# Acceptance ledger

This ledger defines the v0.1 evidence contract and v0.2 roaming workspaces; tests and direct probes are the evidence, not this checklist alone.

- Snapshot correctness: HEAD/index/worktree differ; partial staging, initial commits, deletions, renames, unusual paths, symlinks, conflicts, cancellation, and concurrent snapshot changes are handled explicitly. Reviewing never modifies repository content or index.
- Measurable evidence: JS/TS syntax-tree SLOC, decision counts, CC mass/erosion, explicit verbosity rules, exact-token callable clones. Absolute totals and ratios; unsupported and failed extraction visible.
- Shared physics: versioned Fovea facts/heat API; no duplicate graph engine. Multi-scale conserved mass, isolated nodes, boundary leakage, deterministic ranking, typed relationship witnesses. Separate category units; no quality score.
- Structural deltas: new clones, increasing complex callables, new import cycles, new cross-region imports. Baseline findings do not become new regressions merely by moving lines. Region totals reveal decision redistribution.
- Incremental engine: content-addressed bounded facts cache, snapshot/config-bound report identity, quiet debounced background refresh independent of edit tool path, shutdown and obsolete-result cancellation.
- Interfaces: contour_review tool, /contour review command, CLI JSON/text reviews, explicitly installed non-destructive Git hook. Staged is default; working-tree explicit. Bounded output and actionable questions.
- Policy: advisory default, optional explicit forbidden-import boundaries only; no score gating. Coverage failure never appears as a clean pass. Repeated automatic advisory for identical snapshot suppressed; explicit reviews reproducible.
- Delivery: documented scope and physics, runnable tests, clean typecheck/dead-code gate, bundled CLI and extension load probes. No GitHub writes, installation in user settings, or commits without request.

## Roaming workspace acceptance

- Successful structured/literal accesses select disjoint or nested projects without scanning the launch directory. Failed/blocked calls and opaque programs do not enroll roots. Native cwd semantics stay unchanged.
- A 32-root recency ring retires least-recently used projects; aliases unify, linked worktrees remain distinct. Branch-local root metadata survives compaction/reload, without reviving stale analysis or granting trust.
- Root-labelled tool/command checkpoints support explicit roots and never silently review a previous repository when the selected target is not Git. Agent origin is metadata, not authorship.
- Fair bounded background work remains silent. Explicit checkpoints take priority; retirement/session replacement invalidates obsolete work. Immutable reports reuse generations across more roots than the hot graph cache.
- Git analysis disables fsmonitor and transport/lazy-fetch helpers. Snapshot reads still preserve indexes; missing local objects are errors, not clean results.

## Checkpoint presentation acceptance

- Shared text renderer: `Δ` changes, `▪` source witnesses, `↗` modeled exposure, `?` review questions, and `⚠` coverage gaps. Relations stay attached to witnessed locations; heat is never a severity badge or a source witness.
- Preserve the `contour-review` custom message type, explicit-only disclosure, advisory/policy distinctions, CLI JSON schema, and non-steering command behavior.
- Token estimates remain within every supported budget; selected findings remain a monotonic candidate prefix. Truncation cannot conceal policy counts or incomplete coverage. Show bounded baseline and target coverage examples before optional regions.
- Escape control characters in user-derived text without introducing ANSI styling or extra startup dependencies.
- Documentation: replace the GitHub-rejected operator-name macro with upright roman CC/SLOC notation, retaining the equations and balanced display-math delimiters.

## Verification evidence

- `tests/snapshot.test.ts`: immutable Git/index/worktree comparisons, partial staging, unchanged dependency blobs, unborn HEAD, deletions/renames, unusual names, symlinks, untracked exclusions, caps, stat/blob reuse, alternate indexes, conflicts, and cancellation.
- `tests/metrics.test.ts`: syntax (not regex) decisions, nested callable accounting, exact token clones, union-of-lines verbosity, absolute erosion mass, parser/generated omissions, TSX and empty input.
- `tests/render.test.ts`: distinct glyph roles, explicit-policy labels, baseline/target coverage, escaped controls, exact token-budget conformance, monotonic finding prefixes, and visible counts under truncation.
- `tests/docs.test.ts`: the rejected GitHub macro stays absent, display-math delimiters stay balanced, the metric equations remain intact, and the checkpoint vocabulary is documented.
- `tests/engine.test.ts`: witnessed structural deltas, conserved multiscale exposure, regional redistribution, comment/anonymous identity stability, warm and single-file cache paths, persisted facts, configuration/baseline identities, incomplete baselines, accurate clone counts, budgets, concurrent analysis drift, and report immutability.
- `tests/background.test.ts`: no factory timers, debouncing, single in-flight scan, obsolete-work cancellation, non-preempting polls, shutdown cleanup, and bounded LRU retention.
- `tests/interfaces.test.ts`: exact public registrations, read-only staged tool execution, explicit non-steering command output, CLI advisory/policy exits, checkpoint suppression, hook opt-in/ownership/checksum protection, symlinks, and custom hooksPath.
- `scripts/smoke.ts`: copied bundles without node_modules, executable symlink, immutable staged review, an actual advisory Git commit, a blocked explicit-policy commit, and built extension registrations. All writes/commits occur in disposable fixtures.
- `tests/startup.test.ts`: neutral idle startup, opt-out, successful-result coalescing, busy-root fairness, explicit-checkpoint cancellation, and shutdown cleanup.
- `tests/workspaces.test.ts`: disjoint origin/target separation, 35-root rotation, peer/session filtering, compaction/reload, symlinks/worktrees, immutable indexes, local-only Git helpers, and cross-root report reuse.
- `scripts/verify-package.ts`: actual Pi resource loader, SDK session persistence, disjoint automatic selection, and lazy review from isolated production-only npm/Git layouts, with no compiler/substrate runtime install.
- `scripts/bench.ts`: executable work-count assertions and measured timing; see performance.md. Zero-change passes do not read/parse source, rebuild models, or recompute reviews/heat. Staging analyzed bytes reuses the model.
- Companion `pi-fovea/tests/substrate.test.ts`: versioned snapshot-only graph assembly, invalid-input rejection, multi-scale agreement and conserved/isolated mass. The Fovea suite also checks the underlying heat solver against its independent scaled-Taylor reference.

The v0.2.0 verification covers 60 Contour tests, typecheck/dead-code gates, and standalone smoke/install probes. Fovea v0.27.0 was separately verified with 250 tests and its typecheck/dead-code gates. A composed real-Pi loader probe also verified both extensions together: neutral startup, blocked access, disjoint/nested projects, peer handoff, literal shell hints, immutable indexes, and restored targets with zero unsolicited messages. The release is intentionally JS/TS-scoped; branch-base review, semantic near-clones, cross-language metrics, co-change scoring, and stronger physics-response hypotheses remain future work, not implied capabilities.