datzle123 · datzle123 · Jul 26, 2026 · Jul 26, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,7 @@ All notable changes are documented here. RealDone follows semantic versioning wh
 - Coverage-balanced quick-scan scheduling that represents more routes, action kinds, intents, and keyboard/submit activation paths within the same finite action budget, while placing known policy/environment denials after runnable actions.
 - Additive action-selection telemetry in JSON and HTML reports, including eligible/selected/omitted counts, route coverage, semantic coverage, denial counts, the deterministic strategy version, and an explicit partial-scan explanation.
 - Fresh fingerprint-bound qualification across TodoMVC, Actual Budget, Conduit/SQLite, Conduit/PostgreSQL 17 + Supabase Data API, and Codex-generated Pocket Ledger, including PostgreSQL create/update/delete cleanup, Level 7 roles, and a real Codex MCP baseline → RD901 regression → repair cycle.
+- Hosted main run `30195945498` passed and signed all 15 normative gates across Linux, Windows and macOS for the Phase I fingerprint and installed-package path.
 
 ### Fixed
 

diff --git a/docs/COMPATIBILITY.md b/docs/COMPATIBILITY.md
@@ -2,6 +2,8 @@
 
 `v1.3.3` passed the matrix below in hosted run [`30189340006`](https://github.com/datzle123/RealDone/actions/runs/30189340006), including installed-tarball scan/cleanup gates for metadata-free static and npm projects. GitHub signed the 15/15 aggregate for source commit `b682da329fde789f2f8aa6fe339b0195887c778d`.
 
+Unreleased main fingerprint `f3f65840…` preserved the same matrix and package path in hosted run [`30195945498`](https://github.com/datzle123/RealDone/actions/runs/30195945498). All 15 gates passed on Linux, Windows and macOS with Node 20/22, and GitHub signed the aggregate evidence and gate report for merge commit `2572aba57edf418f87750352ed3b3d36868015ac`.
+
 | Surface | Release gate |
 | --- | --- |
 | Node.js | 20 and 22 |

diff --git a/docs/PRODUCT_STATUS.md b/docs/PRODUCT_STATUS.md
@@ -3,13 +3,14 @@
 **Snapshot:** 2026-07-26
 **Released full product:** **IMPLEMENTED in `v1.3.3`**
 **Latest release qualification:** hosted run `30189340006` passed and signed all 15 gates for the versioned source commit and installed-package path.
+**Latest main qualification:** hosted run `30195945498` passed and signed all 15 gates for Phase I fingerprint `f3f65840…`.
 **Area coverage:** **22/22 `IMPLEMENTED`**, **0/22 `PARTIAL`**, **0/22 `PLANNED`**. Detector catalog: **58/58 production-classified and gated**.
 
 This file reports current evidence against the normative [`PRODUCT_SPECIFICATION.md`](PRODUCT_SPECIFICATION.md). It does not reduce that specification. `IMPLEMENTED` requires executable evidence; `PARTIAL` means useful code exists but the full normative behavior or release gate does not.
 
 Release `v1.3.3` additionally ran ten pinned MIT projects and detected 10/10 injected no-op Create buttons as `NO_EFFECT / RD002`; commit, license, clean-control, run, and report hashes are in [`release/evidence/case-studies-10`](../release/evidence/case-studies-10/README.md). The five normative external cases were rerun and validator-bound to fingerprint `68d4a8cb…`, including PostgreSQL CRUD cleanup, Supabase Data API, Level 7 roles, and a real Codex MCP RD901 regression/repair cycle. Hosted run [`30189340006`](https://github.com/datzle123/RealDone/actions/runs/30189340006) passed all 15 gates across Windows/macOS/Linux and GitHub signed the aggregate for the released source commit.
 
-The unreleased Phase I hardening adds coverage-balanced quick-scan scheduling and additive selection telemetry. Candidate fingerprint `f3f65840…` passed local type/unit/build (140 tests with 2 expected service-dependent skips), audit, full Chromium smoke, pack, installed-tarball smoke, and fresh repository-bound runs for all five normative external cases. TodoMVC exercised both Enter paths; Actual Budget preserved its safe history-dependent `UNCERTAIN`; Conduit passed untruncated SQLite and PostgreSQL 17 + Supabase Data API scans plus real create/update/delete cleanup; Pocket Ledger passed six visible actions, Level 7 roles, and a new Codex MCP RD901 regression/repair cycle. Aggregating those artifacts with the successful Linux/macOS/Windows attestations from candidate run `30193615824` passes 15/15 locally. Phase I is still not released until a fresh hosted run validates and signs the evidence commit itself.
+Phase I hardening is complete on `main`: coverage-balanced quick-scan scheduling and additive selection telemetry are bound to fingerprint `f3f65840…`. Local type/unit/build (140 tests with 2 expected service-dependent skips), audit, full Chromium smoke, pack and installed-tarball smoke passed. Fresh repository-bound runs covered all five normative external cases: TodoMVC exercised both Enter paths; Actual Budget preserved its safe history-dependent `UNCERTAIN`; Conduit passed untruncated SQLite and PostgreSQL 17 + Supabase Data API scans plus real create/update/delete cleanup; Pocket Ledger passed six visible actions, Level 7 roles, and a new Codex MCP RD901 regression/repair cycle. Hosted run [`30195945498`](https://github.com/datzle123/RealDone/actions/runs/30195945498) passed 15/15 on Linux, macOS and Windows; `gh attestation verify` accepted the signed aggregate evidence and gate report. This main-branch qualification is not a new npm version by itself; `v1.3.3` remains the latest published release.
 
 | Specification area | Status | Evidence currently in the repository | Remaining normative gap |
 | --- | --- | --- | --- |
@@ -32,10 +33,10 @@ The unreleased Phase I hardening adds coverage-balanced quick-scan scheduling an
 | §24 Multi-role | IMPLEMENTED | isolated role storage states, UI visibility, Level 7 cross-role observation, API denial, direct route, cross-tenant read/write, revoked-role and invalidated-session probes | Application-specific role provisioning remains user configuration, not a missing verification capability |
 | §25 Safety | IMPLEMENTED | interactive scans require one explicit project-level action consent and non-interactive CLI/MCP execution fails closed without `--yes`/user-owned server authorization; host/destructive/external opt-ins, form/endpoint/provider classification, file/cross-origin/popup boundaries, live pre-execution escalation, redaction, cleanup, read-only adapters, production guards and artifact secret gates remain independent | New action/provider classes must preserve the implemented consent and least-authority boundaries |
 | §26 Benchmark | IMPLEMENTED | precision, recall, FPR, discovery, expectation coverage, verdict/detector accuracy, replay, truncation, environment validity and confirmed cleanup success are machine-readable and release-gated | Future metrics must remain additive and deterministic |
-| §27 Real-world cases | IMPLEMENTED | released fingerprint `68d4a8cb…` has fresh repository-bound scans for TodoMVC, Actual Budget, Conduit/SQLite, Conduit/PostgreSQL 17 + Supabase Data API and Codex-generated Pocket Ledger; all nine normative capability classes have semantic validator-parsed evidence, including PostgreSQL CRUD cleanup, upload/export, Level 7 roles, multi-step and agent repair; signed hosted run `30189340006` passed Windows/macOS/Linux | Future engine fingerprints must repeat the hosted signed qualification |
-| §28–31 Engineering/release/performance/UX | IMPLEMENTED | published npm package with registry-smoked `npx realdone scan`; installed-tarball first-scan gates start, verify and clean up metadata-free static and npm projects; one-command managed scan with bounded first-use browser bootstrap; CI, license/audit/package gates, quick/full budgets, bounded workers, final post-build affected-flow selection, trace-on-failure, snapshot dedup, environment/artifact/schema/raw-case gates and GitHub artifact-attestation workflow; release run `30189340006` passed hosted 15/15 across Windows/macOS/Linux, Node 20/22, PostgreSQL 17, MongoDB 8 and package smoke | Future releases must preserve the same release gates |
-| §32 Full-product definition | IMPLEMENTED | all 22 product areas are `IMPLEMENTED`; released fingerprint `68d4a8cb…` passed the refreshed complete matrix, registry package smoke and all 15 hosted gates with verified signed GitHub provenance in run `30189340006` | Future scope additions must add production behavior and executable gates before retaining this status |
+| §27 Real-world cases | IMPLEMENTED | current main fingerprint `f3f65840…` has fresh repository-bound scans for TodoMVC, Actual Budget, Conduit/SQLite, Conduit/PostgreSQL 17 + Supabase Data API and Codex-generated Pocket Ledger; all nine normative capability classes have semantic validator-parsed evidence, including PostgreSQL CRUD cleanup, upload/export, Level 7 roles, multi-step and agent repair; signed hosted run `30195945498` passed Windows/macOS/Linux | Future engine fingerprints must repeat the hosted signed qualification |
+| §28–31 Engineering/release/performance/UX | IMPLEMENTED | published npm package with registry-smoked `npx realdone scan`; installed-tarball first-scan gates start, verify and clean up metadata-free static and npm projects; one-command managed scan with bounded first-use browser bootstrap; CI, license/audit/package gates, quick/full budgets, coverage-balanced selection, bounded workers, final post-build affected-flow selection, trace-on-failure, snapshot dedup, environment/artifact/schema/raw-case gates and GitHub artifact-attestation workflow; main run `30195945498` passed hosted 15/15 across Windows/macOS/Linux, Node 20/22, PostgreSQL 17, MongoDB 8 and package smoke | Future releases must preserve the same release gates |
+| §32 Full-product definition | IMPLEMENTED | all 22 product areas are `IMPLEMENTED`; current main fingerprint `f3f65840…` passed the complete matrix, installed-package smoke and all 15 hosted gates with verified signed GitHub provenance in run `30195945498`; released `v1.3.3` retains its independent run `30189340006` | Future scope additions must add production behavior and executable gates before retaining this status |
 
 ## Truthful release wording
 
-`v1.3.0` is the first release qualified against the complete specification. `v1.3.2` added hosted cross-platform installed-package evidence for universal first-run discovery. `v1.3.3` releases fingerprint `68d4a8cb…` with the refreshed real-project qualification and signed hosted run `30189340006`. Earlier releases remain real tested increments, but do not retroactively carry later qualification. Future release notes must link this status page and identify the hosted signed run for their fingerprint and package path.
+`v1.3.0` is the first release qualified against the complete specification. `v1.3.2` added hosted cross-platform installed-package evidence for universal first-run discovery. `v1.3.3` releases fingerprint `68d4a8cb…` with the refreshed real-project qualification and signed hosted run `30189340006`. Unreleased main fingerprint `f3f65840…` independently passed signed hosted run `30195945498`; that does not retroactively change the npm package. Earlier releases remain real tested increments, but do not retroactively carry later qualification. Future release notes must link this status page and identify the hosted signed run for their fingerprint and package path.
diff --git a/docs/REAL_WORLD_VALIDATION.md b/docs/REAL_WORLD_VALIDATION.md
@@ -54,7 +54,7 @@ The Phase G rerun binds each compact evidence document to both the raw `scan.jso
 | Conduit + PostgreSQL 17 + Supabase Data API | `VALID`, untruncated | 17 `VERIFIED`; signup was `SOURCE_OF_TRUTH_CONFIRMED` Level 6 through both adapters with the same added-row hash | 0 |
 | Pocket Ledger | `VALID`, untruncated | all 6 visible actions `VERIFIED`, including focus-revealed skip link, multipart upload and non-empty CSV export | 0 |
 
-The current checked-in evidence is bound to Phase I candidate fingerprint `f3f65840e53777056fed4fc770853a522da85c46626f5bc910853515c266cc1a`. Every primary scan was `VALID` and untruncated. Compact documents bind the primary scans, PostgreSQL CRUD scans, cleanup ledger, Level 7 role verification and Codex cycle artifacts by SHA-256. Candidate-head run [`30193615824`](https://github.com/datzle123/RealDone/actions/runs/30193615824) already passed its Linux/macOS/Windows, Node 20/22, browser and package jobs; its first aggregate correctly failed because the previous external artifacts belonged to fingerprint `68d4a8cb…`. Combining those same successful platform attestations with the fresh candidate evidence now passes 15/15 locally, but Phase I remains unreleased until hosted CI validates and signs the evidence commit itself. Released `v1.3.3` and its signed run [`30189340006`](https://github.com/datzle123/RealDone/actions/runs/30189340006) remain the historical release qualification.
+The current checked-in evidence is bound to Phase I main fingerprint `f3f65840e53777056fed4fc770853a522da85c46626f5bc910853515c266cc1a`. Every primary scan was `VALID` and untruncated. Compact documents bind the primary scans, PostgreSQL CRUD scans, cleanup ledger, Level 7 role verification and Codex cycle artifacts by SHA-256. The first candidate-head run [`30193615824`](https://github.com/datzle123/RealDone/actions/runs/30193615824) correctly rejected the previous fingerprint's external artifacts; after the real cases were rerun, PR run [`30195613599`](https://github.com/datzle123/RealDone/actions/runs/30195613599) passed 15/15. Hosted main run [`30195945498`](https://github.com/datzle123/RealDone/actions/runs/30195945498) repeated the Linux/macOS/Windows, Node 20/22, browser, database and package gates, passed all 15 normative gates, and signed both aggregate JSON artifacts. `gh attestation verify` matched their SHA-256 subjects. Released `v1.3.3` and its independent signed run [`30189340006`](https://github.com/datzle123/RealDone/actions/runs/30189340006) remain the historical published-package qualification.
 
 PostgreSQL qualification used the pinned upstream Conduit app with only a harness port mapping, native PostgreSQL 17.10, real create/update/delete row diffs and key-bounded cleanup. The Supabase source adapter read the same action through a local Supabase Data API-compatible PostgREST 14.15 endpoint; the official Supabase CLI was also checked, but its full Auth/Storage local stack could not start on this machine because Docker Desktop/WSL is absent. This evidence therefore claims the maintained Supabase Data API adapter boundary, not a hosted Supabase service.
 
@@ -66,7 +66,7 @@ The first current-engine Conduit rerun exposed an RD501 false positive: the publ
 
 The 2026-07-23 Actual Budget rerun then exposed a safety regression: its server target is a text input with an `https://example.com` placeholder rather than `type="url"`. RealDone initially filled a canary and clicked Connect, producing a DNS failure. URL-bearing placeholders now retain external-target classification; the rerun returned to 6 `VERIFIED`, 1 safe `UNCERTAIN`, 3 policy `SKIPPED`, and zero defects.
 
-Machine-readable candidate inputs are in `release/external-cases.json` and `release/evidence/`. For the released package, hosted run [`30189340006`](https://github.com/datzle123/RealDone/actions/runs/30189340006) passed all 15 gates, GitHub signed both aggregate JSON artifacts, and `gh attestation verify` accepted them for `v1.3.3`. Phase I receives its own signed run only after the candidate evidence commit passes hosted aggregation; it does not inherit the prior signature. The earlier `v1.3.2` package path remains qualified by hosted run [`29977292441`](https://github.com/datzle123/RealDone/actions/runs/29977292441).
+Machine-readable main inputs are in `release/external-cases.json` and `release/evidence/`; hosted run [`30195945498`](https://github.com/datzle123/RealDone/actions/runs/30195945498) signed the Phase I aggregate after all 15 gates passed. For the released package, hosted run [`30189340006`](https://github.com/datzle123/RealDone/actions/runs/30189340006) independently passed and signed all 15 gates for `v1.3.3`. The earlier `v1.3.2` package path remains qualified by hosted run [`29977292441`](https://github.com/datzle123/RealDone/actions/runs/29977292441).
 
 ### Actual Budget original application
 

diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
@@ -138,7 +138,7 @@ Gate:
 
 Phase H is complete. The final local batch passed 129/129 executed tests, audit, browser smoke, packing, and installed-tarball scans of both a metadata-free static project and an npm project without lockfile/package-manager metadata; both managed runtimes were confirmed stopped. Hosted run [`29977292441`](https://github.com/datzle123/RealDone/actions/runs/29977292441) then passed Linux, Windows and macOS on Node 20/22, the package scan/cleanup gate, and all 15 normative release gates. `gh attestation verify` confirmed GitHub-signed provenance for source commit `ab902acdfb95463c82a7c842f5b497a68d8c325a`.
 
-## Phase I — coverage-balanced quick-scan scheduling (release candidate)
+## Phase I — coverage-balanced quick-scan scheduling (complete)
 
 Contributes evidence to: §4.1, §8–11, §29–31.
 
@@ -150,4 +150,4 @@ Gate:
 - JSON/HTML reports expose eligible, selected, omitted, represented-route, semantic coverage, denial counts and strategy version without breaking schema `1.0` consumers.
 - Broken/control unit coverage and a real-browser three-route budget fixture pass with typecheck, audit, browser smoke and package gates.
 
-Phase I implementation and local qualification are complete for candidate fingerprint `f3f65840…`: typecheck/unit/build passed 140 tests with 2 expected service-dependent skips, dependency audit reported no known vulnerabilities, full Chromium smoke passed the real three-route budget control, and pack plus installed-tarball package smoke passed. Fresh SHA-256-bound runs now cover TodoMVC, Actual Budget, Conduit/SQLite, Conduit/PostgreSQL 17 + Supabase Data API, PostgreSQL CRUD cleanup, Level 7 roles, and a Codex MCP baseline → RD901 regression → repair cycle. Reusing only the successful candidate-head Linux/macOS/Windows attestations from run `30193615824`, local aggregation passes 15/15. The phase remains a release candidate until hosted CI reruns against and signs the evidence commit.
+Phase I is complete for fingerprint `f3f65840…`: typecheck/unit/build passed 140 tests with 2 expected service-dependent skips, dependency audit reported no known vulnerabilities, full Chromium smoke passed the real three-route budget control, and pack plus installed-tarball package smoke passed. Fresh SHA-256-bound runs cover TodoMVC, Actual Budget, Conduit/SQLite, Conduit/PostgreSQL 17 + Supabase Data API, PostgreSQL CRUD cleanup, Level 7 roles, and a Codex MCP baseline → RD901 regression → repair cycle. Hosted main run [`30195945498`](https://github.com/datzle123/RealDone/actions/runs/30195945498) passed all 15 gates across Linux, macOS and Windows, Node 20/22, PostgreSQL 17, MongoDB 8 and installed-package smoke. GitHub signed the aggregate evidence and gate report, and `gh attestation verify` accepted both artifacts.
diff --git a/docs/VERIFICATION_MATRIX.md b/docs/VERIFICATION_MATRIX.md
@@ -2,7 +2,7 @@
 
 This matrix maps RealDone's public behavior to an executable release gate. A feature is not marked complete merely because an API or type exists; the gate must exercise its observable result or a fail-closed boundary.
 
-This is the executable matrix for the shipped product, not a product-status ledger. The normative scope and 15 full-product release gates live in [`PRODUCT_SPECIFICATION.md`](PRODUCT_SPECIFICATION.md); [`PRODUCT_STATUS.md`](PRODUCT_STATUS.md) is the only area-completeness ledger. Specification §32 is complete because every status row is `IMPLEMENTED` and hosted run `29958126604` passed the full matrix with signed provenance—not merely because an individual phase gate passed.
+This is the executable matrix for the shipped product, not a product-status ledger. The normative scope and 15 full-product release gates live in [`PRODUCT_SPECIFICATION.md`](PRODUCT_SPECIFICATION.md); [`PRODUCT_STATUS.md`](PRODUCT_STATUS.md) is the only area-completeness ledger. Specification §32 is complete because every status row is `IMPLEMENTED`; current main fingerprint `f3f65840…` passed the full matrix with signed provenance in hosted run `30195945498`, not merely because an individual phase gate passed.
 
 | Capability | Runtime evidence | Automated gate |
 | --- | --- | --- |