Repository navigation
audit: registry verification depth classified; upgrades remain gated #11
Description
Status
PARTIALLY_REMEDIATED / CLASSIFIED
Original finding
The Evaluation Kit registry commands do not all have the same verification depth. Some entries run package scripts. Some entries only check that README.md exists.
Tool remediation applied
A classification artifact was created:
Riverbraid-Documentation/docs/VERIFICATION_DEPTH_CLASSIFICATION.md
It labels the current registry commands by depth, including:
STATIC_VECTOR_OR_CORE_SCRIPTFEATURE_FLOW_SCRIPTNPM_TEST_REPO_VERIFIERPRESENCE_CHECK_ONLY
The Documentation README now links that artifact.
Remaining issue
This classification does not upgrade any verifier.
Presence-check-only entries remain presence checks.
npm test entries still require package-script-level and domain-verifier-depth review.
Future gate
Any registry command upgrade requires an explicit registry succession or freshness gate.
Boundary
This issue records classification only.
It does not mutate registry pins, verifier behavior, workflows, protocol files, hashes, seals, manifests, tags, or releases.
Activity
[-]audit: registry verification commands have uneven verification strength[/-][+]audit: registry verification depth classified; upgrades remain gated[/+]Riverbraid commentedon Jul 27, 2026
Draft PR #13 makes
VERIFICATION_DEPTH_NONUNIFORMexplicit inclaim-ceiling.jsonand at the public README entrance. It also states that presence checks remain presence checks and thatnpm testis only as strong as the package script it invokes.PR #13 does not upgrade any verifier and does not close this issue. Package-script inspection, execution evidence, and any future registry-depth upgrade remain separately gated.
Riverbraid commentedon Jul 27, 2026
Exact-head evidence update: run
30282086825successfully completed the current configured 30-entry profile for PR #13 head277065f8af53a0de5eaecd1671b970c8d8cfec40.The new claim ceiling and README require verification-depth distinctions to remain visible. Successful aggregate execution does not upgrade
PRESENCE_CHECK_ONLYentries or prove equal behavioral depth, so this issue remains open for any future verifier-depth changes.