LETS 1.0.10

First published LETS release since v1.0.0: a production-ready distributed multi-node authorization runtime.

Validation

GitHub-hosted Actions were unavailable for this release (organization spending limit); at the owner's direction every release gate ran locally against source commit 82dbe4f5ddf410cc86778784bb612440725ec66d (GitHub-verified signed annotated tag v1.0.10, ED25519 SHA256:5KasB4SV3tUn6UHrxeFR3ZmQ9faDA4Uq6blCa06ShRw):

• Serial gates: uv lock --check, Ruff check + format over 132 files, strict mypy over 34 source files, container build-context policy, 704 passed / 2 Docker e2e deselected (706 collected).
• Security: Bandit 1.9.4 (-ll, clean), pip-audit 2.10.1 (--strict, no known vulnerabilities) over the frozen locked runtime dependencies.
• Real three-node fault-injected distributed acceptance: passed in 26.954 s.
• Hardened mTLS production-profile acceptance against the exact locally-built candidate image sha256:b0fd6600fd8e313cf22bd20d0e41baf1318dfec940e375bd8df775c1c5ad7a22 (built with SOURCE_DATE_EPOCH=1786436117 from the release commit): passed in 40.35 s (evidence attached, SHA-256 7d9e9957…).
• Sole unweakened 3,600-second production soak against that same exact digest: passed — 571 cycles, 362/362 health samples, 28 partition episodes, 3 authenticated fenced process replacements, zero violations. Evidence attached (24,619,936 bytes, raw SHA-256 fb4bd2cb07b57b1bb786294ffc697090a8cfc68cc20e45ff61da03aa95d1aae0, canonical payload sha256:3732ede0cb43932340b69f414341429dbb36e34aeaacb0e28684b9008520161e).

Both Python artifacts and the deployment bundle were built twice from clean state and are byte-identical; RELEASE_SHA256SUMS covers every attached asset.

Deferred until Actions billing is restored

Dual-platform OCI image publication to GHCR with SLSA provenance, SPDX SBOMs, and Cosign keyless attestations requires the tag-triggered release workflow's OIDC identity and is deferred; no OCI image is promoted for 1.0.10. The workflow was temporarily disabled during this tag push and re-enabled after publication.

History

Signed tags v1.0.5 through v1.0.9 are immutable, unpromoted candidates whose mandatory soaks each failed safely on a distinct verifier or orchestration defect; every failure's evidence is retained in-repo and each fix (peer admission parity, audit-export staleness with a re-derived 40-second contract, throughput-floor calibration, resource-probe fork-window filtering) was proven by replaying the prior failure's retained evidence. See CHANGELOG 1.0.7–1.0.10.

🤖 Generated with Claude Code