[criptogus]

Summary

Published packages no longer imply signed or evaluated releases. Show current-version signing/evaluation metadata separately from aggregate trust, improve weak-password recovery while retaining backend rejection, and count MCP outcomes only after inspecting the result.

MCP call → attempted → result inspection → succeeded | failed | unknown
Signup → inline rejection → corrected retry → original OAuth destination
Package → version evidence → aggregate score with evidence availability

The first commit contains mechanical lint formatting; the second contains behavior, tests and validation tooling. Regenerated artifacts stay synchronized in the automatic version-bump workflow. A follow-up commit patches TanStack Start to 1.168.60, DOMPurify to 3.4.17 and launch-editor to 2.14.2 in both lockfiles; the dependency audit now blocks high/critical findings.

Evidence

• Before: 185 tests passed, but lint reported 11,965 errors, two generated artifact checks failed, and MCP telemetry ran before tool execution.
  After: 190 local tests, TypeScript, a zero-vulnerability npm audit, production build, content validation and generated-artifact checks pass. New lint gate reports zero blocking regressions while explicitly retaining 612 pre-existing any uses; lint:strict still exposes that debt.
• Mobile/desktop browser checks intercept auth: weak-password error, visibility toggle, corrected retry and OAuth query preservation pass without creating users or sending email. Screenshots reviewed locally.
• Live read-only checks: RLS coverage and anonymous-read allowlist pass across 85 tables. The additive SQL constraint was tested with rollback; no rows or permissions changed during validation.
• Repeatable command: npm run check:project; optional --ui and --security checks retain separate receipts. No Lovable agent, model evaluation or generation credits used.

Merge Danger

Door: two-way

Apply 20261023120000_mcp_outcome_events.sql before deploying v2 telemetry. It only extends allowed event names and preserves old rows, quotas and RLS. Version evidence may be unavailable and must not be inferred as a pass. Existing type debt and 23 content heuristic warnings remain explicit; this is not a complete security or typing audit.

Blast Radius: application

Homepage copy, marketplace trust display, auth return paths, MCP telemetry and delivery checks. Review the formatting commit separately. Live email delivery/OAuth providers and paid checkout were not exercised.