# Reliora quality goal

> Historical journal: this captures the pre-Stage 2 quality pass. Current evidence and limitations are in [Stage 2 quality](stage-2-quality.md).

This journal tracks evidence for the goal that every MVP quality category reaches at least 90/100. Scores are not based on this document; the cited source files, tests, package artifact, and command output are the evidence.

## Iteration 1 — package and safety hardening

Date: 2026-07-10

### Scores before changes

| Category | Score | Main evidence and gaps |
|---|---:|---|
| Core functionality | 89 | Source-checkout CLI cycle worked, but one corrupted record blocked search and installed-package behavior was not proven. |
| Reliability | 76 | Build/tests passed; no clean tarball smoke test, no automatic prepack build, damaged data blocked the library. |
| Agent usability | 73 | Successful JSON existed; errors were plain text, unknown flags were ignored, search JSON omitted decision context. |
| Security | 68 | A basic regex detector existed; one credential case was tested, input had no size limits, and no threat model existed. |
| Documentation | 81 | Good product explanation; package demo instructions were not reproducible from the published file list and platform troubleshooting was missing. |
| Product differentiation | 85 | The structured model existed, but the demo retrieved the only record and did not prove project-specific selection over a generic note. |

### Gaps selected for this iteration

1. Build and test the actual npm tarball from a clean temporary project.
2. Include demo assets in the package and build automatically during `npm pack`.
3. Isolate corrupt experience records while returning explicit warnings.
4. Define a versioned JSON success/error contract and reject unknown CLI options.
5. Return enough search context for an agent to validate applicability.
6. Add input/field limits, semantic persisted-data validation, path-traversal tests, a credential matrix, and a threat model.
7. Make the demo prove project-specific selection against a credible generic migration note.

### Changes completed

- `package.json`: added `prepack`, packaged examples/demo, and added `test:package`.
- `scripts/package-smoke.mjs`: packs, installs, and exercises the installed tarball in a clean temporary project; verifies required files, the full CLI cycle, corrupt-record isolation, and the installed demo.
- `src/workspace.ts`: added bounded reads, atomic temp cleanup, runtime core validation, and warning-bearing tolerant library loading.
- `src/validation.ts`: added exact-field validation, UUID/ISO timestamp validation, and field/list limits.
- `src/security.ts`: added common GitHub, AWS, Google, npm, Slack, Stripe, bearer, JWT, database URL, assignment, private-key, and `.env` patterns.
- `src/cli.ts`: added command-specific help, `--version`, strict options/positionals, stdin/file limits, versioned JSON envelopes, structured JSON errors, complete search experiences, and explicit corrupt-record warnings.
- `examples/generic-database-note.json` and `scripts/demo.mjs`: added a strong generic competitor and proved that project context selects the specific PostgreSQL lesson.
- `test/reliora.test.ts`: expanded from 9 to 19 tests covering the new real behaviors and negative cases.
- `README.md`: synchronized CLI/package behavior, JSON contracts, architecture, threat model, limits, troubleshooting, platform notes, and honest limitations.

### Verification results

The following commands passed after `npm ci`:

| Command | Result |
|---|---|
| `npm.cmd ci` | 110 packages installed successfully |
| `npm.cmd run build` | Passed |
| `npm.cmd run typecheck` | Passed |
| `npm.cmd run lint` | Passed |
| `npm.cmd test` | 19/19 passed |
| `npm.cmd run demo` | Passed; generic and project-specific records both matched, project context selected the PostgreSQL lesson |
| `npm.cmd run test:package` | Passed; tarball installed and complete CLI cycle verified |
| `npm.cmd pack --dry-run` | Passed; automatic prepack build and package contents verified |
| `npm.cmd audit --audit-level=high` | Passed; 0 known vulnerabilities |

Key automated evidence is in `test/reliora.test.ts` and `scripts/package-smoke.mjs`. The demo evidence is executable rather than a README-only claim.

### Scores after changes

| Category | Score | Evidence |
|---|---:|---|
| Core functionality | 95 | Complete source and installed-package cycles, human/JSON modes, project context, feedback ranking, corrupt isolation, no main-path stubs. |
| Reliability | 93 | Clean install and all gates pass; real tarball smoke test, bounded/atomic storage, negative tests, predictable repeated init. |
| Agent usability | 93 | Non-interactive operations, output contract v1, JSON errors, stable exit codes, strict flags, full search context and warnings. |
| Security | 92 | Local-only runtime, no telemetry/runtime dependencies, bounded input, path-safe IDs, runtime validation, credential matrix, redacted errors, documented threat model. |
| Documentation | 94 | README commands match tested behavior; source/tarball demos, JSON/human modes, architecture, limitations, security, troubleshooting and OS notes are documented. |
| Product differentiation | 94 | Structured lessons, failure causality, applicability, verification, feedback, explained ranking, and executable generic-vs-project-specific reuse scenario. |

### Remaining risks

- Lexical search misses synonyms and typos; this is a documented MVP limitation, not a high-severity failure of the promised lexical behavior.
- Concurrent feedback writers can lose an update; documented and deferred until real multi-process demand exists.
- Secret detection remains best effort and may produce false positives/negatives; the threat model does not claim hostile-local-user protection.
- `--project-context` is a lexical filter, not a security boundary.
- The workspace's `.git` directory is empty/invalid. Application and npm artifact readiness are proven, but actual GitHub publication remains blocked until Git metadata is initialized or restored.

### Next step

Obtain explicit authorization to initialize or restore `.git`, then perform a final Git status audit. Do not change product scores based solely on that metadata operation.

## Iteration 2 — GitHub quality gate

Date: 2026-07-10

### Scores before changes

Core 95, Reliability 93, Agent usability 93, Security 92, Documentation 94, Product differentiation 94.

### Gap selected

The repository had no CI definition reproducing the documented release gates on the minimum supported Node.js version and both primary operating-system families.

### Change completed

Added `.github/workflows/quality.yml` with read-only repository permissions and a Windows/Linux matrix on Node.js 20. Each job runs clean install, build, typecheck, lint, unit/integration tests, demo, installed-package smoke test, package-content verification, and dependency audit.

### Verification

- The workflow was inspected for all required triggers, permissions, matrix entries, and ten ordered steps.
- A local YAML library was unavailable, so no claim is made that a third-party YAML parser validated it.
- Every workflow command was rerun locally on the available Node.js 24 runtime: build, typecheck, lint, 19 tests, demo, package smoke, pack dry-run, and audit all passed.
- `npm pack --dry-run` still contains 42 files and both examples; `npm audit --audit-level=high` still reports 0 vulnerabilities.

### Scores after changes

Scores remain Core 95, Reliability 93, Agent usability 93, Security 92, Documentation 94, Product differentiation 94. They are not increased merely because a workflow file exists. A remote CI run cannot occur until the directory is a valid Git repository and is pushed.

### Remaining blocker and next step

`.git` is still empty/invalid and `git status` fails. The environment rejected `git init` without explicit user authorization. The next evidence-producing action is to initialize Git, inspect the resulting status, and then let the workflow run after a human configures/pushes the remote.

## Iteration 3 — Git metadata recovery and completion audit

Date: 2026-07-10

### Authorization and change

The user explicitly authorized `git init` in `C:\DevTech\Reliora`. The repository was initialized with branch `main`. No commit, remote, or external publication was created.

### Git evidence

- `git branch --show-current` returns `main`.
- `git status --short` succeeds and lists the expected source tree as untracked in the new repository.
- `.reliora/`, `dist/`, and `node_modules/` are ignored.
- Git reports 23 trackable source/configuration files before this final journal update.

### Final verification from current state

| Command | Result |
|---|---|
| `npm.cmd ci` | Passed; 110 packages installed from lockfile |
| `npm.cmd run build` | Passed |
| `npm.cmd run typecheck` | Passed |
| `npm.cmd run lint` | Passed |
| `npm.cmd test` | Passed; 19/19 tests |
| `npm.cmd run demo` | Passed; both candidates matched and project context selected the specific PostgreSQL lesson |
| `npm.cmd run test:package` | Passed; installed tarball files and complete CLI cycle verified |
| `npm.cmd pack --dry-run` | Passed; prepack build ran and 42 files were included |
| `npm.cmd audit --audit-level=high` | Passed; 0 known vulnerabilities |

### Final scores

| Category | Score | Completion basis |
|---|---:|---|
| Core functionality | 95 | Both source and installed-package cycles prove init, record, contextual search, show, feedback, human/JSON output, ranking effects, and corrupt-record isolation. |
| Reliability | 93 | Lockfile clean install and every gate pass; package is built automatically, smoke-tested after installation, writes are bounded/atomic, damage is isolated, and negative behavior is tested. |
| Agent usability | 93 | All operations are non-interactive; output contract v1, structured errors, exit codes, strict arguments, complete decision context, limits, and warnings are verified. |
| Security | 92 | Runtime is local and dependency-free; no telemetry; input/path/schema controls, credential matrix, redacted errors, threat model, and zero-vulnerability audit are evidenced. |
| Documentation | 94 | README matches tested source/package behavior and documents contracts, architecture, demo, security, limits, troubleshooting, OS differences, and honest deferred scope. |
| Product differentiation | 94 | Executable model and demo prove failed attempts, causal solution, applicability, project context, checks, feedback, explained ranking, and selection over a credible generic note. |

### Completion conclusion

All six categories exceed 90/100. No critical or high-severity gap contradicts a score. All mandatory local and package gates pass. Reliora is ready for a GitHub alpha commit/push and an npm alpha publish subject only to normal human-owned release operations: choosing a remote, credentials, npm name availability, and explicit publish authorization.

Known MVP limitations remain lexical search, best-effort secret patterns, and lack of cross-process feedback locking. They are documented, bounded, and do not contradict the alpha promises or the category thresholds.