type: reference title: "Published documentation qualification for SDK issue 1897" description: "Immutable command replay evidence and explicit qualification limits for five published SDK documents."

Published documentation qualification for SDK issue 1897

The five SDK-owned documents pass against the reviewed release inputs in run 38205709419, artifact 11727651785. The raw document report and summary account for all 45 blocks: 27 executed command blocks, 8 compiled snippets, 1 saved configuration file, and 9 not-run blocks. There are no failed, blocked or needs-input blocks.

The selected public packages are SDK and five companions 0.1.16, independently pinned MCP 0.1.16, and scaffold 0.1.9. Canonical verification downloaded the public artifacts and checked their source, SRI and publisher provenance. The retained manifest keeps server source 93cad86ec4fb28fba3ff0b9358059d86aa55dde5 at image digest sha256:785de2ae7f72e6277ce62aa1ece4f08ee0425970b71c47f9f4843c0baae2c8db. The reviewed platform inputs were merged by honua-release PRs 560 and 563.

What the original findings now prove

The published install steps provide the MapLibre peer needed by the README snippet. Source examples explicitly enter a checkout before running repository scripts; the fixture/dev commands satisfy their readiness checks. CLI query examples, both scaffold templates and the MCP certification/offline evaluation commands complete their unchanged published commands successfully. The retained CLI receipt establishes exit status, not semantic correctness of every returned value; it does not retain stdout or separate CLI output assertions. Typechecked examples compile after their documented installation steps.

The published MCP credential guidance identifies HONUA_TOKEN as the reader's operator-issued bearer token, and identifies the reader's provider keys or AWS credential chain. Its offline evaluation control passes. The billable live-model block is intentionally not executed; this evidence does not claim a live model run.

The nine not-run blocks are six non-executable format examples, two explicitly partial/browser application excerpts, and that one billable credential-dependent lane. Their document/index/hash/reason identities match the prior published-cohort report from run 38188029156 and the failed fresh attempt below. No block was removed or newly excluded by this qualification or its checker repair.

Source builds and public default consumers

The source-build runner instruments moving clone instructions with the document's immutable revision. It executes the documented npm commands with unchanged lockfiles. Exact source dependency paths, versions, integrity and the MCP file:.. link are admitted separately from installed candidate packages. The source Git revision and lock bytes are checked before and after source execution and later observations. The three repaired MCP observations are marked sourceDependencyAudit; they are not claims that the source SDK 0.1.15 link is a published SDK 0.1.16 consumer. Honua-release PR 565 delivered that checker distinction at merge 4195ab9e5d1243eacf568dbfcf31fa18b5bf26ae, keeping the candidate registry strict.

Outside that guard, actual public npm create honua-app@latest, default npm install, production build and the documented dev command passed; readiness returned HTTP 200. The actual consumer lock shows scaffold 0.1.9 selected its certified SDK 0.1.14 fallback. Its separate candidate binding result therefore remains failed. The whole diagnostic job is failed, as the raw gate statuses require. The MCP README's floating commands are confined to the selected MCP 0.1.16 in this candidate replay; they are not proof that public npm latest resolved that version.

The adjacent installed-client report contains 33 active passing cells and 8 predeclared blocked cells. Its overall status remains blocked despite the runner's zero exit. These results do not certify the entire platform, promote defaults, change customer installer pins, or satisfy the separate Production four-adapter qualification in issue 1424.

Preserved attempts and provenance

• Run 38203954406 attempt1 verified eight public artifacts, then received npm HTTP 429 before consumer/document execution. Its unrelated broad document job was cancelled to permit the failed-job retry. Initial provenance.
• Attempt2 ran the published commands successfully but misclassified the retained MCP source SDK link in three blocks. Four documents passed and one failed. Unchanged raw failure.
• Run 38205709419 executed the checker repair at e4f1538a8e36c252f99c8c4e4de7ae82cdb846d1. The merged checker at 4195ab9e5d1243eacf568dbfcf31fa18b5bf26ae has identical executable input trees; its additional changes are unrelated release decisions. Artifact identity and every retained file hash.

All raw reports remain byte-exact, including failed and blocked statuses.

The retained source input receipt and two variable declarations (MCP declaration) come byte-for-byte from the immutable runner source, separately from hosted artifacts. They substitute the documented server origins with http://localhost:8080 and http://localhost:8080/mcp for the owned candidate. They contain no credentials. The receipt records their source paths and hashes plus the runner context source that defines these values.