Release v0.10.0: spec schema 0.2, one compiled model, portable attestation

[qwerfunch]

2026-09-10 · develop → main · release v0.10.0

Spec schema 0.2: a feature says what it is for before what it does, every acceptance criterion has an address, and a test claims a criterion by naming it at the start of its own title. One compiled model answers the questions that used to be asked of four, each level of assurance has a named check profile recorded in a new attestation format, and a reviewed migration carries an old project across.

Heads-up: merge this with "Create a merge commit" — never squash or rebase, so the next release does not report phantom conflicts — then tag v0.10.0 on the merge commit and back-merge main into develop. A project still on the old spec format should commit its work first, then run clad migrate --to 0.2 to preview, apply once the listed decisions are reviewed, and re-prove with clad check --tier=pre-push. On 0.2 a test's covers tag must be the very first thing in its title, or the criterion counts as unproven. The pre-push check rewrites the sealed attestation on every pass; commit it with the change. The attestation now describes what the repository tracks, not what happens to sit in the working copy, so a check that passes locally passes on a fresh clone.

Added

▸ Spec schema 0.2. Purpose-first features, addressable criteria, test-title binding, a compiler with typed registries, transactional spec editing, a migration preview from 0.1, a proof and evidence kernel, and five verification profiles from feedback to release.

▸ One compiled graph model with layers for what the spec declares, what the documents link, what the source references, and which tests the gate actually observed.

▸ clad relocate-generated previews and, with --apply, moves the generated files under spec/generated/ as one recoverable transaction. Opt-in; the current layout stays supported, and a 0.2 workspace explains its generated files in spec/generated/README.md.

▸ A release gate for the 0.2 validation work. The validation ledger names the scenarios that block this release; the release validator exits nonzero while any lacks discriminating evidence, and reference-host evidence counts only when its receipt is signed by a registered issuer.

▸ The release was measured, three ways. Against no engine and against released 0.9.4 on the same host, model and task (docs/ab-evaluation/case-version-abc-094-vs-0100.md); and every change in this section has a recorded scenario row in a 44-row deterministic table locked on the shipped build, with a CI guard that fails when a release-note item has no row (docs/ab-evaluation/case-0100-feature-scenarios.md). Host probes on Claude Code, Codex and Cursor completed read and write cycles; Antigravity fails for a host-side reason recorded there.

Changed

▸ Completeness is judged from structure alone, and the completion, push and release profiles now block on warning-level drift findings.

▸ A project's own instructions say how a test claims a criterion — the managed AGENTS.md and CLAUDE.md sections, the gate's unproven-criterion report, the missing-test guidance, and the refusal of the old binding field all name the same rule; 0.1 wording is unchanged.

▸ clad done reports how independently the work was verified, and independence_policy: require turns that label into a decision.

Removed

▸ The experimental headless loop and its run command, the adapters that served only it, and the run skill. Nothing ever ran it.

Fixed

▸ An attestation stamped on a working machine now matches the one a clean checkout computes. This PR's first CI run went red on every completed feature because the sealed record had been stamped from a working copy that held desktop metadata files and ignored fixtures inside sealed folders. The record now enumerates directory contents and runner configuration from what git tracks (plus untracked files git does not ignore), never from stray files; files inside a nested repository or a submodule are treated as absent rather than sealed. A new scenario row stamps a record on a deliberately messy copy, clones the commit, and checks it there.

▸ A workspace holding a signed review could never record a verification; the gate and the writer now read the same set, and a refusal names its cause.

▸ Two command-line paths found by the scenario battery: asking for a one-run assurance level the project cannot grant now says why instead of failing quietly, and a receipt imported on the command line is checked against the project's registered signers the same way the host tool checks it.

▸ A renamed test keeps its binding, graph code no longer reaches into gate code, the host support table was refreshed against live runs, and transitive dependency advisories are patched (npm audit clean as of 2026-09-09).

Verification at the tip: a clean clone on node:22 (non-root, the CI sequence, no re-stamp) rebuilds dist/clad.js byte-for-byte, passes 336 test files / 3,835 tests, passes the strict pre-commit gate with the committed attestation untouched, and passes the release profile; the 0.2 release validator and conformance suite pass; the 44-row scenario table is locked on the shipped build; the tarball carries no harness directories or key material.

🤖 Generated with Claude Code