `incomplete`; mismatched
+source/build/attempt identity is `inapplicable`; independently observed execution,
+consumer, or cleanup failures remain `failed` even when identity has drifted.
+Conflicting evidence, wrong ownership, or a failed check is `failed`. Failure takes precedence over gaps,
+and all applicable reasons remain visible. Identical replay is idempotent.
+
+Exit `0` means complete coverage, `1` means failed, incomplete, or inapplicable
+evidence, and `2` means invalid input or unavailable prerequisites. None grants
+acceptance, merge, or publication authority.
+
+## Negative cases and cleanup
+
+The integration suite executes either producer failing, both producers failing,
+swapped check ownership, an unreadable delivered file, and an empty artifact
+store with no omission records. It requires the final consumer to run even when
+producer evidence is missing. Inspector tests alter raw evidence while leaving
+the cached summary complete, and check changed bytes, path escape, execution
+status, and changes to independently pinned requirements.
+
+```bash
+npx vitest run \
+  clinkx-workflows/tests/verification-proof.test.ts \
+  clinkx-workflows/tests/integration/verification-handoff.test.ts \
+  tests/verify-workflow-handoff.test.ts
+```
+
+The runner owns and stops its child session. It retains evidence after cleanup,
+including failed attempts. An interrupted or unpublished attempt cannot become
+complete merely because earlier artifacts exist. The task owner controls
+retention and may remove an attempt after its review and diagnostic use end.
+These digests identify bytes under a trusted local collector; they are not an
+attestation against a malicious collector or operating system.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clinkx",
-  "version": "1.1.0",
-  "description": "ClinkX MCP STDIO server — CLI-to-CLI bridge tool",
+  "version": "1.1.2",
+  "description": "ClinkX MCP STDIO server \u2014 CLI-to-CLI bridge tool",
   "type": "module",
   "engines": {
     "node": ">=24.0.0"
@@ -15,6 +15,16 @@
     "dist",
     "conf",
     "CHANGELOG.md",
+    "docs/configuration.md",
+    "docs/security.md",
+    "docs/engineering-recipes.md",
+    "docs/verification/README.md",
+    "docs/verification/project-checks.md",
+    "docs/verification/project-checks.example.json",
+    "docs/verification/dashboard-real-disk.md",
+    "docs/verification/workflow-handoff.md",
+    "scripts/provider-doctor-core.mjs",
+    "scripts/provider-doctor-probe.mjs",
     "clinkx-workflows/dist",
     "!clinkx-workflows/dist/workflows/!(index).*",
     "clinkx-workflows/workflows",
@@ -77,10 +87,7 @@
   },
   "license": "UNLICENSED",
   "author": "jim380",
-  "homepage": "https://github.com/jim380/clink-mcp#readme",
-  "bugs": {
-    "url": "https://github.com/jim380/clink-mcp/issues"
-  },
+  "homepage": "https://www.npmjs.com/package/clinkx",
   "repository": {
     "type": "git",
     "url": "https://github.com/jim380/clink-mcp.git"