# Verification record

Candidate: **13.0.0-rc.0**, reviewed on **2026-09-15**. This document separates deterministic checks, real-host execution and unavailable integrations. It is not a publication approval.

Historical scope: this baseline was recorded before the separately authorized project-repository publication and source upload. Statements below about empty repositories or no remote writes describe that earlier validation phase, not current GitHub state. Source upload does not prove a versioned release, template activation or live MCP connectivity.

## Scope

All automated project data is synthetic. No GitHub project was created or migrated, no remote code/release/template flag was changed, and no employee schedule or legacy runtime was modified. Gmail and Granola were not callable in this task's tool inventory; live provider reads are therefore unverified.

## Interpretation

- `context-ready` proves verified local context preparation and selected references; it does not prove a model completed a task.
- Installer doctor checks owned artifacts and can report `not-probed` for host/MCP execution.
- A compiler schema check or plugin registration is not an execution test.
- Model/tool restrictions rely on the host's native sandbox and permission settings.
- Real-host evidence must include the installed entry point, worker action and resulting synthetic artifact, or a specific blocking reason.

## Local checks

The supported release runtime used locally was Node **20.20.2** with npm **10.9.4**. Component development also used Node 24.13.1; that is outside the declared supported range and is not the release baseline. Node 22, macOS and Linux have CI jobs but were not executed on this Windows machine.

Final production sources were frozen before the full run. It executed **607 tests**: **606 passed**, with one obsolete compiler-text assertion failing after the reviewed source-discovery clarification. Only that test was updated; the complete compiler file then passed **20/20**, including all 108 agent/host boundaries, exact canonical bodies and path/permission restrictions. No production change followed the full run and no failing assertion was removed without replacement. There are no unresolved test failures; the two runs are recorded separately rather than presented as one all-green invocation.

The full run included a real packed npm install, 108 prepared agent contexts, each of the four bundled helper subprocesses and their standalone doctor with an empty PATH, plus install/uninstall checksum preservation. The final archive is produced by the local release pipeline, which writes separate machine-readable evidence for reproducibility, extracted/installed inventories, secret and identifier scans, native surface validation and SPDX. Those files live beside the archive under `platform/.artifacts`; packaging never uploads a release. Source/runtime validators are not model-execution evidence.

The checks cover:

- All 27 canonical agents across four generated hosts: 108 prepared contexts, selected references, parent/worker scope, provenance and immutable manifest generation.
- Installed npm archive and actual subprocess launch of each host's bundled helper, without administrative bootstrap or a security provider.
- Effective GitHub rights, missing authentication, explicit denial, ambiguous private 404, offline operation, revocation and template creation with injected adapters. The real `access` command confirmed personal read/write/admin permission on the private plugin target. No live denial was induced and no live repository was created.
- Local MCP discovery and scoped read adapters, absent tools, wrong provider/project, duplicate sources, conflicting revisions, prompt injection, secrets and quarantine. Provider discovery alone is never marked verified. No Gmail or Granola tool was callable in this task, so there was no live mailbox/meeting read.
- Three-way context conflicts, explicit deletions, offline queues, two-writer exclusion across custom data roots, symlink containment, failed/oversized Git object reads, secret-bearing commit metadata, and prevention of implicit tag/submodule pushes.
- Commands-only component dependencies, installation ownership, modified/foreign files, update, rollback, uninstall, stale locks and crash recovery.
- Daily update caching, disabled checks, one notice per version, native-channel suppression, locally delivered cache copies, failed network reads, archive size/digest verification and preservation of changed downloads. Private release acquisition used test adapters; no remote release exists yet.

Independent reviews found and corrected project/sync/MCP issues, installation/notification issues, and missing core project-context selection. Substantive safety tests were retained. Removed bootstrap tests now check that the removed entry point cannot load executable authorization providers. File-replacement tests use portable rename semantics while retaining ownership-loss assertions on Windows.

## Actual host evidence

| Host | What ran | What remains unverified |
| --- | --- | --- |
| Claude Code 2.1.220 | The npm-installed bundle loaded through `--plugin-dir`. Native initialization listed the 13 public commands and 27 plugin agents. The actual SessionStart hook returned `{}` with exit 0. | Model execution stopped with an expired/unrefreshable host OAuth session. No completed Claude worker task or new-version UI notice is claimed. |
| Codex CLI 0.150.1 | Native marketplace registration and plugin installation succeeded inside an isolated `CODEX_HOME`. All installed helper entry points prepared context. | The isolated profile had no copied credentials; model execution returned HTTP 401. Native slash-menu behavior and a visible update notice need authenticated acceptance. |
| Current Codex app | The installed product skill was read explicitly, its installed helper prepared parent and worker context, and the native collaboration tool ran `product-ticket-writer`. The worker wrote a real synthetic ticket, with 13 sections, observable acceptance criteria, open questions and selected reference provenance. | This is direct loading of the installed skill in the running app, not evidence of marketplace activation in this existing task. It does not prove every design/Figma/browser workflow. |
| Gemini CLI 0.28.2 | Actual installed command/agent loaders accepted 13 command files and 27 agents. The local helper prepared canvas and verifier context. A native command was attempted with an isolated `GEMINI_CLI_HOME`. | Execution stopped at required host authentication (exit 41). No credentials were copied. Completed model/worker work and visible notices remain unverified. |
| Cursor desktop 3.17.8 | Installed helper prepared command and worker context; generated manifests and local-registration documentation were checked. | A usable separate `agent`/`cursor-agent` CLI was unavailable. Desktop `cursor agent --help` only produced desktop help. Actual UI activation, model/worker completion and connector reads are unverified. |

The synthetic Codex ticket used `reference.component-authoring`, `reference.components.list`, `reference.error-recovery` and quoted synthetic brief evidence. This demonstrates a real worker consuming selected context and producing an artifact; it is separate from the 108 preparation checks.

## Release boundary

Both target repositories were verified private and empty, with no default branch; `project-template` was not enabled as a template. No commit, push, PR, GitHub Release, public npm publication, deployment, access change or template toggle was performed.

The old source remained Git-clean and all **424** initially copied source-file hashes remained unchanged. The administration worktree's pre-existing edits were left intact. Operational hooks, client directories and old Git history were not copied into either prepared source tree.

Before release, complete authenticated model/worker acceptance in the intended hosts, a minimal project-scoped Gmail/Granola read where connected, and private release download/notification acceptance after an approved release exists. These missing external checks are not silently counted as passing tests.