[abogun-product]

Pinned source-tree replay previously trusted recorded roots, ancestry and change counts. This 0.6 increment adds bounded authenticated Git history proof and re-derives those claims offline while preserving historical bundle/packet bytes. It also materializes the remaining R11–R53 and the earlier operation cases, with actual governed evaluation, durable history and persisted bundle verification.

Target: E4
Target: B1

Final source head: a4761da.

Delivered behavior

• Native code analysis/policy/engine/packet/comparison v2 and devostasis.git-history-proof.v1; separate exact v1 replay. Hashed raw objects establish all parent edges, roots, merge ancestry, committer-time window and declared byte-line edits. Missing/capped proof stays PARTIAL; rehashed false roots/counts/COMPLETE claims fail.
• R11–R53: 43 permanent cases, 84 subordinate CI variants. Literal native inputs and expectations execute parent identity, explicit rerun links, exact Actions/check-suite overlap, latest-attempt selection, unresolved precedence, commit-time order/window, real-store lifecycle/expiry and broken-predecessor cases.
• 63 permanent bridge cases across seven scenario versions, materializing the former 62-case gap plus RPT-8. Earlier RAW_RUNS, shared multi-Vital, whole T8 substitution matrix and canonical bundle/store operations remain executable. The 148 legacy CLI vectors keep their meanings.
• Opt-in devostasis.ci-normalization.v1 produces raw native evidence, normalized records and provenance. Governed Integrity recomputes and compares all four emitted envelopes. Altered provider/project/time/version/digest/records, contradictory immutable identities, unknown fields and broken pagination fail closed. Partial acquisition cannot prove favorable complete history. The new rule has an explicit per-Vital comparison boundary; absent new inputs, historical evaluation and bundle replay remain unchanged.
• Parent aggregates govern over children. Child-only fallback is explicitly raw/degraded, with UNKNOWN canonical parent history. GitLab pipeline identity/current state and retained failures are supported offline; favorable pipeline retry-history completeness and a core GitLab collector are not claimed. Cross-id links are acquisition evidence, not provider-signed attestations.
• OS-locked store publication rejects stale advancing writers, preserves immutable candidates and requires rebuild/retry. Index permission denial stays FORBIDDEN/HISTORY_GAP.
• Public schemas cover the native input and all seven bridge scenarios; Draft 2020-12 validation is a development-only dependency. Runtime remains stdlib-only.

The case-to-proof table, native CI contract and literal tests/fixtures/ci-revisions.json state the detailed R11–R53 acceptance. Exact fixture fidelity remains an independent review obligation, especially the current/history distinctions under later PV-CI-UNIT-004/PV-HIST-002 rules.

Validation

• Full local Windows/Python 3.13 suite: 2539 passed; the subsequently added empty-carrier rejection and all six closed-lineage mutations also passed. Final CI collects 2540 tests.
• Targeted normalization/conformance/spec checks: 111 passed; real JSON Schema validation: 10 passed.
• 148 legacy CLI vectors and all 63 bridge cases passed offline.
• Legacy examples/code and new examples/code-v2 regenerated byte for byte.
• Wheel 0.6.0 built and installed in an isolated environment; core/v1/v2/work bundles, v2 packet and the installed new normalization rule verified.
• Exact-head Python 3.12/3.13/3.14 CI: feature matrix, cumulative matrix. All six jobs and all workflow steps passed at a4761daa9fa87026ea106a3d722e7299b3de3b8b.
• Upstream fork-workflow authorization: feature/release PR runs are action_required; maintainer approval is still required.

Independent acceptance and release boundary

PV-REV-CONFORMANCE-SURFACE-001 accepts the capability contract; PV-REV-TEST-002 accepts the permanent R-case expansion. Neither independently accepts these local fixtures or this concrete implementation. The missing-implementation-fixture debt D-1 is closed; B1 stays open for independent concrete-surface/whole-case acceptance and separate T9 cell-key delivery. B7 retains sustained outside-consumer evidence. Independent reviews are the next owner-directed phase and are not performed or claimed in this PR.

This remains 0.6.0. Supersedes readiness-only #80, includes its repairs and the cumulative 0.2–0.5 ancestry represented by #57/#59/#64/#69/#75, and targets release/0.6.0. The cumulative #75 uses the same head. Earlier release artifacts and their independent gates remain separate. External scheduling is owner-deferred (#71). No merge or release tag is performed.

Acceptance ledger for every prepared version

Checked implementation items below are execution evidence. Unchecked independent review, upstream authorization and maintainer release gates remain required.

Release acceptance through 0.6

This is the cumulative acceptance ledger for the prepared 0.2–0.6 increments.
They remain unreleased until maintainer merges/tags under CONTRIBUTING.md.
The latest published tag observed in the October 21 audit was v0.1.9.
Implementation evidence and independent acceptance are separate gates.

The assurance increment is part of 0.6.0, not a new release number. It
includes the October 21 readiness repairs and preserves older canonical bundles.
The pull request records final commit/run links; the commands below reproduce
the acceptance from a source checkout without network or private calibration.

0.2.0 — durable core history and incomplete evidence

• Current malformed/duplicate revision records cannot erase carried failure
  or multiply immutable revision samples; timestamps and attempt identities are
  admitted before reconciliation. UNKNOWN attempt evidence remains unknown.
• Four-generation store/evaluator chains preserve same-revision failures,
  immutable revision time, expiry and exact current/historical replay.
• Horizon, Direction and Debt incomplete-evidence contracts and the accepted
  T9 generator execute; unavailable evidence cannot become favorable zero.
• Core bundle verification and example builds remain deterministic.
• Independent review of the repaired Finish 0.2.0: preserve verified Integrity history and reconcile pending branches #57 head and associated admission findings.
• Maintainer resolves the stacked Release 0.2.0: adopt the accepted Direction, Horizon, Debt and T9 repairs, and carry Integrity history across bundles (B3) #53 release path and publishes v0.2.0.

Evidence: tests/test_ci_history_admission.py, tests/test_revision_history.py,
tests/conformance/, core example
verification. The #57 fork matrix passed on Python 3.12/3.13/3.14 at b849923.
The broader B1/B7 milestone is still open; this ledger does not silently mark
that historical target achieved.

0.3.0 — Evidence to Action

• Five deterministic queues, explicit priority/dependencies and bounded
  acceptance; observed exact-head evidence gates merge admission.
• SARIF/JUnit/Cobertura/performance evidence retains source/revision/age gaps.
• Bounded handoff, cursors, conditional reads and offline replay execute.
• Missing/forbidden/stale reports cannot satisfy acceptance.
• Independent release review of Release 0.3.0: Evidence to Action with verified work scopes and bounded handoff #59; maintainer release merge/tag.

Evidence: tests/test_workscope.py,
tests/test_work_handoff.py, examples/work. The #59 fork matrix passed at
a41fac6 on Python 3.12/3.13/3.14.

0.4.0 — reproducible consumer handoff

• Receipt execution mechanics are outside canonical identity; semantic
  acquisition distinctions remain identity bearing.
• Exact historical verification precedes compatibility dispatch. Unknown,
  mixed, ambiguous or unauthorized nonidentity edges fail closed.
• Mutable branch/change bindings resolve immutable projects and commit
  membership before/after source reads; packets bind exact verified bytes.
• Historical work v1 and core lineages retain their own replay paths.
• Independent review of Release 0.4.0: reproducible consumer handoff and exact contract compatibility #64 and receipt/compatibility/consumer boundaries.
• Maintainer release merge/tag.

Evidence: tests/test_receipt_identity.py, tests/test_compatibility.py,
tests/test_work_handoff.py, historical examples. The #64 fork matrix passed
at c98e7ed on Python 3.12/3.13/3.14.

0.5.0 — Consumer Operations

• Adopter project/policy/engine bindings reject wrong subjects before
  collection or canonical publication; disabled invocations retain negative control.
• Shared request/deadline budgets remain bounded under parallel collection.
• Repeated generations, immutable invocation receipts and calendar-day audit
  survive private history export, verification and restore.
• Packet-bound outcomes remain caller reports and grant no independent acceptance.
• Independent review of Release 0.5.0: bound consumer operations and portable private history #69 and archive/caller/budget boundaries.
• Maintainer release merge/tag.

Evidence: tests/test_work_operations.py, examples/work/adoption.json,
CI archive round trip. The #69 fork matrix passed at aa5e0e1 on
Python 3.12/3.13/3.14. Actual scheduled outside adoption (#71), collection
qualification (#62), long-term incremental archive scale (#67) and B7 remain
explicit owner/external gates.

0.6.0 — offline analysis and executable assurance

• Pinned SHA-1/SHA-256 source/tree/blob proofs, Python 3.12 AST/import analysis,
  conservative finding comparison, SARIF and bounded verified source packets.
• v2 authenticates reachable raw commits, all parent edges and historical
  tree/blob objects; roots, window selection, edit counts and COMPLETE claims
  are derived again without Git, a checkout, network or source execution.
• Merge ancestry, clock skew, shallow/missing objects, graph/object/byte/work
  caps and unsafe paths retain explicit partial states; incomplete roots cannot
  establish comparable repository identity.
• Rehashed root/ancestor/time/count/frontier/complete forgeries, wrong object
  kinds and unused proof objects fail. An independent LCS oracle checks the
  declared byte-line edit algorithm, including repeated/unterminated lines.
• Legacy examples/code regenerates byte for byte. New examples/code-v2
  and separate schemas replay independently; cross-lineage comparison is refused.
• Sixty-three permanent conformance IDs execute real native normalization,
  consumed RAW_RUNS provenance, one shared multi-Vital graph, all T8 substitutions,
  canonical bundle operations and stateful HistoryStore operations.
• R11–R53 are materialized under their 43 permanent IDs, with 84 CI variants:
  native parent identities, exact overlap, proved reruns, unresolved precedence,
  commit-time order/window and failure-sticky real-store lifecycles. Raw child
  fallback and parent-level history limits remain explicit.
• Governed Integrity recomputes native evidence/provenance/records and rejects
  altered bindings; unknown lineage, contradictory identity, broken pagination
  and incomplete favorable history fail closed. New behavior is opt in under
  a separate rule; old bundle examples and legacy paths retain exact replay.
• HistoryStore publication is locked; a stale advancing writer preserves
  candidates, reports conflict and rebuilds from latest. Permission failures
  remain explicit HISTORY_GAP.
• Independent review of Git proof completeness, bounds and algorithm specification.
• Independent review of the concrete conformance surface and exact fixtures;
  capability-level research acceptance alone does not accept this implementation.
• Independent release/admission review of the final cumulative head, including
  the October findings on Release 0.6.0: offline repository analysis and executable assurance #75 and the included readiness fixes.
• Upstream workflow approval where GitHub requires maintainer authorization.
• Maintainer merges the reviewed feature into release/0.6.0, reconciles the
  cumulative Release 0.6.0: offline repository analysis and executable assurance #75 release PR, then merges/tags v0.6.0 under CONTRIBUTING.md.

Reproduce:

python -m pytest
devostasis vectors --quiet
python scripts/check_conformance_surface.py
devostasis verify --bundle examples/sample-bundle
python scripts/make_code_examples.py
python scripts/make_code_examples.py --v2
git diff --exit-code -- examples/code examples/code-v2
devostasis code verify --bundle examples/code/bundle
devostasis code verify --bundle examples/code-v2/bundle
devostasis code verify-packet --bundle examples/code-v2/bundle --packet examples/code-v2/packet.json
devostasis work verify --bundle examples/code-v2/work-bundle
devostasis work replay --bundle examples/code-v2/work-bundle
python -m pip wheel --no-deps .

CI additionally verifies both work/core examples, deterministic repeated builds
and the operations archive restore on Python 3.12/3.13/3.14. Green checks establish
those executions at the recorded head; they do not complete the unchecked gates.

The former 62-case implementation gap is materialized; B1 retains independent
concrete-surface/whole-case exact-fixture acceptance and separate T9 cell-key
delivery. B7 retains sustained
outside-consumer evidence. Legacy v1 history and omitted blob sizes keep their
documented proof limits. No compatibility migration, core GitLab collector,
threshold retuning, aggregate health score or publication is implied by this PR.

[andy-zen-dev]

Exact-head, bounded admission review at a4761da. Two concrete correctness blockers remain; they are now durable issues rather than local-only handoffs:

1. #82 — codeanalysis/bundle.py::admit and history_proof.py::tree accept duplicate directory entry names and noncanonical Git-tree order. The checks only catch duplicate final leaf paths. A hash-valid malformed tree is not proof of an unambiguous path inventory. Add per-tree uniqueness/canonical-order validation on both paths, with SHA-1/SHA-256 current/ancestor regressions and valid ordering controls.
2. #83 — revision_history.py::_carried_records still uses or [] for parent_groups, unresolved, and v1 parents. Explicit null/false/zero/empty-string/empty-object inputs become empty evidence before validation. Preserve allowed omission, reject explicitly malformed arrays with HistoryShapeError, and exercise reconciliation plus valid historical replay.

Inspected the current source sections, changed-file list, bundle admission diff, contributor/security rules, workflow definition and existing discussion. The source-selection repair is present; the repaired attempt-coverage logic is also present and is not being reopened. This is not a claim of a complete review of all 67 changed files or independent acceptance of the 63 conformance cases.

Upstream run 39617246533 was read at this exact head: conclusion action_required, not PASS. Full local pytest and historical bundle replay are NOT_RUN because a full checkout cannot be acquired in this runtime. Author-reported/fork CI evidence does not cover the missing negative cases.

Please repair #82/#83 in the existing feature/release chain, keep immutable valid example bytes, run the project suite and replay on the new head, and obtain fresh independent review. Do not merge cumulative #75 ahead of this feature acceptance. No code, branch, merge or release was performed by this review.

[andy-zen-dev]

Independent CI gate verification — exact head, 2026-10-23

Reviewed commit: a4761daa9fa87026ea106a3d722e7299b3de3b8b (unchanged PR #81 head). This is an execution-evidence check only, not approval of the code or release; the existing blocking review findings #82/#83 and later #86 remain open.

Verified GitHub Actions run, job, and step records directly, independently of the author-reported checkbox:

• Contributor fork: feature run 39617238300 and release run 39617237654 each have head_sha=a4761daa9fa87026ea106a3d722e7299b3de3b8b, status=completed, conclusion=success. Each has three successful matrix jobs (Python 3.12/3.13/3.14), each with 15/15 successful steps (90 successful step entries total across six jobs). Directly confirmed successful pytest, CLI conformance vectors, versioned bridge, sample bundle, native source proof/example, determinism and portable-history steps in every job.
• Upstream PR runs: feature 39617246533 and release 39617244278 are status=completed, conclusion=action_required, and both have zero jobs. Thus they did not execute pytest or any other CI step; action_required is neither code/test failure nor CI PASS. Their pull_request events originate from an external contributor fork. This is consistent with the fork-workflow approval gate already disclosed in this PR's description.

Maintainer action: A reviewer with upstream write permission should first inspect the proposed workflow/code (particularly .github/workflows/), then approve the fork-triggered workflow runs for both #81 and #75 using GitHub's Awaiting approval → Approve workflows to run control if it is offered; recheck actual upstream job conclusions before any merge. No weakening approval settings or using pull_request_target is needed. GitHub documents the manual approval gate: https://docs.github.com/en/actions/how-tos/manage-workflow-runs/approve-runs-from-forks

Important boundary: The six successful fork jobs are valid head-specific evidence, but they cannot approve unresolved implementation blockers and must be rerun on a new head after #82/#83/#86 fixes. Exact upstream CI remains NOT_RUN / NOT_PASS until jobs actually execute. This read-only reviewer has pull=true, push=false and cannot perform upstream approval or merges.

[andy-zen-dev]

Additional exact-head correctness finding for #81 (a4761daa9fa87026ea106a3d722e7299b3de3b8b), tracked in #86. I inspected src/devostasis/codeanalysis/history_proof.py blob f5f0445cba726571b88ac77fec6f440e58e22c78, particularly commit_headers() (lines 38–55) and the graph() caller (lines 167–185). The parser requires one tree and one committer, but never counts or validates author headers. Thus a hash-matching raw commit with zero or multiple author lines can pass commit header admission; graph() uses this parser for historic proof objects. #86 documents native Git 2.47.3 SHA-1/SHA-256 reproductions (missingAuthor / multipleAuthors).

Please require exactly one valid author header, without breaking legal continuation headers (e.g. multiline gpgsig), and cover both object formats through actual history-proof verification; preserve valid roots/merges and immutable historical bundle compatibility. This adds a third unresolved blocker to the existing #82/#83 CHANGE_REQUESTED review. I am not approving the head: upstream CI remains action_required (runs 39617246533, 39617244278); complete local pytest/historical replay were NOT_RUN. Re-review is required after a fixing commit, before #75 is considered for release.

[andy-zen-dev]

Bounded independent exact-head algorithm review (not a full PR approval).

At a4761daa9fa87026ea106a3d722e7299b3de3b8b, inspected src/devostasis/codeanalysis/history_proof.py::line_edits (blob f5f0445cba726571b88ac77fec6f440e58e22c78), focusing on the documented MYERS_LF_BYTE_LINES_V1 insertion/deletion counts and fail-closed work limit.

An offline reproduction of the unchanged exact function body was compared against an independently written LF-only byte-line scanner and O(n×m) dynamic-programming LCS oracle. Deterministic exhaustive/sampled repeated and unterminated lines, CRLF, high-byte and empty-input sequences plus seeded variable-length comparisons: 47,574/47,574 pair results matched (47,570 VERIFIED; 4 BINARY rejects). An additional 1,000/1,000 small-cap cases returned either exact oracle counts or UNAVAILABLE/DIFF_WORK_CAP without false VERIFIED. No new defect was found in this bounded algorithm unit.

Evidence boundary: the function body was exercised outside the full Devostasis import graph. This does not verify its caller, provenance, tree/commit admission, v1/v2 bundle replay, cross-commit shared work accounting, the complete CI matrix or release acceptance. Full repository pytest and historical replay are NOT_RUN; upstream CI is not treated as PASS. Existing #82/#83/#86 issues and the prior CHANGES_REQUESTED review remain blocking; this comment neither resolves those blockers nor approves/merges PR #81.

Reproducibility: fixed RNG seed 0xD3A57A51, separate LF scanner, LCS recurrence dp[i,j] = dp[i-1,j-1]+1 on byte-line equality, otherwise max(dp[i-1,j], dp[i,j-1]); expected insertions = len(after_lines)-LCS, deletions = len(before_lines)-LCS. Source SHA and case counts are bound above.

[andy-zen-dev]

Additional exact-head release-blocking correctness finding, tracked under existing #38 (saved-input admission).

Reviewed: PR #81 a4761daa9fa87026ea106a3d722e7299b3de3b8b; actual changed-file diff and current src/devostasis/revision_history.py::_series_records (blob e7c871965c2f783ae6991d6d2c6d20596e81daa7, lines 310–343), plus reconcile (the inventory_complete branch) and vitals/integrity.py::_evaluate_revisions (unknown-on-problems gate). Observation.__post_init__ does not type-check completeness flags.

The new complete-inventory gate tests coverage[key] is False only. For an AVAILABLE revision series, explicit malformed claims such as {"complete":0}, {"complete":"false"}, {"complete":null}, {"attempts_complete":[]}, or non-object coverage:[] are treated as not incomplete. In reconcile, that can set inventory_complete=True and drop a carried revision with historical VERIFY_FAIL merely because it is absent from four current passing revisions. The malformed admission is confirmed at this exact source boundary; full end-to-end misleading-band reproduction is not claimed as executed.

Required before approval: reject supplied non-Boolean known completeness flags and non-object coverage with explicit diagnostics; retain genuine Boolean False as incomplete, True as true; preserve absent/empty coverage compatibility unless a separately accepted research decision changes it. Add exact-head chain tests: predecessor contains failure for revision r, next AVAILABLE series omits r and has 4 passing revisions; invalid flags must retain the carried failure, yield UNKNOWN/no favorable band and report the admission error. Positive-control a genuinely complete inventory. The ready unmerged two-file patch/test handoff is documented in #38, comment 6379736684; it is not proof of passing repository tests.

This finding is additional to #82/#83/#86, not a duplicate Issue or a replacement for their unresolved blocker reviews. Upstream commit-matched CI runs 39617246533 and 39617244278 still report action_required, NOT PASS. Full pytest, four-generation historical bundle replay and patch integration remain NOT_RUN here. Re-review a fixing head; do not approve or release #75/#81 yet.