driftproof 0.11.1 → 0.11.2

package/README.md

@@ -13,17 +13,19 @@ there were too few draws to tell, the receipt says so.
  — live badge for the bundled `commit-message-conventions` example, generated from its own receipt.
 
 **[Quickstart](https://driftproofhq.com/#quickstart)** ·
-**[Latest report](https://driftproofhq.com/reports/008/)** ·
+**[Latest report](https://driftproofhq.com/reports/010/)** ·
 [driftproofhq.com](https://driftproofhq.com)
 
 Driftproof **consumes** the [`agentskills.io/evals`](https://agentskills.io) eval
 format; it does not invent its own.
 
-📊 **Eight published reports** (each re-derived from committed receipts, nothing
-hand-entered), spanning six published report types, the newest being release
-drift. All eight share one band-based, floor-gated verdict rule and
-differ in what moves underneath the skill — or, in the value report, in which
-axes are measured; or, in the instrument re-measurement, in the instrument itself:
+📊 **Ten published reports** (each re-derived from committed files, nothing
+hand-entered: Driftproof's receipts, or for Report #010 the upstream harness's own
+output), spanning seven published report types, the newest being instrument
+comparison. The nine that measure with Driftproof read its own arms by one
+band-based, floor-gated verdict rule and differ in what moves underneath the
+skill — or, in the value report, in which axes are measured; or, in the instrument re-measurement, in the
+instrument itself; or, in the instrument comparison, in which instrument measures:
 
 - **[Report #001](https://driftproofhq.com/reports/001/)** — *release drift*: ten
   public agent skills across a current-vs-previous Sonnet release; 9 of 10 showed
@@ -76,11 +78,25 @@ axes are measured; or, in the instrument re-measurement, in the instrument itsel
   receipts, which is what makes the delta attributable to the model rather than
   to the instrument. One case sits inside the verdict on the effect floor alone
   and the report names it.
+- **[Report #009](https://driftproofhq.com/reports/009/)** — *instrument
+  comparison*: three skills from one plugin, one case each, measured by Claude
+  Code's native plugin eval and by Driftproof on the same SKILL.md bytes, task
+  prompts and rubrics. The two tools apply different treatments and grade
+  differently, so the report reads them side by side, ranks neither, and states
+  what each can and cannot establish. Both tools judged with `claude-opus-5`,
+  which departs from the judge policy, so its figures are not comparable with
+  Reports #001 to #008.
+- **[Report #010](https://driftproofhq.com/reports/010/)** — *instrument
+  comparison*: one skill's own behavioural eval from its upstream repository, run
+  five times under each of two Claude Code configurations at one commit: 8 passed
+  and 2 failed, both failures on one expectation the skill's ADR instructions do
+  not state. No Driftproof measurement was taken and no Driftproof judge ran, and
+  the report does not isolate what caused the variation.
 
 ✍️ The launch essay, **[Three model releases later: what actually happens to agent
-skills](https://driftproofhq.com/writing/three-releases/)**, reads all eight reports
+skills](https://driftproofhq.com/writing/three-releases/)**, reads all ten reports
 together: what moves underneath a skill, what the skill costs to run, and what a
-corrected instrument did to three published results. Revised 2026-09-01; every
+corrected instrument did to three published results. Revised 2026-09-22; every
 figure in it is gate-checked against the report page it cites.
 
 ## Why
@@ -305,7 +321,7 @@ A receipt is the unit of evidence — one JSON document conforming to
     "model_release_date": "2025-10-01",
     "provider": "anthropic",
     "surface": "claude-cli",
-    "runner_version": "0.11.1",
+    "runner_version": "0.11.2",
     "date_utc": "2026-07-27T…Z",
     "registry": "registered",
     "transcripts": "hashes-only",
@@ -384,7 +400,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: driftproofhq/driftproof@v0.11.1
+      - uses: driftproofhq/driftproof@v0.11.2
         with:
           skill-dir: skills/my-skill
           models: claude-haiku-4-5
@@ -479,7 +495,7 @@ site, so it reflects a real dated run, not a hand-set color.
 
 ## Reports
 
-Eight reports are published, spanning six report types. A report page lives at a
+Ten reports are published, spanning seven report types. A report page lives at a
 draft path — `docs/reports/NNN-draft/` — until the publish sequence renames it, and
 `scripts/build-public.sh` excludes every `*-draft/` path from the published tree
 (see the roll at the top of this README, and
@@ -487,6 +503,8 @@ draft path — `docs/reports/NNN-draft/` — until the publish sequence renames
 Each report and every verdict in it are **re-derived from the receipts** committed
 under [`receipts/`](receipts/)
 (`receipts/report-001/` … `receipts/report-006/`) — nothing is hand-entered.
+Report #010 takes no Driftproof measurement and has no receipts: it is re-derived
+from the upstream harness's output files, published beside its page.
 
 Driftproof does **not** commit third-party skill content. Each `SKILL.md` is
 fetched at run time from a pinned commit and verified by sha256 against

package/config.js

@@ -9,7 +9,7 @@ const PROJECT_NAME = 'driftproof';
 // Bumped whenever the runner's behaviour or receipt-generation semantics change
 // in a way that could affect results. Recorded into every receipt as
 // run.runner_version so a receipt is reproducible against a known engine.
-const RUNNER_VERSION = '0.11.1';
+const RUNNER_VERSION = '0.11.2';
 
 // The eval format we CONSUME (we deliberately do not invent our own).
 const SUITE_FORMAT = 'agentskills.io/evals';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "driftproof",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "A dated proof that this skill, this hash, this model, still helps: run a skill's eval suite with and without the skill across model versions, emit hash-verified dated receipts, and diff receipts into drift reports.",
   "license": "Apache-2.0",
   "keywords": [
@@ -36,7 +36,7 @@
     "diff": "node bin/driftproof diff"
   },
   "dependencies": {
-    "ajv": "^8.17.1"
+    "ajv": "^8.18.0"
   },
   "optionalDependencies": {
     "@anthropic-ai/sdk": "^0.39.0"

package/spec/RECEIPT.md

@@ -183,7 +183,7 @@ carry a numeric `mean`.
 ## Which schema validates which receipt (the coexistence rule)
 
 - **A producer emits the current version.** `config.js` `RECEIPT_SCHEMA_VERSION`
-  decides it, and at this revision that is **v0.6**.
+  decides it, and at this revision that is **v0.7**.
 - **A reader validates against the receipt's own `schema_version`**, never
   against the newest schema it happens to have. `validateReceipt()` selects the
   schema by that field, which is why a v0.1 receipt from the first report still