Record signed Phase L completion

CHANGELOG.md

@@ -17,6 +17,7 @@ All notable changes are documented here. RealDone follows semantic versioning wh
 - Hosted main run `30195945498` passed and signed all 15 normative gates across Linux, Windows and macOS for the Phase I fingerprint and installed-package path.
 - Hosted main run `30200299159` passed and signed all 15 normative gates across Linux, Windows and macOS for the Phase J fingerprint; both aggregate artifacts verified against merge `6d736d5`.
 - Hosted main run `30203185815` passed and signed all 15 normative gates across Linux, Windows and macOS for the Phase K fingerprint; both aggregate artifacts verified against merge `ca9e9db`.
+- Hosted main run `30206231697` passed and signed all 15 normative gates on the first attempt across Linux, Windows and macOS for the Phase L fingerprint; both aggregate artifacts verified against merge `badd3a9`.
 
 ### Fixed
 

docs/COMPATIBILITY.md

@@ -10,7 +10,7 @@ Phase J fingerprint `0b39d542…` repeated the matrix in hosted main run [`30200
 
 Phase K fingerprint `4625a9cc…` repeated the matrix in hosted main run [`30203185815`](https://github.com/datzle123/RealDone/actions/runs/30203185815). All 15 gates passed after one Windows Node 22 managed-runtime startup retry, GitHub signed both aggregate artifacts for merge `ca9e9db`, and `gh attestation verify` accepted their provenance.
 
-The Phase L candidate adds optional `ManagedScanRequest.runtimeStartupTimeoutMs`, CLI `--runtime-startup-timeout`, and MCP `scan.runtimeStartupTimeoutMs` controls. Existing API callers remain source-compatible because the request field is optional; CLI/MCP defaults change only the managed-runtime health wait and do not alter report schema or already-running URL scans. Cross-platform hosted qualification is pending.
+Phase L fingerprint `3663ff0c…` adds optional `ManagedScanRequest.runtimeStartupTimeoutMs`, CLI `--runtime-startup-timeout`, and MCP `scan.runtimeStartupTimeoutMs` controls. Existing API callers remain source-compatible because the request field is optional; CLI/MCP defaults change only the managed-runtime health wait and do not alter report schema or already-running URL scans. Hosted main run [`30206231697`](https://github.com/datzle123/RealDone/actions/runs/30206231697) passed 15/15 on its first attempt across Linux, Windows and macOS; GitHub signed both artifacts for merge `badd3a9`.
 
 | Surface | Release gate |
 | --- | --- |

docs/PRODUCT_STATUS.md

@@ -3,7 +3,7 @@
 **Snapshot:** 2026-07-26
 **Released full product:** **IMPLEMENTED in `v1.3.3`**
 **Latest release qualification:** hosted run `30189340006` passed and signed all 15 gates for the versioned source commit and installed-package path.
-**Latest main qualification:** hosted run [`30203185815`](https://github.com/datzle123/RealDone/actions/runs/30203185815) passed and signed all 15 gates for Phase K merge `ca9e9db` and fingerprint `4625a9cc…`; `gh attestation verify` accepted both aggregate artifacts.
+**Latest main qualification:** hosted run [`30206231697`](https://github.com/datzle123/RealDone/actions/runs/30206231697) passed and signed all 15 gates on its first attempt for Phase L merge `badd3a9` and fingerprint `3663ff0c…`; `gh attestation verify` accepted both aggregate artifacts.
 **Area coverage:** **22/22 `IMPLEMENTED`**, **0/22 `PARTIAL`**, **0/22 `PLANNED`**. Detector catalog: **58/58 production-classified and gated**.
 
 This file reports current evidence against the normative [`PRODUCT_SPECIFICATION.md`](PRODUCT_SPECIFICATION.md). It does not reduce that specification. `IMPLEMENTED` requires executable evidence; `PARTIAL` means useful code exists but the full normative behavior or release gate does not.
@@ -16,7 +16,7 @@ Phase J is complete on `main`: scan and contract/MCP traces are inspected immedi
 
 Phase K is complete on `main` at fingerprint `4625a9cc…`: automatic standalone/trace screenshots and browser videos are suppressed before capture whenever the action has a known sensitive field or the context uses auth state; contract trace screenshots/videos are suppressed for `secretEnv` or authenticated contexts. Safe unauthenticated controls still retain visual evidence, and reports use additive value-free `visualSuppressions` metadata. Fresh TodoMVC, Actual Budget, Conduit SQLite/PostgreSQL + Supabase and Pocket Ledger/Codex runs are bound to this fingerprint. Local check (142 pass, 2 service-dependent skips), audit, full Chromium smoke, pack and installed-tarball smoke passed. PR run `30202575079` and main run `30203185815` passed 15/15 across Linux, macOS and Windows; the Windows Node 22 managed-runtime smoke needed one retry in each run, and the main aggregate was signed for merge `ca9e9db`.
 
-Phase L is the current unreleased runtime-readiness candidate at fingerprint `3663ff0c…`: CLI/MCP managed startup now has a dedicated bounded timeout (30 seconds by default) instead of sharing the 10-second page-render budget, accepts an explicit override, and reports redacted process state, PID and restart counts on failure. The MCP browser smoke uses a dynamic port and an intentionally delayed app: a 1-second broken case times out and cleans up, while the default control starts, scans and stops successfully. Local check (144 pass, 2 service-dependent skips), audit, full Chromium smoke, pack and installed-tarball smoke passed. Fresh SHA-256-bound TodoMVC, Actual Budget, Conduit SQLite/PostgreSQL + Supabase, PostgreSQL CRUD cleanup, Pocket Ledger Level 7 and Codex RD901 regression/repair evidence all validate with a clean artifact secret scan. Hosted cross-platform and signed aggregate qualification remain pending.
+Phase L is complete on `main` at fingerprint `3663ff0c…`: CLI/MCP managed startup has a dedicated bounded timeout (30 seconds by default) instead of sharing the 10-second page-render budget, accepts an explicit override, and reports redacted process state, PID and restart counts on failure. The MCP browser smoke uses a dynamic port and an intentionally delayed app: a 1-second broken case times out and cleans up, while the default control starts, scans and stops successfully. Local check (144 pass, 2 service-dependent skips), audit, full Chromium smoke, pack and installed-tarball smoke passed. Fresh SHA-256-bound TodoMVC, Actual Budget, Conduit SQLite/PostgreSQL + Supabase, PostgreSQL CRUD cleanup, Pocket Ledger Level 7 and Codex RD901 regression/repair evidence validate with a clean artifact secret scan. PR run `30205895718` and main run `30206231697` passed 15/15 on the first attempt across Linux, macOS and Windows; GitHub signed the main aggregate for merge `badd3a9`.
 
 | Specification area | Status | Evidence currently in the repository | Remaining normative gap |
 | --- | --- | --- | --- |
@@ -25,7 +25,7 @@ Phase L is the current unreleased runtime-readiness candidate at fingerprint `36
 | §4 Record and verify | IMPLEMENTED | bounded semantic recording and deterministic verification for navigation, click/fill/select/check/keypress/upload/rich-text/drag, popup/download outcomes, masked rrweb, env-only secrets/files and non-ordinal locator fallbacks | Widget-specific adapters may extend recording without changing the implemented contract |
 | §4 Baseline/regression | IMPLEMENTED | baseline, affected-flow selection, first-class `EXPECTED_CHANGE`/`REGRESSION` outcomes, RD901–RD905 classification, CI diff and Playwright export | Additional domain-specific diff adapters may extend the implemented contract |
 | §4 Coding-agent verification | IMPLEMENTED | shared-core MCP tools retain workspace/action confinement, sealed contracts/baselines, final post-build attribution and fail-closed affected selection; authenticated Codex Desktop `0.143.0` produced a green baseline, selected 1 real RD901 regression, repaired the app without changing the contract, then selected 1 flow with 0 regressions; SHA-256-bound cycle artifacts are parsed by the release validator | New agent clients must preserve the implemented evidence boundary; agent prose is never verification evidence |
-| §6 Project Discovery/Runtime Manager | IMPLEMENTED | `init` profiles single-package/monorepo projects; npm fallback without lock metadata; project-local Python virtual environments; zero-config static HTML plus conventional Node, Django/FastAPI/Flask, Laravel/PHP, Rails, ASP.NET Core, Spring Boot, Deno, Go and Rust managed runtimes; occupied-port rejection, development/production/Docker health-checks, dedicated configurable startup timeout, redacted process diagnostics, bounded restarts and process cleanup; installed-tarball scans start, verify and stop metadata-free static and npm projects in hosted run `29977292441` | Phase L must repeat full cross-platform and package evidence before its candidate becomes complete; custom runtimes may still use an explicit HTTP URL |
+| §6 Project Discovery/Runtime Manager | IMPLEMENTED | `init` profiles single-package/monorepo projects; npm fallback without lock metadata; project-local Python virtual environments; zero-config static HTML plus conventional Node, Django/FastAPI/Flask, Laravel/PHP, Rails, ASP.NET Core, Spring Boot, Deno, Go and Rust managed runtimes; occupied-port rejection, development/production/Docker health-checks, dedicated configurable startup timeout, redacted process diagnostics, bounded restarts and process cleanup; delayed managed startup passed hosted Windows/macOS/Linux package/browser gates in run `30206231697` | Custom runtimes may use an explicit HTTP URL; future runtime changes must preserve the cross-platform broken/control and cleanup gate |
 | §7 Environment Health Gate | IMPLEMENTED | main/route document, critical asset/content-type, bootstrap/render, health-endpoint and auth-state checks; separate `environment.json`; broken/control fixtures and TodoMVC defect copy | Additional ecosystem-specific diagnostics may be added without changing the implemented fail-closed contract |
 | §8–11 Discovery, classification, data, executor | IMPLEMENTED | forms/links/buttons/native controls, Enter, hover/context, lazy-scroll, popup/download, opt-in same-origin iframe, complex-action recording boundaries, constraint-aware canaries, network-idle/stale/retry safety, and budget selection that avoids route/semantic starvation and known-denial budget waste | Framework-specific discovery adapters may broaden coverage without changing the implemented safe-execution contract |
 | §12–13 Evidence and snapshots | IMPLEMENTED | URL, redacted semantic DOM/control hashes, cookie hashes, local/session storage, bounded IndexedDB metadata, request/response, WebSocket frames, console/page error, upload/download digests, screenshots, trace/video/timeline, value-free source diffs, and redacted automatic provider evidence/artifacts; every retained browser/contract trace passes bounded ZIP inspection against generated sensitive fields, `secretEnv`, opaque auth-state cookies/tokens and generic credential patterns before linkage, while unsafe/unscannable traces are deleted; screenshots/videos are not created for known-sensitive or authenticated contexts and both policies emit only value-free suppression metadata; reproductions retain value-free provider requirements and replay requires fresh exact causal confirmation | New evidence adapters must preserve the implemented redaction, retention, linkage and replay contract |
@@ -39,10 +39,10 @@ Phase L is the current unreleased runtime-readiness candidate at fingerprint `36
 | §24 Multi-role | IMPLEMENTED | isolated role storage states, UI visibility, Level 7 cross-role observation, API denial, direct route, cross-tenant read/write, revoked-role and invalidated-session probes | Application-specific role provisioning remains user configuration, not a missing verification capability |
 | §25 Safety | IMPLEMENTED | interactive scans require one explicit project-level action consent and non-interactive CLI/MCP execution fails closed without `--yes`/user-owned server authorization; host/destructive/external opt-ins, form/endpoint/provider classification, file/cross-origin/popup boundaries, live pre-execution escalation, redaction, cleanup, read-only adapters, production guards, immediate fail-closed trace retention, pre-capture screenshot/video suppression and the aggregate artifact secret gate remain independent | New action/provider/artifact classes must preserve the implemented consent and least-authority boundaries |
 | §26 Benchmark | IMPLEMENTED | precision, recall, FPR, discovery, expectation coverage, verdict/detector accuracy, replay, truncation, environment validity and confirmed cleanup success are machine-readable and release-gated | Future metrics must remain additive and deterministic |
-| §27 Real-world cases | IMPLEMENTED | current main fingerprint `4625a9cc…` has fresh repository-bound scans for TodoMVC, Actual Budget, Conduit/SQLite, Conduit/PostgreSQL 17 + Supabase Data API and Codex-generated Pocket Ledger; all nine normative capability classes have semantic validator-parsed evidence, including PostgreSQL CRUD cleanup, upload/export, Level 7 roles, multi-step and agent repair; signed hosted run `30203185815` passed Windows/macOS/Linux | Future engine fingerprints must repeat the hosted signed qualification |
-| §28–31 Engineering/release/performance/UX | IMPLEMENTED | published npm package with registry-smoked `npx realdone scan`; installed-tarball first-scan gates start, verify and clean up metadata-free static and npm projects; one-command managed scan with bounded first-use browser bootstrap; CI, license/audit/package gates, quick/full budgets, coverage-balanced selection, bounded workers, final post-build affected-flow selection, trace-on-failure, snapshot dedup, environment/artifact/schema/raw-case gates and GitHub artifact-attestation workflow; main run `30203185815` passed hosted 15/15 across Windows/macOS/Linux, Node 20/22, PostgreSQL 17, MongoDB 8 and package smoke | Future releases must preserve the same release gates |
-| §32 Full-product definition | IMPLEMENTED | all 22 product areas are `IMPLEMENTED`; current main fingerprint `4625a9cc…` passed the complete matrix, installed-package smoke and all 15 hosted gates with verified signed GitHub provenance in run `30203185815`; released `v1.3.3` retains its independent run `30189340006` | Future scope additions must add production behavior and executable gates before retaining this status |
+| §27 Real-world cases | IMPLEMENTED | current main fingerprint `3663ff0c…` has fresh repository-bound scans for TodoMVC, Actual Budget, Conduit/SQLite, Conduit/PostgreSQL 17 + Supabase Data API and Codex-generated Pocket Ledger; all nine normative capability classes have semantic validator-parsed evidence, including PostgreSQL CRUD cleanup, upload/export, Level 7 roles, multi-step and agent repair; signed hosted run `30206231697` passed Windows/macOS/Linux | Future engine fingerprints must repeat the hosted signed qualification |
+| §28–31 Engineering/release/performance/UX | IMPLEMENTED | published npm package with registry-smoked `npx realdone scan`; installed-tarball first-scan gates start, verify and clean up metadata-free static and npm projects; one-command managed scan with bounded first-use browser bootstrap; CI, license/audit/package gates, quick/full budgets, coverage-balanced selection, bounded workers, final post-build affected-flow selection, trace-on-failure, snapshot dedup, environment/artifact/schema/raw-case gates and GitHub artifact-attestation workflow; main run `30206231697` passed hosted 15/15 on the first attempt across Windows/macOS/Linux, Node 20/22, PostgreSQL 17, MongoDB 8 and package smoke | Future releases must preserve the same release gates |
+| §32 Full-product definition | IMPLEMENTED | all 22 product areas are `IMPLEMENTED`; current main fingerprint `3663ff0c…` passed the complete matrix, installed-package smoke and all 15 hosted gates with verified signed GitHub provenance in run `30206231697`; released `v1.3.3` retains its independent run `30189340006` | Future scope additions must add production behavior and executable gates before retaining this status |
 
 ## Truthful release wording
 
-`v1.3.0` is the first release qualified against the complete specification. `v1.3.2` added hosted cross-platform installed-package evidence for universal first-run discovery. `v1.3.3` releases fingerprint `68d4a8cb…` with the refreshed real-project qualification and signed hosted run `30189340006`. Unreleased main fingerprint `4625a9cc…` independently passed signed hosted run `30203185815`; that does not retroactively change the npm package. Earlier releases remain real tested increments, but do not retroactively carry later qualification. Future release notes must link this status page and identify the hosted signed run for their fingerprint and package path.
+`v1.3.0` is the first release qualified against the complete specification. `v1.3.2` added hosted cross-platform installed-package evidence for universal first-run discovery. `v1.3.3` releases fingerprint `68d4a8cb…` with the refreshed real-project qualification and signed hosted run `30189340006`. Unreleased main fingerprint `3663ff0c…` independently passed signed hosted run `30206231697`; that does not retroactively change the npm package. Earlier releases remain real tested increments, but do not retroactively carry later qualification. Future release notes must link this status page and identify the hosted signed run for their fingerprint and package path.