release: PPGP v0.1.3 hardening candidate

[Fatboy-coder]

Summary

Hardening candidate for PPGP v0.1.3. Protocol semantics are unchanged from v0.1.2. This PR brings the CLI, documentation, tests and the public repository surface up to the model the 2026-09-23 adversarial validation found sound, and reconciles the repository's competing truths found in owner review.

Source version in this tree: 0.1.3. Latest published release: v0.1.2 on GitHub Releases and npm. The tree never records publication state: CHANGELOG.md uses a bare ## 0.1.3 heading and CITATION.cff has no date-released, so the immutable v0.1.3 tag stays correct after publication and main stays correct if a publish step fails. Publication state and date are canonical on GitHub Releases and npm only.

CLI (bin/ppgp.js)

• Tolerant ACTIVE_GOAL parser: fields recognized as Markdown headers at any level, bold-only lines or upper-case KEY: lines, case-insensitive, small alias set; unrecognized sections retained and listed; first duplicate wins with a warning.
• Strict conformance, unchanged from v0.1.2: all thirteen SPEC §3.4 fields = conformant (exit 0); PPGP state recognized but fields missing = partial (exit 2, each missing field named); no usable structure = malformed (exit 1); no file = missing (exit 1). Tolerant reading does not weaken the protocol.
• Diagnostics: missing fields, non-lifecycle PHASE, CLOSED inside an existing ACTIVE_GOAL, CLOSED with non-empty REMAINING, leftover scaffold placeholders; doctor surfaces the same.
• Root resolution: --root, else Git top-level of the cwd, else cwd. Git remains optional.
• doctor prints branch / HEAD / working-tree change count and, when no ACTIVE_GOAL is checked out, lists other refs that carry one. Read-only; never switches or merges.
• goal --force preserves the previous file as a timestamped .bak.

Source version vs published release

• README, docs/DISTRIBUTION.md, SPEC.md, ROADMAP.md state the source version and link to GitHub Releases / npm for what is actually published. No document names ppgp-v0.1.3.zip or @fatboy-coder/ppgp@0.1.3.
• CITATION.cff keeps version: "0.1.3" and never carries date-released.
• CHANGELOG.md heads the entry ## 0.1.3 (bare); the version-consistency test enforces: source artifacts agree on the package.json version; the changelog heading is bare; no date-released; no active document hard-codes a release asset or pinned package version.

Repository surface

• Root reduced to README, SPEC, CONTRIBUTING, CHANGELOG, ROADMAP, LICENSE, CITATION.cff, package.json and format-mandated machine manifests. COMPATIBILITY.md, DISTRIBUTION.md, EVALUATION.md → docs/; BENCHMARK_PROTOCOL.md → benchmarks/PROTOCOL.md; ADVERSARIAL_VALIDATION.md → research/2026-09-23-adversarial-validation.md with research/README.md as the evidence index. All references, the npm files list and the release-notes template updated.
• README rewritten as the single front door (what, try, model, versions, evidence, repository map; "one ACTIVE_GOAL state, stored by the reference CLI in docs/ACTIVE_GOAL.md"); CONTRIBUTING rewritten as the contributor path.
• docs/COMPATIBILITY.md matrix carries evidence type, last-verified date (from Git history; client version "not recorded") and a verification snapshot; no date was refreshed by editing.
• Stale tracked archive dist/ppgp-v0.1.zip removed; .gitignore guards generated archives.
• CI push filter reduced to main; workflow inputs and issue-template placeholders describe versions generically.
• Documentation clarifications (no new normative fields): machine-readable shape and conformance classes; goal visibility across refs; handoff packet supplements state; parking convention; blocker scope; GOAL / LOOP / TASK / SESSION; goal granularity; distill/close stay agent-performed.

Public repository state (done outside this diff)

• feat/ppgp-v0.2.0-concurrency preserved unchanged as research/v0.2-concurrency-experiment (same SHA af5a2da); PR feat: PPGP v0.2.0 portfolio coordination release candidate #10 commented and closed as superseded by evidence; old branch deleted. ROADMAP records it as preserved research, not a release path.
• Twelve stale remote branches of merged PRs deleted after verifying no unique work (fix/release-downstream-trigger held only a placeholder file and superseded release-note wording).
• Repository: description and topics set; delete_branch_on_merge enabled; empty wiki and projects disabled. main protection unchanged (not protected; separate owner decision).

Tests

test/hardening.test.js with 12 fixtures under test/fixtures/: happy path (conformant), canonical/SCP-style/OCPDF-style parsing (the realistic files are partial, exit 2, with missing fields named and unknown sections retained), implemented-not-deployed, observation window, scoped blocker, malformed and contradictory state, nested-directory invocation, branch visibility, forced replacement backup, minimal repository, skill install.

Self-hosting

Tracked with docs/ACTIVE_GOAL.md in this repository (two goals: the hardening goal, closed at f98263e, and the owner-review remediation goal, closed at the end of this PR). History in the branch commits.

Verification

• npm test: cli/version/distribution, hardening, benchmark, package suites pass.
• node test/installed-cli.test.js: passes on win32.
• npm pack --dry-run: 24 files, 36.9 kB; ships docs/EVALUATION.md and benchmarks/PROTOCOL.md, no fixtures or research.
• Publication-failure simulation: if this merges and every publish workflow fails, main says "source version 0.1.3", links to releases/latest (v0.1.2) and npm (0.1.2), and no document claims 0.1.3 was published. Conversely, after a successful release nothing in the tagged tree is stale.

Not done in this PR

No merge, tag, GitHub Release or npm publication.

🤖 Generated with Claude Code