ScopeProof public alpha: voluntary dogfood feedback

[YuzeJ21]

ScopeProof v0.1.0 is available for public-repository, local-first evaluation.

Please do not post tokens, private repository links, customer source code, or confidential requirements.

If you choose to try it, share only what you are comfortable making public:

• public PR URL and head SHA
• whether your criteria were user-confirmed or a technical-smoke proxy
• verdict and any misleading/missing evidence candidate
• whether the result changed your review decision
• sanitized error output, if any

ScopeProof remains an evidence assistant: a technical run or a Ready/Blocked label is not proof of correctness, runtime behavior, security, or product value.

The public Action validation record is in docs/launch/non-fork-action-validation.md. Fork validation is intentionally not claimed.

[YuzeJ21]

The current public-alpha release is v0.1.1. It includes the aligned trusted-base Action guidance and copyable safe-preview workflow. Please use this release or newer for any voluntary public-PR dogfood run; do not share private code, tokens, or confidential requirements.

[YuzeJ21]

Current public-alpha release: v0.1.2. It pins and upgrades the GitHub Action dependencies, with a successful real same-repository Action smoke documented in PR #5. Please use this version or newer for voluntary public-PR dogfood feedback.

[YuzeJ21]

Current public-alpha release: v0.1.3. It fixes the copyable workflow installation path by pinning ScopeProof source to a verified public release commit; a clean virtual-environment install and CLI smoke both passed.

[YuzeJ21]

Current public-alpha release: v0.1.4. Fork testing is intentionally excluded for this single-account alpha; the remaining external validation path is voluntary public-PR dogfood with source-owner-confirmed requirements.

[YuzeJ21]

Current public-alpha release: v0.1.5. It adds CodeQL, resolves the detected high-severity local-storage path findings, and keeps the alpha local-first and single-account.

[YuzeJ21]

Current public-alpha release: v0.1.6. It adds public contribution and private vulnerability-reporting guidance while preserving the local-first, no-paid-API, single-account alpha boundaries. CI and CodeQL passed on the release commit.

[YuzeJ21]

Current public-alpha release: v0.1.7. It includes a small local-workbench reliability fix: loading the demo no longer produces the requirements-widget state warning. The deterministic, local-first, no-paid-API, single-account alpha boundaries are unchanged; CI and CodeQL passed on the release commit.

[YuzeJ21]

Current public-alpha release: v0.1.8. It updates the development pytest requirement after a local dependency audit found a known issue in pytest 8.4.2, explicitly upgrades pip before CI installation, and adds a contract test for that workflow safeguard. Main CI and CodeQL passed; the local-first, no-paid-API, single-account alpha boundaries are unchanged.

[YuzeJ21]

Current public-alpha release: v0.1.9. It permanently removes fork testing from the single-account external-validation runbook and supports fork_status: excluded local evidence records without accepting fork-run details. Main CI and CodeQL passed; no external fork-run claim is made.

[YuzeJ21]

ScopeProof public-alpha maintenance update: v0.1.10 is published.

Evidence:

• Release: https://github.com/YuzeJ21/Scope-Proof/releases/tag/v0.1.10
• Maintenance PR: Keep fork validation permanently excluded in public docs #19
• Release PR: Release v0.1.10 #20
• Release target: f817002

What changed:

• Public docs no longer imply fork evidence is required before claiming a real Action run.
• Privacy readiness now states that fork testing is permanently excluded for this single-account public alpha and that no external fork-run claim is made.
• Repository contract tests now reject public-doc wording that reintroduces required or optional external fork-validation claims.

Validation:

• PR Keep fork validation permanently excluded in public docs #19 and PR Release v0.1.10 #20 passed protected verify and CodeQL before merge.
• Local checks before PRs: 139 passed, 1 skipped; Ruff passed; 12 benchmark cases, 0 mismatches, 0 must-have false-ready; git diff --check clean.

Boundaries preserved:

• No fork testing added or claimed.
• No billing, paid API, organization, second account, private repo, or synthetic validation.