Record audit remediation verification

docs/consumers/guide.md

@@ -25,8 +25,10 @@ ckconfig or ckprompt v0.2.0 release together.
 
 Published ckconfig v0.4.0 uses core v0.4.0 and ConfigKit v1.1.0. The ckprompt
 v0.3.0 candidate targets those releases and PromptKit v0.20.0. A Go 1.27.0
-workspace may compose the three local modules; independent tests also use the
+workspace may compose the three local modules. Current ckprompt source uses a
-declared released dependencies.
+diagnostic helper introduced in local ckconfig source that is absent from
+released ckconfig v0.4.0; independent ckprompt builds require release and
+dependency alignment described in [future work](../roadmap/future.md#pending-release-and-integration-work).
 
 The two integrations are independent optional imports. `ckprompt` uses the
 public scope and error contracts from `ckconfig`; importing it does not add the

docs/development.md

@@ -109,6 +109,9 @@ The root module does not traverse nested modules. Preserve the ignored `go.work`
 and `go.work.sum`; use `GOWORK=off GOTOOLCHAIN=local` for dependency preparation
 and independent module suites. The integrations select released core v0.4.0;
 ckprompt also selects released ckconfig v0.4.0.
+Current ckprompt source requires a ckconfig helper absent from that release, so
+its independent suite remains pending release and dependency alignment; the
+aligned workspace exercises the current source together.
 Run `GOWORK=off GOTOOLCHAIN=local go test ./...` separately from each module
 directory. From the repository root, a workspace containing all three modules can
 also run:

docs/roadmap/audit-remediation.md

@@ -1,15 +1,15 @@
 # Audit remediation roadmap
 
-Status: target and decisions finalized; the [implementation plan](implementation.md)
+Status: source remediation complete; the [implementation plan](implementation.md)
-defines the sprint. No remediation is implemented by these documents.
+records the sprint and verification. Release and dependency alignment remain
+separate work in [future work](future.md#pending-release-and-integration-work).
 
 Baseline: `d131999c7c474010a4814bb81601cd32920e6c83`. The
-[catalog](audit/catalog.md) contains 27 distinct open findings, five P2 and 22 P3,
+[catalog](audit/catalog.md) records 27 distinct findings, five P2 and 22 P3,
 from seven audits. Its accepted decisions and the
 [remediation analysis](audit/remediation-analysis.md) supply the scope and
-rationale for this roadmap. The implementation is unchanged since the audited
+rationale for this roadmap. The audited state was
-state `db732e3a1de55c844f77870e1c6db683c2685d5d`; subsequent commits recorded
+`db732e3a1de55c844f77870e1c6db683c2685d5d`.
-the review and decisions.
 
 This roadmap owns the target, scope, and completion criteria. The implementation
 plan owns ordered stages, dependencies, concrete changes, and verification steps.
@@ -251,22 +251,22 @@ removes migration work, not the need for coherent module requirements.
 
 ## Completion criteria
 
-- [ ] Every finding F01–F27 has its selected remediation implemented and recorded
+- [x] Every finding F01–F27 has its selected remediation implemented and recorded
   with relevant evidence; related findings remain individually accountable.
-- [ ] The five P2 defects have focused behavioral protection, including error
+- [x] The five P2 defects have focused behavioral protection, including error
   identity, retained evidence, and the deferred acceptance boundary.
-- [ ] F06 and F08's maintained consumers work, with actual completion checks
+- [x] F06 and F08's maintained consumers work, with actual completion checks
   distinguished from unavailable or skipped shell checks.
-- [ ] F11 and F21's selected API changes and F09/F10's clarified contracts are
+- [x] F11 and F21's selected API changes and F09/F10's clarified contracts are
   reflected in canonical GoDoc and affected integration guidance.
-- [ ] Obsolete production wrappers/plumbing and duplicate adaptation/bookkeeping
+- [x] Obsolete production wrappers/plumbing and duplicate adaptation/bookkeeping
   are removed at the agreed boundaries, with useful tests retained.
-- [ ] F13–F15 and F22 remove the identified repeated work while preserving
+- [x] F13–F15 and F22 remove the identified repeated work while preserving
   behavior, without a new performance guarantee or measurement prerequisite.
-- [ ] F17–F20 improve responsibility separation within their bounded scope;
+- [x] F17–F20 improve responsibility separation within their bounded scope;
   public behavior and necessary ordering remain protected.
-- [ ] Documentation corrections F25–F27 are complete and local links resolve.
+- [x] Documentation corrections F25–F27 are complete and local links resolve.
-- [ ] Relevant module and aligned-workspace results are recorded. Independent
+- [x] Relevant module and aligned-workspace results are recorded. Independent
   results identify the exact dependency selection; any release-alignment work
   still pending is explicitly distinguished from completed source work.
 

docs/roadmap/future.md

@@ -5,7 +5,7 @@ No delivery dates are selected here.
 
 ## Purpose and authority
 
-Completed roadmaps, implementation plans, and review findings have been retired.
+Earlier completed roadmaps, implementation plans, and review findings have been retired.
 This document preserves unfinished work and unselected ideas under the
 [release policy](../policy/release.md#release-documentation-and-preparation).
 The completed PromptKit v0.18.0 adoption roadmap and implementation plan remain
@@ -26,11 +26,20 @@ an idea here does not select its syntax, API, priority, or delivery date.
 
 ## Pending release and integration work
 
+### Audit remediation release alignment
+
+The audit remediation is complete in source. The released ckconfig v0.4.0 does
+not include `AdaptDiagnostics`, which current ckprompt source uses. Select and
+publish appropriate releases in dependency order, align module requirements and
+checksums, and rerun independent module suites under the
+[release procedure](../release.md). No publication is implied by source completion.
+
 ### ckprompt release
 
 The PromptKit v0.20.0 adoption is complete. The
 [ckprompt v0.3.0 candidate](../../integrations/ckprompt/docs/releases/v0.3.0.md)
-remains unpublished. Publication and hosted delivery remain separate operations
+remains unpublished and needs revalidation against the current source and aligned
+dependencies. Publication and hosted delivery remain separate operations
 under the [release procedure](../release.md).
 The published ckprompt v0.2.0 retains its earlier dependencies; see the
 [consumer guide](../consumers/guide.md#module-selection) for module selection.

docs/roadmap/implementation.md

@@ -1,6 +1,7 @@
 # Audit remediation implementation plan
 
-Status: in progress; Stages 1–22 complete.
+Status: source sprint complete; Stages 1–23 complete. Release and dependency
+alignment remain separate work.
 
 Baseline: `d492c7747175c01a53261206c2b4356e53453621`. Before this sprint,
 intervening changes recorded decisions and retired the completed older
@@ -713,6 +714,27 @@ Complete when present guidance and useful historical navigation have clear owner
 
 ## Stage 23 — Verify the assembled sprint and record completion
 
+**Complete.** The full aligned workspace suite passed with Go 1.27.0 using
+`GOTOOLCHAIN=local GOPROXY=off go test -mod=readonly ./... ./integrations/ckconfig/... ./integrations/ckprompt/...`.
+Focused reporter tests passed with `-race -count=1`. Independent `GOWORK=off`
+root and ckconfig suites passed; root selects Cobra v1.10.1, pflag v1.0.9 and
+YAML v4.0.0-rc.6, and ckconfig selects core v0.4.0 and ConfigKit v1.1.0.
+Independent ckprompt selects ckconfig v0.4.0, core v0.4.0, ConfigKit v1.1.0
+and PromptKit v0.20.0; its suite fails to compile because released ckconfig lacks
+`AdaptDiagnostics`. This is pending release alignment, not a passed independent
+check. No manifests, checksums, workspace files, or Go requirements were changed.
+
+Core's default reporting example, ckconfig ordinary show and two-sided diff,
+composed all-scope show, prepared preview and local fixture-backed aggregate smoke
+completed. Bash interactive backend and consumer checks passed; full opt-in runs
+reported missing Zsh and Fish executables, so those interactive checks are
+unavailable. The five P2 regressions reproduced their original defects before the
+fixes. All 27 catalog findings have completion evidence, including both F02
+boundaries, F14/F15 traversal costs, F21 callers and F24 wrappers. Go formatting,
+changed Markdown local links and fragments, the tagged historical fragment, and
+tracked and staged Markdown whitespace checks passed. Source completion does not
+publish any module; pending release alignment is recorded in future work.
+
 Findings: all F01–F27; no new feature work.
 
 1. Review the full diff against this baseline and all roadmap completion criteria.