docs: align rustdoc with README, add doc review to maintenance

crates/bashkit-python/README.md

@@ -15,7 +15,7 @@ print(result.stdout)  # Hello, World!
 ## Features
 
 - **Sandboxed execution** — all commands run in-process with a virtual filesystem, no containers needed
-- **68+ built-in commands** — echo, cat, grep, sed, awk, jq, curl, find, and more
+- **100+ built-in commands** — echo, cat, grep, sed, awk, jq, curl, find, and more
 - **Full bash syntax** — variables, pipelines, redirects, loops, functions, arrays
 - **Resource limits** — protect against infinite loops and runaway scripts
 - **Framework integrations** — LangChain, PydanticAI, and Deep Agents
@@ -145,7 +145,7 @@ print(result.stdout)  # Alice
 ## Features
 
 - **Sandboxed, in-process execution**: All commands run in isolation with a virtual filesystem
-- **68+ built-in commands**: echo, cat, grep, sed, awk, jq, curl, find, and more
+- **100+ built-in commands**: echo, cat, grep, sed, awk, jq, curl, find, and more
 - **Full bash syntax**: Variables, pipelines, redirects, loops, functions, arrays
 - **Resource limits**: Protect against infinite loops and runaway scripts
 

crates/bashkit/src/lib.rs

@@ -15,20 +15,23 @@
 //! - **Experimental: Git** - Virtual git operations on the VFS (`git` feature)
 //! - **Experimental: Python** - Embedded Python via [Monty](https://github.com/pydantic/monty) (`python` feature)
 //!
-//! # Built-in Commands (68+)
+//! # Built-in Commands (100+)
 //!
 //! | Category | Commands |
 //! |----------|----------|
-//! | Core | `echo`, `printf`, `cat`, `read` |
-//! | Navigation | `cd`, `pwd`, `ls`, `find` |
+//! | Core | `echo`, `printf`, `cat`, `nl`, `read` |
+//! | Navigation | `cd`, `pwd`, `ls`, `find`, `pushd`, `popd`, `dirs` |
 //! | Flow control | `true`, `false`, `exit`, `return`, `break`, `continue`, `test`, `[` |
-//! | Variables | `export`, `set`, `unset`, `local`, `shift`, `source`, `.` |
-//! | Text processing | `grep`, `sed`, `awk`, `jq`, `head`, `tail`, `sort`, `uniq`, `cut`, `tr`, `wc` |
-//! | File operations | `mkdir`, `rm`, `cp`, `mv`, `touch`, `chmod`, `rmdir` |
+//! | Variables | `export`, `set`, `unset`, `local`, `shift`, `source`, `.`, `eval`, `readonly`, `times`, `declare`, `typeset`, `let` |
+//! | Shell | `bash`, `sh` (virtual re-invocation), `:`, `trap`, `caller`, `getopts`, `shopt` |
+//! | Text processing | `grep`, `sed`, `awk`, `jq`, `head`, `tail`, `sort`, `uniq`, `cut`, `tr`, `wc`, `paste`, `column`, `diff`, `comm`, `strings`, `tac`, `rev`, `seq`, `expr` |
+//! | File operations | `mkdir`, `mktemp`, `rm`, `cp`, `mv`, `touch`, `chmod`, `chown`, `ln`, `rmdir`, `realpath` |
 //! | File inspection | `file`, `stat`, `less` |
 //! | Archives | `tar`, `gzip`, `gunzip` |
-//! | Utilities | `sleep`, `date`, `basename`, `dirname`, `timeout`, `wait`, `xargs`, `tee` |
-//! | Shell | `bash`, `sh` (virtual re-invocation), `eval`, `:` |
+//! | Byte tools | `od`, `xxd`, `hexdump` |
+//! | Utilities | `sleep`, `date`, `basename`, `dirname`, `timeout`, `wait`, `watch`, `yes`, `kill` |
+//! | Disk | `df`, `du` |
+//! | Pipeline | `xargs`, `tee` |
 //! | System info | `whoami`, `hostname`, `uname`, `id`, `env`, `printenv`, `history` |
 //! | Network | `curl`, `wget` (requires [`NetworkAllowlist`])
 //! | Experimental | `python`, `python3` (requires `python` feature), `git` (requires `git` feature)
@@ -349,6 +352,7 @@
 //! - [`custom_builtins_guide`] - Creating custom builtins
 //! - `python_guide` - Embedded Python (Monty) guide (requires `python` feature)
 //! - [`compatibility_scorecard`] - Feature parity tracking
+//! - `logging_guide` - Structured logging with security (requires `logging` feature)
 //!
 //! # Resources
 //!

specs/012-maintenance.md

@@ -46,11 +46,30 @@ regressions, stale docs, dependency rot, and security gaps.
 
 ### 4. Documentation
 
-- [ ] `README.md` feature list matches implemented builtins
+#### Rust Docs (crate-level + guides)
+
+- [ ] `lib.rs` crate-level docs command count matches reality
+- [ ] `lib.rs` command table categories and entries match `README.md`
+- [ ] `lib.rs` Guides section lists all doc modules (custom_builtins, python, compatibility, threat_model, logging)
+- [ ] `lib.rs` feature list matches `README.md` feature list
+- [ ] `lib.rs` code examples compile: `cargo test --doc --all-features`
 - [ ] `crates/bashkit/docs/compatibility.md` scorecard up to date
 - [ ] `crates/bashkit/docs/threat-model.md` matches `specs/006-threat-model.md`
-- [ ] `crates/bashkit/docs/python.md` matches current python feature status
+- [ ] `crates/bashkit/docs/custom_builtins.md` API examples match current trait signatures
+- [ ] `crates/bashkit/docs/logging.md` matches current logging feature behavior
 - [ ] Rustdoc builds clean: `cargo doc --all-features` (no warnings)
+
+#### Python Docs
+
+- [ ] `crates/bashkit-python/README.md` command count matches reality
+- [ ] `crates/bashkit-python/README.md` feature list matches current Python bindings
+- [ ] `crates/bashkit-python/README.md` API reference matches actual Python exports
+- [ ] `crates/bashkit/docs/python.md` matches current python feature status
+- [ ] Python docstrings match behavior (spot-check `Bash`, `BashTool`, `ScriptedTool`)
+
+#### General
+
+- [ ] `README.md` feature list matches implemented builtins
 - [ ] `CONTRIBUTING.md` instructions still accurate
 - [ ] `CHANGELOG.md` has entries for all changes since last release
 

supply-chain/config.toml

@@ -571,7 +571,7 @@ version = "0.5.0"
 criteria = "safe-to-deploy"
 
 [[exemptions.ipnet]]
-version = "2.11.0"
+version = "2.12.0"
 criteria = "safe-to-deploy"
 
 [[exemptions.iri-string]]