Verify the audit remediation changes

docs/cli.md

@@ -209,9 +209,9 @@ first and then run `deliver --assets DIR` with the token available. The ordinary
 `deliver` command does not download application dependencies or change the
 checkout.
 
-The command returns 0 for complete delivery, 1 for an unavailable preflight,
-a known delivery failure, conflict, partial delivery, or local cleanup failure
-after hosted completion, and 2 for usage,
+The command returns 0 for complete delivery without a local error, 1 for an
+unavailable preflight, a known delivery failure, conflict, partial delivery, or
+local cleanup failure after hosted completion, and 2 for usage,
 profile, forge-selection, local credential-loading, or classified preflight
 configuration/access errors. A remote write whose outcome remains uncertain
 returns 3, including when cancellation prevents reconciliation. Cancellation

docs/consumers/build.md

@@ -53,7 +53,9 @@ module. The default output directory is `<module>/dist`; a relative `OutputDir`
 is resolved from the module, while an absolute path is used as supplied.
 Selected artifact filenames are regenerated. Other files in the output
 directory are left in place. A failed later build or native version check
-returns the binaries already generated in `BuildResult.Artifacts`.
+returns completed, hashed binaries in `BuildResult.Artifacts`. If hashing a
+newly built file fails, the error identifies its path and earlier completed
+artifacts remain in the result.
 
 Builds use the available compatible Go toolchain selected locally; ReleaseKit
 does not download a different toolchain automatically. It disables workspace

docs/internal/overview.md

@@ -94,9 +94,9 @@ not a separate release matrix:
 | Capability | Implementation owner | Existing evidence |
 | --- | --- | --- |
 | Runtime version lookup and injected application version | `buildinfo`, `internal/runtimeinfo`, `internal/versioncontract`, `internal/build` | `TestVersionInConsumerExecutable`, `TestVersion` |
-| Candidate capture, shared validation, public diagnostics, additional checks, and rechecks | `releasekit.Check`, `releasekit.Publish`, `internal/candidate`, `internal/validation`, `cmd/releasekit/internal/cli` | `TestRunUsesOneSuiteWithSelectedRaceSetting`, `TestRunReportsRacePrerequisiteFailureWithoutFallback`, `TestRunExecutesRaceEnabledSuiteOnHost`, `TestRunCompilesTargetsAfterTestAndVetInSelectionOrder`, `TestRunAttributesTargetCompileFailureAndStops`, `TestRunCompilesSourceOnlyAndExecutablePackagesWithoutArtifacts`, `TestCandidateRequestMapsGoValidation`, `TestCandidateRequestPreservesMarkdownObjectSelection`, `TestLoadSettingsReadsGoValidation`, `TestLoadSettingsPreservesMarkdownObjectSelection`, `TestCheckUsesSelectedRaceSuiteBeforeAdditionalChecks`, `TestCheckCapturesCandidateAndCallsAdditionalChecksOnce`, `TestCheckReturnsPublicValidationError`, `TestMarkdownValidationRunsThroughCheckAndPublish`, `TestCheckStopsBeforeProductAndBuildCallbacksWhenMarkdownBoundaryFails`, `TestCheckCommandBindsConfiguredChecksToCapturedCandidate`, `TestPublishCommandPublishesConfiguredCandidate`, `TestCandidateCommandsPresentValidationDiagnosticsOnce`, `TestDeliverPageOnlyCreatesAndReusesRelease` |
+| Candidate capture, shared validation, public diagnostics, additional checks, and rechecks | `releasekit.Check`, `releasekit.Publish`, `internal/candidate`, `internal/validation`, `cmd/releasekit/internal/cli` | `TestRunUsesOneSuiteWithGoValidationSettings`, `TestRunReportsRacePrerequisiteFailureWithoutFallback`, `TestRunExecutesRaceEnabledSuiteOnHost`, `TestRunCompilesTargetsAfterTestAndVetInSelectionOrder`, `TestRunAttributesTargetCompileFailureAndStops`, `TestRunCompilesSourceOnlyAndExecutablePackagesWithoutArtifacts`, `TestCandidateRequestMapsGoValidation`, `TestCandidateRequestPreservesMarkdownObjectSelection`, `TestLoadSettingsReadsGoValidation`, `TestLoadSettingsPreservesMarkdownObjectSelection`, `TestCheckUsesSelectedRaceSuiteBeforeAdditionalChecks`, `TestCheckCapturesCandidateAndCallsAdditionalChecksOnce`, `TestCheckReturnsPublicValidationError`, `TestMarkdownValidationRunsThroughCheckAndPublish`, `TestCheckStopsBeforeProductAndBuildCallbacksWhenMarkdownBoundaryFails`, `TestCheckCommandBindsConfiguredChecksToCapturedCandidate`, `TestPublishCommandPublishesConfiguredCandidate`, `TestCandidateCommandsPresentValidationDiagnosticsOnce`, `TestDeliverPageOnlyCreatesAndReusesRelease` |
 | Committed-file validation: formatting, workspace files, local replacements, and file size | `internal/validation`, `internal/candidate`, `releasekit.Check`, `releasekit.Publish`, CLI profile conversion | `TestCheckGoFormatUsesCapturedRegularGoBlobs`, `TestCheckWorkspaceFilesReportsCommittedBlobNames`, `TestCheckLocalReplacementsParsesCommittedModuleDeclarations`, `TestCheckLocalReplacementsFollowsCommittedModuleSymlinks`, `TestCheckFileSizeUsesStrictLimitsAndDefault`, `TestCheckFileSizeAppliesLiteralPathExclusions`, `TestCheckFileSizeUsesCommittedBlobSizes`, `TestCheckFileSizeUsesOnlyCandidateFilesIndividually` |
-| Internal Markdown parsing, committed destinations, fragments, boundary observations, and public selection | `releasekit.Check`, `releasekit.Publish`, `internal/candidate`, `internal/validation`, `cmd/releasekit/internal/cli` | `TestParseMarkdownLinksAndSourceLocations`, `TestParseMarkdownDecodesEntitiesInDestinations`, `TestParseMarkdownHeadingAnchors`, `TestMarkdownCacheKeepsParsedDocumentsPerCandidatePath`, `TestCheckMarkdownLinksResolvesCommittedDestinationsAndFragments`, `TestCheckMarkdownLinksReportsMissingPathsAnchorsAndCycles`, `TestCheckMarkdownLinksUsesResolvedMarkdownIdentity`, `TestCheckMarkdownLinksReportsBoundaryAndSubmoduleObservations`, `TestCheckMarkdownLinksPreservesResolverCauseAndCancellation`, `TestCheckMarkdownLinksPreservesAnchorReadCause`, `TestRunSelectsMarkdownWithCombinedGoChecksAndReportsOutOfScopeLinks`, `TestMarkdownValidationRunsThroughCheckAndPublish`, `TestLoadSettingsPreservesMarkdownObjectSelection`, `TestValidationSpecPreservesMarkdownObjectSelection` |
+| Internal Markdown parsing, committed destinations, fragments, boundary observations, and public selection | `releasekit.Check`, `releasekit.Publish`, `internal/candidate`, `internal/validation`, `cmd/releasekit/internal/cli` | `TestParseMarkdownLinksAndSourceLocations`, `TestParseMarkdownDecodesEntitiesInDestinations`, `TestParseMarkdownHeadingAnchors`, `TestMarkdownDocumentsParseIdenticalAndDistinctBlobs`, `TestCheckMarkdownLinksResolvesCommittedDestinationsAndFragments`, `TestCheckMarkdownLinksReportsMissingPathsAnchorsAndCycles`, `TestCheckMarkdownLinksUsesResolvedMarkdownIdentity`, `TestCheckMarkdownLinksReportsBoundaryAndSubmoduleObservations`, `TestCheckMarkdownLinksPreservesResolverCauseAndCancellation`, `TestCheckMarkdownLinksPreservesAnchorReadCause`, `TestRunSelectsMarkdownWithCombinedGoChecksAndReportsOutOfScopeLinks`, `TestMarkdownValidationRunsThroughCheckAndPublish`, `TestLoadSettingsPreservesMarkdownObjectSelection`, `TestValidationSpecPreservesMarkdownObjectSelection` |
 | Shared Go settings for validation and builds | `internal/gotool`, `internal/process`, `internal/candidate`, `internal/build` | `TestDefaultValidationDoesNotInheritGOFLAGSRunFilter`, `TestNativeAndStaticCommandsUseOwnedBaseline`, `TestPersistentSettingsPreserveCachesAndNativeCTools`, `TestOwnerReusesSettingsUntilInheritedEnvironmentChanges`, `TestOwnerRefreshesWhenPersistentSettingsChange`, `TestCheckSharesGoDiscoveryWithAfterValidateCallback`, `TestCheckBuildsAfterValidationAndKeepsOutputOutsideWorktree`, `TestRunValidatesOnlyTheSelectedModule`, `TestBuildIgnoresAmbientAndPersistentArchitectureTuning` |
 | Batched local Git blob reads | `internal/git`, `internal/process` | `TestBlobReaderReadsLooseAndPackedObjects`, `TestBlobReaderMissingObjectKeepsBatchSessionUsable`, `TestCandidateObjectReadsStayLocalInPartialClones` |
 | Piped child-process exchanges and cancellation cleanup | `internal/process` | `TestStartPipedExchangesBeforeInputEOFAndPreservesSettings`, `TestStartPipedCancellationAfterReadinessReapsChild`, `TestStartPipedPreservesNonzeroExit` |

docs/internal/validation.md

@@ -19,11 +19,12 @@ artifact or executing a target binary. Test, vet, and package-compilation
 failures retain their `go-test`, `go-vet`, and `package-compile` identities,
 selected target where applicable, and underlying causes. Its
 request carries the captured repository directory and commit, output writer,
-and internal settings. When selected, the Go-format check loads the candidate
-tree once, reads regular Go blobs from the captured commit, and compares them
-with go/format output. It uses the selected inputs, including vendor and explicit
-shared files, and skips
-symlink blobs, reports all unformatted paths, and stops with a contextual cause
+and internal settings. The Go commands run before the committed-tree sequence,
+which owns its reader's lifetime and close-error attribution. When selected,
+the Go-format check loads the candidate tree once, reads regular Go blobs from
+the captured commit, and compares them with go/format output. It uses the
+selected inputs, including vendor and explicit shared files, skips symlink
+blobs, reports all unformatted paths, and stops with a contextual cause
 on parse or inspection errors. It runs before product checks and build callbacks.
 `Request.ReadCandidateTree` lets selected file checks request candidate
 contents; the Go-only path does not enumerate the tree.
@@ -109,9 +110,11 @@ observations remain out of scope under either setting. Observations go to the
 provided writer; a nil writer keeps library use quiet. Public selection is
 defined in the [configuration reference](../config.md) and GoDoc.
 
-Committed-tree metadata and blob reads disable lazy fetching and Git transports
-for those child commands. Missing local objects produce inspection errors;
-source preparation retains its separate network-capable operations. See Git's
+ReleaseKit-owned Git commands inspect original objects even when replacement
+refs exist. Committed-tree metadata and blob reads also disable lazy fetching
+and Git transports for those child commands. Missing local objects produce
+inspection errors; source preparation retains its separate network-capable
+operations. See Git's
 [lazy-fetch controls](https://git-scm.com/docs/git) for the command mechanism.
 Candidate and delivery release-note reads use the same local object boundary.
 

docs/roadmap/audit/08-testing.md

@@ -79,7 +79,8 @@ already checks that identical content resolves relative to each source path.
 Consider removing the pointer-identity assertions or the cache-specific test
 after retaining any unique parsing checks at the behavior boundary.
 
-[TestDeliverReadsLocalBinaryOnceForVerificationAndOnceForUpload](../../../delivery_reads_linux_test.go)
+`TestDeliverReadsLocalBinaryOnceForVerificationAndOnceForUpload` in
+`delivery_reads_linux_test.go` at audit baseline `3d7a691`
 requires exactly two filesystem opens using Linux inotify. Verification before
 hosted writes and correct uploaded bytes matter; the exact number of opens is
 an implementation choice, and a harmless extra metadata open or a different

docs/roadmap/implementation.md

@@ -54,7 +54,7 @@ the agent policy; an intermediate compilation dependency is recorded accurately.
 | 16 | A15 | Complete — the full CLI command suite passed after workflow extraction. |
 | 17 | Remaining A19, A20 | Complete — Git, identity, and Markdown tests passed; delivery benchmark ran for fresh uploads and matching retries. |
 | 18 | A11, A17: assessment only | Assessment complete; production JSON limits and exclusion indexing remain deferred. Evidence follows below. |
-| 19 | Integrated verification and current documentation | Pending |
+| 19 | Integrated verification and current documentation | Complete — full offline tests, race tests, API/dependency checks, formatting, and documentation link checks passed. |
 
 ## Stage 1: Correct the owned tag push
 
@@ -622,3 +622,27 @@ Completion means the selected repairs and maintenance are implemented, their
 behavioral evidence passes, current contracts are documented, and the two
 accepted deferrals have assessment records. Intermediate stages introduce no
 extra compilation, review, or deployment gates.
+
+### Integrated verification
+
+Reviewed the combined A01–A20 outcomes and their cross-package interactions.
+The selected repairs and maintenance are implemented; A11 JSON caps and A17
+production exclusion indexing remain deferred with the assessment evidence above.
+The public facade shape and receipt schema remain unchanged. Current consumer,
+CLI, integration, internal, and Go documentation reflects the selected
+contracts and the source audit reports remain available.
+
+On Linux/amd64 with Go 1.26.8, the following root commands passed with
+`GOTOOLCHAIN=local GOPROXY=off GOSUMDB=off` and a temporary build
+cache. The test commands used `/var/tmp` for fixtures because the restricted
+environment's `/tmp/.git` marker interfered with standalone Git discovery:
+
+- `go test ./...`
+- `go test -race ./...`
+- `go run ./internal/apicheck`
+
+All tracked Go files passed `gofmt` inspection. Local links and Markdown
+fragments across 50 documentation files resolved; the policy's literal
+`COMMIT_URL` template placeholder was intentionally excluded. Markdown and
+combined changes passed `git diff --check`, and the internal guide's referenced
+tests were checked against current test declarations.