[i-shutov]

Scope / ownership

Lane C only, based on main f2a55fa13fd9a1e0af2718bc328ed16786975184 (C02 #13 already merged). Changes restricted to extensions/qa/, docs/EXTENSIONS.md, C03 plans/ and insights/. No A/B/D, workflows, Rust core or GUI modifications.

Actual implementation

• New extensions/qa/verify_smoke.py: reads original C02 output summary.json, per-fixture TOML, logs and PDFs; verifies current-tree source/log/PDF SHA-256, fixed manifest mapping and XeLaTeX, positive one-page PDFs with external pdfinfo, and the specific LuaTeX-required graphdrawing negative diagnostic with no PDF.
• Five-fixture suite required by default; explicit --allow-partial returns scope=selected_only and complete_suite=false. No visual-edit, installed-package, or global package compatibility flags are set.
• test_verify_smoke.py contains 10 offline regression tests including altered sources/logs, fake negative, tampered summary, mixed hosts, symlinks and non-one-page PDFs.
• Usage, plan, QA log and honest provenance caveats in owned docs.

Executed QA, not extrapolated

Local Python 3.13.5 10/10 unit tests PASS (mocked pdfinfo, local matching C02 helper functions). On Linux using actual XeTeX (TeX Live 2025/dev Debian), the five exact checked-in fixture sources (source SHA matched historic CSV) were compiled with -no-shell-escape: 4 produced 1-page PDFs with exit 0, Lua-only graphdrawing exited 1 with explicit engine error. A one-off local C02-v1-format recorder and the C03 auditor returned accepted=true, complete_suite=true, verified_fixtures=5. This does not establish end-to-end invocation of the untouched production run_smoke.py, which remains a CI/integration gate. Local cargo/rustc unavailable.

Outstanding gates / truthful limitations

• Exact-head GitHub Actions: pending until checked after PR creation; CI currently does not run this new Python suite or production C02 recorder+auditor; D owns that workflow integration.
• Windows 10 x64 physical smoke NOT_RUN. Physical macOS ARM64 M1/M4 GUI smoke NOT_RUN. Hosted Windows Server/macOS builds are not substitutes.
• Artifact hashing is not signed provenance or trusted-host attestation. Neither rendering nor a TOML record proves visual editing. Lua-driven graphdrawing is intentionally incompatible with XeLaTeX.

Please coordinate D to run and upload run_smoke.py + verify_smoke.py outputs in all hosted environments and verify the exact PR-head CI; keep draft until gates are reviewed.