diff --git a/ARCHIVE-CUSTODY.md b/ARCHIVE-CUSTODY.md index 8ed93cb..432f2cc 100644 --- a/ARCHIVE-CUSTODY.md +++ b/ARCHIVE-CUSTODY.md @@ -1,27 +1,37 @@ # TestForge archive custody -TestForge is one two-skill Augment with several independently useful release objects. The canonical release keeps the complete product, its Codex plugin, and both standalone skills separately obtainable without pretending that a standalone skill is the whole product. +TestForge v1.1.6 is one two-skill Augment with several distinct distribution objects. Keep their identity and evidence states separate: source presence is not installation, a valid archive is not discovery, discovery is not invocation, and none of those states proves healthy behavior or directory publication. -| Object | Canonical release artifact | Use | +## Current v1.1.6 objects + +| Object | Canonical location | Observed state and use | |---|---|---| -| Complete Augment | `release-assets/v1.1.1/TestForge-v1.1.1.zip` | Portable two-skill TestForge capability with adapters, docs, evals, and tools | -| Codex plugin | `release-assets/v1.1.1/Plugin-TestForge-v1.1.1.zip` | Branded Codex plugin with both skill entry points and listing assets | -| Software Verification skill | `release-assets/v1.1.1/Skill-software-verification--TestForge-v1.1.1.zip` | Independent `$software-verification` installation and recovery | -| Verification Reviewer skill | `release-assets/v1.1.1/Skill-verification-reviewer--TestForge-v1.1.1.zip` | Independent `$verification-reviewer` installation and recovery | -| Claude.ai uploads | `claude-ai/software-verification-v1.1.1.zip` and `claude-ai/verification-reviewer-v1.1.1.zip` | Host-specific one-skill upload archives | -| Source repository | Git tag `v1.1.1` and its GitHub source archives | Versioned source, documentation, tests, testbed, and provenance | +| Maintained package | `testforge/` | Current two-skill source, tools, schemas, examples, evals, adapters, and customer documentation | +| Codex marketplace plugin | `plugins/testforge/` plus `.agents/plugins/marketplace.json` | Repository-native plugin source for `testforge@cd-testforge`; static structure is repository-tested | +| Claude operator upload | `claude-ai/software-verification-v1.1.6.zip` | Current one-skill upload archive; SHA-256 `3485f982d9d7f770b9077bc9da122498ff5ce135ae60e07e7aa8fa8209d5a52f` | +| Claude reviewer upload | `claude-ai/verification-reviewer-v1.1.6.zip` | Current one-skill upload archive; SHA-256 `c882eacec514e23647e1e298b9919a89e3b85ded06649041cf924c91994308ba` | +| Frozen v1.1.6 customer kit | `releases/v1.1.6/TestForge-v1.1.6.zip` | Canonical published release object retained unchanged; SHA-256 `4dd052672923192f59ec2866eb2fedef697ca1f98f00a99341c3d8fe062b0594` | +| Frozen v1.1.6 receipts | `releases/v1.1.6/` | Static package, source-parity, and portable archive evidence; no fresh-host activation or customer-outcome claim | +| Source release | Git tag `v1.1.6` and [GitHub release](https://github.com/Stunspot/TestForge/releases/tag/v1.1.6) | Published 2026-08-12; versioned public source and release boundary | -## Plugin publication payloads +The current `claude-ai/` archives and the frozen archives inside `releases/v1.1.6/claude/` are separate deterministic builds and are not byte-identical. Use the current `claude-ai/` objects for the repository installation guide. Use the frozen release directory to inspect the exact evidence and bytes retained for the v1.1.6 release event. -TestForge plugin v1.1.2 preserves two deliberately different ZIPs: +## OpenAI directory packet -| Object | Canonical release artifact | Use | -|---|---|---| -| Installable Codex plugin | `release-assets/v1.1.2/Plugin-TestForge-v1.1.2.zip` | Normal Codex installation and marketplace distribution with the full interface manifest | -| OpenAI skills-only submission | `release-assets/v1.1.2/Plugin-TestForge-v1.1.2-OpenAI-Submission.zip` | Deterministic portal upload whose archived interface retains only `composerIcon` and `logo` | +The latest retained skills-only portal payload is still v1.1.4: + +- archive: `release-assets/v1.1.4/Plugin-TestForge-v1.1.4-OpenAI-Submission.zip`; +- custody: `release-assets/v1.1.4/openai-submission-custody.json`; +- SHA-256: `9aecec78e407e6f368d0a5c613facbc4252a3f3ef545ba6686e74cf7f2404a46`; +- state: built and repository-tested, not claimed uploaded, approved, published, or discoverable. -`release-assets/v1.1.2/archive-custody.json` governs the installable plugin. `release-assets/v1.1.2/openai-submission-custody.json` separately records the portal derivative's archive hash, source and transformed manifest hashes, member count, and POSIX path requirement. The portal ZIP is not a replacement for the installable plugin. +There is no retained v1.1.6 portal archive or custody object. The repository-native v1.1.6 plugin remains the current Codex installation surface; the v1.1.4 portal packet is a separately governed historical submission candidate. -`release-assets/v1.1.1/archive-custody.json` records exact hashes, sizes, member counts, source-tree digests, and extraction-parity results for the unchanged v1.1.1 Augment and skills. GitHub release assets and the latest-only convenience backup shelf must match the applicable custody records. Canonical assets are copied, never moved, to the backup shelf. Older same-family convenience copies may be removed only after the new copies match; unrelated products are untouched. +## Maintenance rules -The two standalone skill archives and their Claude.ai counterparts intentionally carry the same skill content under channel-appropriate names. Static package equality does not establish live Claude activation, live Codex discovery, or directory approval. +- Rebuild current derivatives from maintained source; never edit ZIP members in place. +- Do not alter `releases/` merely to make present documentation agree with a historical release. +- Record archive name, byte size, SHA-256, member inventory, source revision, and claim boundary for each new object. +- Verify extraction topology and package-relative dependencies before publication. +- After publication, download the public asset and compare it with the governed local object. +- Treat upload, automated scan, review submission, approval, publication, installation, discovery, invocation, and health as separate observed states. \ No newline at end of file diff --git a/BUILD-NOTE.md b/BUILD-NOTE.md index 6b91c40..72bc6d4 100644 --- a/BUILD-NOTE.md +++ b/BUILD-NOTE.md @@ -1,4 +1,6 @@ -# TestForge v1.1.0 maintenance build note +# Historical TestForge v1.1.0 maintenance build note + +> Historical record: this file describes the v1.1.0 maintenance event. It is not the current installation, archive-custody, or validation authority. Use `README.md`, `RELEASE-NOTES-v1.1.6.md`, `RELEASE-NOTES.md`, `ARCHIVE-CUSTODY.md`, and the current `testforge/docs/` guides. ## Result diff --git a/BUILD-WEEK.md b/BUILD-WEEK.md index 0ac0452..892c65f 100644 --- a/BUILD-WEEK.md +++ b/BUILD-WEEK.md @@ -27,6 +27,8 @@ A later Codex task used TestForge to design and harden the CD Augment behavioral ## Build evidence +> Historical snapshot: the counts and release identity in this section describe the original v1.0.2 Build Week entry. They are not current v1.1.6 package or validation evidence; use the current README, release notes, archive custody, and validation guides for that. + - Primary Codex build Session ID: `019f6a6e-8556-75c0-919c-0738a3cb1f84` - Primary build model recorded by Codex: `gpt-5.6-sol` - Primary build date: July 16, 2026 @@ -36,7 +38,7 @@ A later Codex task used TestForge to design and harden the CD Augment behavioral - Deterministic local checks: 9 TestForge tests, 46 testbed tests, and 4 public-distribution tests - Behavioral suite: 10 cases across 11 dimensions, with indispensable gates for evidence honesty, security boundaries, and release judgment -The Devpost form should use the primary Session ID above. It is the task where the majority of TestForge's core functionality was built. The later Omnicompetence task expanded the testbed and handled publication, but it is not a substitute for the primary build task. +The Devpost form should use the primary Session ID listed in this Build evidence section. It is the task where the majority of TestForge's core functionality was built. The later Omnicompetence task expanded the testbed and handled publication, but it is not a substitute for the primary build task. ## Product architecture diff --git a/JUDGE-QUICKSTART.md b/JUDGE-QUICKSTART.md index 5864475..57a5d05 100644 --- a/JUDGE-QUICKSTART.md +++ b/JUDGE-QUICKSTART.md @@ -80,7 +80,7 @@ Python 3.10 or newer is required. PyYAML is the testbed's only third-party depen ## Supported paths -- Codex plugin: repository-native two-command installation above. +- Codex plugin: repository-native two-command installation in step 1. - Codex standalone SKILLs: install the portable `testforge/` bundle while preserving package-relative resources. - Claude Code: structurally compatible SKILL instructions with documented host boundaries. - Other Agent hosts: Markdown skill loading, local-shell adapter, GitHub adapter, or copy-paste fallback. diff --git a/README.md b/README.md index e1d8b1f..165c4b7 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -![TestForge - software verification that argues back](assets/testforge-social-preview.png) +![TestForge verification workbench: evidence is forged, measured, and challenged before release](assets/testforge-readme-hero.png) # TestForge @@ -65,7 +65,7 @@ Start a new Codex task, then invoke `$software-verification` or `$verification-r Download the latest release, unzip it and keep the `testforge/` tree together. Expose both directories under `testforge/skills/` through your Agent host's skill mechanism. Host-specific notes are included for [Codex](testforge/adapters/codex.md), [Claude Code](testforge/adapters/claude-code.md), [GitHub](testforge/adapters/github.md), [local shell](testforge/adapters/local-shell.md) and [copy-paste chat](testforge/adapters/copy-paste-chat.md). -The GitHub release also preserves the complete Augment, the installable Codex plugin, its distinct OpenAI skills-only portal upload, and each bundled skill as separately named archives. This keeps `$software-verification` and `$verification-reviewer` independently recoverable without losing the complete two-skill product. The OpenAI draft exists and both bundled skills passed automated scanning; accountable-owner attestations and submission for review remain pending. +The frozen v1.1.6 release kit preserves the complete Augment, Codex plugin source, and both Claude skill archives with static package receipts. The maintained repository separately exposes current Claude upload archives. The latest retained OpenAI skills-only portal packet is v1.1.4; it is built and repository-tested, but this repository does not claim it was uploaded, scanned by the current portal, approved, published, or made discoverable. See [archive custody](ARCHIVE-CUSTODY.md) for exact object identities and boundaries. Then start with: diff --git a/RELEASE-NOTES.md b/RELEASE-NOTES.md index 71040c0..d0a258a 100644 --- a/RELEASE-NOTES.md +++ b/RELEASE-NOTES.md @@ -1,40 +1,15 @@ -# TestForge v1.0.2 +# TestForge release notes -Version 1.0.2 is a bounded distribution correction. TestForge's public marketplace now uses the product-specific `cd-testforge` namespace, so installing it cannot replace a separately distributed Collaborative Dynamics marketplace such as CanopyOps. The customer command is now `codex plugin add testforge@cd-testforge`. Verification behavior and the v1.0.1 quality-ratchet evidence are unchanged. +The current package release is **v1.1.6**. See [RELEASE-NOTES-v1.1.6.md](RELEASE-NOTES-v1.1.6.md) for the metered-verification safeguards and exact evidence boundary. -## v1.0.1 quality-ratchet revision +## Current release boundary -Version 1.0.1 turns the Build Week evaluation loop back onto TestForge itself. A matched Qwen control/treatment run improved from 72.08 to 88.33 but retained one indispensable evidence-honesty failure: the model proposed removing a system package to reproduce a missing-library condition. This revision strengthens safe, read-only, capability-matched diagnosis and cleanly separates executed commands, proposed diagnostics, and unexecuted remediation. It also prevents a judge from hiding weak observable performance by mislabeling it as an invalid episode. +Version 1.1.6 treats finite verification capacity as part of the test plan. Before recommending or invoking hosted CI, device or browser farms, paid cloud checks, or another quota-limited route, TestForge requires a fresh observation for the exact billing scope and calculates trigger duplication, matrix fan-out, retries, runner ceilings, billing multipliers, and retained reserve. Unknown, stale, insufficient, provider-refused, reserve-consuming, or unauthorized paid capacity produces a hold without launching a discovery job. -Repeated test-diagnose-reengineer cycles then exposed and repaired context dilution, secret-workflow leakage into unrelated cases, incomplete authorization post-state checks, unsafe production-probe scaffolds, destructive-deletion authority gaps, and local-judge logic inversions. A later full local run reached 90.41 with zero failed or invalid episodes; single-trial behavioral results remain model-, context-, and judge-bounded. +The v1.1.5 verification-cycle custody rule remains in force: a product defect or newly exposed product invariant ends the submitted candidate's TestForge cycle. The upstream repair returns later as a new frozen candidate with a new evidence cutoff. Only a defect proven to belong to TestForge's own test, tool, fixture, or execution environment may be corrected and rerun within the same cycle. -It also adds repository-native Codex plugin installation, Build Week provenance, an isolated fictional judge case, public distribution-integrity tests, and a three-operating-system CI matrix. +The maintained repository includes synchronized v1.1.6 package and plugin source plus current Claude upload archives. Static structure, hashes, parity, and deterministic checks do not prove live host activation, provider-meter accuracy, hosted-run success, directory publication, customer outcomes, or defect freedom. -## Original v1.0.0 release +## Historical notes -TestForge is a free Collaborative Dynamics Augment that gives an Agent two complementary software-verification capabilities: - -- `$software-verification` builds a risk-ranked evidence chain from change to release assessment. -- `$verification-reviewer` independently challenges that chain for omissions, weak oracles, misleading mocks and unsupported confidence. - -The repository also includes the CD Augment evaluation testbed for running isolated behavioral cases against Codex or local Ollama models, preserving hard gates and promoting reviewed regression baselines. - -## Included - -- complete portable TestForge Augment; -- two Agent SKILLs and copy-paste fallbacks; -- deterministic Python inspection, validation, normalization and reporting tools; -- Python and TypeScript worked examples with planted defects; -- risk, oracle, reliability, security and stack references; -- canonical behavioral eval suite; -- isolated Augment evaluation harness with Codex and Ollama adapters; -- reviewed compact baselines; -- Codex, Claude Code, GitHub, local-shell and plain-chat adapters. - -## License - -The release uses a split license: MIT for Python software and machine-readable schemas, and CC BY-ND 4.0 for authored Augment materials. The authentic, unmodified branded Augment may be redistributed, including inside a larger commercial product. See `LICENSE.md`, `ATTRIBUTION.md` and `TRADEMARKS.md`. - -## Evidence boundary - -The package and testbed deterministic suites pass locally. Supplied behavioral baselines record their model and context. TestForge provides evidence-bounded advice; it does not prove defect freedom, certify compliance or authorize a release. +Version-specific records remain available as `RELEASE-NOTES-v*.md`. They describe their named releases and do not override current installation, privacy, support, or validation guidance. \ No newline at end of file diff --git a/assets/testforge-readme-hero.png b/assets/testforge-readme-hero.png new file mode 100644 index 0000000..405ca0b Binary files /dev/null and b/assets/testforge-readme-hero.png differ diff --git a/docs/404.html b/docs/404.html new file mode 100644 index 0000000..9a4f7b6 --- /dev/null +++ b/docs/404.html @@ -0,0 +1,26 @@ + + + + + + + + Route not found · TestForge + + + + + +
+
+

404 · route not found

+

The evidence trail stops here.

+

This address is not part of the current TestForge site. Recover through a maintained customer route instead of trusting a stale or repository-relative link.

+ +
+
+ + + diff --git a/docs/SITE-SOURCE.md b/docs/SITE-SOURCE.md index 660bb4e..828ebb6 100644 --- a/docs/SITE-SOURCE.md +++ b/docs/SITE-SOURCE.md @@ -18,9 +18,12 @@ The page does not claim defect freedom, compliance certification, production acc - `index.html` — semantic single-page project overview; - `style.css` — responsive presentation and accessibility treatment; -- `assets/testforge-hero.png` — generated 1600×900 raster hero artwork; +- `assets/testforge-hero.png` — 1200×800 role-specific Pages hero showing a three-path inspection gate; +- `404.html` — maintained recovery route for stale or invalid links; - `.nojekyll` — direct static-file serving marker. +The repository README uses the distinct 1600×640 `assets/testforge-readme-hero.png`. Social sharing uses the distinct 1280×640 `assets/testforge-social-preview.png`, which visibly contains the exact TestForge title and identifying line. + ## Deployment `.github/workflows/deploy-pages.yml` uploads this directory with GitHub's official Pages Actions. Repository Pages must be configured to use **GitHub Actions** before the first deployment can publish. diff --git a/docs/assets/testforge-hero.png b/docs/assets/testforge-hero.png index 4655dbe..555b1b7 100644 Binary files a/docs/assets/testforge-hero.png and b/docs/assets/testforge-hero.png differ diff --git a/docs/index.html b/docs/index.html index 78cf6fb..dc36442 100644 --- a/docs/index.html +++ b/docs/index.html @@ -9,8 +9,8 @@ - - + + TestForge · Software Verification That Argues Back @@ -22,11 +22,12 @@ @@ -45,10 +46,27 @@

Software verification
that argues back.

Free Collaborative Dynamics Augment · two matched SKILLs · deterministic tools · independent review · behavioral eval testbed

- A software change passes through ranked risk gates, discriminating test oracles, captured evidence, independent review, and a one-way regression ratchet that resists backward motion. + A precision quality gate checks three evidence paths and diverts a failed path into a separate reject tray.
+ +
+
+

Begin successfully

+

Bring a finished candidate and a release claim worth attacking.

+

TestForge is for developers, release owners, coding-Agent operators, and Augment builders who need evidence stronger than “the tests are green.” It is not a product-design workshop, penetration-testing authorization, compliance certification, or proof that defects do not exist.

+
+
+
INPUT

What to supply

A bounded target and revision; the intended behavior or requirement; relevant diff, source, tests, logs, and environment facts; plus explicit authority for any consequential action.

+
OUTPUT

What to expect

An impact map, ranked risks, invariants, scenarios, tests or commands, captured execution evidence, classified findings, residual risks, reviewer disposition, and exactly one bounded release status.

+
FIRST RUN

What success looks like

The operator distinguishes observed, inferred, assumed, unresolved, executed, and authorized claims; links critical risks to credible evidence; and refuses confidence that the evidence cannot support.

+
+
+
$software-verification Verify this completed candidate at revision <REVISION>. The intended behavior is <REQUIREMENT>. Inspect the available source and tests, run only safe authorized checks, and issue an evidence-backed release assessment.
+
$verification-reviewer Independently challenge the resulting verification package. Find the smallest consequential break in its evidence chain and judge whether the proposed status is supportable.
+
+

The practical wager

@@ -195,29 +213,41 @@

Run isolated trials without handing the subject its answer key.

-

Install or inspect

-

Use the matched plugin, standalone skills, or the repository testbed.

+

Install, verify, maintain

+

Use matched operator and reviewer versions. A copied file is not an activated capability.

CODEX PLUGIN codex plugin marketplace add Stunspot/TestForge codex plugin add testforge@cd-testforge -

Installs the two aligned self-contained verification skills.

+

Start a new task. Invoke $software-verification, then use a second fresh task to invoke $verification-reviewer. Verify that each can reach its package-relative resources.

+
+
+ CODEX STANDALONE +

Copy both complete folders under testforge/skills/ into the personal Codex skills directory. Keep every reference, template, example, fallback, and script with its owning skill.

+

On Windows, the final paths normally end in .codex\skills\<skill-name>\SKILL.md. Restart and probe both handles separately.

- STANDALONE SKILLS -

Download the release, keep the `testforge/` tree together, and expose both directories under `testforge/skills/` through the host’s skill mechanism.

+ CLAUDE +

Confirm the account exposes custom Skills. Upload claude-ai/software-verification-v1.1.6.zip and claude-ai/verification-reviewer-v1.1.6.zip separately, enable both when required, and test each in a new conversation.

+

Live upload, discovery, resource loading, script execution, and reviewer handoff were not exercised for this release.

- BEHAVIORAL EVALS - py -m pip install -r tools\augment-evals\requirements.txt - py tools\augment-evals\augment_eval.py validate testforge -

Raw runs remain local; reviewed compact baselines may be promoted into Git-tracked records.

+ OTHER HOSTS +

A host must load Markdown skill instructions and preserve package-relative resources. Otherwise use the fileless fallback. Deterministic tools require Python 3.10+; unsupported stacks degrade to generic scenario and command planning.

+
+
+ UPDATE +

Record the installed version and preserve required evidence. Replace both skills from the same release, start a fresh task or conversation, and repeat both discovery and resource probes. Never mix operator and reviewer versions.

+
+
+ REMOVE & CLEAN +

Remove or disable the plugin and both skills through the host manager, or delete only the two exact standalone folders. TestForge has no account, daemon, telemetry store, or product database. Local manifests, reports, tests, raw captures, baselines, and eval runs remain ordinary files until you archive or delete them under project policy.

+

Detailed routes: Codex lifecycle · Claude lifecycle · host boundary.

-

Start from the change

@@ -229,6 +259,61 @@

Ask for the evidence chain, then challenge it separately.

+ +
+
+

Troubleshoot and recover

+

Preserve the symptom before rebuilding anything.

+
+
+

The skill does not appear

Start a fresh task, verify the plugin state or final folder path, confirm the complete folder—not a lone SKILL.md—is installed, and check host or organization enablement.

+

The response is generic

Invoke the handle explicitly, state the target and release claim, and verify package-relative doctrine is reachable. Do not treat a plausible answer as proof the skill loaded.

+

A command cannot run

Record the command, working directory, exit code, exact error, and unavailable guarantee. Classify product, test, environment, or tooling cause before changing anything.

+

Evidence or status is wrong

Stop the cycle, retain raw evidence, and use the reviewer in a fresh context. A product defect returns the candidate upstream; it is not repaired inside that TestForge cycle.

+
+

Full troubleshooting guide · sanitized issue tracker.

+
+ +
+
+

Privacy, storage, network, security

+

The skills are local. The host and tools still have their own data boundaries.

+
+
+

Product behavior

The v1.1.6 skills-only plugin includes no account, telemetry, analytics, hosted service, connector, MCP server, hook, or automatic network request. Deterministic scripts touch only paths and commands the user chooses.

+

Host behavior

Prompts, repositories, logs, uploads, model calls, retention, training, residency, and connector traffic are governed by Codex, Claude, configured models, Git hosts, and any authorized tools—not by TestForge.

+

Local records

Verification manifests, reports, raw command captures, generated tests, evaluation runs, seals, and promoted baselines may contain sensitive project evidence. Store and delete them under an approved retention policy.

+

Security boundary

Imported files and tool output are untrusted evidence. Active security work needs a named target, explicit permission, non-production default, time window, rate limits, prohibited actions, handling rules, and a stop contact.

+
+

Data and privacy · security policy · terms.

+
+ +
+
+

Provenance and evidence status

+

Know exactly what has—and has not—been established.

+
+
+ + + + + + + + + +
ClaimCurrent evidenceBoundary
Constructed and packagedv1.1.6 source, plugin tree, current Claude archives, manifests, and retained frozen-release receiptsDoes not prove host installation or live behavior
Deterministic behaviorRepository-local tool, package, distribution, documentation, and eval-harness suitesOnly exercised commands, fixtures, Python version, and environment
Behavioral evaluationNamed model/context baselines and a deliberately failed fresh-package smokeSingle-trial, model-, context-, case-, and judge-bounded; not universal model quality
OpenAI directoryLatest retained portal packet is v1.1.4 and repository-testedNo claim of upload, approval, publication, or discoverability
Host activationInstallation probes are documentedCurrent live Codex and Claude activation remain separate observations
+
+ +

Trust and authority

@@ -245,7 +330,7 @@

Safe verification is bounded verification.

diff --git a/docs/style.css b/docs/style.css index 208193e..c50890b 100644 --- a/docs/style.css +++ b/docs/style.css @@ -164,7 +164,7 @@ h3 { margin: 0 0 0.72rem; font-size: 1.33rem; } .install-grid { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 1rem; } .install-grid article { min-height: 20rem; padding: 1.25rem; border-top: 4px solid #b01616; background: #f9fbfb; box-shadow: 0 0.9rem 2.2rem rgba(24, 37, 43, 0.08); } .install-grid article > span { display: block; margin-bottom: 2.5rem; color: #b01616; font: 850 0.68rem/1 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; letter-spacing: 0.08em; } -.install-grid code { display: block; margin: 0.5rem 0; padding: 0.75rem; overflow-wrap: anywhere; color: #31434b; background: #e5ecee; font: 700 0.79rem/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; } +.install-grid article > code { display: block; margin: 0.5rem 0; padding: 0.75rem; overflow-wrap: anywhere; color: #31434b; background: #e5ecee; font: 700 0.79rem/1.5 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; } .install-grid p { color: var(--paper-muted); } .prompt-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 1rem; } @@ -178,6 +178,39 @@ h3 { margin: 0 0 0.72rem; font-size: 1.33rem; } .boundary-grid article { padding: 1.25rem; border: 1px solid var(--line); background: rgba(17, 23, 27, 0.72); } .boundary-grid p { color: var(--muted); } + +.install-section a, .troubleshooting-section a, .evidence-section a, .chain-section a, .failures-section a, .ratchet-section a { color: #8f1111; } +.install-section a:hover, .troubleshooting-section a:hover, .evidence-section a:hover, .chain-section a:hover, .failures-section a:hover, .ratchet-section a:hover { color: #5b0808; } +.install-section a:focus-visible, .troubleshooting-section a:focus-visible, .evidence-section a:focus-visible, .chain-section a:focus-visible, .failures-section a:focus-visible, .ratchet-section a:focus-visible { outline-color: #6b4c00; } + +.journey-grid, .recovery-grid { display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 1rem; } +.journey-grid article, .recovery-grid article { min-height: 15rem; padding: 1.25rem; border: 1px solid var(--line); background: var(--panel); } +.journey-grid article > span { display: block; margin-bottom: 2.4rem; color: var(--cyan-soft); font: 850 0.68rem/1 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; letter-spacing: 0.08em; } +.journey-grid p, .recovery-grid p { color: var(--muted); } +.first-prompt { margin-top: 1rem; } +.install-grid { grid-template-columns: repeat(3, minmax(0, 1fr)); } +.install-grid article { min-height: 23rem; } +.install-grid article > code { margin-inline: 0; padding-inline: 0.45rem; } +.install-grid p code { display: inline; margin: 0; padding: 0.1rem 0.28rem; } +.install-note { margin: 1rem 0 0; padding: 1rem 1.2rem; border-left: 0.42rem solid #b01616; color: var(--paper-muted); background: #f9fbfb; } +.troubleshooting-section, .evidence-section { max-width: none; padding-left: max(1.5rem, calc((100vw - 81rem) / 2)); padding-right: max(1.5rem, calc((100vw - 81rem) / 2)); color: var(--paper-ink); background: var(--paper); } +.troubleshooting-section .eyebrow, .evidence-section .eyebrow { color: #b01616; } +.recovery-grid { grid-template-columns: repeat(4, minmax(0, 1fr)); } +.recovery-grid article { border-top: 4px solid #b01616; color: var(--paper-ink); background: #f9fbfb; } +.recovery-grid p { color: var(--paper-muted); } +.privacy-section { max-width: none; padding-left: max(1.5rem, calc((100vw - 81rem) / 2)); padding-right: max(1.5rem, calc((100vw - 81rem) / 2)); background: var(--black); } +.evidence-table-wrap { overflow-x: auto; border: 1px solid rgba(24, 37, 43, 0.16); background: #f9fbfb; } +.evidence-table-wrap:focus-visible { outline: 3px solid #6b4c00; outline-offset: 4px; } +table { width: 100%; min-width: 46rem; border-collapse: collapse; } +th, td { padding: 1rem; border-bottom: 1px solid rgba(24, 37, 43, 0.13); text-align: left; vertical-align: top; } +th { color: #fff; background: #26373f; } +td { color: var(--paper-muted); } +td:first-child { color: var(--paper-ink); font-weight: 800; } +.evidence-links { display: flex; flex-wrap: wrap; gap: 0.7rem; margin-top: 1rem; } +.evidence-links a { padding: 0.7rem 0.85rem; border: 1px solid #b01616; color: #8f1111; background: #f9fbfb; font-weight: 800; text-decoration: none; } +.not-found { min-height: calc(100vh - 8rem); display: grid; align-items: center; } +.not-found .section { width: 100%; border-top: 0; } + footer { padding: 2.5rem 1.5rem 3.5rem; border-top: 1px solid rgba(255, 26, 26, 0.25); text-align: center; color: var(--muted); background: #000; } footer p { margin: 0.35rem 0; } @@ -196,16 +229,16 @@ footer p { margin: 0.35rem 0; } .oracles-copy, .evals-copy, .boundary-copy { position: static; } .eval-rule { grid-column: 1; } .oracle-card dl > div { grid-template-columns: 1fr; gap: 0.4rem; } - .ratchet-copy, .install-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); } + .ratchet-copy, .install-grid, .journey-grid, .recovery-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); } .eval-flow { grid-template-columns: repeat(2, minmax(0, 1fr)); } } @media (max-width: 40rem) { nav { padding-inline: 1rem; } - .nav-links a:not(:last-child) { display: none; } + .nav-links { max-width: 70vw; flex-wrap: nowrap; overflow-x: auto; padding-bottom: 0.35rem; } .hero, .section { padding: 4.6rem 1rem; } .hero { padding-top: 5.6rem; } - .capability-grid, .state-grid, .failure-grid, .status-grid, .ratchet-copy, .eval-flow, .install-grid, .prompt-grid, .boundary-grid { grid-template-columns: 1fr; } + .capability-grid, .state-grid, .failure-grid, .status-grid, .ratchet-copy, .eval-flow, .install-grid, .prompt-grid, .boundary-grid, .journey-grid, .recovery-grid { grid-template-columns: 1fr; } h1 { font-size: clamp(2.8rem, 14vw, 4.5rem); } h2 { font-size: clamp(2.1rem, 11vw, 3.5rem); } .hero-visual::before { position: static; display: block; padding: 0.7rem; } diff --git a/documentation-manifest.json b/documentation-manifest.json index 9f1f986..515844e 100644 --- a/documentation-manifest.json +++ b/documentation-manifest.json @@ -1,36 +1,124 @@ { - "format": "cd-customer-documentation/v1", - "landing_page": "README.md", - "customer_docs": [ - "README.md", - "testforge/README.md", - "testforge/docs/HOST-COMPATIBILITY.md", - "testforge/docs/INSTALL-CODEX.md", - "testforge/docs/INSTALL-CLAUDE.md", - "testforge/docs/QUICK-START.md", - "testforge/docs/WORKFLOWS.md", - "testforge/docs/CAPABILITY-MATRIX.md", - "testforge/docs/TROUBLESHOOTING.md", - "testforge/docs/DATA-AND-PRIVACY.md", - "testforge/docs/TERMS-OF-USE.md", - "testforge/SECURITY.md", - "testforge/docs/VALIDATION.md", - "testforge/docs/LIMITATIONS.md", - "testforge/docs/SUPPORT-AND-VERSIONING.md", - "RELEASE-NOTES-v1.1.6.md", - "ARCHIVE-CUSTODY.md", - "PLUGIN-DIRECTORY-SUBMISSION-v1.1.4.md", - "testforge/PROVENANCE.md" - ], - "moments": { - "orientation": ["README.md", "testforge/README.md"], - "installation": ["testforge/docs/HOST-COMPATIBILITY.md", "testforge/docs/INSTALL-CODEX.md", "testforge/docs/INSTALL-CLAUDE.md"], - "first_value": ["testforge/docs/QUICK-START.md"], - "normal_use": ["testforge/docs/WORKFLOWS.md", "testforge/docs/CAPABILITY-MATRIX.md"], - "recovery": ["README.md", "testforge/docs/TROUBLESHOOTING.md", "testforge/docs/SUPPORT-AND-VERSIONING.md"], - "privacy_security": ["testforge/docs/DATA-AND-PRIVACY.md", "testforge/docs/TERMS-OF-USE.md", "testforge/SECURITY.md"], - "evidence_limits": ["testforge/docs/VALIDATION.md", "testforge/docs/LIMITATIONS.md"], - "support_maintenance": ["testforge/docs/SUPPORT-AND-VERSIONING.md", "RELEASE-NOTES-v1.1.6.md", "ARCHIVE-CUSTODY.md", "PLUGIN-DIRECTORY-SUBMISSION-v1.1.4.md"], - "provenance": ["testforge/PROVENANCE.md"] - } + "format": "cd-customer-documentation/v1", + "landing_page": "README.md", + "pages_landing": "docs/index.html", + "customer_docs": [ + "README.md", + "docs/index.html", + "docs/404.html", + "docs/SITE-SOURCE.md", + "testforge/README.md", + "testforge/docs/HOST-COMPATIBILITY.md", + "testforge/docs/INSTALL-CODEX.md", + "testforge/docs/INSTALL-CLAUDE.md", + "testforge/docs/QUICK-START.md", + "testforge/docs/WORKFLOWS.md", + "testforge/docs/CAPABILITY-MATRIX.md", + "testforge/docs/TROUBLESHOOTING.md", + "testforge/docs/DATA-AND-PRIVACY.md", + "testforge/docs/TERMS-OF-USE.md", + "testforge/SECURITY.md", + "testforge/docs/VALIDATION.md", + "testforge/docs/LIMITATIONS.md", + "testforge/docs/SUPPORT-AND-VERSIONING.md", + "testforge/docs/SUPPORTED-ENVIRONMENTS.md", + "testforge/docs/SALES-DEMO.md", + "testforge/CHANGELOG.md", + "RELEASE-NOTES-v1.1.6.md", + "RELEASE-NOTES.md", + "ARCHIVE-CUSTODY.md", + "PLUGIN-DIRECTORY-SUBMISSION-v1.1.4.md", + "testforge/PROVENANCE.md", + "SECURITY.md", + "CONTRIBUTING.md", + "LICENSE.md", + "ATTRIBUTION.md", + "TRADEMARKS.md", + "NOTICE.md", + "JUDGE-QUICKSTART.md", + "BUILD-WEEK.md", + "BUILD-NOTE.md", + "tools/augment-evals/README.md", + "release-docs/CAPABILITIES.md", + "release-docs/DESCRIPTION-CUSTODY.md", + "release-docs/HOST-EVIDENCE-BOUNDARY.md", + "release-docs/INSTALL-CLAUDE.md", + "release-docs/INSTALL-CODEX.md", + "release-docs/LIMITATIONS.md", + "release-docs/MAINTAINER-GUIDE.md", + "release-docs/PACKAGE-REFERENCE.md", + "release-docs/PROVENANCE.md", + "release-docs/QUICK-START.md", + "release-docs/README.md", + "release-docs/SUPPORT.md", + "release-docs/VALIDATION.md" + ], + "moments": { + "orientation": [ + "README.md", + "docs/index.html", + "testforge/README.md", + "release-docs/README.md" + ], + "installation": [ + "docs/index.html", + "testforge/docs/HOST-COMPATIBILITY.md", + "testforge/docs/INSTALL-CODEX.md", + "testforge/docs/INSTALL-CLAUDE.md", + "release-docs/INSTALL-CODEX.md", + "release-docs/INSTALL-CLAUDE.md" + ], + "first_value": [ + "docs/index.html", + "testforge/docs/QUICK-START.md", + "JUDGE-QUICKSTART.md", + "release-docs/QUICK-START.md" + ], + "normal_use": [ + "testforge/docs/WORKFLOWS.md", + "testforge/docs/CAPABILITY-MATRIX.md", + "tools/augment-evals/README.md" + ], + "recovery": [ + "docs/404.html", + "docs/index.html", + "testforge/docs/TROUBLESHOOTING.md", + "testforge/docs/SUPPORT-AND-VERSIONING.md", + "release-docs/SUPPORT.md" + ], + "privacy_security": [ + "docs/index.html", + "testforge/docs/DATA-AND-PRIVACY.md", + "testforge/docs/TERMS-OF-USE.md", + "testforge/SECURITY.md", + "SECURITY.md" + ], + "evidence_limits": [ + "docs/index.html", + "testforge/docs/VALIDATION.md", + "testforge/docs/LIMITATIONS.md", + "release-docs/HOST-EVIDENCE-BOUNDARY.md", + "release-docs/VALIDATION.md" + ], + "support_maintenance": [ + "CONTRIBUTING.md", + "RELEASE-NOTES-v1.1.6.md", + "RELEASE-NOTES.md", + "ARCHIVE-CUSTODY.md", + "release-docs/MAINTAINER-GUIDE.md" + ], + "provenance_legal": [ + "testforge/PROVENANCE.md", + "ATTRIBUTION.md", + "LICENSE.md", + "NOTICE.md", + "TRADEMARKS.md", + "release-docs/PROVENANCE.md" + ] + }, + "historical_context": [ + "BUILD-WEEK.md", + "BUILD-NOTE.md", + "PLUGIN-DIRECTORY-SUBMISSION-v1.1.4.md" + ] } diff --git a/release-docs/MAINTAINER-GUIDE.md b/release-docs/MAINTAINER-GUIDE.md index 47f0fa4..dd5d76f 100644 --- a/release-docs/MAINTAINER-GUIDE.md +++ b/release-docs/MAINTAINER-GUIDE.md @@ -9,7 +9,7 @@ Build each release from the maintained repository on a clean release branch. A p 3. Run it a second time and require the same SHA-256 digest. 4. Run `python -B releases/v1.1.6/tools/verify_release.py releases/v1.1.6` and require `ok: true` with no findings. 5. Run the repository unit suites, package validator, eval-suite validator, release-manifest validator, and line-ending verifier. -6. Review all thirteen customer documents as a reader journey, including installation, first value, expected success, troubleshooting, removal, and rollback. +6. Review every document declared by the current `documentation-manifest.json` as a reader journey, including installation, first value, expected success, troubleshooting, removal, and rollback. 7. Require an independent skeptical review before publication. 8. After publication, download the GitHub asset and compare its SHA-256 with the canonical repository artifact and release shelf copy. diff --git a/release-manifest.json b/release-manifest.json index 3ae5259..e578d2b 100644 --- a/release-manifest.json +++ b/release-manifest.json @@ -3,7 +3,7 @@ "package": "testforge-public-repository", "version": "1.1.6", "release_date": "2026-08-12", - "artifact_count": 1136, + "artifact_count": 1138, "artifacts": [ { "path": ".agents/plugins/marketplace.json", @@ -37,8 +37,8 @@ }, { "path": "ARCHIVE-CUSTODY.md", - "size": 2896, - "sha256": "425b0b6934970f7f08c0cfef076f22a8d5a19fb5e04e42a353c569119e731b1d" + "size": 3337, + "sha256": "f00ba461b43c3bc170d13f5270f8a74ac5bb635b1e5401f99c602e13bd2805ec" }, { "path": "archive-plan-v1.1.2.json", @@ -50,6 +50,11 @@ "size": 872, "sha256": "60ec047aceb0e73ea1029d0e93b9244783c1a466349ce5c0ebd17a6f844c106c" }, + { + "path": "assets/testforge-readme-hero.png", + "size": 2236720, + "sha256": "6891298c9e6d0cea15e72a249ecaba2d6546dbe841578b239ad19dc0d2b09a03" + }, { "path": "assets/testforge-social-preview.png", "size": 600421, @@ -62,13 +67,13 @@ }, { "path": "BUILD-NOTE.md", - "size": 2540, - "sha256": "b6f3521d6f7c618b092fb0bf7810fe6ae467decec2e9a8670f345904b6f3a539" + "size": 2829, + "sha256": "cd6d587a238a65766bf0da59ea35d2b6abe5a84255138d453532134fab4fd6c0" }, { "path": "BUILD-WEEK.md", - "size": 10210, - "sha256": "d425220d1501d59cdfdce8401e8d66ca95a752cf545f33daff36b77b8ff95d05" + "size": 10509, + "sha256": "b8c06a6148caa2279226345c192cb4e6a9411196be3cd2ff37620d194761e8f8" }, { "path": "claude-ai/software-verification-v1.1.0.zip", @@ -120,30 +125,35 @@ "size": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, + { + "path": "docs/404.html", + "size": 1579, + "sha256": "99b1f755194e2f8d4ac0775327bc90496b764ee1331400f68a2c62142e1f407e" + }, { "path": "docs/assets/testforge-hero.png", - "size": 1481766, - "sha256": "d327ba98cb45afbe7a939e0f265eb51db98a50258d5ba8c117e6573e98c7d05b" + "size": 2212223, + "sha256": "f639f84c2c597053ca04c010be36201c46011596dfbeec9b7ca4e76e38a68bf8" }, { "path": "docs/index.html", - "size": 17593, - "sha256": "aab19b819b6c772cb70f2604e65001715b081005d280750eed042c198867e9cc" + "size": 27157, + "sha256": "0e756a1481d70ce36b6f8157403022c29d24cc3288d33a7e87b7f8c2435c1701" }, { "path": "docs/SITE-SOURCE.md", - "size": 1835, - "sha256": "428deaaf6ae81cde85aae1551c3afa51d84d95f256672df17b20298e884c4cf5" + "size": 2178, + "sha256": "587fd2a272411dc0ca217bcc2f0390469ee348653a1e79f4f54025298ffbe6f8" }, { "path": "docs/style.css", - "size": 16589, - "sha256": "1c9cd32a619426ba4c0925dc710c3c9944beabf0b3c7979b188010f5452de1e4" + "size": 19819, + "sha256": "f3f1b17a5646f75b66bbc58773c24bcb3d537af979318629b5d65584ea3bdebd" }, { "path": "documentation-manifest.json", - "size": 1677, - "sha256": "27dbf97ae017b026d35aa51e797e1cadd02efc01f0a260b29301d52928af0e2b" + "size": 6820, + "sha256": "2a654257294da78f94eebc0b6b7d02789cf0456d46d9fbd5268eff39a76d0f7d" }, { "path": "documentation-review.json", @@ -167,8 +177,8 @@ }, { "path": "JUDGE-QUICKSTART.md", - "size": 3703, - "sha256": "dd493b3a35c6f8d032beb2ef7302462d2df645ff94f56266591c020fd7041a3d" + "size": 3707, + "sha256": "13bf30896cebe30e2589ac8216a935ea39f08ff90b5bf9c25255f17bcddf9a96" }, { "path": "LICENSE.md", @@ -757,8 +767,8 @@ }, { "path": "README.md", - "size": 9474, - "sha256": "715100b86f5fc80e0861994d64e18be50bdec28b86f1380ad35d5762d468062a" + "size": 9574, + "sha256": "12c06960e476f9c0b742b383068d10109d81408d810446f7334bf0b234214e23" }, { "path": "release-docs/CAPABILITIES.md", @@ -792,8 +802,8 @@ }, { "path": "release-docs/MAINTAINER-GUIDE.md", - "size": 1833, - "sha256": "713915e93bbfe4569fb2b46b6e12c680a22764fbc7716689698673a1f0c2ac94" + "size": 1870, + "sha256": "5cdb0b9f0772adf27bc22e9ce7b4b8e0e6987e01b6397481ce52060e834e1d31" }, { "path": "release-docs/PACKAGE-REFERENCE.md", @@ -852,8 +862,8 @@ }, { "path": "RELEASE-NOTES.md", - "size": 3321, - "sha256": "27c78497964978957d8bc928670ee6adc5c9c9e2979c733c5a16ff098b1a2dcf" + "size": 1678, + "sha256": "9dfa7e6e4013b693a3785357624a5e631e3afdf0bcace5379c3ca4b388e072ed" }, { "path": "releases/v1.1.3/claude/software-verification-v1.1.3.zip", @@ -4272,13 +4282,13 @@ }, { "path": "testforge/docs/INSTALL-CLAUDE.md", - "size": 1274, - "sha256": "903f93ea711424b247c6f75340cf45d0abc6103ee98af820ccaa954d7023e32f" + "size": 2317, + "sha256": "82927330ec8eead0166ca10280b0a7008d48b2e061bbc7a6b22efe94ff10353b" }, { "path": "testforge/docs/INSTALL-CODEX.md", - "size": 1267, - "sha256": "d8e4a251f9e2a34976e00de53947ed10eff8ee7ee36f215ac11c8da1cbc71f1f" + "size": 2743, + "sha256": "085dc6d43c13a31de00df8d9e8cd9dfe7da6446dc3580f6df942b8d5866863cf" }, { "path": "testforge/docs/LIMITATIONS.md", @@ -4688,7 +4698,7 @@ { "path": "testforge/release-manifest.json", "size": 43504, - "sha256": "613d13d095a482c68f68d5c8740482371e2c0734de76d7b9bdc9c8b4023cfbd0" + "sha256": "4f3f9cfa32a3a9b5a086aa2f626d80e8cb22174f45adf42a07ded7b97fb39340" }, { "path": "testforge/scripts/assemble_report.py", @@ -5322,8 +5332,8 @@ }, { "path": "tests/test_documentation.py", - "size": 3729, - "sha256": "2c29b90281e53b6ed028cc9d8d035c46b31b37498e38879da93b09b50ae63d51" + "size": 5466, + "sha256": "ad6d803501ec2381a8603f8cfe28188b2c50fe3e13a920e08ae5611d560875fe" }, { "path": "tests/test_line_ending_policy.py", @@ -5482,13 +5492,13 @@ }, { "path": "tools/rebuild_public_release.py", - "size": 4047, - "sha256": "0f75099a4f38557b87336e37b5bb526c30c347989f0121ee188f9860e905b471" + "size": 4346, + "sha256": "f6e4fa00425c170aa5a8385d9ce0a39ae6fe9f8af632e8f2d3eafdd0e4907e3b" }, { "path": "tools/validate_release_manifests.py", - "size": 4211, - "sha256": "23b0fa59151d9ca80fd2e519a86b94d4236235e958dc5602d309b11756f5ab07" + "size": 4503, + "sha256": "4f2ca918673e0db9073c824fd204e6d3962b6efeffb4cd205043a71cbcf1c556" }, { "path": "tools/verify_family_release.py", diff --git a/testforge/docs/INSTALL-CLAUDE.md b/testforge/docs/INSTALL-CLAUDE.md index 1a1649d..13dca3e 100644 --- a/testforge/docs/INSTALL-CLAUDE.md +++ b/testforge/docs/INSTALL-CLAUDE.md @@ -11,3 +11,12 @@ Claude capabilities, eligible plans, organization controls, and interface labels Do not combine the archives, upload the entire repository, or upload a ZIP containing only `SKILL.md`. Each supplied ZIP contains one matching top-level skill folder and its runtime dependency closure. Live upload, enablement, discovery, progressive resource loading, script execution, reviewer handoff, and persistence were not exercised for this release. If a skill does not appear, preserve the visible error and check account capabilities, organization policy, upload state, and enablement before changing the archive. +## Update + +Record the installed package version and preserve any local evidence you need. Remove or disable both existing TestForge skills through the current host interface, upload both same-version replacement archives separately, enable them if required, then start a new conversation and repeat the operator and reviewer probes. Do not update only one skill. + +## Remove and clean up + +Remove or disable both TestForge skills through the host's current skill-management interface and begin a new conversation to confirm neither is discoverable. Delete downloaded ZIPs if local retention is unnecessary. + +TestForge itself has no account, hosted store, telemetry database, or background service. Host conversations, uploaded skill copies, generated files, and model-provider records are controlled by the host and organization, not by TestForge; use their retention and deletion controls. Locally retained manifests, reports, raw evidence, tests, and evaluation runs remain ordinary files and must be reviewed under the project's data policy. diff --git a/testforge/docs/INSTALL-CODEX.md b/testforge/docs/INSTALL-CODEX.md index 1e45035..3f2ec37 100644 --- a/testforge/docs/INSTALL-CODEX.md +++ b/testforge/docs/INSTALL-CODEX.md @@ -14,3 +14,14 @@ Keep every folder intact. The operator needs its doctrine, templates, examples, 4. Confirm each skill can reach its referenced resources. Success for one skill does not prove the other is installed. If either skill does not appear, preserve the visible symptom, verify the final folder or plugin state, restart Codex, and follow [Troubleshooting](TROUBLESHOOTING.md) before rebuilding the package. +## Update + +Before replacing anything, record the installed TestForge version and preserve any verification manifests or evidence you intend to keep. For the marketplace plugin, use the host's plugin manager to remove the installed `testforge@cd-testforge` entry, then run the two current marketplace installation commands again and start a new task. For standalone skills, replace both complete skill folders from the same release; do not mix operator and reviewer versions. + +Repeat both discovery probes after every update. An updated file tree does not establish that a running task loaded the new version. + +## Remove and clean up + +For the marketplace path, remove `testforge@cd-testforge` through the Codex plugin manager and start a new task to confirm both TestForge handles are absent. For standalone installation, delete only the two exact installed folders named `software-verification` and `verification-reviewer` after resolving their full paths; do not remove the surrounding skills directory. + +TestForge has no service account, telemetry store, daemon, or product database to delete. Verification manifests, reports, raw command captures, test files, promoted baselines, and evaluation runs are ordinary local project artifacts. Review them for retention, then archive or delete them under the project's own data policy. Removing TestForge does not automatically remove those records or any data retained by Codex, configured models, Git hosts, or external tools. diff --git a/testforge/release-manifest.json b/testforge/release-manifest.json index 3af9e5b..ccc36ac 100644 --- a/testforge/release-manifest.json +++ b/testforge/release-manifest.json @@ -127,13 +127,13 @@ }, { "path": "docs/INSTALL-CLAUDE.md", - "size": 1274, - "sha256": "903f93ea711424b247c6f75340cf45d0abc6103ee98af820ccaa954d7023e32f" + "size": 2317, + "sha256": "82927330ec8eead0166ca10280b0a7008d48b2e061bbc7a6b22efe94ff10353b" }, { "path": "docs/INSTALL-CODEX.md", - "size": 1267, - "sha256": "d8e4a251f9e2a34976e00de53947ed10eff8ee7ee36f215ac11c8da1cbc71f1f" + "size": 2743, + "sha256": "085dc6d43c13a31de00df8d9e8cd9dfe7da6446dc3580f6df942b8d5866863cf" }, { "path": "docs/LIMITATIONS.md", diff --git a/tests/test_documentation.py b/tests/test_documentation.py index b1fe25d..5b281d7 100644 --- a/tests/test_documentation.py +++ b/tests/test_documentation.py @@ -1,5 +1,6 @@ import json import re +import struct import subprocess import unittest from pathlib import Path @@ -20,7 +21,7 @@ def setUp(self): def test_customer_document_manifest_is_complete_and_coherent(self): documents = self.manifest["customer_docs"] self.assertEqual(len(documents), len(set(documents))) - self.assertEqual(19, len(documents)) + self.assertEqual(49, len(documents)) self.assertIn("testforge/docs/TERMS-OF-USE.md", documents) self.assertIn("ARCHIVE-CUSTODY.md", documents) self.assertIn(f"RELEASE-NOTES-v{CURRENT_VERSION}.md", documents) @@ -59,6 +60,43 @@ def test_current_customer_paths_use_current_release_identity(self): ).lower() self.assertNotIn("once published", customer_text) + def test_pages_journey_and_visual_roles_are_distinct(self): + index = (ROOT / "docs" / "index.html").read_text(encoding="utf-8") + readme = (ROOT / "README.md").read_text(encoding="utf-8") + for section_id in ( + "start", + "chain", + "status", + "ratchet", + "evals", + "install", + "troubleshooting", + "privacy", + "evidence", + ): + self.assertIn(f'id="{section_id}"', index) + self.assertIn("assets/testforge-readme-hero.png", readme) + self.assertIn('src="assets/testforge-hero.png"', index) + self.assertIn("assets/testforge-social-preview.png", index) + self.assertTrue((ROOT / "docs" / "404.html").is_file()) + + def png_dimensions(path: Path) -> tuple[int, int]: + data = path.read_bytes() + self.assertEqual(b"\x89PNG\r\n\x1a\n", data[:8]) + return struct.unpack(">II", data[16:24]) + + roles = { + "readme": ROOT / "assets" / "testforge-readme-hero.png", + "pages": ROOT / "docs" / "assets" / "testforge-hero.png", + "social": ROOT / "assets" / "testforge-social-preview.png", + } + self.assertEqual({"readme", "pages", "social"}, set(roles)) + dimensions = {name: png_dimensions(path) for name, path in roles.items()} + self.assertEqual((1600, 640), dimensions["readme"]) + self.assertEqual((1200, 800), dimensions["pages"]) + self.assertEqual((1280, 640), dimensions["social"]) + self.assertEqual(3, len({width / height for width, height in dimensions.values()})) + self.assertEqual(3, len({path.read_bytes() for path in roles.values()})) def test_all_tracked_markdown_local_links_resolve(self): tracked = subprocess.run( ["git", "ls-files", "*.md"], diff --git a/tools/rebuild_public_release.py b/tools/rebuild_public_release.py index 3d8eea1..a69b748 100644 --- a/tools/rebuild_public_release.py +++ b/tools/rebuild_public_release.py @@ -55,7 +55,15 @@ def canonical_record(path: Path, root: Path) -> dict[str, object]: def files(root: Path, excluded_file: Path | None = None) -> list[Path]: result = [] for path in root.rglob("*"): - if not path.is_file() or any(part in EXCLUDED for part in path.relative_to(root).parts): + relative = path.relative_to(root) + if not path.is_file() or any(part in EXCLUDED for part in relative.parts): + continue + if ( + root.resolve() == REPO.resolve() + and len(relative.parts) > 1 + and relative.parts[0] == "verification" + and relative.parts[1].startswith("remediation-") + ): continue if excluded_file is not None and path.resolve() == excluded_file.resolve(): continue @@ -86,7 +94,9 @@ def write_manifest(root: Path, package_name: str) -> None: "artifacts": artifacts, "note": "release-manifest.json, release-assets/, and ignored local evaluation-results/ are excluded from this source-tree hash list; releases/v1.1.6 governs the dual-host customer kit, while release-assets/v1.1.4/openai-submission-custody.json retains the separately reviewed OpenAI portal payload; UTF-8 text hashes use canonical LF line endings for cross-platform validation", } - output.write_text(json.dumps(manifest, indent=2) + "\n", encoding="utf-8") + output.write_text( + json.dumps(manifest, indent=2) + "\n", encoding="utf-8", newline="\n" + ) def main() -> int: diff --git a/tools/validate_release_manifests.py b/tools/validate_release_manifests.py index e95b452..536c65c 100644 --- a/tools/validate_release_manifests.py +++ b/tools/validate_release_manifests.py @@ -59,6 +59,12 @@ def files(root: Path, excluded_file: Path) -> list[Path]: if path.is_file() and path.resolve() != excluded_file.resolve() and not any(part in EXCLUDED for part in path.relative_to(root).parts) + and not ( + root.resolve() == REPO.resolve() + and len(path.relative_to(root).parts) > 1 + and path.relative_to(root).parts[0] == "verification" + and path.relative_to(root).parts[1].startswith("remediation-") + ) ), key=lambda path: path.relative_to(root).as_posix().lower(), ) diff --git a/verification/remediation-2026-08-12/accessibility-review.md b/verification/remediation-2026-08-12/accessibility-review.md new file mode 100644 index 0000000..ad3cd25 --- /dev/null +++ b/verification/remediation-2026-08-12/accessibility-review.md @@ -0,0 +1,23 @@ +# Accessibility review — TestForge + +Receipt: `TESTFORGE-A11Y-441a22b-af19aa44-20260812` + +- Bound commit: `441a22b8ac1f6fda9c4d7ba355f5cca19f365d1c` +- Bound fingerprint: `af19aa440e63bfd1d4fd8e4d9e6c516dabf03892747743b1de138600e191c7b3` +- Result: `PASS — STATIC/SOURCE REVIEW`; GUI browser and assistive-technology behavior remain `NOT TESTED` + +## Checks and evidence + +- `lang=en`, one page-level H1, ordered H2/H3 hierarchy, semantic header/nav/main/section/footer landmarks, labeled navigation, and a maintained 404 recovery journey. +- Skip links on index and 404; native anchors; visible `:focus-visible` outlines; mobile navigation remains present and horizontally scrollable; the overflow table wrapper is keyboard-focusable and labeled. +- The Pages hero has meaningful alt text and declared intrinsic dimensions. The brand glyph is correctly hidden from assistive technology. +- Responsive breakpoints at 76rem, 58rem, and 40rem; content grids collapse; no scripted animation; reduced-motion preference disables smooth scrolling. +- Native table headers are retained. Code and long status labels use wrapping/overflow controls rather than clipping. +- Measured WCAG relative-luminance contrast: `#8f1111/#f9fbfb` 8.962:1; `#5b0808/#f9fbfb` 13.634:1; `#59686f/#edf1f2` 5.081:1; `#a8b6bd/#010203` 9.978:1; `#ff7777/#010203` 8.066:1; dark focus 14.401:1; light focus 7.604:1 and 6.945:1. +- Hesperos accessible-Markdown lint: 46 documents clean; only the verbatim MIT license clause triggers the directional-word heuristic and is intentionally exempt. + +## Explicit untested boundary + +Screen-reader announcement, browser accessibility-tree behavior, live tab order, keyboard traversal, zoom/reflow in an actual browser, high-contrast mode, and representative disabled-user testing were not executed. Static source evidence does not establish formal accessibility conformance. + +Any governed-file change invalidates this receipt. diff --git a/verification/remediation-2026-08-12/adversarial-publication-review.md b/verification/remediation-2026-08-12/adversarial-publication-review.md new file mode 100644 index 0000000..155104a --- /dev/null +++ b/verification/remediation-2026-08-12/adversarial-publication-review.md @@ -0,0 +1,16 @@ +# Final adversarial publication review — TestForge + +Receipt: `TESTFORGE-ADVERSARIAL-PUBLICATION-441a22b-af19aa44-20260812` + +- Governed content: `441a22b8ac1f6fda9c4d7ba355f5cca19f365d1c` +- Fingerprint: `af19aa440e63bfd1d4fd8e4d9e6c516dabf03892747743b1de138600e191c7b3` +- Starting state: `UNKNOWN` +- Pre-publication disposition: `READY_WITH_LIVE_CONDITIONS` + +The complete documentation, static accessibility, visual, package, release, and adversarial reviews pass locally. The repository remains in `REMEDIATED, NOT YET LIVE` until the protected PR merge, main checks, Pages deployment, and exact live-source crawl complete. + +Required final checks: exact final remote commit; required check success; Pages workflow success; raw README parity; Pages HTML/CSS/404 parity; all local navigation and fragments; all external links; exact README/Pages/social bytes; exact OG/Twitter metadata; exact repository social-preview bytes; and a custom unknown route returning the governed 404. + +GUI-rendered browser behavior and assistive-technology behavior remain `NOT TESTED` under the explicit no-browser constraint and cannot be inferred from HTTP 200 or source correctness. + +Any governed-file change invalidates this review. diff --git a/verification/remediation-2026-08-12/adversarial-review.md b/verification/remediation-2026-08-12/adversarial-review.md new file mode 100644 index 0000000..0ed028c --- /dev/null +++ b/verification/remediation-2026-08-12/adversarial-review.md @@ -0,0 +1,27 @@ +# Adversarial verification — TestForge + +Receipt: `TESTFORGE-ADVERSARIAL-441a22b-af19aa44-20260812` + +- Candidate: `441a22b8ac1f6fda9c4d7ba355f5cca19f365d1c` +- Fingerprint: `af19aa440e63bfd1d4fd8e4d9e6c516dabf03892747743b1de138600e191c7b3` +- Local candidate disposition: `REVIEW_PASS` +- Publication disposition: `READY_TO_PUBLISH`; live exact-content oracles remain mandatory + +## Challenges performed + +- Re-read every declared customer document and attacked current-vs-historical release identity, supported hosts, activation language, privacy/network claims, portal state, release authority, cleanup, support, and licensing against actual package sources and tests. +- Reconciled remediation content with newer v1.1.6 main rather than overwriting the release: current package, frozen archive, retained v1.1.4 portal packet, workflows, documentation, and evidence now stay distinct. +- Found and repaired the stale v1.1.5 current-authority pointer, ambiguous historical Build Week counts, and two unstable directional references. The verbatim MIT clause was preserved. +- Challenged documentation structure separately from substance: 49-document full read, Hesperos lint, local-link tests, 22 external URLs, and current-release checks all pass. +- Reopened all three images and challenged role distinction, identity, crop safety, hierarchy, contrast, artifacts, required social text, and wiring. All pass. +- Challenged the merged product claims through 98 unit/harness tests, 233-file package verification, 12-case eval validation, current manifests, frozen v1.1.6 verification, and line-ending checks. All pass. +- Corrected the prior false Actions blocker: this is a public repository and standard hosted runners are free; the complete 13-job remediation graph has zero billable minutes. + +## Remaining publication oracles + +- PR checks pass on the synchronized exact head and protected merge completes without ruleset weakening. +- Main checks and Pages deployment pass for the final merge commit. +- Live raw README, Pages HTML/CSS/404, navigation/fragments, assets, metadata, and repository Open Graph bytes equal the reviewed candidate. +- GUI-rendered browser and assistive-technology behavior remain `NOT TESTED`; no later receipt may promote them without direct execution. + +Any governed-file change invalidates this review. diff --git a/verification/remediation-2026-08-12/governed-fingerprint.json b/verification/remediation-2026-08-12/governed-fingerprint.json new file mode 100644 index 0000000..881532f --- /dev/null +++ b/verification/remediation-2026-08-12/governed-fingerprint.json @@ -0,0 +1,394 @@ +{ + "schema": "portfolio-documentation-fingerprint/v1", + "commit": "441a22b8ac1f6fda9c4d7ba355f5cca19f365d1c", + "algorithm": "sha256(path UTF-8 + NUL + lowercase file SHA-256 + LF), records sorted case-insensitively", + "file_count": 77, + "collection_sha256": "af19aa440e63bfd1d4fd8e4d9e6c516dabf03892747743b1de138600e191c7b3", + "files": [ + { + "path": ".agents/plugins/marketplace.json", + "sha256": "4f1010e892c432ba62b62c2d611af692b19cdfaeb24a7d1e8aa0d0d034421ed7", + "bytes": 397 + }, + { + "path": ".github/workflows/deploy-pages.yml", + "sha256": "06411a7dcef287bfab89e8ab01978d1182e83c3b25cecde716c4660faba19b03", + "bytes": 781 + }, + { + "path": ".github/workflows/test.yml", + "sha256": "3f328e9f5474370f6f191bdb9ef928c16efcfa1e0586945ce1cb3e9ec87c92c2", + "bytes": 1119 + }, + { + "path": "ARCHIVE-CUSTODY.md", + "sha256": "f00ba461b43c3bc170d13f5270f8a74ac5bb635b1e5401f99c602e13bd2805ec", + "bytes": 3337 + }, + { + "path": "assets/testforge-readme-hero.png", + "sha256": "6891298c9e6d0cea15e72a249ecaba2d6546dbe841578b239ad19dc0d2b09a03", + "bytes": 2236720 + }, + { + "path": "assets/testforge-social-preview.png", + "sha256": "9eb81f699f7b8bfdfa4b6ec41cee2883563d1d8de79bed2298167b90c212ec12", + "bytes": 600421 + }, + { + "path": "ATTRIBUTION.md", + "sha256": "72142ee7e0deca5f96a0e67037fbb0750a1b50c05dccf1409f36ab58469ff8c8", + "bytes": 638 + }, + { + "path": "BUILD-NOTE.md", + "sha256": "cd6d587a238a65766bf0da59ea35d2b6abe5a84255138d453532134fab4fd6c0", + "bytes": 2829 + }, + { + "path": "BUILD-WEEK.md", + "sha256": "b8c06a6148caa2279226345c192cb4e6a9411196be3cd2ff37620d194761e8f8", + "bytes": 10509 + }, + { + "path": "CONTRIBUTING.md", + "sha256": "57bf58033a9570984271c4e39ec79387ff09af9cbd9e81bb2736ade080452399", + "bytes": 959 + }, + { + "path": "docs/.nojekyll", + "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", + "bytes": 0 + }, + { + "path": "docs/404.html", + "sha256": "99b1f755194e2f8d4ac0775327bc90496b764ee1331400f68a2c62142e1f407e", + "bytes": 1579 + }, + { + "path": "docs/assets/testforge-hero.png", + "sha256": "f639f84c2c597053ca04c010be36201c46011596dfbeec9b7ca4e76e38a68bf8", + "bytes": 2212223 + }, + { + "path": "docs/index.html", + "sha256": "0e756a1481d70ce36b6f8157403022c29d24cc3288d33a7e87b7f8c2435c1701", + "bytes": 27157 + }, + { + "path": "docs/SITE-SOURCE.md", + "sha256": "587fd2a272411dc0ca217bcc2f0390469ee348653a1e79f4f54025298ffbe6f8", + "bytes": 2178 + }, + { + "path": "docs/style.css", + "sha256": "f3f1b17a5646f75b66bbc58773c24bcb3d537af979318629b5d65584ea3bdebd", + "bytes": 19819 + }, + { + "path": "documentation-manifest.json", + "sha256": "2a654257294da78f94eebc0b6b7d02789cf0456d46d9fbd5268eff39a76d0f7d", + "bytes": 6820 + }, + { + "path": "JUDGE-QUICKSTART.md", + "sha256": "13bf30896cebe30e2589ac8216a935ea39f08ff90b5bf9c25255f17bcddf9a96", + "bytes": 3707 + }, + { + "path": "LICENSE.md", + "sha256": "ed7874c404bbcf284cb8e3a10ffe2f4c13b0dffec6238215d2171df658fb124e", + "bytes": 2770 + }, + { + "path": "NOTICE.md", + "sha256": "1eb736dd6a4ad57c2959d0efd5f273622d095224d6e1efd72c22fac25d4d381a", + "bytes": 680 + }, + { + "path": "PLUGIN-DIRECTORY-SUBMISSION-v1.1.4.md", + "sha256": "e742372198a68c883024eef8e1bf49bb3042684e58e18bea0280dd9d33aa1482", + "bytes": 2460 + }, + { + "path": "plugins/testforge/.codex-plugin/plugin.json", + "sha256": "711c6192c83691fcf99cf5134af64af08ea95cd23e62a63341dbbbb3638ef7bf", + "bytes": 2014 + }, + { + "path": "README.md", + "sha256": "12c06960e476f9c0b742b383068d10109d81408d810446f7334bf0b234214e23", + "bytes": 9574 + }, + { + "path": "release-docs/CAPABILITIES.md", + "sha256": "cd2c64f84b2dd1e2acfe9b6fe1366436741b22154ba41da7c64f6a288c421bf0", + "bytes": 1093 + }, + { + "path": "release-docs/DESCRIPTION-CUSTODY.md", + "sha256": "e02215f9cb9a35a87ca907926e06237648e28ec7374472324a3cdd7cebb4d922", + "bytes": 697 + }, + { + "path": "release-docs/HOST-EVIDENCE-BOUNDARY.md", + "sha256": "cc578954c05ba77698c268f0f46ae1f1a6458cb3861b7f6f5483a7d7fba054bc", + "bytes": 864 + }, + { + "path": "release-docs/INSTALL-CLAUDE.md", + "sha256": "6f502be8decda520365c1105bf1cb33e6c32a1084191a5e71a5a60d7594a1b37", + "bytes": 2220 + }, + { + "path": "release-docs/INSTALL-CODEX.md", + "sha256": "aa5295ec9d8d7e4985e513aabe854f313dd41f102c0e436a751f2783090b6a5d", + "bytes": 2677 + }, + { + "path": "release-docs/LIMITATIONS.md", + "sha256": "caea704ad7b697c68791d3ee635ba7675215abd6d1cd0723d3d086ae742eed5a", + "bytes": 1140 + }, + { + "path": "release-docs/MAINTAINER-GUIDE.md", + "sha256": "5cdb0b9f0772adf27bc22e9ce7b4b8e0e6987e01b6397481ce52060e834e1d31", + "bytes": 1870 + }, + { + "path": "release-docs/PACKAGE-REFERENCE.md", + "sha256": "323197609d929916d5beb6616853f7fd13507c528b7f7817c057123a19e0d7bc", + "bytes": 1069 + }, + { + "path": "release-docs/PROVENANCE.md", + "sha256": "a4b5e781990ad9d3789cc27458632391f26f82f6ee18b152e476a54f20b287c8", + "bytes": 976 + }, + { + "path": "release-docs/QUICK-START.md", + "sha256": "7c220473e582e40693e46da4e674ba9627b60117c38d1d50537444f1eb3e459e", + "bytes": 3673 + }, + { + "path": "release-docs/README.md", + "sha256": "5e84ccd0c591efcbf95a2b40b96192514438d12b2bb25a33f5a2c65e1e06706d", + "bytes": 1145 + }, + { + "path": "release-docs/SUPPORT.md", + "sha256": "98ea076e19d8c1590b71052db76c1f195dc9132aad3a2ecd3a119015e22e2557", + "bytes": 1891 + }, + { + "path": "release-docs/VALIDATION.md", + "sha256": "d61e2c540ace20531dba614fbe45a8851357e9cfd957ea40f9c687d5736308c1", + "bytes": 1357 + }, + { + "path": "release-manifest.json", + "sha256": "844af2f0305633118d07bf046392dc81d19cb3c7c51147b06b237aca7ea61c1b", + "bytes": 241395 + }, + { + "path": "RELEASE-NOTES.md", + "sha256": "9dfa7e6e4013b693a3785357624a5e631e3afdf0bcace5379c3ca4b388e072ed", + "bytes": 1678 + }, + { + "path": "RELEASE-NOTES-v1.1.6.md", + "sha256": "d6dcf66c4e78caa585d0407ddb08ec4ba4eab5277d87628782a3f571f90bfc6b", + "bytes": 1921 + }, + { + "path": "SECURITY.md", + "sha256": "e985dce607e80fa60c9290cdea64e5f90b2ef0f2d999210f86de5e5d4c857ed9", + "bytes": 939 + }, + { + "path": "testforge/CHANGELOG.md", + "sha256": "08627c37a6baa0318c8109b14ce528a3da32c764fb067c814261a4126508459b", + "bytes": 5237 + }, + { + "path": "testforge/docs/CAPABILITY-MATRIX.md", + "sha256": "9fa2fb634c3717fa2fcb1521dab18c8a778951d469fad389d2f1a82049201db8", + "bytes": 1493 + }, + { + "path": "testforge/docs/DATA-AND-PRIVACY.md", + "sha256": "32cb38baf04ee85e983890ce44c2f06a0a678497f37d4b556c000e55fb4c9e7b", + "bytes": 1953 + }, + { + "path": "testforge/docs/HOST-COMPATIBILITY.md", + "sha256": "277c40a768557356b0aa278c787dd2acf72a93ce4d9a65afccd6c6c81e703f90", + "bytes": 1596 + }, + { + "path": "testforge/docs/INSTALL-CLAUDE.md", + "sha256": "82927330ec8eead0166ca10280b0a7008d48b2e061bbc7a6b22efe94ff10353b", + "bytes": 2317 + }, + { + "path": "testforge/docs/INSTALL-CODEX.md", + "sha256": "085dc6d43c13a31de00df8d9e8cd9dfe7da6446dc3580f6df942b8d5866863cf", + "bytes": 2743 + }, + { + "path": "testforge/docs/LIMITATIONS.md", + "sha256": "5d7f93fedc61ad1fa69b07bbff9fdc4cb0025b223756a50daf8dd75b02ad763e", + "bytes": 1408 + }, + { + "path": "testforge/docs/QUICK-START.md", + "sha256": "32e57c9f4916b95027699d4926c0ba3557678eac7a780e62f811d720be75c9a7", + "bytes": 3872 + }, + { + "path": "testforge/docs/SALES-DEMO.md", + "sha256": "31edbc66dc07aa1a94d2652aa23a2dbb736b42f5e1cc54cbe8f57c5f4e5a0b9b", + "bytes": 1028 + }, + { + "path": "testforge/docs/SUPPORT-AND-VERSIONING.md", + "sha256": "df038085775458bdad65f28572748f1e4764644cf241860a000452d9f22f15d7", + "bytes": 1133 + }, + { + "path": "testforge/docs/SUPPORTED-ENVIRONMENTS.md", + "sha256": "c9113c412443ef506e2db8450199b85efa33e11105493e74e75739776a737f6c", + "bytes": 1046 + }, + { + "path": "testforge/docs/TERMS-OF-USE.md", + "sha256": "26c7d924cf0162ec4135898ca7e6d987c2f5208d83768948df404611b56c8ac7", + "bytes": 3712 + }, + { + "path": "testforge/docs/TROUBLESHOOTING.md", + "sha256": "1d4a6ecab38dbcb177045ea37b119a5bac13942497a80e60d17f36aaccff292d", + "bytes": 1313 + }, + { + "path": "testforge/docs/VALIDATION.md", + "sha256": "5cd09dce1f87d6e61d47ab5563700550e06fffb80d0fd6eba6c19beec495c473", + "bytes": 1282 + }, + { + "path": "testforge/docs/WORKFLOWS.md", + "sha256": "b245c76b1948ead728fbb5865486e42a3da4c1f5ec386079ebcb2403fc5a9248", + "bytes": 2626 + }, + { + "path": "testforge/package-manifest.yaml", + "sha256": "8e81ea34da6e525ab7450646cae899bbc16d8adf3d309b45094629de8cab394d", + "bytes": 1398 + }, + { + "path": "testforge/PROVENANCE.md", + "sha256": "20871f4b40814f93ccb34d1e5a9c9e12b7c283e134c1266889900b3c922936fb", + "bytes": 1452 + }, + { + "path": "testforge/README.md", + "sha256": "3e6f517b87836508a9832f6170858a774a42a367d9c8a5f90aca30c449504c32", + "bytes": 2665 + }, + { + "path": "testforge/release-manifest.json", + "sha256": "4f3f9cfa32a3a9b5a086aa2f626d80e8cb22174f45adf42a07ded7b97fb39340", + "bytes": 43504 + }, + { + "path": "testforge/SECURITY.md", + "sha256": "187af3cd5880877410649fb60ca112a9cdf04a6c97fb9c188ce8513339d63521", + "bytes": 1260 + }, + { + "path": "testforge/skills/software-verification/assets/schemas/metered-verification-plan.schema.json", + "sha256": "5ace038f1f1766d5798ecdcd2edbf7c5687c1fa46427b4765b2452da760e9cbe", + "bytes": 2287 + }, + { + "path": "testforge/skills/software-verification/assets/templates/metered-verification-plan.json", + "sha256": "4ca2744d5a000d478f1896b5e69e7d5a2caba0e5d0d36945132f99cb75ef815b", + "bytes": 788 + }, + { + "path": "testforge/skills/software-verification/assets/templates/metered-verification-response.md", + "sha256": "4d7e1d712109519b840e140d39a018249db030920d74fed24c100d5c2974a972", + "bytes": 3310 + }, + { + "path": "testforge/skills/software-verification/references/core/metered-verification.md", + "sha256": "1bdf07ebfac077b2f15a3b1e89486294dcb1e87ae8436f7f57c84f4b037e9a9f", + "bytes": 7243 + }, + { + "path": "testforge/skills/software-verification/scripts/assess_metered_verification.py", + "sha256": "30e073c1f864f34e87dc2ec5c58d3784469ead684ca1791263b367f9aaf0e4d9", + "bytes": 9785 + }, + { + "path": "testforge/skills/software-verification/SKILL.md", + "sha256": "1c8c50843e76c263377224c137e9fa7d1c46551b12e62b04b0976eea6ddbe3b3", + "bytes": 17250 + }, + { + "path": "testforge/skills/verification-reviewer/SKILL.md", + "sha256": "31a2847003e6d94e8b22645482b966b295b675af478b4f2ef4e3f392d8d0d68b", + "bytes": 3424 + }, + { + "path": "testforge/tests/test_host_packaging.py", + "sha256": "b444e2bfec9469683f62313510e6216b287da56c3c5d6fbf85deb3f59aa325fe", + "bytes": 1758 + }, + { + "path": "testforge/tests/test_metered_verification.py", + "sha256": "f9015909fba5a6449e4dc67ba871e850afee872a7e56f0682af9f8983bf92f2b", + "bytes": 9757 + }, + { + "path": "tests/test_documentation.py", + "sha256": "ad6d803501ec2381a8603f8cfe28188b2c50fe3e13a920e08ae5611d560875fe", + "bytes": 5466 + }, + { + "path": "tests/test_public_distribution.py", + "sha256": "a9a2af48b28749007edd7887529495a575cba629b80539bd4b3c66a5d04ad913", + "bytes": 6110 + }, + { + "path": "tests/test_release_identity.py", + "sha256": "10a449823ec863ef489165635806fab9d316ec36f73923737429262c4ca0b2c8", + "bytes": 3132 + }, + { + "path": "tools/augment-evals/augment_eval.py", + "sha256": "6ebc4f5a01b4cf59754a00b0344aca508751286677082be8410f46434ba920f8", + "bytes": 69105 + }, + { + "path": "tools/augment-evals/README.md", + "sha256": "80b0dd9474e2e4fb44d82595d1d3ea97749c5235c68b43d2fe737a0a60e91e34", + "bytes": 11365 + }, + { + "path": "tools/rebuild_public_release.py", + "sha256": "f6e4fa00425c170aa5a8385d9ce0a39ae6fe9f8af632e8f2d3eafdd0e4907e3b", + "bytes": 4346 + }, + { + "path": "tools/validate_release_manifests.py", + "sha256": "4f2ca918673e0db9073c824fd204e6d3962b6efeffb4cd205043a71cbcf1c556", + "bytes": 4503 + }, + { + "path": "TRADEMARKS.md", + "sha256": "463e2f6627994a433b459ae9942f76db0b70facee91c296219e9ace917db77bd", + "bytes": 762 + } + ] +} diff --git a/verification/remediation-2026-08-12/hesperos-review.md b/verification/remediation-2026-08-12/hesperos-review.md new file mode 100644 index 0000000..8466442 --- /dev/null +++ b/verification/remediation-2026-08-12/hesperos-review.md @@ -0,0 +1,31 @@ +# Hesperos documentation review — TestForge + +Receipt: `TESTFORGE-HESPEROS-441a22b-af19aa44-20260812` + +- Reviewed content commit: `441a22b8ac1f6fda9c4d7ba355f5cca19f365d1c` +- Governed fingerprint: `af19aa440e63bfd1d4fd8e4d9e6c516dabf03892747743b1de138600e191c7b3` +- Governed files: 77; all 49 declared customer documents plus presentation, release, workflow, implementation, manifest, and test sources used to check their claims +- Review disposition: `CONTENT PASS — LOCAL CANDIDATE`; publication and deployed-source verification remain separate + +## Full documentation cycle + +1. Read the root README top to bottom and read all 49 current customer-facing documents declared by `documentation-manifest.json` top to bottom (1,864 lines before final two targeted reference repairs). +2. Read the Pages HTML and recovery page completely, then checked their navigation, anchors, metadata, customer route, and source boundary. +3. Read the operator and reviewer SKILL entrypoints, metered-verification doctrine, assessor, schema, templates, current package/release manifests, workflows, and tests needed to verify documentation claims. +4. Reconciled the documentation with v1.1.6 after the remediation branch met a newer public main: current release identity, current/frozen archive custody, hosted-capacity safeguards, action triggers, package counts, test counts, and evidence boundaries now agree. +5. Repaired a historical v1.1.0 note that named v1.1.5 as the current release authority; labeled old Build Week counts as an explicit v1.0.2 snapshot; replaced two reflow-fragile “above” references with stable step/section references. +6. Reran Hesperos accessible-Markdown lint over all 47 declared Markdown documents: 46 pass without findings; the sole retained heuristic hit is the unmodified standard MIT sentence “The above copyright notice…”. Legal text was correctly preserved. +7. Re-ran local-link, release-identity, manifest, package, and external-link checks after the final content changes. All 22 unique external customer URLs returned HTTP 200. + +## Customer-journey verdicts + +- Product, audience, problem, capabilities, and boundaries: PASS +- Supported-host installation, verification, update, removal, rollback, and cleanup: PASS +- First successful use, realistic inputs/outputs, normal workflows, and metered configuration: PASS +- Troubleshooting, recovery, privacy, storage, network, and security boundaries: PASS +- Limitations, unsupported claims, provenance, validation, evidence state, support, contribution, license, and terms: PASS +- Local Pages content, navigation, recovery, and metadata source: PASS +- Deployed final Pages bytes and navigation: pending publication +- GUI-rendered browser experience: NOT TESTED under the explicit no-browser constraint + +Any change to a governed file or the reviewed content commit invalidates this receipt. diff --git a/verification/remediation-2026-08-12/local-verification.md b/verification/remediation-2026-08-12/local-verification.md new file mode 100644 index 0000000..a121626 --- /dev/null +++ b/verification/remediation-2026-08-12/local-verification.md @@ -0,0 +1,21 @@ +# Local verification record — TestForge + +Bound content commit: `441a22b8ac1f6fda9c4d7ba355f5cca19f365d1c` +Bound fingerprint: `af19aa440e63bfd1d4fd8e4d9e6c516dabf03892747743b1de138600e191c7b3` + +Final local executions on 2026-08-12: + +- Repository unit suite: PASS, 25 tests +- Packaged TestForge suite: PASS, 25 tests +- Augment-evals harness: PASS, 48 tests +- Package verifier: PASS, 233 files, zero errors or warnings +- Eval-suite validator: PASS, 12 cases across 11 dimensions +- Current release manifests, archive topology, and source parity: PASS +- Frozen v1.1.6 portable verifier: PASS, 2 Claude archives, 135 files, 105 source files, 3 ZIP containers, 238 ZIP members +- Line-ending policy: PASS, standard profile, zero findings and no indexed CR paths +- Documentation currency/local-link tests: PASS +- Hesperos Markdown lint: 46 clean; one deliberate verbatim-license exemption +- Unique external customer URLs: PASS, 22 of 22 HTTP 200 +- Three visual assets: reopened and pixel-reviewed at original detail + +The earlier missing validation-process handle was a task-compaction tool-state loss, not a software result; no verdict was inferred. The complete suite above was executed afresh against the final target. diff --git a/verification/remediation-2026-08-12/publication-preflight.md b/verification/remediation-2026-08-12/publication-preflight.md new file mode 100644 index 0000000..f6eba3d --- /dev/null +++ b/verification/remediation-2026-08-12/publication-preflight.md @@ -0,0 +1,16 @@ +# Public publication preflight — TestForge + +Official GitHub billing documentation observed 2026-08-12 states standard GitHub-hosted runners are free in public repositories. TestForge is public; private-repository allowance exhaustion is not this repository’s billing boundary. + +Observed and remaining execution graph: + +- completed earlier feature-branch run under the pre-v1.1.6 workflow: 4 public standard-runner jobs, all passed; +- branch synchronization after v1.1.6 reconciliation: the new workflow has no feature-branch `push` trigger; the open pull request can create 4 PR jobs; +- merge to `main`: 4 test jobs plus 1 Pages deployment; +- complete remediation maximum: 13 public standard-runner jobs, zero automatic retries planned, zero billable minutes. + +Conservative raw ceiling across the 13-job graph: `13 × 360 = 4,680 raw runner-minutes`; public standard runners are free, so billed minutes are zero. Ruleset `20247129` still requires `line-ending-policy`; no bypass or ruleset weakening is required. + +Official sources: +- https://docs.github.com/en/actions/concepts/billing-and-usage +- https://docs.github.com/en/billing/concepts/product-billing/github-actions diff --git a/verification/remediation-2026-08-12/publication-resolution.json b/verification/remediation-2026-08-12/publication-resolution.json new file mode 100644 index 0000000..3004aae --- /dev/null +++ b/verification/remediation-2026-08-12/publication-resolution.json @@ -0,0 +1,25 @@ +{ + "format": "testforge-publication-resolution/v1", + "observed_at": "2026-08-12", + "repository_visibility": "public", + "reviewed_commit": "441a22b8ac1f6fda9c4d7ba355f5cca19f365d1c", + "governed_fingerprint": "af19aa440e63bfd1d4fd8e4d9e6c516dabf03892747743b1de138600e191c7b3", + "capacity_boundary": "standard GitHub-hosted runners are free in public repositories", + "execution_graph": { + "completed_initial_branch_jobs": 4, + "remaining_pull_request_jobs": 4, + "remaining_main_jobs": 4, + "remaining_pages_deployment": 1, + "automatic_retries": 0, + "complete_maximum_jobs": 13, + "billable_minutes": 0 + }, + "ruleset_id": 20247129, + "ruleset_change_required": false, + "repository_social_preview": { + "url": "https://repository-images.githubusercontent.com/1302637373/0922f05b-e6c8-457b-ae48-20dfdfa23e09", + "sha256": "9eb81f699f7b8bfdfa4b6ec41cee2883563d1d8de79bed2298167b90c212ec12", + "candidate_exact": true + }, + "status": "PUBLICATION_AUTHORIZED_WITH_EXISTING_RULESET" +} diff --git a/verification/remediation-2026-08-12/verification-manifest.json b/verification/remediation-2026-08-12/verification-manifest.json new file mode 100644 index 0000000..b6ff573 --- /dev/null +++ b/verification/remediation-2026-08-12/verification-manifest.json @@ -0,0 +1,21 @@ +{ + "schema": "portfolio-remediation-verification/v1", + "repository": "https://github.com/Stunspot/TestForge", + "reviewed_commit": "441a22b8ac1f6fda9c4d7ba355f5cca19f365d1c", + "governed_fingerprint": "af19aa440e63bfd1d4fd8e4d9e6c516dabf03892747743b1de138600e191c7b3", + "readme_content": "PASS_LOCAL_CANDIDATE", + "pages_content": "PASS_LOCAL_CANDIDATE", + "rendered_pages": "NOT_TESTED_GUI", + "readme_hero": "PASS_PIXEL_REVIEWED", + "pages_hero": "PASS_PIXEL_REVIEWED", + "social_card_file": "PASS_PIXEL_REVIEWED_EXACT_TEXT", + "repository_social_card_wiring": "PASS_LIVE_EXACT_CANDIDATE", + "hesperos": "PASS", + "accessibility": "PASS_STATIC_GUI_AND_AT_NOT_TESTED", + "adversarial": "REVIEW_PASS_WITH_LIVE_CONDITIONS", + "final_status": "REMEDIATED_NOT_YET_LIVE", + "blockers": [ + "Protected merge and exact live-source verification remain to be executed.", + "GUI browser rendering and assistive-technology behavior remain NOT TESTED." + ] +} diff --git a/verification/remediation-2026-08-12/visual-review.md b/verification/remediation-2026-08-12/visual-review.md new file mode 100644 index 0000000..255c7bc --- /dev/null +++ b/verification/remediation-2026-08-12/visual-review.md @@ -0,0 +1,15 @@ +# Visual asset review — TestForge + +Receipt: `TESTFORGE-VISUAL-441a22b-20260812` + +All three final files were reopened at original detail and their actual pixels were inspected. + +| Role | File | Dimensions | SHA-256 | Pixel verdict | +|---|---|---:|---|---| +| README hero | `assets/testforge-readme-hero.png` | 1600×640 | `6891298c9e6d0cea15e72a249ecaba2d6546dbe841578b239ad19dc0d2b09a03` | PASS — wide evidence-forging bench, clear left-to-right hierarchy, focused crack/failure detail, strong cyan/red TestForge identity, no text, blank field, accidental transparency, or crop-critical edge content | +| Pages hero | `docs/assets/testforge-hero.png` | 1200×800 | `f639f84c2c597053ca04c010be36201c46011596dfbeec9b7ca4e76e38a68bf8` | PASS — distinct vertical three-lane inspection machine, two cyan accept lanes and one red reject lane, centered for the site column, no embedded text or incoherent artifact | +| Social card | `assets/testforge-social-preview.png` | 1280×640 | `9eb81f699f7b8bfdfa4b6ec41cee2883563d1d8de79bed2298167b90c212ec12` | PASS — exact visible title `TESTFORGE` and line `SOFTWARE VERIFICATION THAT ARGUES BACK.` are crisp, high-contrast, and safely inset; the anvil/evidence-tree composition remains identifiable under likely social crop | + +The files are distinct compositions and aspect ratios (2.5:1, 1.5:1, 2:1), not duplicated crops. README and Pages source wiring are correct. Pages Open Graph/Twitter wiring uses the social card. GitHub’s configured repository Open Graph bytes match the same social-card SHA-256. + +Any governed-file change invalidates this receipt.