Fix Conductor validation coverage and document operational readiness

[Steel-tech]

check:shell previously passed every script after the first as arguments to Bash instead of checking their syntax. Validate each entrypoint and add a regression for a later filename containing spaces, while proving scripts are never executed. Explicitly bind ten reconciliation test calls to their fake Herdr binary so an operator’s HERDR_BIN_PATH cannot change the test outcome.

Update the Stage 3 cheatsheet, add first-run/readiness guidance, and link the canonical suite documentation. Package and manifest remain 0.4.0; product runtime authority is unchanged in this PR.

Validation at merged head bf67d318067c60318dcd7089897f513bfefe3af7:

• Node 24.18.0 full npm run check: 542 tests passed, zero failures, with a deliberately nonexistent ambient Herdr path; all subsequent static/evidence checks passed.
• Node 20.20.2 corrected reconciliation tests: 7 passed; shell/documentation tests: 8 passed; targeted stand-down retry test: 1 passed.
• Shell syntax, ShellCheck, pinned Actionlint, manifest, documentation, historical evidence, and diff checks passed.
• CI fully green on push and PR runs: Linux Node 20/LTS and macOS Node 20/system Bash 3.2 each passed 542 full tests and 496 explicit Stage 2/3 tests. Independent review found no actionable defects; CodeRabbit green.

Base: 46d02c21352ad9ae6b3d6795775df56296ce516f. Merged head: bf67d318067c60318dcd7089897f513bfefe3af7. No effect/crash boundary changed; zero-CAS and retry negatives now reach their intended checks regardless of ambient binary selection. Runtime/security/private-state/role/source-evidence contracts retain their existing boundaries. Historical evidence was not regenerated or promoted as new live proof.

Limitations remain cooperative same-UID records, final-check/pane-close TOCTOU, assertion-only worker results, retained resources, SHA-1-width Git, and no ambiguous-operation recovery outside the bounded Stage 3 apply publication. This PR did not add a new live installation claim. No adapter, unattended operation, cleanup, Browser integration, site code, product push/tag/release automation, CI configuration, or security-policy behavior change is included. Subsequent runtime fixes and developer smoke evidence are separate changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 12418e7a-d7e8-4e6c-a514-a1cb668d0fe7

📥 Commits

Reviewing files that changed from the base of the PR and between 46d02c2 and bf67d31.

📒 Files selected for processing (7)

• README.md
• docs/herdr-plugins-cheatsheet.md
• docs/readiness.md
• package.json
• tests/shell-validation.test.mjs
• tests/stage1-runtime-reconcile.test.mjs
• tests/stage1-runtime-stand-down-archive.test.mjs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request adds Conductor readiness documentation, updates runtime boundary guidance, changes shell validation to check scripts individually, adds shell-validation coverage, and supplies a fake Herdr executable in runtime tests.

Changes

Readiness and validation

Layer / File(s)	Summary
Runtime readiness documentation README.md, docs/readiness.md, docs/herdr-plugins-cheatsheet.md	The documentation adds readiness and suite-guide links, defines the Conductor runtime contract, and records compatibility, workflow, boundary, and security details.
Shell validation command and test package.json, tests/shell-validation.test.mjs, README.md	check:shell validates each script separately with bash -n. The test covers filenames with spaces, later-script failures, non-execution, cleanup, and successful validation.
Runtime test executable wiring tests/stage1-runtime-reconcile.test.mjs, tests/stage1-runtime-stand-down-archive.test.mjs	Updated reconcile calls pass herdrBin: "fake".

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to bf67d

The changes improve validation isolation and operational guidance without introducing an established merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the primary changes: fixing Conductor validation coverage and documenting operational readiness.
Description check	✅ Passed	The description covers the scope, runtime and destructive-operation boundaries, validation evidence, contract alignment, retained limitations, and out-of-scope changes. It provides exact test results …

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch improve/suite-readiness

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}