# proof-manifest.toml
#
# Canonical register of proof numbers (test counts) that may be cited on the public
# site (index.html, GO-LIVE.md, case-studies/*.html, README.md, etc.).
#
# Each entry's `value` is the ONLY number that is allowed to be cited for that repo
# anywhere in committed site content. It is produced by ACTUALLY RUNNING the suite
# named in `source_cmd`, in `source_repo`, and reading the pytest summary line's
# "N passed" count (never "collected", never "passed + skipped" summed together).
#
# scripts/check_proof_numbers.py reads this file and fails a commit if any citation
# in site content contradicts it. See that script's module docstring for the exact
# matching/association rules.
#
# Key = the repo keyword as it is expected to appear in site text (e.g. "mcp-factory").
#
# PATH HARDENING (2026-07-24): this file is publicly served (no-build-step
# static deploy -- jaimenbell.dev/proof-manifest.toml is a real fetchable
# URL), so it carries ONLY public identity (source_repo_public, a github
# slug) -- never a local filesystem path. The actual local absolute path
# used to live-verify each entry (source_repo) -- plus any source_env value
# that is itself a local path -- lives in the untracked
# proof-manifest.local.toml overlay instead (gitignored; see
# proof-manifest.local.toml.example for the template, and
# scripts/check_proof_numbers.py's LOCAL_MANIFEST_PATH header comment for how
# it's merged in at live-check time). Without that overlay present (CI, a
# fresh public clone) the live-check for each entry degrades to an honest
# WARN, never a FAIL.
#
# VISIBILITY (2026-07-29): a `visibility` field marks whether the entry's
# `source_repo_public` github slug is a repo a site visitor can actually open
# and re-count for themselves. Absent = "public" (the default -- most entries
# don't set it explicitly, same sparse-only-when-needed convention as
# source_repo/source_env above). Set `visibility = "private"` when the repo
# is private: the number is still live-verified by THIS operator (the
# live-check machinery doesn't care about GitHub visibility, only local
# filesystem access via proof-manifest.local.toml), but it is NOT
# independently checkable by a visitor clicking through -- the site must say
# so next to every citation of that number. check_proof_numbers.py reports
# (never fails) every private-visibility entry via the same honest-WARN
# convention as a missing live-check.
#
# SOURCE_TIMEOUT (2026-07-30): live-checking an entry runs its real suite
# under a global timeout (LIVE_CHECK_TIMEOUT_SECONDS = 90s in
# check_proof_numbers.py) -- a hang or a genuinely slow suite WARNs rather
# than blocking the commit forever. Absent = the global 90s applies (the
# default, most entries don't set it -- same sparse-only-when-needed
# convention as source_repo/source_env/visibility above). Set
# `source_timeout = <seconds>` on an entry ONLY when its suite legitimately
# runs close enough to the global default, with real run-to-run variance,
# that it intermittently trips the timeout and goes permanently unverified
# -- never raise the global default itself just to accommodate one outlier
# entry. Unlike source_repo/source_env, a timeout value carries no local
# filesystem path, so it lives directly on this tracked manifest (no
# proof-manifest.local.toml overlay needed).

["mcp-factory"]
value = 233
source_repo_public = "jaimenbell/mcp-factory"
source_cmd = "python -m pytest -q"
# NOTE 2026-08-03: the MCP_FACTORY_SMOKE_ROOTS neutralization that used to live
# here is now OBSOLETE and has been removed. It pointed the smoke-hub's
# auto-discovery at an empty root to reproduce a clean-checkout count -- but
# commit "feat: bundle a labelled demo bot as a directory-listing fallback"
# (2026-07-31) ships a demo bot precisely so those 4 smoke tests PASS on a clean
# checkout. Pointing them at an empty root now defeats that fallback and
# under-counts by exactly 4. Measured both ways on 2026-08-03:
#   with neutralization -> 229 passed, 10 skipped   (artificially low)
#   without             -> 233 passed,  6 skipped   (matches repo README + CI)
# The repo README states 233/6 and is itself CI-gated by
# scripts/check_readme_counts.py, so 233 is the number public CI produces.
tail_line = "233 passed, 6 skipped in 9.70s"
verified_utc = "2026-08-03T14:20:00+00:00"
status = "verified"
note = "DRIFT 2026-07-31 (caught by the pre-commit gate itself when committing an unrelated mcp-factory-count site update): 222->229 at commit 4cf5c10 (feat: bundle a labelled demo bot as a directory-listing fallback), now pushed and public. Re-verified live in this pass: clean checkout, working tree clean, ran `MCP_FACTORY_SMOKE_ROOTS=<empty_smoke_root> python -m pytest -q --junitxml=...` per this entry's neutralization note -- summary line '229 passed, 10 skipped in 5.38s', cross-checked against the junitxml (tests=239 skipped=10 errors=0 failures=0 -> 229 passed). Prior: DRIFT 2026-07-22 (evening-ceremony preflight, ahead of the paired site refresh + factory push): 216->224->222 at commit 2491528 (ci: add GitHub Actions CI with README count-verification gate; repo local main ahead of origin by 1 commit at time of this check). Re-verified live in this pass. Prior: DRIFT 2026-07-20/21: 213->215 (2 tests added since 07-13, untraced, unrelated). Re-verified stable across 10+ independent runs after root-causing an unrelated apparent-flakiness report (213/215/195 across different invocations) down to a real bug in THIS checker's own live-check subprocess call -- see check_proof_numbers.py's live_verify_manifest() fix, 2026-07-21: it inherited GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE from git's own hook-invocation environment and leaked them into mcp-factory's test subprocess, corrupting its git-aware tests (test_workflow_runner.py) and producing a phantom 195. Fixed by stripping GIT_* env vars before spawning a different repo's test command. Prior: DRIFT 2026-07-13, 187->213."

["github-mcp"]
value = 97
source_repo_public = "jaimenbell/github-mcp"
source_cmd = "python -m pytest -q --tb=no"
tail_line = "97 passed, 1 skipped (junitxml: tests=98 failures=0 errors=0 skipped=1)"
verified_utc = "2026-07-23T14:55:11+00:00"
status = "verified"
note = "DRIFT FOUND 2026-07-23 (checker-parse-fix lane: the manifest's plain -q live-check had been silently WARN-skipping this entry since the summary line is suppressed under piped/non-tty capture -- fixed by teaching the live-check to parse junitxml instead, which then correctly caught this real drift that had been invisible behind the broken WARN). 86->97 since the 07-11 seed: 'ci: add GitHub Actions CI with README count-verification gate' (ec67472) added tests/test_check_readme_counts.py (+11 tests), 'harden(ci): SHA-pin third-party GitHub Actions' (5c3daf1) is a workflow-only change with no test delta. Cross-checked against the repo's own README Tests badge, which already reads '97 passing / 1 skipped' -- this is the manifest catching up to a repo that self-corrected. no .venv in this repo; ran with the global python per fallback rule. Prior: DRIFT FOUND 2026-07-11 (rate limiter fd0664c, 07-10, added 12 tests, 74->86)."

["desktop-mcp"]
value = 139
source_repo_public = "jaimenbell/desktop-mcp"
source_cmd = "python -m pytest -q --tb=no"
tail_line = "139 passed, 2 skipped (junitxml: tests=141 failures=0 errors=0 skipped=2)"
verified_utc = "2026-07-23T14:55:11+00:00"
status = "verified"
note = "DRIFT FOUND 2026-07-23 (checker-parse-fix lane, same class as github-mcp above: junitxml live-check fix caught real drift previously hidden behind a silent WARN). 128->139 since the 07-11 seed: 'ci: add GitHub Actions CI with README count-verification gate' (2607b94) added tests/test_check_readme_counts.py (+11 tests), matching the github-mcp pattern exactly; 'harden(ci): SHA-pin third-party GitHub Actions' (d3faac7) and the intervening docs/security commits are test-count-neutral. Cross-checked against the repo's own README Tests badge, which already reads '141 (139 passing, 2 skipped)' -- manifest catching up to a repo that self-corrected. no .venv in this repo; ran with the global python per fallback rule. Prior: DRIFT FOUND 2026-07-11 (121->128 since 07-09)."

["rag-mcp"]
value = 149
source_repo_public = "jaimenbell/rag-mcp"
source_cmd = ".venv/Scripts/python.exe -m pytest"
tail_line = "149 passed"
verified_utc = "2026-07-31T02:35:00+00:00"
status = "verified"
note = "DRIFT FOUND 2026-07-30 evening (caught by this gate at commit time, same session that CAUSED it): 126 -> 149 at master 94289b9 'fix(ingest): collapse consecutive-day duplicate chunks in dated snapshot series', which added tests/test_snapshot_dedupe.py (+23 tests). This is the gate working exactly as designed -- the drift existed for minutes, not days, because the commit that created it was blocked until the citation caught up. TRAP RECORDED FOR THE NEXT REFRESH: 126 was ALSO video-digest's correct count at this moment, so a global find-replace of '126' would have silently corrupted a DIFFERENT, accurate claim. Only rag-mcp.html (9 refs), the rag-mcp #cases card in index.html (2 refs), and this entry were touched; video-digest.html's 10 refs of 126 were verified untouched afterward. ALSO CHANGED source_cmd: dropped '-q --tb=no'. On this box that flag combination SWALLOWS the pytest summary line entirely -- the run prints progress dots to 100%% and then nothing -- which made this gate report 'no pytest summary line found' and would have been easy to misread as a broken gate rather than a captured-output problem. Plain 'python -m pytest' emits '149 passed in 8.70s' normally. Prior: DRIFT FOUND 2026-07-30 (wave lane, buyer-view audit of the deployed site): 68 -> 126 at master 28040bb. This was the LARGEST understatement on the site -- 46% low, i.e. the case study claimed roughly half the real suite. Growth since the 07-24 seed came from the incremental-reingest arc (508fa16 feat(ingest) + c2ba15d fix(lock) + 3e8aaa1 test(store guard)) plus 9576c53 (SDK 2.0.0 / protocol revision 2026-07-28) and 9941909 test(security), which added test_incremental_ingest.py, test_protocol_version.py and test_embedded_only_invariant.py -- three files the case study's enumerated test-file list was also missing, now added. Live-verified via junitxml in the repo's own .venv (tests=126 failures=0 errors=0 skipped=0). NOTE ON THAT RUN: conftest's store guard SKIPPED because a live production reingest held the store lock (pid 27936) -- store-pollution coverage was not exercised, but the count and pass status are unaffected. Understating is not a safe direction of error on a site whose FAQ invites buyers to clone and check. Prior: DRIFT FOUND 2026-07-24 (cred-refresh lane, spot-check of existing cards per doctrine): 60 -> 68 at master 0f1d3a9 ('fix(registry): shorten server.json description to the 100-char registry cap'). Since the 07-23 seed: 'chore(packaging): rename PyPI dist name to jaimenbell-rag-mcp, add server.json + mcp-name marker' (5f833d2) and 'feat(packaging): console entry point' (9149081) each added test coverage (test_check_readme_counts.py, test_entrypoint.py, test_server_stdio.py all new). Live-verified via junitxml in the repo's own .venv, working tree clean before/after. Fixed on site + case study in the same pass. Prior: DRIFT FOUND 2026-07-11 (proof-numbers pre-publish audit): query-cap fix (000f23b) added 2 tests, 51->53. Re-verified 2026-07-11 -- value now 53, drift fixed on site + case study + README."

["bus-mcp"]
value = 99
source_repo_public = "jaimenbell/bus-mcp"
source_cmd = ".venv/Scripts/python.exe -m pytest -q --junitxml=<scratch>/bus.xml"
tail_line = "99 passed, 1 skipped (junitxml: tests=100 failures=0 errors=0 skipped=1)"
verified_utc = "2026-07-23T14:55:11+00:00"
status = "verified"
note = "DRIFT FOUND 2026-07-23 (checker-parse-fix lane: junitxml live-check fix caught real drift previously hidden behind a silent WARN -- this entry's own source_cmd already carried the <scratch> junitxml convention, which the fix now actually substitutes and parses instead of leaving unused). 62->99 since the 07-09 seed: 'ci: add GitHub Actions workflow + README count-verification gate' (acd5e5f) added tests/test_check_readme_counts.py (+11, same pattern as github-mcp/desktop-mcp), plus 'fix(security): validate lane param against path injection' (45a4f1a) and 'fix(security): gate 4 mutating tools behind default-OFF write flag' (186fc1f) each added their own dedicated test coverage for the remaining +26. Cross-checked against the repo's own README Tests badge, which already reads '100 (99 passing, 1 skipped)' -- manifest catching up to a repo that self-corrected. Still not cited as a proof number anywhere in site content (re-verified 2026-07-23: grepped index.html/README.md/GO-LIVE.md/case-studies/*/articles/*/scoreboard.html -- only bare repo-name mentions in fleet-reliability-day.html and fleet-audit-methodology.html, no numeric test-count citation either place). Tool count not re-checked this pass."

["options-bot"]
value = 452
source_repo_public = "jaimenbell/options-bot"
visibility = "private"
source_cmd = ".venv/Scripts/python.exe -m pytest -q"
tail_line = "452 passed, 1 skipped (junitxml testcase count: 453 total, 452 passed, 1 skipped, 0 failures, 0 errors)"
verified_utc = "2026-08-04T20:57:00+00:00"
status = "verified"
note = "DRIFT AGAIN 2026-08-04 (8th rot since 07-06, orphan-managed-watch-fix lane): 391 -> 452 @ master a3a4a22 ('feat(halt): obey the fleet HALT sentinel -- freeze entries, keep managing exits'). 8 commits landed since the 07-30 seed (halt-sentinel handling, exposure_writer fail-closed on portfolio-read failure, data-blackout vs quiet-market distinction made honest at the source, greeks_sidecar startup stagger, empty-frame fetch retry/backoff, single-instance-lock refusal), each shipping with its own test coverage per this repo's convention. Live-verified via junitxml, counting real <testcase> elements per this gate's own established method (never the testsuite tests= attribute, which has previously overstated by phantom counts on this fleet -- see day-trader below): tests=453, skipped=1, failures=0, errors=0 -> 452 passed. Repo working tree clean before/after (git status --porcelain empty). Also caught and confirmed by this repo's own check_proof_numbers.py live-check gate independently (LIVE-CHECK FAIL: manifest said 391, live said 452), corroborating this manual measurement. Prior: DRIFT AGAIN 2026-07-29 (seventh rot since 07-06: 186->281->292->299->321->353->371->383)."

["discord-mcp"]
value = 162
source_repo_public = "jaimenbell/discord-mcp"
source_cmd = ".venv/Scripts/python.exe -m pytest -q"
tail_line = "162 passed, 1 skipped (junitxml: tests=163 failures=0 errors=0 skipped=1)"
verified_utc = "2026-07-24T13:10:53+00:00"
status = "verified"
note = "DRIFT MID-LANE 2026-07-24 (cred-refresh lane, first time cited on site): first live-check this pass read 160 passed/161 total (matching the prior manifest value exactly, no drift at that instant); a re-run minutes later read 162/163 -- root-caused to a genuine concurrent commit landing on master DURING this lane: 'chore: rename PyPI identifier to jaimenbell-discord-mcp' (eafb610, 07:07:35 local, i.e. between the two checks) added tests/test_mcp_registry_marker.py (+2 tests, no route/server.py changes -- tool count unaffected, still 12). Re-confirmed stable at 162/163 across 2 consecutive fresh runs after the commit landed, working tree clean before/after both times. Tool count live-verified at 12 (5 read: list_channels/list_roles/list_categories/get_channel_permission_overwrites/get_member_roles; 7 gated write: create_channel/edit_channel/delete_channel/create_role/edit_role/edit_guild/create_message, all behind DISCORD_MCP_ENABLE_WRITE, gated at the routes.py function via config.py's gated_write decorator, not just the server.py tool wrapper). History confirmed squash-clean: 2 commits on master (db11da7 initial squash + eafb610 rename), both authored/pushed by the operator's own concurrent session, not this lane. Now cited on case-studies/discord-mcp.html + index.html #cases card. Prior: DRIFT FOUND 2026-07-23 (checker-parse-fix lane: junitxml live-check fix caught real drift previously hidden behind a silent WARN -- this entry's plain '-q' output is dots-only under piped capture, same suppressed-summary class as github-mcp/desktop-mcp/bus-mcp). 144->160 since the 07-21 04:48 UTC seed: 'Add create_message write tool (7th write tool, gated)' (6769e5c) added the 7th gated write tool plus its dedicated test coverage (+16)."

["reliability-retainer"]
value = 265
source_repo_public = "jaimenbell/reliability-retainer"
visibility = "private"
source_cmd = "python -m pytest -q --tb=no"
tail_line = "265 passed in 5.38s"
verified_utc = "2026-07-29T00:00:00+00:00"
status = "verified"
note = "Seeded 2026-07-13 for case-studies/reliability-retainer.html, which cites the repo's full-suite count; that page IS linked from index.html:1004 (the #cases proof-card grid) -- the original 'unlinked, staged' note here was stale. Original seed value was live-verified at commit a4733c3 on branch slice5-runbook-sow-reconcile (unmerged slice1-5 work at the time; no .venv in this repo, ran with the global python per the github-mcp/desktop-mcp fallback convention). RE-VERIFIED 2026-07-29 (disclose-private lane) on the repo's DEFAULT branch: local checkout was already on master (origin/HEAD -> refs/remotes/origin/master, confirmed via `git symbolic-ref`) at commit fc20b8a8, working tree not touched (no checkout/branch switch performed) -- 265 passed in 5.38s, unchanged from the original seed, so the number holds on the default branch despite first being measured on an unmerged feature branch. Both options-bot and reliability-retainer are PRIVATE GitHub repos (verified via `gh repo view --json visibility`, 2026-07-29) -- see visibility = \"private\" above; the site now discloses this next to every citation of this number instead of implying an independently-checkable public repo."

["rails-mcp"]
value = 106
source_repo_public = "jaimenbell/rails-mcp"
source_cmd = ".venv/Scripts/python.exe -m pytest -q"
tail_line = "106 tests (junitxml: tests=106 failures=0 errors=0 skipped=0)"
verified_utc = "2026-07-22T18:10:35+00:00"
status = "verified"
note = "8th flagship (governance category), went public/private-GitHub 2026-07-19. DRIFT 2026-07-22 (flagship-coverage lane, first time cited on site): 95 -> 106 (suite grew +11 since 07-19 seed; config/routes/server suites expanded). Live-verified stable across 2/2 junitxml runs in the repo's own .venv; repo's own README Tests badge already reads '106 passing', so this is the manifest catching up to a repo that self-corrected. Tool count live-verified at 6 (classify_action, is_action_registered, get_rails_hash, get_signoff_state, record_spend_intent, evaluate_budget). Now cited on case-studies/rails-mcp.html + index.html #cases card."

["vllm-ops-mcp"]
value = 95
source_repo_public = "jaimenbell/vllm-ops-mcp"
source_cmd = ".venv/Scripts/python.exe -m pytest -q"
tail_line = "95 passed, 7 skipped (junitxml: tests=102 failures=0 errors=0 skipped=7)"
verified_utc = "2026-07-22T18:10:35+00:00"
status = "verified"
note = "7th flagship, went public/private-GitHub 2026-07-19. DRIFT 2026-07-22 (flagship-coverage lane, first time cited on site): 76 -> 95 (unit suite grew +19 since 07-19 seed; the 7 live-infra smokes still skip without VLLM_OPS_MCP_LIVE=1). Live-verified stable across 2/2 junitxml runs in the repo's own .venv; repo's own README Tests badge already reads '102 (95 passing, 7 live-skipped)', so this is the manifest catching up to a repo that self-corrected. Per this manifest's convention the citable headline number is passed-only (95), not the 102 combined total. Tool count live-verified at 6 (check_health, get_gpu_status, get_serve_config, get_service_status, list_models, test_completion). Now cited on case-studies/vllm-ops-mcp.html + index.html #cases card."

["mcp-security-scanner"]
value = 762
source_repo_public = "jaimenbell/mcp-security-scanner"
source_cmd = "python -m pytest -q --tb=no"
tail_line = "762 passed, 9 skipped in 8.69s"
verified_utc = "2026-08-04T20:44:00+00:00"
status = "verified"
note = "DRIFT AGAIN 2026-08-04 (13th, orphan-managed-watch-fix lane): 648 -> 762 passing (657 -> 771 total) @ master 915d1a3 ('docs: add commercial-support footer, services URL, and correct owner name'). 22 commits landed between the prior d88aacb seed and this one, including an SSRF-sink resolution arc (import-alias + instance-receiver resolution, HTTP-verb severity calibration), tool-scope-creep receiver-classification fixes, a reachability cross-file-name-guess fix, and a README count restamp at f43949d (676 -> 689, later grown further by the SSRF/tool-scope-creep commits after it) -- test growth is organic across several small feature/fix commits, not one bulk add. Cross-checked against the repo's own README (line ~130): 'python -m pytest -q # 771 tests (762 passing, 9 self-audit skip)' -- MATCHES the live-measured count exactly, no discrepancy between repo and README this pass. (A prior, UNVERIFIED claim floated '648 claimed vs 762 in the README' as if that were a live contradiction -- it wasn't checked against a real run at the time; this pass supplies the actual measurement and confirms 762/9 is correct, the site's 648 was simply stale by 4 days / 22 commits, same fast-drift pattern as every prior rot on this entry.) Live-verified via global python (no .venv in this repo, per the github-mcp/desktop-mcp fallback convention), working tree clean before and after (git status --porcelain empty both times). NOTE this remains the fastest-drifting number on the site (13 rots since 07-19) -- live-re-verify before any public copy, never trust a carried-forward figure more than a few days old. Prior drifts: 44->48 (07-19), 48->59 (07-21), 82->101 (07-22 05:57). DRIFT AGAIN 2026-07-22 18:10 (flagship-coverage lane, first time cited on site): 101 -> 195 (JS/TS parity across .js/.mjs/.cjs/.ts/.mts/.cts/.jsx/.tsx + reachability-grading matrix + tool-parameter taint-tracking matrix all merged today; the 7 skips are the self-audit tests that need MCP_SCANNER_FLEET_ROOT). Live-verified stable across 2/2 junitxml runs. Repo's own README already reads '202 tests (195 passing, 7 self-audit skip)', so this is the manifest catching up to a repo that self-corrected. Now cited on case-studies/mcp-security-scanner.html + index.html #cases card. NOTE this repo is the fastest-drifting number on the site (5 rots since 07-19) -- live-re-verify before any public copy. DRIFT AGAIN 2026-07-23 (6th): 195 -> 257 passing / 264 total (tool-discovery low-level SDK support @ fe36864 + detector-5/6 low-level coverage @ 4a63544, both triple-review-gated [2x refuter N-vote + Opus final verify each], merged+pushed same morning). Live-verified via repo count-gate (scripts/check_readme_counts.py green at 264/257/7). DRIFT AGAIN 2026-07-23 ~15:20 (7th, same day): 257 -> 264 passing / 271 total (decorator-path import-aware gate/sink resolver @ 15b5460, 2x refuter N-vote + Opus final verify, pushed) -- folded into the checker-parse-fix deploy so site+repo land together. DRIFT AGAIN 2026-07-23 evening (8th, same day): 264 -> 337 passing / 346 total @ 88b133c (sink-substring resolution arc + fp-wave1 one-law FP-reduction, both N-vote + Opus-MERGE-SAFE final verify; README/ANNOUNCEMENT self-audit table rebuilt live). The self-audit narrative on the case study + index card was ALSO corrected this pass: 6 servers -> 8, and mcp-factory now scans CLEAN (codegen class fixed upstream 2026-07-21) with github-mcp/discord-mcp showing honest P1/LOW rows for their own fake test-fixture tokens -- so the old 'flags the codegen class, gives the other five a clean bill' copy is retired as factually stale. Live-verified 337/9 via py -3.12 pytest. DRIFT AGAIN 2026-07-23 ~21:47 (9th, same day): 337 -> 410 passing / 419 total @ master 49f556e (client-report generator lane merged -- 8-section deliverable, finding_id, boundaries.py, golden-file render tests; review MERGE-SAFE + operator dogfood-eyes approved). Live-verified 410 passed / 9 skipped via py -3.12 -m pytest (also corroborated by the scanner's own scan_meta.suite_counts = 419/410/9 emitted into the rag-mcp sample-report scan JSON). This resync landed alongside the new public sample report at case-studies/sample-report-rag-mcp.html (the real rag-mcp render, branded into the site shell). DRIFT AGAIN 2026-07-23 evening (10th, same day): 410 -> 430 passing / 439 total @ master 53f7187 (FP-wave2 custom-gates + destructiveHint converged via N-vote adjudication; docs-integrity fix pushed). Live-verified 430 passed / 9 skipped via python -m pytest -q (fresh run, no MCP_SCANNER_FLEET_ROOT set, matching this manifest's env-relative convention). sample-report-rag-mcp.html's citation stays pinned to historical commit 49f556e (410/419) by design -- it documents the scan-time state of that specific report, not the current live count -- and was left untouched in this pass. DRIFT AGAIN 2026-07-29 (11th): 430 -> 595 passing / 604 total @ master c811d25 (grading-honesty wave -- grade axis + scoped severity cap + four detector scope fixes; reviewed and pushed to public master 2026-07-29 11:45 MDT, remote-verified three ways). Live-verified 595 passed / 9 skipped via junitxml (tests=604 skipped=9). CONTEXT THAT SHOULD TRAVEL WITH THIS NUMBER: on the same day the scanner measured 0.00% on BOTH axes against 5 pinned third-party MCP servers -- precision 0/53, recall 0/69 pooled -- so a rising test count here is NOT evidence of capability. The $250-750 One-Shot Audit tier was pulled from managed-watch.html in this same commit. Do not let this figure carry a quality implication it has not earned. DRIFT AGAIN 2026-07-30 (12th): 595 -> 648 passing / 657 total @ master d88aacb. The repo's own CI count-gate was RED on a5768d5 because README.md still claimed 604/595 -- corroborated three ways: local run, the CI job's junit output, and scripts/check_readme_counts.py. **THE CAPABILITY CONTEXT ABOVE IS NOW SUPERSEDED AND MUST NOT BE RE-QUOTED:** the '0/53 precision, 0/69 recall' line described the 2026-07-29 state. Three recall slices on 07-30 (tool-registry extraction for the five real registration idioms + un-gating auth_posture and secret_handling from the Python AST) moved the held-out baseline to 88 findings / 2 hand-audited true positives -- and that 2 was independently re-derived, not relayed. Read it as 1, not 2: only airtable src/main.ts:54 has real-world consequence (and even that is opt-in and already disclosed by upstream), while e2e.test.ts:23 is a credential upstream deliberately committed as a read-only public-data test token. The standing warning still holds in both directions: a rising test count is NOT evidence of capability, and neither is 2/88 -- that is a LOW precision figure and the JS/TS precision layer still does not exist."

["day-trader"]
value = 1386
source_repo_public = "jaimenbell/Day-Trader"
visibility = "private"
source_cmd = ".venv/Scripts/python.exe -m pytest -q"
# Measured 2026-07-30: 1281 passed, 0 failed, 84.99s -- runs close enough to
# the global 90s live-check timeout, with 13-19s of observed run-to-run
# variance, that it intermittently trips it and goes permanently unverified.
# This entry only; every other entry keeps the fast-fail 90s default.
source_timeout = 180
tail_line = "1386 passed (junitxml testcase count: 1386 real <testcase> elements, 0 failures, 0 errors, 0 skipped; the suite's own testsuite tests= attribute read 1416, a 30-test PHANTOM overstatement of the same kind first caught 2026-07-31 -- counted real <testcase> elements per this gate's established method, never the attribute)"
verified_utc = "2026-08-04T20:57:00+00:00"
status = "verified"
note = "DRIFT AGAIN 2026-08-04 (2nd, orphan-managed-watch-fix lane): 1348 -> 1386 @ master 405ca7a. Live-verified via junitxml in the repo's own .venv: the testsuite tests= attribute read 1416, but counting actual <testcase> elements (this gate's own documented fix for exactly this failure mode, see the note directly below) gives 1386 real cases, 0 failures, 0 errors, 0 skipped -- the attribute's +30 phantom is the SAME class of overstatement first caught 2026-07-31, recurring on a fresh run, not a one-off. Also independently confirmed by this repo's own check_proof_numbers.py live-check gate (LIVE-CHECK FAIL: manifest said 1348, live said 1386) -- two independent measurements agree. NOTE ON REPO STATE AT MEASUREMENT TIME: `git status --porcelain` showed pre-existing uncommitted drift in data/signal_history/{overnight_snapshots,scorer_snapshots}.jsonl and an untracked .claude/plans file -- present BEFORE this lane ran anything (confirmed via a status check preceding the test run) and UNCHANGED after (confirmed via a second status check post-run) -- i.e. live-bot-operation drift unrelated to this measurement, not prod pollution caused by this test run. Left untouched per lane-contracts.md's git-checkout-requires-status-first rule; not this lane's to clean. Prior: SEEDED 2026-07-30 -- previously cited on case-studies/orphan-position-recovery.html as '1,002 tests' with no manifest entry at all (fully ungated). Live-verified fresh in the repo's own .venv (global python lacks the alpaca dependency, so this MUST run under .venv, not the github-mcp/desktop-mcp global-python fallback convention). The repo's own README independently claimed 1248 the day before (2026-07-29), consistent with organic growth to 1280 the next day, not a discrepancy. Also PRIVATE (verified via gh repo view --json visibility) -- the site did not previously disclose this next to the citation, unlike options-bot/reliability-retainer's existing disclosure pattern. Both the stale number and the missing disclosure fixed on case-studies/orphan-position-recovery.html in the same pass. DRIFT SAME DAY 2026-07-30 (1st): 1280 -> 1281 -- the manifest was seeded from a run 77.93s before this session's own subprocess-safety fix (81445e8, bounding the belt-and-suspenders _kill_process_tree fallback call) landed a new test one minute later. Caught by this repo's own live-check gate (LIVE-CHECK FAIL), not by inspection -- the exact failure mode this gate exists to catch."

["video-digest"]
value = 126
source_repo_public = "jaimenbell/video-digest"
source_cmd = "python -m pytest -q --junitxml=<scratch>/video-digest.xml"
tail_line = "126 passed (junitxml: tests=126 failures=0 errors=0 skipped=0)"
verified_utc = "2026-07-29T00:10:00+00:00"
status = "verified"
note = "DRIFT FOUND 2026-07-28 (proof-numbers refresh lane, caught by the pre-commit LIVE-CHECK gate: manifest said 68, live repo said 126). 68->126 since the 07-24 seed at 0ba9f42: 'Add deterministic, model-free visual analysis of keyframes' (c8db0f5 + merge 3892817) added the new keyframe-analysis module and its own dedicated test coverage, then 'Add GitHub Actions CI workflow to gate test suite' (9239425) added its own CI-gate test coverage -- same class of commit-adds-a-count-verification-suite pattern seen on github-mcp/desktop-mcp/bus-mcp. Live-verified via global python (no .venv in this repo, same fallback convention) with junitxml (tests=126, failures=0, errors=0, skipped=0), re-confirmed stable across 2 consecutive runs, working tree clean before/after (git status --porcelain empty). Matches the repo's own README, which already reads '126 tests, 126 passing (re-verified fresh)' -- manifest catching up to a repo that self-corrected. Fixed on case-studies/video-digest.html (title/meta/og/twitter tags, .meta div, both pills, evidence-list tests line) + index.html #cases card in the same pass. Prior: SEEDED 2026-07-24 (cred-refresh lane, first time cited on site) at 68 passed / 0ba9f42."
