First-use reports: published Windows alpha.1
These are real, unedited renderer outputs from termivar 0.10.0-alpha.1, the verified Windows x86_64 prerelease archive, run in an isolated local directory on 2026-09-05. They are not generated by development alpha.2 or a future commit. This was not a fresh-machine or independent security test.
- HTML assessment
- JSON assessment
- Default operational JSON
- Measured provenance
- Release acquisition and sample digests
The walkthrough repeats this path using an explicitly acquired local binary. The checked-in example is Windows release evidence; the existing three-OS runtime-smoke jobs separately exercise the actual development CLI at their recorded full source SHA. Linux release acceptance uses its exact downloaded archive in a separate CI step. Check the associated workflow result/artifact before claiming that execution; a documented command is not proof that an OS was tested. macOS prerelease execution is not claimed.
What ran
The standard-library runner binds 127.0.0.1 on an allocated port and serves
two fixed, tiny demonstration documents. It serves no directory or user files,
and has no forms, query-driven inputs, reflection, credentials, callbacks, or
external assets. It stops its own listener and children after the run.
| Invocation | Actual result in this capture |
|---|---|
| Version, help, scan help | Exit 0; binary reports termivar 0.10.0-alpha.1 |
| Default scan, no profile | Exit 0; decision-scan/v1, one request, no active verification; halt / no_eligible_action |
Root web-review, JSON |
Exit 0; complete report, one subject, four informational items; three fixture requests |
Root web-review, HTML |
Separate exit-0 run; complete HTML from the existing renderer; three fixture requests |
| Existing JSON output | Exit 1; zero fixture requests; original report bytes/hash unchanged |
| Invalid baseline/report combination | Exit 2 before any fixture request; no success artifact |
Begun non-root /example run |
Exit 1 after three fixture requests; assessment_subject_identity_unavailable; no partial report file |
The non-root case uses an existing subject-identity limitation, not a payload,
stress test, or changed runtime limit. Its operational diagnostic reports
incomplete_assessment_items_withheld; this is distinct from preflight refusal.
The absence of an assessment file is deliberate, not a zero-observation result.
Reading the actual assessment
The JSON says status: complete, subject_count: 1, and item_count: 4.
All four items have disposition: informational, claim_basis: observation,
and severity: null. They record that the eligible static HTML response did
not include these headers:
- Permissions-Policy
- Content-Security-Policy
- Referrer-Policy
- X-Content-Type-Options
These are bounded observations, not demonstrated vulnerabilities. NeedsReview
would ask a human to investigate stronger evidence; this sample contains no
such item. An action's Success is not vulnerability confirmation. The report
does not establish business impact, exploitability, detection accuracy, or
production readiness. A report with no items must never be paraphrased as “secure.”
The no-profile output is a different, operational schema; it shows planning,
dispatch, and terminal state rather than an assessment findings list. Its
ordinary no_eligible_action halt is not a renderer failure.
What was not evaluated
The published release-bundle compiles several optional capabilities, but this
walkthrough enables none of their flags. It does not request GraphQL,
OpenAPI, REST, resource authorization, normalization-resilience, or artifact
review. OAST is not compiled into the archived bundle and is not used here.
The four-item renderer document does not contain a per-capability execution
matrix or request totals: those must not be invented. Fixture request counts
come from the separate acceptance provenance, not a new report field.
The archive predates maintenance PRs #109–#111. It is not recommended for credentialed or production use. The tagged alpha.1 source predates the F3 correction, while this archived release binary did not compile OAST; later development changes do not rewrite this capture. See the maintenance ledger.
Provenance and normalization
acquisition.json records the GitHub release ID, peeled tag commit, exact
archive name, archive/manifest/binary digests, raw provenance digest, and
checked-in sample digests. Checksum agreement is not code signing or an
independent audit. Distribution separates checksum and
build-provenance verification.
The runner's provenance.json records observed version/hash, declared build
features/ref, host architecture, fixture contract/content digest, exact argv,
invocation identifiers, timestamps, exits, bounded capture digests, and report
digests. Ref/features are caller declarations supported here by exact release
acquisition; --version alone does not attest them.
The public copy uses the runner's small public_provenance helper. Its complete
normalization allowlist is binary.path and invocations[*].argv[0], both
replaced by <LOCAL_BINARY>. No other measured value is transformed. The
loopback port, times, errors, counts, completion state, dispositions, and
digests remain actual. No raw credential was used. The JSON and HTML reports,
and default.json, are byte-for-byte copies: no report normalization.
The narrow .gitattributes entries preserve those capture bytes and public
provenance line endings across checkouts; they do not exclude lint or coverage.
05-assessment-json and 06-assessment-html identify two different CLI
executions. These are harness invocation identities, not invented scanner run
IDs. Do not require matching fingerprints/timestamps across separate runs.
Compare semantic invariants instead. No unofficial JSON-to-HTML conversion
was used; the generated HTML has no scripts, CDN, tracking, or external assets.
Raw stdout/stderr and unnormalized provenance stay in the private local output
directory or the workflow's bounded, 30-day first-use-* artifacts. Their
relative capture filenames in public provenance are evidence references, not
promises that private raw captures are checked into this directory. No raw
capture is published here. The normalizer does not promise to scrub arbitrary
user-provided labels or unrelated captures; inspect before publishing.
The helper tests verify fixture safety, cleanup, bounded captures, and negative cases. Sample tests pin byte hashes and semantics without treating a future rerun's legitimate timing/identity differences as failures.
