toolchains
Status: available. Evidence tier: Tier2Structural. Counts required local tools before analysis runs.
Demo result
The public demo already produces a readable first evidence packet.
The current public demo scans checked-in .NET and TypeScript samples, writes local scan artifacts, and produces public-safe summary files that show available sections, deferred sections, evidence tiers, rule IDs, coverage labels, counts, and reasons.
Public claim level: demo. This page describes the current first-slice demo result. It does not claim runtime behavior, production traffic, deployment state, endpoint performance, release safety, or AI impact analysis.
Run
Generate the result from a clean checkout.
Use an ignored output directory when running inside the repository. The summary files are designed for public-safe inspection; raw scan artifacts stay local.
git clone https://github.com/joefeser/tracemap.git
cd tracemap
./scripts/demo-public.sh .tracemap-demo
sed -n '1,160p' .tracemap-demo/demo-summary.mdWhat runs today
The first demo slice demonstrates the scan packet shape across checked-in samples.
Toolchain checksStatus: available. The script checks `git`, `.NET`, `node`, and `npm` before writing the summary.
BuildStatus: available. The demo builds the .NET CLI and TypeScript adapter used by the sample scans.
.NET modern sampleStatus: available. Produces the required scan artifacts under the generated output root.
.NET endpoint server sampleStatus: available. Produces static endpoint and scan evidence from checked-in sample code.
TypeScript modern sampleStatus: available. Produces reducer-compatible TypeScript scan artifacts.
TypeScript endpoint client sampleStatus: available. Produces static client-side endpoint evidence from checked-in sample code.
Summary files
The public-safe result is a status ledger, not a raw artifact dump.
demo-summary.mdHuman-readable table with section name, status, evidence tier, rule IDs, coverage, counts, and reasons.demo-summary.jsonMachine-readable section rows with a hashed output-root label instead of an absolute local path.public.demo.summary.v1Rule ID used for demo summary rows so each public conclusion remains rule-backed.Tier2StructuralEvidence tier for available demo sections such as toolchain checks, build, and sample scans.Tier4UnknownEvidence tier for deferred, unavailable, or failed sections where the demo cannot make a stronger claim.Representative section rows
The exact counts can vary with toolchain coverage, but the statuses are explicit.
python
Status: not_requested by default. Python scanning is opt-in for this demo slice and must use an isolated environment when requested.
jvm
Status: unavailable when Java 21 is absent, or deferred when Java 21 exists but JVM demo assertions are still follow-up work.
build
Status: available. The demo builds the .NET and TypeScript tooling needed for the checked-in sample scans.
sample-scans
Status: available. Four checked-in samples produce manifests, facts, SQLite indexes, reports, and analyzer logs.
deferred sections
Status: deferred. Follow-up slices will add combined report, paths/reverse, portfolio, diff, impact, and release-review assertions.
Current deferred work
Deferred rows are part of the result because silence would be misleading.
combine-and-dependency-reportDeferred: a follow-up slice will combine generated sample indexes and run dependency report assertions.
paths-and-reverseDeferred: a follow-up slice will run path and reverse assertions after combined report wiring lands.
portfolioDeferred: a follow-up slice will generate a portfolio manifest from generated indexes.
diffDeferred: no concrete checked-in before/after fixture pair exists yet.
impactDeferred: no concrete checked-in before/after fixture pair exists yet.
release-reviewDeferred: compatible before/after inputs and delta fixtures are not part of the first public demo slice.
Artifact safety
Share summaries; keep raw generated internals local.
demo-summary.*Public-shareable after the generated-output sentinel scan passes.reports/**/*.mdPublic-shareable only when generated from public samples and scrubbed by sentinel checks.scans/**/scan-manifest.jsonLocal-only generated artifact; may contain temporary execution details.scans/**/facts.ndjsonLocal-only fact stream for deeper inspection and reducer input.scans/**/index.sqliteLocal-only queryable index; do not publish private-repo SQLite artifacts raw.scans/**/logs/analyzer.logLocal-only diagnostic log for extraction and coverage troubleshooting.Claim boundary
What this demo result supports right now.
- Safe: the demo can generate scan packets and public-safe summary rows from checked-in .NET and TypeScript samples.
- Safe: the current result makes deferred sections visible instead of hiding them.
- Safe: the summaries can orient a review conversation around static evidence, rule IDs, evidence tiers, coverage labels, and gaps.
- Not safe: claiming the first demo slice proves combined paths, reverse queries, portfolio reports, diff, impact, release review, runtime behavior, production traffic, or release safety.
Source material