Anti-Dark-Code v2026.10.09-unified.18

Complete historical router recovery for installed, legacy and current packaged layouts. Recorded historical replay uses the recorded Git tree, including bare repositories; missing historical routers never fall back to a newer working tree. Ambiguous candidates, wrong digests, nonregular historical blobs and redirected backfill paths remain refused.

This release also includes PR81's Windows private-staging repair, PR79's current-time model-policy test fixtures, and the reviewed search-discovery work from PR78/80. VERSION, catalog, plugin metadata, pinned examples, website and the seven-page field brief are synchronized. The saved ThinkPad workspace proposals and Windows investigation were already incorporated through PR65 and PR66; no duplicate lesson promotion is included.

Verification and integrity:

• Release commit: f3bb479. Its tree exactly matches the independently reviewed PR82 candidate.
• Managed-core SHA-256: 24beceec388efb6ec1e1fa68a3d348a4fe615f701a03b31107323ce5835a68bd.
• PR82's complete Windows/macOS/Linux, Python 3.13, hostile-environment, distribution and mutation checks passed. The release integrity manifest records main CI and actual tagged-extract verification.
• A disposable digest-bound v17-to-v18 upgrade preserves invariant text, gate approvals, routing/machine state, repository binding identity/history and repository-owned upstream fields. Installation bookkeeping updates explicitly. No gates or live ledgers were executed or changed.
• The PDF has seven verified pages/destinations; all page text matches v17 after version/date substitutions. Visual inspection passed and two fresh renders match after timestamp normalization.
• Current native ThinkPad and non-elevated Windows compatibility remain unverified. Claude and skills-ref validators were unavailable; GitHub's skill dry-run validator passed with repository-layout warnings. Hosted runner tests do not establish native host discovery or those missing checks.

Review SHA256SUMS and release-integrity.json, inspect the archive, validate its clean distribution, and review the installer dry run using the published managed-core digest before applying an update. Follow OPERATIONS.md and PLUGINS.md for your host. Preserve repository calibration and any opted-in usage ledger; this release changes neither consent nor existing collection history.

Rollback source: v2026.10.04-unified.17, managed-core SHA-256 1d95ca4c22f01c014bc2e77492ed5e29a7d1205017b15e06c8c89da85ad20840. Review rollback conflicts and preserve repository calibration and any usage ledger.

Anti-Dark-Code v2026.10.04-unified.17

Unified.17 promotes two trial-backed lessons into the shared core, prunes sixteen candidates whose baselines never missed, and makes behavioral trial evidence a standing requirement for promoted instruction text.

• references/assurance-preservation.md: when destination identity protects writes, bind them to a verified held directory handle or platform equivalent, prove the actual child retains that binding, and test replacement or unmount after validation (baseline trials missed this in one of five runs).
• references/assurance-native-execution.md: at the last protected step, prove a separate contender cannot acquire the lock with incidental holders absent; test closed, reused and wrong-object descriptors and stale environment claims (baseline missed in five of five runs; with the text, met in two of three).
• references/15-dogfeeding-flowback.md, CONTRIBUTING.md and the public site: promotion needs at least three fresh-context trials per case per skill state, text is kept only when a baseline trial misses its obligation, baselines are topped up to five before pruning, counts and quotes are recorded rather than percentages, and pruned lessons stay queued as rejected naming the evidence.
• design/lessons-unified-17-plan.md and design/evals/lessons-v17/: the review, cases and trial evidence, including the sixteen pruned segments verbatim.
• Illuminated code artwork for Codex plugin and skill metadata, progressive-frost navigation on the website and screen brief, the README pointing at the public site, and the brief PDF re-rendered with design/render-brief-pdf.py (same Chromium build as unified.16) with refreshed provenance.

Use the pinned tag and instructions in PLUGINS.md. Plugin metadata enables no automatic collection, hooks, background jobs or MCP servers.

Verification

All 14 checks on the pull-request head passed (https://github.com/LynxTWO/anti-dark-code-skill/actions/runs/37248761218): Windows, macOS and Linux Python suites, hostile environments, clean distribution archive, mutation replay shards and the shadow evidence record. The merged release tree is byte-identical to that tested tree.

Local, on the release-prep commit: 743 tests passed, 5 Windows-only skips, 673 subtests passed (Python 3.14.4, Linux); universal validation 0 errors, 0 warnings; clean-extract distribution validation and packaging check valid; tagged release-check with the published core digest passes with no undescribed files. Brief PDF: seven print pages and seven named destinations verified; two fresh renders match after timestamp normalization.

Core digest (managed-core SHA-256, published independently of the archive): 1d95ca4c22f01c014bc2e77492ed5e29a7d1205017b15e06c8c89da85ad20840

Assets: the brief (HTML, PDF, provenance), the clean source archive, release-integrity.json and SHA256SUMS.

Anti-Dark-Code v2026.09.27-unified.16

Unified.16 packages Anti-Dark-Code for native installation in Codex, Claude Code and Gemini CLI while keeping one shared core and preserving repository calibration during upgrades.

• Moves the universal source to skills/anti-dark-code/; regenerates portable and host manifests and marketplace metadata from the canonical version.
• Documents native installation/discovery, integrity checks and migration from published unified.15.
• Brings the approved glass design to the website and screen brief: frosted navigation, rounded opaque reading panels and clear workflow/PDF actions. Preserves crisp seven-page PDF output and refreshed provenance.
• Adds optional one-time/monthly GitHub Sponsors links.

Use the pinned tag and instructions in PLUGINS.md. Plugin metadata enables no automatic collection, hooks, background jobs or MCP servers.

Verification

All 14 candidate checks passed, including Windows/macOS/Linux Python suites, hostile environments, clean distribution and mutation replay. The merged release tree exactly matches that tested candidate. Final tagged release-check and available host validators pass. Fresh installation and upgrade from published .15 preserve ten calibration files byte-for-byte. Core macOS tests: 741 passed, 5 skipped, 674 subtests passed. The final documentation revision also passes 14 focused tests with 493 subtests.

Native checks on this macOS arm64 system: Codex 0.158.0-alpha.2.1 installed the plugin and discovered its enabled skill; Gemini CLI 0.61.0 installed and discovered its enabled skill; Claude Code 2.1.283 passed strict validation and native installation/listing. These observations do not establish model activation rates or task-quality improvements. Native host loading on Windows/Linux remains unmeasured.

The refreshed PDF was visually reviewed on all seven pages, its six named internal destinations verified, and a second render matched its normalized digest. The website and screen brief passed 64 viewport/theme/navigation cases across Chromium 151 and WebKit 26.5, down to 320px. Reduced-transparency and forced-color fallbacks passed in Chromium.

Integrity

Managed-core SHA-256:

915f01c660baa3cf8999d19e681d137d338f028f67caedbcf11e135f6d61323d

Download SHA256SUMS alongside the assets. release-integrity.json identifies the actual tag/commit, archive digest, CI evidence and verification limits. The archive contains the tagged distribution; separate HTML, PDF and provenance files match that tag byte-for-byte.

CI evidence · Release changes · Optional GitHub Sponsors support

Anti-Dark-Code v2026.09.15-unified.15

Anti-Dark-Code adds an Improve task card with scoped quality tests, product principles and a product-contract template. Audit-only work, owner authority and stable capability and status IDs are preserved. The profiler now partitions HTML scripts, handlers, controls, prose and inert data, recognizes framework-free browser apps and declared Python CLI entrypoints, and keeps runtime family, file size and unknown maturity separate.

The probe no longer stays silent about what it could not read. A manifest it cannot parse is listed and warned about instead of reading as a package with no scripts, and a package.json that is valid JSON but not an object no longer stops the probe. Mutation-tool sandboxes such as .stryker-tmp, and in-tree copies that hold a byte-identical root manifest, are skipped and recorded instead of becoming proposed gates.

The opt-in usage ledger refuses shared or wrong-owner paths before any sensitive write, creates private files and verifies POSIX modes or Windows ACLs. It adds a private summary export and a manual history-removal workflow, and supports routine Codex task reviews through reviewed native hooks. On Windows the permission checker loads only its own system modules and now has a measured timeout: slow Windows PowerShell starts under CPU contention caused intermittent refusals at the former 15 s ceiling. Refusals name their reason (timed out, could not start, or did not confirm a private ACL). No retry was added and no permission policy changed. Work receipts count each model response once; earlier receipts from row-split transcripts overstate usage.

New and adapted lessons cover physical-client handoff readiness, runtime target binding for cached tools, workspace consolidation, generated consumers after moves, separate machine-local state on a second host, and changes whose effect is slower than any test window. Evidence contracts add exact test selection, property case accounting and comparable performance recordings. The brief gains linked contents, page numbers and consistent PDF margins.

All pull-request checks passed, including Windows, macOS and Linux suites, both hostile environments, clean distribution validation and all mutation-replay shards. The tagged tree matches the tested pull request. See checks and changes.

SHA256SUMS covers the attached archive, brief, provenance and integrity record. Preview existing installations with the pinned core digest, preserve calibration and inspect conflicts before applying. Before upgrading an opted-in .14 collector, follow the ledger review in OPERATIONS.md. Rollback uses the prior tagged core after the same review; do not overwrite local calibration or opt-in ledger history.

Anti-Dark-Code v2026.09.07-unified.14

Anti-Dark-Code can now collect reported usage from explicitly authorized local Codex and Claude logs during ordinary work. The optional collector records counters and bounded metadata privately, deduplicates responses and resumes bounded reads without model calls, task replay, transcript retention or uploads. Existing installations remain opt-in.

Task feedback tracks skill use, expected activation and quality with unknowns and exclusions preserved. Reported usage is separated by exact model, effort and attribution source. These observations do not establish causal token savings, subscription cost, remaining quota or population trigger accuracy.

The offline model policy recommends an eligible economical route for directly checkable work and a stronger route for consequential work or one failed acceptance check. Automatic application requires an exposed, authorized host model control; unsupported hosts keep the current model. Dated catalog tiers are starting heuristics, not quality guarantees.

README, operating references, the HTML overview and six-page PDF reflect the implemented behavior while retaining the original branding and presentation. The release also rejects common credential-shaped metadata and isolates automatic Git maintenance in disposable test repositories.

All 14 pull-request checks passed, including Windows/macOS/Linux suites, both hostile environments, clean distribution validation and all mutation-replay shards. The tagged tree matches the tested pull request. See checks and changes.

SHA256SUMS covers the attached archive, brief, provenance and integrity record. Preview existing installations with the pinned core digest, preserve calibration and inspect conflicts before applying. Rollback uses the prior tagged core after the same review; do not overwrite local calibration or opt-in ledger history.

Anti-Dark-Code v2026.09.07-unified.13

Anti-Dark-Code now uses a compact core, five task cards, and conditional assurance recipes. Existing CLI and calibration contracts are preserved; owner-confirmation and cached-evidence checks are stricter.

README and OPERATIONS separate the introduction from operating details. The updated HTML and six-page PDF describe the implemented workflow while preserving the original branding and presentation. Public examples use generic identities.

Verification passed on Windows, macOS, and Linux, including both hostile environments, clean distribution checks, all 158 mutation rows, and the required aggregate and shadow-evidence jobs. The tagged tree matches the verified pull request. See release checks and changes.

Use the attached ZIP for the reviewed 277-file distribution. SHA256SUMS covers the archive, brief, provenance, and release-integrity record. Existing installations should use the installer dry run, preserve repository calibration, and inspect conflicts before applying.

These checks do not establish host auto-trigger accuracy or causal token savings.

2026.09.06-unified.12

Six lessons from a consuming repository are promoted into the references, and the gate runner gains the targeted repair one of them asks for: gates --rebind refreshes a single drifted source binding and leaves the reviewed profile and plan alone. Supersedes 2026.09.06-unified.11 for distribution.

Identity. Tag v2026.09.06-unified.12 points at 1901303fad361f31ee4783fc5a78bef50e14c2ef. The distributed core hashes to d99d12b5ab74b67b8c8e419f4bc879d7bbcd7e0524a5b6e5f2f2643a3a200e2a; pass that value as --expect-core-digest to bind an install to this release rather than to whatever a source directory happened to contain. release-check --tag v2026.09.06-unified.12 --previous-tag v2026.09.06-unified.11 returns RELEASE OK: the core reproduces from the tag, distribution validation is clean, and no file under references/ or assets/ changed without being described below.

Where it came from. Proposal #50, staged from the same consuming repository as the last two releases. Three of the lessons had been staged there in August and never reached this inbox; three are from this week's work on that repository and on this one, including this repository's own mutation-replay job running at ninety-six percent of its timeout.

What this release does not do. It approves no routing rule and changes no gate's command. --rebind writes only the one gate it is asked to rebind, keeps the previous digest, and requires a note; the profile and the plan are not read or written by it.

---

Six Lessons Promoted

• A claim that crossed a context boundary is a hypothesis again (references/00-conventions.md, confidence levels). A claim inherited across a summary, handoff, or session carries no label until re-measured in the current session, and a refuted inherited claim is recorded as refuted where it was going to be filed.
• Enumerate the channels before reporting an absence (references/00-conventions.md, negative-search evidence). An availability absence names the channels searched; a mid-migration ecosystem makes a single-channel survey systematically negative.
• A line-ending override plus a sweep commit rewrites the repository (references/00-conventions.md, new commit hygiene section, and SKILL.md bounded execution). Explicit staging, no sweep with an environment override, attributes decide line endings, and a diff stat against the base before every push.
• An unaudited producer needs its own output root (references/10-maintenance-harness.md, 9b). A non-gate producer declares an output root outside any audited tree, with the reason commented at the path.
• A required job at the edge of its timeout is a flake waiting for contention (references/10-maintenance-harness.md, harness safety rules). Keep a measured two-to-one margin or split the job; re-measure before opening several pull requests at once.
• A refusal must name a repair that does not destroy something else (references/14-deterministic-verification.md, step 4, and scripts/adc.py). gates --rebind GATE --note TEXT recomputes one gate's source binding, keeps the previous digest under previous_definition_sha256, appends the note to owner_notes, and touches nothing else; it refuses without a note, for an unknown gate, when the binding is not match, and when nothing drifted. The runner's drift refusal now prints the targeted repair for each drifted gate before it mentions the planner. Three tests cover the message order, the targeted rebind, and the refusals. The suite stands at 581 passed and 14 skipped on a Windows workstation without symlink privilege.

Brief and PDF

The brief and site footers describe this release. The PDF is regenerated from that HTML with Chrome 152.0.7977.66 headless on Windows, and its provenance carries the new source, raw, and normalized digests.

2026.09.06-unified.11

The planner stops treating prose as proof: every signal records where its evidence came from, and a capability backed only by documentation stays a candidate. The catalog's twenty-two capabilities are finally described as twenty-two everywhere, with reference entries for V21 and V22. Supersedes 2026.09.05-unified.10 for distribution.

Identity. Tag v2026.09.06-unified.11 points at 8044674f0ddb46b68d12cd3f2e13decbf5ea46bd. The distributed core hashes to 3f32a303bf78e5aa1ae91fe7627ad0c6d86190867470e5f951f598add678a1a1; pass that value as --expect-core-digest to bind an install to this release rather than to whatever a source directory happened to contain. release-check --tag v2026.09.06-unified.11 --previous-tag v2026.09.05-unified.10 returns RELEASE OK: the core reproduces from the tag, distribution validation is clean, and no file under references/ or assets/ changed without being described below.

Where it came from. The same consuming repository that produced unified.10. With the nested-checkout fix installed, its profile still reported 23 of 30 signals present, and every citation for financial entitlement and simulation was a Markdown steering or audit document. The automatic plan selected 21 of 22 capabilities on that basis against a reviewed plan of 10. Staged as public proposal #47 and promoted here.

What this release does not do. It approves no routing rule and changes no gate. A signal's present flag means what it meant before; the new evidence_classes and documentation_only fields are additions, and only the planner's selection of non-core capabilities reads them.

---

Profiling Scope

• Documentation is not evidence that code does a thing. Every signal now records evidence_classes (source, config, structure, prose) and a documentation_only flag. A content match in a steering file, a design note, or a user guide is recorded as prose; the planner holds a non-core capability whose matched signals are all documentation-only at candidate and names them in the reason, instead of selecting it. Two tests cover the flag and the planner's response; references/14-deterministic-verification.md documents both.

Documentation

• The catalog has described 22 capabilities since unified.9, but eleven sentences across SKILL.md, references/10-maintenance-harness.md, references/13-calibrated-local-mode.md, references/14-deterministic-verification.md, and assets/templates/calibration/README.md still said twenty, and references/verification-capabilities.md had no entry for V21 or V22. The counts now say 22, the reference gains both entries in the shape of the others, and V21 joins the core list in its selection summary.

Brief and PDF

The brief and site footers describe this release. The PDF is regenerated from that HTML with Chrome 152.0.7977.66 headless on Windows, and its provenance carries the new source, raw, and normalized digests.

2026.09.05-unified.10

The profiler stops at nested checkouts and agent worktrees, takes an explicit exclusion, recognises Visual Basic .NET, and reports a language it cannot see as an unknown. The proposal inbox is left out of every archive, so a flow-back pull request passes the same clean-distribution check a release does. Supersedes 2026.09.04-unified.9 for distribution.

Identity. Tag v2026.09.05-unified.10 points at 81c9bf63a71cf4688088cf7549a380b367635b81. The distributed core hashes to 47eda63d992ae97c715980633e93bca9bf90f97df77c97b4bb337937c3c8e1d2; pass that value as --expect-core-digest to bind an install to this release rather than to whatever a source directory happened to contain. release-check --tag v2026.09.05-unified.10 --previous-tag v2026.09.04-unified.9 returns RELEASE OK: the core reproduces from the tag, distribution validation is clean, and no file under references/ or assets/ changed without being described below.

Where it came from. Both profiler defects were found by installing unified.9 into a consuming repository whose main language is Visual Basic .NET and whose agent harness keeps linked worktrees under .claude/worktrees/. The profile counted 1383 files where the tree under audit holds 387, listed a steering file from inside a worktree, bound its one discovered gate to solution files four of which lived in worktrees, selected all 22 capabilities where the reviewed plan selects 10, and reported no Visual Basic at all. The lessons were staged as a public proposal (#44) and promoted in #45. The first proposal pull request opened under the test workflow also exposed the inbox defect: the clean-distribution job extracted the very file the proposal added.

What this release does not do. It approves no routing rule. The shadow job is unchanged except that it now uploads its policy sidecars beside each record (#43), which landed after unified.9 and ships here.

---

Profiling Scope

• The profiler stops at a nested checkout. Any directory below the root that carries its own .git entry, file or directory, is another repository: a vendored clone, a submodule, or a linked worktree. The walk no longer descends into it and lists what it skipped under scan.skipped_nested_repositories. Agent worktrees under .claude/worktrees/ are also excluded by name, listed under scan.ignored_worktree_trees, and left out of the source-identity status hash the same way skill trees are.
• probe, plan, and bootstrap accept --exclude <path-or-glob>, repeatable, for content no rule can recognize. The request is normalized, refused if it points outside the repository, recorded under scan.requested_exclusions, and reused when plan re-probes a stale profile, so a plan cannot silently widen a scan the owner narrowed.
• Visual Basic .NET is a recognized language. .vb counts as source, *.vbproj and *.fsproj count as .NET manifests, and the dotnet-test candidate binds to them alongside .sln and .csproj.
• An unrecognized language is reported, not dropped. When an extension outside every table outnumbers the largest recognized language, with at least ten such files, the profile records it under counts.unrecognized_source_extensions and adds a note that language and repo-type classification are incomplete.
• A proposal pull request can pass the clean-distribution check. anti-dark-code/incoming is export-ignore, so git archive and a source-archive download leave the inbox out, which is what CONTRIBUTING.md has always promised.
• references/13-calibrated-local-mode.md and references/14-deterministic-verification.md document the exclusion flag, the recorded scan fields, and how to read the residue note. SKILL.md names worktrees and nested checkouts beside skill trees in the profiling exclusions.

Eight tests cover the nested-checkout skip, the exclusion flag and its refusal of outside paths, the plan's reuse of recorded exclusions, the Visual Basic count and manifest binding, both sides of the residue threshold, and the identity hash ignoring a parked worktree. The suite stands at 576 passed and 14 skipped on a Windows workstation without symlink privilege.

Shadow Evidence Campaign

• assets/templates/shadow-job.yml uploads the two policy sidecars beside the record (#43). The record step has always written policy-<digest>.json and gates-<digest>.json next to the record, and ingest recomputes a record's class from them, but the upload glob carried the record alone. Records already uploaded without sidecars remain ingestible through the recovery path.

Brief and PDF

The brief and site footers describe this release. The PDF is regenerated from that HTML with Chrome 152.0.7977.66 headless on Windows, the same build the previous release named, and its provenance carries the new source, raw, and normalized digests.

2026.09.04-unified.9

The shadow evidence campaign: the measurement by which a proposed routing rule could earn an approval review, and the guards that let a consuming repository bind an install to this exact tag. Supersedes 2026.08.22-unified.8 for distribution.

Identity. Tag v2026.09.04-unified.9 points at 6e6ad669e6ea1d42fb82221f811aded41ec8bd6d, the merge of #42. The distributed core hashes to 86386445faa946617f2c7dc226329847babf8e3668edfafa0fa75d9bc371192b; pass that value as --expect-core-digest to bind an install to this release rather than to whatever a source directory happened to contain. release-check --tag v2026.09.04-unified.9 --previous-tag v2026.08.22-unified.8 returns RELEASE OK: the core reproduces from the tag, distribution validation is clean, and no file under references/ or assets/ changed without being described below.

What this release does not do. It approves no routing rule. Every rule ships proposed, and a proposed rule never runs less than everything. The shadow job is absent from every required check's dependencies and blocks nothing. The campaign's own first canary in this repository came back a miss, and the record that says so is kept; this repository's documentation-only class is approvable by neither evidence path (D-137), which is recorded rather than engineered around.

Brief and PDF. The public brief and site gain a section on the campaign. The PDF is regenerated from that HTML, and its provenance names the renderer that made it: Chrome 152 headless on Windows, replacing the Linux snap Chromium of earlier releases. The normalized digest is reproducible only on the toolchain the record names, which is why it names it.

---

Shadow Evidence Campaign

The routing policy's rules ship proposed, and a proposed rule never runs less than everything. This adds the measurement by which a rule earns an approval review, and documents it for a repository that installs it.

• scripts/adc_shadow.py and the adc.py shadow subcommands: outcomes and record, which a non-required CI job runs on every pull request to record what the proposed rules would have skipped and whether anything skipped failed; backfill, which replays today's router over every pull request's own run history rather than the merges that survived them; ingest, which re-reads each record's outcomes from the run it names and recomputes its verdict before appending it to a committed ledger; and summary, which counts pull requests per route class and is byte-identical on a second run. A record is evidence and never a gate: the job is absent from every required check's dependencies.
• references/shadow-evidence.md documents the campaign for a maintainer: what a record says, what a repository needs, the install steps, the commands, canaries, and the boundaries. It is listed in SKILL.md beside the other supporting references and is not a pass.
• assets/templates/shadow-job.yml is the job, with three placeholders, and assets/templates/shadow-gate-map.json is the mapping from canonical gates to a repository's own CI jobs and steps, with one example of each shape.
• assets/templates/calibration/gates.json gains a canonical_full_set block, empty and commented: what a full route runs is declared beside the gates and checked against the policy, because a policy able to define "full" could shrink it and still look complete. assets/templates/calibration/routing-policy.json gains the classifier and the proposed rules a generated calibration starts from, every rule proposed so it can only ever describe what a route would have been.
• assets/verification-capabilities.json adds V21, affected-unit testing, and V22, input fuzz testing, so the catalog describes 22 capabilities rather than 20. The obligations a routing policy binds are drawn from this catalog, and the shadow campaign's own gates bind to it.
• Ingest recomputes each record's class against the policy that built it, kept beside the ledger and named by its own digest, so a class is checked rather than believed. adc.py shadow dominance is the second path to approval for a class no gate reads: it breaks every path the class covers, twice, runs every gate, and records what each concluded. It runs gates, so it refuses without the same owner confirmation the gate runner requires.

Release and Install Provenance

Four guards, added after unified.7 shipped a tag that did not reproduce the core distributed from it and notes that did not describe everything the release carried. Both defects were found by an independent reviewer at a consuming repository, and neither was caught by anything in this repository, because nothing checked them.

• The installer refuses a source that is not at a release tag. install and bootstrap classify the source as git-tag, git-untagged, git-dirty, or non-git and block the two moving kinds unless --allow-untagged-source is passed after review. A plain extract stays allowed: it cannot drift. This is the guard that would have stopped the original mistake.
• --expect-core-digest binds an install to a published release. The installer refuses unless the source core hashes to the expected digest, and the recorded source_core_sha256 then lets a reviewer check the install against the release without rerunning anything.
• release-check verifies a tag against itself. It extracts the tag, recomputes the core digest, optionally compares it to the digest the release publishes, runs distribution validation on that extract, and returns nonzero on failure. Verifying a release by reading the working tree that produced it proves nothing about the tag.
• Release notes must describe what the release changed. release-check reports every file under references/ or assets/ that changed since the previous tag without being named in the new notes. Mechanical version-string churn is ignored so the check stays worth reading. Run against the historical tags, this reports the unified.7 digest mismatch and its undescribed template change, and passes unified.8.

The deterministic suite grows by source-provenance classification across all four source kinds, both installer refusals, tag-reproduction failure and success, an undescribed reference change, and the version-churn exclusion. Counting everything below, it now stands at 144 tests, of which 131 pass and 13 skip on a Windows workstation without symlink privilege; a host that can create links runs about a dozen more.

Mutation and Fuzz Coverage

• Pilots mutation testing on the highest-stakes modules and records what survived in tools/MUTATION-FINDINGS.md, including the gaps it did not close.
• Fuzzes validate_flowback_proposal_bytes, the one function here that parses a stranger's file, against 19,000 inputs across five strategies: bit-flips, uniform random bytes, truncation, filename attacks, and an adversarial set covering terminal escapes, bidirectional overrides, homoglyphs, credential shapes, invalid UTF-8, and inputs shaped to provoke catastrophic backtracking. Four invariants: never raises, never hangs, fails closed, and can still accept a valid proposal. The fourth exists because the other three are satisfied by a validator that rejects everything.
• Fault-injects gate termination: a gate that never returns, one that spawns a background process and then hangs, and one that ignores SIGTERM. The orphan case is the one that separates process-tree termination from child termination, and it was proven to have teeth by swapping the tree kill for a direct one and watching it fail.

Cross-Platform Verification

• Adds a test workflow. This repository previously had none: the two existing workflows trigger only on incoming/** and metrics/**, so an ordinary code change ran no checks at all, and three stacked pull requests reached review untested on any platform.
• The suite now runs on Linux, macOS, and Windows, plus a second Python on Linux for forward drift, and validates a clean distribution archive rather than the working tree.
• The matrix found real defects on its first runs. macOS had never passed: it places temporary directories under /var, a symlink to /private/var, and the managed-path guards correctly refuse to write through a link-like component, so 29 tests failed before exercising anything. Windows failed four more: a symlink call that raised instead of skipping, a filesystem chmod that Windows git cannot see, fixtures written as CRLF and compared against LF from a git archive, and a shell pipeline into tar with a backslashed drive path. All were test portability rather than product defects.
• One was subtler. A marker path embedded two string levels deep, with the outer level not raw, reached the gate's parser as a truncated unicode escape whenever the temp directory sat under C:/Users, so the gate died of a SyntaxError instead of hanging and the test reported a termination failure that had not happened. Local Windows testing could not find it, because that workstation's temp directory contains no escape-forming sequence.
• Branch protection requires one aggregating context rather than one name per matrix leg. Pinning every leg by name makes the settings page a second implementation of the workflow's matrix, which is the standing drift risk SKILL.md names, with a failure mode where a renamed job leaves pull requests waiting on a check that no longer exists. The aggregating job runs with if: always(), so it checks each dependency's result explicitly; without that it would report success no matter what happened upstream.

Locale Independence

• Fixes a product defect. git_output decoded git's stdout with text=True alone, which uses the machine's locale encoding: cp1252 on a default Windows install, ASCII under LC_ALL=C. Git emits UTF-8. core.quotepath hides this for paths by escaping them, but not for a branch name, a tag name, the repository pat...