driftproof 0.9.0 → 0.10.0

package/README.md

@@ -158,6 +158,22 @@ npx driftproof <cmd>        # no install — always the published version
 npm install -g driftproof   # or install the CLI globally
 ```
 
+Inside Claude Code, there is a third path — the same CLI, reached from a slash
+command:
+
+```bash
+claude plugin marketplace add driftproofhq/driftproof
+claude plugin install driftproof@driftproofhq
+```
+
+That installs `/driftproof:init`, `/driftproof:run` and `/driftproof:badge`.
+The CLI is the product and it runs on every surface Driftproof measures, while
+the plugin is one install path for Claude Code users: it builds one argument
+vector, hands it to the pinned runner, and writes the receipt that runner would
+have written from the same arguments. The plugin's version is the runner version
+it pins, and `/driftproof:run` spends your Claude Code subscription rather than
+an API key. It measures; it never edits a skill.
+
 The only runtime dependency is `ajv` (schema validation); `@anthropic-ai/sdk` is
 optional and pulled in only for `CLAUDE_PROVIDER=api`. The CLI resolves its spec,
 schema, and model registry from inside the package, so it runs the same from a
@@ -271,7 +287,7 @@ A receipt is the unit of evidence — one JSON document conforming to
     "model_release_date": "2025-10-01",
     "provider": "anthropic",
     "surface": "claude-cli",
-    "runner_version": "0.9.0",
+    "runner_version": "0.10.0",
     "date_utc": "2026-07-27T…Z",
     "registry": "registered",
     "transcripts": "hashes-only",
@@ -349,29 +365,78 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: driftproofhq/driftproof@v0.9.0
+      - uses: driftproofhq/driftproof@v0.10.0
         with:
           skill-dir: skills/my-skill
           models: claude-haiku-4-5
           api-key: ${{ secrets.ANTHROPIC_API_KEY }}
           # max-usd:   <n>    # override the dollar budget (default: DEV_MAX_USD in config.js)
           # max-calls: <n>    # override the per-model call cap (default: DEV_MAX_CALLS)
-          # fail-on-regression: 'true'   # (default) fail the job if the skill REGRESSED
+          # fail-on-regression: 'true'   # (default) fail the job on a measured regression
+          # (a requested model with no readable receipt fails the job either way)
 ```
 
-The action runs the suite, uploads the receipt as a build artifact, and exposes
-`verdict` (`PASSED` / `NO_EFFECT` / `REGRESSED`) and `delta` as step outputs. It
-fails the job on `REGRESSED` unless you set `fail-on-regression: 'false'`. For a
-free CI dry-run with **zero model calls**, set `DRIFTPROOF_STUB=1` in the job env —
-the runner returns canned receipts so the wiring can be tested without spend (this
-is exactly how the action's own [self-test](.github/workflows/action-selftest.yml)
-runs). A stub receipt says what it is: `verification_level` `UNVERIFIED`,
-`run.surface` `stub`, `run.answered_by.kind` `stub`, and the verdict on it is
-`NOT_MEASURED` — it proves the wiring, never the skill. That self-test is also the proof behind the input hardening: on every
-run it passes one hostile value (a quote, a semicolon, `$(...)`, a backtick and
-a newline) through each of the action's five inputs on the real runner and
-fails unless every one is refused before anything ran, so a green check there
-is a claim you can read, not one you have to take.
+The action runs the suite on **every** id in `models`, writes one receipt per
+model, uploads the whole receipt directory as a build artifact, and renders the
+run on three surfaces: the **badge**, a **job summary** carrying one row per
+requested model, and the **check title** of the enforcement step.
+
+**The decision is taken over every receipt the run produced.** Each requested
+model gets one decision state, and the run's `verdict` is the **worst** of them —
+worst first, in this order:
+
+| `verdict` | decision state | when |
+|---|---|---|
+| `REGRESSED` | regression | measured, and the skill hurt: `delta <= -EFFECT_FLOOR` |
+| `REFUSED` | refused | a requested model produced **no readable receipt** |
+| `INCONCLUSIVE` | inconclusive | the run did not complete, or carries no numeric delta |
+| `NOT_MEASURED` | not measured | the receipt is below `TESTED`, or nothing in it says a model answered |
+| `NO_EFFECT` | no detected effect | measured, and `\|delta\| < EFFECT_FLOOR` |
+| `PASSED` | helped | measured, and the skill helped: `delta >= EFFECT_FLOOR` |
+
+So on a multi-model run a regression on **any** one of them governs the verdict,
+and the badge names the model it came from. Earlier releases decided the job from
+whichever receipt's filename sorted **first**, which is a property of the model id
+and not of the run — so if a Driftproof check was ever green on a multi-model run,
+that result was only ever about one of your models, and is worth re-running before
+you rely on it.
+
+**What fails the job.** `fail-on-regression` governs **regression verdicts
+only**: set it to `'false'` and a measured regression warns instead of failing.
+`REFUSED` is not a verdict about your skill — it is the run failing to produce
+one for a model you asked for — so it **fails the job whatever
+`fail-on-regression` says**. A workflow that sets `fail-on-regression: 'false'`
+to keep the check non-blocking can still be failed this way, deliberately: a
+model that was not measured did not pass. `INCONCLUSIVE` and `NOT_MEASURED` do
+not fail the job on their own — a run that could not measure is not evidence that
+the skill hurt — but they **never render as success** on any of the three
+surfaces: not in the badge, not in the summary row, and not in the check title,
+which carries a `::warning` naming the state and the models it came from.
+
+Step outputs: `verdict`, `delta` (of the model the worst decision came from),
+`worst_state`, `regressed_models`, `missing_models` and `receipts_dir`. Each is
+described in [`action.yml`](action.yml).
+
+For a free CI dry-run with **zero model calls**, set `DRIFTPROOF_STUB=1` in the job
+env — the runner returns canned receipts so the wiring can be tested without spend
+(this is exactly how the action's own
+[self-test](.github/workflows/action-selftest.yml) runs). A stub receipt says what
+it is: `verification_level` `UNVERIFIED`, `run.surface` `stub`,
+`run.answered_by.kind` `stub`, and the verdict on it is `NOT_MEASURED` — it proves
+the wiring, never the skill, and the badge, the summary row and the check title
+all say so rather than exiting quietly green.
+
+That self-test is also the proof behind the **Action's** input hardening, and it
+is worth saying exactly which surface that covers. On every CI run the Action
+self-test sends one hostile value through each of the Action's five inputs — a
+quote, a semicolon, `$(...)`, a backtick and a newline — on the real runner, and
+the Action fails unless every one of them is refused before anything ran, so a
+green check there is a claim you can read rather than one you have to take.
+Those refusals live in `action/lib.sh`, and what they protect is the Action
+surface. The CLI has carried its own input contract at its own door since
+0.9.0 — the same rules, held identical to the Action's by the gate — so
+`npx driftproof` refuses a malformed cap or model id before it projects a run.
+Neither statement covers the other. Said of the Action, of CI, or of the runner, "hostile input is refused" is only ever true of the one surface it was measured on.
 
 ### Badge
 

package/bin/driftproof

@@ -14,6 +14,7 @@ const { surfaceForModel, isSubscriptionSurface, resolveModel, evalUser } = requi
 const { estimateRunCostUSD, BudgetTracker } = require('../lib/cost');
 const { registryStatus, assertRegistered, REGISTRY_PATH } = require('../lib/models');
 const { verdictFromReceipt, badgeEndpoint, githubOutputLines } = require('../lib/verdict');
+const decision = require('../lib/decision');
 const { scaffoldInit } = require('../lib/init');
 
 // Output dirs default to the USER's current directory, not the package dir, so a
@@ -176,7 +177,9 @@ USAGE
                         [--keep-transcripts] [--out DIR] [--trusted-skill]
   ${PROJECT_NAME} diff <receiptA.json> <receiptB.json> [--out FILE] [--mode release|revision]
   ${PROJECT_NAME} validate <receipt.json>
-  ${PROJECT_NAME} badge <receipt.json> [--out FILE] [--github-output]
+  ${PROJECT_NAME} badge <receipt.json|receipts-dir> [--models a,b] [--out FILE] [--github-output]
+  ${PROJECT_NAME} decide <receipts-dir> --models a,b [--github-output] [--badge FILE]
+                        [--summary FILE] [--enforce] [--fail-on-regression true|false]
   ${PROJECT_NAME} import <results.json> --from agent-skills-eval|skillgrade [--out DIR]
   ${PROJECT_NAME} export <receipt.json> [--to summary-json] [--report-url URL] [--out FILE]
 
@@ -504,7 +507,12 @@ See AUTHORING.md for how to write a fair suite.`);
 // --github-output prints verdict/delta/message/color as key=value lines.
 function cmdBadge(positional, flags) {
   const p = positional[0];
-  if (!p) { console.error('usage: driftproof badge <receipt.json> [--out FILE] [--github-output]'); process.exit(2); }
+  if (!p) { console.error('usage: driftproof badge <receipt.json|receipts-dir> [--models a,b] [--out FILE] [--github-output]'); process.exit(2); }
+  // SPEC 030 AC-3. A DIRECTORY renders the worst decision across every receipt
+  // in it, naming the model that state came from. A single receipt renders
+  // exactly what it always did - lib/verdict.js is untouched and still answers
+  // the one-receipt question, which AC-3's control asserts.
+  if (fs.existsSync(p) && fs.statSync(p).isDirectory()) return cmdBadgeSet(p, flags);
   const receipt = JSON.parse(fs.readFileSync(p, 'utf8'));
   refuseUnverified(receipt, p, 'badge');
   if (flags['github-output']) { console.log(githubOutputLines(receipt)); return; }
@@ -521,6 +529,113 @@ function cmdBadge(positional, flags) {
   }
 }
 
+// The badge over a receipt SET (spec 030 AC-3): the worst decision, the model
+// it came from, and how many models share it. Every receipt in the directory is
+// read; when --models is given the requested list governs, so a model with no
+// receipt is `refused` and can be the worst state.
+function cmdBadgeSet(dir, flags) {
+  const files = decision.receiptFiles(dir);
+  if (files.length === 0) {
+    console.error(`  \u2717 REFUSED (badge): ${dir} holds no receipts; a badge over nothing is a badge about nothing.`);
+    process.exit(2);
+  }
+  // Every receipt is verified before it is displayed, exactly as the
+  // single-receipt path does (spec 026 AC-20): a set is not a way around the
+  // check, and the file that fails is named.
+  for (const f of files) {
+    const r = JSON.parse(fs.readFileSync(f, 'utf8'));
+    refuseUnverified(r, f, 'badge');
+  }
+  const models = flags.models || files
+    .map((f) => JSON.parse(fs.readFileSync(f, 'utf8')))
+    .map((r) => r.run && r.run.model_id).filter(Boolean).join(',');
+  const d = decision.decideSet(dir, models);
+  if (flags['github-output']) { console.log(decision.githubOutputLines(d)); return; }
+  const badge = decision.badgeEndpointForSet(d);
+  const json = JSON.stringify(badge, null, 2);
+  if (flags.out) {
+    const out = path.resolve(flags.out);
+    fs.mkdirSync(path.dirname(out), { recursive: true });
+    fs.writeFileSync(out, json + '\n');
+    console.log(`badge written to ${flags.out}  (${d.worst}: ${badge.message}, ${badge.color})`);
+  } else {
+    console.log(json);
+  }
+}
+
+// The decision over a RUN: every receipt it produced, against every model it was
+// asked for (spec 030 AC-1, AC-2, AC-4).
+//
+// `badge` answers about one receipt and still does. This answers about the set,
+// which is what the GitHub Action needs and what `ls … | head -1` was standing
+// in for. Modes compose: --github-output emits the step outputs, --summary
+// writes the job-summary table, --enforce decides the job and sets the exit
+// code. With none of them it prints the decision as JSON.
+function cmdDecide(positional, flags) {
+  const dir = positional[0];
+  if (!dir || !flags.models) {
+    console.error('usage: driftproof decide <receipts-dir> --models a,b [--github-output] [--badge FILE] [--summary FILE] [--enforce] [--fail-on-regression true|false]');
+    process.exit(2);
+  }
+  if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory()) {
+    console.error(`  \u2717 REFUSED (decide): ${dir} is not a directory; a run that wrote no receipt directory decided nothing.`);
+    process.exit(2);
+  }
+  // ── THE SEAL IS VERIFIED BEFORE ANY DECISION (spec 026 AC-20, spec 030 AC-3)
+  //
+  // Before spec 030 the action rendered through `driftproof badge <receipt>`,
+  // which calls refuseUnverified and exits 4 on a receipt_hash mismatch. All
+  // four surfaces the action writes now go through THIS command, and until
+  // this it verified nothing: a receipt with one field hand-edited after
+  // sealing rendered `passing`, `brightgreen`, exit 0 - the check that had
+  // stood between the receipts and the job was not carried across to the
+  // command that replaced its caller. The failure direction is FAIL-OPEN,
+  // which is the one direction an adopter cannot detect from their own CI.
+  //
+  // Every receipt in the set, before anything is read for a decision and
+  // before any file is written, exactly as cmdBadgeSet does - a set is not a
+  // way around the check, and the file that fails is named.
+  //
+  // A receipt that cannot be PARSED is left to the decision, not refused here:
+  // `decideSet` distinguishes a receipt that is absent from one that exists and
+  // is unreadable and fails closed on both, naming which (spec 030 AC-2,
+  // absence-vs-unreadable). Refusing it here would collapse that distinction
+  // into an exit code.
+  for (const f of decision.receiptFiles(dir)) {
+    let receipt;
+    try { receipt = JSON.parse(fs.readFileSync(f, 'utf8')); } catch (_e) { continue; }
+    refuseUnverified(receipt, f, 'decide');
+  }
+  const failOnRegression = String(flags['fail-on-regression'] ?? 'true') !== 'false';
+  const d = decision.decideSet(dir, flags.models, { failOnRegression });
+  if (d.rows.length === 0) {
+    console.error('  \u2717 REFUSED (decide): no models requested; there is nothing to decide over.');
+    process.exit(2);
+  }
+  let acted = false;
+  if (flags['github-output']) { console.log(decision.githubOutputLines(d)); acted = true; }
+  if (flags.badge) {
+    const out = path.resolve(flags.badge);
+    fs.mkdirSync(path.dirname(out), { recursive: true });
+    const badge = decision.badgeEndpointForSet(d);
+    fs.writeFileSync(out, JSON.stringify(badge, null, 2) + '\n');
+    console.log(`badge written to ${flags.badge}  (${d.worst}: ${badge.message}, ${badge.color})`);
+    acted = true;
+  }
+  if (flags.summary) {
+    const out = path.resolve(flags.summary);
+    fs.mkdirSync(path.dirname(out), { recursive: true });
+    fs.appendFileSync(out, decision.summaryMarkdown(d) + '\n');
+    acted = true;
+  }
+  if (flags.enforce) {
+    for (const line of decision.enforcementLines(d, { failOnRegression })) console.log(line);
+    acted = true;
+    if (d.fails) process.exit(1);
+  }
+  if (!acted) console.log(JSON.stringify(d, null, 2));
+}
+
 // Convert another tool's results file into a valid DECLARED receipt (interop,
 // Phase 7). The converted receipt is validated + self-hash-verified before it
 // is written; a failed conversion writes nothing.
@@ -579,6 +694,7 @@ async function main() {
     case 'diff': return cmdDiff(positional, flags);
     case 'validate': return cmdValidate(positional);
     case 'badge': return cmdBadge(positional, flags);
+    case 'decide': return cmdDecide(positional, flags);
     case 'import': return cmdImport(positional, flags);
     case 'export': return cmdExport(positional, flags);
     case 'version': case '--version': case '-v': console.log(RUNNER_VERSION); return;

package/config.js

@@ -9,7 +9,7 @@ const PROJECT_NAME = 'driftproof';
 // Bumped whenever the runner's behaviour or receipt-generation semantics change
 // in a way that could affect results. Recorded into every receipt as
 // run.runner_version so a receipt is reproducible against a known engine.
-const RUNNER_VERSION = '0.9.0';
+const RUNNER_VERSION = '0.10.0';
 
 // The eval format we CONSUME (we deliberately do not invent our own).
 const SUITE_FORMAT = 'agentskills.io/evals';

package/lib/decision.js

@@ -0,0 +1,425 @@
+// SPDX-License-Identifier: Apache-2.0
+'use strict';
+
+// The decision a RUN reaches, over every receipt it produced (spec 030).
+//
+// `lib/verdict.js` answers a question about ONE receipt: does the skill still
+// help on THIS model? That question is still asked and still answered there,
+// unchanged. This module answers the one the action actually needs and never
+// had a place to ask: a run takes a LIST of models and must reach a single
+// decision over all of them.
+//
+// Until spec 030, `action/run.sh` picked one receipt with `ls … | head -1` and
+// decided the job from it. Receipts are named `<skill>-<model>-<date>.json`, so
+// that pick is ordered by model id: `claude-haiku-4-5` sorts before
+// `claude-sonnet-5`, and a regression on any model that did not sort first was
+// reported as a pass, with a green check and a brightgreen badge. The seam lives
+// here, in lib/, rather than in the shell, because `bin/driftproof badge` needs
+// it too and because a decision state is a property of a receipt.
+
+const fs = require('fs');
+const path = require('path');
+const { EFFECT_FLOOR } = require('../config');
+const { shortModel, githubOutputEntry } = require('./verdict');
+
+// The six decision states (spec 030 AC-4).
+//
+// `helped` is the sixth, and is a RECORDED DEVIATION from the brief's five
+// (spec.md A-030-1): a model on which the skill measurably helped needs a row
+// that says so. `no detected effect` is false about such a model - the effect
+// was detected and it cleared the floor - and widening it to mean "not a
+// regression" would put a measured lift and a measured nothing in one cell.
+const STATES = ['regression', 'refused', 'inconclusive', 'not measured', 'no detected effect', 'helped'];
+
+// WORST FIRST. This is the single definition of the ordering; AC-1's
+// enforcement and AC-3's badge both read it, so they cannot disagree about
+// which of two states governs a run.
+const STATE_ORDER = STATES.slice();
+
+// States that must never render as success on any surface the action writes -
+// the badge, the summary row, or the check title (AC-4).
+const NEVER_SUCCESS = ['inconclusive', 'not measured'];
+
+// States that fail the job. `refused` fails CLOSED (AC-2): a model that
+// produced no receipt is not a model that passed. `regression` fails subject to
+// fail-on-regression. An unmeasured run does not fail on its own (AC-4's rule)
+// - it is not evidence that the skill hurt - but it never renders as success.
+function failsJob(state, { failOnRegression = true } = {}) {
+  // AC-2. `refused` fails CLOSED and is NOT subject to fail-on-regression: that
+  // input says what to do about a measured regression, and a model that
+  // produced no receipt was not measured at all. A run that silently narrowed
+  // to the models that survived would be AC-1's defect with a different cause -
+  // the decision taken over a subset nobody chose.
+  if (state === 'refused') return true;
+  if (state === 'regression') return !!failOnRegression;
+  return false;
+}
+
+// The mapping rule of spec 030 AC-4, in order; the first match wins. A null or
+// missing receipt is `refused`.
+//
+// `not measured` is tested BEFORE `inconclusive` and before any delta is read,
+// because a receipt below TESTED has not measured anything its delta could be
+// about - spec 026 AC-1 is what makes a stub receipt unable to claim TESTED,
+// and reading its delta first would grade a run that never ran.
+// The rule is read off AC-4's table and nothing is supplied that the receipt
+// does not carry. Until this it read
+//
+//   const level = receipt.verification_level || 'TESTED';
+//   ... || (kind && kind !== 'model')
+//
+// - a receipt with no `verification_level` was GRADED ON ITS DELTA as though it
+// had claimed TESTED, and a receipt with no `answered_by` block had the second
+// clause skipped entirely. Both defaults point the same way: they let a receipt
+// that says nothing about how it was answered reach `helped`. AC-4 says each
+// state SHALL be derived "by the rule below and by no other", and the rule says
+// `verification_level != "TESTED"` and `run.answered_by.kind != "model"` - an
+// absent field satisfies both. The receipts the shipped runner writes always
+// carry a level and an answered_by block (lib/run.js answeredByOf always
+// returns a kind), so this changes nothing about a run the action produced; it
+// changes what happens to a receipt from somewhere else, and it changes it in
+// the fail-safe direction.
+function decisionState(receipt) {
+  if (!receipt) return 'refused';
+  const level = receipt.verification_level;
+  const kind = receipt.run && receipt.run.answered_by ? receipt.run.answered_by.kind : undefined;
+  if (level !== 'TESTED' || kind !== 'model') return 'not measured';
+  const cmp = receipt.comparison || {};
+  if ((receipt.run && receipt.run.status === 'incomplete') || typeof cmp.delta !== 'number') return 'inconclusive';
+  if (cmp.delta <= -EFFECT_FLOOR) return 'regression';
+  if (cmp.delta >= EFFECT_FLOOR) return 'helped';
+  return 'no detected effect';
+}
+
+// The worst state in a set, by STATE_ORDER. An empty set has no decision, and
+// says so with null rather than defaulting to something benign.
+function worstState(states) {
+  let worst = null;
+  for (const s of states) {
+    const i = STATE_ORDER.indexOf(s);
+    if (i < 0) continue;
+    if (worst === null || i < STATE_ORDER.indexOf(worst)) worst = s;
+  }
+  return worst;
+}
+
+// Every receipt in a directory, excluding the summaries and the badge writer's
+// own earlier output. Mirrors what action/run.sh's glob selected from, so the
+// set this reads is the set that was there to be read.
+function receiptFiles(dir) {
+  return fs.readdirSync(dir)
+    .filter((f) => f.endsWith('.json') && !f.includes('.summary.') && f !== 'badge.json')
+    .sort()
+    .map((f) => path.join(dir, f));
+}
+
+// Parse the `models` input the same way the runner does: comma-separated, with
+// surrounding whitespace ignored and empty entries dropped.
+function parseModels(csv) {
+  return String(csv || '').split(',').map((s) => s.trim()).filter(Boolean);
+}
+
+// A receipt matches a requested id exactly, or after the release date stamp is
+// stripped from both - `claude-haiku-4-5-20251001` IS `claude-haiku-4-5`, which
+// is the equivalence lib/verdict.js's shortModel already defines for the badge.
+function matchesModel(receiptModelId, requested) {
+  return receiptModelId === requested || shortModel(receiptModelId) === shortModel(requested);
+}
+
+// The same question for a receipt that CANNOT BE READ. `matchesModel` reads
+// `run.model_id`, and for an unreadable receipt that field is inside the bytes
+// that will not parse. The FILENAME is the only thing left that names a model:
+// the runner writes `<skill>-<model>-<date>.json`, so the id appears in the
+// basename as a dash-delimited run.
+//
+// Until this, the unreadable branch matched by POSITION - the first unreadable
+// file in the directory, whichever model it belonged to. With one requested model
+// absent and another's receipt unreadable, the two causes were hung on the wrong
+// models: the absent model was reported as "exists and is unreadable" naming the
+// OTHER model's file, and the model whose file was actually corrupt was reported
+// as having produced nothing. Both still failed closed and both ids still
+// appeared somewhere, which is why AC-2's arms stayed green - they drove one
+// cause at a time and never both at once (F-1 of 2026-09-12).
+function fileNamesModel(file, requested) {
+  const base = path.basename(file);
+  // Both spellings, for the reason `matchesModel` takes both: a receipt for
+  // `claude-haiku-4-5-20251001` answers a request for `claude-haiku-4-5`.
+  for (const id of new Set([requested, shortModel(requested)])) {
+    if (base.includes(`-${id}-`)) return true;
+  }
+  return false;
+}
+
+// The decision over a run: one row per REQUESTED model, in the order requested.
+//
+// Rows come from the requested list rather than from the directory listing, so
+// a model that produced no receipt is a row that says `refused` instead of a
+// row that is simply absent. That is the whole of AC-2: absence is not a pass.
+function decideSet(dir, requestedCsv, { failOnRegression = true } = {}) {
+  const requested = parseModels(requestedCsv);
+  const files = receiptFiles(dir);
+  const loaded = files.map((f) => {
+    let receipt = null, error = null;
+    try { receipt = JSON.parse(fs.readFileSync(f, 'utf8')); } catch (e) { error = e.message; }
+    return { file: f, receipt, error };
+  });
+  const used = new Set();
+  const rows = requested.map((model) => {
+    const hit = loaded.find((l) => !used.has(l.file) && l.receipt
+      && l.receipt.run && matchesModel(l.receipt.run.model_id, model));
+    if (hit) used.add(hit.file);
+    // A receipt that exists and cannot be parsed is UNREADABLE, not absent.
+    // Both fail closed, and the row says which - the register's
+    // absence-vs-unreadable distinction, kept at the point it is decided.
+    const unreadable = !hit && loaded.find((l) => !used.has(l.file) && l.error
+      && fileNamesModel(l.file, model));
+    if (unreadable) used.add(unreadable.file);
+    const receipt = hit ? hit.receipt : null;
+    const state = decisionState(receipt);
+    return {
+      model,
+      state,
+      delta: receipt && receipt.comparison && typeof receipt.comparison.delta === 'number'
+        ? receipt.comparison.delta : null,
+      file: hit ? path.basename(hit.file) : (unreadable ? path.basename(unreadable.file) : null),
+      // The distinction is carried on the ROW, not left in a sentence, because
+      // the enforcement message has to say which of the two happened (AC-2's
+      // mutation class, absence-vs-unreadable).
+      unreadable: unreadable ? unreadable.error : null,
+      // A SHORT CAUSE, not the parser's text. V8's JSON.parse message echoes the
+      // first bytes of the input - "Unexpected token '|', \"|{bad\" is not valid
+      // JSON" - and this string is rendered into a markdown table cell, where one
+      // unescaped `|` adds a column and a newline ends the row. The detail still
+      // reaches the annotation, which is not a table; the cell carries the cause,
+      // and the filename is already beside it in the same cell (F-2 of
+      // 2026-09-12).
+      reason: unreadable ? 'receipt unreadable (not valid JSON)' : (hit ? null : 'no receipt for this model'),
+    };
+  });
+  // Receipts the run wrote for models nobody requested are reported rather than
+  // dropped: they are evidence that the run did something other than what it
+  // was asked for.
+  const unexpected = loaded.filter((l) => !used.has(l.file))
+    // An unreadable file whose name matches no requested model is still reported,
+    // and reported AS unreadable. Calling it a receipt for a model nobody asked
+    // for would state as fact the one thing its bytes could not tell us.
+    .map((l) => (l.error ? `${path.basename(l.file)} (unreadable)` : path.basename(l.file)));
+  const worst = worstState(rows.map((r) => r.state));
+  return {
+    rows,
+    worst,
+    regressed: rows.filter((r) => r.state === 'regression').map((r) => r.model),
+    missing: rows.filter((r) => r.state === 'refused').map((r) => r.model),
+    // `missing` is every model that reached no readable receipt, which is what
+    // the missing_models output has always published. `absent` and `unreadable`
+    // split it by CAUSE: nothing was written for this model, or something was
+    // written and cannot be read. Both fail closed; they are not the same fact,
+    // and the failure has to say which.
+    absent: rows.filter((r) => r.state === 'refused' && !r.unreadable).map((r) => r.model),
+    unreadable: rows.filter((r) => r.state === 'refused' && r.unreadable)
+      .map((r) => ({ model: r.model, file: r.file, error: r.unreadable })),
+    unexpected,
+    receiptCount: files.length,
+    requestedCount: requested.length,
+    fails: rows.some((r) => failsJob(r.state, { failOnRegression })),
+  };
+}
+
+module.exports = {
+  STATES, STATE_ORDER, NEVER_SUCCESS, EFFECT_FLOOR,
+  decisionState, worstState, failsJob, decideSet, receiptFiles, parseModels, matchesModel,
+};
+
+// ── the three surfaces the action writes ────────────────────────────────────
+//
+// AC-4 binds all three: the badge, the summary row and the check title. A state
+// in NEVER_SUCCESS must not render as success on any of them, which is why the
+// renderers live together - three surfaces fed by one table cannot drift apart
+// the way three hand-written strings do.
+
+// How each state renders. `color` is the shields colour; `marker` is the
+// summary row's marker. Only `helped` gets a success marker: `no detected
+// effect` is not a failure but it is not a success either, and the two
+// NEVER_SUCCESS states carry a warning.
+const RENDER = {
+  regression: { word: 'regressed', color: 'red', marker: '\u274c' },
+  refused: { word: 'refused', color: 'red', marker: '\u274c' },
+  inconclusive: { word: 'inconclusive', color: 'yellow', marker: '\u26a0\ufe0f' },
+  'not measured': { word: 'not measured', color: 'lightgrey', marker: '\u26a0\ufe0f' },
+  'no detected effect': { word: 'no effect', color: 'lightgrey', marker: '\u2014' },
+  helped: { word: 'passing', color: 'brightgreen', marker: '\u2705' },
+};
+
+// The one place a state becomes a success claim. AC-4's clause is enforced here
+// rather than restated at each surface.
+function rendersAsSuccess(state) {
+  return state === 'helped';
+}
+
+// The badge over a SET (AC-3): the worst state, naming the model it came from,
+// and how many models share it when more than one does.
+function badgeMessage(d) {
+  const worst = d.worst;
+  if (!worst) return 'no receipts';
+  const r = RENDER[worst];
+  const sharing = d.rows.filter((row) => row.state === worst);
+  const named = sharing[0] ? sharing[0].model : 'unknown';
+  const extra = sharing.length > 1 ? ` (+${sharing.length - 1} more)` : '';
+  return `${r.word} on ${shortModel(named)}${extra}`;
+}
+
+function badgeEndpointForSet(d, { label = 'driftproof' } = {}) {
+  const worst = d.worst;
+  return {
+    schemaVersion: 1,
+    label,
+    message: badgeMessage(d),
+    color: worst ? RENDER[worst].color : 'lightgrey',
+  };
+}
+
+// The step outputs. `verdict` keeps the vocabulary lib/verdict.js publishes, so
+// a workflow reading steps.run.outputs.verdict is not broken by this change;
+// `worst`, `regressed` and `missing` are new and carry what it could not say.
+const VERDICT_WORD = {
+  regression: 'REGRESSED', refused: 'REFUSED', inconclusive: 'INCONCLUSIVE',
+  'not measured': 'NOT_MEASURED', 'no detected effect': 'NO_EFFECT', helped: 'PASSED',
+};
+
+function githubOutputLines(d) {
+  const worst = d.worst;
+  const badge = badgeEndpointForSet(d);
+  const worstRow = d.rows.find((r) => r.state === worst);
+  return [
+    ['verdict', worst ? VERDICT_WORD[worst] : 'NOT_MEASURED'],
+    ['delta', worstRow && worstRow.delta !== null ? worstRow.delta : 0],
+    ['message', badge.message],
+    ['color', badge.color],
+    ['worst_state', worst || 'none'],
+    ['regressed_models', d.regressed.join(',')],
+    ['missing_models', d.missing.join(',')],
+    ['receipt_count', d.receiptCount],
+  ].map(([k, v]) => githubOutputEntry(k, v)).join('\n');
+}
+
+// Anything reaching a table cell from outside this module - a filename, a reason,
+// a model id - is escaped FOR THE CELL it sits in. A markdown row is delimited by
+// `|`, so one unescaped pipe adds a column and the row stops lining up with its
+// header; a newline ends the row outright. The cause AC-4's own finding had was a
+// parser echo, and that echo is gone from the cell - but the filename is still
+// read off a directory, so the row is made to survive the byte rather than made
+// to depend on where the byte came from.
+function cell(s) {
+  return s === null || s === undefined ? '' : String(s).replace(/\r?\n/g, ' ').replace(/\|/g, '\\|');
+}
+
+// The job summary: one row per REQUESTED model, in the order requested (AC-4).
+function summaryMarkdown(d) {
+  const L = [];
+  L.push('### Driftproof');
+  L.push('');
+  L.push('| Model | Decision | Lift | Receipt |');
+  L.push('|---|---|---|---|');
+  for (const row of d.rows) {
+    const r = RENDER[row.state];
+    const delta = row.delta === null ? 'n/a' : (row.delta >= 0 ? '+' : '') + row.delta.toFixed(3);
+    const note = row.reason ? ` <br><sub>${cell(row.reason)}</sub>` : '';
+    L.push(`| \`${cell(row.model)}\` | ${r.marker} ${row.state} | ${delta} | ${cell(row.file) || '\u2014'}${note} |`);
+  }
+  L.push('');
+  L.push(`Decided over ${d.receiptCount} receipt(s) for ${d.requestedCount} requested model(s). `
+    + `Worst: **${d.worst || 'none'}**.`);
+  if (d.unexpected.length) {
+    L.push('');
+    L.push(`Receipts in the directory that no requested model claimed: ${d.unexpected.join(', ')}.`);
+  }
+  return L.join('\n');
+}
+
+// The check title and the human line the enforcement step prints.
+//
+// The message names THE MODELS THAT REGRESSED, never the requested list. The
+// old line interpolated the requested list, so one model's regression was
+// reported against every model asked for - the same defect as the selection,
+// seen from the other side.
+// The parser's message still reaches the ANNOTATION, where the detail is worth
+// having - but a workflow command is ONE LINE: a newline inside it ends the
+// command and drops everything after, and an unbounded echo of a file's bytes
+// does not belong in a check annotation either. One line, bounded, cut marked.
+function oneLine(s, max = 160) {
+  const flat = String(s).replace(/\s+/g, ' ').trim();
+  return flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
+}
+
+function enforcementLines(d, { failOnRegression = true } = {}) {
+  const L = [];
+  const per = d.rows.map((r) => `${r.model}: ${r.state}`).join(', ');
+  L.push(`Driftproof decision over ${d.receiptCount} receipt(s) for ${d.requestedCount} model(s) - ${per}`);
+  // AC-2: the count is reported before any verdict, and names each model that
+  // reached no readable receipt. Absence is not a pass.
+  //
+  // The two causes are reported apart (absence-vs-unreadable). A model with NO
+  // receipt and a model whose receipt exists and cannot be parsed both fail
+  // closed, but they send the reader to different places - one to the run that
+  // never wrote it, one to the file that is there - so a single message naming
+  // both as "no receipt was produced" would be false about one of them.
+  if (d.absent.length) {
+    L.push(`::error title=Driftproof::No receipt was produced for ${d.absent.join(', ')} - `
+      + `${d.receiptCount} receipt(s) for ${d.requestedCount} requested model(s). `
+      + `Failing closed: a model that was not measured did not pass.`);
+  }
+  if (d.unreadable.length) {
+    L.push(`::error title=Driftproof::The receipt for `
+      + `${d.unreadable.map((u) => `${u.model} exists and is unreadable (${u.file}: ${oneLine(u.error)})`).join('; ')}. `
+      + `Failing closed: a receipt that cannot be read is not a pass, and is not the same as one that was never written.`);
+  }
+  if (d.regressed.length) {
+    const deltas = d.rows.filter((r) => r.state === 'regression')
+      .map((r) => `${r.model} (delta ${r.delta})`).join(', ');
+    if (failOnRegression) {
+      L.push(`::error title=Driftproof::Skill REGRESSED on ${deltas}`);
+    } else {
+      L.push(`::warning title=Driftproof::Skill REGRESSED on ${deltas} (fail-on-regression is false)`);
+    }
+  }
+  // AC-4: an unmeasured run renders as unmeasured, never as passing, and does
+  // not fail the job on its own.
+  const unmeasured = d.rows.filter((r) => NEVER_SUCCESS.includes(r.state));
+  if (unmeasured.length) {
+    // AC-4 binds the TITLE: a `::warning` "whose title names the state and the
+    // models it came from". Until this it named `unmeasured[0].state` and no
+    // model at all - both facts were in the MESSAGE, which is not where the
+    // criterion puts them, and with two never-success states present the title
+    // carried only the first row's. A reader who sees the annotation collapsed
+    // to its title in a check list saw neither the second state nor any model
+    // (F-4 of 2026-09-12).
+    //
+    // Grouped by state, worst first, from STATE_ORDER - the same single ordering
+    // AC-1's enforcement and AC-3's badge read, so the title cannot disagree with
+    // them about which state governs.
+    //
+    // NO COMMA IN THE TITLE, and that is load-bearing rather than a style
+    // choice: GitHub parses a workflow command's properties as a
+    // COMMA-SEPARATED list, so `title=not measured,inconclusive` ends the title
+    // at the comma and leaves the rest to be read as a property GitHub does not
+    // know. States are joined with ' / ' and the models under one state with
+    // ' + ', neither of which GitHub reads.
+    const states = STATE_ORDER.filter((s) => unmeasured.some((r) => r.state === s));
+    const title = states
+      .map((s) => `${s} on ${unmeasured.filter((r) => r.state === s).map((r) => r.model).join(' + ')}`)
+      .join(' / ');
+    L.push(`::warning title=Driftproof: ${title}::`
+      + `${unmeasured.map((r) => `${r.model}: ${r.state}`).join(', ')} - `
+      + `this run did not measure these models, and is not a pass on them.`);
+  }
+  return L;
+}
+
+module.exports.RENDER = RENDER;
+module.exports.rendersAsSuccess = rendersAsSuccess;
+module.exports.badgeMessage = badgeMessage;
+module.exports.badgeEndpointForSet = badgeEndpointForSet;
+module.exports.githubOutputLines = githubOutputLines;
+module.exports.summaryMarkdown = summaryMarkdown;
+module.exports.enforcementLines = enforcementLines;
+module.exports.VERDICT_WORD = VERDICT_WORD;

package/lib/runner.js

@@ -39,13 +39,38 @@ class Gate {
     return rec.pass;
   }
 
+  // Record an assertion whose SUBJECT this checkout does not carry (spec 030
+  // AC-5). Not a pass and not a failure: a row that says the check could not
+  // apply here and why.
+  //
+  // This exists because the two wrong answers are both worse. Guarding such a
+  // check with `if (...)` REMOVES the row, and the headline count silently
+  // drops by one - the register's `absence-vs-unreadable` class, and the reason
+  // the DECISIONS #4 check was written to fail rather than skip. Failing it
+  // instead means a `--depth 1` clone, which carries no `main` ref and so has
+  // no merge range to read, can never reach a green gate however correct it is.
+  // A third state costs one row and keeps both properties: the assertion always
+  // registers, and its cause is printed rather than hidden in a detail field
+  // that only prints on failure.
+  //
+  // `notApplicable` is NEVER the answer to "I could not read it". An absence
+  // must be positively detected - the ref is not there - or it is a failure.
+  notApplicable(name, cause) {
+    const rec = { section: this._section, name, pass: true, notApplicable: true, cause, detail: null };
+    this.results.push(rec);
+    // eslint-disable-next-line no-console
+    console.log(`  [N/A] ${name}  -- ${cause}`);
+    return true;
+  }
+
   // Convenience: assert deep equality of two JSON-able values.
   checkEqual(name, actual, expected) {
     const pass = safeJson(actual) === safeJson(expected);
     return this.check(name, pass, { actual, expected });
   }
 
-  get passed() { return this.results.filter((r) => r.pass).length; }
+  get passed() { return this.results.filter((r) => r.pass && !r.notApplicable).length; }
+  get notApplicableCount() { return this.results.filter((r) => r.notApplicable).length; }
   get failed() { return this.results.filter((r) => !r.pass); }
   get total() { return this.results.length; }
 
@@ -53,12 +78,19 @@ class Gate {
   summarize() {
     const failed = this.failed;
     // eslint-disable-next-line no-console
-    console.log(`\n=== ${this.title.toUpperCase()} RESULT: ${this.passed}/${this.total} passed, ${failed.length} failed ===`);
+    const na = this.notApplicableCount;
+    const naSuffix = na ? `, ${na} not applicable` : '';
+    // eslint-disable-next-line no-console
+    console.log(`\n=== ${this.title.toUpperCase()} RESULT: ${this.passed}/${this.total - na} passed, ${failed.length} failed${naSuffix} ===`);
+    for (const r of this.results.filter((x) => x.notApplicable)) {
+      // eslint-disable-next-line no-console
+      console.log(`  N/A  [${r.section}] ${r.name}: ${r.cause}`);
+    }
     for (const f of failed) {
       // eslint-disable-next-line no-console
       console.log(`  FAIL [${f.section}] ${f.name}: ${safeJson(f.detail)}`);
     }
-    return { title: this.title, total: this.total, passed: this.passed, failed: failed.length, results: this.results };
+    return { title: this.title, total: this.total, passed: this.passed, failed: failed.length, notApplicable: na, results: this.results };
   }
 
   toExitCode() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "driftproof",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "A dated proof that this skill, this hash, this model, still helps: run a skill's eval suite with and without the skill across model versions, emit hash-verified dated receipts, and diff receipts into drift reports.",
   "license": "Apache-2.0",
   "keywords": [