@@ -8,6 +8,12 @@ _Add entries here, never under a stamped version_ — a release commit renames t
 heading, and a branch that wrote beneath it merges without conflict straight into a
 published section (it happened to #170).
 
+## [0.51.0] - 2026-11-06
+
+### Added
+
+- Experimental `mcpm review-artifacts` compares two explicit local USTAR skill/plugin snapshots without extraction or execution. Receipts bind file hashes, mode changes, declarations and literal references to retained bytes, with separate byte/declaration coverage and unknown host state.
+
 ## [0.50.1] - 2026-11-06
 
 ### Fixed
 
@@ -284,6 +284,7 @@ Those 20 points **inform the score but cannot clear a safety floor.** The MCP se
 | `mcpm publish check` | Dry-run: show trust score and what would be submitted (`--json` emits the exact request body) |
 | `mcpm publish` | Submit to the official MCP registry (requires `GITHUB_TOKEN`/`MCPM_TOKEN`, or `--github-oidc` in GitHub Actions with `id-token: write`) |
 | `mcpm scope <project-root>` | Read-only Claude Code source/scope and instruction-file inventory (`--json`); [coverage and unknown states](docs/PROJECT-SCOPE.md) |
+| `mcpm review-artifacts <before.tar> <after.tar> --profile <profile>` | Compare explicit local USTAR Agent Skills or Claude plugin snapshots, with byte/mode changes, declarations, literal references and coverage gaps (`--json`); [format and limits](docs/ARTIFACT-REVIEW.md) |
 | `mcpm doctor` | Check MCP setup health and report issues (`--json` structured model, `--report` redacted paste-for-bug-reports snapshot) |
 | `mcpm init` | Scaffold a starter `mcpm.yaml` stack file in the current directory |
 | `mcpm disable <name>` | Disable an MCP server without removing it from config |
 
@@ -0,0 +1,145 @@
+# Artifact-review candidate evidence — 2026-11-06
+
+This record describes project backlog #156 before merge/publication. Current
+published CLI remains v0.50.1; no v0.51.0 publication is claimed here. The
+[command/profile contract](ARTIFACT-REVIEW.md) defines the supported archive and
+declaration subset. Source checks, historical and final candidate execution, and
+the real consumer decision below have separate identities. The 0.51.0 changelog
+section is prepared for release; this does not assert publication.
+
+## Reviewed source checkpoint
+
+Implementation base: `1b573fc3568c42dcb1a08149da05eb3c702f32b3`. Sol implemented
+the command; Astra independently reproduced and fixed archive/declaration,
+reference, pointer and coverage edge cases, then reproduced a Markdown parsing
+CPU regression and replaced the backtracking scan with a bounded linear scan.
+The latest source receipt is
+`/private/tmp/mcpm-156-astra-source-freeze-v2-20261106.json`.
+
+That source checkpoint records Node 24.20.0 typecheck (main/tooling), build,
+62 focused tests, whitespace checks and all 163 test files passing: **3,846 tests
+passed, three skipped**. It supersedes the first Astra source freeze. These are
+source results; fresh packed-candidate execution is recorded separately below. The
+placeholder package version remains `0.15.0`; no dependency/lockfile or override
+change is part of #156. Documentation additions after the source freeze are
+tracked separately and do not change runtime bytes.
+
+## Final latest-source candidate
+
+The fresh candidate archive is
+`/private/tmp/mcpm-156-final-candidate-20261106/getmcpm-cli-0.15.0.tgz`, SHA-256
+`9a39064a617c76b843e9241b8324a3fc7e09842bc986dce0760b696e7a4805e4`.
+Its consumer binding receipt names the latest Astra source-freeze SHA-256
+`aa42dbbe48d0e16ee73e29e32f007121e4cfd46a6a33bfc18bc936438f3b8b25`.
+The actual isolated image identity is
+`sha256:c32866659f49450a1e74f6e7dd13a06670b36a3f2068e01ccbfe5fd3352392a6`.
+
+Independent read-back matched all **66 installed JavaScript files**, the three
+input archive hashes below, and every reported member hash, size and mode.
+Both newly executed consumer reports matched the previously reviewed reports:
+31 old-to-capture and eight tag-to-capture changed/unknown records, with exit 1
+and both coverage flags false. The maintainer's retain-source/no-rollback
+decision was reaffirmed; no global mutation, native activation or safety
+approval followed. The isolated execution used UID 1000, no network, a
+read-only root and no host bind mounts. Home/project directories were checked
+empty after execution, not traced for absence of transient writes. The temporary
+read-back container was removed after its evidence was retained.
+
+| Check | Final candidate/source result | Local receipt |
+| --- | --- | --- |
+| Clean installation and public CLI smoke | Passed against the exact candidate archive | `/private/tmp/mcpm-156-final-smoke.log` |
+| Modern/legacy direct/guarded stdio protocol | 87 passed, zero failures, two expected unsupported combinations, four exclusions; independent actual-image/runtime/input binding passed | `/private/tmp/mcpm-156-final-protocol-20261106/{report,verified-binding}.json` |
+| Real macOS confinement dogfood | Passed control access, denied synthetic-secret read, intact relay, tamper refusal and event logging | `/private/tmp/mcpm-156-final-confine.log` |
+| Source coverage | Passed: 90.15% statements, 86.64% branches, 87.20% functions, 91.92% lines | Maintainer coverage run |
+| Negative coverage-threshold probe | Passed; failing thresholds were rejected | `/private/tmp/mcpm-156-final-negative.log` |
+| Real consumer and member/runtime binding | Passed receipt bindings; both product reports intentionally incomplete, retention reaffirmed | `/private/tmp/mcpm-156-final-candidate-20261106/consumer/run-final/verified-binding.json` |
+
+These are candidate/static/protocol/confinement observations for their named
+surfaces. They do not prove native artifact loading, default approvals, provider
+behavior, universal host coverage or a published package. Published-byte
+authentication and companion synchronization remain release gates.
+
+## Historical real-consumer inputs
+
+The maintainer prepared inert uncompressed USTAR snapshots outside the product.
+The separate preparation record names the two upstream commits and the explicit
+captured source root; the mcpm receipt itself authenticates neither provenance
+nor host cache/activation state. Preparation normalized owner/time and retained
+member content/modes. Only `.git` metadata was omitted from the captured source;
+no vendor or `node_modules` directory was present or omitted. An earlier generic
+omission description was corrected while preserving the original record and
+unchanged archive bytes.
+
+| Snapshot | Regular files | Archive SHA-256 |
+| --- | --- | --- |
+| Ponytail tag 5.3.2, upstream commit `16352ac229eb08a9598dcae48fe9f2b342567d86` | 213 | `fead09d7275d23ca5713e92873ec4ab10cf1fa177090b4bb5d18d3e1f929e10f` |
+| Ponytail tag 5.3.3, upstream commit `7801d061243d7b753bad0e0b3c057cd250b11755` | 214 | `032b3aa5083a19bec10a8539b9033fdb6f4b5f61a606204073129ae3eb67c544` |
+| Explicit local 5.3.3 source capture | 216 | `3ab7882f3a3251aa890c78e095258b52a5dd2715635ed74415855e4a37c35bb2` |
+
+Inputs, preparation script/proof and consumer decision are retained temporarily
+under `/private/tmp/mcpm-156-consumer-v2-20261106/`. Both comparisons used
+`--profile claude-plugin-2026-11-06 --withhold .git --json`.
+
+## Historical candidate execution and decision
+
+The earlier candidate npm archive SHA-256 was
+`0456b014efb655a4037c3127c7579010d4399711b2a911f3b9942df9e26717e5`, bound to the
+first Astra source-freeze receipt SHA-256
+`ed7d58f54b9549911253b3c0cdd12429f127a2889f0378827dc6ba34757f7c1c`.
+This **predates the latest Markdown CPU fix**. The `run-v2` directory name below
+identifies a consumer-run revision, not the newer source-freeze v2.
+The first `run-v1` consumer attempt failed on input-file permissions before
+producing reports and is excluded. Its receipt is retained. The original CPU
+regression and source-capture metadata-pack limit failure are also excluded from
+passing evidence; no failed capture archive was produced. The final candidate
+above was freshly executed after the fixes.
+
+Retained container inspection and binding receipts matched that archive, all
+66 installed JavaScript files and the three input hashes. The execution used
+UID 1000, no network, read-only root, dropped capabilities, no-new-privileges
+and no host bind mounts/credentials. Home/project directories were checked empty
+after execution; this is not a syscall-level assertion that no write occurred.
+No artifact hooks/scripts, native validators, installers or provider/model calls
+were executed.
+
+| Comparison | Result | Evidence used by the maintainer |
+| --- | --- | --- |
+| 5.3.2 tag → captured 5.3.3 source | Exit 1; byte and declaration coverage incomplete; 31 changed/unknown records | Changed executable/source files, declared shared-hook source/timeouts, literal references and explicit coverage gaps |
+| 5.3.3 tag → captured 5.3.3 source | Exit 1; byte and declaration coverage incomplete; eight changed/unknown records | 208 matching known content/mode pairs; five README/translation modifications, two SVG unknown additions, one withheld `.env.example` |
+
+Dynamic `node -e`, opaque Claude-band modules, unsupported manifest fields and
+nine other-host manifests remained interpretation gaps. The default-withheld
+`.env.example` member and prepackaging `.git` omission remained byte-coverage
+gaps. Archive buffering still read packaged member bytes; hashing was not
+redaction. Other-host declarations, including Codex, were not evaluated as loaded
+components. Configured/cached/loaded/enforced host states remained unknown.
+
+The actual maintainer decision was to **retain the reviewed 5.3.3 source update
+without requesting a rollback**. No global changes or native install/activation
+approval followed. Manual semantic review separately checked hook timeout
+5→15 seconds, activation subprocess timeout 1→3 seconds, Git-list buffer
+1→64 MiB with the existing line-count cap, and the opaque band's transcript
+lookup across Claude project folders. SVG XML was inspected separately; the
+receipt's file-role heuristic did not establish executable status or safety.
+
+The one-consumer gate is met for this bounded experiment: the receipt combined
+captured byte/mode identity with component/reference/coverage mapping instead of
+requiring that inventory to be assembled manually. Public-tag diff alone did not
+bind the captured local bytes. This is not a measured time saving, evidence of
+general demand, superiority over native/Git/APM workflows, or a safety verdict.
+
+Historical local receipts:
+
+- `/private/tmp/mcpm-156-consumer-sandbox-20261106/run-v2/{consumer,old-to-cache,tag-to-cache,verified-binding}.json`
+- `/private/tmp/mcpm-156-consumer-v2-20261106/consumer-decision.json`
+- `/private/tmp/mcpm-156-consumer-v2-20261106/preparation-proof.json`
+
+## Remaining delivery gates
+
+The latest-source repack, consumer bindings, smoke, protocol, confinement and
+coverage and negative-threshold checks are complete as described above.
+Final artifact/documentation review, hosted checks,
+merge, publication, published-byte authentication and companion synchronization
+remain pending in this record. The prepared 0.51.0 changelog section is not
+publication evidence. The one-consumer result does not authorize #157/#158 or another host
+dialect; those retain their own scope and evidence gates.
@@ -0,0 +1,131 @@
+# Local artifact change review
+
+`mcpm review-artifacts <before.tar> <after.tar> --profile <profile> [--json]`
+compares two explicitly supplied local snapshots. This is a bounded experiment
+for a maintainer reviewing a concrete update, alongside manual source review.
+It identifies changed bytes/modes, declared components and literal local
+references without extracting files, executing code, installing anything,
+invoking native validators or reading host configuration/credential stores.
+
+## Input and source identity
+
+Prepare **uncompressed USTAR00** archives outside mcpm, with bundle-relative
+member paths (no enclosing checkout directory). One skill snapshot has
+`SKILL.md` at its root; one plugin snapshot has `.claude-plugin/plugin.json`.
+Directory inputs fail before any child read. No archive member path ever reaches
+the filesystem. This avoids the ancestor-symlink race in recursive path readers.
+The explicitly opened archive must be a regular file without symlink components.
+
+Fixed limits are 16 MiB per archive, 2 MiB per member, 256 regular files,
+512 entries and 16 path levels. Only regular files and zero-size directories
+are accepted. Magic/version, unsigned header checksum, octal numbers, paths,
+payload bounds, zero padding, two zero end blocks and zero-only aligned trailers
+are checked. Links, special files, PAX/GNU/sparse extensions, duplicate normalized
+names, file/ancestor collisions, invalid UTF-8 names and truncated/concatenated
+archives make inventory incomplete. Unsupported archives yield no partial
+definitive member inventory. This strict subset intentionally refuses some
+archives accepted by native tar. [Primary format reference](https://www.gnu.org/software/tar/manual/html_node/Standard.html).
+
+Source identity means the retained archive bytes and SHA-256. It does not
+authenticate a publisher, commit, tag, cache location or supplied label. Member
+hashes bind content from that same buffer; permission modes are separate facts.
+Archive order/owner/time differences can change the container hash without
+changing member content. Both open handles and named file identities are checked
+again after both analyses; observed changes make the result incomplete. This is
+not an atomic filesystem snapshot or protection from a privileged writer.
+
+## Pinned interpretation profiles
+
+- `agent-skills-2026-11-06`: required YAML frontmatter, naming/description and
+  optional standard metadata constraints, root `SKILL.md`, explicit Markdown
+  links and conventional resource tokens. The root directory name cannot be
+  verified from a flat archive; nested plugin skill names are checked against
+  their member directory. Unknown fields remain gaps. [Agent Skills specification](https://agentskills.io/specification).
+- `claude-plugin-2026-11-06`: manifest-required static subset of the rolling
+  Claude reference retrieved on that date. Default/additional skills,
+  replacement command/agent/style/workflow paths, inline commands, hook paths
+  and arrays/inline event maps, and path/inline MCP/LSP declarations are
+  inventoried. Duplicate component names are gaps. Alternate forms outside
+  this subset, modules/Mods, userConfig, dependencies, settings, experimental
+  fields, unknown fields and other host manifests remain explicit gaps.
+  Declared paths are checked as files or directories as appropriate; empty
+  declared directories are retained. Unsupported hook fields, event names over
+  128 characters and unsupported or incomplete MCP/LSP entry shapes remain gaps.
+  A missing manifest is incomplete even though native Claude supports
+  manifest-free plugins. Plugin version strings are opaque release metadata,
+  not schema/host versions or byte identity. [Manifest reference](https://code.claude.com/docs/en/plugins-reference),
+  [loading reference](https://code.claude.com/docs/en/plugins/loading).
+
+Literal local reference candidates come only from Markdown links, conventional
+`scripts/`, `references/`, `assets/`, `hooks/` tokens and literal
+`${CLAUDE_PLUGIN_ROOT}/...` paths. They are not inferred executions. Dynamic
+commands such as `node -e` remain unresolved; JS imports, shell behavior,
+dependencies, module semantics and commands in prose are not analyzed. External
+URLs are never followed. A named module file is not proof that a host loads it.
+Local Markdown URL queries and fragments are omitted from reference targets;
+queries retain an interpretation gap. JSON pointers escape member names and
+identify the actual singleton, array or wrapped declaration location.
+
+## Receipt, gaps and sensitive input
+
+JSON is `schemaVersion: 1`. Each side contains the explicit source path/state,
+archive digest, member paths/states/sizes/modes/digests, components, references
+and gaps. Components/references/gaps identify their source member digest where
+available. No raw instruction, command, environment, header or credential values
+are emitted. Configured/cached/loaded/enforced state and host version are unknown;
+archive preparation provenance belongs in a separate maintainer record.
+
+`byteInventoryComplete` and `declarationCoverageComplete` are separate. Neither
+means safe, approved or active. A known hash/mode difference on both retained
+sides is a `modified` fact even when unrelated members are withheld. Missing
+counterparts under incomplete inventory have `unknown` deltas, never definitive
+removal/addition. Exit 0 requires both coverage flags; exit 1 retains the receipt
+and its gaps. Consumers must inspect gaps and source states, and stop on unknown
+receipt versions. There is no universal score, installer or enforcement claim.
+
+Sensitive-looking members (`.env*`, credential/key files and store directories,
+`.git`, `node_modules`) are withheld from interpretation and member hashes by
+default. `--withhold <paths...>` adds member paths/subtrees, including inputs
+omitted during preparation, as coverage gaps. **Archive buffering still reads
+packaged member bytes and the container digest includes them. Hashing is not
+redaction.** Omit sensitive bytes before packaging when they must not be read;
+record omitted paths with `--withhold` and preserve preparation provenance.
+
+## Actual consumer checkpoint — 2026-11-06
+
+An mcpm maintainer used two candidate receipts plus manual source
+review to decide whether to retain the reviewed local Ponytail 5.3.3 source
+update or request a rollback to 5.3.2. Inputs were inert USTAR snapshots of the
+two pinned upstream tags and the explicitly captured 5.3.3 source directory;
+source capture provenance was recorded separately from the product reports.
+Only `.git` was omitted before packaging; no `node_modules`/vendor directory was
+present or omitted. `.git` was declared with `--withhold`, and the packaged
+`.env.example` member was withheld from interpretation/member hashing by default.
+
+The old-to-capture receipt exposed 31 changed/unknown member records. The
+tag-to-capture comparison had 208 matching known file bytes/modes, five known
+README/translation modifications, two unknown SVG additions and one withheld
+`.env.example` record. Declared shared hooks and timeout fields focused the code
+review; unresolved `node -e`, opaque Claude-band modules, unsupported manifest
+fields and nine other-host manifest gaps prevented a complete interpretation.
+Both commands exited **1**, with both coverage flags false.
+
+The maintainer retained the reviewed source update without requesting a rollback.
+No global configuration, installation or native activation was changed or
+approved. Manual review, rather than the report, interpreted subprocess timeout,
+buffer-size and transcript-discovery changes; SVG content was checked separately
+without treating the file-role heuristic as a safety verdict. The receipt's
+observed value was combining actual captured byte/mode identity with component,
+reference and missing-coverage mapping. Time savings, general demand and
+superiority over native/Git/APM tooling were not measured.
+
+The first reports belonged to an earlier candidate before the Markdown CPU fix.
+A fresh archive of the latest reviewed source reran both comparisons with all
+66 installed JavaScript files, all three input hashes and every reported member
+hash/size/mode checked against the actual isolated image. Both new reports
+matched the reviewed earlier reports, and the maintainer reaffirmed retention.
+This is new candidate evidence, not an inherited earlier pass or a publication
+claim. Exact archive identities, additional smoke/protocol/confinement results,
+receipt locations and remaining gates are in the
+[candidate validation record](ARTIFACT-REVIEW-VALIDATION.md). Configured, cached,
+loaded and enforced host states remain unknown throughout.