v0.11 item 4: G31, the catalogue at v7, and three transcripts re-run

[arpanghoshal]

Pairs with CTRLRun/ctrlrun#201, on a branch of the same name. v0.11 item 4: one chain, five receipt schema versions.

Stacks on #31. That PR is what makes docs main green again after kernel #199 and #200; this contains its commits, so merging #31 first and then this, or just this, both work.

The three quoted verify transcripts are re-run, not edited

This is the change most worth checking, because test_every_quoted_verify_transcript_is_one_verify_actually_prints exists precisely because both of these pages were once written rather than captured.

page	run against
docs/verify.md	examples/authority/payments.yaml, now 25/25, catalogue v7
docs/cookbook/verify-in-github-actions.mdx	the policy the page itself quotes, now 16/16
docs/guides/verify-in-ci.mdx	the same, indented into its <Steps> block

Each was produced by running ctrlrun verify against that page's own policy with item 4's kernel branch installed, and pasting what it printed.

docs/verify.md's abridged N/A illustration moves from 8/8 … never 16/16 to 9/9 … never 17/17: G31 needs only an action to build a chain from, so it is applicable wherever any guarantee is, and tests/test_verify_page.py is updated to pin the new number.

Written by hand

docs/OWASP-AGENTIC-TOP10.md gains G31's row under ASI09:2026 (partly), alongside G11. What it says it does not close is the part worth reading: this is about whether the record can still be read and recomputed years later, not about who wrote it, and an unknown schema label is named so an operator knows which row this binary could not fully interpret, which is a different sentence from this row was tampered with.

docs/ROADMAP.md's v0.11 bullet said "nothing yet proves that verify walks it end to end". It is closed and dated, and it carries the methodology error the proof made first, so the next person building a multi-version proof does not rediscover it:

Run with PYTHONPATH=src, the variable is inherited by every child, so all five "released wheels" imported the build under test and the run reported one schema version while looking exactly like a pass.

ROADMAP.md already said five receipt schema versions in both the prose and the Exit line, so SPEC-v0.11.md §6's instruction to correct "four" had already been carried out by an earlier session and nothing needed changing.

Generated

Every generator re-run against the item 4 kernel branch, then repoint-claims.py, then both readiness blocks pasted fresh. The readiness block now reads 28 guarantees and 6,122 tests.

One thing worth recording about how that was produced. The generators were first run in a virtual environment holding kernel main, which has 27 guarantees, so the readiness block came out saying 27 while the catalogue under test had 28 — and test_no_page_states_a_guarantee_count_the_catalogue_does_not_have caught it. The environment must hold the branch being documented, built the way docs CI builds one: [dev,gateway,otel,identity] and no postgres extra.

git status in the kernel worktree after running every generator: clean.

Checks

./scripts/check.sh: 1701 passed.

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
ctrlrun	🟢 Ready	View Preview	Sep 14, 2026, 3:02 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[coderabbitai]

Warning

Review limit reached

Next included review available in 50 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 98cca79d-6a52-427c-937c-7816d6bec52f

📥 Commits

Reviewing files that changed from the base of the PR and between df86c7c and d1f4a73.

⛔ Files ignored due to path filters (4)

• generated/readiness.full.mdx is excluded by !**/generated/**
• generated/readiness.json is excluded by !**/generated/**
• generated/readiness.mdx is excluded by !**/generated/**
• generated/readiness.readme.md is excluded by !**/generated/**

📒 Files selected for processing (25)

• docs.mdx
• docs/CLAIMS.md
• docs/OWASP-AGENTIC-TOP10.md
• docs/ROADMAP.md
• docs/cookbook/verify-in-github-actions.mdx
• docs/guides/verify-in-ci.mdx
• docs/production/index.mdx
• docs/production/receipt-integrity.mdx
• docs/reference/api/Control.mdx
• docs/reference/api/DelegationRecord.mdx
• docs/reference/api/EventSink.mdx
• docs/reference/api/InMemoryStateStore.mdx
• docs/reference/api/JSONLEventSink.mdx
• docs/reference/api/SQLiteStateStore.mdx
• docs/reference/api/StateStore.mdx
• docs/reference/api/context.mdx
• docs/reference/api/idempotency_token.mdx
• docs/reference/api/postgres-PostgresStateStore.mdx
• docs/reference/api/protect.mdx
• docs/reference/api/state-Charge.mdx
• docs/reference/api/state-Consumption.mdx
• docs/reference/api/state-check_charges.mdx
• docs/reference/api/with_approval.mdx
• docs/verify.md
• tests/test_verify_page.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}