Skip to content

v3.16.0

Someone pulled the plug mid-write. The journal ended on half a line, and the task that owned it was gone. That used to be the end of the story. Here it is a repair.

Replay stopped losing the ending

  • A crash-torn journal tail is repaired and the suspended task resumes. (#3955, @Louis20060723)
  • Journal consistency and sealed identity are separate verdicts, so a clean prefix stops passing for a whole journal. (#3908, @Silentpartnercoding)
  • event_count counts usable events through the sealed prefix instead of trusting the file. (#4025, @sujeito-operator)
  • A journal line that is not valid UTF-8 is discarded, not raised. (#4008, @sujeito-operator)
  • replay --as-json emits JSON on every exit path, including the ones that fail. (#4017, @Chirag6722; #3991)

Proof instead of assurance

  • A result bundle verifies offline against DSSE. No network, no registry, nobody to ask. (#3903, @Nickgonzales76017)
  • allowed_files is enforced at the merge acceptance gate, not merely declared. (#4002, @Aeirx)
  • A merge whose incoming change cannot be verified is refused rather than waved through. (#4022)
  • The credential token_type allowlist derives from its own Literal and cannot drift from it. (#4030, @Aeirx)

Volunteer workers

Bernstein opted into its own volunteer program, which is either good engineering or a conflict of interest. The project manifest is content-addressed, the sandbox profile is derived rather than declared, and bernstein volunteer verify says which. (#3907, #3909, #3912, #3916, #3920)

Boundaries

  • Sixteen hand-rolled path checks became one containment helper. (#3855, #3857, #3858, @vaibhav8a)
  • Card matches are Luhn-validated before redaction: real numbers go, coincidences stay readable. (#3818, @vaibhav8a)
  • Budget forecasts are scoped to the caller's tenant. (#3850, @vaibhav8a)
  • Upgrade proposals are gated on the proposer's measured history. Confidence is not history. (#3840, #3843, @Nickgonzales76017)

The CI said it was fine

It was not. A gate that always succeeded, a mutation lane that could not fail, a workflow whose header described another workflow. Now they say what they do.

  • Silently-inert gates and misleading green, across the workflow surface. (#3945, #3960)
  • Workflow headers and names match behaviour. (#3956, @ThinkerDesigns)
  • Merges land through a queue, and release bumps go through it too. (#3964)

Also

  • READMEs in Hindi and Bengali. (#3992)
  • First-run paths for evolve and listen are fenced. (#3848, @jvsilva12600009)
  • A dashboard vocabulary reference. (#3790, @atirna)
  • The TUI renders a toast again, and its task list stops lying about stale rows. (#3938; #3932, @ShlokShar)

Upgrading

Upgrade in place. JournalVerifyResult reports chain consistency, reader coverage and sealed identity as three verdicts instead of one ok bit; anything reading the old bit needs updating.

Contributors

@Chirag6722 · @sujeito-operator · @vaibhav8a · @Louis20060723 · @Nickgonzales76017 · @Aeirx · @ThinkerDesigns · @Silentpartnercoding · @ShlokShar · @atirna · @jvsilva12600009 — and Renovate and Dependabot, who never sleep.

Soundtrack

Two footwork takes on the same lyric sheet.

Lyrics 
[Intro — dry vocal, chopped]
Version three... one... six
Tag it — tag it — tag it
(queue empty, main green)

[Drop — chop loop]
Drain the queue, drain the queue
Merge — merge — merge —
Green on main, green on main
Fake green? Found it. Gated.

[Break — replay]
Torn tail? Stitched.
Crash mid-write? Resume.
Replay it byte for byte
Same hash — same hash — every time

[Drop — receipts]
Show me the receipt (-ceipt -ceipt -ceipt)
Verify it offline
No trust, just proof
No trust — just proof

[Break — volunteer]
Lend your worker to the cause
Sandbox locked, scope declared
Zero creds, clean room
We run our own program

[Bridge — tenant]
Your data — your lane
Tenant-scoped, stay in your lane
Card match? Redacted.
No leak — no leak

[Outro]
Readme speaks four new tongues
Mutation gate bites now
The ratchet only turns one way
Three... one... six. (tag it)