{
  "schemaVersion": 1,
  "asOf": "2026-11-01",
  "release": "2.5.0",
  "overall": "partial-local",
  "statusSemantics": {
    "implemented": "Executable code exists; does not imply live verification.",
    "passed": "Specified local evidence passed; platform/scope limits remain explicit.",
    "partial": "Only part of criterion or verification matrix is covered.",
    "blocked": "External target/access or unimplemented dependent fixture prevents verification."
  },
  "criteria": [
    {
      "id": "A01",
      "criterion": "Native Codex and Claude Code packages declare their manifests, skill/MCP paths and product routing",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "tests/packaging/packages.test.mjs",
        "tests/unit/sqlcl-transport.test.ts",
        "tests/contracts/mcp.test.mjs"
      ],
      "blocker": "Fresh Codex and Claude Code discovery, work-cycle execution and browser handoff require native-host qualification."
    },
    {
      "id": "A02",
      "criterion": "The Codex host lists the plugin and supports enable/disable without a manual skills-only installation",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": ["tests/unit/sqlcl-transport.test.ts", "tests/contracts/mcp.test.mjs"],
      "blocker": "Fresh Codex installation and lifecycle checks are required on each supported native host."
    },
    {
      "id": "A03",
      "criterion": "MCP runs from the native installation location outside the monorepo",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": ["tests/unit/sqlcl-transport.test.ts", "tests/contracts/mcp.test.mjs"],
      "blocker": "Relocated CLI/stdio MCP tests do not establish a native model-host session."
    },
    {
      "id": "A04",
      "criterion": "The primary bootstrap installs client dependencies and registers the plugin without manual JSON/TOML edits",
      "implementation": "partial",
      "verification": "partial",
      "evidence": [
        "packages/installer/src/toolchain.ts",
        "scripts/setup-smoke.mjs",
        "tests/contracts/dependencies.test.mjs",
        "packages/installer/src/package-source.ts",
        "tests/contracts/setup-source.test.mjs",
        "tests/installers/native-source.test.ts",
        "packages/installer/src/registration.ts",
        "scripts/verify-setup-registration.mjs"
      ],
      "blocker": "macOS client path exercised; Linux/Windows/WSL2 not executed. Project-only Codex scope is blocked."
    },
    {
      "id": "A05",
      "criterion": "Repeated setup is idempotent; interruptions recover and concurrent setup is protected",
      "implementation": "partial",
      "verification": "partial",
      "evidence": [
        "packages/core/src/fs.ts",
        "tests/unit/deployment.test.ts",
        "packages/installer/src/registration.ts",
        "tests/installers/native-source.test.ts",
        "scripts/verify-setup-registration.mjs"
      ],
      "blocker": "Same-host dead lock recovery and repeated offline setup tested; bootstrap interruption/upgrade matrix on all OSes remains incomplete."
    },
    {
      "id": "A06",
      "criterion": "Download integrity failure blocks execution; offline/cache misses do not conceal network requests",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/installers/installer.test.ts", "tests/packaging/packages.test.mjs"],
      "blocker": "Vendor download channels still require per-platform clean-machine evidence."
    },
    {
      "id": "A07",
      "criterion": "Existing Codex settings, Java/Node runtimes and unrelated plugins are preserved",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "packages/installer/src/native.ts",
        "tests/installers/installer.test.ts",
        "tests/contracts/dependencies.test.mjs",
        "packages/installer/src/package-source.ts",
        "tests/contracts/setup-source.test.mjs",
        "tests/installers/native-source.test.ts",
        "packages/installer/src/registration.ts",
        "scripts/verify-setup-registration.mjs",
        "packages/installer/src/uninstall-tools.ts",
        "tests/installers/uninstall-tools.test.ts"
      ],
      "blocker": "Unrelated Codex setting and reused runtimes checked; foreign plugin and every upgrade/failure path require additional fixture coverage."
    },
    {
      "id": "A08",
      "criterion": "The new-app template passes real Oracle compiler validation",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": ["tests/unit/sqlcl-transport.test.ts", "tests/contracts/mcp.test.mjs"],
      "blocker": "Real Oracle compiler checks require the selected supported SQLcl toolchain; connected imports are separate."
    },
    {
      "id": "A09",
      "criterion": "Existing-app export/adopt preserves local edits and application components",
      "implementation": "partial",
      "verification": "partial",
      "evidence": [
        "packages/core/src/oracle.ts",
        "docs/existing-app.md",
        "scripts/integration.mjs",
        "tests/unit/core.test.ts"
      ],
      "blocker": "Local edit preservation is covered by unit fixtures. Actual existing-app no-op export/import and page/LOV preservation evidence is not included; normalization/component fixtures remain incomplete."
    },
    {
      "id": "A10",
      "criterion": "`.apex` metadata/MMD are preserved; unsupported capabilities are not simulated",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": ["packages/core/src/oracle.ts", "tests/unit/core.test.ts"],
      "blocker": "Real compiler validation retains template MMD metadata. Existing-app metadata/component preservation and unsupported-component rejection matrix remain unverified."
    },
    {
      "id": "A11",
      "criterion": "Source mutation after planning and target drift block apply",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": ["packages/core/src/deploy.ts", "tests/unit/deployment.test.ts"],
      "blocker": "Source and target-drift behavior tested with fixtures; actual DB drift requires an authorized target."
    },
    {
      "id": "A12",
      "criterion": "Target DB/service/workspace/schema/application ID are verified before writes",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": ["packages/core/src/oracle.ts", "tests/unit/oracle-performance.test.ts"],
      "blocker": "Fresh target identity and mismatch failures are covered by unit fixtures. Actual connected pre-write/post-write checks and the full negative matrix remain unverified."
    },
    {
      "id": "A13",
      "criterion": "An existing-app backup is created and verified before import; restore uses a separate plan",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": ["packages/core/src/deploy.ts", "tests/unit/deployment.test.ts"],
      "blocker": "Backup-before-import ordering is covered by unit fixtures. The 2026-10-31 fake-Oracle review reproduced full APEXlang restore importing the current configured alias while verifying the backed-up alias, failing after the write when they differ. Actual Oracle backup, restore and restore-failure evidence remains open."
    },
    {
      "id": "A14",
      "criterion": "Migration checksums and journals work without blind reapplication",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": ["packages/core/src/deploy.ts", "tests/unit/deployment.test.ts"],
      "blocker": "Migration history and coordination are local only. The 2026-10-31 local shell/fake-Oracle review reproduced exit-drain descendant termination being accepted as process success and persisted as a succeeded migration. Real Oracle DDL interruption/reconciliation requires an authorized target."
    },
    {
      "id": "A15",
      "criterion": "Concurrent deployments from different runners to the same target are coordinated",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["packages/core/src/deploy.ts", "tests/unit/deployment.test.ts"],
      "blocker": "Local coordination covers one shared managed home/schema. Independent machines/homes require external serialization and separate connected contention checks."
    },
    {
      "id": "A16",
      "criterion": "Unknown/interrupted APEX imports read actual server state, recognize already-applied results or safely replan/retry without blind SQL replay or clearing foreign/live ownership",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "packages/core/src/jobs.ts",
        "packages/core/src/process.ts",
        "tests/unit/deployment.test.ts",
        "tests/unit/core.test.ts",
        "tests/unit/safety-policy.test.ts",
        "tests/unit/working-copy.test.ts",
        "docs/deployment-safety.md"
      ],
      "blocker": "Local recovery fixtures and one authorized connected already-applied reconciliation passed. The 2026-10-31 review reproduced unflagged exit-drain termination and an uncancelled drain SIGKILL after normal process close. Broader lost-response/interruption, multi-host and operation-specific SQL reconciliation remain separate qualification."
    },
    {
      "id": "A17",
      "criterion": "Production-marked targets refuse deploy/restore regardless of locality, local grants, human confirmation or legacy signature flags",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": ["packages/core/src/config.ts", "packages/core/src/deploy.ts", "tests/unit/core.test.ts"],
      "blocker": "Local policy regressions do not establish connected production behavior; no actual production deployment is permitted."
    },
    {
      "id": "A19",
      "criterion": "Confirmed error-free server deployment is success; browser inspection runs only on user request, using built-in or selected browser with separate factual observations",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "packages/core/src/browser.ts",
        "tests/unit/browser.test.ts",
        "plugins/apexrest-apex/skills/apexrest-work/SKILL.md"
      ],
      "blocker": "Local APEX 26.2 authenticated CRUD and negative validation were observed; narrow-layout and broad native-host qualification remain open."
    },
    {
      "id": "A21",
      "criterion": "Secrets are absent from Git, process arguments, MCP output, logs and public artifacts",
      "implementation": "partial",
      "verification": "partial",
      "evidence": [
        "SECURITY.md",
        "packages/core/src/result.ts",
        "packages/core/src/artifacts.ts",
        "tests/packaging/packages.test.mjs"
      ],
      "blocker": "Credential references, private auth, redaction and bundle scan verified locally. The 2026-10-31 disposable-file review reproduced passwordFile containment escaping through a parent-directory symlink. No claim of exhaustive business-secret detection or full live trace audit."
    },
    {
      "id": "A22",
      "criterion": "CLI and MCP apply policy and error classification consistently",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "tests/contracts/mcp.test.mjs",
        "packages/core/src/service.ts",
        "packages/installer/src/package-source.ts",
        "tests/contracts/setup-source.test.mjs",
        "tests/installers/native-source.test.ts",
        "packages/installer/src/registration.ts",
        "scripts/verify-setup-registration.mjs",
        "tests/unit/saved-connections.test.ts",
        "packages/core/src/sqlcl-config.ts",
        "packages/core/src/sqlcl-mcp.ts",
        "tests/unit/sqlcl-transport.test.ts",
        "scripts/verify-sqlcl-transports.mjs"
      ],
      "blocker": "CLI and MCP contracts cover local policy/error behavior; connected target checks remain separate."
    },
    {
      "id": "A23",
      "criterion": "Update/uninstall preserves user projects, backups and unrelated configurations",
      "implementation": "partial",
      "verification": "partial",
      "evidence": [
        "packages/installer/src/native.ts",
        "packages/installer/src/setup.ts",
        "packages/installer/src/registration.ts",
        "tests/installers/native-source.test.ts",
        "scripts/verify-setup-registration.mjs",
        "packages/installer/src/uninstall-tools.ts",
        "tests/installers/uninstall-tools.test.ts"
      ],
      "blocker": "Product uninstall checked in clean profile; full cross-version/platform update/rollback coverage incomplete."
    },
    {
      "id": "A24",
      "criterion": "Release artifacts and the GitHub Pages site build have matching source versions and checksums",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": [
        "scripts/package-release.mjs",
        "scripts/build-site.mjs",
        "tests/packaging/site-markdown.test.mjs"
      ],
      "blocker": "Local release artifact checks remain separate from the branch-hosted GitHub Pages build. Pages settings are main:/docs at https://apexrest-dev.github.io/apexrest/ with no custom domain. Current generated site is prepared locally; newly published output, signed releases and current native/Oracle qualification are not established by this website work.",
      "regeneratedEvidence": ["dist/releases/release-manifest.json", "site-dist/releases/manifest.json"]
    },
    {
      "id": "A25",
      "criterion": "Version-bound npm local-evidence eligibility is separate from full native-platform and Oracle qualification; missing, failed or stale required evidence blocks its applicable gate",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["scripts/check-release-readiness.mjs", "tests/contracts/release-readiness.test.mjs"],
      "blocker": "The retained local-evidence exception is bound to 2.2.0 and does not apply to source version 2.5.0. Current source-bound evidence, CI, package integrity, registry verification and applicable authorization remain required; full native/Oracle qualification is incomplete.",
      "regeneratedEvidence": ["dist/releases/release-readiness.json"]
    },
    {
      "id": "A26",
      "criterion": "Documentation distinguishes verified, experimental and planned capabilities and platform profiles",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "docs/implementation-status.md",
        "docs/next-actions.md",
        "toolchains/compatibility.json",
        "README.md",
        "scripts/check-docs.mjs",
        "tests/unit/saved-connections.test.ts"
      ],
      "blocker": "Fresh native-host and connected qualification is required where applicable."
    },
    {
      "id": "A27",
      "criterion": "Startup does not load the complete Oracle manual, schema or traces into context",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "packages/core/src/references.ts",
        "packages/mcp/src/server.ts",
        "tests/contracts/mcp.test.mjs",
        "tests/unit/apexlang-corpus.test.ts",
        "tests/unit/sqlcl-transport.test.ts"
      ],
      "blocker": "Fresh native-host and connected qualification is required where applicable."
    },
    {
      "id": "A32",
      "criterion": "Plugin-level ORDS HTTP(S) transport preserves APEXlang import/export and direct connection settings without requiring SQLcl saved OREST connections",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "docs/ords.md",
        "packages/core/src/ords.ts",
        "resources/ords/OrdsBridge.java",
        "tests/unit/ords-transport.test.ts",
        "tests/unit/ords-adapter.test.ts",
        "tests/unit/ords-bridge.test.ts",
        "tests/unit/ords-protocol.test.ts"
      ],
      "blocker": "Authorized live CLI no-op import/export and SQL backup verified on a private test target: deterministic pre-import exports and all 21 files identical after import. Changed imports, additional component/static-file/MMD variants, SQL restore, live interruption/reconciliation, remote rollback and Windows remain open. Application browser verification is explicitly deferred by the user. Native-host settings evidence is separate from connected CLI operation evidence."
    },
    {
      "id": "A34",
      "criterion": "Reduce plugin instruction/catalog context, reuse fresh reference normalization and wait for existing jobs within one bounded MCP call without changing authorization, outcomes or effective input constraints",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "tests/unit/jobs-wait.test.ts",
        "tests/unit/references.test.ts",
        "tests/contracts/mcp.test.mjs",
        "scripts/benchmark-plugin-context.mjs"
      ],
      "blocker": "Local byte and retrieval measurements plus isolated runtime tests only. End-to-end native APEX task latency, Oracle performance and billed-token savings remain unmeasured."
    },
    {
      "id": "A35",
      "criterion": "Deterministic Oracle/APEX operations return completed jobs in one bounded call, batch scoped metadata with one target verification and provide concise project inspection while preserving outcomes and recovery",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "docs/codex-automation.md",
        "tests/unit/job-tools.test.ts",
        "tests/unit/metadata-batch.test.ts",
        "tests/unit/project-summary.test.ts",
        "tests/unit/mcp-output.test.ts",
        "tests/contracts/mcp.test.mjs"
      ],
      "blocker": "Local stdio MCP and CLI contracts are covered. SQLcl 26.3 metadata batching was checked on local APEX 26.2; native task latency and billed-token savings are unmeasured."
    },
    {
      "id": "A36",
      "criterion": "All APEXREST implementation runs directly in the current Codex conversation; no plugin model-session controller, team/work startup APIs, team skills, model routing or task controls remain in the executable package",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "plugins/apexrest-apex/skills/apexrest-work/SKILL.md",
        "packages/core/src/operations.ts",
        "packages/mcp/src/server.ts"
      ],
      "blocker": "Local source, CLI/MCP/package and UI checks do not establish live Oracle behavior, native task latency or paid-token savings."
    },
    {
      "id": "A37",
      "criterion": "Offline Universal Theme component catalog covers the reviewed source application inventory, exposes contextual parameters and hash-bound compiler-checked recipes through existing reference MCP tools and CLI, and preserves distinct SQL/import/browser evidence. Public internet page templates retain pinned licensed source provenance and dependency inventories, and remain explicitly separate from dependency-closed ready recipes.",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": [
        "resources/components/manifest.json",
        "resources/components/source/snapshot.json",
        "resources/components/recipes/compiler-evidence.json",
        "tests/unit/component-references.test.ts",
        "tests/contracts/component-source.test.mjs",
        "tests/contracts/component-parameters.test.mjs",
        "tests/packaging/components.test.mjs",
        "resources/public-templates/26.2/manifest.json",
        "resources/public-templates/26.2/source-lock.json",
        "tests/unit/public-templates.test.ts",
        "tests/contracts/public-templates.test.mjs",
        "tests/contracts/component-provenance.test.mjs"
      ],
      "blocker": null
    },
    {
      "id": "A38",
      "criterion": "A separate offline UX pattern catalog accounts for every page and meaningful variant from both reviewed sources, rejects missing or stale page reviews, retrieves original compositions through CLI/MCP, binds ready recipes to compiler evidence, and provides a source-isolated maintenance skill for further applications.",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": [
        "resources/patterns/manifest.json",
        "resources/patterns/source/ux-pattern-catalog/snapshot.json",
        "resources/patterns/recipes/compiler-evidence.json",
        "plugins/apexrest-apex/skills/apexrest-pattern-catalog/SKILL.md",
        "tests/unit/pattern-references.test.ts",
        "tests/contracts/pattern-source.test.mjs",
        "tests/contracts/pattern-recipes.test.mjs",
        "tests/packaging/patterns.test.mjs",
        "resources/patterns/source/universal-theme-reference/snapshot.json",
        "tests/contracts/pattern-coverage.test.mjs"
      ],
      "blocker": null
    },
    {
      "id": "A39",
      "criterion": "Single-editor working copies for existing dev/test apps: APEXlang baseline once, three locally verified real plan/apply cycles without exports, restart persistence and safety failures blocked at a fake Oracle boundary.",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": [
        "packages/core/src/sync.ts",
        "packages/core/src/deploy.ts",
        "tests/unit/working-copy.test.ts",
        "tests/unit/sync-metadata.test.ts",
        "tests/contracts/working-copy.test.mjs"
      ],
      "blocker": null
    },
    {
      "id": "A40",
      "criterion": "Connected working-copy baseline, three changed full imports across restart, authenticated browser, actual fault recovery and separate initial APEXlang restore on an authorized DEV target.",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "docs/evidence/plugin-server/read-only.json",
        "docs/evidence/plugin-server/imports-261.json",
        "docs/evidence/plugin-server/final-audit.json",
        "docs/evidence/plugin-server/browser-261.json",
        "docs/next-actions.md"
      ],
      "blocker": "Authorized APEX 26.1.5 baseline, three title-only imports across restart, final 21-file audit and browser shell checks passed. Actual fault recovery, separate backup restore, business behavior and current installed-host qualification remain unverified."
    },
    {
      "id": "CMP000",
      "criterion": "Checkout audit and integration map",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP001",
      "criterion": "Baseline checks and execution log",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP002",
      "criterion": "ADR, threat model and acceptance IDs",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP003",
      "criterion": "Strict schemas and contract dialect",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "Full structural contract dialect is incomplete."
    },
    {
      "id": "CMP004",
      "criterion": "Safe YAML/JSON reading and package paths",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP005",
      "criterion": "Canonical snapshots and content digests",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP006",
      "criterion": "Tracked state, base store and runtime journal model",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP007",
      "criterion": "Executable block registry over existing catalogs",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP008",
      "criterion": "Search, filters and explainable shortlist",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "Compatibility/contract-aware ranking and complete qualification filters remain incomplete."
    },
    {
      "id": "CMP009",
      "criterion": "Compatibility profiles and evidence policy",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "Independent profile/configuration/fixture/toolchain qualification policy is incomplete."
    },
    {
      "id": "CMP010",
      "criterion": "Immutable local cache and index lifecycle",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP011",
      "criterion": "Project inventory and reader adapter",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "Complete resource reference graph remains incomplete."
    },
    {
      "id": "CMP012",
      "criterion": "Oracle metadata for keys, types and signatures",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP013",
      "criterion": "Dataset contracts and entity binding",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "Full producer/consumer dataset compatibility remains incomplete."
    },
    {
      "id": "CMP014",
      "criterion": "Commands, authorization contracts and transaction semantics",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "The 2026-10-31 local binding review reproduced unqualified parameterless routine names passing both the row-predicate and write-authorization expression guards. Oracle runtime side effects were not executed."
    },
    {
      "id": "CMP015",
      "criterion": "Deterministic dependency and capability resolver",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP016",
      "criterion": "Stable allocator and shared resource ownership",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "Shared LOV semantic deduplication and ownership are absent."
    },
    {
      "id": "CMP017",
      "criterion": "Typed event, action and route wiring",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "Independent typed route mappings remain incomplete."
    },
    {
      "id": "CMP018",
      "criterion": "Composition plan and diagnostics",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP019",
      "criterion": "Bounded APEXlang structural transformer",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP020",
      "criterion": "Journaled local materialization and recovery",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP021",
      "criterion": "Idempotence and basic ownership modes",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "Hosted summary detach is coupled to page ownership; shared resource ownership is incomplete."
    },
    {
      "id": "CMP022",
      "criterion": "Binding to the existing deployment pipeline",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "Live qualification deferred by agreed scope."
    },
    {
      "id": "CMP023",
      "criterion": "Isolated CRM fixture and API contract",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "tests/unit/composer.test.ts",
        "scripts/verify-composer.mjs",
        "tests/fixtures/composer/crm.sql",
        "tests/fixtures/composer/service-desk.sql"
      ],
      "blocker": "Live qualification deferred by agreed scope."
    },
    {
      "id": "CMP024",
      "criterion": "First runnable read-only list",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "tests/unit/composer.test.ts",
        "scripts/verify-composer.mjs",
        "tests/fixtures/composer/crm.sql",
        "tests/fixtures/composer/service-desk.sql"
      ],
      "blocker": "Live qualification deferred by agreed scope."
    },
    {
      "id": "CMP025",
      "criterion": "Modal form saved through an API",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "tests/unit/composer.test.ts",
        "scripts/verify-composer.mjs",
        "tests/fixtures/composer/crm.sql",
        "tests/fixtures/composer/service-desk.sql"
      ],
      "blocker": "Live qualification deferred by agreed scope."
    },
    {
      "id": "CMP026",
      "criterion": "Summary block and inter-block refresh events",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "tests/unit/composer.test.ts",
        "scripts/verify-composer.mjs",
        "tests/fixtures/composer/crm.sql",
        "tests/fixtures/composer/service-desk.sql"
      ],
      "blocker": "Live qualification deferred by agreed scope."
    },
    {
      "id": "CMP027",
      "criterion": "End-to-end Oracle/browser qualification",
      "implementation": "partial",
      "verification": "partial",
      "evidence": [
        "tests/unit/composer.test.ts",
        "scripts/verify-composer.mjs",
        "tests/fixtures/composer/crm.sql",
        "tests/fixtures/composer/service-desk.sql"
      ],
      "blocker": "Live qualification deferred by agreed scope."
    },
    {
      "id": "CMP028",
      "criterion": "Public CLI surface",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts", "tests/contracts/composer.test.mjs"],
      "blocker": null
    },
    {
      "id": "CMP032",
      "criterion": "Version upgrade and structural three-way merge",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP033",
      "criterion": "Remove/detach, dependency cleanup and migration seam",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "Shared-resource consumers and typed migration references are absent."
    },
    {
      "id": "CMP034",
      "criterion": "Library expansion and two application blueprints",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "tests/unit/composer.test.ts",
        "scripts/verify-composer.mjs",
        "tests/fixtures/composer/crm.sql",
        "tests/fixtures/composer/service-desk.sql"
      ],
      "blocker": "Live qualification deferred by agreed scope."
    },
    {
      "id": "CMP035",
      "criterion": "Local authoring and capture of a finished block",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts", "scripts/composer-author.mjs"],
      "blocker": "Capture records declaration facts; arbitrary source normalization into executable blocks is absent."
    },
    {
      "id": "CMP036",
      "criterion": "Trust, provenance and supply-chain hardening",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": null
    },
    {
      "id": "CMP037",
      "criterion": "Security/property/fault regression suite",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "Remaining property/adversarial/deployment matrix cases are not implemented."
    },
    {
      "id": "CMP038",
      "criterion": "Benchmarks and agent workflow evaluation",
      "implementation": "partial",
      "verification": "partial",
      "evidence": [
        "tests/unit/composer.test.ts",
        "scripts/benchmark-composer.mjs",
        "docs/evidence/perf-p0-p1/performance-after.json",
        "docs/evidence/perf-p0-p1/comparison.json",
        "docs/evidence/plugin-server/performance-20.json"
      ],
      "blocker": "Matched recipe adaptation and broader workflow measurements are absent."
    },
    {
      "id": "CMP039",
      "criterion": "Bundling and clean-install checks",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": ["tests/unit/composer.test.ts", "tests/contracts/composer.test.mjs"],
      "blocker": null
    },
    {
      "id": "CMP040",
      "criterion": "Current platform and release gates",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "Hosted CI establishes local quality gates. Native Linux/Windows Composer and connected Oracle behavior require separate qualification."
    },
    {
      "id": "CMP041",
      "criterion": "Current documentation, acceptance and release readiness",
      "implementation": "partial",
      "verification": "partial",
      "evidence": ["tests/unit/composer.test.ts"],
      "blocker": "Composer remains experimental; complete shared-resource ownership and runtime qualification before stable acceptance."
    },
    {
      "id": "APEX262-01",
      "criterion": "Release-specific 26.1 and 26.2 toolchains, references, starter templates and read-only capability diagnostics",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "toolchains/compatibility.json",
        "toolchains/toolchain-26.2.lock.json",
        "tests/unit/reference-releases.test.ts",
        "tests/unit/apex-capabilities.test.ts"
      ],
      "blocker": "Release/profile fixtures do not establish connected behavior on every compiler build or operating system."
    },
    {
      "id": "APEX262-02",
      "criterion": "Automatic or explicit page/shared-file APEXlang imports with scoped conflicts/backups/readback, native page export, disclosed shared-component full observation and separate APEXlang restore",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "tests/unit/partial-import.test.ts",
        "tests/unit/partial-export.test.ts",
        "tests/unit/apexlang-equivalence.test.ts",
        "docs/evidence/fast-apexlang-scope/latest.json"
      ],
      "blocker": "Authorized local 26.2 page creation/replacement, shared LOV creation/replacement, selected-page APEXlang restore and authenticated dashboard/LOV rendering passed. Native LOV/list selected export is unavailable on the tested target; component imports disclose full APEXlang observation. Broader component families, independent-machine coordination, ORDS and SQLcl MCP-mode imports remain unqualified or unsupported."
    },
    {
      "id": "APEX262-03",
      "criterion": "26.2 AI/report/workflow/security authoring guidance, real offline recipe compilation and advisory CodeScan/upgrade diagnostics",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "resources/references/26.2/oracle-snapshot.json",
        "resources/references/26.2/recipes/verification.json",
        "tests/unit/apex262-compatibility.test.ts"
      ],
      "blocker": "Provider calls, DDS enforcement, OCI IAM/network provisioning, running-workflow migration and broader UI combinations are not runtime-qualified by compiler/metadata evidence."
    },
    {
      "id": "APEX262-04",
      "criterion": "Current native Codex and Claude Code host discovery and execution with the 26.2 package",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": ["tests/contracts/mcp.test.mjs", "scripts/repository-plugin-smoke.mjs"],
      "blocker": "Fresh Codex and Claude Code work cycles, ship/job execution and browser handoff require native-host qualification."
    },
    {
      "id": "VERIFY-01",
      "criterion": "The plugin has no automated application unit/SQL/API/UI runners, no browser-auth-state capture and no browser-install step; repository self-tests remain",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": [
        "packages/core/src/operations.ts",
        "packages/installer/src/toolchain.ts",
        "tests/contracts/dependencies.test.mjs",
        "tests/unit/agent-surface.test.ts",
        "tests/packaging/packages.test.mjs",
        "tests/unit/cli-main.test.ts",
        "scripts/repository-plugin-smoke.mjs"
      ]
    },
    {
      "id": "SAFETY-01",
      "criterion": "No folder trust requirement; QA support; effective local-target rules; operation-aware remote exact-plan confirmation; ignored local ENV credentials without secret outputs",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "tests/unit/safety-policy.test.ts",
        "packages/core/src/sql-review.ts",
        "packages/core/src/local-env.ts",
        "docs/deployment-safety.md"
      ],
      "blocker": "Local regressions and requested DEV demo are separate from broad transport/platform qualification. The 2026-10-31 review reconfirmed missing remote confirmation for parameterless query calls and calls inside CTAS, and reproduced unflagged exit-drain termination, a delayed group SIGKILL after normal close and a passwordFile parent-symlink escape. These defects remain open. Real stalled Oracle/JVM, Windows and native-host process termination remain unqualified."
    },
    {
      "id": "REF262-01",
      "criterion": "Complete official Oracle 26.2 inventory bytes, contextual properties, ordinary search with accelerator integrity/recovery and packaged MCP pagination; independent new-release and ancillary-source discovery",
      "implementation": "implemented",
      "verification": "passed",
      "evidence": [
        "resources/references/26.2/oracle-snapshot.json",
        "scripts/verify-oracle-apexlang-coverage.mjs",
        "tests/unit/reference-releases.test.ts",
        "tests/unit/oracle-upstream-sync.test.ts",
        "plugins/apexrest-apex/skills/apexrest-oracle-sync/SKILL.md",
        "docs/oracle-apexlang-coverage.md"
      ],
      "blocker": "This criterion covers the pinned source inventory and local packaged retrieval only. Oracle target behavior, new release qualification and native host/browser behavior remain separate."
    },
    {
      "id": "HOST-PARITY-01",
      "criterion": "Codex and Claude Code use one canonical skill/runtime flow, equivalent scoped ship contracts and the same managed Node/home bindings; both marketplaces remain installable",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "tests/contracts/host-parity.test.mjs",
        "tests/installers/native-source.test.ts",
        "tests/packaging/packages.test.mjs",
        "tests/unit/partial-import.test.ts",
        "docs/evidence/host-parity/latest.json"
      ],
      "blocker": "Manifest-driven subprocess and installer fixtures do not prove fresh native model-host skill/tool execution. Managed setup registers Codex only; Claude uses its native plugin registration commands. No new Oracle or browser run is authorized by host parity work."
    },
    {
      "id": "DECISIONS-01",
      "criterion": "Opt-in project Decisions API selects compatible catalog components in one batch, with bounded local fallback and current-host APEXlang generation",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "tests/unit/reference-selection.test.ts",
        "tests/contracts/reference-selection.test.mjs",
        "docs/component-catalog.md",
        "docs/evidence/decisions/local.json",
        "docs/evidence/decisions/live-benchmark.json",
        "tests/plugin-server/apex-26.1.cases.json#A261-069",
        "docs/evidence/decisions/page-ab/report.json"
      ],
      "blocker": "Four fixed selection scenarios have 20 successful warm samples each; 89/92 attempts used Decisions, with three HTTP fallbacks. A separate one-page API generation pilot completed three runs per flag at the same offline compiler/46-check threshold, retaining one timeout fallback and all repairs. Fixed two-template retrieval is not native-host authoring; broader semantic quality, cold-process/backend-cache distributions, connected Oracle and browser behavior remain unqualified. Timeout usage is unavailable."
    },
    {
      "id": "PEER-01",
      "criterion": "Cross-vendor peer review runs the other agent CLI read-only on a saved ship plan, records a digest-bound verdict and gates apply in required mode",
      "implementation": "implemented",
      "verification": "partial",
      "evidence": [
        "tests/unit/peer-review.test.ts",
        "tests/contracts/mcp.test.mjs",
        "docs/configuration.md#cross-vendor-peer-review",
        "docs/evidence/peer-review/real-cli-20261101.json"
      ],
      "blocker": "Fake-CLI unit tests and one real Codex 0.160.0 and Claude Code 2.1.296 fixture review on macOS passed. Native-host MCP sessions on a real saved plan, Windows CLI shims and current Anthropic terms for headless subscription use remain unverified."
    }
  ]
}