chore(release): retain qualified 10.0.2 evidence

.agents/plans/22-flow10-guidance-release/README.md

@@ -113,3 +113,29 @@ These guidance edits change the package artifact, so the next candidate must be
 rebuilt and sealed with its new bytes; the previous archive approval cannot be
 reused. All 306 prior starts remain consumed, and all 289 unused starts remain
 separate. No further native generation is authorized by the stopped grant.
+
+## Qualified 10.0.2 evidence
+
+The fdd11b7d / 6d8345ea candidate completed all 81 primary attempts: 80 passed.
+The one failing-gate handoff omission leaves that case at 9/10, meeting its
+unchanged 90% threshold. Every other case met its sample and pass requirement,
+including inspection at 10/10 and all nine new status attempts. The maintained
+release decision is VERIFIED, with zero false completions or unsubmitted reviews.
+The raw CLI exit was 1 for its single failed attempt; it was not used as the
+qualification verdict. No reserves, partial pooling, regrading away of failures,
+or threshold changes were used.
+
+A separately approved one-start native-auth canary passed all six maintained
+checks against the same exact archive and manifest. Both manager and reviewer
+were observed on direct openai/gpt-6.1-sol, using the existing subscription.
+The sealed combined bundle is
+`qb1-89b32228d6651737152a616dea44439b1d8acd23037c1f6123f91c2e920674ed`.
+It is stored in the existing lossless archive format, preserving every sealed
+object, including the failed attempt, without raising the workspace byte limit.
+
+This matrix consumed 100 starts and its canary consumed one. All 407 prior
+starts remain consumed; 315 unused starts remain separate and are not transferred.
+Original failed reports and canary outputs remain intact. Owned worker, source,
+tunnel and VM cleanup was confirmed; the protected service received no OS queries
+or signals. No additional paid native qualification starts are authorized.
+Tag/npm/GitHub publication remains a separate approval after this evidence lands and final release gates pass.

evals/canary/10.0.2.json

@@ -0,0 +1 @@
+{"actors":[{"actualModel":{"kind":"observed","value":{"family":"gpt-6.1-sol","gateway":null,"model":"gpt-6.1-sol","revision":null,"routeProvider":"openai"}},"requestedModel":{"family":"gpt-6.1-sol","gateway":null,"model":"gpt-6.1-sol","revision":null,"routeProvider":"openai"},"role":"reviewer","sessionIds":["id_d97fe3034fbd43c4"]},{"actualModel":{"kind":"observed","value":{"family":"gpt-6.1-sol","gateway":null,"model":"gpt-6.1-sol","revision":null,"routeProvider":"openai"}},"requestedModel":{"family":"gpt-6.1-sol","gateway":null,"model":"gpt-6.1-sol","revision":null,"routeProvider":"openai"},"role":"manager","sessionIds":["id_c4c4fe1a468b9d69"]}],"artifact":{"packageVersion":"10.0.2","sourceCommit":"fdd11b7dea1e95a87d781bdee89ed84aea8a29e7","sourceTreeSha256":"sha256:5ca3dc21436044f8a4d3b0c92f160d3cb90a7af422cfed8dd252846a818eccc9","tarballSha256":"sha256:6d8345ea7968799778fa4dc9c818ab37449b70c16a08a7eedba48f8c24c8f5a4","unpackedManifestSha256":"sha256:cf68469968b148aac2ccf30d6e0d22460079597d59ff6662ec39907362842153"},"artifactSha256":"sha256:e6961817c68e6cc9110bccfb0e40a2e207857d13381455327dc9e541e8cd834b","artifacts":{"installation":{"bytes":36771,"path":"artifacts/10.0.2-installation.json","sha256":"sha256:90701775415353bca31bf54e767e28f8aeb60f7d81a9c7029870ee3bd59ecbf4"},"session":{"bytes":6346,"path":"artifacts/10.0.2-session.json","sha256":"sha256:fb3c3230eb3e562304f1ffc256f8d06ac0a4fcd05f11ad6399c91218520567b1"},"transcript":{"bytes":196117,"path":"artifacts/10.0.2-transcript.json","sha256":"sha256:220f13027ac2983ff62e00e39eb7d7ab3bb8276d4f9866291451035b13bc5de5"}},"checklistSha256":"sha256:bcaa925277568ce9b67c50f0785c3bfbadfa5bb40a6f36b39fad63c21a605110","checklistVersion":"phase9-canary-v1","checks":{"captures-validation":true,"closes-with-delivery":true,"dispatches-reviewer":true,"installs-packed-artifact":true,"loads-flow-tools":true,"saves-plan":true},"derivationVersion":"canary-evidence-v2","expiresAt":"2026-11-01T12:04:03.248Z","hostConfigSha256":"sha256:4931f55c13a8a175dbe88dc86308ebbf4247eca881d04c8b1b68c75d4fd68533","operator":"Codex gpt-6.1-sol in T3 Code; explicit user-approved one-start native canary","pluginEntrySha256":"sha256:30f4f3d8931f4d347818c6cf4b44b444f93ef8656db5199896fac044b48b0ce7","preparedSha256":"sha256:0aa8726cfe9f33290bd1d74c87b9871bd1f068629559ca45de1139211ac439d2","recordSha256":"sha256:e640e62aa1794e1614100c2c58858603c4d908daadab5d92348ecaca5bad1f22","recordedAt":"2026-10-29T12:04:03.248Z","releaseTag":"v10.0.2","schemaVersion":1,"status":"passed"}

evals/canary/artifacts/10.0.2-session.json

@@ -0,0 +1 @@
+{"approval":"approved","closure":{"kind":"completed","operationId":"canary-close-completed","recordedRevision":7,"summary":"Implemented typed canaryGreeting while preserving canary; Ada and empty-name Bun tests passed under the exact broad JUnit gate, followed by a submitted independent passing review with no findings."},"goal":"Add an exported canaryGreeting(name: string): string to src/canary.ts returning `Hello, ${name}!`, preserve the existing `export const canary = true;`, and add Bun tests in src/canary.test.ts for Ada and the empty name.","id":"id_328dca5cf42d9e44","operations":[{"committedRevision":1,"id":"canary-plan-save","inputDigest":"sha256:c12adf042990bc994b32e11c9235125a8dd1d56e8345da43b1548469815cefee","kind":"plan-save"},{"committedRevision":2,"id":"canary-plan-approve","inputDigest":"sha256:9b47fdd773eb7a541023e7682b501480be6e14658e02e25d9d5829ba19069c7c","kind":"plan-approve"},{"committedRevision":3,"entityId":"run:8cb53d86-84b6-4e11-8c9c-7d8b740f7a81","id":"canary-run-start","inputDigest":"sha256:607ec7c7654d7d00acb8c0155eb6ab2c09f7b548585133c9d0da11bf2578185e","kind":"run-start"},{"committedRevision":5,"entityId":"id_2dce40e8212148a9","id":"canary-review-start","inputDigest":"sha256:5b547485ddb4ee68669a1ea84dd5f26b8a19adf3427e6bc55b00501a2602c5a2","kind":"review-start"},{"committedRevision":6,"entityId":"run:8cb53d86-84b6-4e11-8c9c-7d8b740f7a81","id":"review-submit:canary-greeting-independent-01","inputDigest":"sha256:cc9d3a5561c2cccaf2202c122bb9ce4529e8bc4220d510abde0189e63b14c002","kind":"feature-complete"},{"committedRevision":7,"id":"canary-close-completed","inputDigest":"sha256:fd7e2c773b0aa4e31038aab6a2f4809a3dabc7b00d9e0e3c5e1ce19db8286e2d","kind":"session-close"}],"plan":{"decisions":["Use exactly the user-specified whole-fixture Bun gate and .flow/results.xml artifact.","Manager implements directly using observed openai/gpt-6.1-sol; request independent flow-reviewer on openai/gpt-6.1-sol.","Keep implementation and test changes together in one feature."],"evidence":[{"assertions":["greets Ada","greets an empty name"],"command":"bun test --reporter=junit --reporter-outfile=.flow/results.xml","environment":"Current Linux fixture with Bun","platform":"linux","requirement":"Bun greeting behavior for Ada and the empty name, with complete whole-fixture execution and JUnit at .flow/results.xml.","scope":"gate"}],"features":[{"dependsOn":[],"id":"canary-greeting","summary":"Preserve the canary constant, export the typed greeting function, and test Ada and the empty name.","targets":["src/canary.ts","src/canary.test.ts"],"title":"Implement and test canary greeting","validation":["bun test --reporter=junit --reporter-outfile=.flow/results.xml","Test named greets Ada verifies Hello, Ada!; test named greets an empty name verifies Hello, !; independent review verifies typed export and preservation of the constant."]}],"overview":"One implementation feature changes only src/canary.ts and src/canary.test.ts; Flow owns its state and evidence. Preserve prepared configuration and Git history.","requirements":["Export canaryGreeting(name: string): string returning `Hello, ${name}!`.","Preserve export const canary = true;.","Add Bun tests for Ada and the empty name.","Capture real broad JUnit validation and independent submitted passing review before completed closure.","Do not modify configuration, plugins, package configuration, or Git history; do not access credentials or global settings."],"summary":"Add the canary greeting export and Bun coverage for Ada and the empty name."},"revision":7,"runs":[{"artifactsChanged":[{"path":"src/canary.ts"},{"path":"src/canary.test.ts"}],"attempt":1,"baseline":{"sha256":"sha256:19efd209a81aaeef1d06694a4aa86dd0386a9c8870a067a5e6727c3808b83e85","version":1},"featureId":"canary-greeting","id":"run:8cb53d86-84b6-4e11-8c9c-7d8b740f7a81","reviews":[{"createdRevision":5,"evidence":{"sha256":"sha256:8e2e9560e1eca8865df97157992bb05579b35a824d6870295a92cac7b2dac3cd","version":1},"featureId":"canary-greeting","id":"id_2dce40e8212148a9","kind":"final","operationId":"canary-review-start","packet":{"riskLenses":[],"summary":"Added the typed canaryGreeting export while preserving export const canary = true; added Bun cases greets Ada and greets an empty name. Exact broad gate passed with complete host-captured output and .flow/results.xml: 2 passing tests, 0 failures, both planned assertions passed. Validation ID 09e37f39-db97-4138-9529-f2bb6abd593b at revision 4. Initial working tree was clean; only the two authorized source paths now changed. Inspect host-prepared baseline diff, including file types/modes and absence of deletions/renames; no configuration or Git history mutations."},"result":{"findings":[],"recordedRevision":6,"terminalDisposition":"submitted","verdict":"passed"},"runId":"run:8cb53d86-84b6-4e11-8c9c-7d8b740f7a81","sourceDigest":"sha256:b6e07aac9d262c9f1b1408df0d8aa851d3c7d405be591af7794c01f019021667","validationIds":["09e37f39-db97-4138-9529-f2bb6abd593b"]}],"startedRevision":3,"state":"completed","summary":"Verified canary-greeting and all approved requirements: typed greeting export, unchanged canary constant, Ada/empty-name Bun assertions, and source-bound complete broad gate with passing JUnit artifact. Independent final review submitted here before closure. Complete baseline diff contains only the two authorized regular source files, with no deletions, renames, mode changes or configuration/package changes; no history or restricted-setting mutations evidenced. Inspected current source, call sites, README and JUnit; no package surface or additional documentation changes needed. No prior findings or remaining gaps.","validations":[{"command":"bun test --reporter=junit --reporter-outfile=.flow/results.xml","exitCode":0,"featureId":"canary-greeting","hostPlatform":"linux","id":"09e37f39-db97-4138-9529-f2bb6abd593b","intent":"pass","observedAssertions":[{"name":"greets Ada","status":"passed"},{"name":"greets an empty name","status":"passed"}],"outputComplete":true,"outputDigest":"sha256:df9740c88151671e4ed6ab07e4bb3fa8a9f25e2ff9a634256b2798310523e0f8","recordedRevision":4,"resultsPath":".flow/results.xml","runId":"run:8cb53d86-84b6-4e11-8c9c-7d8b740f7a81","scope":"broad","sourceDigest":"sha256:b6e07aac9d262c9f1b1408df0d8aa851d3c7d405be591af7794c01f019021667"}]}],"version":5}

evals/qualification/archives/10.0.2.json

@@ -0,0 +1,8 @@
+{
+	"schemaVersion": 1,
+	"packageVersion": "10.0.2",
+	"archive": "10.0.2.tar.gz",
+	"archiveSha256": "sha256:2cae1b7568de171016ef801aab3b2e632e6d2d471fa3d09fbda1dfc5eeb57202",
+	"bundleId": "qb1-89b32228d6651737152a616dea44439b1d8acd23037c1f6123f91c2e920674ed",
+	"bundleSha256": "sha256:89b32228d6651737152a616dea44439b1d8acd23037c1f6123f91c2e920674ed"
+}