plan-auditor 2.4.2__tar.gz → 2.4.4__tar.gz

{plan_auditor-2.4.2 → plan_auditor-2.4.4}/.gitignore

@@ -44,3 +44,8 @@ pack.json
 # mypy cache from the type ratchet job
 .mypy_cache/
 .ruff_cache/
+
+# Upstream commit lookups cached by .github/scripts/check_action_pins.py. The
+# cache exists so repeated local runs and a cold CI runner do not re-query the
+# API; it is machine-local state and must never be committed.
+.action-pin-cache/

{plan_auditor-2.4.2 → plan_auditor-2.4.4}/CHANGELOG.md

@@ -2,6 +2,274 @@
 
 All notable changes to plan-auditor. Versions are published to PyPI and npm.
 
+## Unreleased
+
+## 2.4.4 — HMAC check subprocess boundary
+
+### Security
+
+- Do not inherit `PLAN_AUDITOR_HMAC_KEY` or `PLAN_AUDITOR_HMAC_KEY_FILE`
+  into project-controlled behavioral-check subprocesses. The supervisor
+  retains these credentials to authenticate the resulting audit evidence.
+- Add regression tests for both credential variables, benign environment
+  preservation, parent environment preservation, and the public `run_check`
+  path.
+- Clarify that environment sanitisation is defense in depth, **not** OS
+  sandboxing: an untrusted child running as the supervisor's user can still
+  open any HMAC key file that user can read. Deliberately hostile agents need
+  a separately isolated, keyless check-execution identity/container.
+
+### Documentation
+
+- **README reduced from 362 to 248 lines with no surface lost.** The previous
+  release traded a line target for coverage and stopped at 356, on the reasoning
+  that the layer table, command tables and artifact list were the coverage gap.
+  That was right about the priority and wrong about the arithmetic: the reduction
+  had not been attempted. Detail now lives on the docs site and the README keeps a
+  scannable map plus links. Measured against the same 66-surface checklist derived
+  from the code, **0 surfaces are undocumented**: 37 still appear in the README and
+  29 moved to a named docs page.
+  - The L0-L14 layer table became a five-row band map. It still names all fifteen
+    layers, and the two facts that carry the design are now stated in the prose
+    rather than buried in a row: **L10 (`scripts/audit_check.py`) is the only
+    component that can mark a step `verified`** and **L13 (`gate.py`) is the only
+    one that emits a final `PASS`/`FAIL`/`UNKNOWN`**. Per-layer detail was already
+    in `docs/architecture.md`.
+  - The fourteen workspace artifacts moved to a new **`docs/workspace-artifacts.md`**,
+    which also records what is *not* written and why the files are separated
+    (append-only evidence, host-owned input separate from agent-owned state, and a
+    stale verdict being detectable). The README still says the tool writes under
+    `.plan-auditor/` and links the page.
+  - The full command table was already in `docs/cli.md`; the README now names the
+    four entry points and the five check types, and `docs/cli.md` gained an explicit
+    `0`/`1`/`2`/`3` exit-code legend so the codes have one canonical home.
+  - `## Reference` was folded into `## Documentation` rather than kept as a second
+    index. The heading name is unchanged on purpose: a test splits the README on it.
+  - The `## Use it in CI` yaml block became one prose line pointing at
+    `docs/integrations.md`.
+  - The quick start keeps the structure `tests/test_readme_quickstart.py` requires:
+    exactly two JSON blocks, one console block, and the same four commands. Both
+    plan files and the transcript were compressed using the `...` elision the test
+    already tolerates. **The `request_sha256` changed** because the documented
+    `task` string was shortened, and it was re-derived by running the walkthrough,
+    not computed: `d39e577eb0577d8c0c81231fdd7fc559d1c6045ecc5e5bd3a00e7e8f2f49197b`.
+  - `docs/index.md` now links `workspace-artifacts.md` and `release-status.md`,
+    which it did not, so the docs home is a real index rather than a partial one.
+
+- **`docs/check_readme_size.py` guards against re-inflation.** It fails when
+  `README.md` exceeds a recorded line and word budget, **and** when any single
+  `## ` section exceeds its own budget, so one section cannot quietly absorb the
+  whole allowance. `docs/readme_size_baseline.json` holds the recorded budget
+  (248 lines, 1490 words) and `--update` re-records it, printing a warning when a
+  budget is raised rather than lowered. Verified by mutation: appending twelve
+  invented bullets to `Honest limits` exits 1 naming that section, and a four-line
+  prose expansion of `Documentation` exits 1 naming lines, words and that section.
+  **It is not wired into CI by this change** — adding the job means editing
+  `.github/workflows/`, which is outside this work's file ownership. Until it is
+  wired, the guard only runs when invoked by hand.
+
+- The `2.4.3` attestation facts were re-measured rather than assumed: the PyPI
+  per-file provenance endpoint returns `200` for both the wheel and the sdist, and
+  the npm attestations endpoint returns `404`. The README keeps the two-line
+  statement naming both channels, and `test_readme_states_the_npm_attestation_gap`
+  still passes against it.
+
+### Fixed
+
+- **Supply-chain claims are now measured, scoped and separated by mechanism.** The three
+  things that get blurred into "attested" are now named separately wherever they appear
+  in `README.md`, `SECURITY.md` and `docs/release-status.md`:
+  1. a **digest** (`dist.integrity`, `digests.sha256`) proves the bytes match what was
+     published and says nothing about the build;
+  2. npm's **`dist.signatures`** is a registry *transport* signature over the packument,
+     present for every package whether or not it was built in CI, and is never build
+     provenance;
+  3. a **build attestation** (Sigstore/in-toto on npm, PEP 740 on PyPI) is the only one of
+     the three that names a workflow, repository and commit.
+- **The current version was stale at `2.4.2` in the release-status claims** while `2.4.3` is
+  the release on both registries. Refreshed, with the npm `shasum`, integrity, file count
+  and unpacked size, and the PyPI wheel and sdist SHA-256, all re-measured. The npm values
+  were re-checked by running `npm pack` on `main` (`45fd5ee`): integrity reproduces exactly.
+- **The PyPI integrity URL shape is called out explicitly**, because reading the wrong shape
+  is how a false negative gets reported. PyPI serves attestations **per file**, so the path
+  ends in `/<filename>/provenance`. `https://pypi.org/integrity/plan-auditor/2.4.3/` is not
+  an endpoint and returns `404`; that `404` means "no such URL", **not** "no attestation".
+  The per-file endpoint returns `200` with an in-toto v1 statement, predicate type
+  `https://docs.pypi.org/attestations/publish/v1`, publisher
+  `kind=GitHub, repository=Furox-Art/plan-auditor, workflow=release.yml, environment=pypi`,
+  whose subject digest equals the SHA-256 PyPI serves for the file.
+- **The condition for npm provenance is stated as pending**, with the four facts it needs:
+  a trusted publisher on npmjs.com for owner `Furox-Art`, package `plan-auditor`, workflow
+  filename `npm-publish.yml`, and the environment the publish job declares. Nothing in this
+  repository needs to change. Until that record exists, npm consumers verify by digest and
+  the docs keep saying so.
+- `SECURITY.md` gained the per-channel verification commands and the mechanism table, so a
+  reader can check a claim without trusting this repository.
+
+### Added
+
+- **`docs/check_attestation_claims.py`** — a regression guard for supply-chain claims, with
+  its own negative control. It rejects any attestation claim that names no channel, that
+  states no definite status, that presents `dist.signatures` as provenance, or that calls a
+  stale version current. Run it three ways:
+
+  ```bash
+  python docs/check_attestation_claims.py             # scan the docs
+  python docs/check_attestation_claims.py --online    # also re-measure both registries
+  python docs/check_attestation_claims.py --self-test # negative control
+  ```
+
+  The negative control feeds the guard five deliberately false claims and fails unless all
+  five are rejected, plus one correct claim it must accept and two same-word-different-meaning
+  cases (`docs/benchmark.md` measurement provenance, `docs/formal-planning.md` source
+  provenance) it must not flag. A guard that cannot be shown to reject a known lie is not a
+  guard, so `--self-test` is part of the deliverable rather than a nicety.
+
+  It is not wired into CI, because this change set does not touch workflows. Adding one step
+  to `.github/workflows/plan-audit.yml` that runs
+  `python docs/check_attestation_claims.py --self-test && python docs/check_attestation_claims.py`
+  would close that; until then it runs on demand.
+
+### Not claimed
+
+- No security claim is weakened anywhere. npm is still described as digest-only, and the
+  PyPI attestation is still described as present, because that is what the registries
+  return.
+
+## v2.4.3 - 2026-10-04
+
+A documentation release. The README restructure and the three corrections below
+land on PyPI's project page for the first time: `2.4.2`'s `long_description` is
+the old 499-line README and still carries the "so it cannot drift from reality"
+claim that this release removes. PyPI serves `description` per release, so only
+a new release can change it.
+
+**No behaviour change in `supervisor/`, in the deterministic core, or in the npm
+launcher.** Verified against the published artifacts, not the working tree:
+`supervisor/` has no commit since `311f4dc`, and the `index.js` and
+`bin/plan-auditor.js` inside the PyPI `2.4.2` wheel are byte-identical to those
+on `main`.
+
+Two packaging changes do reach users. Both are already live on npm at `2.4.2`,
+which was published at 16:16:46Z -- after #29 landed at 16:14:02Z -- so this is
+the first release in which they reach PyPI:
+
+- **The wheel's embedded `package.json` now declares `engines.node >=22.14.0`.**
+  The `2.4.2` wheel says `>=18`, because it was uploaded 2026-10-02T23:06:40Z and
+  therefore predates #27. Anyone copying the bundled launcher out of this wheel
+  onto Node 18 or 20 now gets npm's engine warning.
+- **The sdist and npm tarball carry `bin/prepublish_gate.js`** in place of the
+  `bin/check_tarball_contents.js` and `bin/verify_installed_launcher.js` it
+  replaces. Both old scripts only ran under `prepublishOnly`; so does the new
+  one. Installed behaviour is unchanged -- what a publisher executes differs.
+
+
+- **Three false claims in the README and quickstart are corrected.**
+  - The quick-start transcript documented `request_sha256`
+    `7b347f48...0db55f`. The CLI has never printed that value: `request_contract.py`
+    stamps `plan_contract_sha256s` into the request before hashing, so the printed
+    digest is not a hash of the source file. Running the documented walkthrough in
+    a clean virtualenv yields `d7d47e409fc1c53b9830346740bac2a20e716aefc71e7396ad3db0ebbdd837f2`.
+    Fixed in `README.md` and `docs/quickstart.md`. The value was unaffected by
+    reformatting the JSON, because the digest is taken over the parsed contract
+    rather than the file bytes.
+  - The README claimed the transcript "cannot drift from reality" because
+    `tests/test_readme_quickstart.py` executes it. It could. `_mask()` rewrites
+    every 64-hex string to `<sha256>` and the transcript check is a subset test, so
+    substituting `dead0000...` for the real digest left the suite green: measured
+    at 389 passed, 0 failed. The claim is corrected and two new tests close the gap
+    (see below).
+  - The README and `CONTRIBUTING.md` both described `examples/fib` as shipping a
+    "deliberately broken variant". It does not; the directory holds four files, none
+    of them broken. `docs/benchmark.md` is where you break it yourself, and says so.
+
+- **`tests/test_readme_quickstart.py` can now fail on the two ways it used to
+  pass.** Proven by mutation against this commit.
+  - `test_readme_quickstart_hashes_are_not_normalised_away` compares the documented
+    digests against the *unmasked* real output, so a fabricated hash is rejected.
+    Replacing `request_sha256` with `dead0000...`: **389 passed / 0 failed before,
+    1 failed after**.
+  - `test_readme_quickstart_json_keys_match_the_real_output` compares the JSON key
+    sequence at each indentation level and only tolerates a shorter sequence where
+    the document actually used a `...` marker. Dropping `deterministic_core` from
+    the `audit` block, which had no elision, is now a failure. This check caught a
+    real omission introduced while compressing this very README.
+  - A third mutation, inserting a fabricated `plan_hash`, fails both the original
+    subset test and the new hash test.
+
+- **The README now explains the repository instead of only the happy path.**
+  Measured against a 60-surface checklist drawn from the code, coverage goes from
+  14/60 to 60/60. Added: the L0-L14 layer table with the two layers that can decide
+  a verdict; all 11 command groups and their 17 nested actions; the other three
+  console scripts including `plan-auditor-formal`'s `verify`/`export-pddl`/
+  `make-check`; the core's `status`/`snapshot`/`rollback` modes; the `regex` check
+  type and the rule that `regex` and `file_exists` are non-behavioural; profiles,
+  run modes and the four LLM tiers; every file written under `.plan-auditor/`;
+  `hooks/gate_hook.py` as the single authoritative gate with no per-host adapter
+  files; exit codes including `3` for `UNKNOWN`; and
+  `references/plan-format.md`.
+  - Two checklist items from the audit were wrong and are documented as the code
+    actually is: the tiers are `NO_LLM`/`SMALL_LOCAL`/`STRONG_LOCAL`/`REMOTE`
+    (four, not "T1/T2/T3"), and there are no six hook adapters — `hooks/` contains
+    `gate_hook.py` and its README, and the per-host wiring patterns are documented
+    in `docs/integrations.md`.
+
+- **The 53-line release-status block moved to `docs/release-status.md`** and is in
+  the mkdocs navigation. Almost all of it describes one version number and would be
+  wrong at the next release. The README keeps two lines, and keeps them honest
+  rather than dropping the substance: `2.4.2` is current on both registries, npm
+  has no provenance attestation and returns `404` for one, and PyPI publishes with a
+  PEP 740 attestation. `test_readme_states_the_npm_attestation_gap` still passes
+  against the shortened text, so the move did not cost the supply-chain disclosure.
+
+- **Sections that GitHub or the docs already render are gone from the README:**
+  the inline `Troubleshooting` block (a 158-line per-error guide lives in
+  `docs/quickstart.md`), the standalone `npm` section, `Project links`, and
+  `License`. README length falls from 499 to 356 lines.
+
+- **Two doc tests were updated because they pinned text that moved, not because
+  they were inconvenient.** `test_readme_adoption_region_covers_the_essentials`
+  used `## Troubleshooting` as its region sentinel; the sentinel is now
+  `## Documentation`, and the ordering assertions it exists to protect are
+  unchanged. `test_doc_transcripts.py` no longer requires the README to carry a
+  failing run, but now also requires the README to link the page that does, and
+  that page to still document the most common failure.
+
+- **A new test keeps the deleted troubleshooting reachable.**
+  `test_readme_points_at_the_full_troubleshooting_page` fails if the README stops
+  linking `docs/quickstart.md`, or if that page stops documenting
+  `"request contract is not activated"`.
+
+- **A successful npm publish is no longer reported as a failed one.** Run
+  37136117550 published `plan-auditor@2.4.2` and then failed its own
+  verification step one second later with `ERROR: npm reports 'nothing',
+  expected 2.4.2`. `npm publish` returns when the registry's *write* path accepts
+  the upload, while clients read from a CDN that converges asynchronously; the
+  run's own timestamps show the window, with the probe at 16:15:10Z against a
+  registry `time["2.4.2"]` of 16:16:46Z. The verification step now polls with a
+  growing backoff over a bounded budget — 12 attempts, ~200s of waiting, first
+  match wins — and a version that never appears still fails closed with a
+  `::warning::` explaining what to check. Both directions are covered by
+  `tests/test_npm_registry_visibility.py`.
+- **The poll queries the registry over HTTP instead of `npm view`.** `npm view`'s
+  stdout is not a stable contract, its on-disk HTTP cache can answer from state
+  staler than the registry, and it inherits `npm_config_*` and `NODE_AUTH_TOKEN`
+  from the environment. `GET /<package>/<version>` is exactly what an
+  independent reader requests, with no cache in between.
+- **Documentation now matches the registries.** `README.md`, `SECURITY.md` and
+  `docs/index.md`, `docs/quickstart.md`, `docs/integrations.md` no longer say npm
+  is unpublished or that the published builds are behind `main`. `2.4.2` is on
+  both registries; `2.4.0` and `2.4.1` carried the defects and `2.4.2` is the
+  fixed release.
+- **The attestation story is stated per registry, from the registries themselves.**
+  PyPI `2.4.2` carries a PEP 740 provenance attestation. npm `2.4.2` does **not**:
+  the attestations endpoint returns `404` and the packument has no `provenance`
+  field, because it was published in token mode, which cannot mint one. The npm
+  `dist.signatures` block is npm's own signature over the packument and is not
+  described as provenance.
+- **The npm badge is retained** only after confirming the registry's `latest`
+  (`2.4.2`) matches PyPI's version (`2.4.2`).
+
 ## v2.4.2 - 2026-10-03
 
 - **npm publishing is restored, and `2.4.2` exists because the published `2.4.1`
@@ -11,7 +279,7 @@ All notable changes to plan-auditor. Versions are published to PyPI and npm.
   workspace directory resolves `.` against the *installed package directory* and
   reports `plan yok: .../node_modules/plan-auditor/.plan-auditor/plan.json`. The
   launcher starts and an absolute workspace path works, so the failure is silent
-  and looks authoritative — it audits the wrong tree. `2.4.1` cannot be
+  and looks authoritative — it audits the wrong tree. `2.4.1` cannot be
   republished because npm versions are immutable, hence the patch bump.
 - **The launcher now runs the CLI in the caller's working directory.** `index.js`
   keeps `process.cwd()` and prepends the package directory to `PYTHONPATH`
@@ -20,9 +288,13 @@ All notable changes to plan-auditor. Versions are published to PyPI and npm.
 - **`npm publish` runs again.** The previous commit replaced the publish step
   with `echo "npm publishing is disabled" && exit 0`, so the workflow reported
   success while publishing nothing. Publishing is back, gated on the version not
-  already existing on the registry, using OIDC trusted publishing with
-  `npm publish --provenance`. `NPM_TOKEN` remains available as an explicitly
-  documented fallback only.
+  already existing on the registry, and selectable between OIDC trusted
+  publishing and an `NPM_TOKEN` fallback that must be requested explicitly.
+  Correction: `2.4.2` itself was published in **token mode** — the run log
+  records `selected publish mode: token` — so it carries **no** provenance
+  attestation. The attestation endpoint for `plan-auditor@2.4.2` returns `404`
+  and the packument has no `provenance` field. Only PyPI publishes with
+  attestation, via trusted publishing.
 - **The publish path proves the artifact works before uploading it.** The gate
   packs the tarball, installs it into a throwaway directory, and runs the
   *installed* `bin/plan-auditor.js` from an unrelated working directory against a
@@ -32,12 +304,11 @@ All notable changes to plan-auditor. Versions are published to PyPI and npm.
   `.github/pypi-release-trigger` on `main` publishes the same version to both
   registries, so the two cannot drift apart.
 
-## Unreleased — OSS visibility and onboarding
+### OSS visibility and onboarding (shipped in `2.4.2`)
 
 Documentation and project-metadata work only. No behaviour in the supervisor, the
-deterministic core or the npm launcher changed, and the version numbers in
-`pyproject.toml`, `package.json`, `SKILL.md` and `CITATION.cff` are untouched at
-`2.4.1` — a release owner must bump them for any of this to reach a registry.
+deterministic core or the npm launcher changed. This work was merged before the
+`2.4.2` release commit, so it is part of `2.4.2` rather than still pending.
 
 - **The README now states the real release status instead of implying parity.** The
   published PyPI `2.4.1` was built 2026-09-29 and npm `2.4.1` 2026-10-01, from
@@ -92,7 +363,7 @@ deterministic core or the npm launcher changed, and the version numbers in
   there is no PGP key. `CODE_OF_CONDUCT.md` moved enforcement off the public
   issue tracker, which would have exposed reporters, onto a private address, and
   its Contact section now matches what Contributor Covenant 2.1 requires.
-- **`CONTRIBUTING.md` documents the workflow the code actually implements** — the
+- **`CONTRIBUTING.md` documents the workflow the code actually implements** — the
   real test and coverage commands, the seal and trust chain, exit codes, the
   `CHECK_TYPES` extension path, and the release procedure including the reason the
   two registries diverged.
@@ -103,15 +374,15 @@ deterministic core or the npm launcher changed, and the version numbers in
   GitHub" link, and social links for the repository, PyPI, npm and the citation
   file. Navigation is unchanged and still covers every page.
 
-### Re-verified against `main` after #24
+#### Re-verified against `main` after #24
 
 - **The README's release-status text was corrected against the merged code rather
   than the previous `main`.** The wheel now force-includes the Agent Skill assets
   under `plan_auditor_skill/`, so the earlier claim that a `pip` install cannot
   supply `SKILL.md`, `references/` or `hooks/` was true of the published `2.4.1`
   wheel and false of anything built from `main`. The README and
-  `docs/integrations.md` now document both routes — a checkout, or the installed
-  `plan_auditor_skill/` directory — with a command that prints its location, and
+  `docs/integrations.md` now document both routes — a checkout, or the installed
+  `plan_auditor_skill/` directory — with a command that prints its location, and
   the claim is scoped to the already-published build. `docs/` and `examples/` are
   still not in the wheel, which is stated as such.
 - **The npm surface was re-checked against the merged launcher, not the old one.**
@@ -158,7 +429,7 @@ that already exists on PyPI, so the metadata on `main` cannot be published witho
 a version bump. That part is unchanged by this entry.
 
 The other half has been fixed since, by #24: the npm workflow now runs a `verify`
-job — the launcher tests and the packed-tarball check — before publishing, and
+job — the launcher tests and the packed-tarball check — before publishing, and
 refuses a version already on the registry, so the absence of any gate that let
 `2.4.0` ship a syntax error is no longer the state of the tree. `main` is also
 now protected by a ruleset with no bypass actors, so none of the required checks
@@ -167,7 +438,7 @@ can be skipped by pushing to `main`.
 **Still outstanding:** the version bump itself. Until `2.4.2` is published to both
 registries, a `pip` user keeps seeing the pre-rewrite README on the project page.
 
-## v2.4.1 — PyPI 2026-09-29, npm 2026-10-01
+## v2.4.1 — PyPI 2026-09-29, npm 2026-10-01
 
 ### Published to both registries
 
@@ -199,7 +470,7 @@ registries, a `pip` user keeps seeing the pre-rewrite README on the project page
 
 - **Both npm entry points now propagate the verifier's exit code.** The fix was
   initially placed only in `index.js`, but `package.json` maps the `plan-auditor`
-  bin to `bin/plan-auditor.js` — the file `npx plan-auditor` actually executes —
+  bin to `bin/plan-auditor.js` — the file `npx plan-auditor` actually executes —
   and that file discarded the child's result entirely. Verified: `node
   bin/plan-auditor.js run <failing plan>` returned `0` while `index.js` returned
   `1`. `index.js` now exposes `runPythonAndPropagate()`, which attaches the
@@ -215,9 +486,9 @@ registries, a `pip` user keeps seeing the pre-rewrite README on the project page
 - `test_docs_metadata.py` and `test_doc_transcripts.py` now check that the `bin`
   field resolves to a launcher that propagates rather than a bare spawn, and that
   documented launcher commands reference a file that exists.
-- **Verbatim transcripts.** The README and `docs/quickstart.md`/`docs/cli.md` failure transcripts previously showed a single collapsed `çıktı:` line while the tool actually prints a `|`-joined multi-line traceback. Both blocks now reproduce the real output line for line and state that nothing is elided.
+- **Verbatim transcripts.** The README and `docs/quickstart.md`/`docs/cli.md` failure transcripts previously showed a single collapsed `çıktı:` line while the tool actually prints a `|`-joined multi-line traceback. Both blocks now reproduce the real output line for line and state that nothing is elided.
 - **Removed a fabricated transcript line from `docs/benchmark.md`:** it showed
-  `çıktı: AssertionError` where the tool emits a full traceback. Replaced with
+  `çıktı: AssertionError` where the tool emits a full traceback. Replaced with
   verbatim output, plus the equivalent launcher invocation and its exit code.
 - **Transcripts are now stable across the CI matrix.** Two platform differences
   had made the documented failure output wrong somewhere: the core joins a
@@ -233,7 +504,7 @@ registries, a `pip` user keeps seeing the pre-rewrite README on the project page
   traceback that pins a version-specific frame.
 - **`.npmignore` added and `package.json` tightened:** `__pycache__` directories were still being packed despite the `files` allowlist, because the allowlist re-includes whole directories. Added `!**/__pycache__` and `!**/*.py[cod]` negation patterns and a minimal `.npmignore`. `npm pack --dry-run` now reports 59 entries / ~134 KB with zero `__pycache__`, `.venv`, or `site-packages` paths, down from 18502 entries / 29.1 MB.
 
-## v2.4.0 — 2026-09-06
+## v2.4.0 — 2026-09-06
 
 - **Deterministic automatic formalization:** `plan-auditor-formalize compile` converts structured Plan Auditor requirements, coverage, dependencies, named outputs, `requires_outputs`, and deterministic checks into a conservative grounded STRIPS contract without asking an LLM to invent authoritative symbolic semantics.
 - **Independent formalization proof:** generated contracts carry a `formalization-source:<SHA256>` marker and are independently recompiled from the current plan; stale, weakened, omitted, or manually edited generated contracts are rejected even if their embedded contract SHA is recomputed.
@@ -242,7 +513,7 @@ registries, a `pip` user keeps seeing the pre-rewrite README on the project page
 - **New installed CLI:** adds `plan-auditor-formalize compile|verify`; package and skill identity advance to stable `2.4.0`.
 - **Regression coverage:** tests exercise exact recompilation, source-staleness detection, goal weakening, dropped output preconditions, fake initial requirement goals, idempotence, sealed-plan mutation refusal, and manual-contract preservation.
 
-## v2.3.0 — 2026-09-06
+## v2.3.0 — 2026-09-06
 
 - **Sealed classical planning:** non-trivial multi-step plans can embed one sealed `formal_planning` contract with explicit initial facts, final goals, one grounded STRIPS-style action per Plan Auditor step, symbolic preconditions, add effects and delete effects.
 - **Native LLM-free reachability:** monotonic contracts use deterministic forward reasoning while delete-effect contracts use bounded state-space search. Exhausting the configured state budget returns UNKNOWN instead of manufacturing PASS.
@@ -253,12 +524,12 @@ registries, a `pip` user keeps seeing the pre-rewrite README on the project page
 - **Regression coverage:** dedicated formal-planning and semantic-binding tests cover reachable/unreachable contracts, delete-effect dead ends, alternate valid orderings, bounded search, PDDL sanitization, duplicate anchors, requirement omissions and formal-contract mutation.
 - **Version identity:** source/package/skill version advances to `2.3.0`, so the post-v2.2.0 formal-planning and semantic-binding code is no longer distributed under the already-published `2.2.0` identity.
 
-## v2.2.0 — 2026-09-05
+## v2.2.0 — 2026-09-05
 
 - **Physical control-plane confinement:** existing `.plan-auditor`, plan, seal, request/activation and policy path components are inspected with `lstat`; symlinked parents/leaves cannot redefine the workspace trust root.
 - **Policy read confinement:** `load_config` authorizes only symlink-free workspace policy directories before policy loading; a resolved external symlink target is rejected before its files are read.
 - **Sealed scope freeze:** automatic monotonic strengthening remains available for extra deterministic checks/prerequisites, but new steps, requirements, tools, coverage assignments or declared outputs now require a new host-approved request generation.
-- **Safe v3→v4 migration:** `plan-auditor-migrate-seal` provides a representation-only migration path for exact full-contract v3 seals. It requires authoritative request alignment and refuses any plan-scope change.
+- **Safe v3→v4 migration:** `plan-auditor-migrate-seal` provides a representation-only migration path for exact full-contract v3 seals. It requires authoritative request alignment and refuses any plan-scope change.
 - **Seal self-consistency:** v3/v4 seals validate their contract hash and criteria count on load/save before being trusted or authenticated.
 - **Streaming evidence verification:** JSONL verification, hashing and HMAC migration retain one record/chunk at a time instead of reading complete evidence/archive files into RAM.
 - **PID-aware registry locking:** registry transaction locks carry PID + random token; live owners are never evicted because of age alone, and stale cleanup requires a provably dead PID plus unchanged lock identity.
@@ -268,7 +539,7 @@ registries, a `pip` user keeps seeing the pre-rewrite README on the project page
 - **Trust-boundary documentation:** deliberate same-OS-user interference is explicitly treated as an OS isolation problem; separate account/container/VM deployment is required when that attacker is in scope.
 - **Regression coverage:** new tests cover plan/policy symlink escapes, scope expansion, config-only activation, PID-aware registry locks, streaming evidence verification and exact legacy-seal migration.
 
-## v2.1.0 — 2026-09-05
+## v2.1.0 — 2026-09-05
 
 - **Aggregate multi-plan completion:** the integrated supervisor now enumerates the default plan and every safe `.plan-auditor/plans/<name>.json` plan. Global PASS requires every active plan to PASS; a passing default plan cannot hide an unfinished named plan, and a named-only workspace is no longer misclassified as `NO_PLAN`.
 - **Explicit requirement coverage:** Supervisor Mode requires explicit requirements and deterministic `covers` links from steps. Every `must`/`should` requirement must be covered; omitted user requirements, unknown coverage IDs and duplicate requirement contracts block plan approval/PASS.
@@ -290,7 +561,7 @@ registries, a `pip` user keeps seeing the pre-rewrite README on the project page
 - **Regression hardening:** dedicated failure-injection tests cover named-plan bypasses, seal-contract weakening, environment downgrade, HMAC seal tampering, invalid config/policies, path traversal, evidence races/rotation/retry history, active-log tampering, rollback cleanup, executable-bit fingerprint changes, canonical agent conflicts, missing tools and bounded verifier output.
 - **Observational final audit:** a full audit fails if a verifier mutates product workspace content, type, or mode. Verification must prove pre-existing implementation state rather than creating the claimed result during the audit itself.
 
-## v2.0.2 — 2026-09-05
+## v2.0.2 — 2026-09-05
 
 - **Integrated supervisor pipeline:** new `supervisor/orchestrator.py` wires plan validation, requirements, workspace state, policies, sealing, deterministic evidence, adversarial review, completion gating, lifecycle state, and multi-agent state into one fail-closed assessment.
 - **Real hook enforcement:** `hooks/gate_hook.py` no longer trusts `status=verified` or fabricated integrity flags; PASS requires a valid seal and matching fresh full-audit evidence.
@@ -302,7 +573,7 @@ registries, a `pip` user keeps seeing the pre-rewrite README on the project page
 - **Workspace safety:** file checks and rollback are path-confined; workspace observation is read-only and uses `shutil.which()` instead of shell redirections that could create files.
 - **Daemon integration:** the background supervisor persists an integrated assessment and final gate outcome on every observation cycle.
 
-## v1.1.0 — 2026-09-03
+## v1.1.0 — 2026-09-03
 
 - **Portable skill paths:** `SKILL.md` resolves auditor scripts relative to the skill directory.
 - **Hard attempt cap:** `run` refuses a step after the configured failed-attempt cap unless explicitly forced.
@@ -310,7 +581,7 @@ registries, a `pip` user keeps seeing the pre-rewrite README on the project page
 - **Snapshot / rollback:** snapshot and rollback support were introduced and recorded in evidence.
 - **Evidence rotation:** large evidence logs rotate into `.plan-auditor/archive/`.
 
-## v1.0.0 — 2026-09-03
+## v1.0.0 — 2026-09-03
 
 - Initial strict plan + independent auditor Agent Skill.
 - Machine-checkable `verify` checks (`run`, `exec`, `file_exists`, `regex`, `pytest`).

{plan_auditor-2.4.2 → plan_auditor-2.4.4}/CITATION.cff

@@ -21,8 +21,8 @@ authors:
 repository-code: "https://github.com/Furox-Art/plan-auditor"
 url: "https://github.com/Furox-Art/plan-auditor"
 license: MIT
-version: 2.4.2
-date-released: "2026-10-03"
+version: 2.4.4
+date-released: "2026-10-10"
 keywords:
   - AI coding agents
   - deterministic verification

{plan_auditor-2.4.2 → plan_auditor-2.4.4}/CONTRIBUTING.md

@@ -221,7 +221,7 @@ with a non-zero code if Python cannot be started at all.
 - Every command you document must exist. `tests/test_docs_metadata.py` parses
   fenced code blocks and checks the subcommand against the real argument parser.
 - Every transcript must be copied from a real run, and any elision must say what
-  is elided. A `çıktı:` line whose interior depends on your Python version must be
+  is elided. An `output:` line whose interior depends on your Python version must be
   scoped, not quoted.
 - Never add a download count, a star count, a user count or a trust badge. Link to
   the package page instead; the tests reject a copied number.
@@ -299,7 +299,7 @@ the point: nothing in the release path depends on a maintainer remembering a ste
 | `plan-auditor doctor .` | Machine-readable capability and health report. Run this first when anything misbehaves. |
 | `SKILL.md` | The Agent Skill definition loaded by skill hosts. |
 | `hooks/gate_hook.py` | The authoritative hook gate for hosts that support blocking hooks. |
-| `examples/fib/` | A complete, runnable two-step plan, including a deliberately broken variant. |
+| `examples/fib/` | A complete, runnable two-step plan whose second step is a pytest run. |
 | `docs/` | The documentation set. Navigation is defined in `mkdocs.yml`. |
 
 ## Conduct and security