d-init-d · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026 · Oct 6, 2026
diff --git a/.github/release-notes/v2.5.0-rc.1.md b/.github/release-notes/v2.5.0-rc.1.md
@@ -0,0 +1,137 @@
+# Aleph Skill v2.5.0-rc.1
+
+## Reviewed causal drafts. Reproducible strategic scenarios.
+
+Aleph 2.5 adds an evidence-to-model drafting workflow, an eligible direct
+linear solver for instantaneous feedback components, and multi-round strategic
+roleplay. This prerelease includes the integrity fixes from the upgrade review
+and integrates the D Research 3.6 search and optional CDP browser improvements.
+
+Stable 2.4.3 remains the default release. Use this candidate to evaluate the new
+workflow with explicit assumptions before adopting it in consequential work.
+
+### Highlights
+
+- **Evidence-to-model drafts with review gates.** Bilingual causal discovery
+  creates proposed nodes and edges linked to claims. Per-node baseline, unit,
+  observation time, and stock retention must be supplied or remain gaps.
+  Evidence confidence never becomes an effect-size estimate.
+- **Explicit approval before numerical execution.** Deterministic screening
+  cannot approve a model. A named human or agent reviewer must provide complete
+  decisions and rationales bound to the proposal and evidence. Partial review
+  exports candidates and assumptions without producing a runnable model.
+- **Atomic model publication.** Apply accepts only a fresh or empty target,
+  stages artifacts on the destination filesystem, and verifies the standard
+  disk compiler, numerical run, and replay before publishing one directory.
+  Existing models, traces, and unrelated workspace files are preserved.
+- **Direct solutions for eligible linear loops.** `linear_auto` decomposes
+  instantaneous strongly connected components and solves nonsingular linear
+  systems with pivoting. Unsupported, singular, or nonconvergent models retain
+  explicit diagnostics. No hidden delays or edge pruning alter the model.
+- **Multi-round strategic roleplay.** Actor packets, committed actions, model,
+  engine configuration, and scenario specification are bound together. Replay
+  derives interventions again and verifies state, payoffs, round hashes, and
+  finalized receipts. Engine errors cannot become published payoffs.
+- **Stricter artifact validation.** Proposal/review sidecars reject malformed
+  types, nonfinite values, and invalid observation timestamps. Numerical trace
+  validation covers nested state, sampled parameters, integration records,
+  and supported transform modes.
+
+### Research component and provenance
+
+The bundled **D Research 3.6.0-rc.2** runtime brings explicit search failure statuses,
+validated host-result artifacts, DNS-pinned public-network transport, and
+opt-in CDP reuse with ownership limited to task pages and descendants.
+The component lock pins annotated tag object
+`17efb33b15a0d60988a4a3ef08a9e4e4d614397d`, source commit
+`0aaa374cf9b230ca80e6206f95e2c8bc8d945bd1`, Git tree
+`ff28e45093ba2fbd01d4ce9f417cb15ef8008be3`, the reproducible source archive,
+and the published full/runtime profile digests. CI reconstructs the 241-file
+projection and rejects byte, path, transform, or identity drift. Local
+candidate snapshots and published upstream tag provenance remain separate
+policies; a local checksum cannot impersonate an upstream attestation.
+
+### Upgrade guidance
+
+Download `aleph-skill-runtime-v2.5.0-rc.1.zip` for normal use, or
+`aleph-skill-v2.5.0-rc.1.zip` for development and validation. Verify the archives
+before extraction, and install into a new directory. Preserve existing
+simulation workspaces and version-bound receipts; regenerate receipts when a
+workflow needs to bind the new component identity.
+
+```sh
+python "<ALEPH_SKILL_ROOT>/scripts/preflight.py" --json
+python "<ALEPH_SKILL_ROOT>/scripts/research_gateway.py" research:preflight --json
+python "<ALEPH_SKILL_ROOT>/scripts/auto_causal_inducer.py" --help
+python "<ALEPH_SKILL_ROOT>/scripts/interactive_roleplay.py" --help
+```
+
+Read [the candidate workflow contract](https://github.com/d-init-d/aleph-skill/blob/v2.5.0-rc.1/references/upgrade-completion.md)
+before using the new commands. Auto-causal output verifies a numerical model;
+full final-scenario assurance still requires the normal research evidence map,
+receipts, actor tracks, scenario artifacts, and final validation gates.
+
+### Compatibility
+
+| Component | Support |
+|---|---|
+| Python | 3.10 or newer; no new mandatory dependency |
+| Node.js | 18 or newer for bundled research |
+| Workspace schemas | 2.0.0 default, 2.1.0 opt-in |
+| Formula versions | 2.0.0 and 2.1.0 remain replayable |
+| Research ledgers | Existing 14/19/22/23/37-column contracts |
+| Optional browser | Playwright 1.61.1; binaries installed separately |
+
+Existing commands and adapters remain available. Invalid inputs previously
+accepted by weaker checks can now fail early with explicit diagnostics. The
+stock/flow, lag, and transform semantics of approved models remain bound to
+replay; historical traces are never rewritten to manufacture validation.
+
+### Validation and operating limits
+
+Local validation covers unit/integration regressions, adversarial acceptance,
+release gates, deterministic double builds, and relocated full/runtime ZIP
+execution outside Git. The release pipeline additionally runs Python 3.10-3.13
+on Linux, Windows, and macOS, Node.js 18/20/22 without a browser, real Chromium
+through the research gateway, lint, strict typing, and coverage checks. Refer
+to the [release workflow](https://github.com/d-init-d/aleph-skill/actions/workflows/release.yml)
+for the final status and any platform skips.
+
+A causal phrase is a discovery hint, not empirical causal identification.
+Numerical solvability does not establish dynamic stability, calibration, or
+forecast validity. Roleplay hashes detect divergence but do not authenticate a
+malicious writer able to replace every artifact. Sealed actor execution and
+research HMAC receipts remain host responsibilities. Simulation outputs never
+become research evidence merely because replay succeeds.
+
+Independent live host benchmarks and prospective calibration are not claimed
+for this prerelease. Browser reuse and provider fixtures do not guarantee access
+to every platform or a fixed RAM saving. These limits are part of the release
+contract and remain relevant after automated checks pass.
+
+### Verify your download
+
+Download both ZIP archives, `distribution-manifest.json`, and `SHA256SUMS.txt`
+into the same directory, then run:
+
+```sh
+sha256sum -c SHA256SUMS.txt
+
+gh attestation verify aleph-skill-v2.5.0-rc.1.zip \
+  --repo d-init-d/aleph-skill \
+  --signer-workflow d-init-d/aleph-skill/.github/workflows/release.yml \
+  --source-ref refs/tags/v2.5.0-rc.1
+
+gh attestation verify aleph-skill-runtime-v2.5.0-rc.1.zip \
+  --repo d-init-d/aleph-skill \
+  --signer-workflow d-init-d/aleph-skill/.github/workflows/release.yml \
+  --source-ref refs/tags/v2.5.0-rc.1
+```
+
+GitHub's attestation service identifies the immutable tagged inputs and workflow.
+The runtime ZIP also includes an individual-file manifest. These integrity
+checks do not establish causal or statistical validity.
+
+The existing **CC BY-NC 4.0** license is unchanged.
+
+**Full changelog:** [v2.4.3...v2.5.0-rc.1](https://github.com/d-init-d/aleph-skill/compare/v2.4.3...v2.5.0-rc.1)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -91,8 +91,12 @@ jobs:
             echo "::error::Release $GITHUB_REF_NAME already exists; refusing to modify it."
             exit 1
           fi
+          release_flags=(--latest)
+          if [[ "$GITHUB_REF_NAME" == *-rc.* ]]; then
+            release_flags=(--prerelease --latest=false)
+          fi
           gh release create "$GITHUB_REF_NAME" dist/* \
             --verify-tag \
             --title "Aleph Skill $GITHUB_REF_NAME" \
             --notes-file "$notes" \
-            --latest
+            "${release_flags[@]}"
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
@@ -26,17 +26,38 @@ jobs:
     needs: lockfiles
     runs-on: ubuntu-24.04
     timeout-minutes: 10
-    env:
-      UPSTREAM_REPOSITORY: https://github.com/d-init-d/d-research-skill
-      UPSTREAM_TAG: v3.5.0
-      UPSTREAM_TAG_OBJECT: b00a260ae87f8244baa86a072080c532cc446ce9
-      UPSTREAM_COMMIT: c0dd972b40b2de6470cf9ac355f510c8acc18454
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.13"
+      - name: Verify lock integrity and select provenance policy
+        id: pin
+        shell: bash
+        run: |
+          python -B scripts/lock_bundled_component.py
+          python - <<'PYCODE'
+          import json, os
+          entry = json.load(open("component-lock.json", encoding="utf-8"))["components"]["d-research"]
+          values = {"mode": entry.get("provenance", {}).get("mode", "upstream_release"),
+                    "repository": entry["source_repository"], "tag": entry["source_tag"],
+                    "tag_object": entry["upstream_tag_object"], "commit": entry["upstream_commit"]}
+          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
+              for key, value in values.items():
+                  if not isinstance(value, str) or "\n" in value or "\r" in value:
+                      raise SystemExit("invalid provenance output")
+                  print(f"{key}={value}", file=output)
+          PYCODE
+      - name: Verify local candidate snapshot without claiming upstream attestation
+        if: steps.pin.outputs.mode == 'local_candidate'
+        run: python -B scripts/lock_bundled_component.py
       - name: Verify the bundled snapshot against the pinned upstream tag
+        if: steps.pin.outputs.mode == 'upstream_release'
+        env:
+          UPSTREAM_REPOSITORY: ${{ steps.pin.outputs.repository }}
+          UPSTREAM_TAG: ${{ steps.pin.outputs.tag }}
+          UPSTREAM_TAG_OBJECT: ${{ steps.pin.outputs.tag_object }}
+          UPSTREAM_COMMIT: ${{ steps.pin.outputs.commit }}
         shell: bash
         run: |
           repo="$RUNNER_TEMP/d-research-upstream.git"
@@ -46,64 +67,13 @@ jobs:
           git -C "$repo" fetch --quiet --force --no-tags --depth=1 origin \
             "+refs/tags/$UPSTREAM_TAG:refs/tags/$UPSTREAM_TAG"
           tag_ref="refs/tags/$UPSTREAM_TAG"
-          actual_type="$(git -C "$repo" cat-file -t "$tag_ref")"
-          actual_tag="$(git -C "$repo" rev-parse "$tag_ref")"
-          actual_commit="$(git -C "$repo" rev-parse "$tag_ref^{}")"
-          if [[ "$actual_type" != tag ]]; then
-            echo "expected annotated upstream tag, got $actual_type" >&2
-            exit 1
-          fi
-          if [[ "$actual_tag" != "$UPSTREAM_TAG_OBJECT" ]]; then
-            echo "upstream tag object mismatch: expected $UPSTREAM_TAG_OBJECT, got $actual_tag" >&2
-            exit 1
-          fi
-          if [[ "$actual_commit" != "$UPSTREAM_COMMIT" ]]; then
-            echo "upstream commit mismatch: expected $UPSTREAM_COMMIT, got $actual_commit" >&2
-            exit 1
-          fi
+          test "$(git -C "$repo" cat-file -t "$tag_ref")" = tag
+          test "$(git -C "$repo" rev-parse "$tag_ref")" = "$UPSTREAM_TAG_OBJECT"
+          test "$(git -C "$repo" rev-parse "$tag_ref^{}")" = "$UPSTREAM_COMMIT"
           provenance="$RUNNER_TEMP/component-provenance.json"
-          if ! python -B scripts/lock_bundled_component.py \
-            --upstream-repo "$repo" > "$provenance"; then
-            cat "$provenance" >&2
-            exit 1
-          fi
+          python -B scripts/lock_bundled_component.py --require-upstream \
+            --upstream-repo "$repo" > "$provenance"
           cat "$provenance"
-          python - "$provenance" <<'PY'
-          import json
-          import os
-          import sys
-
-          payload = json.load(open(sys.argv[1], encoding="utf-8"))
-          lock = json.load(open("component-lock.json", encoding="utf-8"))
-          entry = lock["components"]["d-research"]
-          expected_lock = {
-              "source_repository": os.environ["UPSTREAM_REPOSITORY"],
-              "source_tag": os.environ["UPSTREAM_TAG"],
-              "upstream_tag_object": os.environ["UPSTREAM_TAG_OBJECT"],
-              "upstream_commit": os.environ["UPSTREAM_COMMIT"],
-          }
-          for field, value in expected_lock.items():
-              if entry.get(field) != value:
-                  raise SystemExit(
-                      f"component lock {field} mismatch: "
-                      f"expected {value}, got {entry.get(field)!r}"
-                  )
-          if payload.get("status") != "pass":
-              raise SystemExit(f"component provenance failed: {payload!r}")
-          upstream = payload.get("upstream_verification")
-          if not isinstance(upstream, dict):
-              raise SystemExit("component provenance omitted upstream_verification")
-          expected = {
-              "tag_object": os.environ["UPSTREAM_TAG_OBJECT"],
-              "commit": os.environ["UPSTREAM_COMMIT"],
-          }
-          for field, value in expected.items():
-              if upstream.get(field) != value:
-                  raise SystemExit(
-                      f"component provenance {field} mismatch: "
-                      f"expected {value}, got {upstream.get(field)!r}"
-                  )
-          PY
 
   portable:
     needs: lockfiles

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## 2.5.0-rc.1 - 2026-10-06 (prerelease)
+
+- Add reviewed causal drafts and atomic disk-verified model publication.
+- Bind multi-round roleplay execution and replay to model/config/spec identity.
+- Pin the published D Research 3.6.0-rc.2 runtime by signed tag, Git objects and artifact digests; retain a separate integrity policy for local development snapshots.
+- Publish RC tags as prereleases without changing the latest stable release.
+- Preserve numerical nonconvergence and keep assumptions explicit.
+
+
 ## 2.4.3 - 2026-09-19
 
 ### Changed

diff --git a/README.md b/README.md
@@ -152,7 +152,7 @@ Supported install locations:
 
 ## Verification
 
-When upgrading an existing 2.0.0 workspace, keep an untouched backup and run draft validation first. Aleph 2.4.3 keeps `schema_version: 2.0.0` as the write default, offers schema `2.1.0` as an explicit sibling-only upgrade, writes `formula_version: 2.1.0` for new workspaces, and can still replay formula 2.0.0 artifacts. Version-bound numerical, component, likelihood, provenance, research-import, and sealed-roleplay receipts may require regeneration before final validation succeeds. For a workspace that still stores an absolute D Research path, run `python "<ALEPH_SKILL_ROOT>/scripts/migrate_workspace.py" --source <workspace> --bind-bundled-d-research --check`, inspect the byte-equivalence report, then repeat without `--check`. Do not use the 1.x schema migrator or hand-edit hashes or formula identifiers.
+When upgrading an existing 2.0.0 workspace, keep an untouched backup and run draft validation first. Aleph 2.5.0-rc.1 keeps `schema_version: 2.0.0` as the write default, offers schema `2.1.0` as an explicit sibling-only upgrade, writes `formula_version: 2.1.0` for new workspaces, and can still replay formula 2.0.0 artifacts. Version-bound numerical, component, likelihood, provenance, research-import, and sealed-roleplay receipts may require regeneration before final validation succeeds. For a workspace that still stores an absolute D Research path, run `python "<ALEPH_SKILL_ROOT>/scripts/migrate_workspace.py" --source <workspace> --bind-bundled-d-research --check`, inspect the byte-equivalence report, then repeat without `--check`. Do not use the 1.x schema migrator or hand-edit hashes or formula identifiers.
 
 Run the local release gate: