Changelog

Notable repository changes to this proof of concept are recorded here.

The project does not publish semantic software versions. Historical and baseline tags are reproducibility references, not maintained release series. The normative claim and nonclaims remain in poc/contract.md.

Unreleased

Added

• A security policy that states the implemented reporting scope without claiming production security, artifact authenticity, a private response channel, or a support SLA.
• Public-command troubleshooting and safe single-run cleanup guidance.
• A retained-artifact reference covering schemas, integrity boundaries, interpretation, inspection, and sharing.
• Evidence-backed compatibility documentation that separates requirements, exercised environments, and untested configurations.
• This repository change history.
• The Apache License 2.0 grant for project-authored repository content, with Eduardo Kohn as the copyright holder.
• CFF 1.2.0 software citation metadata naming Eduardo Kohn as the author.
• A VitePress documentation site that publishes canonical Markdown with local search, explicit experimental status, documentation-only dependency and trust boundaries, and automated content, language, route, and publication checks.

These repository-policy and documentation changes do not alter the Python implementation, Java fixture, supported claim, query, oracles, public result semantics, or runtime configuration. The license changes redistribution permissions.

Final Python implementation - 2026-08-15

The Python implementation was finalized at commit 0564bc9c619a4827a014c8920c8e30818f31c7a8 after the following bounded stages.

Added

• Retained-artifact evidence probes for malformed, omitted, extra, stale, and internally inconsistent evidence.
• Strict JSON Lines progress on standard error while preserving the JSON-only standard-output contract.
• Architecture and contribution documentation for component boundaries, evidence flow, trust assumptions, evolution rules, atomic commits, and US English.
• Contract tests that prove JDK pre-observation, launch, and post-observation ordering for fixture compilation and both workload JVMs.

Changed

• Isolated the exact timer contract from the main semantic verifier without changing verification labels or outcomes.
• Isolated runtime event accounting from graph mutation without changing event order, accounting values, or fused results.
• Reduced full JDK-tree inventories from 25 to 20 in the runner and harness, and from 27 to 22 in the complete public run, while retaining one full pre-launch and post-launch observation for every fixture-build and workload Java process.

No stable whole-run performance improvement, service-level objective, or production-performance conclusion is claimed from that bounded optimization.

Fixed

• Containment, termination, and reaping of resistant descendant processes.
• Rejection of undeclared semantic inputs and mismatched exact inventories.
• Binding of the Dockerfile, Compose file, launcher, and ignore policy into the executable build boundary.
• Verification of the effective non-root, capability-free, no-new-privileges, read-only, and isolated-network container posture.
• Launcher validation of source revision metadata, numeric container IDs, and the effective Compose process limit.

The final gates passed 39 unit contracts, one real semantic canary, four official negative cases, retained-artifact probes, test-only semantic mutants, a complete four-unit run, and an independent check.

Standalone baseline - 2026-08-15

The annotated local tag poc-baseline-3677c75 identifies commit 3677c75a1c8d9598ba21ad52c52738520205bd2e before the engineering improvements.

Added

• The standalone reproducible Java 25 static/runtime graph-fusion proof of concept derived from the accepted upstream experiment.
• Pinned Python and Eclipse Temurin container inputs.
• Four fixed scan-pass units, independent finite oracles, exact semantic verification, and four negative semantic cases.
• Create-only raw and result evidence, SHA-256 inventories, runtime identity records, and independent result reconstruction.
• Behavioral contracts, a real semantic canary, and the complete GitHub Actions reproduction workflow.

See poc/PROVENANCE.md for the imported experiment lineage and standalone adaptations.