driftproof 0.11.3 → 0.12.0

package/README.md

@@ -256,7 +256,9 @@ A skill directory is expected to look like:
 my-skill/
   SKILL.md              # the skill instructions (required)
   evals/evals.json      # agentskills.io/evals suite (required)
-  .driftproofrc         # optional per-project run defaults (models, samples, max_usd)
+  .driftproofrc         # optional run defaults (models, max_usd); samples, max_cases
+                        # and judge_model are read only from the working directory's rc
+                        # (the GitHub Action reads no working-directory rc at all)
   ...                   # any bundled files (contribute to content_hash)
 ```
 
@@ -332,7 +334,7 @@ A receipt is the unit of evidence — one JSON document conforming to
     "model_release_date": "2025-10-01",
     "provider": "anthropic",
     "surface": "claude-cli",
-    "runner_version": "0.11.3",
+    "runner_version": "0.12.0",
     "date_utc": "2026-07-27T…Z",
     "registry": "registered",
     "transcripts": "hashes-only",
@@ -411,7 +413,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: driftproofhq/driftproof@v0.11.3
+      - uses: driftproofhq/driftproof@v0.12.0
         with:
           skill-dir: skills/my-skill
           models: claude-haiku-4-5
@@ -427,6 +429,13 @@ model, uploads the whole receipt directory as a build artifact, and renders the
 run on three surfaces: the **badge**, a **job summary** carrying one row per
 requested model, and the **check title** of the enforcement step.
 
+**The checkout's `.driftproofrc` is not read.** The action starts the run in an
+empty working directory, so no key of a `.driftproofrc` at the repository root
+is read, and a skill directory's `.driftproofrc` may not set `max_cases`,
+`samples` or `judge_model`. Both files are pull-request content, and a pull
+request may not narrow the run that measures it. The run takes its models and
+caps from the inputs above.
+
 **The decision is taken over every receipt the run produced.** Each requested
 model gets one decision state, and the run's `verdict` is the **worst** of them —
 worst first, in this order:
@@ -490,6 +499,47 @@ surface. The CLI has carried its own input contract at its own door since
 `npx driftproof` refuses a malformed cap or model id before it projects a run.
 Neither statement covers the other. Said of the Action, of CI, or of the runner, "hostile input is refused" is only ever true of the one surface it was measured on.
 
+### Scheduled stale check
+
+`driftproof stale` says whether each receipt's conclusion still stands under the model, harness,
+skill, suite and judge that would run today. The staleness check runs it on a schedule in your
+repository. While any receipt needs a rerun or a regrade, one issue labelled `driftproof-stale` lists
+each one, what moved, and the command to run next. Later runs update that issue, and the first run
+that finds everything current closes it. It makes no model call and needs no API key.
+
+Copy [`examples/workflows/driftproof-stale.yml`](examples/workflows/driftproof-stale.yml) into
+`.github/workflows/`. It runs weekly and on demand, with these permissions and no others:
+
+```yaml
+permissions:
+  contents: read
+  issues: write
+# ...
+      - uses: driftproofhq/driftproof/stale@v0.12.0
+        with:
+          receipts: receipts/**/*.json
+          skill: skills/my-skill
+```
+
+| Input | Default | What it does |
+|---|---|---|
+| `receipts` | `receipts/**/*.json` | Glob of receipt files, one per line for several. |
+| `skill` | none | The skill directory as it is today. Without it, the skill axis reads unknown. |
+| `suite` | the skill's `evals/evals.json` | The eval suite file. |
+| `model`, `judge` | `.driftproofrc` | The model and the judge that would run today. |
+| `harness-version` | `latest` | A Claude Code version, `latest` (read from npm), or `none` (not checked). |
+| `strict` | `false` | Count an unknown axis or an advisory as stale. |
+| `fail-on-stale` | `false` | Fail the job while anything is stale. |
+| `open-issue` | `true` | Keep the issue. |
+| `issue-label` | `driftproof-stale` | Give each check its own label to keep separate issues. |
+| `github-token` | the workflow's token | Used for the issue only. |
+
+The job fails on an error, such as a receipt that does not validate, and on stale only when
+`fail-on-stale` is `'true'`. A patch release of the harness alone (2.1.280 to 2.1.281) is an
+advisory: the job summary reports it and nothing fails. An axis that cannot be known is reported as
+unknown, never as current. Outputs: `result` (`current`, `advisory`, `stale` or `error`),
+`stale-count`, `issue-number` and `report-dir`.
+
 ### Badge
 
 `driftproof badge <receipt>` emits a [shields.io endpoint](https://shields.io/badges/endpoint-badge)

package/bin/driftproof

@@ -8,7 +8,7 @@ const { PROJECT_NAME, RUNNER_VERSION, DEFAULT_JUDGE_SAMPLES, DEV_MAX_USD, DEV_MA
 const { loadSkill } = require('../lib/skill');
 const { runSkillOnModel, summarizeReceipt, projectCalls, answeredLine, band, uncertaintyStr } = require('../lib/run');
 const { SAMPLING } = require('../lib/sampling');
-const { validateReceipt, verifyReceiptHash, duplicateCaseRows, ambiguityLine } = require('../lib/receipt');
+const { validateReceipt, verifyReceiptHash, duplicateCaseRows, ambiguityLine, listReceipts, receiptBaseName, fileSlug, REGRADE_SIDECAR, SUMMARY_SIDECAR } = require('../lib/receipt');
 const { buildDriftReport, revisionPairProblem } = require('../lib/diff');
 const { surfaceForModel, isSubscriptionSurface, resolveModel, evalUser } = require('../lib/provider');
 const { estimateRunCostUSD, BudgetTracker } = require('../lib/cost');
@@ -33,7 +33,7 @@ function writeTranscripts(receipt, transcripts) {
   const manifest = { receipt_hash: receipt.receipt_hash, model_id: receipt.run.model_id, date_utc: receipt.run.date_utc, entries: [] };
   for (const t of transcripts) {
     if (!t) continue;
-    const base = `${slug(t.id)}-${t.mode}`;
+    const base = `${fileSlug(t.id)}-${t.mode}`;
     fs.writeFileSync(path.join(dir, `${base}.json`), JSON.stringify({ id: t.id, mode: t.mode, generation: t.generation, judge_outputs: t.judge_outputs }, null, 2));
     manifest.entries.push(`${base}.json`);
   }
@@ -75,24 +75,67 @@ function refuseAmbiguous(receipt, file, command) {
   process.exit(2);
 }
 
-// Read an optional .driftproofrc (JSON) for per-project run defaults. Looked up
-// in the skill dir first (where `driftproof init` writes it), then the CWD. CLI
-// flags always win over the rc; the rc wins over built-in defaults.
+// ── A RECEIPT THAT DOES NOT VALIDATE IS NOT RENDERED (spec 062, register row 2) ─
+// badge and decide verified the hash and never validated, so a sealed receipt whose
+// schema_version named an Object.prototype property rendered `passing` and decided
+// `helped`. Called after refuseUnverified, and after refuseAmbiguous where a surface
+// calls that, so spec 050's exit 2 for an ambiguous receipt stands: nothing on
+// stdout, no file, the reason on stderr naming the file, exit 4 as for a receipt
+// whose hash does not verify.
+function refuseInvalid(receipt, file, command) {
+  const { valid, errors } = validateReceipt(receipt);
+  if (valid) return;
+  const first = errors[0] || {};
+  console.error(`  ✗ REFUSED (${command}): ${path.basename(file)} does not validate against its schema (${errors.length} error(s); ${first.instancePath || '/'} ${first.message || ''}); nothing rendered. Run driftproof validate on it for the list.`);
+  process.exit(4);
+}
+
+// Read an optional .driftproofrc (JSON) for per-project run defaults: the CWD's,
+// then the skill dir's (where `driftproof init` writes it). CLI flags always win
+// over the rc; the rc wins over built-in defaults.
+//
+// Spec 062 (register row 6): an rc that does not parse is REFUSED, exit 2, naming
+// the file. It used to be ignored, so a trailing comma ran the project with the
+// built-in budget and caps instead of the ones the file set.
+//
+// Spec 062 (register row 4): the skill directory is the skill's content (in the
+// Action, pull-request content), and it may not narrow the run that measures it.
+// max_cases, samples and judge_model are read from the working directory's rc
+// only; set in the skill directory's they are ignored and named on stderr. When
+// the working directory IS the skill directory, its rc is the skill's.
+//
+// Spec 069: in the Action the checkout's root is pull-request content too, so
+// action/run.sh starts `run` from an empty directory and no working-directory
+// rc is read there at all.
+const SKILL_RC_IGNORED = ['max_cases', 'samples', 'judge_model'];
+function readRc(p) {
+  if (!fs.existsSync(p)) return {};
+  let rc;
+  try { rc = JSON.parse(fs.readFileSync(p, 'utf8')); } catch (e) {
+    console.error(`  ✗ REFUSED: ${p} is not valid JSON (${e.message}); nothing run. Fix the file or remove it.`);
+    process.exit(2);
+  }
+  if (!rc || typeof rc !== 'object' || Array.isArray(rc)) {
+    console.error(`  ✗ REFUSED: ${p} is not a JSON object; nothing run. Fix the file or remove it.`);
+    process.exit(2);
+  }
+  return rc;
+}
 function loadRc(skillDir) {
   const merged = {};
-  for (const dir of [process.cwd(), skillDir].filter(Boolean)) {
-    const p = path.join(dir, '.driftproofrc');
-    try {
-      if (fs.existsSync(p)) Object.assign(merged, JSON.parse(fs.readFileSync(p, 'utf8')));
-    } catch (_e) { /* a malformed rc is ignored, not fatal */ }
+  const skillRcDir = skillDir ? path.resolve(skillDir) : null;
+  if (path.resolve(process.cwd()) !== skillRcDir) Object.assign(merged, readRc(path.join(process.cwd(), '.driftproofrc')));
+  if (skillRcDir) {
+    const p = path.join(skillRcDir, '.driftproofrc');
+    const rc = readRc(p);
+    const dropped = SKILL_RC_IGNORED.filter((k) => Object.hasOwn(rc, k));
+    for (const k of dropped) delete rc[k];
+    if (dropped.length) console.error(`  note: ${p} sets ${dropped.join(', ')}; ignored, because a skill directory may not narrow the run that measures it (set them as flags, or in the working directory's .driftproofrc when you run the CLI yourself; the GitHub Action reads no working-directory .driftproofrc)`);
+    Object.assign(merged, rc);
   }
   return merged;
 }
 
-// Flags that never take a value, so `--trusted-skill <skill-dir>` keeps the dir
-// positional instead of swallowing it as the flag's value.
-const BOOLEAN_FLAGS = new Set(['trusted-skill', 'svg', 'count-errored-runs', 'strict', 'no-harness-check']);
-
 // ── THE INPUT CONTRACT (spec 026 AC-9, F5) ────────────────────────────────────
 // A COPY of action/lib.sh's RE_* rules, in the shape spec 028's fixture holds
 // them; specs/026-receipt-integrity/fixtures/input-contract.json carries the
@@ -168,21 +211,75 @@ function checkNumericInputs(flags, rc) {
   return out;
 }
 
+// Spec 062 (register row 6): `--name=value` is the flag `name` with the value
+// `value`, the empty value included. It used to be a flag named `name=value`, which
+// no command read, so `--max-usd=0.01` ran with the default budget.
+//
+// A flag that takes no value is set by its name alone, so `--trusted-skill <skill-dir>`
+// keeps the dir positional instead of swallowing it as the flag's value (spec 106: all
+// eight, where three used to take the next argument). Given with `=`, or followed by a
+// boolean word, it is refused, exit 2, naming it, for every command (A-062-3, spec 106):
+// `--trusted-skill=false` and `--trusted-skill false` each turned the same-user lane on.
+const NO_VALUE_FLAGS = new Set(['trusted-skill', 'svg', 'count-errored-runs', 'strict', 'no-harness-check', 'keep-transcripts', 'github-output', 'enforce']);
+const BOOLEAN_WORD = /^(true|false|yes|no|on|off|1|0)$/i;
+function refuseValue(key, given) {
+  console.error(`  \u2717 REFUSED: --${key} takes no value, and was given one (${given}). Give --${key} alone to set it, or leave it out. Nothing run, no receipt written.`);
+  process.exit(2);
+}
 function parseArgs(argv) {
   const positional = [];
   const flags = {};
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
+    const eq = a.startsWith('--') ? a.indexOf('=') : -1;
+    if (eq > 2 && NO_VALUE_FLAGS.has(a.slice(2, eq))) refuseValue(a.slice(2, eq), a);
+    if (eq > 2) { flags[a.slice(2, eq)] = a.slice(eq + 1); continue; }
     if (a.startsWith('--')) {
       const key = a.slice(2);
       const next = argv[i + 1];
-      if (BOOLEAN_FLAGS.has(key) || next === undefined || next.startsWith('--')) { flags[key] = true; }
+      if (NO_VALUE_FLAGS.has(key) && next !== undefined && BOOLEAN_WORD.test(next)) refuseValue(key, `${a} ${next}`);
+      if (NO_VALUE_FLAGS.has(key) || next === undefined || next.startsWith('--')) { flags[key] = true; }
       else { flags[key] = next; i++; }
     } else positional.push(a);
   }
   return { positional, flags };
 }
 
+// Spec 062 (register row 6): the two commands that spend refuse a flag they do not
+// take, exit 2, naming it, before anything is read or printed. A misspelt cap flag
+// used to be read by nothing, and the run went ahead with the default cap. The
+// `node:util` parseArgs rewrite, one table per command, is later work.
+const COMMAND_FLAGS = {
+  run: ['models', 'samples', 'max-cases', 'max-calls', 'judge-model', 'concurrency', 'max-usd', 'keep-transcripts', 'out', 'trusted-skill'],
+  regrade: ['skill', 'answers', 'judge-model', 'samples', 'max-calls', 'max-usd', 'out', 'trusted-skill'],
+};
+function refuseUnknownFlags(command, flags) {
+  const unknown = Object.keys(flags).filter((k) => !COMMAND_FLAGS[command].includes(k));
+  if (!unknown.length) return;
+  console.error(`  ✗ REFUSED (${command}): unknown flag ${unknown.map((k) => `--${k}`).join(', ')}; ${command} takes ${COMMAND_FLAGS[command].map((k) => `--${k}`).join(', ')}. Nothing run, no receipt written.`);
+  process.exit(2);
+}
+
+// Spec 106: the same two commands take one argument. Another positional is refused, exit 2,
+// naming each one given and the one taken, before anything is read. A word after a flag that
+// takes no value (`--trusted-skill maybe`), or a single-dash `-trusted-skill`, used to be
+// dropped with no word.
+function refuseExtraPositionals(command, positional, placeholder) {
+  if (positional.length <= 1) return;
+  console.error(`  ✗ REFUSED (${command}): ${command} takes one argument and was given ${positional.length}: ${positional.join(', ')}. It took ${positional[0]} as ${placeholder}, and would read none of ${positional.slice(1).join(', ')}. A flag that takes no value is given alone. Nothing run, no receipt written.`);
+  process.exit(2);
+}
+
+// A skill that cannot be loaded because a link stands where it is read (spec 062,
+// register row 5) is refused like any other input, naming the path.
+function loadSkillOrRefuse(skillDir, command) {
+  try { return loadSkill(skillDir); } catch (e) {
+    if (!e || e.code !== 'SKILL_LINK') throw e;
+    console.error(`  ✗ REFUSED (${command}): ${e.message}. Nothing measured, no receipt written.`);
+    process.exit(2);
+  }
+}
+
 function usage() {
   console.log(`${PROJECT_NAME} v${RUNNER_VERSION} — continuous verification of agent skills
 
@@ -202,7 +299,7 @@ USAGE
                         [--summary FILE] [--enforce] [--fail-on-regression true|false]
   ${PROJECT_NAME} import <results.json> --from agent-skills-eval|skillgrade [--out DIR]
   ${PROJECT_NAME} import <file|dir> --from claude-plugin-eval|skill-creator [--count-errored-runs] [--out DIR]
-  ${PROJECT_NAME} export <receipt.json> [--to summary-json] [--report-url URL] [--out FILE]
+  ${PROJECT_NAME} export <receipt.json> [--to summary-json] [--report-url URL] [--out FILE|DIR]
 
 ENV
   CLAUDE_PROVIDER   api | cli   (default: cli — spawns \`claude -p\`, strips ANTHROPIC_API_KEY)
@@ -273,13 +370,14 @@ NOTES
     (driftproof/summary v1) other tools can consume without a receipt parser.`);
 }
 
-function slug(s) { return String(s).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, ''); }
 // An imported receipt whose source records no date carries date_utc null (receipt v0.9).
 function dateStamp(iso) { return iso ? iso.slice(0, 10) : 'undated'; }
 
 async function cmdRun(positional, flags) {
   const skillDir = positional[0];
   if (!skillDir) { usage(); process.exit(2); }
+  refuseUnknownFlags('run', flags);
+  refuseExtraPositionals('run', positional, '<skill-dir>');
 
   // Per-project defaults from .driftproofrc (if any); CLI flags override these.
   const rc = loadRc(skillDir);
@@ -322,7 +420,7 @@ async function cmdRun(positional, flags) {
   fs.mkdirSync(outDir, { recursive: true });
 
   let skill;
-  try { skill = loadSkill(skillDir); } catch (e) {
+  try { skill = loadSkillOrRefuse(skillDir, 'run'); } catch (e) {
     // Spec 050 AC-1: a suite whose case ids collide is refused before the projection and
     // before any call, naming the suite file, like the empty suite below.
     if (!e || e.code !== 'DUPLICATE_CASE_ID') throw e;
@@ -441,10 +539,13 @@ async function cmdRun(positional, flags) {
       process.exitCode = 1;
     }
 
-    const base = `${slug(skill.name)}-${slug(receipt.run.model_id)}-${dateStamp(receipt.run.date_utc)}`;
+    // Spec 062 (register row 3): the name carries the receipt's own hash, so a second
+    // run on the same day names a second file, and the file is created, never
+    // replaced: a name already taken is a receipt already written.
+    const base = receiptBaseName({ skill: skill.name, model: receipt.run.model_id, date: dateStamp(receipt.run.date_utc), hash: receipt.receipt_hash });
     const jsonPath = path.join(outDir, `${base}.json`);
     const mdPath = path.join(outDir, `${base}.summary.md`);
-    fs.writeFileSync(jsonPath, JSON.stringify(receipt, null, 2));
+    fs.writeFileSync(jsonPath, JSON.stringify(receipt, null, 2), { flag: 'wx' });
     fs.writeFileSync(mdPath, summarizeReceipt(receipt));
     emitted.push(jsonPath);
 
@@ -561,6 +662,8 @@ function cmdStale(positional, flags) {
 async function cmdRegrade(positional, flags) {
   const receiptPath = positional[0];
   if (!receiptPath) { console.error('  ✗ regrade: a receipt path is required\n'); usage(); process.exit(2); }
+  refuseUnknownFlags('regrade', flags);
+  refuseExtraPositionals('regrade', positional, '<receipt.json>');
   for (const f of ['skill', 'answers', 'judge-model']) {
     if (typeof flags[f] !== 'string' || !flags[f]) { console.error(`  ✗ REFUSED (regrade): --${f} is required; nothing run, no receipt written.`); process.exit(2); }
   }
@@ -575,7 +678,7 @@ async function cmdRegrade(positional, flags) {
   const maxUsd = checked['max-usd'] !== undefined ? parseFloat(checked['max-usd']) : DEV_MAX_USD;
   const trusted = !!flags['trusted-skill'];
   const outDir = flags.out ? path.resolve(flags.out) : RECEIPTS_DIR;
-  const skill = loadSkill(flags.skill);
+  const skill = loadSkillOrRefuse(flags.skill, 'regrade');
   const answersFile = path.resolve(flags.answers);
   const answersBytes = fs.readFileSync(answersFile);
   const answers = (JSON.parse(answersBytes.toString('utf8')) || {}).answers || {};
@@ -618,14 +721,16 @@ async function cmdRegrade(positional, flags) {
   if (!valid) { console.error('  ✗ regraded receipt FAILED schema validation:', JSON.stringify(errors, null, 2)); process.exitCode = 1; }
   if (!verifyReceiptHash(out)) { console.error('  ✗ receipt_hash does not verify'); process.exitCode = 1; }
   fs.mkdirSync(outDir, { recursive: true });
-  const base = `${slug(out.skill.name)}-${slug(out.run.model_id)}-regrade-${slug(judgeModel)}-${dateStamp(out.run.date_utc)}`;
+  const base = receiptBaseName({ skill: out.skill.name, model: out.run.model_id, tag: `regrade-${fileSlug(judgeModel)}`, date: dateStamp(out.run.date_utc), hash: out.receipt_hash });
   const jsonPath = path.join(outDir, `${base}.json`);
-  fs.writeFileSync(jsonPath, JSON.stringify(out, null, 2));
+  fs.writeFileSync(jsonPath, JSON.stringify(out, null, 2), { flag: 'wx' });
   fs.writeFileSync(path.join(outDir, `${base}.summary.md`), summarizeReceipt(out));
   const provenance = { ...result.provenance, answers: { file: path.basename(answersFile), sha256: sha256(answersBytes), graded: plan.draws } };
-  fs.writeFileSync(path.join(outDir, `${base}.regrade.json`), JSON.stringify(provenance, null, 2));
+  // The sidecar's name is lib/receipt.js's, which the directory readers skip by (spec 069).
+  const sidecar = `${base}${REGRADE_SIDECAR.suffix}`;
+  fs.writeFileSync(path.join(outDir, sidecar), JSON.stringify(provenance, null, 2));
   console.log(`  → ${path.relative(process.cwd(), jsonPath)}  (${result.calls} judge calls)`);
-  console.log(`  → verification_level ${out.verification_level}; provenance: ${base}.regrade.json\n`);
+  console.log(`  → verification_level ${out.verification_level}; provenance: ${sidecar}\n`);
 }
 
 function cmdValidate(positional) {
@@ -677,6 +782,7 @@ function cmdBadge(positional, flags) {
   const receipt = JSON.parse(fs.readFileSync(p, 'utf8'));
   refuseUnverified(receipt, p, 'badge');
   refuseAmbiguous(receipt, p, 'badge');
+  refuseInvalid(receipt, p, 'badge');
   if (flags.svg) {
     // SPEC 036. The drawn badge: state, model, date, lift and uncertainty, with the
     // machine token in its data attributes. After the same hash check as the JSON.
@@ -714,7 +820,8 @@ function cmdBadge(positional, flags) {
 // read; when --models is given the requested list governs, so a model with no
 // receipt is `refused` and can be the worst state.
 function cmdBadgeSet(dir, flags) {
-  const files = decision.receiptFiles(dir);
+  const listed = listReceipts(dir);
+  const files = listed.map((l) => l.file);
   if (files.length === 0) {
     console.error(`  \u2717 REFUSED (badge): ${dir} holds no receipts; a badge over nothing is a badge about nothing.`);
     process.exit(2);
@@ -722,13 +829,17 @@ function cmdBadgeSet(dir, flags) {
   // Every receipt is verified before it is displayed, exactly as the
   // single-receipt path does (spec 026 AC-20): a set is not a way around the
   // check, and the file that fails is named.
-  for (const f of files) {
-    const r = JSON.parse(fs.readFileSync(f, 'utf8'));
-    refuseUnverified(r, f, 'badge');
+  // An unreadable file is left to the decision, which fails its model closed and
+  // names it (spec 030 AC-2), as `decide` does.
+  for (const { file, receipt } of listed) {
+    if (!receipt) continue;
+    refuseUnverified(receipt, file, 'badge');
+    // Spec 062: validated too. A receipt with duplicate rows is left to the decision's
+    // `refused` state (spec 050 AC-3), which fails closed.
+    if (!duplicateCaseRows(receipt).length) refuseInvalid(receipt, file, 'badge');
   }
-  const models = flags.models || files
-    .map((f) => JSON.parse(fs.readFileSync(f, 'utf8')))
-    .map((r) => r.run && r.run.model_id).filter(Boolean).join(',');
+  const models = flags.models || listed
+    .map((l) => l.receipt && l.receipt.run && l.receipt.run.model_id).filter(Boolean).join(',');
   const d = decision.decideSet(dir, models);
   if (flags['github-output']) { console.log(decision.githubOutputLines(d)); return; }
   const badge = decision.badgeEndpointForSet(d);
@@ -781,10 +892,11 @@ function cmdDecide(positional, flags) {
   // is unreadable and fails closed on both, naming which (spec 030 AC-2,
   // absence-vs-unreadable). Refusing it here would collapse that distinction
   // into an exit code.
-  for (const f of decision.receiptFiles(dir)) {
-    let receipt;
-    try { receipt = JSON.parse(fs.readFileSync(f, 'utf8')); } catch (_e) { continue; }
-    refuseUnverified(receipt, f, 'decide');
+  for (const { file, receipt } of listReceipts(dir)) {
+    if (!receipt) continue;
+    refuseUnverified(receipt, file, 'decide');
+    // Spec 062 (register row 2): and validated, as badge is.
+    if (!duplicateCaseRows(receipt).length) refuseInvalid(receipt, file, 'decide');
   }
   const failOnRegression = String(flags['fail-on-regression'] ?? 'true') !== 'false';
   const d = decision.decideSet(dir, flags.models, { failOnRegression });
@@ -854,8 +966,10 @@ function cmdImport(positional, flags) {
   // Spec 049 (approval F-2): the two formats it adds produce several documents per skill, model and
   // day (one per iteration or per results directory), so their receipt name carries the document's
   // own hash and one import never overwrites another's receipt. The same document names the same file.
-  const doc = receipt.run.import && ANTHROPIC_TOOLS.includes(from) ? `-${receipt.run.import.source_sha256.slice(0, 12)}` : '';
-  const base = `${slug(receipt.skill.name)}-${slug(receipt.run.model_id)}-imported-${slug(from)}-${dateStamp(receipt.run.date_utc)}${doc}`;
+  // The same base-name rule as a run's (spec 062), with the source document's hash in
+  // the receipt hash's place, so the name spec 049 gave an import is unchanged.
+  const doc = receipt.run.import && ANTHROPIC_TOOLS.includes(from) ? receipt.run.import.source_sha256 : null;
+  const base = receiptBaseName({ skill: receipt.skill.name, model: receipt.run.model_id, tag: `imported-${fileSlug(from)}`, date: dateStamp(receipt.run.date_utc), hash: doc });
   const jsonPath = path.join(outDir, `${base}.json`);
   fs.writeFileSync(jsonPath, JSON.stringify(receipt, null, 2));
   if (read !== p) console.log(`read ${path.relative(process.cwd(), read)}`);
@@ -869,7 +983,7 @@ function cmdImport(positional, flags) {
 function cmdExport(positional, flags) {
   const p = positional[0];
   const to = flags.to || 'summary-json';
-  if (!p) { console.error('usage: driftproof export <receipt.json> [--to summary-json] [--report-url URL] [--out FILE]'); process.exit(2); }
+  if (!p) { console.error('usage: driftproof export <receipt.json> [--to summary-json] [--report-url URL] [--out FILE|DIR]'); process.exit(2); }
   if (to !== 'summary-json') { console.error(`unknown export target "${to}" — supported: summary-json`); process.exit(2); }
   const { toSummaryJson } = require('../lib/export');
   const receipt = JSON.parse(fs.readFileSync(p, 'utf8'));
@@ -878,10 +992,14 @@ function cmdExport(positional, flags) {
   const summary = toSummaryJson(receipt, { reportUrl: typeof flags['report-url'] === 'string' ? flags['report-url'] : null });
   const json = JSON.stringify(summary, null, 2);
   if (flags.out) {
-    const out = path.resolve(flags.out);
+    // An existing directory gets the receipt's base name with the summary suffix, the name
+    // listReceipts skips beside its receipt (spec 107); any other path is written as given.
+    let shown = flags.out;
+    if (fs.existsSync(path.resolve(shown)) && fs.statSync(path.resolve(shown)).isDirectory()) shown = path.join(shown, path.basename(p, '.json') + SUMMARY_SIDECAR.suffix);
+    const out = path.resolve(shown);
     fs.mkdirSync(path.dirname(out), { recursive: true });
     fs.writeFileSync(out, json + '\n');
-    console.log(`summary written to ${flags.out}  (${summary.verdict}, delta ${summary.delta === null ? 'n/a' : summary.delta})`);
+    console.log(`summary written to ${shown}  (${summary.verdict}, delta ${summary.delta === null ? 'n/a' : summary.delta})`);
   } else {
     console.log(json);
   }

package/config.js

@@ -9,7 +9,7 @@ const PROJECT_NAME = 'driftproof';
 // Bumped whenever the runner's behaviour or receipt-generation semantics change
 // in a way that could affect results. Recorded into every receipt as
 // run.runner_version so a receipt is reproducible against a known engine.
-const RUNNER_VERSION = '0.11.3';
+const RUNNER_VERSION = '0.12.0';
 
 // The eval format we CONSUME (we deliberately do not invent our own).
 const SUITE_FORMAT = 'agentskills.io/evals';

package/lib/decision.js

@@ -17,11 +17,10 @@
 // here, in lib/, rather than in the shell, because `bin/driftproof badge` needs
 // it too and because a decision state is a property of a receipt.
 
-const fs = require('fs');
 const path = require('path');
 const { EFFECT_FLOOR } = require('../config');
-const { shortModel, githubOutputEntry, receiptVerdict, drawsLine, UNDERPOWERED_LINE } = require('./verdict');
-const { duplicateCaseRows, ambiguityLine } = require('./receipt');
+const { shortModel, githubOutputEntry, receiptVerdict, readCases, drawsLine, UNDERPOWERED_LINE } = require('./verdict');
+const { duplicateCaseRows, ambiguityLine, suiteNarrowed, listReceipts, fileSlug } = require('./receipt');
 
 // The six decision states (spec 030 AC-4).
 //
@@ -96,37 +95,48 @@ function decisionState(receipt) {
   const level = receipt.verification_level;
   const kind = receipt.run && receipt.run.answered_by ? receipt.run.answered_by.kind : undefined;
   if (level !== 'TESTED' || kind !== 'model') return 'not measured';
+  // Spec 062 (register row 1): THE MEASURED CASES BEFORE THE INCOMPLETE RULE. Until this an
+  // incomplete run read `inconclusive` before any case was read, so one unmeasured case hid a
+  // regression another case had measured: the same receipt read `regression`, exit 1, with every
+  // case measured, and `inconclusive`, exit 0, with one with-skill arm unmeasured (the register's
+  // pass 2 probe 7). A case that separated down was measured whatever happened to the others.
+  if (readCases(receipt).some((c) => c.state === 'separated-down')) return 'regression';
   const cmp = receipt.comparison || {};
-  if ((receipt.run && receipt.run.status === 'incomplete') || typeof cmp.delta !== 'number') return 'inconclusive';
+  // Incomplete: a case failed (run.status), or the receipt ran fewer cases than its suite holds
+  // (spec 062, register row 4).
+  if ((receipt.run && receipt.run.status === 'incomplete') || suiteNarrowed(receipt) || typeof cmp.delta !== 'number') return 'inconclusive';
   // Spec 035: the measured states are the receipt verdict's, read per case by the
   // band rule (lib/verdict.js receiptVerdict), not the aggregate delta against the floor.
-  // receiptVerdict refuses on the same four conditions the two clauses above split
-  // between `not measured` and `inconclusive`, so it cannot answer NOT_MEASURED here.
-  return MEASURED_STATE[receiptVerdict(receipt).verdict];
+  const verdict = receiptVerdict(receipt).verdict;
+  // Spec 062: every verdict has a state. NOT_MEASURED is reachable here - a receipt whose every
+  // case was dropped reads it by spec 036's no_readable_case rung - and until this it had no row
+  // in the table, so the state was undefined and the model left the set (pass 6 V3).
+  if (!Object.hasOwn(MEASURED_STATE, verdict)) throw new Error(`decisionState: the verdict ${JSON.stringify(verdict)} has no decision state`);
+  return MEASURED_STATE[verdict];
 }
 
-const MEASURED_STATE = { REGRESSED: 'regression', PASSED: 'helped', UNDERPOWERED: 'underpowered', NO_EFFECT: 'no detected effect' };
+const MEASURED_STATE = { REGRESSED: 'regression', PASSED: 'helped', UNDERPOWERED: 'underpowered', NO_EFFECT: 'no detected effect', NOT_MEASURED: 'not measured' };
 
 // The worst state in a set, by STATE_ORDER. An empty set has no decision, and
-// says so with null rather than defaulting to something benign.
+// says so with null rather than defaulting to something benign. A state this
+// ordering does not know is refused (spec 062): skipping it dropped its model
+// from the decision, which is a pass by omission.
 function worstState(states) {
   let worst = null;
   for (const s of states) {
     const i = STATE_ORDER.indexOf(s);
-    if (i < 0) continue;
+    if (i < 0) throw new Error(`worstState: unknown decision state ${JSON.stringify(s)}`);
     if (worst === null || i < STATE_ORDER.indexOf(worst)) worst = s;
   }
   return worst;
 }
 
-// Every receipt in a directory, excluding the summaries and the badge writer's
-// own earlier output. Mirrors what action/run.sh's glob selected from, so the
-// set this reads is the set that was there to be read.
+// Every receipt file in a directory, by lib/receipt.js listReceipts (spec 062): the files that
+// parse and carry receipt_hash or results and are no sidecar by name and shape (spec 069), and the
+// files that do not parse. Until spec 062 it was
+// every `.json` but the summaries and badge.json, so a regrade sidecar was read as a receipt.
 function receiptFiles(dir) {
-  return fs.readdirSync(dir)
-    .filter((f) => f.endsWith('.json') && !f.includes('.summary.') && f !== 'badge.json')
-    .sort()
-    .map((f) => path.join(dir, f));
+  return listReceipts(dir).map((e) => e.file);
 }
 
 // Parse the `models` input the same way the runner does: comma-separated, with
@@ -159,9 +169,11 @@ function matchesModel(receiptModelId, requested) {
 function fileNamesModel(file, requested) {
   const base = path.basename(file);
   // Both spellings, for the reason `matchesModel` takes both: a receipt for
-  // `claude-haiku-4-5-20251001` answers a request for `claude-haiku-4-5`.
+  // `claude-haiku-4-5-20251001` answers a request for `claude-haiku-4-5`. Each is
+  // looked for in the form the runner writes it, lib/receipt.js fileSlug (spec 062): an
+  // id with a dot or a capital is not in the file name as itself.
   for (const id of new Set([requested, shortModel(requested)])) {
-    if (base.includes(`-${id}-`)) return true;
+    if (base.includes(`-${fileSlug(id)}-`)) return true;
   }
   return false;
 }
@@ -173,12 +185,8 @@ function fileNamesModel(file, requested) {
 // row that is simply absent. That is the whole of AC-2: absence is not a pass.
 function decideSet(dir, requestedCsv, { failOnRegression = true } = {}) {
   const requested = parseModels(requestedCsv);
-  const files = receiptFiles(dir);
-  const loaded = files.map((f) => {
-    let receipt = null, error = null;
-    try { receipt = JSON.parse(fs.readFileSync(f, 'utf8')); } catch (e) { error = e.message; }
-    return { file: f, receipt, error };
-  });
+  const loaded = listReceipts(dir);
+  const files = loaded.map((l) => l.file);
   const used = new Set();
   const rows = requested.map((model) => {
     // Spec 050 AC-6: EVERY readable receipt that matches, not the first. Until this the

package/lib/export.js

@@ -8,8 +8,9 @@
 // Documented in docs/interop.md; snapshot-tested in the gate.
 
 const { verdictFromReceipt } = require('./verdict');
+const { SUMMARY_SIDECAR } = require('./receipt');
 
-const SUMMARY_FORMAT = 'driftproof/summary';
+const SUMMARY_FORMAT = SUMMARY_SIDECAR.format;
 const SUMMARY_FORMAT_VERSION = '1';
 
 // Build the summary object for one receipt. Deterministic for a given receipt:

package/lib/init.js

@@ -11,7 +11,9 @@ const path = require('path');
 //   <dir>/evals/evals.json    — an eval suite with 3 example cases, each rubric
 //                               anchored at 0.80 (the scoring convention the
 //                               example suite and Report #001 use)
-//   <dir>/.driftproofrc       — per-project run defaults (budget, models, samples)
+//   <dir>/.driftproofrc       - per-project run defaults (budget, models). No samples,
+//                               max_cases or judge_model: a skill directory's rc may not
+//                               set them, and `run` ignores them there (spec 062).
 //
 // NEVER overwrites an existing file — every write is guarded, and an existing
 // path is reported as "skipped". Safe to re-run.
@@ -89,7 +91,6 @@ function rcTemplate() {
   return {
     _comment: 'Per-project driftproof defaults. CLI flags override these. See `driftproof help`.',
     models: 'claude-haiku-4-5',
-    samples: 5,
     max_usd: 2,
   };
 }

package/lib/receipt.js

@@ -57,20 +57,28 @@ const BAND_RULE = 'per arm: the sample standard deviation (n-1) of the per-case
 const FAILED_STATUSES = ['failed_timeout', 'failed_unmeasured'];
 function caseFailed(c) { return !!(c && c.case_status && c.case_status !== 'ok'); }
 
-const _validators = {};
+// Spec 062 (register row 2): the table is read by OWN key and the cache is a Map. Until this
+// the lookup was `SCHEMA_FILES[version]`, so a receipt whose schema_version named an
+// Object.prototype property ("constructor", "toString") found something truthy, fell back to
+// the current schema's cached validator and read VALID; and a version nobody knew was checked
+// against the current schema as though it had claimed it. A version that is not a row here has
+// no schema, and a receipt with no schema is not valid.
+const _validators = new Map();
 // Lazily compile the JSON Schema validator (ajv) for a given version. Kept lazy
 // so the library can be required without ajv present (pure hashing utilities).
+// Returns null for a version the table does not hold.
 function getValidator(version) {
-  const v = SCHEMA_FILES[version] ? version : RECEIPT_SCHEMA_VERSION;
-  if (_validators[v]) return _validators[v];
+  if (typeof version !== 'string' || !Object.hasOwn(SCHEMA_FILES, version)) return null;
+  if (_validators.has(version)) return _validators.get(version);
   let Ajv;
   // The schema is JSON Schema draft 2020-12, so use ajv's 2020 build.
   try { Ajv = require('ajv/dist/2020'); }
   catch (_e) { throw new Error('receipt validation requires the `ajv` package (npm install)'); }
-  const schema = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'spec', SCHEMA_FILES[v]), 'utf8'));
+  const schema = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'spec', SCHEMA_FILES[version]), 'utf8'));
   const ajv = new Ajv({ allErrors: true, strict: false });
-  _validators[v] = ajv.compile(schema);
-  return _validators[v];
+  const validate = ajv.compile(schema);
+  _validators.set(version, validate);
+  return validate;
 }
 
 // Compute the receipt_hash: sha256 over the canonical receipt JSON with the
@@ -118,9 +126,16 @@ function ambiguityLine(dups) {
 
 // Validate against the schema matching the receipt's own schema_version (so both
 // v0.1 and v0.2 receipts validate). Returns { valid, errors, version }.
+//
+// Spec 062: a schema_version that is absent, or is not a version the table holds, is invalid,
+// with no fallback to the current schema. Absent is not read as current: every receipt the
+// runner and the importers write carries one.
 function validateReceipt(receipt) {
-  const version = (receipt && receipt.schema_version) || RECEIPT_SCHEMA_VERSION;
+  const version = receipt && typeof receipt === 'object' ? receipt.schema_version : undefined;
   const validate = getValidator(version);
+  if (!validate) {
+    return { valid: false, errors: [{ instancePath: '/schema_version', message: `unknown schema_version ${JSON.stringify(version === undefined ? null : version)}: not a version this validator holds (${Object.keys(SCHEMA_FILES).join(', ')}); no other schema was tried` }], version };
+  }
   const valid = validate(receipt);
   const errors = valid ? [] : (validate.errors || []);
   // v0.8 (spec 043 AC-2): run.judge.samples and run.counts.judge_samples_per_generation
@@ -137,6 +152,94 @@ function validateReceipt(receipt) {
   return { valid: errors.length === 0, errors, version };
 }
 
+// Spec 062 (register row 4): whether a receipt ran fewer cases than its suite holds. The receipt
+// records the ids it ran (results.cases) and the suite's count (suite.case_count), not the
+// suite's ids, so a receipt narrows its suite when either arm names fewer distinct case ids than
+// the suite counts (R-5). A failed case keeps its rows, so it is not a cut. A
+// narrowed receipt is not a reading of the suite its suite_hash names, and both readers treat it
+// as incomplete (lib/verdict.js receiptVerdict, lib/decision.js decisionState).
+function suiteNarrowed(receipt) {
+  const n = receipt && receipt.suite ? receipt.suite.case_count : undefined;
+  if (!Number.isInteger(n)) return false;
+  const ids = { with_skill: new Set(), baseline: new Set() };
+  for (const c of (receipt.results && receipt.results.cases) || []) if (c && ids[c.mode]) ids[c.mode].add(c.id);
+  return ids.with_skill.size < n || ids.baseline.size < n;
+}
+
+// ── receipt files (spec 062, register row 3) ────────────────────────────────
+// The writer's naming rule and the readers' listing rule, in one module. Until this the name was
+// assembled in bin/driftproof and read back by lib/decision.js with a different rule: a second run
+// on the same day overwrote the first, a regrade sidecar in the directory was read as a receipt
+// that did not verify, and a model id with a dot was looked for in a name that held its slug.
+
+// The file-name form of a skill name or a model id. Named for what it is rather than `slug`: the
+// probe-copies rule reads an exported name, and spec 054's probe has a heading-anchor `slug` of its
+// own that is not this function (spec 062 A-062-1).
+function fileSlug(s) { return String(s).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, ''); }
+
+// <skill>-<model>[-<tag>]-<date>[-<hash12>]. `hash` is the first 12 characters of the receipt's
+// own receipt_hash for a run, so two runs on one day name two files; an import passes its source
+// document's hash, which keeps the name spec 049 gave it.
+function receiptBaseName({ skill, model, date, hash = null, tag = null }) {
+  return [fileSlug(skill), fileSlug(model), ...(tag ? [tag] : []), date, ...(hash ? [String(hash).slice(0, 12)] : [])].join('-');
+}
+
+// The regrade provenance sidecar: its name is the receipt's base name with this suffix, and its
+// `format` names this version. `regrade`'s writers read both from here (lib/regrade.js the format,
+// bin/driftproof the name), so the listing rule below is the writer's own (spec 069).
+const REGRADE_SIDECAR = { suffix: '.regrade.json', format: 'driftproof-regrade/2' };
+const REGRADE_FAMILY = REGRADE_SIDECAR.format.split('/')[0];
+
+// The summary export kept beside its receipt: `export --out <dir>` names it the receipt's base name
+// with this suffix, and lib/export.js stamps this format on it (spec 107). It carries the receipt's
+// receipt_hash as a reference, so the listing rule below skips it by name and shape.
+const SUMMARY_SIDECAR = { suffix: '.summary.json', format: 'driftproof/summary' };
+
+// The files a writer puts beside a receipt that carry its receipt_hash and are not receipts. A file
+// is one of these only when its name AND its shape match (spec 069, the operator's ruling Q1): a
+// name alone or a shape alone is not enough, so a receipt renamed, or a sidecar renamed, is not
+// passed over. None of them carries `results`.
+//   - regrade provenance: `format` is a version of the regrade format. The published Report 011
+//     sidecars carry the version before the writer's current one, and read as sidecars.
+//   - surface record (spec 042's run): `receipt` names the receipt it sits beside, which is its own
+//     name with the suffix replaced by `.json`.
+//   - summary export (spec 107): `format` is the summary format and `format_version` a string of
+//     digits.
+const RECEIPT_SIDECARS = [
+  { kind: 'regrade provenance', suffix: REGRADE_SIDECAR.suffix,
+    shape: (doc) => typeof doc.format === 'string' && new RegExp(`^${REGRADE_FAMILY}/[0-9]+$`).test(doc.format) },
+  { kind: 'surface record', suffix: '.surface.json',
+    shape: (doc, name) => doc.receipt === `${name.slice(0, -'.surface.json'.length)}.json` },
+  { kind: 'summary export', suffix: SUMMARY_SIDECAR.suffix,
+    shape: (doc) => doc.format === SUMMARY_SIDECAR.format && typeof doc.format_version === 'string' && /^[0-9]+$/.test(doc.format_version) },
+];
+function sidecarKind(name, doc) {
+  if (Object.hasOwn(doc, 'results')) return null;
+  const s = RECEIPT_SIDECARS.find((x) => name.endsWith(x.suffix) && name.length > x.suffix.length && x.shape(doc, name));
+  return s ? s.kind : null;
+}
+
+// Every receipt in a directory, sorted by file name: { file, receipt, error }. A `.json` file that
+// parses to an object carrying `receipt_hash` or `results` is returned, unless it is a sidecar by
+// name and shape (above), so the caller's hash check refuses by name a receipt with either field
+// removed, rather than reading it as absent (spec 062 A-062-3 for `receipt_hash`, spec 069 for
+// `results`). An object carrying neither is not a receipt and is not returned: a badge, a stale
+// document. A `.json` file that does not parse IS returned, with receipt null and the
+// parser's message: it may be a receipt, and spec 030 AC-2 fails its model closed as unreadable.
+function listReceipts(dir) {
+  const out = [];
+  for (const name of fs.readdirSync(dir).filter((f) => f.endsWith('.json')).sort()) {
+    const file = path.join(dir, name);
+    let receipt;
+    try { receipt = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (e) { out.push({ file, receipt: null, error: e.message }); continue; }
+    if (!receipt || typeof receipt !== 'object' || Array.isArray(receipt)) continue;
+    if (!Object.hasOwn(receipt, 'results') && !Object.hasOwn(receipt, 'receipt_hash')) continue;
+    if (sidecarKind(name, receipt)) continue;
+    out.push({ file, receipt, error: null });
+  }
+  return out;
+}
+
 function mean(nums) {
   if (!nums.length) return 0;
   return round(nums.reduce((a, b) => a + b, 0) / nums.length);
@@ -339,5 +442,5 @@ function buildReceipt({ skill, suite, run, cases, economics = null, verification
 
 module.exports = {
   buildReceipt, sealReceipt, computeReceiptHash, verifyReceiptHash, validateReceipt, BAND_RULE, comparisonOf, caseFailed, FAILED_STATUSES,
-  duplicateCaseRows, ambiguityLine,
+  duplicateCaseRows, ambiguityLine, suiteNarrowed, fileSlug, receiptBaseName, listReceipts, REGRADE_SIDECAR, SUMMARY_SIDECAR,
 };

package/lib/regrade.js

@@ -25,7 +25,7 @@
 const { sha256 } = require('./canonical');
 const { judgeCase, attest, outcomeFor, resolveCallTimeoutMs } = require('./run');
 const { judgeSettings, promptTemplateHash, rubricHash } = require('./judge');
-const { buildReceipt, verifyReceiptHash, FAILED_STATUSES } = require('./receipt');
+const { buildReceipt, verifyReceiptHash, FAILED_STATUSES, REGRADE_SIDECAR } = require('./receipt');
 const { acrossDraws } = require('./sampling');
 const { resolveModel, surfaceForModel, isMeteredSurface } = require('./provider');
 const { priceForModel, assertRegistered } = require('./models');
@@ -250,7 +250,7 @@ async function regradeReceipt({ receipt, skill, answers, judgeModel, samples, op
   // revision and the archived arms are in the receipt (spec 043 AC-4) and are not repeated
   // here; this sidecar is bound to the receipt by its hash.
   const provenance = {
-    format: 'driftproof-regrade/2',
+    format: REGRADE_SIDECAR.format,
     receipt_hash: out.receipt_hash,
     regraded_from: { receipt_hash: receipt.receipt_hash, runner_version: receipt.run.runner_version, date_utc: receipt.run.date_utc, judge: receipt.run.judge },
     generated_at_basis: receipt.run.generated_at || (receipt.run.arms && Object.values(receipt.run.arms).some((x) => x && x.generated_at))

package/lib/skill.js

@@ -30,23 +30,57 @@ function pastBound(bound, limit, value, what) {
 const IGNORE_DIRS = new Set(['.git', 'node_modules', 'evals']);
 const IGNORE_FILES = new Set(['.DS_Store']);
 
+// Spec 062 (register row 5): A LINK IS REFUSED WHERE THE SKILL IS READ. Until this SKILL.md was
+// read through a link, so a skill directory could make any file the operator can read into the
+// system prompt, while the walk skipped links and content_hash covered none of the bytes used
+// (the SHA-256 of empty input, unchanged when the target changed). A link is neither followed nor
+// skipped: the skill is refused, naming it. The skill directory itself may be reached by a link;
+// what is under it may not.
+function linkRefusal(rel, base) {
+  const e = new Error(`${rel} under ${base} is a symbolic link; a skill is read only from its own directory, so a link is refused rather than followed or skipped`);
+  e.code = 'SKILL_LINK'; e.path = rel;
+  return e;
+}
+// Every component from the skill directory down to `rel` is a plain entry, not a link. An absent
+// component is left to the caller, whose own message names what is missing.
+function assertNoLink(dir, rel) {
+  let cur = dir;
+  for (const part of rel.split('/')) {
+    cur = path.join(cur, part);
+    let st;
+    try { st = fs.lstatSync(cur); } catch (_e) { return; }
+    if (st.isSymbolicLink()) throw linkRefusal(path.relative(dir, cur), dir);
+  }
+}
+
 // Bounded (spec 026 AC-13): the walk stops at SKILL_MAX_DEPTH directories
 // below the skill dir, SKILL_MAX_FILES bundled files, and SKILL_MAX_BYTES of
 // them together, and throws naming the bound the moment one is passed, so a
 // pathological tree is refused before its bytes are read into memory.
-function walkFiles(dir, base = dir, acc = [], state = { bytes: 0 }, depth = 0) {
+//
+// `read` maps a path relative to the skill dir to bytes the caller has already read, so the hash
+// covers those bytes and not a second read of the same path (spec 062: SKILL.md).
+function walkFiles(dir, base = dir, acc = [], state = { bytes: 0 }, depth = 0, read = {}) {
   if (depth > SKILL_MAX_DEPTH) throw pastBound('SKILL_MAX_DEPTH', SKILL_MAX_DEPTH, depth, `directory depth under ${base}`);
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isSymbolicLink()) {
+      // A link under an ignored name is never read, so it is left as the name is; `evals` is
+      // checked where the suite is read.
+      if (IGNORE_DIRS.has(entry.name) || IGNORE_FILES.has(entry.name)) continue;
+      throw linkRefusal(path.relative(base, path.join(dir, entry.name)), base);
+    }
     if (entry.isDirectory()) {
       if (IGNORE_DIRS.has(entry.name)) continue;
-      walkFiles(path.join(dir, entry.name), base, acc, state, depth + 1);
+      walkFiles(path.join(dir, entry.name), base, acc, state, depth + 1, read);
     } else if (entry.isFile() && !IGNORE_FILES.has(entry.name)) {
       const abs = path.join(dir, entry.name);
+      const rel = path.relative(base, abs);
       if (acc.length + 1 > SKILL_MAX_FILES) throw pastBound('SKILL_MAX_FILES', SKILL_MAX_FILES, acc.length + 1, `bundled files under ${base}`);
-      const size = fs.statSync(abs).size;
+      const given = Object.hasOwn(read, rel) ? read[rel] : null;
+      const size = given ? given.length : fs.statSync(abs).size;
       state.bytes += size;
       if (state.bytes > SKILL_MAX_BYTES) throw pastBound('SKILL_MAX_BYTES', SKILL_MAX_BYTES, state.bytes, `bundled bytes under ${base}`);
-      acc.push({ path: path.relative(base, abs), bytes: fs.readFileSync(abs) });
+      acc.push({ path: rel, bytes: given || fs.readFileSync(abs) });
     }
   }
   return acc;
@@ -55,14 +89,17 @@ function walkFiles(dir, base = dir, acc = [], state = { bytes: 0 }, depth = 0) {
 function loadSkill(skillDir) {
   const dir = path.resolve(skillDir);
   const skillMdPath = path.join(dir, 'SKILL.md');
+  assertNoLink(dir, 'SKILL.md');
   if (!fs.existsSync(skillMdPath)) {
     throw new Error(`no SKILL.md found in ${dir}`);
   }
-  const skillMd = fs.readFileSync(skillMdPath, 'utf8');
+  const skillMdBytes = fs.readFileSync(skillMdPath);
+  const skillMd = skillMdBytes.toString('utf8');
 
   // Content hash over SKILL.md + every bundled file (evals/ excluded — the suite
   // is hashed separately so a suite edit doesn't masquerade as a skill change).
-  const files = walkFiles(dir);
+  // SKILL.md enters it as the bytes read above, the bytes the run is given.
+  const files = walkFiles(dir, dir, [], { bytes: 0 }, 0, { 'SKILL.md': skillMdBytes });
   const contentHash = sha256Files(files);
 
   // Parse skill name/version from front-matter or the first H1; fall back to dir.
@@ -72,6 +109,7 @@ function loadSkill(skillDir) {
 
   // Load the eval suite.
   const suitePath = path.join(dir, 'evals', 'evals.json');
+  assertNoLink(dir, 'evals/evals.json');
   if (!fs.existsSync(suitePath)) {
     throw new Error(`no evals/evals.json found in ${dir}`);
   }

package/lib/verdict.js

@@ -4,7 +4,7 @@
 const crypto = require('crypto');
 const { EFFECT_FLOOR, POWER_Z } = require('../config');
 const { bandOf } = require('./reuse');
-const { duplicateCaseRows, ambiguityLine } = require('./receipt');
+const { duplicateCaseRows, ambiguityLine, suiteNarrowed } = require('./receipt');
 
 // Spec 050 AC-3. A receipt with two rows for one (id, mode) has no verdict: which row
 // the byId map below kept would decide it. The error carries a code so a caller that
@@ -186,7 +186,11 @@ function receiptVerdict(receipt) {
   // incomplete: a case had an arm that could not be measured) is not verdicted
   // either. spec/RECEIPT.md has said since v0.3.1 that a drift report must not
   // compute a verdict from one; the badge is the same reader with a shorter path.
-  const incomplete = !!(receipt && receipt.run && receipt.run.status === 'incomplete');
+  //
+  // Spec 062 (register row 4): a receipt that ran fewer cases than its suite holds is incomplete
+  // too, by the same route. Its suite_hash names the whole suite, so a verdict read off it would
+  // be a verdict on cases that were never run.
+  const incomplete = !!(receipt && receipt.run && receipt.run.status === 'incomplete') || suiteNarrowed(receipt);
   // Spec 036 A-036-4: WHICH REFUSAL FIRED. The guard below is one line and says only that
   // some refusal did; a surface that renders NOT_MEASURED in words owes its reader the one
   // that actually fired, and cannot get it from a boolean. `notMeasuredRoutes` names the same
@@ -201,20 +205,7 @@ function receiptVerdict(receipt) {
   // the rung edges. A guard and a route list that disagree read RED there.
   const routes = notMeasuredRoutes(level, kind, cmp.delta, incomplete);
   if (level !== 'TESTED' || kind !== 'model' || typeof cmp.delta !== 'number' || incomplete) return { verdict: 'NOT_MEASURED', cases: [], drawsNeeded: null, notMeasured: routes };
-  const byId = new Map();
-  for (const c of (receipt.results && receipt.results.cases) || []) {
-    if (c.case_status && c.case_status !== 'ok') continue;
-    const e = byId.get(c.id) || {};
-    e[c.mode] = c;
-    byId.set(c.id, e);
-  }
-  const cases = [];
-  for (const [id, e] of byId) {
-    const w = armOf(e.with_skill);
-    const b = armOf(e.baseline);
-    if (!w || !b) continue;
-    cases.push({ id, ...caseRule(b, w) });
-  }
+  const cases = readCases(receipt);
   // Spec 036 A-036-3, THE RUNG R-5 NEVER HAD. R-5 reads its ladder off the cases, and
   // every rung below REGRESSED is a statement about what the cases showed. NO_EFFECT is
   // the bottom rung and it is a MEASUREMENT: "no separation detected at this sample size".
@@ -231,6 +222,31 @@ function receiptVerdict(receipt) {
   return { verdict, cases, drawsNeeded: verdict === 'UNDERPOWERED' ? receiptDrawsNeeded(cases) : null, notMeasured: null };
 }
 
+// R-1 to R-4 over every readable case of a receipt, with none of R-5's refusals applied: a case
+// with a failed arm, or an arm with no readable band, is left out. receiptVerdict reads its ladder
+// off this list; lib/decision.js reads it BEFORE the incomplete rule (spec 062, register row 1),
+// because a case that was measured and separated down is a measured regression however many other
+// cases went unmeasured.
+function readCases(receipt) {
+  const dups = duplicateCaseRows(receipt);
+  if (dups.length) throw new AmbiguousReceiptError(dups);
+  const byId = new Map();
+  for (const c of (receipt && receipt.results && receipt.results.cases) || []) {
+    if (c.case_status && c.case_status !== 'ok') continue;
+    const e = byId.get(c.id) || {};
+    e[c.mode] = c;
+    byId.set(c.id, e);
+  }
+  const cases = [];
+  for (const [id, e] of byId) {
+    const w = armOf(e.with_skill);
+    const b = armOf(e.baseline);
+    if (!w || !b) continue;
+    cases.push({ id, ...caseRule(b, w) });
+  }
+  return cases;
+}
+
 // Derive the verdict object from a receipt. Returns
 //   { verdict, delta, floor, model, message, color, drawsNeeded }
 function verdictFromReceipt(receipt) {
@@ -300,6 +316,6 @@ function githubOutputLines(receipt) {
 
 module.exports = {
   verdictFromReceipt, badgeEndpoint, githubOutputLines, githubOutputEntry, shortModel, VERDICTS,
-  receiptVerdict, caseRule, armOf, drawsLine, receiptDrawsTaken, UNDERPOWERED_LINE, NOT_MEASURED_ROUTES,
+  receiptVerdict, readCases, caseRule, armOf, drawsLine, receiptDrawsTaken, UNDERPOWERED_LINE, NOT_MEASURED_ROUTES,
   AmbiguousReceiptError,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "driftproof",
-  "version": "0.11.3",
+  "version": "0.12.0",
   "description": "A dated proof that this skill, this hash, this model, still helps: run a skill's eval suite with and without the skill across model versions, emit hash-verified dated receipts, and diff receipts into drift reports.",
   "license": "Apache-2.0",
   "keywords": [