LETS 1.1.2

LETS 1.1.2

The v1.1.1 tag was not published: its release run built and signed the image candidate but could
not build the hardened production-acceptance image, because Alpine 3.24 replaced OpenSSL 3.5.8-r0
with 3.5.9-r0 and the pinned version was no longer installable. 1.1.2 carries the same runtime.

Security

• The runtime image installs libcrypto3 and libssl3 3.5.9-r0, and the production-acceptance image
  installs openssl 3.5.9-r0, the current Alpine 3.24 security update.

Compatibility, migration, and rollback

• The API, protocol, storage schema (version 3), and configuration are unchanged from 1.1.1 and
  1.1.0; no migration is needed. The 1.1.1 notes on migrating from 1.0.x and on the rollback
  boundary apply unchanged.

LETS 1.0.12

LETS 1.0.12

Added

• A separate NSDI evidence scope record, results/nsdi-evidence-scope-2026-09-28.json, records
  where the tree now differs from the source digests sealed in both NSDI evidence bundles, which
  commits changed each path, and whether behavior changed. The sealed bundles are unchanged; the
  only drift in formal/sensitivity_frontier.py is docstring removal, which leaves its analysis
  identical.
• Research tooling outside the shipped package: the AstralDeep case-study harness
  (benchmarks/astraldeep/), the NSDI reproducibility harnesses (benchmarks/nsdi_strengthening/),
  and the formal analyzers formal/sensitivity_frontier.py and formal/vector_model_checker.py,
  with their sealed evidence bundles and scope records under results/.

Fixed

• Single-warden clusters round-trip init → serve --production without hand edits: init now
  always persists peer_endpoints (an empty map for a one-warden manifest) and the serve-time
  manifest trust rebuild treats a missing map as "no peers", admissible only when the signed
  manifest declares no other wardens. Previously every production single-warden config was refused
  with "configured peer endpoints do not exactly match the signed manifest" (found while
  commissioning the AstralDeep sandbox warden, 2026-08-23).

Changed

• Removed the mandatory production soak from release qualification, together with its harness,
  verifier and tests; image promotion now depends on production acceptance only.
• CI gates changed-line coverage against the pull request's base commit or, for a push to main,
  the commit the push replaced; a push previously compared origin/main with itself and measured
  nothing. The step fails closed unless that base is a 40-hex, non-zero commit in the checkout, and
  it records every decision with the base and candidate commits and the changed paths: pass or
  fail against the 90% threshold, or an explicit not-applicable record, instead of a silent pass,
  when a change has no executable lines in the measured packages.
• The production deployment, case-study, benchmark, and TLC command-line tools state their
  --help description explicitly instead of reusing their module docstring, and the production
  Compose files open with a short header. Tools whose bytes are bound by sealed NSDI evidence are
  unchanged.
• Refreshed the image and build inputs: the pinned Python 3.14 Alpine base digest, the
  libcrypto3/libssl3 3.5.8-r0 and libuuid 2.42.3-r1 security backports, the acceptance image's
  openssl 3.5.8-r0, uv 0.12.19, and the uv_build 0.12.18 build backend. The locked core, server,
  and client dependency closure is unchanged; only the development tools hypothesis, mypy, and ruff
  moved.
• CI verifies the signed v1.0.11 comparison anchor before tests, requires every owner gate through
  one aggregate, and caps each job at 30 minutes. The repository is governed by the LETS
  constitution v1.0.0, and its source follows the self-documenting convention; that conversion
  changed docstrings and comments only.

Compatibility, migration, and rollback

• The wire contracts (lets.receipt/v1, lets.lease-grant/v1, lets.manifest/v1), API_VERSION
v1 and the HTTP API, the warden storage schema (version 2), and the executor replay schema
  (version 5) are unchanged from v1.0.11. The committed protocol/openapi.yaml differs from
  v1.0.11 only in info.version, and the public client, executor, authorizer, and receipt exports
  and the AstralDeep tool scope profile are unchanged.
• No data, schema, or configuration migration is required. init now always writes
  peer_endpoints, and serve also accepts a config that omits it when the signed manifest names
  no other warden. LETS v1 still forbids a mixed-version cluster, so upgrade through the documented
  drain, stop-the-world replacement, verification, and activation procedure.
• The approved binary rollback target is the promoted v1.0.11 image
  ghcr.io/astraldeep/lets@sha256:73f6b442df0a849f1d8cf6e13e29ff8b23bf515aae2d34cfc56bac7ccc60774c,
  which is compatible with v1.0.12 state because no storage, replay, or audit schema changed. Drain
  and stop the whole cluster, redeploy that digest to every node, and verify and activate it
  through the same procedure. v1.0.11 refuses a single-warden config that omits peer_endpoints,
  so restage such a config with an explicit empty map before rolling back. Never move or reuse a
  signed tag.

LETS 1.0.11

LETS 1.0.11

Changed

• Refreshed the pinned Python 3.14 Alpine runtime, uv build/runtime tooling, supported server
  dependency floor, development toolchain, and immutable GitHub Actions revisions already present
  on main. Removed the retired tracked manuscript tree; release evidence remains owned by the
  release workflow and immutable release assets.

Compatibility, migration, and rollback

• Runtime behavior, the public HTTP and receipt-wire contracts, and SQLite schema version are
  unchanged from v1.0.10. Existing v1.0.10 state and configuration require no data or schema
  migration. LETS v1 still forbids a mixed-version cluster, so upgrade through the documented
  drain, stop-the-world replacement, verification, and activation procedure.
• No earlier published LETS release has an approved OCI rollback digest: v1.0.10 published package
  and local acceptance artifacts but no promoted image, and v1.0.1 through v1.0.9 remain
  unpromoted candidates. If v1.0.11 must be withdrawn, fence affected wardens, preserve its
  immutable evidence, and recover forward with a patch release; never move or reuse a signed tag.

LETS 1.0.10

First published LETS release since v1.0.0: a production-ready distributed multi-node authorization runtime.

Validation

GitHub-hosted Actions were unavailable for this release (organization spending limit); at the owner's direction every release gate ran locally against source commit 82dbe4f5ddf410cc86778784bb612440725ec66d (GitHub-verified signed annotated tag v1.0.10, ED25519 SHA256:5KasB4SV3tUn6UHrxeFR3ZmQ9faDA4Uq6blCa06ShRw):

• Serial gates: uv lock --check, Ruff check + format over 132 files, strict mypy over 34 source files, container build-context policy, 704 passed / 2 Docker e2e deselected (706 collected).
• Security: Bandit 1.9.4 (-ll, clean), pip-audit 2.10.1 (--strict, no known vulnerabilities) over the frozen locked runtime dependencies.
• Real three-node fault-injected distributed acceptance: passed in 26.954 s.
• Hardened mTLS production-profile acceptance against the exact locally-built candidate image sha256:b0fd6600fd8e313cf22bd20d0e41baf1318dfec940e375bd8df775c1c5ad7a22 (built with SOURCE_DATE_EPOCH=1786436117 from the release commit): passed in 40.35 s (evidence attached, SHA-256 7d9e9957…).
• Sole unweakened 3,600-second production soak against that same exact digest: passed — 571 cycles, 362/362 health samples, 28 partition episodes, 3 authenticated fenced process replacements, zero violations. Evidence attached (24,619,936 bytes, raw SHA-256 fb4bd2cb07b57b1bb786294ffc697090a8cfc68cc20e45ff61da03aa95d1aae0, canonical payload sha256:3732ede0cb43932340b69f414341429dbb36e34aeaacb0e28684b9008520161e).

Both Python artifacts and the deployment bundle were built twice from clean state and are byte-identical; RELEASE_SHA256SUMS covers every attached asset.

Deferred until Actions billing is restored

Dual-platform OCI image publication to GHCR with SLSA provenance, SPDX SBOMs, and Cosign keyless attestations requires the tag-triggered release workflow's OIDC identity and is deferred; no OCI image is promoted for 1.0.10. The workflow was temporarily disabled during this tag push and re-enabled after publication.

History

Signed tags v1.0.5 through v1.0.9 are immutable, unpromoted candidates whose mandatory soaks each failed safely on a distinct verifier or orchestration defect; every failure's evidence is retained in-repo and each fix (peer admission parity, audit-export staleness with a re-derived 40-second contract, throughput-floor calibration, resource-probe fork-window filtering) was proven by replaying the prior failure's retained evidence. See CHANGELOG 1.0.7–1.0.10.

🤖 Generated with Claude Code

LETS 1.0.0

Full Changelog: https://github.com/AstralDeep/LETS/commits/v1.0.0