Features and Verification Model

Features and Verification Model

What the kit delivers, and the single design idea that makes the delivery trustworthy: every claim in a kit-built wiki is either traced to a source line or reproduced by executing the software. This page states the model precisely, inventories the features with their verification status from this run, and separates what the kit does from what it is not.

Contents

• The one rule
• Feature inventory (with this run's verification status)
• What a finished run produces
• The model paying for itself — documented catches
• What the kit is not
• See also

---

The one rule

Important

A claim enters the wiki only if it is (a) traced to a specific source line, or (b) reproduced by running the software. The subject's README is a set of author claims, not facts. Document discrepancies explicitly rather than silently omitting them.

The rule exists because of a concrete failure: the subject of the reference run (MD.Viewer) claimed syntax highlighting — no highlighter existed anywhere in the repository, code was emitted as <pre><code> and styled by CSS — and nested lists, which rendered as literal text paragraphs. Both claims were plausible, both were easy to transcribe, and both would have shipped as falsehoods a reader could disprove in two minutes.

The epistemics behind it: reading code tells you what software intends; running it tells you what it does. The gap between the two is where every interesting finding lives — and where every embarrassing error would live. The kit therefore provides a verification channel for each half:

Channel	Tools	Produces
(a) Source tracing	scan/repo_scan.py inventory + ranged reading (sed -n '661,760p') + function index with line numbers	sources.md §A citations; facts.json entries with source: code:file:line
(b) Execution	lib/serve.py staged instances + probe/webapp_probe.py batteries + custom drivers + qa/verify_commands.py re-runs	sources.md §B named tests; facts.json entries with source: test:NAME; evidence JSON/MD

Web sources (§C) are permitted only for context the repository cannot give — specifications, platform behaviour, competitor docs. And §D — claims deliberately not made, with reasons — closes the loop: it becomes the enforced ban.json, so a verified falsehood cannot creep back in during a later edit.

Feature inventory (with this run's verification status)

Feature	What it gives you	Status in this run
Environment bootstrap	idempotent setup + capability/egress report; optional node/PHP-8.3/composer; --subject runtime gate	executed (T0): PHP 8.2.34, curl, jq, rg installed; report accurate
Whole-repo inventory	git metadata incl. tag count, license + extra clauses, deps or their absence, largest files, entry points, version markers, external hosts, 11 security-signal classes, config-key surface; 9-language symbol extraction; 8-ecosystem manifest detection	executed (T0b): 53 KB JSON + brief; brief facts match manual inspection
Safe staged execution	clean temp docroot, verified-free port (busy preferred port raises), readiness wait + interpreter-alive HTTP probe, process-group teardown, fixture writers (write/mkdir/set_ini/ls/read)	executed (T10/T17), including a non-PHP serve command
HTTP evidence client	status/headers/body as data for every outcome incl. 4xx/5xx and transport errors; no auto-redirect; form + multipart helpers; CLI	executed (T11/T18)
Stateful-flow client	cookie jar (multi-Set-Cookie safe), CSRF extraction across six printed shapes, token in body + header never URL, observable 302s	executed (T9): live self-test 8/8 on PHP
Declarative batteries	20 traversal + 26 injection payloads, header inventory (10 security + 4 leak), config-flag gating, upload matrices, disk side-effects; per-request records with expectation matching	executed (T14/T16): full suite in 0.46 s; reproduced the documented 19/26 injection figure
QA-clean scaffolding	wiki skeleton (Home/_Sidebar/_Footer/stubs) satisfying every structural audit rule; grouping from PROGRESS.json; derived links	executed (T8 + this wiki): 3 round-trips clean; 22-file skeleton audited at 0 errors
The audit	16 check families incl. GitHub-slug anchors, fence nesting, mermaid validity, bash -n, compile(), filler/emoji, bans with negation-downgrade and exemptions, terminology	executed (T1 + this wiki): self-test 22/22; this wiki audited to 0 errors/0 warnings
TOC regeneration	block-scoped ## Contents rebuild with GitHub slugs, --bak, word-count guard, accident-reproducing self-test	executed (T2 + per-page in this run): 8/8
Command re-verification harness	worked template: fresh clone → documented commands → evidence JSON	read and adapted (template is subject-shaped by design)
Delivery pipeline	QA gate → clone/fallback-init with origin → commit with derived message → verified bundle → PUBLISH.md hand-over → optional push	executed (T15): commit + verified bundle against an uninitialised remote
Recovery system	STATE/PROGRESS/REWORK-STATE templates, five research files, phase-boundary snapshots	used throughout this run; caught a sandbox path-rewriting trap mid-Phase-1
Doctrine docs	SKILL.md (Agent Skills format), AGENTS.md (phase→tool map), PROMPT.md (paste-ready task prompt), PITFALLS.md (31 traps), PUBLISHING.md (verified git flows)	read in full; claims cross-checked against code
CI self-verification	10-step workflow incl. negative controls and a workspace-refusal gate	replicated locally (T4–T8): all green
Reference examples	full research artefacts + 3 sample pages from run 1; 1,571-line battery + patterns from run 2	used for calibration

What a finished run produces

The reference run (MD.Viewer) and the second field run (MD.Scribe) bound the output shape:

Metric	Run 1 — MD.Viewer	Run 2 — MD.Scribe 3.1.0
Files	22 (20 pages + sidebar + footer)	23 pages
Words	73,013	41,623
GitHub Alerts	154	28
Mermaid diagrams	27 (26 flowchart + 1 sequence)	9
Table rows	1,687	786
Internal wiki-links	341, all resolving	252
QA errors at delivery	0	0
Empirical checks	137 shell blocks bash -n-clean	249 checks (234 pass / 0 fail / 15 findings)
Doc-vs-code discrepancies found	incl. 2 false README claims	14 verified

The model paying for itself — documented catches

The kit's own history records what the verification loop caught, in its own docs and tools:

1. Fabricated code quote. The delivered Architecture.md of run 1 quoted plausible-looking code for a URL normaliser that the subject did not contain; Phase 4 re-verification replaced it with the verbatim source.
2. README claim the code did not implement. A force-flag documented as propagating between update phases is dropped by the code (a literal query string is built without it); the wiki corrected the claim and documented the discrepancy.
3. Nine tool defects found during kit extraction — all by running the tools, not reading them — including an auditor bug that compared every page against the previous page's text (235 phantom errors) and scaffold templates with hardcoded dead links (see Changelog and Versioning).
4. This run: the probe's expectation-mismatch column flagged two drifts in the current MD.Viewer build (auth gate now precedes action validation; a redirect expectation depends on staged fixture state), and an audit of the kit's scaffold found the explicit-grouping branch missing its _Footer.md write — fixed and recorded per the maintenance doctrine.

What the kit is not

Not	Reality
A documentation generator	It generates scaffolds, audits and evidence — the prose is written by the agent operating it. There is no push-button wiki
An AI service	No tool makes any LLM API call; the kit has zero declared dependencies and no network clients beyond HTTP probing, git and apt
A security-assessment product	The batteries produce documentation evidence with generic payloads; no coverage guarantee; authorized local testing only
A hosting or SaaS offer	Output is a git commit + bundle for GitHub's native wiki; nothing is hosted
Language-universal out of the box	Language-aware scanning for 9 languages; PHP default serving; other stacks via --serve-cmd or custom drivers — an adaptation path, not a promise

---

See also

• The Four Phase Workflow — the model as a process
• Research and Probing Guide — building the evidence base
• Comparison with Alternatives — how this differs from hosted AI wikis
• Security Considerations — authorized use of the batteries
• Changelog and Versioning — the catches as they landed in releases