Skopeo

.planning/codebase/STRUCTURE.md

@@ -94,6 +94,7 @@ FSB/
 - `content.js`: DOM analysis, action execution, tools (~5600 lines)
 - `ai-integration.js`: AI prompts, response parsing, caching (~2800 lines)
 - `universal-provider.js`: Multi-provider API adapter (~800 lines)
+- `extension/content/skopeo-context-router.js`: Closed, render-independent Drive/Docs context classification and context-epoch ownership
 
 **Testing:**
 - No dedicated test directory

.planning/milestones/v1.2.0-SKOPEO-MILESTONE-AUDIT.md

@@ -0,0 +1,114 @@
+---
+milestone: v1.2.0
+milestone_name: Skopeo
+audited: 2026-08-27
+status: automated_complete_non_live_approved
+live_approved: false
+scores:
+  requirements: 63/63
+  phases: 9/9
+  plans: 62/62
+  integration: 6/6
+  flows: 6/6
+open_code_blockers: 0
+open_security_threats: 0
+human_needed_rows: 12
+---
+
+# v1.2.0 — Skopeo — Milestone Audit
+
+## Verdict
+
+**AUTOMATED COMPLETE · NON-LIVE-APPROVED.** All 63 v1.2.0 implementation requirements are mapped, checked complete, and backed by phase verification; all 9 phases and 62 plans are complete. The final extension validation and full repository suite pass. No code-review blocker or open security threat remains.
+
+This verdict does not claim legal/domain, authorized Google Drive/Docs/PDF, native OS notification, or human accessibility approval. The 12 named observations in Phase 59 remain `human_needed`, and every live/human approval flag is false.
+
+## Definition of Done
+
+**Goal:** deliver an explicitly invoked, page-native adaptive HUD across the supported capability catalog and a Chrome-local, permission-scoped Drive vendor-contract intelligence pack with governing truth, cited answers, decision policy, and honest current-user deadline alerts.
+
+**Automated outcome:** achieved.
+
+- One explicit lifecycle and Shadow shell cover the catalog while preserving fail-quiet behavior, host controls, accessibility contracts, and zero-residue teardown.
+- All 2,314 committed capability descriptors resolve through the versioned profile/readiness system without inventing unsupported actions or semantic authority.
+- Corpus, graph, truth, policy, alert, and citation state remain Chrome-local, partitioned by current Drive account and enrolled root, with bounded existing-provider use and no new runtime service.
+- Governing lineage, exact facts, deadline derivations, cited ask, Document 10, complex-memo, and notice-only alert decisions fail visibly closed on ambiguity, access loss, stale evidence, or identity drift.
+- Current-user alerts use explicit stable owner mapping, exact minus-90 civil-date eligibility, wake-safe dedupe, attempt-before-effect persistence, fresh delivery/click reauthorization, and honest public states.
+- A versioned release gate covers 12 deterministic gold, 10 adversarial security, and 6 lifecycle/browser cases while a separate ledger prevents automated evidence from becoming live approval.
+
+## Requirements Coverage
+
+| Requirement family | Count | Owning phases | Automated status | Live/human boundary |
+|---|---:|---|---|---|
+| HUD-01..09 | 9 | 52, 53 | complete | Authorized Drive/Docs host and assistive-tech observations retained where named |
+| ADAPT-01..10 | 10 | 53.1 | complete | Nine representative live genre rows remain human-needed in their phase ledger |
+| LOCAL-01..07 | 7 | 55 | complete | Domain fidelity remains human-needed |
+| CORPUS-01..06 | 6 | 54 | complete | Authorized account/access/revocation behavior remains human-needed |
+| TRUTH-01..11 | 11 | 55, 56 | complete | Legal/domain and live citation behavior remain human-needed |
+| VIEW-01..07 | 7 | 57, 58 | complete | Authorized Drive/Docs and human usefulness remain human-needed |
+| POLICY-01..03 | 3 | 58 | complete | Counsel/legal-operations review remains human-needed |
+| ALERT-01..05 | 5 | 59 | complete | Native Chrome/OS notification observation remains human-needed |
+| VERIFY-01..05 | 5 | 59 | complete | VERIFY-04 is complete as an honest reporting contract; its six named live observations remain human-needed |
+
+Traceability totals: **63 mapped, 63 automated complete, 0 orphaned, 0 duplicate mappings.**
+
+## Phase Coverage
+
+| Phase | Plans | Result | Evidence boundary |
+|---|---:|---|---|
+| 52 — On-Demand HUD Lifecycle & Primitive Shell | 12/12 | complete | Automated lifecycle/UI contracts; deferred live UAT retained |
+| 53 — Drive Context Router & Semantic Anchors | 5/5 | complete | Automated identity/anchor mechanics; authorized live host pending |
+| 53.1 — Catalog-Wide Adaptive HUD Platform | 12/12 | complete | 20/20 automated must-haves; representative live genre UAT pending |
+| 54 — Permission-Scoped Drive Corpus Boundary | 8/8 | complete | Automated partition/access/purge authority; live account/access UAT pending |
+| 55 — Chrome-Local Graph & Incremental Truth Foundation | 5/5 | complete | Automated graph/provenance/provider/store contracts; domain fidelity pending |
+| 56 — Governing Lineage, Evidence & Deadline Engine | 5/5 | complete | Automated truth/deadline contracts; legal/domain and live citations pending |
+| 57 — Folder & Reading HUD | 5/5 | complete | Automated projections and local-browser mechanics; authorized live UI pending |
+| 58 — Cited Ask & Decision Policy | 5/5 | complete | 5/5 verified; legal/domain, authorized live, and human UI pending |
+| 59 — Current-User Alerts & Release Hardening | 5/5 | complete | 5/5 automated truths verified; `live_approved: false` |
+
+## Cross-Phase Integration
+
+| Flow | Status |
+|---|---|
+| explicit invocation → controller generation → adaptive composer → one Shadow shell → exact teardown | wired and verified |
+| catalog/profile/readiness → exact-origin context → semantic anchor → safe action projection | wired and verified |
+| Drive account/root/access → corpus replacement/purge → graph extraction/store → current truth | wired and verified |
+| current truth → folder/reading projection → cited ask → policy clearance/abstention | wired and verified |
+| current truth/owner mapping → alert derivation/store → alarm reconcile → notification/evidence action | wired and verified |
+| fixture manifests → production modules → release aggregate → separate human ledger | wired and verified |
+
+## Final Gate Evidence
+
+At Phase 59 implementation head `0f93723f455d`:
+
+```text
+test:skopeo-truth-evals       PASS
+test:skopeo-hud-evals         PASS (34/34)
+test:skopeo-ask-evals         PASS (24/24)
+test:skopeo-release-evals     PASS (12 gold, 10 security, 6 lifecycle)
+storage boundary              PASS (33 injected/dependency files)
+session lifecycle             PASS
+real local Chrome contract    PASS
+validate:extension            PASS (451 classic scripts)
+npm test                      PASS
+git diff --check              PASS
+```
+
+The full suite initially exposed a stale Phase 58 startup-import assertion. Commit `0f93723f` updated it to require the complete trusted Phase 59 alert chain; the focused test then passed 112/112 and the full suite passed.
+
+## Security and Review
+
+- Phase 59 code review: 1 integration-test finding fixed, 0 remaining.
+- Phase 59 security: 12/12 threat families closed, 0 accepted, 0 open.
+- No new dependency, lockfile, remote asset, host permission, provider, server, telemetry channel, MCP surface, daemon, or external delivery adapter.
+- The only new extension capability is the local Chrome `notifications` permission.
+
+## Human/Live Evidence Debt
+
+The release ledger retains 12 pending observations: Google Docs, text-bearing PDF, blocked download, shared access, revocation, account switching, native notification, legal/domain review, VoiceOver, 200% zoom, dense corpus, and real host coexistence.
+
+These rows are not silent accepted risks: unsupported or unavailable product paths stay fail-closed, and the milestone explicitly reports `live_approved: false`. Completing those observations may change the evidence disposition without changing the automated milestone implementation result.
+
+## Final Disposition
+
+v1.2.0 is ready for archive as **automated complete, non-live-approved**. Publication, tagging, deployment, store submission, and live-UAT execution remain user-controlled external actions and were not performed by this closeout.

.planning/milestones/v1.2.0-SKOPEO-MILESTONE-SUMMARY.md

@@ -0,0 +1,39 @@
+---
+milestone: v1.2.0
+milestone_name: Skopeo
+completed: 2026-08-27
+status: automated_complete_non_live_approved
+live_approved: false
+requirements: 63/63
+phases: 9/9
+plans: 62/62
+---
+
+# v1.2.0 — Skopeo — Milestone Summary
+
+FSB now includes Skopeo: an explicitly invoked, page-native adaptive HUD platform across the committed capability catalog, plus a Chrome-local permission-scoped Drive vendor-contract intelligence pack with governing truth, cited answers, policy safeguards, and honest current-user deadline alerts.
+
+## Shipped
+
+- One lifecycle, visual grammar, adaptive composer, and Shadow shell with exact-origin/profile authority, honest readiness, consequence confirmation, host protection, accessibility contracts, and zero-residue teardown.
+- Versioned catalog profile coverage for 2,314 descriptors across 128 app stems and 129 services, with unsupported actions kept visibly non-invocable.
+- Chrome-local corpus enrollment, access/revision reconciliation, atomic source replacement, purge ownership, graph/provenance storage, truth adjudication, and deterministic deadline calculation.
+- Folder and reading projections, cited permission-scoped Ask, stable Document 10 review policy, and explicitly complex human-memo status without AI-authored memos.
+- Current-user-only local notifications based on explicit stable owner mapping and exact governing notice-deadline minus 90 days, with persistent deduplicated lifecycle state and wake-safe revalidation.
+- A pinned release matrix with 12 gold, 10 security, and 6 lifecycle/browser cases, plus a separate 12-row human/live evidence ledger.
+
+## Closure
+
+- Requirements: 63/63 automated complete and mapped exactly once.
+- Phases: 9/9 complete.
+- Plans: 62/62 complete.
+- Final extension validation: passed.
+- Final full repository suite: passed.
+- Phase 59 security: 12/12 threats closed; 0 accepted; 0 open.
+- Final code review: 0 findings remaining.
+
+## Honest Boundary
+
+This milestone is **not live-approved**. Legal/domain review, authorized Drive/Docs/PDF and account/access observations, native Chrome/OS notification behavior, VoiceOver, 200% zoom, dense-corpus usefulness, and real host coexistence remain `human_needed`. Automated and local-browser fixtures do not satisfy those observations and never set their approval flags.
+
+Publication, tagging, deployment, store submission, and live UAT were not performed.