0.2.31

See CHANGELOG.md. Supervisor binaries attach from release-bins. PyPI from the pypi workflow.

0.2.30

See CHANGELOG.md. Supervisor binaries attach from release-bins. PyPI from the pypi workflow.

0.2.29

Supervisor last-mile: dep:* sealed on identify and run. Helper swap between those calls is FAIL, not PASS. A live local import without a hash is a worker error (FAIL, not SKIPPED).

• Async composite goes through _prepare_execution (bind + seal).
• cmd_judge lives in cli_judge.py. action_driver.py is in runtime_hashes (8 keys).
• MatchesPredicate has an 80ms budget. Timeout / bad pattern / predicate exception → FAIL.
• PreToolUse verifies the index pin when present. No pin is 0.2.28 bind-only. Pre ≠ PASS.
• Locks reshot on CPython 3.11.

pip install acid-judge==0.2.29

0.2.28

Consumer PreToolUse: `ACID_REPO_ROOT` / `ACID_LOCKS_INDEX`, package from pip.

• Matcher fragment is `YOUR_TOOL_ID`. Product ids are in `claude_settings.product.fragment.json`. Lookup unchanged. Hook is not in the pin.
• Release signature is not in this tag (`MINISIGN_SECRET_KEY` not on the publisher). Tagged Action still checks sha256.

`pip install acid-judge==0.2.28`

0.2.27

Self-CI runs a local supervisor. Tagged Action still fetches the Release ELF.

• `rust` job: `cargo build --release --locked` + `python -m acid_engine.action_driver` on `locks/index.json`. Receipts on disk. No GitHub Fetch.
• `uses: ./` stays python-cli.
• `cargo audit` is a separate job on rustc 1.88, not mixed with MSRV 1.75.
• Contour unchanged. Driver is not in the pin.

`pip install acid-judge==0.2.27`

0.2.26

Supervisor exits honestly. Tagged Action checks sha256 and writes receipts.

• Binary: 0 PASS, 1 FAIL, 2 input error or SKIPPED. JSON body unchanged.
• Release assets include `.sha256`. Tagged Action runs sha256sum -c; mismatch logs `checksum mismatch` and falls back to python-cli.
• Driver is `python -m acid_engine.action_driver` (not in the pin). YAML has no entries loop. Supervisor path writes `receipts/.json`.

`pip install acid-judge==0.2.26`

0.2.25

Tagged Action fetches the supervisor from the same release. uses: ./ stays python-cli.

• Linux uses: …@v0.2.n downloads acid-judge-linux-x86_64 from that tag (path=supervisor). Missing asset or uses: ./ logs path=python-cli. URL is not an input. Contour unchanged.
• Install block: pin, lock, index in git, Action, locks --index, judge --plan. Swapped body is not PASS. Proof is smoke.
• Cargo.toml version 0.2.25; crates.io publish = false. Replay stays library-only.

pip install acid-judge==0.2.25

0.2.24

RecordSchema fail-closed. cli_judge.py in the pin. Worker does not import cli.py.

• RecordSchema uses the conformance type dictionary. Unknown type_tag is invalid. True is not int.
• cli_judge.py is in runtime_hashes. cli.py is not. A help-text patch does not reshoot locks; a patch of cli_judge.py or worker.py is runtime_hash FAIL before run.
• Locks reshot on CPython 3.11.

pip install acid-judge. Action on the supervisor binary is not this tag.

0.2.23

Fail-closed queue: Action env, contour without cli.py, unknown output_type SKIPPED.

• pip install acid-judge. Do not publish this tree as acid-engine.
• Action Verify step interpolates inputs via env, not run:.
• runtime_hashes does not include cli.py. Reshoot locks on CPython 3.11.
• Empty or unknown output_type is SKIPPED. bool is still not int.
• Hidden init/validate/run are gone.
• INTEROP: judge_script on an imported callable is not a file gate.
• mypy --strict covers locks/ci_judge.py.
• COMMERCIAL.md has no tariff.

Yank acid-engine 0.2.21 and 0.2.22 on PyPI. acid-engine==0.2.0 stays the archive.

0.2.22

replay_run uses the same verified pipeline as execute_plan.

• Runtime pin, interface bind, body/dep hashes, seal_local_deps, then run.
• Poisoned contour or a swapped helper does not execute.
• iface and toolchain are required; missing either is SKIPPED.
• Library judge_script still does not re-hash an already-imported callable.

PyPI: acid-judge and acid-engine (same files).