daichunghy · daichunghy · Aug 28, 2026 · Aug 28, 2026
@@ -91,7 +91,7 @@ The repository enforces a clean root structure (maximum 9 files) with well-defin
 ## Current project status
 
 This section is the operating snapshot for the repository. It was revalidated
-on 2026-08-23 and must be kept separate from the constitutional definition of
+on 2026-08-28 and must be kept separate from the constitutional definition of
 done below. A local test, a recorded fixture, or a configured remote is not by
 itself evidence of live GitHub behavior, external adoption, or release
 readiness.
@@ -110,7 +110,9 @@ and follow-ups #15–#21, #23, #25 and #26 were merged on 2026-08-22, and #28,
 #36 and #40 were merged on 2026-08-23, each by the repository
 administrator after temporarily lifting `enforce_admins`; the setting was
 restored immediately after each merge, and every such merge is recorded as a
-maintainer decision rather than independent-review evidence. PR #40 closed
+maintainer decision rather than independent-review evidence. PRs #46, #47,
+#51, #53, #54 and #55 were merged on 2026-08-25 in the same recorded
+pattern, bringing `main` to `c9d11cb`. PR #40 closed
 audit item P1-8: `evaluate` accepts `--output` as an alias of `--report`,
 conflicting paths fail closed with `REPORT_OUTPUT_CONFLICT`, and the
 committed Action bundle was rebuilt to catch up with the `evaluator-core`
@@ -121,19 +123,27 @@ and CodeQL `32563526929` on `main@e4052f2`, earlier runs through
 [32559824706](https://github.com/daichunghy/patchgate/actions/runs/32559824706)
 on `main@c9f643e`, and the first public run
 [CI 32333914059](https://github.com/daichunghy/patchgate/actions/runs/32333914059).
-For the current public `main`, default-branch CI run
-[32616034636](https://github.com/daichunghy/patchgate/actions/runs/32616034636)
-completed successfully while CodeQL `32616034425` was still in progress when
-this snapshot was written.
+For the current public `main` at `c9d11cb`, default-branch
+[CI 32806576723](https://github.com/daichunghy/patchgate/actions/runs/32806576723)
+and CodeQL
+[32806576725](https://github.com/daichunghy/patchgate/actions/runs/32806576725)
+completed successfully on 2026-08-25.
 Live branch
 protection also requires one approving pull-request review, dismisses stale
 reviews, requires six CI contexts including `CI / Full Verify`, enforces
 linear history and conversation resolution, and disables force-pushes and
 branch deletion. The merged feature, documentation and release branches were
 deleted after their content reached `main`; the stale pre-publication
-`test/patchgate-shadow-smoke` draft branch and the open
-`dependabot/npm_and_yarn/typescript-7.0.2` branch (PR #12)
-remain. Dependabot PRs #11 (`@types/node` 26), #13 (`vitest` 4) and #14
+`test/patchgate-shadow-smoke` draft branch remains, and the open branches are
+`codex/tested-sha-interop` (PR #59), `feat/release-rollback-guide`
+(PR #52, opened 2026-08-23), the CodeQL 4.37.8 Dependabot branches
+(PRs #57 and #58, opened 2026-08-27), and
+`dependabot/npm_and_yarn/typescript-7.0.2` (PR #12). PR #59 binds the Action
+snapshot and check-run delivery to the exact `pull_request.head.sha` with
+fail-closed live-target mismatch handling; on 2026-08-28 every required
+context on it was green and it waited only on the one approving review that
+branch protection requires. Dependabot PRs #11 (`@types/node` 26), #13
+(`vitest` 4) and #14
 (`@vitest/coverage-v8` 4) were merged on 2026-08-22 after local
 re-verification; PR #12 (`typescript` 7) stays open because `@vercel/ncc`
 cannot bundle under TS 7. Dependabot Actions PRs #38 (`actions/setup-node` 7)
@@ -150,15 +160,15 @@ unusable on real runners
 [release record](docs/releases/2026-08-23-beta.5.md)); it is beta
 shadow-evidence scope only — not production, adoption or a `v0.1` claim.
 
-The current milestone audit is [the 2026-08-20 G4/G0 continuation audit](docs/reviews/2026-08-20-g4-g0-audit.md). The newest records are the [2026-08-22 multi-persona review round](docs/reviews/2026-08-22-multi-persona-review.md), the [2026-08-22 live consumer smoke findings](docs/reviews/2026-08-22-live-smoke-findings.md) and the [2026-08-22 Mimosa static-advisory adjudication](docs/reviews/2026-08-22-mimosa-static-advisory-adjudication.md) — re-run the sealed scan after any change to `src/github/client.ts` transport handling. The latest verification command to rerun after a change is:
+The current milestone audit is [the 2026-08-20 G4/G0 continuation audit](docs/reviews/2026-08-20-g4-g0-audit.md). The current cross-repository register is the [2026-08-28 repository portfolio audit](docs/reviews/2026-08-28-repository-portfolio-audit.md). The newest review records are the [2026-08-22 multi-persona review round](docs/reviews/2026-08-22-multi-persona-review.md), the [2026-08-22 live consumer smoke findings](docs/reviews/2026-08-22-live-smoke-findings.md) and the [2026-08-22 Mimosa static-advisory adjudication](docs/reviews/2026-08-22-mimosa-static-advisory-adjudication.md) — re-run the sealed scan after any change to `src/github/client.ts` transport handling. The latest verification command to rerun after a change is:
 
 ```bash
 npm run verify
 ```
 
 ## Shared repository workflow
 
-The Desktop workspace contains four separate public repositories: [PatchGate](https://github.com/daichunghy/patchgate), [contribkit](https://github.com/daichunghy/contribkit), [OpenSheet-AI](https://github.com/daichunghy/opensheet-ai), and [quant-research](https://github.com/daichunghy/quant-research). They are not a monorepo or a combined adoption claim. The live status, evidence limits, and cross-repository working rules are maintained in the [repository portfolio audit](docs/reviews/2026-08-24-repository-portfolio-audit.md).
+The Desktop workspace contains five separate public repositories: [PatchGate](https://github.com/daichunghy/patchgate), [contribkit](https://github.com/daichunghy/contribkit), [OpenSheet-AI](https://github.com/daichunghy/opensheet-ai), [quant-research](https://github.com/daichunghy/quant-research), and [agentsmd](https://github.com/daichunghy/agentsmd). They are not a monorepo or a combined adoption claim. The live status, evidence limits, and cross-repository working rules are maintained in the [repository portfolio audit](docs/reviews/2026-08-28-repository-portfolio-audit.md).
 
 When working across them, keep each repository's own `AGENTS.md`, constitution, tests, release boundary, and Git history authoritative. Check live GitHub and package-registry signals before writing a status update. Count outside walkthroughs, downstream installs, outside issues, outside pull requests, and consented pilots as usage evidence; count self-authored activity and bot activity as maintenance evidence only.
 

@@ -0,0 +1,121 @@
+# Repository portfolio audit — 2026-08-28
+
+This is the operating register for the five GitHub repositories kept in the
+Desktop workspace. They remain separate projects with separate contracts,
+release decisions, and user evidence. The register does not turn them into a
+suite and does not imply shared adoption. It supersedes the
+[2026-08-24 register](2026-08-24-repository-portfolio-audit.md), which stays
+on file as the record of that date's signals.
+
+## Live snapshot
+
+The GitHub and npm checks were run on 2026-08-28. A download is a registry
+event, not a user count. A self-authored issue, release, discussion, star,
+fork, or maintenance log is not external adoption.
+
+| Local folder | Repository | Current public signal | Package signal | Verified usage |
+| --- | --- | --- | --- | --- |
+| `Github/` | [`daichunghy/patchgate`](https://github.com/daichunghy/patchgate) | 1 star, 0 forks, 8 open issues (count includes PRs), current Action pre-release `v0.1.0-beta.5`, public `main` at `c9d11cb` | PatchGate remains unpublished (`private: true`); the npm name `patchgate` belongs to another package | No external user, downstream repository, or pilot verified |
+| `Github 2/contribkit/` | [`daichunghy/contribkit`](https://github.com/daichunghy/contribkit) | 0 stars, 0 forks, 20 open issues (count includes PRs), pre-release `v0.1.0-alpha.7` | npm `latest` resolves `0.1.0-alpha.3`, `alpha` resolves `0.1.0-alpha.6`; 578 downloads from 2026-08-20 to 2026-08-26 | No external user, downstream repository, or pilot verified |
+| `Github 3/` | [`daichunghy/opensheet-ai`](https://github.com/daichunghy/opensheet-ai) | 0 stars, 0 forks, 8 open issues (count includes PRs), pre-release `v0.1.0-alpha.5` | npm `latest` and `alpha` resolve `0.1.0-alpha.4`; 128 downloads from 2026-08-20 to 2026-08-26 | No external user, downstream repository, or pilot verified |
+| `Github 4/` | [`daichunghy/quant-research`](https://github.com/daichunghy/quant-research) | 0 stars, 0 forks, 9 open issues (count includes PRs), pre-release `v0.1.0-alpha.5` | npm `@agentbiz/quant-research`: `alpha` resolves `0.1.0-alpha.5`, `latest` resolves `0.1.0-alpha.4`; 254 downloads from 2026-08-20 to 2026-08-26 | No external user, downstream repository, or pilot verified |
+| `Desktop/agentsmd/` | [`daichunghy/agentsmd`](https://github.com/daichunghy/agentsmd) | 1 star, 1 fork, 7 open issues (count includes PRs), pre-release `v0.1.0-alpha.2` (2026-08-22) | npm `@daichunghy/agentsmd` not published | One outside GitHub account (`VedantMadane`) forked the repository on 2026-08-23; no issue, pull request, or feedback followed. A fork is not verified usage |
+
+The contributor lists are maintainer-led everywhere; Dependabot supplies most
+open pull requests. No outside human contribution was observed in this
+snapshot.
+
+## What changed since 2026-08-24
+
+- On 2026-08-25 the maintainer merged a documentation, test and hardening
+  batch through the recorded admin-bypass pattern on every repository:
+  PatchGate #46/#47/#51/#53/#54/#55 (bringing `main` to `c9d11cb`, with
+  [CI 32806576723](https://github.com/daichunghy/patchgate/actions/runs/32806576723)
+  and CodeQL
+  [32806576725](https://github.com/daichunghy/patchgate/actions/runs/32806576725)
+  completed successfully on that commit), contribkit #29/#31/#32,
+  OpenSheet-AI #10/#12/#13/#15/#16, quant-research #13/#14/#15/#17/#18, and
+  agentsmd #10. Every merge remains a maintainer decision rather than
+  independent-review evidence.
+- Open feature work as of this snapshot: PatchGate
+  [PR #59](https://github.com/daichunghy/patchgate/pull/59) binds the Action
+  snapshot and check-run delivery to the exact `pull_request.head.sha` with
+  fail-closed live-target mismatch handling — every required context was
+  green on 2026-08-28 and the pull request waited only on the one approving
+  review branch protection requires. contribkit
+  [PR #33](https://github.com/daichunghy/contribkit/pull/33) adds runtime
+  adapters and package-first onboarding; its `verify` context was failing at
+  audit time while clean-room reproducibility fixes were being pushed to the
+  branch, and [PR #30](https://github.com/daichunghy/contribkit/pull/30)
+  (Ruby RSpec and PHP PHPUnit adapters) is open. OpenSheet-AI
+  [PR #17](https://github.com/daichunghy/opensheet-ai/pull/17) ships packaged
+  examples and a five-minute preview (mergeable, checks green) and
+  [#14](https://github.com/daichunghy/opensheet-ai/pull/14) documents the
+  xlsx adapter error boundary. quant-research
+  [PR #19](https://github.com/daichunghy/quant-research/pull/19) ships a
+  reproducible service-quality workflow (mergeable, checks green) and
+  [#16](https://github.com/daichunghy/quant-research/pull/16) adds a workflow
+  readiness instrument family.
+- Dependabot backlog awaiting triage: PatchGate #57/#58 (CodeQL 4.37.8) and
+  the long-open #12 (`typescript` 7, still blocked by `@vercel/ncc`);
+  contribkit #1/#2/#3/#8/#9/#11/#12; OpenSheet-AI #1–#5; quant-research
+  #1–#5; agentsmd #1–#5.
+- agentsmd has been quiet since the 2026-08-25 merge apart from Dependabot.
+  It joins the register because it is an actively released public repository
+  in the same workspace, and it recorded the portfolio's first outside-human
+  event: the fork listed above.
+
+## What this means
+
+Download counts for the recorded week (contribkit 578, quant-research 254,
+OpenSheet-AI 128, windows 2026-08-20 to 2026-08-26) are higher than the
+cumulative figures in the 2026-08-24 register, but a download still cannot
+tell us whether a person used a package, whether it solved their problem, or
+whether the event came from CI, a mirror, or an automated scan. The only
+outside-human event in the portfolio remains the agentsmd fork, with no
+follow-up contact.
+
+The per-repository adoption blockers are unchanged: PatchGate is a private,
+unpublished package that must be cloned and built before the first CLI
+command; the other four publish pre-release packages but have not yet met one
+consented external walkthrough, downstream install, outside issue, or outside
+merged pull request. More release scaffolding will not answer the usefulness
+question; a consented external walkthrough will.
+
+## Shared working method
+
+1. Work in the repository that owns the change. Do not vendor or nest one
+   repository inside another.
+2. Before making an adoption or popularity claim, check GitHub and the
+   relevant package registry, record the date, and separate maintenance from
+   independent usage.
+3. Treat a real external walkthrough, downstream install, outside issue,
+   merged outside pull request, or consented pilot with feedback as usage
+   evidence. Treat self-authored activity and bot activity as maintenance
+   evidence only. Treat a fork, star, or download as a lead to investigate,
+   never as usage.
+4. Start each public description with the user's job, state the hard
+   boundary, and label the release stage. Do not lead with an AI-shaped
+   promise or a claim the evidence cannot support.
+5. Prefer one completed user interaction over another internal release,
+   issue, or scheduled post. Record negative results too.
+
+## Next evidence to pursue
+
+- PatchGate: one consented non-blocking shadow install by a maintainer
+  outside `daichunghy/*`, followed by feedback on setup, noise, and
+  usefulness.
+- contribkit: one consumer repository or outside maintainer walkthrough that
+  exercises the preflight boundary; merge PR #33 only after its `verify`
+  context is green.
+- OpenSheet-AI: one researcher or operator completing the documented local
+  quickstart and reporting whether the typed plan and receipt match a real
+  spreadsheet task.
+- quant-research: one researcher using an instrument, recode, or emitter in a
+  real study workflow and reporting what was missing or unnecessary.
+- agentsmd: triage the five open Dependabot pull requests, then seek one
+  outside walkthrough of the lint/score loop; investigate whether the
+  forking account can be invited to describe what they tried.
+
+Until those checks exist, the accurate description is: five actively
+maintained public pre-release projects with no verified external adoption.