Record audit remediation verification

docs/roadmap/audit-remediation.md

@@ -1,15 +1,15 @@
 # Audit remediation roadmap
 
-Status: target and decisions finalized; the [implementation plan](implementation.md)
-defines the sprint. No remediation is implemented by these documents.
+Status: source remediation complete; the [implementation plan](implementation.md)
+records the sprint and verification. Release and dependency alignment remain
+separate work in [future work](future.md#pending-release-and-integration-work).
 
 Baseline: `d131999c7c474010a4814bb81601cd32920e6c83`. The
-[catalog](audit/catalog.md) contains 27 distinct open findings, five P2 and 22 P3,
+[catalog](audit/catalog.md) records 27 distinct findings, five P2 and 22 P3,
 from seven audits. Its accepted decisions and the
 [remediation analysis](audit/remediation-analysis.md) supply the scope and
-rationale for this roadmap. The implementation is unchanged since the audited
-state `db732e3a1de55c844f77870e1c6db683c2685d5d`; subsequent commits recorded
-the review and decisions.
+rationale for this roadmap. The audited state was
+`db732e3a1de55c844f77870e1c6db683c2685d5d`.
 
 This roadmap owns the target, scope, and completion criteria. The implementation
 plan owns ordered stages, dependencies, concrete changes, and verification steps.
@@ -251,22 +251,22 @@ removes migration work, not the need for coherent module requirements.
 
 ## Completion criteria
 
-- [ ] Every finding F01–F27 has its selected remediation implemented and recorded
+- [x] Every finding F01–F27 has its selected remediation implemented and recorded
   with relevant evidence; related findings remain individually accountable.
-- [ ] The five P2 defects have focused behavioral protection, including error
+- [x] The five P2 defects have focused behavioral protection, including error
   identity, retained evidence, and the deferred acceptance boundary.
-- [ ] F06 and F08's maintained consumers work, with actual completion checks
+- [x] F06 and F08's maintained consumers work, with actual completion checks
   distinguished from unavailable or skipped shell checks.
-- [ ] F11 and F21's selected API changes and F09/F10's clarified contracts are
+- [x] F11 and F21's selected API changes and F09/F10's clarified contracts are
   reflected in canonical GoDoc and affected integration guidance.
-- [ ] Obsolete production wrappers/plumbing and duplicate adaptation/bookkeeping
+- [x] Obsolete production wrappers/plumbing and duplicate adaptation/bookkeeping
   are removed at the agreed boundaries, with useful tests retained.
-- [ ] F13–F15 and F22 remove the identified repeated work while preserving
+- [x] F13–F15 and F22 remove the identified repeated work while preserving
   behavior, without a new performance guarantee or measurement prerequisite.
-- [ ] F17–F20 improve responsibility separation within their bounded scope;
+- [x] F17–F20 improve responsibility separation within their bounded scope;
   public behavior and necessary ordering remain protected.
-- [ ] Documentation corrections F25–F27 are complete and local links resolve.
-- [ ] Relevant module and aligned-workspace results are recorded. Independent
+- [x] Documentation corrections F25–F27 are complete and local links resolve.
+- [x] Relevant module and aligned-workspace results are recorded. Independent
   results identify the exact dependency selection; any release-alignment work
   still pending is explicitly distinguished from completed source work.
 

docs/roadmap/future.md

@@ -5,7 +5,7 @@ No delivery dates are selected here.
 
 ## Purpose and authority
 
-Completed roadmaps, implementation plans, and review findings have been retired.
+Earlier completed roadmaps, implementation plans, and review findings have been retired.
 This document preserves unfinished work and unselected ideas under the
 [release policy](../policy/release.md#release-documentation-and-preparation).
 The completed PromptKit v0.18.0 adoption roadmap and implementation plan remain
@@ -26,11 +26,20 @@ an idea here does not select its syntax, API, priority, or delivery date.
 
 ## Pending release and integration work
 
+### Audit remediation release alignment
+
+The audit remediation is complete in source. The released ckconfig v0.4.0 does
+not include `AdaptDiagnostics`, which current ckprompt source uses. Select and
+publish appropriate releases in dependency order, align module requirements and
+checksums, and rerun independent module suites under the
+[release procedure](../release.md). No publication is implied by source completion.
+
 ### ckprompt release
 
 The PromptKit v0.20.0 adoption is complete. The
 [ckprompt v0.3.0 candidate](../../integrations/ckprompt/docs/releases/v0.3.0.md)
-remains unpublished. Publication and hosted delivery remain separate operations
+remains unpublished and needs revalidation against the current source and aligned
+dependencies. Publication and hosted delivery remain separate operations
 under the [release procedure](../release.md).
 The published ckprompt v0.2.0 retains its earlier dependencies; see the
 [consumer guide](../consumers/guide.md#module-selection) for module selection.

docs/roadmap/implementation.md

@@ -1,6 +1,7 @@
 # Audit remediation implementation plan
 
-Status: in progress; Stages 1–22 complete.
+Status: source sprint complete; Stages 1–23 complete. Release and dependency
+alignment remain separate work.
 
 Baseline: `d492c7747175c01a53261206c2b4356e53453621`. Before this sprint,
 intervening changes recorded decisions and retired the completed older
@@ -713,6 +714,27 @@ Complete when present guidance and useful historical navigation have clear owner
 
 ## Stage 23 — Verify the assembled sprint and record completion
 
+**Complete.** The full aligned workspace suite passed with Go 1.27.0 using
+`GOTOOLCHAIN=local GOPROXY=off go test -mod=readonly ./... ./integrations/ckconfig/... ./integrations/ckprompt/...`.
+Focused reporter tests passed with `-race -count=1`. Independent `GOWORK=off`
+root and ckconfig suites passed; root selects Cobra v1.10.1, pflag v1.0.9 and
+YAML v4.0.0-rc.6, and ckconfig selects core v0.4.0 and ConfigKit v1.1.0.
+Independent ckprompt selects ckconfig v0.4.0, core v0.4.0, ConfigKit v1.1.0
+and PromptKit v0.20.0; its suite fails to compile because released ckconfig lacks
+`AdaptDiagnostics`. This is pending release alignment, not a passed independent
+check. No manifests, checksums, workspace files, or Go requirements were changed.
+
+Core's default reporting example, ckconfig ordinary show and two-sided diff,
+composed all-scope show, prepared preview and local fixture-backed aggregate smoke
+completed. Bash interactive backend and consumer checks passed; full opt-in runs
+reported missing Zsh and Fish executables, so those interactive checks are
+unavailable. The five P2 regressions reproduced their original defects before the
+fixes. All 27 catalog findings have completion evidence, including both F02
+boundaries, F14/F15 traversal costs, F21 callers and F24 wrappers. Go formatting,
+changed Markdown local links and fragments, the tagged historical fragment, and
+tracked and staged Markdown whitespace checks passed. Source completion does not
+publish any module; pending release alignment is recorded in future work.
+
 Findings: all F01–F27; no new feature work.
 
 1. Review the full diff against this baseline and all roadmap completion criteria.