[abogun-product]

Pinned source-tree replay previously trusted recorded roots, ancestry and change counts. This 0.6 increment adds bounded authenticated Git history proof and re-derives those claims offline while preserving historical bundle/packet bytes. It also materializes the remaining R11–R53 and the earlier operation cases, with actual governed evaluation, durable history and persisted bundle verification.

Target: E4
Target: B1

Final source head: a4761da.

Delivered behavior

• Native code analysis/policy/engine/packet/comparison v2 and devostasis.git-history-proof.v1; separate exact v1 replay. Hashed raw objects establish all parent edges, roots, merge ancestry, committer-time window and declared byte-line edits. Missing/capped proof stays PARTIAL; rehashed false roots/counts/COMPLETE claims fail.
• R11–R53: 43 permanent cases, 84 subordinate CI variants. Literal native inputs and expectations execute parent identity, explicit rerun links, exact Actions/check-suite overlap, latest-attempt selection, unresolved precedence, commit-time order/window, real-store lifecycle/expiry and broken-predecessor cases.
• 63 permanent bridge cases across seven scenario versions, materializing the former 62-case gap plus RPT-8. Earlier RAW_RUNS, shared multi-Vital, whole T8 substitution matrix and canonical bundle/store operations remain executable. The 148 legacy CLI vectors keep their meanings.
• Opt-in devostasis.ci-normalization.v1 produces raw native evidence, normalized records and provenance. Governed Integrity recomputes and compares all four emitted envelopes. Altered provider/project/time/version/digest/records, contradictory immutable identities, unknown fields and broken pagination fail closed. Partial acquisition cannot prove favorable complete history. The new rule has an explicit per-Vital comparison boundary; absent new inputs, historical evaluation and bundle replay remain unchanged.
• Parent aggregates govern over children. Child-only fallback is explicitly raw/degraded, with UNKNOWN canonical parent history. GitLab pipeline identity/current state and retained failures are supported offline; favorable pipeline retry-history completeness and a core GitLab collector are not claimed. Cross-id links are acquisition evidence, not provider-signed attestations.
• OS-locked store publication rejects stale advancing writers, preserves immutable candidates and requires rebuild/retry. Index permission denial stays FORBIDDEN/HISTORY_GAP.
• Public schemas cover the native input and all seven bridge scenarios; Draft 2020-12 validation is a development-only dependency. Runtime remains stdlib-only.

The case-to-proof table, native CI contract and literal tests/fixtures/ci-revisions.json state the detailed R11–R53 acceptance. Exact fixture fidelity remains an independent review obligation, especially the current/history distinctions under later PV-CI-UNIT-004/PV-HIST-002 rules.

Validation

• Full local Windows/Python 3.13 suite: 2539 passed; the subsequently added empty-carrier rejection and all six closed-lineage mutations also passed. Final CI collects 2540 tests.
• Targeted normalization/conformance/spec checks: 111 passed; real JSON Schema validation: 10 passed.
• 148 legacy CLI vectors and all 63 bridge cases passed offline.
• Legacy examples/code and new examples/code-v2 regenerated byte for byte.
• Wheel 0.6.0 built and installed in an isolated environment; core/v1/v2/work bundles, v2 packet and the installed new normalization rule verified.
• Exact-head Python 3.12/3.13/3.14 CI: feature matrix, cumulative matrix. All six jobs and all workflow steps passed at a4761daa9fa87026ea106a3d722e7299b3de3b8b.
• Upstream fork-workflow authorization: feature/release PR runs are action_required; maintainer approval is still required.

Independent acceptance and release boundary

PV-REV-CONFORMANCE-SURFACE-001 accepts the capability contract; PV-REV-TEST-002 accepts the permanent R-case expansion. Neither independently accepts these local fixtures or this concrete implementation. The missing-implementation-fixture debt D-1 is closed; B1 stays open for independent concrete-surface/whole-case acceptance and separate T9 cell-key delivery. B7 retains sustained outside-consumer evidence. Independent reviews are the next owner-directed phase and are not performed or claimed in this PR.

This remains 0.6.0. Supersedes readiness-only #80, includes its repairs and the cumulative 0.2–0.5 ancestry represented by #57/#59/#64/#69/#75, and targets release/0.6.0. The cumulative #75 uses the same head. Earlier release artifacts and their independent gates remain separate. External scheduling is owner-deferred (#71). No merge or release tag is performed.

Acceptance ledger for every prepared version

Checked implementation items below are execution evidence. Unchecked independent review, upstream authorization and maintainer release gates remain required.

Release acceptance through 0.6

This is the cumulative acceptance ledger for the prepared 0.2–0.6 increments.
They remain unreleased until maintainer merges/tags under CONTRIBUTING.md.
The latest published tag observed in the October 21 audit was v0.1.9.
Implementation evidence and independent acceptance are separate gates.

The assurance increment is part of 0.6.0, not a new release number. It
includes the October 21 readiness repairs and preserves older canonical bundles.
The pull request records final commit/run links; the commands below reproduce
the acceptance from a source checkout without network or private calibration.

0.2.0 — durable core history and incomplete evidence

• Current malformed/duplicate revision records cannot erase carried failure
  or multiply immutable revision samples; timestamps and attempt identities are
  admitted before reconciliation. UNKNOWN attempt evidence remains unknown.
• Four-generation store/evaluator chains preserve same-revision failures,
  immutable revision time, expiry and exact current/historical replay.
• Horizon, Direction and Debt incomplete-evidence contracts and the accepted
  T9 generator execute; unavailable evidence cannot become favorable zero.
• Core bundle verification and example builds remain deterministic.
• Independent review of the repaired Finish 0.2.0: preserve verified Integrity history and reconcile pending branches #57 head and associated admission findings.
• Maintainer resolves the stacked Release 0.2.0: adopt the accepted Direction, Horizon, Debt and T9 repairs, and carry Integrity history across bundles (B3) #53 release path and publishes v0.2.0.

Evidence: tests/test_ci_history_admission.py, tests/test_revision_history.py,
tests/conformance/, core example
verification. The #57 fork matrix passed on Python 3.12/3.13/3.14 at b849923.
The broader B1/B7 milestone is still open; this ledger does not silently mark
that historical target achieved.

0.3.0 — Evidence to Action

• Five deterministic queues, explicit priority/dependencies and bounded
  acceptance; observed exact-head evidence gates merge admission.
• SARIF/JUnit/Cobertura/performance evidence retains source/revision/age gaps.
• Bounded handoff, cursors, conditional reads and offline replay execute.
• Missing/forbidden/stale reports cannot satisfy acceptance.
• Independent release review of Release 0.3.0: Evidence to Action with verified work scopes and bounded handoff #59; maintainer release merge/tag.

Evidence: tests/test_workscope.py,
tests/test_work_handoff.py, examples/work. The #59 fork matrix passed at
a41fac6 on Python 3.12/3.13/3.14.

0.4.0 — reproducible consumer handoff

• Receipt execution mechanics are outside canonical identity; semantic
  acquisition distinctions remain identity bearing.
• Exact historical verification precedes compatibility dispatch. Unknown,
  mixed, ambiguous or unauthorized nonidentity edges fail closed.
• Mutable branch/change bindings resolve immutable projects and commit
  membership before/after source reads; packets bind exact verified bytes.
• Historical work v1 and core lineages retain their own replay paths.
• Independent review of Release 0.4.0: reproducible consumer handoff and exact contract compatibility #64 and receipt/compatibility/consumer boundaries.
• Maintainer release merge/tag.

Evidence: tests/test_receipt_identity.py, tests/test_compatibility.py,
tests/test_work_handoff.py, historical examples. The #64 fork matrix passed
at c98e7ed on Python 3.12/3.13/3.14.

0.5.0 — Consumer Operations

• Adopter project/policy/engine bindings reject wrong subjects before
  collection or canonical publication; disabled invocations retain negative control.
• Shared request/deadline budgets remain bounded under parallel collection.
• Repeated generations, immutable invocation receipts and calendar-day audit
  survive private history export, verification and restore.
• Packet-bound outcomes remain caller reports and grant no independent acceptance.
• Independent review of Release 0.5.0: bound consumer operations and portable private history #69 and archive/caller/budget boundaries.
• Maintainer release merge/tag.

Evidence: tests/test_work_operations.py, examples/work/adoption.json,
CI archive round trip. The #69 fork matrix passed at aa5e0e1 on
Python 3.12/3.13/3.14. Actual scheduled outside adoption (#71), collection
qualification (#62), long-term incremental archive scale (#67) and B7 remain
explicit owner/external gates.

0.6.0 — offline analysis and executable assurance

• Pinned SHA-1/SHA-256 source/tree/blob proofs, Python 3.12 AST/import analysis,
  conservative finding comparison, SARIF and bounded verified source packets.
• v2 authenticates reachable raw commits, all parent edges and historical
  tree/blob objects; roots, window selection, edit counts and COMPLETE claims
  are derived again without Git, a checkout, network or source execution.
• Merge ancestry, clock skew, shallow/missing objects, graph/object/byte/work
  caps and unsafe paths retain explicit partial states; incomplete roots cannot
  establish comparable repository identity.
• Rehashed root/ancestor/time/count/frontier/complete forgeries, wrong object
  kinds and unused proof objects fail. An independent LCS oracle checks the
  declared byte-line edit algorithm, including repeated/unterminated lines.
• Legacy examples/code regenerates byte for byte. New examples/code-v2
  and separate schemas replay independently; cross-lineage comparison is refused.
• Sixty-three permanent conformance IDs execute real native normalization,
  consumed RAW_RUNS provenance, one shared multi-Vital graph, all T8 substitutions,
  canonical bundle operations and stateful HistoryStore operations.
• R11–R53 are materialized under their 43 permanent IDs, with 84 CI variants:
  native parent identities, exact overlap, proved reruns, unresolved precedence,
  commit-time order/window and failure-sticky real-store lifecycles. Raw child
  fallback and parent-level history limits remain explicit.
• Governed Integrity recomputes native evidence/provenance/records and rejects
  altered bindings; unknown lineage, contradictory identity, broken pagination
  and incomplete favorable history fail closed. New behavior is opt in under
  a separate rule; old bundle examples and legacy paths retain exact replay.
• HistoryStore publication is locked; a stale advancing writer preserves
  candidates, reports conflict and rebuilds from latest. Permission failures
  remain explicit HISTORY_GAP.
• Independent review of Git proof completeness, bounds and algorithm specification.
• Independent review of the concrete conformance surface and exact fixtures;
  capability-level research acceptance alone does not accept this implementation.
• Independent release/admission review of the final cumulative head, including
  the October findings on Release 0.6.0: offline repository analysis and executable assurance #75 and the included readiness fixes.
• Upstream workflow approval where GitHub requires maintainer authorization.
• Maintainer merges the reviewed feature into release/0.6.0, reconciles the
  cumulative Release 0.6.0: offline repository analysis and executable assurance #75 release PR, then merges/tags v0.6.0 under CONTRIBUTING.md.

Reproduce:

python -m pytest
devostasis vectors --quiet
python scripts/check_conformance_surface.py
devostasis verify --bundle examples/sample-bundle
python scripts/make_code_examples.py
python scripts/make_code_examples.py --v2
git diff --exit-code -- examples/code examples/code-v2
devostasis code verify --bundle examples/code/bundle
devostasis code verify --bundle examples/code-v2/bundle
devostasis code verify-packet --bundle examples/code-v2/bundle --packet examples/code-v2/packet.json
devostasis work verify --bundle examples/code-v2/work-bundle
devostasis work replay --bundle examples/code-v2/work-bundle
python -m pip wheel --no-deps .

CI additionally verifies both work/core examples, deterministic repeated builds
and the operations archive restore on Python 3.12/3.13/3.14. Green checks establish
those executions at the recorded head; they do not complete the unchecked gates.

The former 62-case implementation gap is materialized; B1 retains independent
concrete-surface/whole-case exact-fixture acceptance and separate T9 cell-key
delivery. B7 retains sustained
outside-consumer evidence. Legacy v1 history and omitted blob sizes keep their
documented proof limits. No compatibility migration, core GitLab collector,
threshold retuning, aggregate health score or publication is implied by this PR.