Close out the repository audit

docs/cli.md

@@ -176,7 +176,7 @@ complete prior bundle is a rollback artifact.
 | `--units VALUE` | `generate`, `run`, `compare` | Override `weather_api.units` for this command. |
 | `--tz NAME` | `generate`, `run`, `compare` | Override `weather_api.timezone` for this command. |
 | `--out PATH` | every `generate` command | Write the report to this complete file destination instead of the configured or current-directory default. |
-| `--llm-debug-dir PATH` | every `generate`, `run`, and `compare` command | Write requested sensitive prompt diagnostics under this absolute path. |
+| `--llm-debug-dir PATH` | every `generate`, `run`, and `compare` command | On Unix hosts, write requested sensitive prompt diagnostics under this absolute path. Other hosts fail closed when the flag is requested. |
 | `--profile PROFILE` | `compare` | Select one explicit profile. Repeat at least twice with distinct, nonblank IDs. |
 | `--out-dir PATH` | `run morning`, `run evening`, `compare` | Write batch reports beneath this directory, or select the exact comparison directory. |
 | `--replace` | `compare` | Authorize replacement of a recognized nonempty comparison bundle. |

docs/config.md

@@ -188,6 +188,8 @@ key is rejected with a migration error; it is not translated or ignored.
 
 Prompt debug capture has no YAML setting. Use `--llm-debug-dir PATH` on an
 individual `generate`, `run`, or `compare` command when explicitly needed.
+See [optional prompt debug capture](operations.md#optional-prompt-debug-capture)
+for platform availability, security, and retention requirements.
 
 | Field | Default | Rules |
 | --- | --- | --- |

docs/integrations/promptkit.md

@@ -33,7 +33,9 @@ When capture is enabled, its preparation artifact projects a provider endpoint
 to its scheme and host and retains only reviewed execution settings. Provider
 extras and URL user information, paths, queries, and fragments are omitted.
 Capture storage remains confined to the operator-selected debug root; an unsafe
-filesystem path causes the requested execution to fail.
+filesystem path causes the requested execution to fail. Host availability and
+operator handling are documented in the
+[operations guide](../operations.md#optional-prompt-debug-capture).
 
 ## Comparison Execution
 

docs/internal/comparison-execution.md

@@ -22,7 +22,9 @@ profile slug. This keeps concurrent captures separate. The debug writer itself
 owns secure-root validation and file permissions. It safely creates shared
 missing ancestors during concurrent writes, then rejects symlink and non-
 directory components. Operational retention and sensitivity are documented in
-the [operations guide](../operations.md).
+the [operations guide](../operations.md). This secure writer is enabled only on
+Unix hosts; comparison fails before execution when another host requests debug
+capture.
 
 The output result and its safe errors are converted into the durable contract
 only by comparison publication. See [comparison publication

docs/operations.md

@@ -166,6 +166,12 @@ remain distinct. Normal output, summaries, and routine logs omit that sensitive
 content. Debug capture is never created for an ordinary command without
 `--llm-debug-dir`.
 
+Secure prompt debug capture is currently available only on Unix hosts, where
+Weatherreporter can keep every traversal and write anchored to opened directory
+descriptors without following symbolic links. On other platforms, requesting
+`--llm-debug-dir` fails before prompt inspection, weather collection, or
+provider execution; ordinary commands without the flag remain available.
+
 Preparation captures retain only the provider endpoint origin and reviewed
 execution settings. URL user information, paths, queries, fragments, and
 unrecognized provider parameters are omitted.

docs/releases/v0.12.0.md

@@ -0,0 +1,66 @@
+# Weatherreporter v0.12.0
+
+This release completes a repository-wide correctness, security, efficiency,
+test-durability, and documentation audit.
+
+## Summary
+
+Weatherreporter now applies stricter validation and bounded diagnostics across
+its configuration, weather collection, Promptkit, rendering, publication,
+comparison, and Distributor boundaries. Report preparation and execution carry
+one reconciled identity, independent weather sources are collected
+concurrently, and cancellation preserves completed report and comparison
+outcomes.
+
+The release also removes obsolete compatibility surfaces and consolidates
+duplicated implementation and test policy without changing ordinary report
+commands or output identities.
+
+## Compatibility
+
+This release is compatible with `v0.11.0` for ordinary `generate`, `run`, and
+`compare` commands, configuration files, report filenames, comparison bundles,
+and Distributor integration.
+
+Sensitive prompt-debug capture through `--llm-debug-dir` is now supported only
+on Unix hosts. Non-Unix hosts reject an explicit capture request before prompt
+inspection, weather collection, or provider execution because the required
+handle-relative, no-follow filesystem guarantees are unavailable there.
+
+Several unused internal compatibility exports were removed. They were not part
+of the documented CLI, configuration, artifact, or integration contracts.
+
+## Upgrade
+
+No special action is required for ordinary installations. Operators who use
+`--llm-debug-dir` on Windows must run that diagnostic workflow on a Unix host.
+Review any automation that depended on undocumented internal Go APIs removed by
+this release.
+
+## Changes
+
+- Hardened configuration loading, source validation, secrets rollback,
+  endpoint validation, HTTP diagnostics, generated-text limits, prompt-debug
+  redaction, output publication, comparison replacement, and Distributor
+  failure reporting.
+- Reconciled inspected, prepared, callback, and completed Promptkit identity
+  and provenance before accepting generated content.
+- Preserved metric values, civil-day and daypart identity, overnight alerts,
+  precipitation semantics, and Markdown structure across deterministic report
+  preparation and rendering.
+- Collected independent Weather API sources concurrently and reused readiness
+  data while retaining deterministic normalized results.
+- Preserved completed report and comparison failures independently from shared
+  cancellation, stopped unfinished work, and skipped batch notification after
+  cancellation or partial report failure.
+- Made secure prompt-debug traversal descriptor-relative on Unix and fail
+  closed elsewhere. See the [operations
+  guide](../operations.md#optional-prompt-debug-capture).
+- Strengthened default test portability and determinism, including
+  capability-aware symbolic-link fixtures and platform-appropriate process
+  signal coverage.
+- Removed obsolete compatibility helpers, duplicated test ownership, dormant
+  persistence code, and completed audit and implementation roadmaps.
+- Updated the [architecture policy](../policy/architecture.md), [testing
+  policy](../policy/testing.md), and focused internal guides to describe the
+  implemented final state.