PDF XYZ — a focused PDF text highlighter for cleaner reading and faster reviews.
ProductivityTypeScript · JavaScriptGitHub @baki2222OnlineOwner unconfirmed
Have you tried it? One tap is enough. No sign-in needed.
No updates detected yet. GitHub releases will appear here.
GitHub star growth between the latest completed 8-hour observations
DeepSeek Harness Remote can securely connect a phone or another computer to the computer where you run DeepSeek Harness, so you can continue your work anytime and anywhere, check progress anytime, and continue working.
AI translation
Hide the menu bar icons you don't need behind a chevron and bring them back the instant you ask. Native, private, free for macOS.
Self-hosted, sharable kanban for humans and agents. One 4.5 MB binary, 4.5 MB of RAM, 10 to 60 tokens per agent reply, starts in 2 ms, zero setup.
Dictate into any app on macOS or Windows. Arion recognizes Chinese, English and both mixed on your device, works offline, and is open source under AGPL-3.0.
The open-source alternative to Claude's browser plugin. AI-powered browser extension for Chrome & Firefox. Read, understand, and automate any web page. Multi-provider LLM support. Multilingual UI. Fre
Owners of public repositories under a personal GitHub account can sign in to verify ownership and manage the introduction themselves. No administrator approval is needed.
Sign in, generate a verification file, and commit it to this repository’s default branch within 30 minutes. Files on other branches or forks do not count. Then check the file below to manage the project without administrator approval. Keep the file to retain your access.
If needed, you will go to sign-in. After signing in, return here and press your chosen verification button again.
Run /nomorevibe verify in your project folder to verify ownership and manage the introduction yourself.
Verify in one minuteAsk about other verification options
A complete pdf tool project.
Translation pending
Taken from the repository README
Loading the full README.
Read the full README ↗Every PDF tool. Private by design.
A modern, fast, privacy-first PDF platform. Most tools run entirely in your browser — your files never leave your device — and the heavier operations are routed to clearly-labeled secure workers (rather than faked client-side).
pdf-lib (transform) + pdfjs-dist (render) — all in-browserThis is a production-grade foundation with a growing set of genuinely working tools. We are deliberately honest in the UI and here about what is live versus planned — no fake processing.
| Area | Status |
|---|---|
| Product site, tool catalog (50 tools), workspace, SEO, a11y | ✅ Live |
Real in-browser tools: merge, split, rotate, delete/extract/organize pages — plus compare-pdf, irreversible redact-pdf (it rasterizes the page, so no text survives under the box), signature placement, and fillable forms. These shipped in the browser; they were never pending workers, and for compare-pdf/redact-pdf/fill-forms that absence is pinned by a verify-marker in docs/SECURITY.md rather than by this sentence | ✅ Live |
| Compress (in-browser size analyzer + lossless structural repack) | ✅ Live |
| Page thumbnails & visual page board (pdfjs) | ✅ Live |
| Editor depth: undo/redo, keyboard reordering, range selection, lazy large-PDF thumbnails, per-file merge validation | ✅ Live |
| Local-first workspace: multi-file staging, local PDF page counts, file-aware tool suggestions, browser-only handoff, batch launch | ✅ Live (local session only) |
| Production hardening: CSP/security headers, robots, sitemap, manifest, OG image, JSON-LD | ✅ Live |
| Client resilience & observability: error/not-found/loading boundaries, reusable error boundary, privacy-safe error + Web Vitals telemetry (inert unless an endpoint is set) | ✅ Live |
| Secure-worker contract + adapter, presence-only status probe, honest Compress UI integration | ✅ Live |
Deep compression worker (Ghostscript/qpdf/mutool) — real, runnable via PDFXYZ_WORKER_MODE=local-dev | 🧪 Local-dev |
OCR foundation: options/capability contract, honest OCR tool page + /status row, browser job client | ✅ Live (foundation) |
Production storage + queue providers: S3/R2-compatible signed upload/download/delete storage, Redis/Upstash-compatible durable queue, per-provider /status readiness, honest DELETE /api/jobs/:id | ✅ Live (provider foundations) |
Out-of-band worker daemon runner: pnpm worker:daemon drains the queue → executor → worker-side S3/R2 byte I/O and completes real compress-pdf jobs (lossless always; deep when a native engine is installed) — proven end-to-end over the S3 seam — with --once/--drain/--dry-run-status modes, useful sanitized output filenames, a compression_health deep-engine smoke signal, content-free logs, and a daemon /status readiness | ✅ Live (runner) |
Worker deployment hardening: retention→lifecycle policy generation/validation (AWS S3/R2/MinIO/generic), composed deployment readiness/posture + honest not-implemented facets, and production guardrails that fail fast (exit 4) on unsafe config — via --dry-run-status / --check / --lifecycle-policy; content-free, offline, no cloud calls | ✅ Live (ops tooling) |
Redis queue atomicity + lease correctness: worker-owned transitions (claim commit, stale-lease redelivery, heartbeat, advance, finalize, requeue) run through frozen Redis EVAL compare-and-set scripts with status + lease-attempt preconditions, so a stolen/expired lease cannot resurrect or corrupt a job; a broker without atomic scripts fails as typed unavailable, and strict mode / PDFXYZ_QUEUE_REQUIRE_ATOMIC refuse a non-atomic queue | ✅ Live (queue hardening) |
Malware-scan gate (Phase 22): an optional ClamAV/clamd scanner streams each input over INSTREAM and scans it before processing — an infected or unscannable upload is blocked terminally (no artifact, inputs wiped), a transient scan failure retries, and with nothing configured the honest no-op scans nothing and never reports a file as scanned. Presence-only readiness (disabled/not-configured/ready/unavailable), content-free logs/status, and an opt-in PDFXYZ_WORKER_REQUIRE_SCAN guardrail that fails --check (exit 4) unless a usable endpoint is configured | ✅ Live (optional backend; run clamd as a sidecar) |
OCR backend (Phase 23): an optional, real OCR processor on the out-of-band worker — shells out to OCRmyPDF/Tesseract with a fixed argv (no shell), hard timeout + byte ceilings, isolated temp with guaranteed cleanup, and a structural PDF check, producing a searchable PDF and/or text sidecar from actual recognition. Off by default (PDFXYZ_OCR): with nothing configured, ocr-pdf fails honestly as not_implemented, status.ocr.available is false, and the tool page mounts no uploader. The malware scan runs before OCR; recognized text lives only in the downloaded artifact and never leaks into logs/status/errors; presence-only readiness (disabled/not-configured/unavailable/ready) with an opt-in PDFXYZ_WORKER_REQUIRE_OCR guardrail. See docs/OCR_BACKEND.md | ✅ Live (optional backend; the Phase 24 worker image ships the engine) |
Worker image engine packaging + container proofs (Phase 24): the worker image now installs the native stack it advertises — Ghostscript/qpdf/mutool and OCRmyPDF/Tesseract + minimal English language data (tesseract-ocr-eng) — while the web image ships none. Two in-image smokes prove it with no cloud/secret/document: pnpm worker:image-smoke (compression + OCR binaries and English langdata present; PDFXYZ_OCR=on flips ocr_health→ready/compression_health→deep; native engines never fake drainability — --dry-run-status still exits 2) and the node-free pnpm worker:engines preflight (production require-flags satisfied because the engines are present). Both run inside the built image on GitHub Actions; static tests pin the packages, the web↔worker split, the CI steps, and the smokes' presence-only, no-secret-echo hygiene. Docker isn't run locally — proof is those static tests + the container workflow | ✅ Live (image packaging + CI proof) |
OCR metadata + deterministic recognition proof (Phase 25): a successful OCR job attaches bounded, content-free metadata (OcrResultMeta — engine family, validated languages, output mode, produced artifact kinds, output page count, sidecar character count), measured from the actual run — no recognized text, path, or fabricated value (meanConfidence stays null; nulls are honest). And pnpm worker:ocr-proof proves the packaged Tesseract baseline actually recognizes text: Ghostscript renders a synthetic sentinel raster, Tesseract OCRs it to a searchable PDF + sidecar, and the sidecar must contain the sentinel — a non-user-document proof, presence-only/content-free, self-cleaning, run in the container workflow after the presence smokes. Docker-free tests pin the metadata bounds/no-leak and the script hygiene | ✅ Live (metadata populated; synthetic recognition proven in CI) |
OCR metadata surfaced to the client (Phase 26): the bounded OcrResultMeta a completed OCR job produces is now threaded onto the client-facing job record (Job.results.ocr) and returned by GET /api/jobs/:id, so the OCR tool shows a structural "Recognition summary" (pages · output kind · languages · character count) — never recognized text. One redaction boundary (sanitizeJobResults) re-bounds every write and collapses the engine to the closed ocrmypdf/tesseract/unknown family set, so no path/version/key/URL/secret can ride in; results is written only on a genuinely completed job and dropped with the artifacts on cancel/expire. A compression or failed/blocked job never grows a results block. The recognized text itself stays download-only in the artifact | ✅ Live (metadata on job record + API + UI summary) |
OCRmyPDF searchable-PDF proof + metadata fidelity (Phase 27): pnpm worker:ocrmypdf-proof proves the packaged OCRmyPDF path turns an image-only PDF (Ghostscript pdfimage) into a genuinely searchable PDF — it confirms with pdftotext that the source yields no selectable text, OCRs it by fixed argv, then confirms the output yields the sentinel (image-only → searchable), corroborated by the sidecar. Runs inside the built worker image in CI after the recognition proof; pdftotext (poppler-utils) is worker-image-only, proof-only tooling (never on the OCR runtime path; the web image ships none). The native runner now measures the metadata from the produced artifacts — the searchable-PDF page count comes from the produced PDF's bytes (never the input), so the produced-kind flags/counts can't drift and a missing output fabricates nothing. Docker-free tests pin the proof hygiene, the worker↔web split, and the searchable-PDF metadata fidelity. Still out-of-band: production OCR quality, non-English packs, real user documents | ✅ Live (searchable-PDF proven in CI; metadata fidelity tightened) |
Worker observability + SLOs (Phase 28): the out-of-band worker now emits content-free operational metrics and SLOs alongside its structured logs. A bounded metric schema (worker_run_total, worker_tick_total, worker_processor_total/_latency_seconds, worker_scan_total, worker_storage_ops_total, worker_readiness, worker_engine_capability, lifecycle + job-terminal counters) is emitted at the executor/daemon/storage seams — every label is a fixed enum or coarse bucket (latency/depth/age bucketed at construction), never a filename, key, endpoint, env value, signature, OCR text, or job/user id, enforced by a sanitizeMetric allowlist. Pure SLO helpers (evaluateSlos) compute job success rate, p95/p99 latency (honest histogram-bucket estimates), retry/dead-letter/scanner-unavailable rates, and queue/engine/lifecycle health — unknown on missing data, never a green default. GET /api/worker/operations returns a web-vantage health snapshot (one recommended next action, honest daemonObserved:false); worker:daemon --dry-run-status/--check/run modes emit content-free operations/metrics/slo JSON lines. Provider-neutral dashboard/alert examples (docs/examples/observability/) plus a canonical Prometheus text export (renderPrometheus) adapt it to any backend — no hosted dependency, no egress. Offline tests pin the schema/label bounds, SLO math, no-leakage, runtime emission, and the examples | ✅ Live (content-free metrics/SLOs; bring your own backend) |
Worker heartbeat/liveness (Phase 30): an optional PDFXYZ_WORKER_HEARTBEAT seam lets an out-of-band daemon publish a bounded content-free heartbeat to the configured Redis/Upstash job-queue broker. /api/worker/operations reads it back through a node-free provider and sets daemonObserved:true only for a fresh beat; stale beats trigger investigate-worker-liveness, missing beats are unknown, and disabled remains the honest default. The record contains only fixed enums, booleans, a coarse major.minor release, and a timestamp used solely to derive a coarse age bucket — never hostnames, PIDs, container IDs, endpoints, keys, filenames, OCR text, scanner signatures, or secrets | ✅ Live (optional heartbeat; no fake liveness) |
Deployment blueprints + ops-check scheduler templates (Phase 32): provider-neutral examples under docs/examples/deployment/ cover Docker Compose, Kubernetes, systemd daemon/timer units, cron, and a GitHub Actions fixture gate for worker:ops-check. They are static blueprints, not a live deployment: real cloud resources, secrets, DNS/TLS, Docker/Kubernetes execution, and pagers remain operator-owned. pnpm deploy:examples:check plus static tests validate placeholders, command semantics, and no-secret/no-endpoint leakage without needing Docker or a cluster | ✅ Live (validated templates; operator-owned infra) |
Worker operations dashboard on /status (Phase 29): the /status page now renders the content-free /api/worker/operations snapshot as an operator dashboard beneath the user capability summary — an overall health class (ok/warn/blocked/unknown), the single recommended next action, a per-subsystem grid, lifecycle-verification + engine/OCR proof cards, and (worker-vantage only) a last-loop card, with graceful loading/error/retry. A hardened client parser (normalizeSnapshot) narrows the response to bounded enums, booleans, and clamped integers mapped to client-authored copy, so an injected endpoint, object key, filename, signed URL, recognized text, or secret in any server field has nowhere to surface. From the web vantage daemonObserved is true only when Phase 30 heartbeat observation is explicitly enabled and a fresh provider-backed heartbeat is visible; disabled/stale/absent heartbeats stay honest (false with disabled/stale/unknown copy), so the dashboard never invents daemon liveness. Reading the snapshot emits a privacy-safe worker_operations_checked event (bounded enums only). Docker-free tests pin the healthy/degraded/unknown/disabled/liveness states, the failure+retry flow, content-free rendering, and a11y basics | ✅ Live (operator dashboard on /status) |
Operator healthcheck + alert evaluation (Phase 31): pnpm worker:ops-check folds the content-free operations snapshot (+ an optional SLO metric window) and the Phase 30 heartbeat into a single alert verdict + exit code a cron job / uptime monitor / process supervisor / CI gate keys on — no metrics backend, no pager. A pure alert policy (evaluateOperationsAlerts) maps the snapshot onto bounded severities (ok/warn/critical/unknown), reasons, and actions — all fixed enums with code-authored copy. Sources --runtime/--web/--stdin/--file, formats --json/--prometheus/--text, and a paranoid ingest path that re-authors a monitor-supplied snapshot so an injected filename/key/endpoint/secret can never survive. Exit codes 0 ok / 1 usage / 2 unknown / 3 warn / 4 critical. The same content-free posture is attached to GET /api/worker/operations and rendered as an Alert posture callout on /status. Runnable fixtures (docs/examples/observability/healthcheck/) + offline tests pin every verdict, exit code, and the no-leak contract | ✅ Live (offline alert evaluation; bring your own scheduler + pager) |
Public-API abuse guard + rate limiting (Phase 33): a small in-app guard (src/lib/ratelimit) puts typed per-action policies in front of every public API route (uploads.create, jobs.create, jobs.status, jobs.delete, artifacts.fetch, worker.status, worker.operations). On deny it returns 429 rate_limited with a Retry-After header and a content-free body. It is off by default and fails open — with no provider set every request is allowed (enforced:false), so the default build, e2e, and local-first browser tools are byte-for-byte unchanged. PDFXYZ_RATE_LIMIT_PROVIDER=local-memory enables a real per-process in-memory limiter; a remote name (redis/upstash) activates the shipped distributed provider (Phase 34) — a Redis/Upstash-REST store with an atomic fixed-window EVAL (INCR+PEXPIRE+PTTL, never a race-prone get-then-set), auto-registered at boot from src/instrumentation.ts on its own web-safe PDFXYZ_RATE_LIMIT_REDIS_REST_* credentials (kept distinct from the worker-only queue names so the public web pod carries no worker secret), reporting remote/enforced across every instance — or, with no store wired, resolves to remote-unimplemented and skips honestly, never faking distributed enforcement. On a store error it degrades per PDFXYZ_RATE_LIMIT_FAIL_MODE (open default ⇒ allow; closed ⇒ 429). Decisions carry only allow/deny, policy id, provider, enforced, and an exact + coarse-bucketed retry-after — never an IP, UA, filename, token, key, job id, env value, or body; the store sees only an opaque salted-hash bucket token; client attribution (PDFXYZ_RATE_LIMIT_TRUST_PROXY, off by default) is salted-hashed and never retained. Honest caveat: local-memory is not distributed enforcement (behind N instances the budget is N×; a restart resets windows) — select the redis/upstash provider (or a real edge/WAF) before a high-traffic launch. Offline tests pin the limiter math, the atomic script + op... [truncated] | |
Upload intake guardrails (Phase 35): secure-worker upload sessions and job creation now pass through a typed, content-free intake layer (src/lib/uploads/intake) before storage or queue work. The guard rejects too many files, declared over-size files/requests, hostile/path-like filenames, unsupported or MIME/extension-mismatched types, and — when explicitly opted in — local-dev PDF bytes missing bounded %PDF- / %%EOF markers. Order is deterministic (abuse guard → intake → tool validation); defaults mirror JOB_LIMITS, so browser/local-first tools and no-config secure-worker honesty are byte-for-byte unchanged. Errors use stable codes (invalid_upload_request, unsupported_file_type, too_many_files, file_too_large, request_too_large, malformed_pdf) and never echo filenames, object keys, signed URLs, request bodies, or bytes. Structural byte sniffing is deliberately not malware scanning or PDF sanitization; worker-side scanning/soundness checks remain separate. Offline tests pin the policy parsing, family allowlist, bounded PDF sniff, route codes, and the no-leak contract | ✅ Live (content-free upload boundary) |
Secure-worker tools, shipped and routed: Office ⇄ PDF both directions (word/excel/powerpoint-to-pdf → office-conversion; pdf-to-word/-excel/-powerpoint → pdf-office-export), repair-pdf + optimize-web → pdf-structure, pdf-to-pdfa → pdf-archive, deep compression → compression, extract-tables → table-extract, protect-pdf + unlock-pdf → pdf-security, html-to-pdf + webpage-to-pdf → html-render, ocr-pdf → ocr, and request-signatures → request-signatures. Every catalogue tool whose processing is server or hybrid resolves to a registered processor — the invariant is pinned by src/lib/workers/processor/catalog-coverage.test.ts, not by this sentence. Per-deployment readiness is still observed, never assumed: with no worker heartbeat the tool page mounts no uploader and the job API refuses rather than accepting a file it cannot process | ✅ Live (routed; per-deployment readiness observed) |
AI tools: chat-with-pdf, summarize-pdf, translate-pdf, and ai-extract each resolve to their own worker processor and mount a real panel on the tool page. One shared gate (canRunAiTool) offers them only when the deployment is not local-dev-only, a provider is declared (status.ai.ready), and the pipeline is drainable — otherwise the panel names the missing piece and never takes the document. A bounded daily allowance per connection (never per person — the bucket is an address) and a global AI spend ceiling shared by both tiers apply | ✅ Live (gated on an observed worker + a declared provider) |
Every tool page states exactly where it runs (in-browser / secure worker /
hybrid / AI). Tools without a live engine render a polished,
implementation-ready overview instead of pretending to process files. See
docs/ENGINE_ROADMAP.md for the full plan and
docs/SECURITY.md for the privacy model.
The /workspace hub stages files locally for the current browser tab only — it
never uploads them, page counts are parsed on-device, and only tool preferences
(never file names) persist. For supported in-browser tools, workspace launch now
uses a browser-only IndexedDB handoff: files are stored under an opaque,
single-use, short-lived local token and preloaded on the tool page, then the URL
parameter is consumed/removed. No server sees those bytes.
Requires Node ≥ 20 and pnpm (pinned via the packageManager field).
pnpm install
pnpm dev # http://localhost:3000
No environment variables are required to run the app locally. With none set the
secure worker is off, the job API answers 503 worker_not_configured, and the
tools that actually run are the in-browser ones (production wires the worker, the
storage/queue providers, and an AI provider separately). Client error/Web-Vitals
telemetry is opt-in: it stays inert unless you set
NEXT_PUBLIC_TELEMETRY_ENDPOINT, and even then it only ever emits
redacted payloads (never file names, contents, or hand-off tokens). See
docs/DEPLOYMENT.md for the env policy and toggles, and
docs/SECURITY.md for the telemetry privacy model.
The secure worker is off by default and the API answers 503 worker_not_configured.
To exercise the real server-side compression flow on your own machine:
PDFXYZ_WORKER_MODE=local-dev pnpm dev
Open /tools/compress-pdf and add a PDF. The lossless path (pdf-lib) always
works; the deep image-downsampling path needs a native engine on your
PATH — install Ghostscript, qpdf, or mutool to enable it. Without one, the
tool honestly says deep compression is unavailable and the API records a
not_implemented job rather than faking a file. This mode is developer-only
(in-memory, single-instance) and never used in production — see
docs/WORKER_ARCHITECTURE.md.
| Command | What it does |
|---|---|
pnpm dev | Start the dev server |
pnpm build | Production build |
pnpm start | Serve the production build |
pnpm worker:daemon | Run the out-of-band secure-worker daemon (--once / --drain / --dry-run-status / --check / --lifecycle-policy) — see docs/DEPLOYMENT.md |
pnpm worker:daemon:status | Presence-only worker readiness probe (--dry-run-status); exits 0 drainable / 2 not configured. Used by the container health check |
pnpm worker:ops-check | Operator healthcheck (Phase 31): evaluate the content-free operations posture (+ optional SLO window) into an alert verdict a monitor keys on. Sources --runtime/--web/--stdin/--file; formats --json/--prometheus/--text; exits 0 ok / 1 usage / 2 unknown / 3 warn / 4 critical — see docs/OBSERVABILITY.md |
pnpm worker:cleanup-check | Storage-artifact cleanup verifier (Phase 42): prove, from content-free evidence exported out-of-band, whether artifacts that should be gone are actually absent (active delete-now vs bucket lifecycle backstop) or only retrieval-denied. Sources --stdin/--file (default: report env posture); formats --json/--prometheus/--text; --grace-hours=N (default 48); exits 0 verified / 1 usage / 2 unknown·unavailable·not-configured / 3 drift — see |
First-time e2e run:
pnpm test:e2e:install # downloads Chromium (once)
pnpm build # create production build
pnpm test:e2e # boots `next start`, runs the smoke suite
src/
app/ App Router pages + metadata routes
layout.tsx Root layout, global metadata, landmarks
page.tsx Homepage (+ Organization/WebSite/WebApp/FAQ JSON-LD)
tools/ /tools catalog and /tools/[slug] tool pages
workspace/ Private staging workspace (noindex)
robots.ts sitemap.ts manifest.ts Generated at build time
icon.svg Favicon / PWA icon
opengraph-image.tsx OG/Twitter share image (next/og + bundled font)
components/
layout/ sections/ ui/ Site chrome + landing sections + primitives
tools/runner/ Client-side tool runners (merge/split/rotate/…)
seo/json-ld.tsx <script type="application/ld+json"> renderer
upload/ Drag-and-drop staging zone
lib/
tools/ Catalog, categories, processing metadata (source of truth)
pdf/ Engine (pdf-lib), renderer (pdfjs), registry of live runners
seo.ts site.ts Metadata builders + brand config
structured-data.ts schema.org builders
faq.ts FAQ content shared by the section + FAQ JSON-LD
assets/fonts/ Fonts used only to render the OG image at build time
e2e/ Playwright smoke tests + fixtures
Catalog-driven: adding a Tool to src/lib/tools/catalog.ts automatically
wires the homepage grid, /tools, the dynamic /tools/[slug] page, search,
and the sitemap. Registering a slug in src/lib/pdf/registry.ts (plus a case in
the runner dispatcher) upgrades that page from overview to a live runner.
Security headers / CSP live in next.config.mjs (applied on every response,
dev-relaxed) and are asserted by the Playwright suite. Details in
docs/SECURITY.md.
Both tiers run as containers under Coolify, on the pdf.xyz domain
behind Cloudflare. Merging to main builds both images, pushes them to GHCR,
deploys them, and holds until the public wire serves that exact build —
the web tier's BUILD_ID and the worker's source fingerprint, each read out
of the image that was just pushed. Full setup, env policy, and rollback are in
docs/DEPLOYMENT.md.
(Until 2026-08-24 this line said the target host was Vercel. It stopped being true at the DNS cutover and stayed on the page for three weeks — which is the defect class this repository's guards exist for, appearing in the file a new reader opens first.)
The secure worker is a separate process, never a serverless function on
the request path. A multi-stage Dockerfile exposes two independent
targets — web (the site, pnpm start) and worker (the daemon with
Ghostscript/qpdf/mutool and the OCRmyPDF/Tesseract OCR stack, pnpm worker:daemon) — with an example
docker-compose.worker.yml and
.env.worker.example (placeholder names only, no secrets):
docker build --target worker -t pdfxyz-worker:local . # deep-compression + OCR engines + daemon
docker build --target web -t pdfxyz-web:local . # site only, no engines
The image build is not exercised in this repo's environment (no Docker daemon
here); CI builds both targets on GitHub Actions
(.github/workflows/container.yml) and, inside
the built worker image, runs the no-config honesty smoke (pnpm worker:smoke) plus
the native-engine + OCR proofs — pnpm worker:image-smoke and the node-free pnpm worker:engines preflight — which confirm the packaged deep-compression and OCR
engines are present and report ready (presence-only, no document processed). The
Dockerfile/compose/CI invariants are pinned by static tests (src/deploy/). For a
full two-service production rollout — responsibilities, env by service, image
promotion, smoke, and rollback — see the production runbook;
the worker container checklist is in docs/DEPLOYMENT.md.
Proprietary — © pdf.xyz. All rights reserved.
| Worker file-soundness quarantine gate (Phase 36): after the worker retrieves bytes but before malware scanning and processors, src/lib/workers/soundness runs a bounded structural + metadata-consistency preflight. It rejects empty inputs, too many inputs, optional size ceilings, declared-size mismatches, unsupported/mismatched families, and PDF-expected bytes missing %PDF- (plus optional %%EOF). Rejections produce a content-free quarantine receipt and unsound failure class; no processor runs, no artifacts/text are produced, and logs/metrics carry only stable reason codes and buckets. This is not malware scanning, sanitization, repair, OCR validation, or proof that a PDF is safe/valid. | ✅ Live (worker preflight, content-free quarantine) |
| Worker artifact-manifest / provenance gate (Phase 37): after a processor produces outputs but before any bytes are persisted or a download is minted, src/lib/workers/artifacts validates each output's structural provenance. It rejects zero outputs, over-count/over-size outputs, empty bytes, unknown output kinds, content-type/extension mismatches, kinds a tool may not produce, and jobs with no resolvable retention class. Rejections produce a content-free rejection receipt and artifact failure class (artifact_invalid); no artifact is written, and each published output carries a typed manifest (kind/content-type/byte-count/retention-class/tool/processor) with no filename, key, URL, id, or content. This is not malware scanning, sanitization, OCR-correctness, or a lifecycle-deletion guarantee. | ✅ Live (worker output provenance, content-free) |
| Artifact retrieval/download guardrails (Phase 38): every published output records its content-free manifest alongside its bytes, and the local-dev download route (GET /api/artifacts/local/:artifactId) delegates to a pure retrieval-access layer (src/lib/workers/artifacts/access.ts) before streaming a byte. It checks handle shape, lifecycle (live/expired/deleted/absent), job completion, and re-validates the recorded manifest against the actual bytes; a pass streams with safe, generated headers (canonical Content-Type; an attachment Content-Disposition named from the output kind/tool, never the stored/user filename; Content-Length; Cache-Control: private, no-store; X-Content-Type-Options: nosniff), a failure returns a closed set of content-free reasons (not_found/deleted/expired→404/410, invalid_manifest, unsupported_kind, …) with no bytes. A bounded worker_artifact_retrieval_total metric + per-attempt receipt (both opt-in sinks) make decisions observable. : possession of the opaque handle is the capability; the optional binding is an integrity cross-check, not access control. Not authentication, authorization, scanning, sanitization, or a deletion proof. | ✅ Live (retrieval boundary, content-free) |
| Storage-backed artifact retrieval (Phase 39): the Phase 38 access boundary is generalized behind an seam so a configured object bucket gets byte-identical checks. The production route () reads artifact bytes from the bucket (signed GET) and streams them through the same shared boundary as local-dev — (proxy/stream, not redirect); the content-free provenance manifest rides the object as signed metadata () and is re-validated on download. A transient bucket failure is a retryable →, distinct from a not-configured ; a bucket is an honest . The retrieval metric + receipt gain a bounded label (//). No S3 needed to test (scripted transport + backend override). No CDN/private-bucket policy is claimed. | ✅ Live (server-side proxy, content-free) |
| Download delivery hardening (Phase 40): after access is granted, a second pure gate () verifies the byte delivery before streaming, on both routes. It re-asserts from the actual bytes and cross-checks it against the access decision and any upstream-declared length (→, never a truncated body under a lying header); enforces a fixed delivery ceiling (→, a backstop for the opt-in publish-time cap); answers with the verified headers and no body; and takes an honest posture — whole buffered objects only, so and a header is (whole-file ), never a / or resumable claim. Non-/ verbs get a content-free (no body) from the framework. Any unexpected error closes to a safe (), never a framework /stack or a provider message/key/URL. A parallel content-free metric + delivery receipt (adds bounded /) observe it. Not authentication, resumable serving, or content scanning. | ✅ Live (delivery gate, content-free) |
| Storage-backed lifecycle/expiry enforcement (Phase 41): a bucket does tombstone, so it serves a for an artifact past its retention window until the bucket's lifecycle rule reaps it. The worker signs the retention window as content-free object metadata ( — the same the client holds, plus an optional tombstone marker); the storage reader evaluates it against its clock () and denies a logically-expired/tombstoned object , bytes never buffered. , additional to the bucket lifecycle-deletion backstop — an object with no evidence () is served honestly (never over-claimed as gone), an unreadable clock never fabricates , and it is proof of deletion. A content-free metric + drift receipt surface / (drift) vs (no metadata). Local-dev tombstones unchanged. No S3 needed to test (synthetic signed metadata). Bucket lifecycle correctness, legal retention, audit export, private-bucket policy, CDN purge remain out of band. | ✅ Live (retrieval-time expiry, content-free) |
| Storage-artifact cleanup verification (Phase 42): Phase 41 a gone artifact at retrieval, but that is not proof the bucket . proves — from content-free evidence exported out-of-band (the app never calls the cloud) — whether artifacts that should be gone are actually (and by which mechanism) or only retrieval-denied. It separates the four cleanup facts the platform keeps distinct: (Phase 41, access only), (delete-now → ), (reap → ), and (this tool). Per-object states ////// fold to a verdict ////. : a present-but-denied object is reported as pending, never fabricated into "deleted"; a deployment stays honestly inert; it reads no bytes and NEVER deletes. Content-free metric + receipt; exit verified / usage / unknown / drift. No S3 needed to test (injected evidence). | ✅ Live (content-free cleanup evidence; operator-owned deletion) |
| Storage-artifact cleanup (Phase 42): the complementary lens to the verifier above. Where the verifier proves should-be-gone objects are , the sweeper () categorizes an offline, content-free of PRESENT object metadata into ////// and emits an optional dry-run cleanup (counts + actions only). It re-derives lifecycle through the same Phase 41 , escalates a severity only on POSITIVE evidence (a tombstone or a passed deadline; absent evidence stays ), and NEVER lists a real bucket or deletes anything. Content-free metric + receipt; exit clean / usage / unknown / cleanup-recommended / invalid·breached. No S3 needed to test. | ✅ Live (dry-run sweeper, content-free) |
| Cleanup evidence (Phase 43): Phase 42 gave operators two offline verifiers but no safe way to their content-free inputs from a raw provider capture. is that bridge — it projects an out-of-band / capture (or a normalized dump) into a or document the Phase 42 tools ingest, piped straight in. It reads ONLY a bounded allowlist (a coarse presence, the decoded evidence, a decoded manifest/kind, coarse age/size) and locator/identifier (object keys, buckets, signed URLs, endpoints, regions, account ids, ETags, filenames, user-metadata), tallying drops by category (////) in an embedded content-free receipt. A — not proof of deletion, not malware scanning, not a cloud scanner, no auth/provenance claim: it makes no cloud call and deletes nothing. A tampered lifecycle/manifest blob collapses to "no evidence"; a present-but-tombstoned object surfaces as . Content-free metric + receipt; exit projected / usage / insufficient / unsafe. No S3 needed to test (fake-only). | ✅ Live (offline projector, content-free) |
| Cleanup evidence (Phase 44): Phases 42–43 gave operators three offline tools; wiring them by hand (project → verify, project → sweep) is fiddly and easy to get fail-open. composes them into ONE fail-closed command — it reads a raw export , projects it away, runs both the absence verifier and the dry-run sweeper in-process, and rolls the two arms into a single documented exit code ( ok / usage / unknown / drift / breach; the worst arm wins, and a usage/unreadable-export is a NON-ZERO fail-closed result, never a silent ). Read-only, no cloud call, deletes nothing; the raw export is projected away before either arm runs, so no locator/identifier survives. Content-free metric + rolled-up receipt; deployment templates (, a CI fixture) included. Not deletion, auth, scanning, or provenance. | ✅ Live (one-command pipeline, content-free) |
| Cleanup evidence (Phase 44): the passive complement to the pipeline. reads the content-free report SUMMARIES a scheduled cleanup-check / artifact-cleanup job already wrote (via / ) and folds them — with a freshness threshold — into a bounded ops (///////) for the dashboard and . It refuses a raw export (a misconfiguration → ), never fabricates freshness from missing/stale evidence (→ , never a false OK), and reads no bytes, no cloud, no secret. Content-free gauge. Monitoring is OFF () until a report path is configured. Not deletion, scanning, or a cloud call. | ✅ Live (posture monitor, content-free) |
pnpm worker:release-decision-index --file=<decision.json> [--file=...] indexes a bounded batch of content-free pdfxyz.release-decision/1 records (the Phase 59 decision ledger entries, one per release; repeated --file/--decision, oldest first / newest last, or a --stdin JSON array / NDJSON stream / single record) into ONE pdfxyz.release-decision-index/1 review summary. It re-validates each record against itself (re-deriving its Phase 59 decision from its own recorded publish-pack/acknowledgement summaries + cross-check + strict flag, so a hand-flipped decision is caught as a tamper), and folds them into the decision distribution (proceed/proceed-with-followup/hold/reject/insufficient/invalid counts), per-source cross-check posture counts, a per-record posture sequence, an index verdict + bounded reasons, a trend class (all-clear/followup-present/hold-present/rejection-present/insufficient-evidence/invalid-input), and an ordered next-action checklist — answering "over the batch of release decisions, what did they decide, is anything blocking/inconclusive/untrustworthy, and what follow-up is warranted?" A stable index REQUIRES a clean batch (every usable record a clean proceed, no tampered/unreadable record); a proceed-with-followup/hold decision is watch; an insufficient decision or zero usable records is insufficient; a reject/invalid decision is blocked; an unreadable/tampered record is invalid (it dominates — never a vacuous stable); --strict escalates any advisory/insufficiency to blocked. --json/--text/--pretty/--output + bounded policy knobs (--max-records=N, --strict); exits 0 stable / 1 usage / 2 insufficient / 3 watch / 4 blocked or invalid. It is a content-free ledger INDEX SUMMARY ONLY — NOT a legal audit log, a compliance attestation, an external approval/signature, an identity proof, or a deployment/promotion ledger — and it . Emits .
pnpm worker:release-decision-trend --file=<window.json> [--file=...] summarizes a bounded history of content-free pdfxyz.release-decision-index/1 windows (the Phase 60 ledger-index summaries, one per review period; repeated --file/--window, oldest first / newest last, or a --stdin JSON array / NDJSON stream / single window) into ONE pdfxyz.release-decision-trend/1 governance summary. It re-validates each window against itself (re-deriving its Phase 60 index verdict from its own recorded ledger counts via computeIndexRollup, and re-checking those counts against the window's own per-record sequence + window arithmetic via reduceIndex, so a hand-flipped index — or a lied count consistent with it — is caught as a tamper), and folds them into the per-window index-verdict distribution (stable/watch/insufficient/blocked/invalid counts), the aggregate decision distribution (proceed/proceed-with-followup/hold/reject/insufficient/invalid counts), a per-window posture sequence, an arc direction (improving/flat/degrading/unknown, from ordered input positions — never a timestamp), a trend class (all-clear/improving/stable-watch/followup-rising/hold-rising/rejection-present/insufficient-evidence/invalid-input), a trend verdict + bounded reasons, and an ordered next-action checklist — answering "over the recent decision-index windows, are the decisions improving, stable, or degrading, is anything blocking/inconclusive/untrustworthy, and what follow-up is warranted?" A stable trend REQUIRES a clean history (every usable window a clean stable index, no tampered/unreadable window), and improving additionally a clean latest window over an earlier worse one; a flat advisory history is watch and a worsening arc is degrading (both exit 3); an only-insufficient history or zero usable windows is insufficient; a blocked/ window is ; an unreadable/tampered window is (it dominates — never a vacuous pass); escalates any non-stable window to . /// + bounded policy knobs ( default 26, ); exits improving/stable / usage / insufficient / watch/degrading / blocked or invalid. It is a content-free ledger-index — NOT a legal audit log, a compliance attestation, an external approval/signature, an identity proof, or a deployment/promotion ledger — and it . Emits .
pnpm worker:release-decision-action-plan --trend=<trend.json> (alias --file=, or --stdin for one JSON trend document) ingests ONE content-free pdfxyz.release-decision-trend/1 summary (the Phase 61 governance trend) and translates its bounded verdict into ONE pdfxyz.release-decision-action-plan/1 operator follow-up plan. It re-validates the trend against itself (re-deriving its Phase 61 trend verdict from its own recorded window-verdict summary via computeTrendRollup, and re-checking that summary against the trend's own per-window posture sequence + window arithmetic, so a hand-flipped trend verdict — or a lied window distribution consistent with it — is caught as a tamper), and folds it into a plan verdict (clear/monitor/investigate/block-release/invalid), an urgency (none/low/medium/high/critical), an action class (none/monitor-next-window/review-followups/stabilize-regression/block-and-reconcile/restore-evidence/reject-input), the surfaced source trend verdict / class / arc (bounded Phase 61 enums), an ordered next-action checklist (each item a stable id + an allowlisted label + bounded urgency / expectation enums + a boolean, no free-form source text), and a content-free receipt with a disclosure statement — answering "given this content-free decision-trend summary, what bounded follow-up plan should an operator run next, and at what urgency?" A clear plan REQUIRES a usable trend whose OWN verdict is a clean stable history; an improving trend is a benign monitor (exit 0); a watch/degrading trend is a follow-up monitor (exit 3); an insufficient trend is investigate (exit 2); a blocked/invalid trend is block-release (exit 4); an unreadable/tampered trend input is invalid/reject-input (exit 4, it dominates — never a vacuous clear plan); --strict escalates any non-clear plan to block-release but never fabricates approval for a clear trend. --json/--text// + bounded policy knobs ( default 8 / hard max 20, ); exits clear/benign-monitor / usage / investigate / follow-up monitor / block-release or invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-action-receipt --plan=<plan.json> (alias --file=, or --stdin for one JSON plan document) ingests ONE content-free pdfxyz.release-decision-action-plan/1 follow-up plan (the Phase 62 operator plan) plus bounded operator acknowledgement flags and records whether the plan's required follow-ups were closed out for the governance record — ONE pdfxyz.release-decision-action-receipt/1 execution receipt. It re-validates the plan against itself (reconstructing its Phase 62 bounded decision from the source-trend details the plan recorded and re-running the Phase 62 computeActionPlan reducer, so a hand-flipped plan verdict / action class / exit code is caught as a tamper), folds the plan's coarse class (clear/monitor/investigate/block, where block = a block-release/invalid plan) against the acknowledgements it requires, and emits a receipt verdict (completed/incomplete/followup-open/blocked), the resolved plan class, a bounded acknowledgement checklist (which acks were required / supplied / missing / contradictory), a bounded rationale, and a content-free receipt — answering "given this content-free follow-up plan and the operator's bounded acknowledgements, were the plan's required follow-ups closed out?" A completed receipt REQUIRES a usable plan AND its class's required acknowledgements (--ack-plan for every class, plus --ack-followups + a class ack — --ack-monitor / --ack-investigation / --ack-block — for the rest); a missing / unreadable plan is incomplete (exit 2, nothing to receipt); a tampered plan, a block plan not acknowledged as held-blocked (--ack-block), a contradictory acknowledgement (a class ack that does not match the plan class), or a --strict-open escalation is blocked (exit 4); an open advisory follow-up (a monitor / investigate plan whose follow-up ack is absent) is followup-open (exit 3). The acknowledgements are BOOLEANS ONLY — no free-form note or actor name. --json/--text/--pretty/--output + --strict-open; exits 0 completed / 1 usage / 2 incomplete / followup-open / blocked. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout --receipt=<receipt.json> (alias --file=, or --stdin for one JSON receipt document) composes the release DECISION governance chain into ONE bounded closeout. It ingests ONE content-free pdfxyz.release-decision-action-receipt/1 execution receipt (the Phase 63 receipt; required) plus OPTIONAL related records already on hand — the pdfxyz.release-decision-action-plan/1 plan, the pdfxyz.release-decision-trend/1 trend, and the pdfxyz.release-decision/1 / pdfxyz.release-decision-index/1 ledger records — re-validates the primary receipt against itself (reconstructing its Phase 63 bounded decision from the source facets it recorded and re-running the Phase 63 computeReceipt reducer, so a hand-flipped receipt verdict / ack coverage / exit code is caught as a tamper), cross-checks the supplied related records against what the receipt recorded (the supplied plan must agree with the plan the receipt receipted; the supplied trend must agree with the plan's recorded source-trend verdict; the decision / index records fold their OWN bounded posture as a source-chain signal), and emits a closeout verdict (closed/closeout-incomplete/closeout-open/closeout-blocked), the primary receipt's state + verdict, a bounded related-record checklist, a bounded rationale, and a content-free receipt — answering "is this release decision governance chain closed out, still open, incomplete, or blocked?" A closed closeout REQUIRES a usable primary receipt whose OWN verdict is completed AND every supplied related record coherent; a missing / unreadable primary receipt or a missing required record (--require-plan/--require-trend/--require-decision/--require-index) is closeout-incomplete (exit 2); a tampered / blocked receipt, a contradictory cross-check record, a tampered related record, a blocked source-chain record (a reject/invalid decision or a blocked/invalid index upstream), or a --strict-open escalation is closeout-blocked (exit 4); a followup-open receipt or an advisory decision / index record is closeout-open (exit 3). --json/--text/--pretty/ + ; exits closed / usage / incomplete / open / blocked. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-index --file=<closeout.json> [--file=...] (alias --closeout=, or --stdin for a JSON array / NDJSON stream / single closeout) indexes a bounded history of content-free pdfxyz.release-decision-closeout/1 records (the Phase 64 closeout bundles, one per release; oldest first / newest last) into ONE pdfxyz.release-decision-closeout-index/1 review summary. It re-validates each closeout against itself (re-deriving its Phase 64 closeout rollup from its own recorded receipt-source facets + per-kind related-record signals + policy, mirroring the Phase 64 computeCloseout reducer, so a hand-flipped closeout verdict / exit / rollup — and a flipped decision/index/trend cross-check signal — is caught as a tamper), and folds them into the closeout-verdict distribution (closed/closeout-incomplete/closeout-open/closeout-blocked counts), the latest / oldest closeout verdict, a per-record posture sequence, a trend class (all-closed/open-present/incomplete-present/blocked-present/tampered-present/no-usable), an index verdict + bounded reasons, and an ordered next-action checklist — answering "across the recent release decision closeouts, are we consistently closed, or is the latest / recent history open, incomplete, or blocked?" It is latest-focused: the newest usable closeout drives the verdict, and bounded history thresholds (--max-open=N/--max-incomplete=N/--max-blocked=N, each default 0) tolerate a bounded number of non-closed closeouts before the accumulation escalates (the latest is never tolerated by a threshold). An indexed index REQUIRES a coherent history (the latest usable closeout closed, no tampered/unreadable closeout, counts within thresholds); a closeout-open latest / breach is index-open; a closeout-incomplete latest / breach, an unreadable closeout, or zero usable closeouts is index-incomplete; a tampered closeout, a closeout-blocked latest / breach, or a --strict-open escalation is index-blocked (it dominates — never a vacuous indexed). --json/--text/--pretty/ + bounded policy knobs (, //, ); exits indexed / usage / index-incomplete / index-open / index-blocked. It is a content-free closeout-ledger — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-index-trend --file=<window.json> [--file=...] (alias --index=, or --stdin for a JSON array / NDJSON stream / single window) summarizes a bounded history of content-free pdfxyz.release-decision-closeout-index/1 windows (the Phase 65 closeout-index summaries, one per review period; oldest first / newest last) into ONE pdfxyz.release-decision-closeout-index-trend/1 governance summary. It re-validates each window against itself (re-deriving its Phase 65 index verdict from its own recorded ledger via computeCloseoutIndexRollup, and re-checking those counts against the window's own per-record sequence + window arithmetic via reduceIndex, so a hand-flipped index — or a lied count consistent with it — is caught as a tamper), and folds them into the per-window index-verdict distribution (indexed/index-incomplete/index-open/index-blocked counts), the aggregate closeout distribution (closed/closeout-incomplete/closeout-open/closeout-blocked counts), a per-window posture sequence, an arc direction (improving/flat/degrading/unknown, from ordered input positions — never a timestamp), a trend class (all-indexed/watch-present/incomplete-present/blocked-present/tampered-present/no-usable), a trend verdict + bounded reasons, and an ordered next-action checklist — answering "over the recent closeout-index windows, are the release closeouts trending stable/improving, watching, incomplete, or blocked, and what follow-up is warranted?" It is latest-focused: the newest usable window's own index verdict drives the verdict, bounded history thresholds (--max-watch=N/--max-incomplete=N/--max-blocked=N, each default 0) tolerate a bounded number of non-indexed windows before the accumulation escalates (the latest is never tolerated by a threshold), and a worsening arc raises a watch. A trend-stable trend REQUIRES a coherent history (the latest usable window indexed, no tampered/unreadable window, counts within thresholds, a non-degrading arc); an latest / breach or a degrading arc is ; an latest / breach, an unreadable window, or zero usable windows is ; a tampered window, an latest / breach, or a escalation is (it dominates — never a vacuous stable). /// + bounded policy knobs ( default 26, //, ); exits trend-stable / usage / trend-incomplete / trend-watch / trend-blocked. It is a content-free closeout-index — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-action-plan --trend=<trend.json> (alias --file=, or --stdin) ingests ONE content-free pdfxyz.release-decision-closeout-index-trend/1 summary (the Phase 66 governance trend) and translates its bounded verdict into ONE pdfxyz.release-decision-closeout-action-plan/1 operator follow-up plan. It re-validates the trend against itself (re-deriving its Phase 66 trend verdict from its own recorded per-window summary via computeTrendRollup, and re-checking that summary against the trend's own per-window posture sequence + window arithmetic via directionOf / deriveTrendClass, so a hand-flipped trend verdict — or a lied window distribution consistent with it — is caught as a tamper), and folds it into a plan verdict + urgency + action class, the surfaced source trend verdict / class / arc / latest index posture, an ordered next-action checklist (each a stable id + an allowlisted label + bounded urgency / expectation enums), a bounded rationale, and a content-free receipt — answering "given this content-free closeout-index trend, what bounded follow-up posture should the release team take next, and at what urgency?" It fails closed: a trend-stable history is clear (exit 0, routine monitoring only); a trend-incomplete history is investigate (exit 2); a trend-watch / degrading history is a follow-up monitor (exit 3); a trend-blocked history, an unreadable / tampered trend input, or a --strict-watch escalation is block-release (exit 4, never a vacuous clear plan). --strict-watch escalates a monitor plan to block-release — a hard "consistently closed or block" gate — but never fabricates approval for a stable trend. --json/--text/--pretty/--output; exits 0 clear / 1 usage / 2 investigate / 3 monitor / 4 block-release. It is a content-free operational follow-up plan ONLY — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it signs/approves/publishes/promotes/deploys/notifies/mutates nothing. Emits .
pnpm worker:release-decision-closeout-action-receipt --plan=<plan.json> (alias --file=, or --stdin for one JSON plan document) ingests ONE content-free pdfxyz.release-decision-closeout-action-plan/1 follow-up plan (the Phase 67 operator plan) plus bounded operator acknowledgement flags and records whether the plan's required follow-ups were acknowledged / executed sufficiently to close it out for the governance record — ONE pdfxyz.release-decision-closeout-action-receipt/1 execution receipt. It re-validates the plan against itself (reconstructing its Phase 67 bounded decision from the source-trend details the plan recorded and re-running the Phase 67 computeCloseoutActionPlan reducer, so a hand-flipped plan verdict / action class / exit code is caught as a tamper), folds the plan's coarse class (clear/investigate/monitor/block, where block = a block-release plan) against the acknowledgements it requires, and emits a receipt verdict (completed/incomplete/followup-open/blocked), the resolved plan class, a bounded acknowledgement checklist (which acks were required / supplied / missing / contradictory), a bounded rationale, and a content-free receipt — answering "given this content-free closeout follow-up plan and the operator's bounded acknowledgements, were the plan's required follow-ups closed out?" A completed receipt REQUIRES a usable plan AND its class's required acknowledgements (--ack-plan for every class, plus --ack-executed + a class ack — --ack-monitor / --ack-investigation / --ack-block — for the rest); a missing / unreadable / tampered plan fails closed to blocked (exit 4, nothing trustworthy to receipt); a block plan not acknowledged as held-blocked (--ack-block), a contradictory acknowledgement (a class ack that does not match the plan class), or a --strict-open escalation is also blocked (exit 4); a missing required acknowledgement for a clear / investigate plan is incomplete (exit 2); a monitor plan reviewed but whose follow-up is still open / not fully executed is followup-open (exit 3). The acknowledgements are BOOLEANS ONLY — no free-form note or actor name. --json/// + ; exits completed / usage / incomplete / followup-open / blocked. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance --receipt=<receipt.json> (alias --file=, or --stdin) composes the whole closeout chain into ONE final governance record: it ingests a required content-free pdfxyz.release-decision-closeout-action-receipt/1 primary receipt (the Phase 68 execution receipt) plus, optionally, the related records it was built from — the follow-up plan (--plan, Phase 67), the closeout-index trend (--trend, Phase 66), the closeout index (--index, Phase 65), and the closeout bundle (--closeout, Phase 64) — re-validates each record against itself (each is re-run through the exact downstream boundary that already consumes it — the Phase 68 computeReceipt for the primary receipt, the Phase 64–67 boundaries for the related records — so a hand-flipped verdict / ack coverage / exit code is caught as a tamper), cross-checks the supplied plan / trend against the plan verdict / source-trend verdict the receipt recorded (a mismatch is a contradiction), folds every supplied source-chain record's own bounded posture, and emits ONE pdfxyz.release-decision-closeout-governance/1 bundle: a governance verdict (closed/governance-incomplete/governance-open/governance-blocked), a primary-receipt summary, a bounded related-record checklist (kind / required / state / relation signal / verdict), an archive checklist, an ordered follow-up assignment list, and a content-free receipt — answering "is this release decision closeout governance chain fully closed, open, incomplete, or blocked?" A closed bundle REQUIRES a usable primary receipt whose OWN verdict is completed AND every supplied related record coherent; a tampered / blocked primary receipt, a contradictory plan / trend, a tampered related record, a blocked source chain (index-blocked / closeout-blocked), or a --strict-open escalation is governance-blocked (exit 4); a missing / unreadable primary receipt, an incomplete receipt, a required-but-missing (--require-plan/--require-trend/--require-index/--require-closeout) record, or an inconclusive source chain is governance-incomplete (exit 2); a followup-open receipt or an advisory source chain (index-open / ) is (exit 3). /// + the require flags + ; exits closed / usage / governance-incomplete / governance-open / governance-blocked. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-index --file=<governance.json> [--file=...] (alias --governance=, or --stdin for a JSON array / NDJSON stream / single bundle) indexes a bounded history of content-free pdfxyz.release-decision-closeout-governance/1 records (the Phase 69 governance bundles, one per release; oldest first / newest last) into ONE pdfxyz.release-decision-closeout-governance-index/1 review summary. It re-validates each bundle against itself (re-deriving its Phase 69 governance rollup from its own recorded primary-receipt source facets + per-kind related-record signals + policy, mirroring the Phase 69 computeGovernance reducer, so a hand-flipped governance verdict / exit / rollup — and a flipped cross-check / posture signal — is caught as a tamper), and folds them into the governance-verdict distribution (closed/governance-incomplete/governance-open/governance-blocked counts), the latest / oldest governance verdict, a per-record posture sequence, a trend class (all-closed/open-present/incomplete-present/blocked-present/tampered-present/no-usable), an index verdict + bounded reasons, and an ordered next-action checklist — answering "across the recent release closeout governance bundles, is the latest governance state consistently closed, or is the latest / recent history open, incomplete, or blocked?" It is latest-focused: the newest usable bundle drives the verdict, and bounded history thresholds (--max-open=N/--max-incomplete=N/--max-blocked=N, each default 0) tolerate a bounded number of non-closed bundles before the accumulation escalates (the latest is never tolerated by a threshold). An indexed index REQUIRES a coherent history (the latest usable bundle closed, no tampered/unreadable bundle, counts within thresholds); a governance-open latest / breach is index-open; a governance-incomplete latest / breach, an unreadable bundle, or zero usable bundles is index-incomplete; a tampered bundle, a governance-blocked latest / breach, or a --strict-open escalation is index-blocked (it dominates — never a vacuous indexed). --json/// + bounded policy knobs (, //, ); exits indexed / usage / index-incomplete / index-open / index-blocked. It is a content-free governance-history — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-index-trend --file=<governance-index.json> [--file=...] (alias --index=, or --stdin for a JSON array / NDJSON stream / single window) summarizes a bounded history of content-free pdfxyz.release-decision-closeout-governance-index/1 windows (the Phase 70 governance-index summaries, one per review window; oldest first / newest last) into ONE pdfxyz.release-decision-closeout-governance-index-trend/1 trend summary. It re-validates each window against itself (re-deriving its Phase 70 index verdict from its own recorded ledger + latest, and re-checking those counts against the window's own per-record posture sequence + window arithmetic via the Phase 70 rollup + reduce folds, so a hand-flipped index — or a lied count consistent with it — is caught as a tamper), and folds them into the per-window index-verdict distribution (indexed/index-incomplete/index-open/index-blocked counts), the aggregate governance distribution (closed/governance-incomplete/governance-open/governance-blocked), a per-window posture sequence, an arc direction (improving/flat/degrading/unknown) + trend class (all-indexed/watch-present/incomplete-present/blocked-present/tampered-present/no-usable), a trend verdict + bounded reasons, and an ordered next-action checklist — answering "over the recent governance-index windows, is the closeout-governance posture trending stable, watch-worthy, incomplete, or blocked, and what follow-up is warranted?" It is latest-focused: the newest usable window's own index verdict drives the verdict, bounded history thresholds (--max-open=N/--max-incomplete=N/--max-blocked=N, each default 0) tolerate a bounded number of non-indexed windows before the accumulation escalates (the latest is never tolerated by a threshold), and a worsening arc raises a watch. A trend-stable trend REQUIRES a coherent history (the latest usable window indexed, no tampered/unreadable window, counts within thresholds, a non-degrading arc); an latest / breach or a degrading arc is ; an latest / breach, an unreadable window, or zero usable windows is ; a tampered window, an latest / breach, or a escalation is (it dominates — never a vacuous stable). /// + bounded policy knobs (, //, ); exits trend-stable / usage / trend-incomplete / trend-watch / trend-blocked. It is a content-free governance-index — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-action-plan --trend=<trend.json> (alias --file=, or --stdin) ingests ONE content-free pdfxyz.release-decision-closeout-governance-index-trend/1 summary (the Phase 71 governance-index trend) and translates its bounded verdict into ONE pdfxyz.release-decision-closeout-governance-action-plan/1 operator follow-up plan. It re-validates the trend against itself (re-deriving its Phase 71 trend verdict from its own recorded per-window summary via computeTrendRollup, and re-checking that summary against the trend's own per-window posture sequence + window arithmetic via directionOf / deriveTrendClass, so a hand-flipped trend verdict — or a lied window distribution consistent with it — is caught as a tamper), and folds it into a plan verdict + urgency + action class, the surfaced source trend verdict / class / arc / latest governance-index posture, an ordered next-action checklist (each a stable id + an allowlisted label + bounded urgency / expectation enums), a bounded rationale, and a content-free receipt — answering "given this content-free governance-index trend, what bounded follow-up posture should the release team take next, and at what urgency?" It fails closed: a trend-stable history is clear (exit 0, routine monitoring only); a trend-incomplete history is investigate (exit 2); a trend-watch / degrading history is a follow-up monitor (exit 3); a trend-blocked history, an unreadable / tampered trend input, or a --strict-watch escalation is block-release (exit 4, never a vacuous clear plan). --strict-watch escalates a monitor plan to block-release — a hard "consistently closed or block" gate — but never fabricates approval for a stable trend. --json/--text/--pretty/--output; exits 0 clear / 1 usage / 2 investigate / 3 monitor / 4 block-release. It is a content-free operational follow-up plan ONLY — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it signs/approves/publishes/promotes/deploys/notifies/mutates nothing. Emits .
pnpm worker:release-decision-closeout-governance-action-receipt --plan=<plan.json> (alias --file=, or --stdin for one JSON plan document) ingests ONE content-free pdfxyz.release-decision-closeout-governance-action-plan/1 follow-up plan (the Phase 72 governance action plan) plus bounded operator acknowledgement flags and records whether the plan's required follow-ups were acknowledged / executed sufficiently to close it out for the governance record — ONE pdfxyz.release-decision-closeout-governance-action-receipt/1 execution receipt. It re-validates the plan against itself (reconstructing its Phase 72 bounded decision from the source-trend details the plan recorded and re-running the Phase 72 computeGovernanceActionPlan reducer, so a hand-flipped plan verdict / action class / exit code is caught as a tamper), folds the plan's coarse class (clear/investigate/monitor/block, where block = a block-release plan) against the acknowledgements it requires, and emits a receipt verdict (completed/incomplete/followup-open/blocked), the resolved plan class, a bounded acknowledgement checklist (which acks were required / supplied / missing / contradictory), a bounded rationale, and a content-free receipt — answering "given this content-free governance follow-up plan and the operator's bounded acknowledgements, were the plan's required follow-ups closed out?" A completed receipt REQUIRES a usable plan AND its class's required acknowledgements (--ack-plan for every class, plus --ack-executed + a class ack — --ack-monitor / --ack-investigation / --ack-block — for the rest); a missing / unreadable / tampered plan fails closed to blocked (exit 4, nothing trustworthy to receipt); a block plan not acknowledged as held-blocked (--ack-block), a contradictory acknowledgement (a class ack that does not match the plan class), or a --strict-open escalation is also blocked (exit 4); a missing required acknowledgement for a clear / investigate plan is incomplete (exit 2); a monitor plan reviewed but whose follow-up is still open / not fully executed is followup-open (exit 3). The acknowledgements are BOOLEANS ONLY — no free-form note or actor name. /// + ; exits completed / usage / incomplete / followup-open / blocked. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize --receipt=<receipt.json> (alias --file=, or --stdin for one JSON receipt document) composes the content-free closeout-governance chain — a required pdfxyz.release-decision-closeout-governance-action-receipt/1 primary receipt (the Phase 73 execution receipt) plus, optionally, the related records it was built from (--plan a …-governance-action-plan/1, --trend a …-governance-index-trend/1, --index a …-governance-index/1, --governance a …-governance/1) — into ONE pdfxyz.release-decision-closeout-governance-finalize/1 FINAL governance record. It re-validates each record against itself (reconstructing the primary receipt's Phase 73 bounded decision from the source facets it recorded and re-running the Phase 73 computeReceipt, and re-running each related record through the exact Phase 69–72 boundary that already consumes it, so a hand-flipped verdict / ack coverage / exit code is caught as a tamper), cross-checks the supplied plan / trend against what the receipt recorded (a mismatch is a contradiction), folds every supplied source-chain record's own bounded posture, and emits a finalization verdict (finalized/finalize-incomplete/finalize-open/finalize-blocked), a per-source posture, a bounded related-record checklist, an archive checklist, an ordered follow-up assignment list, and a content-free receipt — answering "is this closeout-governance chain fully finalized, still open, incomplete, or blocked?" A finalized bundle REQUIRES a usable primary receipt whose OWN verdict is completed AND every supplied related record coherent; a missing / unreadable primary receipt is finalize-incomplete (exit 2, nothing to finalize); a tampered / blocked receipt, a contradictory plan / trend, a tampered related record, a blocked source chain, or a --strict-open escalation is finalize-blocked (exit 4); a required-but-missing related record (--require-plan/--require-trend/--require-index/--require-governance), an incomplete receipt, or an inconclusive source chain is finalize-incomplete (exit 2); a followup-open receipt or an advisory source chain is (exit 3). /// + ; exits finalized / usage / incomplete / open / blocked. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index --file=<older.json> --file=<newer.json> (alias --finalization=, or --stdin for a JSON array / NDJSON / single bundle, oldest first / newest last) indexes a bounded history of content-free pdfxyz.release-decision-closeout-governance-finalize/1 finalization bundles (Phase 74) into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index/1 summary. It re-validates each bundle against itself (re-deriving its Phase 74 finalization rollup from its own recorded primary-receipt source facets + per-kind related[] state / signal + policy, mirroring the Phase 74 computeGovernanceFinalize reducer, so a hand-flipped finalization verdict / exit / rollup — or a flipped cross-check / posture signal — is caught as a tamper) and is latest-focused: the newest usable bundle drives the verdict, bounded history thresholds (--max-open / --max-incomplete, each default 0) tolerate a bounded number of non-finalized older bundles, and --require-latest-finalized demands the newest usable bundle be finalized. It emits an index verdict (indexed/index-open/index-incomplete/index-blocked/index-invalid), a coverage summary (supplied / considered / usable / unreadable / tampered / dropped), the finalization-verdict distribution, a bounded summary of the newest usable finalization, a per-record posture sequence, bounded reasons, and an ordered next-action checklist — answering "across the recent finalization bundles, is the latest finalization state consistently finalized, or is the latest / recent history open, incomplete, blocked, or untrustworthy?" It FAILS CLOSED: any tampered OR unreadable bundle is index-invalid (exit 4, the top precedence — an untrustworthy input is never counted as usable); a finalize-blocked latest / any blocked bundle, or a --strict-open escalation, is index-blocked (exit 4); a finalize-incomplete latest / threshold breach, a --require-latest-finalized miss, or zero usable bundles is index-incomplete (exit 2); a finalize-open latest / open-threshold breach is index-open (exit 3); a coherent finalized history is indexed (exit 0). --max-finalizations=N (default 26, hard max 104) caps the newest N bundles and surfaces the dropped count. ///; exits indexed / usage / incomplete / open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend --file=<older.json> --file=<newer.json> (alias --index=, or --stdin for a JSON array / NDJSON / single window, oldest first / newest last) summarizes a bounded history of content-free pdfxyz.release-decision-closeout-governance-finalize-index/1 windows (Phase 75) into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend/1 trend. It re-validates each window against itself (re-deriving its Phase 75 index verdict from its own recorded coverage + distribution + policy, mirroring the Phase 75 computeFinalizeIndexRollup reducer, AND re-checking those counts against the window's own per-record sequence + window arithmetic, so a hand-flipped index verdict — or a lied count consistent with it — is caught as a tamper) and is latest-focused: the newest usable window drives the verdict, refined by the ordered arc (oldest first, newest last — improving vs stable, degrading vs watch). It emits a trend verdict (improving/stable/watch/degrading/insufficient/blocked/invalid), a coverage summary (supplied / considered / usable / unreadable / tampered / dropped), the per-window index-verdict distribution, the aggregate finalization distribution, a bounded summary of the newest usable window, a per-window posture sequence, an arc direction (improving/stable/degrading/mixed/unknown) + class (clean/recovering/regressing/blocked/insufficient/invalid), bounded reasons, and an ordered next-action list — answering "across the recent finalize-index windows, is the closeout-governance FINALIZATION posture improving, stable, watch-worthy, degrading / open, insufficient, blocked, or untrustworthy?" It FAILS CLOSED: any tampered OR unreadable window is invalid (exit 4, the top precedence — an untrustworthy input); an index-blocked / index-invalid usable window, or a --strict-open escalation, is blocked (exit 4); zero usable windows, an index-incomplete latest, or an only-incomplete history is insufficient (exit 2); an latest or a degrading arc is , and an older open / incomplete under a clean latest is (exit 3); a coherent all- history is and a recovering one (exit 0). (default 26, hard max 104) caps the newest N windows and surfaces the dropped count; demands an latest. ///; exits clean / usage / insufficient / watch / degrading / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-action-plan --trend=<path> (alias --file=, or --stdin) ingests ONE content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend/1 trend (Phase 76), re-validates it against itself (re-deriving its Phase 76 trend verdict from its own recorded coverage + window distribution + arc summary via the Phase 76 computeTrendRollup reducer, AND re-checking that summary against the trend's own per-window posture sequence + window arithmetic, so a hand-flipped trend verdict — or a lied distribution consistent with it — is caught as a tamper), and translates its bounded verdict into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-action-plan/1 operator follow-up plan. It emits a plan verdict (clear/monitor/investigate/block-release/invalid), an urgency (routine/soon/high/immediate), an action class, the surfaced source trend verdict / class / arc / latest finalize-index posture, an ordered next-action checklist (plan — each item a stable id + an allowlisted label + bounded urgency / expectation enums), a compact nextActions id list, bounded reasons, and a content-free receipt — answering "given this content-free finalization-index trend, what bounded follow-up plan should an operator run next, and with what urgency?" It FAILS CLOSED: an unreadable / tampered trend input is invalid (exit 4, the top precedence, never weakened by a policy knob); a blocked or invalid-history trend is block-release (exit 4); an insufficient trend is investigate (exit 2); a watch / degrading trend is monitor (exit 3, soon / high); a stable / improving trend is clear (exit 0). --strict-watch escalates a monitor plan to block-release; --require-clean escalates EVERY non-clear plan to block-release; neither weakens the invalid precedence of an untrustworthy input. --json/--text/--pretty/; exits clear / usage / investigate / monitor / block-release / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-action-receipt --plan=<path> (alias --file=, or --stdin) ingests ONE content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-action-plan/1 follow-up plan (Phase 77) plus a small set of bounded operator acknowledgement flags, re-validates the plan against itself (reconstructing its Phase 77 bounded decision from the source-trend facets it recorded and re-running the Phase 77 computeActionPlan reducer, requiring the recorded plan verdict / urgency / action class / exit code / reason SET to re-derive, so a hand-flipped plan is caught as a tamper), and records whether the operator provided the acknowledgements required to close it out: ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-action-receipt/1 document. It emits a receipt verdict (completed/incomplete/blocked/invalid), the resolved plan class (clear/monitor/investigate/block), a bounded acknowledgement checklist (required / supplied / satisfied / contradictory), bounded reasons, a compact nextActions id list, and a content-free receipt — answering "given this content-free finalization-index trend action plan, did the operator provide the bounded acknowledgements required to close it out, and what is the resulting receipt posture?" The acknowledgement flags are booleans only (no note / actor): --ack-plan (alias --ack-reviewed, required for every closeable class), --ack-executed (required for monitor / investigate / block — the receipt never claims an action was executed without it), --ack-monitor / --ack-investigation (their class follow-up), --ack-block (the release remains BLOCKED, required for a block plan and a contradiction elsewhere), and the optional --ack-clear. It FAILS CLOSED: a missing / unreadable / tampered plan — or a plan whose OWN verdict is invalid — is invalid (exit 4, even if every flag is supplied); a block-release plan is blocked (exit 4, the release stays held whether or not it was acknowledged); a contradictory acknowledgement is blocked (exit 4); a missing required acknowledgement for a clear / monitor / investigate plan is incomplete (exit 2); a usable, closeable plan with its required acknowledgements is (exit 0). escalates any missing-acknowledgement to . ///; exits completed / usage / incomplete / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize --receipt=<path> (alias --file=, or --stdin) FINALIZES the finalize-index-trend follow-up loop. It ingests a required pdfxyz.release-decision-closeout-governance-finalize-index-trend-action-receipt/1 primary receipt (Phase 78) plus, optionally, the source-chain records it was built from — the Phase 77 follow-up plan (--plan), the Phase 76 finalize-index trend (--trend), the Phase 75 finalize index (--index), and the Phase 74 finalization bundle (--finalization) — re-validates each supplied record against itself through the existing Phase 74–78 boundaries (reconstructing its bounded decision and re-running that phase's reducer, so a hand-flipped verdict is caught as a tamper), cross-checks each supplied record against what its downstream record recorded (a swapped / edited record is a contradiction), folds every supplied record's own bounded posture, and emits ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize/1 document. It emits a finalization verdict (finalized/finalize-open/finalize-incomplete/finalize-blocked/finalize-invalid), a bounded coverage summary (required / usable / missing / tampered / unreadable / coherent / contradictory counts), a source-chain checklist, bounded reasons, a compact nextActions id list, and a content-free receipt — answering "given the content-free finalization-index trend follow-up receipt and optional source-chain records, is this follow-up loop finalized, open, incomplete, blocked, or untrustworthy?" It FAILS CLOSED with precedence invalid > blocking > incomplete > open > informational: an unreadable / tampered / wrong-schema primary receipt — or a tampered supplied source — is finalize-invalid (exit 4); a contradiction, a blocked / invalid receipt verdict, or a blocked source chain is finalize-blocked (exit 4); a required-but-missing / unreadable record, an incomplete receipt, or an inconclusive source chain is finalize-incomplete (exit 2); an advisory / open source chain is finalize-open (exit 3); a completed receipt with every supplied record coherent is finalized (exit 0). --require-plan / --require-trend / / make a record mandatory; escalates an open (or incomplete-receipt) finalization to a hard block. ///; exits finalized / usage / incomplete / open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index --file=<older> --file=<newer> (repeatable; alias --finalization=, or --stdin for a JSON array / NDJSON / single record) INDEXES a bounded HISTORY of content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize/1 finalization records (Phase 79) into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index/1 summary. It RE-VALIDATES each record against itself (re-deriving its Phase 79 finalization rollup from its own recorded primary-receipt source state + per-kind related[] signals + policy, mirroring the Phase 79 reducer, so a hand-flipped verdict / exit / rollup / count is caught as a tamper), and folds them into an index verdict (indexed/index-open/index-incomplete/index-blocked/index-invalid), a finalization-verdict distribution, a bounded latest summary of the newest usable record, a per-record posture sequence, bounded reasons, a compact nextActions id list, and a content-free receipt — answering "across the recent finalization records, is the latest follow-up loop consistently finalized, or is the recent history open, incomplete, blocked, or untrustworthy?" It is LATEST-FOCUSED and FAILS CLOSED with precedence invalid > blocking > open > incomplete: any tampered / unreadable INPUT record is index-invalid (exit 4, the top precedence — never a vacuous pass); a finalize-blocked / finalize-invalid latest or any such record in the window (a usable record whose OWN content concluded blocked / untrustworthy), or a --strict-open escalation, is index-blocked (exit 4); a finalize-incomplete latest / --max-incomplete breach, a --require-latest-finalized miss, or zero usable records is index-incomplete (exit 2); a finalize-open latest / --max-open breach is index-open (exit 3); a finalized latest within thresholds is indexed (exit 0). --max-finalizations=N (default 26, hard max 104) caps the newest N records and surfaces the dropped count. --json/--text/--pretty/--output; exits 0 indexed / 1 usage / 2 incomplete / open / blocked / invalid. It is a content-free finalization-history — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend --file=<older.json> --file=<newer.json> (alias --index=, or --stdin for a JSON array / NDJSON / single window, oldest first / newest last) summarizes a bounded history of content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index/1 windows (Phase 80) into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend/1 trend. It re-validates each window against itself (re-deriving its Phase 80 index verdict from its own recorded coverage + distribution + policy, mirroring the Phase 80 computeFinalizeIndexRollup reducer, AND re-checking those counts against the window's own per-record sequence + window arithmetic, so a hand-flipped index verdict — or a lied count consistent with it — is caught as a tamper) and is latest-focused: the newest usable window drives the verdict, refined by the ordered arc (oldest first, newest last — improving vs stable, degrading vs watch). It emits a trend verdict (improving/stable/watch/degrading/insufficient/blocked/invalid), a coverage summary (supplied / considered / usable / unreadable / tampered / dropped), the per-window index-verdict distribution, the aggregate finalization distribution, a bounded summary of the newest usable window, a per-window posture sequence, an arc direction (improving/stable/degrading/mixed/unknown) + class (clean/recovering/regressing/blocked/insufficient/invalid), bounded reasons, and an ordered next-action list — answering "across the recent finalize-index windows, is the closeout-governance FINALIZATION posture improving, stable, watch-worthy, degrading / open, insufficient, blocked, or untrustworthy?" It FAILS CLOSED: any tampered OR unreadable window is invalid (exit 4, the top precedence — an untrustworthy input); an index-blocked / index-invalid usable window, or a --strict-open escalation, is blocked (exit 4); zero usable windows, an index-incomplete latest, or an only-incomplete history is (exit 2); an latest or a degrading arc is , and an older open / incomplete under a clean latest is (exit 3); a coherent all- history is and a recovering one (exit 0). (default 26, hard max 104) caps the newest N windows and surfaces the dropped count; demands an latest. ///; exits clean / usage / insufficient / watch / degrading / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
(alias , or ) ingests ONE content-free trend (Phase 81), (re-deriving its Phase 81 trend verdict from its own recorded coverage + window distribution + arc summary via the Phase 81 reducer, AND re-checking that summary against the trend's own per-window posture sequence + window arithmetic, so a hand-flipped trend verdict — or a lied distribution consistent with it — is caught as a tamper), and translates its bounded verdict into ONE stable operator follow-up plan. It emits a (////), an (///), an , the surfaced source trend verdict / class / arc / latest finalize-index posture, an ordered ( — each item a stable id + an allowlisted label + bounded urgency / expectation enums), a compact id list, bounded reasons, and a content-free — answering It FAILS CLOSED: an unreadable / tampered trend input is (exit 4, the , never weakened by a policy knob); a or -history trend is (exit 4); an trend is (exit 2); a / trend is (exit 3, / ); a / trend is (exit 0). escalates a plan to ; escalates EVERY non-clear plan to ; neither weakens the precedence of an untrustworthy input. ///; exits clear / usage / investigate / monitor / block-release / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
(alias , or ) ingests ONE content-free follow-up plan (Phase 82) plus a small set of , (reconstructing its Phase 82 bounded decision from the source-trend facets it recorded and re-running the Phase 82 reducer, requiring the recorded plan verdict / urgency / action class / exit code / reason SET to re-derive, so a hand-flipped plan is caught as a tamper), and records whether the operator provided the acknowledgements required to close it out or hold it: ONE stable document. It emits a (////), the resolved (///), a bounded (required / supplied / satisfied / contradictory), bounded reasons, a compact id list, and a content-free — answering The acknowledgement flags are (no note / actor): (alias , required for every usable class), (required for monitor / investigate / block), / (their class follow-up), and (the release remains BLOCKED, required for a block plan and a contradiction elsewhere); a clear plan needs only . It FAILS CLOSED: a missing / unreadable / tampered / wrong-schema plan is (exit 4); an unacknowledged plan (a plan, or a plan whose own verdict is ), a contradictory acknowledgement, or a escalation is (exit 4); a / plan reviewed but its follow-up unacknowledged is (exit 3); a missing required acknowledgement is (exit 2); a usable plan with its class's required acknowledgements is (exit 0) — and even a completed block plan records the release as HELD, never promoted. ///; exits completed / usage / incomplete / followup-open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
(alias , or ) CLOSES OUT the finalize-index-trend-finalize-index-trend follow-up loop. It ingests ONE content-free action-plan execution receipt (Phase 83) plus, , the related records already on hand — the Phase 82 follow-up plan (), the Phase 81 finalize-index trend (), and the Phase 80 finalization-index window () — (reconstructing its Phase 83 bounded plan-ingest from the source facets it recorded and re-running the Phase 83 reducer, requiring the recorded receipt verdict / ack coverage / exit code to re-derive, so a hand-flipped receipt is caught as a tamper), each supplied plan / trend against what the receipt recorded (a swapped / edited record is a contradiction), and folds the finalization-index window's own posture as a source-chain signal: ONE stable document. It emits a (////), a bounded summary (required / usable / missing / tampered / unreadable / coherent / contradictory counts), a , bounded reasons, a compact id list, and a content-free — answering It FAILS CLOSED with precedence : a missing / unreadable / tampered / wrong-schema primary receipt — or a receipt whose own verdict is — is (exit 4); a receipt, a contradictory / tampered / unreadable related record, a blocked source chain, or a escalation is (exit 4); a receipt or an advisory finalization-index window is (exit 3); an receipt, a missing required related record, or an inconclusive source chain is (exit 2); a usable, receipt with every supplied related record coherent is (exit 0). / / make a related record mandatory; escalates an OPEN closeout to a hard block, never weakening the / precedence. ///; exits closed / usage / incomplete / open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index --file=<older> --file=<newer> (alias --closeout=, or --stdin) INDEXES a bounded HISTORY of Phase 84 pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout/1 closeout records (a sprint / quarter of finalization-index-trend follow-up loops, oldest first / newest last). It re-validates each closeout against itself (re-deriving its Phase 84 coverage rollup from its own recorded primary-receipt facets + per-kind related-record signals + source-chain posture + policy, mirroring the Phase 84 computeCloseout reducer, so a hand-flipped closeout verdict / exit / rollup — or a flipped receipt / source-chain posture signal — is caught as a tamper), reduces every record to bounded enums / small counts / booleans (dropping prose / stamps / paths), and folds the recent postures into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index/1 summary: an index verdict (indexed/index-open/index-incomplete/index-blocked/index-invalid), the closeout-verdict distribution, a bounded summary of the newest usable closeout, a per-record posture sequence, bounded reasons, an ordered nextActions checklist, and a content-free receipt — answering "across the recent finalization-index-trend follow-up-loop closeouts, is the latest loop closed and the recent history coherent, or is anything open / incomplete / blocked / untrustworthy?" It is LATEST-FOCUSED and FAILS CLOSED with precedence invalid > blocked > open > incomplete > indexed: any tampered / unreadable record is index-invalid (exit 4, the TOP precedence, never a vacuous indexed); a blocked / invalid-posture latest / any blocked-or-invalid record, or a --strict-open escalation, is index-blocked (exit 4); an incomplete latest / --max-incomplete breach / --require-latest-closed miss, or zero usable records, is index-incomplete (exit 2); an open latest / --max-open breach is index-open (exit 3); a coherent all-closed history within thresholds is indexed (exit 0). --max-closeouts=N (default 26, hard max 104) bounds the window (older records dropped, the count surfaced); / (each default 0) tolerate a bounded number of non-closed OLDER records; demands a closed latest; escalates an open index to a hard block. ///; exits indexed / usage / incomplete / open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend --file=<older> --file=<newer> (alias --index=, or --stdin for a JSON array / NDJSON / single window) SUMMARIZES a bounded HISTORY of Phase 85 pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index/1 windows (a quarter / year of closeout-index summaries, oldest first / newest last) into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend/1 trend. It re-validates each window against itself (re-deriving its Phase 85 index verdict from its own recorded coverage + distribution + policy AND re-checking those counts against the window's own per-record sequence + window arithmetic, so a hand-flipped index — or a lied count consistent with it — is caught as a tamper), reduces every window to bounded enums / small counts / booleans (dropping prose / stamps / paths), and folds the recent postures into a trend verdict (improving/stable/watch/degrading/insufficient/blocked/invalid), the per-window index-verdict distribution, the aggregate closeout distribution, a bounded summary of the newest usable window, a per-window posture sequence, an arc direction + 8-value trend class, bounded reasons, an ordered nextActions list, and a content-free receipt — answering "over the recent closeout-index windows, is the closeout-index posture improving / stable, watch / degrading, insufficient, or blocked, and what follow-up is warranted?" It is LATEST-FOCUSED and FAILS CLOSED with precedence invalid > blocked > insufficient > advisory > informational, refined by the ordered arc: any tampered / unreadable window is invalid (exit 4, the TOP precedence, never a vacuous stable); an index-blocked / index-invalid window over --max-blocked (or as the latest), or a --strict-watch escalation, is blocked (exit 4); zero usable windows, an index-incomplete latest, or an --max-incomplete breach is insufficient (exit 2); an index-open latest or a degrading arc is degrading, and a --max-watch breach under a clean latest is watch (exit 3); a recovering arc to a clean latest is and an all- history within thresholds is (exit 0). (default 26, hard max 104) bounds the window (older windows dropped, the count surfaced); / / (each default 0) tolerate a bounded number of non- windows; escalates a watch / degrading trend to a hard block; demands an latest. Direction is derived from ORDERED INPUT POSITIONS, never a timestamp. ///; exits stable/improving / usage / insufficient / watch/degrading / blocked/invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-action-plan --trend=<path> (alias --file=, or --stdin) ingests ONE content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend/1 trend (Phase 86), re-validates it against itself (re-deriving its Phase 86 trend verdict from its own recorded coverage + window distribution + arc summary via the Phase 86 computeTrendRollup reducer, AND re-checking that summary against the trend's own per-window posture sequence + window arithmetic, so a hand-flipped trend verdict — or a lied distribution consistent with it — is caught as a tamper), and translates its bounded verdict into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-action-plan/1 operator follow-up plan. It emits a plan verdict (clear/monitor/investigate/block-release/invalid), an urgency (routine/soon/high/immediate), an action class, the surfaced source trend verdict / class / arc / latest closeout-index posture, an ordered next-action checklist (plan — each item a stable id + an allowlisted label + bounded urgency / expectation enums), a compact nextActions id list, bounded reasons, and a content-free receipt — answering "given this content-free closeout-index trend, what bounded follow-up plan should an operator run next, and with what urgency?" It FAILS CLOSED: an unreadable / tampered trend input is invalid (exit 4, the top precedence, never weakened by a policy knob); a blocked or invalid-history trend is block-release (exit 4); an insufficient trend is investigate (exit 2); a watch / degrading trend is monitor (exit 3, soon / high); a stable / improving trend is clear (exit 0). --strict-watch escalates a monitor plan to block-release; --require-clean escalates EVERY non-clear plan to block-release; neither weakens the invalid precedence of an untrustworthy input. ///; exits clear / usage / investigate / monitor / block-release / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-action-receipt --plan=<path> (alias --file=, or --stdin) ingests ONE content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-action-plan/1 follow-up plan (Phase 87) plus a small set of bounded operator acknowledgement flags, re-validates the plan against itself (reconstructing its Phase 87 bounded decision from the source-trend facets it recorded and re-running the Phase 87 computeActionPlan reducer, requiring the recorded plan verdict / urgency / action class / exit code / reason SET to re-derive, so a hand-flipped plan is caught as a tamper), and records whether the operator provided the acknowledgements required to close it out or hold it: ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-action-receipt/1 document. It emits a receipt verdict (completed/incomplete/followup-open/blocked/invalid), the resolved plan class (clear/monitor/investigate/block), a bounded acknowledgement checklist (required / supplied / satisfied / contradictory), bounded reasons, a compact nextActions id list, and a content-free receipt — answering "given this content-free closeout-index trend action plan, did the operator provide the bounded acknowledgements required to close it out or hold it, and what is the resulting receipt posture?" The acknowledgement flags are booleans only (no note / actor): --ack-plan (alias --ack-reviewed, required for every usable class), --ack-clear (a clear plan accepted for routine monitoring), --ack-monitor / --ack-investigation (their class follow-up), and --ack-block (the release remains BLOCKED, required for a block plan); each plan class has exactly ONE class acknowledgement, and supplying one that does not match the plan's class is a contradiction. It FAILS CLOSED: a missing / unreadable / tampered / wrong-schema plan is invalid (exit 4); an unacknowledged block plan (a block-release plan, or a plan whose own verdict is invalid), a contradictory acknowledgement, or a --strict-open escalation is blocked (exit 4); a / plan reviewed but its follow-up unacknowledged is (exit 3); a missing required acknowledgement is (exit 2); a usable plan with its class's required acknowledgements is (exit 0) — and even a completed block plan records the release as HELD, never promoted. ///; exits completed / usage / incomplete / followup-open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout --receipt=<path> (alias --file=, or --stdin) CLOSES OUT the finalize-index-trend-finalize-index-trend-closeout-index-trend follow-up loop. It ingests ONE required content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-action-receipt/1 action-plan execution receipt (Phase 88) plus, optionally, the related records already on hand — the Phase 87 follow-up plan (--plan), the Phase 86 finalize-index trend (--trend), and the Phase 85 closeout-index window (--index) — re-validates the primary receipt against itself (reconstructing its Phase 88 bounded plan-ingest from the source facets it recorded and re-running the Phase 88 computeReceipt reducer, requiring the recorded receipt verdict / ack coverage / exit code to re-derive, so a hand-flipped receipt is caught as a tamper), cross-checks each supplied plan / trend against what the receipt recorded (a swapped / edited record is a contradiction), and folds the closeout-index window's own posture as a source-chain signal: ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout/1 document. It emits a closeout verdict (closed/open/incomplete/blocked/invalid), a bounded coverage summary (required / usable / missing / tampered / unreadable / coherent / contradictory counts), a source-chain checklist, bounded reasons, a compact nextActions id list, and a content-free receipt — answering "given this content-free finalization-index-trend follow-up receipt and optional related records, is this follow-up loop CLOSED, still OPEN, INCOMPLETE, BLOCKED, or untrustworthy?" It FAILS CLOSED with precedence invalid > blocking > open > incomplete > informational: a missing / unreadable / tampered / wrong-schema primary receipt — or a receipt whose own verdict is invalid — is invalid (exit 4); a blocked receipt, a contradictory / tampered / unreadable related record, a blocked source chain, or a --strict-open escalation is blocked (exit 4); a followup-open receipt or an advisory closeout-index window is open (exit 3); an incomplete receipt, a missing required related record, or an inconclusive source chain is (exit 2); a usable, receipt with every supplied related record coherent is (exit 0). / / make a related record mandatory; escalates an OPEN closeout to a hard block, never weakening the / precedence. ///; exits closed / usage / incomplete / open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index --file=<older> --file=<newer> (repeatable; alias --closeout=, or --stdin for a JSON array / NDJSON) INDEXES a bounded WINDOW of Phase 89 pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout/1 closeout records into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index/1 review summary. It RE-VALIDATES each record against ITSELF (re-deriving its Phase 89 coverage rollup from its own recorded primary-receipt facets + related-record signals + source-chain posture + policy, so a hand-flipped closeout verdict / exit / rollup is caught as a tamper), drops every prose / stamp / path, and folds only bounded facets into a coverage summary (supplied / considered / usable / unreadable / tampered / dropped), a closeout-verdict distribution, a bounded latest summary of the newest usable record, a per-record points posture sequence, bounded reasons, an ordered nextActions checklist, and a content-free receipt — answering "across the supplied closeout window, is the closeout-index-trend follow-up loop consistently CLOSED, still OPEN/INCOMPLETE, BLOCKED, or untrustworthy?" It is LATEST-FOCUSED and FAILS CLOSED with precedence invalid > blocked > open > incomplete > all-closed: a tampered / unreadable / wrong-schema record, a usable record whose OWN verdict is invalid, or zero usable records is invalid (exit 4); any blocked record is blocked (exit 4); an open latest or an older open count above --max-open is open (exit 3); an incomplete latest or an older incomplete count above --max-incomplete is incomplete (exit 2); every supplied record closed within thresholds is all-closed (exit 0). --max-closeouts=<N> (default 26) caps the window (older records dropped, count surfaced); --strict-open escalates any open OR incomplete window to a hard block. --json/--text/--pretty/--output; exits 0 all-closed / 1 usage / 2 incomplete / open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend --file=<older> --file=<newer> (repeatable; alias --index=, or --stdin for a JSON array / NDJSON) SUMMARIZES a bounded HISTORY of Phase 90 pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index/1 closeout-index windows (oldest first, newest last) into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend/1 trend summary. It RE-VALIDATES each window against ITSELF (re-deriving its Phase 90 index rollup + coverage + distribution from its own recorded facets, so a hand-flipped index verdict is caught as a tamper), drops every prose / stamp / path, and folds only bounded facets into a per-window index-verdict distribution, an aggregate closeout distribution, a bounded latest summary of the newest usable window, a per-window points posture sequence, an arc direction + trend class, bounded reasons, an ordered nextActions checklist, and a content-free receipt — answering "across the recent closeout-index windows, is the release-decision closeout-index posture improving, stable, watch-worthy, degrading, insufficient, blocked, or untrustworthy?" It is LATEST-FOCUSED and FAILS CLOSED with precedence invalid > blocked > insufficient, then a directional band: a tampered / unreadable / wrong-schema window is invalid (exit 4); a blocked / invalid window over --max-blocked or as latest, or a --strict-open escalation, is blocked (exit 4); zero usable windows, an incomplete latest, or an older --max-incomplete breach is insufficient (exit 2); an open latest or a degrading arc is degrading and an older open count above --max-open under a clean latest is watch (exit 3); a recovering arc to a clean latest is improving and a fully all-closed history within thresholds is stable (exit 0). --max-indexes=<N> (default 26) caps the history (older windows dropped, count surfaced); --strict-open escalates any watch / degrading / insufficient trend to a hard block; demands an latest. ///; exits stable/improving / usage / insufficient / watch/degrading / blocked/invalid. Direction is derived from ORDERED INPUT POSITIONS (oldest first, newest last), never from any ingested timestamp. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-action-plan --trend=<path> (alias --file=, or --stdin) ingests ONE content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend/1 trend (Phase 91), re-validates it against itself (re-deriving its Phase 91 trend verdict from its own recorded coverage + window distribution + arc summary via the Phase 91 computeTrendRollup reducer, AND re-checking that summary against the trend's own per-window posture sequence + window arithmetic, so a hand-flipped trend verdict — or a lied distribution consistent with it — is caught as a tamper), and translates its bounded verdict into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-action-plan/1 operator follow-up plan. It emits a plan verdict (clear/monitor/investigate/block-release/invalid), an urgency (routine/soon/high/immediate), an action class, the surfaced source trend verdict / class / arc / latest closeout-index posture, an ordered next-action checklist (plan — each item a stable id + an allowlisted label + bounded urgency / expectation enums, capped by --max-actions with the dropped count surfaced), a compact nextActions id list, bounded reasons, and a content-free receipt — answering "given this content-free closeout-index-trend, what bounded follow-up plan should an operator run next, and with what urgency?" It FAILS CLOSED: an unreadable / tampered trend input, or a trend whose OWN verdict is invalid (an untrustworthy window in its history), is invalid (exit 4, the top precedence, never weakened by a policy knob); a blocked trend is block-release (exit 4); an insufficient trend is investigate (exit 2); an improving / watch / degrading trend is monitor (exit 3); a stable trend is clear (exit 0). --strict escalates EVERY non-clear (monitor / investigate) plan to block-release, never weakening the precedence of an untrustworthy input; (default 8, hard max 20) caps the checklist, surfacing the dropped count. ///; exits clear / usage / investigate / monitor / block-release / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-action-receipt --plan=<path> (alias --file=, or --stdin) ingests ONE content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-action-plan/1 follow-up plan (Phase 92) plus a small set of bounded operator acknowledgement flags, re-validates the plan against itself (reconstructing its Phase 92 bounded decision from the source-trend facets it recorded and re-running the Phase 92 computeActionPlan reducer, requiring the recorded plan verdict / urgency / action class / exit code / reason SET to re-derive, so a hand-flipped plan is caught as a tamper), and records whether the operator provided the acknowledgements required to close it out or hold it: ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-action-receipt/1 document. It emits a receipt verdict (completed/incomplete/followup-open/blocked/invalid), the resolved plan class (clear/monitor/investigate/block), a bounded acknowledgement checklist (required / supplied / satisfied / contradictory), bounded reasons, a compact nextActions id list, and a content-free receipt — answering "given this content-free closeout-index trend action plan, did the operator provide the bounded acknowledgements required to close it out or hold it, and what is the resulting receipt posture?" The acknowledgement flags are booleans only (no note / actor): --ack-plan (alias --ack-reviewed, required for every usable class), --ack-clear (a clear plan accepted for routine monitoring), --ack-monitor / --ack-investigation (their class follow-up), and --ack-block (the release remains BLOCKED, required for a block plan); each plan class has exactly ONE class acknowledgement, and supplying one that does not match the plan's class is a contradiction. It FAILS CLOSED: a missing / unreadable / tampered / wrong-schema plan is invalid (exit 4); an unacknowledged block plan (a block-release plan, or a plan whose own verdict is invalid), a contradictory acknowledgement, or a --strict-open escalation is (exit 4); a / plan reviewed but its follow-up unacknowledged is (exit 3); a missing required acknowledgement is (exit 2); a usable plan with its class's required acknowledgements is (exit 0) — and even a completed block plan records the release as HELD, never promoted. ///; exits completed / usage / incomplete / followup-open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout --receipt=<path> (alias --file=, or --stdin) composes ONE content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-action-receipt/1 action-plan execution receipt (Phase 93) plus OPTIONAL related records already on hand — the …-closeout-index-trend-closeout-index-trend-action-plan/1 plan (Phase 92, --plan) the receipt receipted and the …-closeout-index-trend-closeout-index-trend/1 trend (Phase 91, --trend) the plan planned over — into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout/1 closeout bundle. It RE-VALIDATES the primary receipt against itself (reconstructing its Phase 93 bounded plan-ingest from the source facets it recorded and re-running the Phase 93 computeReceipt reducer, so a hand-flipped receipt verdict / ack coverage / exit code is caught as a tamper) and CROSS-CHECKS the supplied related records against what the receipt recorded, then emits a closeout verdict (closed/open/incomplete/blocked/invalid), a bounded primary-receipt summary, a bounded related-record checklist, a bounded source-chain posture, bounded reasons, a compact nextActions id list, and a content-free receipt — answering "does this content-free closeout-index-trend follow-up receipt (plus the supplied related records) coherently close the loop?" Make a related record MANDATORY with --require-plan / --require-trend (its absence ⇒ incomplete); --strict-open escalates an OPEN closeout to a hard block. It FAILS CLOSED: a missing / unreadable / tampered / wrong-schema receipt (or an invalid receipt verdict), or a supplied related record that contradicts the receipt / is tampered / is unreadable (an incoherent chain), is invalid (exit 4); a blocked receipt or a --strict-open escalation is blocked (exit 4); a followup-open receipt is open (exit 3); an incomplete receipt or a missing required related record is incomplete (exit 2); a usable, receipt with coherent related records is (exit 0). ///; exits closed / usage / incomplete / open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index --file=<older> --file=<newer> (repeatable; alias --closeout=, or --stdin for a JSON array / NDJSON) INDEXES a bounded WINDOW of Phase 94 pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout/1 closeout records into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index/1 review summary. It RE-VALIDATES each record against ITSELF (re-deriving its Phase 94 coverage rollup from its own recorded primary-receipt facets + related-record signals + source-chain posture + policy, so a hand-flipped closeout verdict / exit / rollup is caught as a tamper), drops every prose / stamp / path, and folds only bounded facets into a coverage summary (supplied / considered / usable / unreadable / tampered / dropped), a closeout-verdict distribution, a bounded latest summary of the newest usable record, a per-record points posture sequence, bounded reasons, an ordered nextActions checklist, and a content-free receipt — answering "across the supplied closeout window, is the closeout-index-trend follow-up loop consistently CLOSED, still OPEN/INCOMPLETE, BLOCKED, or untrustworthy?" It is LATEST-FOCUSED and FAILS CLOSED with precedence invalid > blocked > open > incomplete > all-closed: a tampered / unreadable / wrong-schema record, a usable record whose OWN verdict is invalid, or zero usable records is invalid (exit 4); any blocked record is blocked (exit 4); an open latest or an older open count above --max-open is open (exit 3); an incomplete latest or an older incomplete count above --max-incomplete is incomplete (exit 2); every supplied record closed within thresholds is all-closed (exit 0). --max-closeouts=<N> (default 26) caps the window (older records dropped, count surfaced); --strict-open escalates any open OR incomplete window to a hard block. --json/--text/--pretty/--output; exits 0 all-closed / usage / incomplete / open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend --file=<older> --file=<newer> (repeatable; alias --index=, or --stdin for a JSON array / NDJSON) SUMMARIZES a bounded HISTORY of Phase 95 pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index/1 closeout-index windows (oldest first, newest last) into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend/1 trend summary. It RE-VALIDATES each window against ITSELF (re-deriving its Phase 95 index rollup + coverage + distribution from its own recorded facets, so a hand-flipped index verdict is caught as a tamper), drops every prose / stamp / path, and folds only bounded facets into a per-window index-verdict distribution, an aggregate closeout distribution, a bounded latest summary of the newest usable window, a per-window points posture sequence, an arc direction + trend class, bounded reasons, an ordered nextActions checklist, and a content-free receipt — answering "across the recent closeout-index windows, is the release-decision closeout-index posture improving, stable, watch-worthy, degrading, insufficient, blocked, or untrustworthy?" It is LATEST-FOCUSED and FAILS CLOSED with precedence invalid > blocked > insufficient, then a directional band: a tampered / unreadable / wrong-schema window is invalid (exit 4); a blocked / invalid window over --max-blocked or as latest, or a --strict-open escalation, is blocked (exit 4); zero usable windows, an incomplete latest, or an older --max-incomplete breach is insufficient (exit 2); an open latest or a degrading arc is degrading and an older open count above --max-open under a clean latest is watch (exit 3); a recovering arc to a clean latest is improving and a fully all-closed history within thresholds is stable (exit 0). --max-indexes=<N> (default 26) caps the history (older windows dropped, count surfaced); --strict-open escalates any watch / degrading / insufficient trend to a hard block; demands an latest. ///; exits stable/improving / usage / insufficient / watch/degrading / blocked/invalid. Direction is derived from ORDERED INPUT POSITIONS (oldest first, newest last), never from any ingested timestamp. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-action-plan --trend=<path> (alias --file=, or --stdin) ingests ONE content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend/1 trend (Phase 96), re-validates it against itself (re-deriving its Phase 96 trend verdict from its own recorded coverage + window distribution + arc summary via the Phase 96 computeTrendRollup reducer, AND re-checking that summary against the trend's own per-window posture sequence + window arithmetic, so a hand-flipped trend verdict — or a lied distribution consistent with it — is caught as a tamper), and translates its bounded verdict into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-action-plan/1 operator follow-up plan. It emits a plan verdict (clear/monitor/investigate/block-release/invalid), an urgency (routine/soon/high/immediate), an action class, the surfaced source trend verdict / class / arc / latest closeout-index posture, an ordered next-action checklist (plan — each item a stable id + an allowlisted label + bounded urgency / expectation enums, capped by --max-actions with the dropped count surfaced), a compact nextActions id list, bounded reasons, and a content-free receipt — answering "given this content-free closeout-index-trend, what bounded follow-up plan should an operator run next, and with what urgency?" It FAILS CLOSED: an unreadable / tampered trend input, or a trend whose OWN verdict is invalid (an untrustworthy window in its history), is invalid (exit 4, the top precedence, never weakened by a policy knob); a blocked trend is block-release (exit 4); an insufficient trend is investigate (exit 2); an improving / watch / degrading trend is monitor (exit 3); a stable trend is clear (exit 0). --strict escalates EVERY non-clear (monitor / investigate) plan to , never weakening the precedence of an untrustworthy input; (default 8, hard max 20) caps the checklist, surfacing the dropped count. ///; exits clear / usage / investigate / monitor / block-release / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-action-receipt --plan=<path> (alias --file=, or --stdin) ingests ONE content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-action-plan/1 follow-up plan (Phase 97) plus a small set of bounded operator acknowledgement flags, re-validates the plan against itself (reconstructing its Phase 97 bounded decision from the source-trend facets it recorded and re-running the Phase 97 computeActionPlan reducer, requiring the recorded plan verdict / urgency / action class / exit code / reason SET to re-derive, so a hand-flipped plan is caught as a tamper), and records whether the operator provided the acknowledgements required to close it out or hold it: ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-action-receipt/1 document. It emits a receipt verdict (completed/incomplete/followup-open/blocked/invalid), the resolved plan class (clear/monitor/investigate/block), a bounded acknowledgement checklist (required / supplied / satisfied / contradictory), bounded reasons, a compact nextActions id list, and a content-free receipt — answering "given this content-free closeout-index trend action plan, did the operator provide the bounded acknowledgements required to close it out or hold it, and what is the resulting receipt posture?" The acknowledgement flags are booleans only (no note / actor): --ack-plan (alias --ack-reviewed, required for every usable class), --ack-clear (a clear plan accepted for routine monitoring), --ack-monitor / --ack-investigation (their class follow-up), and --ack-block (the release remains BLOCKED, required for a block plan); each plan class has exactly ONE class acknowledgement, and supplying one that does not match the plan's class is a contradiction. It FAILS CLOSED: a missing / unreadable / tampered / wrong-schema plan is invalid (exit 4); an unacknowledged block plan (a block-release plan, or a plan whose own verdict is invalid), a contradictory acknowledgement, or a escalation is (exit 4); a / plan reviewed but its follow-up unacknowledged is (exit 3); a missing required acknowledgement is (exit 2); a usable plan with its class's required acknowledgements is (exit 0) — and even a completed block plan records the release as HELD, never promoted. ///; exits completed / usage / incomplete / followup-open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout --receipt=<path> (alias --file=, or --stdin) composes ONE content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-action-receipt/1 action-plan execution receipt (Phase 98) plus OPTIONAL related records already on hand — the …-closeout-index-trend-closeout-index-trend-action-plan/1 plan (Phase 97, --plan) the receipt receipted and the …-closeout-index-trend-closeout-index-trend/1 trend (Phase 96, --trend) the plan planned over — into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout/1 closeout bundle. It RE-VALIDATES the primary receipt against itself (reconstructing its Phase 98 bounded plan-ingest from the source facets it recorded and re-running the Phase 98 computeReceipt reducer, so a hand-flipped receipt verdict / ack coverage / exit code is caught as a tamper) and CROSS-CHECKS the supplied related records against what the receipt recorded, then emits a closeout verdict (closed/open/incomplete/blocked/invalid), a bounded primary-receipt summary, a bounded related-record checklist, a bounded source-chain posture, bounded reasons, a compact nextActions id list, and a content-free receipt — answering "does this content-free closeout-index-trend follow-up receipt (plus the supplied related records) coherently close the loop?" Make a related record MANDATORY with --require-plan / --require-trend (its absence ⇒ incomplete); --strict-open escalates an OPEN closeout to a hard block. It FAILS CLOSED: a missing / unreadable / tampered / wrong-schema receipt (or an invalid receipt verdict), or a supplied related record that contradicts the receipt / is tampered / is unreadable (an incoherent chain), is invalid (exit 4); a blocked receipt or a --strict-open escalation is blocked (exit 4); a followup-open receipt is open (exit 3); an incomplete receipt or a missing required related record is (exit 2); a usable, receipt with coherent related records is (exit 0). ///; exits closed / usage / incomplete / open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index --file=<older> --file=<newer> (repeatable; alias --closeout=, or --stdin for a JSON array / NDJSON) INDEXES a bounded WINDOW of Phase 99 pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout/1 closeout records into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index/1 review summary. It RE-VALIDATES each record against ITSELF (re-deriving its Phase 99 coverage rollup from its own recorded primary-receipt facets + related-record signals + source-chain posture + policy, so a hand-flipped closeout verdict / exit / rollup is caught as a tamper), drops every prose / stamp / path, and folds only bounded facets into a coverage summary (supplied / considered / usable / unreadable / tampered / dropped), a closeout-verdict distribution, a bounded latest summary of the newest usable record, a per-record points posture sequence, bounded reasons, an ordered nextActions checklist, and a content-free receipt — answering "across the supplied closeout window, is the closeout-index-trend follow-up loop consistently CLOSED, still OPEN/INCOMPLETE, BLOCKED, or untrustworthy?" It is LATEST-FOCUSED and FAILS CLOSED with precedence invalid > blocked > open > incomplete > all-closed: a tampered / unreadable / wrong-schema record, a usable record whose OWN verdict is invalid, or zero usable records is invalid (exit 4); any blocked record is blocked (exit 4); an open latest or an older open count above --max-open is open (exit 3); an incomplete latest or an older incomplete count above --max-incomplete is incomplete (exit 2); every supplied record closed within thresholds is all-closed (exit 0). --max-closeouts=<N> (default 26) caps the window (older records dropped, count surfaced); --strict-open escalates any open OR incomplete window to a hard block. --json/--text/--pretty/--output; exits all-closed / usage / incomplete / open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend --file=<older> --file=<newer> (repeatable; alias --index=, or --stdin for a JSON array / NDJSON) SUMMARIZES a bounded HISTORY of Phase 100 pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index/1 closeout-index windows (oldest first, newest last) into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend/1 trend summary. It RE-VALIDATES each window against ITSELF (re-deriving its Phase 100 index rollup + coverage + distribution from its own recorded facets, so a hand-flipped index verdict is caught as a tamper), drops every prose / stamp / path, and folds only bounded facets into a per-window index-verdict distribution, an aggregate closeout distribution, a bounded latest summary of the newest usable window, a per-window points posture sequence, an arc direction + trend class, bounded reasons, an ordered nextActions checklist, and a content-free receipt — answering "across the recent closeout-index windows, is the release-decision closeout-index posture improving, stable, watch-worthy, degrading, insufficient, blocked, or untrustworthy?" It is LATEST-FOCUSED and FAILS CLOSED with precedence invalid > blocked > insufficient, then a directional band: a tampered / unreadable / wrong-schema window is invalid (exit 4); a blocked / invalid window over --max-blocked or as latest, or a --strict-open escalation, is blocked (exit 4); zero usable windows, an incomplete latest, or an older --max-incomplete breach is insufficient (exit 2); an open latest or a degrading arc is degrading and an older open count above --max-open under a clean latest is watch (exit 3); a recovering arc to a clean latest is improving and a fully all-closed history within thresholds is stable (exit 0). --max-indexes=<N> (default 26) caps the history (older windows dropped, count surfaced); escalates any watch / degrading / insufficient trend to a hard block; demands an latest. ///; exits stable/improving / usage / insufficient / watch/degrading / blocked/invalid. Direction is derived from ORDERED INPUT POSITIONS (oldest first, newest last), never from any ingested timestamp. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-action-plan --trend=<path> (alias --file=, or --stdin) ingests ONE content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend/1 trend (Phase 101), re-validates it against itself (re-deriving its Phase 101 trend verdict from its own recorded coverage + window distribution + arc summary via the Phase 101 computeTrendRollup reducer, AND re-checking that summary against the trend's own per-window posture sequence + window arithmetic, so a hand-flipped trend verdict — or a lied distribution consistent with it — is caught as a tamper), and translates its bounded verdict into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-action-plan/1 operator follow-up plan. It emits a plan verdict (clear/monitor/investigate/block-release/invalid), an urgency (routine/soon/high/immediate), an action class, the surfaced source trend verdict / class / arc / latest closeout-index posture, an ordered next-action checklist (plan — each item a stable id + an allowlisted label + bounded urgency / expectation enums, capped by --max-actions with the dropped count surfaced), a compact nextActions id list, bounded reasons, and a content-free receipt — answering "given this content-free closeout-index-trend, what bounded follow-up plan should an operator run next, and with what urgency?" It FAILS CLOSED: an unreadable / tampered trend input, or a trend whose OWN verdict is invalid (an untrustworthy window in its history), is invalid (exit 4, the top precedence, never weakened by a policy knob); a blocked trend is block-release (exit 4); an insufficient trend is investigate (exit 2); an improving / watch / degrading trend is monitor (exit 3); a stable trend is clear (exit 0). --strict escalates EVERY non-clear (monitor / investigate) plan to , never weakening the precedence of an untrustworthy input; (default 8, hard max 20) caps the checklist, surfacing the dropped count. ///; exits clear / usage / investigate / monitor / block-release / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-action-receipt --plan=<path> (alias --file=, or --stdin) ingests ONE content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-action-plan/1 follow-up plan (Phase 102) plus a small set of bounded operator acknowledgement flags, re-validates the plan against itself (reconstructing its Phase 102 bounded decision from the source-trend facets it recorded and re-running the Phase 102 computeActionPlan reducer, requiring the recorded plan verdict / urgency / action class / exit code / reason SET to re-derive, so a hand-flipped plan is caught as a tamper), and records whether the operator provided the acknowledgements required to close it out or hold it: ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-action-receipt/1 document. It emits a receipt verdict (completed/incomplete/followup-open/blocked/invalid), the resolved plan class (clear/monitor/investigate/block), a bounded acknowledgement checklist (required / supplied / satisfied / contradictory), bounded reasons, a compact nextActions id list, and a content-free receipt — answering "given this content-free closeout-index trend action plan, did the operator provide the bounded acknowledgements required to close it out or hold it, and what is the resulting receipt posture?" The acknowledgement flags are booleans only (no note / actor): --ack-plan (alias --ack-reviewed, required for every usable class), --ack-clear (a clear plan accepted for routine monitoring), --ack-monitor / --ack-investigation (their class follow-up), and --ack-block (the release remains BLOCKED, required for a block plan); each plan class has exactly ONE class acknowledgement, and supplying one that does not match the plan's class is a contradiction. It FAILS CLOSED: a missing / unreadable / tampered / wrong-schema plan is invalid (exit 4); an unacknowledged block plan (a block-release plan, or a plan whose own verdict is ), a contradictory acknowledgement, or a escalation is (exit 4); a / plan reviewed but its follow-up unacknowledged is (exit 3); a missing required acknowledgement is (exit 2); a usable plan with its class's required acknowledgements is (exit 0) — and even a completed block plan records the release as HELD, never promoted. ///; exits completed / usage / incomplete / followup-open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout --receipt=<path> (alias --file=, or --stdin) composes ONE content-free pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-action-receipt/1 action-plan execution receipt (Phase 103) plus OPTIONAL related records already on hand — the …-closeout-index-trend-closeout-index-trend-action-plan/1 plan (Phase 102, --plan) the receipt receipted and the …-closeout-index-trend-closeout-index-trend/1 trend (Phase 101, --trend) the plan planned over — into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout/1 closeout bundle. It RE-VALIDATES the primary receipt against itself (reconstructing its Phase 103 bounded plan-ingest from the source facets it recorded and re-running the Phase 103 computeReceipt reducer, so a hand-flipped receipt verdict / ack coverage / exit code is caught as a tamper) and CROSS-CHECKS the supplied related records against what the receipt recorded, then emits a closeout verdict (closed/open/incomplete/blocked/invalid), a bounded primary-receipt summary, a bounded related-record checklist, a bounded source-chain posture, bounded reasons, a compact nextActions id list, and a content-free receipt — answering "does this content-free closeout-index-trend follow-up receipt (plus the supplied related records) coherently close the loop?" Make a related record MANDATORY with --require-plan / --require-trend (its absence ⇒ incomplete); --strict-open escalates an OPEN closeout to a hard block. It FAILS CLOSED: a missing / unreadable / tampered / wrong-schema receipt (or an invalid receipt verdict), or a supplied related record that contradicts the receipt / is tampered / is unreadable (an incoherent chain), is invalid (exit 4); a blocked receipt or a --strict-open escalation is blocked (exit 4); a followup-open receipt is open (exit 3); an receipt or a missing required related record is (exit 2); a usable, receipt with coherent related records is (exit 0). ///; exits closed / usage / incomplete / open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index --file=<older> --file=<newer> (repeatable; alias --closeout=, or --stdin for a JSON array / NDJSON) INDEXES a bounded WINDOW of Phase 104 pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout/1 closeout records into ONE stable pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index/1 review summary. It RE-VALIDATES each record against ITSELF (re-deriving its Phase 104 coverage rollup from its own recorded primary-receipt facets + related-record signals + source-chain posture + policy, so a hand-flipped closeout verdict / exit / rollup is caught as a tamper), drops every prose / stamp / path, and folds only bounded facets into a coverage summary (supplied / considered / usable / unreadable / tampered / dropped), a closeout-verdict distribution, a bounded latest summary of the newest usable record, a per-record points posture sequence, bounded reasons, an ordered nextActions checklist, and a content-free receipt — answering "across the supplied closeout window, is the closeout-index-trend follow-up loop consistently CLOSED, still OPEN/INCOMPLETE, BLOCKED, or untrustworthy?" It is LATEST-FOCUSED and FAILS CLOSED with precedence invalid > blocked > open > incomplete > all-closed: a tampered / unreadable / wrong-schema record, a usable record whose OWN verdict is invalid, or zero usable records is invalid (exit 4); any blocked record is blocked (exit 4); an open latest or an older open count above --max-open is open (exit 3); an incomplete latest or an older incomplete count above --max-incomplete is incomplete (exit 2); every supplied record closed within thresholds is all-closed (exit 0). --max-closeouts=<N> (default 26) caps the window (older records dropped, count surfaced); --require-latest-closed (demand the newest usable record be closed, else incomplete) and escalates any open OR incomplete window to a hard block. ///; exits all-closed / usage / incomplete / open / blocked / invalid. It is a content-free — NOT a legal/compliance sign-off, an external approval/signature, an identity proof, a deployment authorization, a promotion ledger, an incident record, or an audit log — and it . Emits .
Phase 106 adds pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend --file=<older> --file=<newer> (repeatable; alias --index=, or --stdin for JSON array / NDJSON) to summarize a bounded history of Phase 105 closeout-index windows into one pdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend/1 content-free trend. It re-validates each Phase 105 index against itself, derives direction only from ordered input position, emits bounded verdicts (stable, improving, watch, degrading, insufficient, blocked, invalid), and never approves, signs, deploys, notifies, promotes, archives, deletes, or mutates anything. Fixtures live under docs/examples/release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend-closeout-index-trend/ and are wired into deployment-example validation.
docs/RUNBOOK.mdpnpm worker:artifact-cleanup | Storage-artifact cleanup dry-run sweeper (Phase 42): categorize an offline, content-free inventory of PRESENT object metadata into expired-but-present/deleted-but-present/missing-lifecycle/missing-manifest/unsupported-kind/storage-unavailable/ok, with an optional content-free cleanup plan (counts + actions only). Sources --stdin/--file; formats --json/--text (--plan/--breakdown/--metrics); exits 0 clean / 1 usage / 2 unknown / 3 cleanup-recommended / 4 invalid·breached. Dry-run only — never lists a real bucket, never deletes — see docs/RUNBOOK.md |
pnpm worker:cleanup-project | Cleanup evidence exporter / projector (Phase 43): the safe bridge into the two tools above. Projects your own out-of-band raw provider export (aws s3api list-objects-v2/head-object, or a normalized dump) into a content-free --target=evidence (for worker:cleanup-check) or --target=inventory (for worker:artifact-cleanup) document, reading ONLY a bounded allowlist and dropping every object key/bucket/URL/endpoint/id/ETag/filename/user-metadata. A redaction/normalization helper — not proof of deletion, not a cloud scanner: it makes no cloud call and deletes nothing. Sources --stdin/--file; `--source=aws-s3 |
pnpm worker:cleanup-pipeline | Cleanup evidence pipeline (Phase 44): the one fail-closed command that composes the three tools above. Reads your out-of-band raw export once, projects it into both shapes, runs the absence verifier and the dry-run sweeper internally, and rolls the two arms into ONE composite exit code. Read-only, no cloud call, deletes nothing. Sources --stdin/--file; --source=aws-s3|generic; --grace-hours=N; formats --json/--text; embeds a content-free receipt; exits 0 ok / 1 usage / 2 unknown / 3 drift / 4 breach — see docs/RUNBOOK.md |
pnpm worker:ops-bundle | Operations evidence bundle (Phase 45): compose an existing content-free worker:ops-check --json result plus an optional worker:cleanup-pipeline --json summary into one safe pdfxyz.ops-bundle/1 support/incident artifact. Reads --stdin or --operations-file/--ops-check, optional --pipeline, formats --json/--text, optional --output/--pretty; exits 0 ok / 1 usage / 2 unknown / 3 warn / 4 critical. Aggregator only: no cloud call, no raw provider export, no deletion, no paths/object IDs in output. |
pnpm worker:release-gate | Release readiness gate (Phase 46): RUN the existing checks (deploy-examples, smoke, engines, ops-check/ops-bundle fixtures, cleanup-pipeline, lifecycle-verify) as subprocesses and read ONLY their exit codes — discarding all output — then fold to ONE verdict. --only/--skip scope by check id, --json/--text; exits 0 pass / 1 usage / 2 unknown / 3 warn / 4 fail. Structurally content-free (never parses stdout); local/offline/read-only; no cloud call, no deletion, no promotion. |
pnpm worker:smoke | No-config honesty smoke: asserts the daemon refuses to fake work (exit 2), rejects bad flags (exit 1), reports clean guardrails (exit 0), and fails fast on a dangerous config (exit 4) — no secrets or network. Also run inside the built worker image in CI |
pnpm worker:image-smoke | Image-level native-engine + OCR proof — run inside the built worker image in CI: the deep-compression + OCR binaries and English OCR data are installed, PDFXYZ_OCR=on flips ocr_health→ready, and native engines never fake drainability. Presence-only; no cloud/secret/document |
pnpm worker:engines | Node-free command -v engine preflight (0 ok / 1 usage / 3 a required engine is missing). Honors the opt-in require-flags; runs anywhere, in or out of the image. Presence-only, content-free |
pnpm worker:ocr-proof | Deterministic OCR recognition proof (Phase 25): gs renders a synthetic sentinel raster, Tesseract OCRs it, the sidecar must contain the sentinel. 0 pass / 2 engine missing / 3 proof failed. Presence-only, content-free, self-cleaning; run inside the built worker image in CI. No document/cloud/secret |
pnpm worker:ocrmypdf-proof | Deterministic OCRmyPDF searchable-PDF proof (Phase 27): gs's pdfimage builds an image-only PDF, pdftotext confirms it has no selectable text, OCRmyPDF adds a text layer, and pdftotext confirms the output is searchable (+ sidecar). 0 pass / 2 tool missing (gs/ocrmypdf/pdftotext) / 3 proof failed. Presence-only, content-free, self-cleaning; run inside the built worker image in CI. No document/cloud/secret |
pnpm typecheck | tsc --noEmit (strict) |
pnpm lint | ESLint (flat config, eslint-config-next) |
pnpm test | Unit tests (Vitest, run once) |
pnpm test:watch | Unit tests in watch mode |
pnpm test:e2e | Playwright smoke tests against a production build |
pnpm test:e2e:install | Install the Chromium browser Playwright needs |
pnpm qa | typecheck → lint → test → build (the pre-push gate) |
pnpm format / pnpm format:check | Prettier write / check |
?job=ArtifactRetrievalBackendGET /api/artifacts/:artifactIdx-amz-meta-artifact-manifeststorage_error503 service_unavailablestorage_unavailable404not_foundproviderlocal-devremote-configurednot-configuredsrc/lib/workers/artifacts/delivery.tsContent-Lengthsize_mismatch503oversize503HEADRangeAccept-Ranges: noneRange200206416GETHEAD405503stream_error500worker_artifact_delivery_totalmethodrange200x-amz-meta-artifact-lifecycleexpiresAtartifacts/lifecycle.ts410 Goneunknownexpiredworker_artifact_expiry_total{state,provider}expireddeletedunknownpnpm worker:cleanup-checkabsent-activeabsent-backstopabsent-activeabsent-backstopretrieval-denieddriftliveunknownunavailableverifieddriftunknownunavailablenot-configurednot-configuredworker_cleanup_verification_total{verdict,provider}0123pnpm worker:artifact-cleanupexpired-but-presentdeleted-but-presentmissing-lifecyclemissing-manifestunsupported-kindstorage-unavailableokevaluateArtifactLifecycleunknownworker_artifact_cleanup_total{category,severity}01234pnpm worker:cleanup-projectaws s3api list-objects-v2head-object--target=evidence--target=inventory{expiresAtMs,deleted}locatorurlidentityintegritymetadata-blobunsafeworker_cleanup_projection_total{target,verdict}0124pnpm worker:cleanup-pipeline012340worker_cleanup_pipeline_total{arm,severity}cleanup-pipeline-notify.shsrc/lib/workers/cleanup-evidencePDFXYZ_CLEANUP_EVIDENCE_CHECK_REPORT_SWEEP_REPORTdisabledhealthystalewarningcriticalunknownnot-configuredinvalid/statusworker:ops-checkinvalidstaleworker_cleanup_evidence_posture{state,reason,provider}disabledworker_release_decision_index_total{verdict}invalidblockedinvalid--strictblocked--json--text--pretty--output--max-windows=N--strict01234worker_release_decision_trend_total{verdict}--pretty--output--max-actions=N--strict01234worker_release_decision_action_plan_total{verdict}34worker_release_decision_action_receipt_total{verdict}--output--strict-open01234worker_release_decision_closeout_total{verdict}--output--max-closeouts=N--max-open--max-incomplete--max-blocked--strict-open01234worker_release_decision_closeout_index_total{verdict}index-opentrend-watchindex-incompletetrend-incompleteindex-blocked--strict-watchtrend-blocked--json--text--pretty--output--max-indexes=N--max-watch--max-incomplete--max-blocked--strict-watch01234worker_release_decision_closeout_index_trend_total{verdict}worker_release_decision_closeout_action_plan_total{verdict}--text--pretty--output--strict-open01234worker_release_decision_closeout_action_receipt_total{verdict}closeout-opengovernance-open--json--text--pretty--output--strict-open01234worker_release_decision_closeout_governance_total{verdict}--text--pretty--output--max-governance=N--max-open--max-incomplete--max-blocked--strict-open01234worker_release_decision_closeout_governance_index_total{verdict}index-opentrend-watchindex-incompletetrend-incompleteindex-blocked--strict-watchtrend-blocked--json--text--pretty--output--max-indexes=N--max-open--max-incomplete--max-blocked--strict-watch01234worker_release_decision_closeout_governance_index_trend_total{verdict}worker_release_decision_closeout_governance_action_plan_total{verdict}--json--text--pretty--output--strict-open01234worker_release_decision_closeout_governance_action_receipt_total{verdict}finalize-open--json--text--pretty--output--strict-open01234worker_release_decision_closeout_governance_finalize_total{verdict}--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_total{verdict}index-opendegradingwatchindexedstableimproving--max-windows=N--require-latest-indexedindexed--json--text--pretty--output0123344worker_release_decision_closeout_governance_finalize_index_trend_total{verdict}--output012344worker_release_decision_closeout_governance_finalize_index_trend_action_plan_total{verdict}completed--strict-openincompleteblocked--json--text--pretty--output01244worker_release_decision_closeout_governance_finalize_index_trend_action_receipt_total{verdict}--require-index--require-finalization--strict-open--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_total{verdict}344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_total{verdict}insufficientindex-opendegradingwatchindexedstableimproving--max-windows=N--require-latest-indexedindexed--json--text--pretty--output0123344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_total{verdict}pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-action-plan --trend=<path>--file=--stdinpdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend/1computeTrendRolluppdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-action-plan/1clearmonitorinvestigateblock-releaseinvalidroutinesoonhighimmediateplannextActionsinvalidblockedinvalidblock-releaseinsufficientinvestigatewatchdegradingmonitorsoonhighstableimprovingclear--strict-watchmonitorblock-release--require-cleanblock-releaseinvalid--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_action_plan_total{verdict}pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-action-receipt --plan=<path>--file=--stdinpdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-action-plan/1computeActionPlanpdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-action-receipt/1completedincompletefollowup-openblockedinvalidclearmonitorinvestigateblocknextActions--ack-plan--ack-reviewed--ack-followups--ack-monitor--ack-investigation--ack-block--ack-planinvalidblockblock-releaseinvalid--strict-openblockedmonitorinvestigatefollowup-openincompletecompleted--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_action_receipt_total{verdict}pnpm worker:release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout --receipt=<path>--file=--stdinpdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-action-receipt/1--plan--trend--indexcomputeReceiptpdfxyz.release-decision-closeout-governance-finalize-index-trend-finalize-index-trend-closeout/1closedopenincompleteblockedinvalidnextActionsinvalid > blocking > open > incomplete > informationalinvalidinvalidblocked--strict-openblockedfollowup-openopenincompleteincompletecompletedclosed--require-plan--require-trend--require-index--strict-openinvalidincomplete--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_total{verdict}--max-open=N--max-incomplete=N--require-latest-closed--strict-open--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_total{verdict}improvingindexedstable--max-indexes=N--max-watch=N--max-incomplete=N--max-blocked=Nindexed--strict-watch--require-latest-indexedindexed--json--text--pretty--output01234worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_total{verdict}--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_action_plan_total{verdict}monitorinvestigatefollowup-openincompletecompleted--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_action_receipt_total{verdict}incompletecompletedclosed--require-plan--require-trend--require-index--strict-openinvalidincomplete--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_total{verdict}344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_total{verdict}--require-latest-all-closedall-closed--json--text--pretty--output01234worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_total{verdict}invalid--max-actions=<N>--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_action_plan_total{verdict}blockedmonitorinvestigatefollowup-openincompletecompleted--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_action_receipt_total{verdict}completedclosed--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_closeout_total{verdict}12344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_total{verdict}--require-latest-all-closedall-closed--json--text--pretty--output01234worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_total{verdict}block-releaseinvalid--max-actions=<N>--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_action_plan_total{verdict}--strict-openblockedmonitorinvestigatefollowup-openincompletecompleted--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_action_receipt_total{verdict}incompletecompletedclosed--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_closeout_total{verdict}012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_total{verdict}--strict-open--require-latest-all-closedall-closed--json--text--pretty--output01234worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_total{verdict}block-releaseinvalid--max-actions=<N>--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_action_plan_total{verdict}invalid--strict-openblockedmonitorinvestigatefollowup-openincompletecompleted--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_action_receipt_total{verdict}incompleteincompletecompletedclosed--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_closeout_total{verdict}--strict-open--json--text--pretty--output012344worker_release_decision_closeout_governance_finalize_index_trend_finalize_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_trend_closeout_index_total{verdict}