fix: align review promises with implementation

[fall-out-bug]

Summary

• Fix codex-only init so the target manifest is narrowed to the selected harness set before adapter doctor verification.
• Publish the source installer into the public sdp mirror surface and document that boundary.
• Align maturity, trust, and coverage docs with the current release and CI behavior.
• Tighten metadata drift detection so source-repo clone URLs are allowed while stale distribution URLs still fail.

Evidence

• go test -tags sqlite_fts5 ./cmd/sdp ./internal/adapters ./internal/manifest -count=1
• scripts/check-public-metadata.sh --json
• scripts/check-release-surface.sh
• scripts/sdp-publish.sh --pr (created publish: sync protocol artifacts (2026-04-29) sdp#134)

Beads

• sdplab-jglv
• sdplab-do6j
• sdplab-e11x
• sdplab-ndzp
• sdplab-387l

[github-actions]

SDP Auto-Attestation

Field	Value
Branch	fix/review-promises
Commit	a1ba9c97
Changed files	11
Tests	✅ pass (5673 passed, 0 failed)
Lint	✅
Scope	✅ no linked workstreams — auto-attested from CI observation
Attestation generation	✅
Coverage	⚠️ 65.40300751879703%
Signed	✅ Sigstore bundle
Beads	none

Full attestation report

{
  "all_lint_pass": true,
  "all_tests_pass": true,
  "attestation_id": "ci-auto-144-a1ba9c97",
  "beads_ids": [],
  "branch": "fix/review-promises",
  "changed_files": 11,
  "coverage_ok": false,
  "coverage_pct": 65.40300751879703,
  "coverage_threshold": 80,
  "generated_at": "2026-04-29T06:48:14Z",
  "head_commit": "a1ba9c9711f79f8f5ae048f72e7b8fe5569bf6df",
  "lint_results": [
    {
      "name": "go-vet",
      "status": "pass"
    },
    {
      "name": "golangci-lint",
      "status": "pass"
    }
  ],
  "out_of_scope": [],
  "scope_compliance": {
    "ok": true,
    "reason": "no linked workstreams — auto-attested from CI observation"
  },
  "test_results": [
    {
      "name": "go-test",
      "status": "pass (5673 passed, 0 failed)"
    }
  ],
  "type": "ci-auto-attestation"
}

Generated by SDP auto-attestation

[github-actions]

SDP Auto-Attestation

Field	Value
Branch	fix/review-promises
Commit	e86dbd43
Changed files	41
Tests	✅ pass (5735 passed, 0 failed)
Lint	✅
Scope	✅ no linked workstreams — auto-attested from CI observation
Attestation generation	✅
Coverage	⚠️ 65.23940520446097%
Signed	✅ Sigstore bundle
Beads	none

Full attestation report

{
  "all_lint_pass": true,
  "all_tests_pass": true,
  "attestation_id": "ci-auto-144-e86dbd43",
  "beads_ids": [],
  "branch": "fix/review-promises",
  "changed_files": 41,
  "coverage_ok": false,
  "coverage_pct": 65.23940520446097,
  "coverage_threshold": 80,
  "generated_at": "2026-04-29T15:55:42Z",
  "head_commit": "e86dbd436574bc7a74c29147a16f4cab8dd3111c",
  "lint_results": [
    {
      "name": "go-vet",
      "status": "pass"
    },
    {
      "name": "golangci-lint",
      "status": "pass"
    }
  ],
  "out_of_scope": [],
  "scope_compliance": {
    "ok": true,
    "reason": "no linked workstreams — auto-attested from CI observation"
  },
  "test_results": [
    {
      "name": "go-test",
      "status": "pass (5735 passed, 0 failed)"
    }
  ],
  "type": "ci-auto-attestation"
}

Generated by SDP auto-attestation

[github-actions]

SDP Auto-Attestation

Field	Value
Branch	fix/review-promises
Commit	161861d1
Changed files	43
Tests	✅ pass (5737 passed, 0 failed)
Lint	✅
Scope	✅ no linked workstreams — auto-attested from CI observation
Attestation generation	✅
Coverage	⚠️ 65.2460966542751%
Signed	✅ Sigstore bundle
Beads	none

Full attestation report

{
  "all_lint_pass": true,
  "all_tests_pass": true,
  "attestation_id": "ci-auto-144-161861d1",
  "beads_ids": [],
  "branch": "fix/review-promises",
  "changed_files": 43,
  "coverage_ok": false,
  "coverage_pct": 65.2460966542751,
  "coverage_threshold": 80,
  "generated_at": "2026-04-29T16:16:15Z",
  "head_commit": "161861d175c6b0fc836d7aeade8faea2158d6f00",
  "lint_results": [
    {
      "name": "go-vet",
      "status": "pass"
    },
    {
      "name": "golangci-lint",
      "status": "pass"
    }
  ],
  "out_of_scope": [],
  "scope_compliance": {
    "ok": true,
    "reason": "no linked workstreams — auto-attested from CI observation"
  },
  "test_results": [
    {
      "name": "go-test",
      "status": "pass (5737 passed, 0 failed)"
    }
  ],
  "type": "ci-auto-attestation"
}

Generated by SDP auto-attestation

[github-actions]

SDP Auto-Attestation

Field	Value
Branch	fix/review-promises
Commit	f7f36511
Changed files	45
Tests	✅ pass (5740 passed, 0 failed)
Lint	✅
Scope	✅ no linked workstreams — auto-attested from CI observation
Attestation generation	✅
Coverage	⚠️ 65.43345724907066%
Signed	✅ Sigstore bundle
Beads	none

Full attestation report

{
  "all_lint_pass": true,
  "all_tests_pass": true,
  "attestation_id": "ci-auto-144-f7f36511",
  "beads_ids": [],
  "branch": "fix/review-promises",
  "changed_files": 45,
  "coverage_ok": false,
  "coverage_pct": 65.43345724907066,
  "coverage_threshold": 80,
  "generated_at": "2026-04-30T07:11:19Z",
  "head_commit": "f7f3651119167fa0fd75b237d9458c7ee2f46ed3",
  "lint_results": [
    {
      "name": "go-vet",
      "status": "pass"
    },
    {
      "name": "golangci-lint",
      "status": "pass"
    }
  ],
  "out_of_scope": [],
  "scope_compliance": {
    "ok": true,
    "reason": "no linked workstreams — auto-attested from CI observation"
  },
  "test_results": [
    {
      "name": "go-test",
      "status": "pass (5740 passed, 0 failed)"
    }
  ],
  "type": "ci-auto-attestation"
}

Generated by SDP auto-attestation