0.6: independently verified Git history and executable assurance

.devostasis/debt.json

@@ -5,10 +5,11 @@
     {
       "id": "D-10",
       "title": "Native change hotspots and local roots rely on recorded acquisition rather than complete ancestry proofs",
-      "state": "open",
+      "state": "closed",
       "opened": "2026-10-08",
-      "updated": "2026-10-08",
-      "cost": "0.6 source proofs bind pinned commit/tree and admitted blob bytes, but replay of recorded history counts/root traversal is not independent admission of their complete ancestry. A rehashed recorded history can alter hotspots. Counts remain descriptive and separately covered, with no health or acceptance authority. Bounded historic object/parent proof and preserved v1 replay are issue #73."
+      "updated": "2026-10-21",
+      "cost": "Implemented in the pending 0.6 assurance increment: code-analysis v2 authenticates bounded commit/parent/tree/blob proofs and independently derives roots, selection, completeness and edit counts offline. Rehashed claims are rejected; caps/shallow/missing objects remain explicit PARTIAL. V1 exact bytes/replay retain their documented acquisition-only limit. Independent PR review and maintainer release remain pending; issue #73.",
+      "closed": "2026-10-21"
     },
     {
       "id": "D-7",
@@ -46,10 +47,11 @@
     {
       "id": "D-1",
       "title": "Conformance cases named in the specification have no executable fixture",
-      "state": "open",
+      "state": "closed",
       "opened": "2026-09-05",
-      "updated": "2026-10-02",
-      "cost": "docs/spec/conformance.md named T2-T9, R1-R53, ART-05, ART-08-ART-11, ART-15 and RPT-4-RPT-9 with no test behind them, so the public coverage claim is larger than the proof. The vector format and runner exist since 0.1.8, and 0.1.9 transcribed the accepted exact vectors the research process delivered (T2, R1, R2, R3, R4, T4, T5, T7) together with whole accepted families (INT-UNKNOWN, INT-TOTAL, CLU-INCOMPLETE, ACT-COV). The pending 0.2.0 branch holds T9 to its accepted table with a generator, leaving sixty-two named cases without executable proof. Several (T3, T6, T8, the bundle and store cases) need further conformance capabilities or accepted vectors (issues #20, #23)."
+      "updated": "2026-10-21",
+      "cost": "Closed as an implementation-fixture obligation in pending 0.6: the versioned bridge executes 63 permanent cases, materializing the former 62-case gap plus RPT-8. R11-R53 add 43 cases and 84 CI variants with native normalization and real governed/store/bundle lifecycles. B1 remains open for independent concrete-surface/whole-case exact-fixture acceptance and separate T9 cell-key delivery; capability or research expansion acceptance does not accept these local fixtures. No independent review is claimed.",
+      "closed": "2026-10-21"
     },
     {
       "id": "D-2",

.github/workflows/ci.yml

@@ -32,6 +32,8 @@ jobs:
         run: python -m pytest -q
       - name: Conformance vectors through the command line
         run: devostasis vectors --quiet
+      - name: Versioned conformance operation bridge
+        run: python scripts/check_conformance_surface.py
       - name: Example bundle verifies from its own contents
         run: devostasis verify --bundle examples/sample-bundle
       - name: Work companion replay and deterministic handoff
@@ -56,6 +58,12 @@ jobs:
           devostasis work replay --bundle examples/code/work-bundle
           python scripts/make_code_examples.py
           git diff --exit-code -- examples/code
+          devostasis code verify --bundle examples/code-v2/bundle
+          devostasis code verify-packet --bundle examples/code-v2/bundle --packet examples/code-v2/packet.json
+          devostasis work verify --bundle examples/code-v2/work-bundle
+          devostasis work replay --bundle examples/code-v2/work-bundle
+          python scripts/make_code_examples.py --v2
+          git diff --exit-code -- examples/code-v2
       - name: Determinism check on the example observations
         run: |
           a=$(devostasis build --observations examples/observations.json --store /tmp/store-a --planning milestones --debt-label type:refactor --debt-mapping-version example-1 | head -n 1 | awk '{print $2}')

CHANGELOG.md

@@ -5,7 +5,37 @@ contract or a policy always come with a version bump of that contract.
 
 ## 0.6.0 (unreleased)
 
-Offline Repository Analysis, target E4, issue #72.
+Offline Repository Analysis and executable assurance, targets E4/B1, issues #72/#73.
+
+- Default native analysis v2 carries bounded authenticated commit/parent/tree/blob
+  history proof; offline replay derives roots, window membership, edit counts and
+  completeness. Merge ancestry, clock skew, shallow/missing objects and resource
+  caps remain explicit. V1 bundle/packet/example bytes retain exact replay.
+- Publish a versioned source-checkout conformance operation bridge with 63 permanent
+  implementation fixtures, consumed RAW_RUNS provenance, shared multi-Vital evidence,
+  all T8 substitutions, canonical bundle and actual HistoryStore checkpoints.
+- Materialize R11–R53 (43 permanent cases, 84 CI variants) with native parent
+  identities, explicit rerun proof, exact Actions/suite overlap, unresolved current
+  composition and failure-sticky store lifecycles. Versioned opt-in normalization
+  replays raw facts before governed Integrity; altered/partial evidence fails
+  closed and old observation/bundle replay remains unchanged. Public schemas
+  expose seven bridge scenarios and the bounded native input contract.
+- Serialize canonical store publication and reject stale advancing predecessors
+  with explicit retry conflict while preserving immutable candidates. Store index
+  permission denial remains FORBIDDEN/HISTORY_GAP.
+- Add per-version 0.2–0.6 acceptance ledger and independent review/release gates;
+  B1 exact research acceptance and sustained external B7 evidence remain open.
+
+- Release-readiness repairs: reject ambiguous/malformed current CI inventory
+  before it can remove carried failures; preserve immutable revision time;
+  require exact bounded attempt identities and retain UNKNOWN history. Activity
+  shares current-record admission and exposes rejected verification inputs.
+- Replay native source-selection predicates instead of accepting a recognized
+  omission reason alone. Operational verification explicitly distinguishes
+  proved source/tree bytes from unproven omitted sizes and history ancestry;
+  canonical v1 artifact bytes and existing lineages remain unchanged.
+- Reconcile the October 21 release state/sequence and add a tested direct
+  first-report path; the v0.6.0 installation remains conditional on publication.
 
 - New stdlib-only `code` companion: immutable local Git snapshot, Python 3.12
   AST structure, six scoped findings, declared-module import cycles and bounded
@@ -24,9 +54,9 @@ Offline Repository Analysis, target E4, issue #72.
   GitHub totals while preserving observed partial rows (#70).
 - Isolate inherited Git context and unrelated credential environment variables
   from local analysis subprocesses and synthetic diagnostics (#74).
-- Independent ancestry/count proof remains documented debt (#73); external
-  scheduling/adoption is deferred (#71). Existing Vitals, core/work replay,
-  B1/B7 and upstream release/review gates retain their contracts.
+- Independent ancestry/count proof is implemented under the separate v2 lineage
+  (#73); v1 retains its historical limits. External scheduling/adoption remains
+  deferred (#71), and B1/B7 and upstream release/review gates remain explicit.
 
 ## 0.5.0 (unreleased)
 

README.md

@@ -211,15 +211,27 @@ For this unreleased checkout:
 pip install -e .
 ```
 
-After the 0.5.0 release tag is published:
+After the 0.6.0 release tag is published:
 
 ```bash
 pip install git+https://github.com/drevendev/devostasis@v0.6.0
 ```
 
-Observe one repository (a GitHub token is read from `DEVOSTASIS_GITHUB_TOKEN`,
+Produce your first seven-Vital report without a configuration file:
+
+```bash
+devostasis run --repo drevendev/Devostasis --store ./history-local
+devostasis verify --bundle history-local/projects/github.com/drevendev/devostasis/latest
+```
+
+Open `history-local/projects/github.com/drevendev/devostasis/latest/report.md`.
+The first successful run is a `BASELINE`; later runs compare with the previous
+verified bundle. Unavailable API evidence remains explicit, and planning/debt
+without configured registers or mappings remains undeclared/uninstrumented.
+
+A GitHub token is read from `DEVOSTASIS_GITHUB_TOKEN`,
 `GITHUB_TOKEN`, `GH_TOKEN` or `gh auth token`; public repositories work
-without one, with a low rate limit):
+without one, with a low rate limit. For separate observation and evaluation:
 
 ```bash
 devostasis observe --repo owner/name --out observations.json
@@ -332,6 +344,9 @@ gauges, accepted band ordering and executable conformance vectors. The
 pending 0.2.0 adoption adds the accepted Vital repairs and durable Integrity
 history; 0.3.0 adds the separate Evidence to Action companion and 0.4.0 adds
 reproducible consumer handoff and accepted receipt/compatibility contracts.
+0.5.0 adds bound consumer operations and portable private history; 0.6.0 adds
+native offline Python analysis and verified source packets. The cumulative
+release is still under review, including inherited history-admission repairs.
 Its GitLab work collector does not yet implement the core GitLab Vital
 adapter or the accepted Instruments carrier.
 
@@ -354,3 +369,8 @@ than patched ad hoc.
 ## License
 
 [MIT](LICENSE).
+
+The 0.6 release candidate adds independently replayable Git history proof and a
+versioned conformance operation bridge. See the [0.2–0.6 acceptance ledger](docs/release-acceptance.md)
+for implementation checks, historical compatibility and pending independent
+review/release gates. Existing published pins remain unchanged until release.