Tags give the ability to mark specific points in history as being important
-
v0.3.7
protected9aefa5a1 · ·v0.3.7: adversarial5 remediation — executed evidence trust hardened and made uniform, plus honest trust-boundary docs. Evidence provenance (C6-01): run-go-test labels a record origin "executed" ONLY when the Go toolchain is operator-named via --toolchain-path or config evidence.toolchain_path; resolution from the caller's own GOROOT/PATH yields origin "imported". GOROOT and GOENV are scrubbed from the child env (GOENV=off, so a persisted `go env -w GOFLAGS=-exec=` cannot forge a pass) and GOFLAGS neutralized; -exec/-toolexec/-overlay refused. Schema v4 records toolchain_path/toolchain_digest/source_digest. ed25519 attestation shipped (pkg/attest): run-go-test --sign-key, verify/ingest --require-attestation --trusted-keys; default (no keys) is filesystem-trust. Cross-command assurance (C6-02): pkg/gotestevents leaf package holds one semantic evaluator (RecordDerivable); verify, scan-export, and next/deps/ticket (LoadEligible) all apply the identical full artifact re-derivation — no cheaper hash-only path remains. Incomplete scans omit verified/verification. Peer resolution is filesystem-trust by default; with evidence.trusted_keys it checks receipt signature + ClaimsDigest (recomputed from the presented verified array) + PolicyHash, staleness from signed GeneratedAt. Source binding (C6-06): source digest computed before AND after the test child, refuse on mismatch; verify drops executed records whose source digest no longer matches HEAD. Dependency grammar (C6-03) fails closed on malformed syntax with a path+line diagnostic. Benchmark mapping (C6-08): BENCH= parent matches sub-benchmarks on the / path boundary, identically in producer and verifier. Generated onboarding (C6-04) uses run-go-test --toolchain-path and honest --update-stale wording. Init rollback contract (C6-07) corrected. Audit-closure manifest (C6-05) is execution-backed (TestAuditC509 shells out per cited test, rejects skip) and honest (partial rows where filesystem-trust is the default). Trust boundary documented plainly: executed evidence is filesystem-trust by default; adversarial/cross-machine trust requires the ed25519 attestation mechanism with the signing key held OUTSIDE the workspace. A local binary cannot defeat an adversary who controls the environment it runs in. Residuals (per-peer-project binding, immutable-checkout, minimal-env sandbox, evidence-store pruning, P2 execution matrix) tracked in GAP_ANALYSIS.md.
-
v0.3.6
protectedbecb73b1 · ·v0.3.6: adversarial4 remediation — executed evidence is a derived trust state (run-go-test fixed Go runner rejecting -exec/-toolexec/-overlay and scrubbing GOFLAGS, artifacts reparsed to derive records, ingest demotes unprovable executed labels, verify requires re-derivable artifacts), one strict evidence policy across verify/scan-export/next/deps/ticket/peers with receipt-bearing verdicts (policy/overrides/degraded/commit/verifier), scan verified-export gated on a clean tree and peers requiring a fresh non-degraded receipt, dependency graph full-ID + evidence-based status + rooted context, rooted index DB, transactional MCP prioritize, structured init partial results, rooted+atomic doc commands, README conformance gate, and an audit-closure manifest (docs/audit/AUDIT_CLOSURE.md, enforced by TestAuditC509). Finding-by-finding status in the manifest; environment-bound and residual items tracked in GAP_ANALYSIS.md.
-
v0.3.5
protected456816ef · ·v0.3.5: adversarial3 remediation — trusted evidence provenance (origin/dirty trust model, canary evidence run with retained digest-verified artifacts), single verification gate (scan --verify delegates to canary verify), exact dependency test/bench mappings with external-unknown blocking, single-read index hashing with fail-closed completeness and seeded snapshot digest, atomic mutations and journaled init with rollback, full serializer coverage for token producers, default-namespace cleanup migration, doc create contract fulfilled, documentation aligned with executable behavior. Remaining follow-ups tracked in GAP_ANALYSIS.md.
-
v0.3.4
protected394824de · ·v0.3.4: adversarial2 remediation (R-01..R-16) Evidence chain fail-closed (truncation, dirty trees, derived commits, per-declared TEST=/BENCH= completion, bench evidence); init bulk copy guarded and staged; scan-digest index freshness; unified next ordering with exhaustive candidates; project-scoped refs and index metadata (migration 000009); durable source-token mutations; canonical serializer on all token producers; stale external caches block; declared-status wording on every CLI/MCP surface; scanner normalization and fail-closed subscans; docs aligned with the executable contract. Breaking/behavior notes: - JSON: completion_pct/completed renamed declared_completion_pct/declared_complete (canary status/view --json, MCP status result). - canary init keeps existing .canary/ files unless --force (backups written). - bug create --aspect now validated against the ASPECT enum (case-normalized). - evidence from-go-test derives the commit from HEAD and refuses dirty trees. - scan --verify and canary verify both fail on empty claims files.