Thirteen agents audited runward. Verdict: not finished..

Before announcing a "finalized" version, we turned the audit on our own repository: nine readers in parallel, three refuters instructed to refute, 95 findings, each anchored to file:line. The question asked: is runward finished?

The answer is no. "The limit is reached": refuted. "Ready to announce": refuted. And the two worst findings did not live in the docs. They lived inside the evidence layer itself.

False green #1: the JUnit homonym

A test:report.xml::myTest pointer resolves against the committed report. The adapter stopped at the first occurrence of the name. Two suites, two homonymous cases, the first green, the second red:

<testcase name="t" classname="A"/>
<testcase name="t" classname="B"><failure/></testcase>

The pointer read "pass". A red test invisible behind a green homonym, in the tool that sells "a red test is not evidence". Fixed: every occurrence is scanned, a single red reddens the verdict, and Class::Name pins one case when the homonyms are legitimately different tests.

False green #2: the ignored depth

spec-check verified that an acceptance criterion points at a present file, and silently ignored the #Symbol and ::testName the author had written. A criterion linked to a vanished symbol or a red test read "linked". The machinery to verify already existed in the gate's evidence layer; it was not wired. It is now: the same checks, at the same depth, and a criterion passes only when every one of its pointers verifies.

What 0.35.0 ships

The whole verdict layer: check --attest (the verdict as an unsigned in-toto Statement v1, bound to the exact mission state), runward verify (offline re-derivation on the repo alone, with the version skew named so evolution is never mistaken for forgery), runward bundle (one provenance for an assessor), runward spec-check, the JUnit adapter, and the shared corpus pinned without a registry: update --corpus <path>, a path, never a coordinate, resolved from committed bytes with the network cut.

The detail is in the CHANGELOG, with the migration note: two false greens die on purpose, three rules gain a signature, and the note says who reddens and the one-line fix.

The humility line

The audit did not absolve the rest. The limit is not reached: the SARIF adapter our own code promises itself, the Windows proof of "same tree, same verdict", the opt-in signing are still ahead, dated in the ROADMAP. And the real ceiling is not code: nobody but us has yet run this gate on a repository we did not write. An internal audit, however adversarial, does not replace that.

← All news