LETS 1.0.12

LETS 1.0.12

Added

• A separate NSDI evidence scope record, results/nsdi-evidence-scope-2026-09-28.json, records
  where the tree now differs from the source digests sealed in both NSDI evidence bundles, which
  commits changed each path, and whether behavior changed. The sealed bundles are unchanged; the
  only drift in formal/sensitivity_frontier.py is docstring removal, which leaves its analysis
  identical.
• Research tooling outside the shipped package: the AstralDeep case-study harness
  (benchmarks/astraldeep/), the NSDI reproducibility harnesses (benchmarks/nsdi_strengthening/),
  and the formal analyzers formal/sensitivity_frontier.py and formal/vector_model_checker.py,
  with their sealed evidence bundles and scope records under results/.

Fixed

• Single-warden clusters round-trip init → serve --production without hand edits: init now
  always persists peer_endpoints (an empty map for a one-warden manifest) and the serve-time
  manifest trust rebuild treats a missing map as "no peers", admissible only when the signed
  manifest declares no other wardens. Previously every production single-warden config was refused
  with "configured peer endpoints do not exactly match the signed manifest" (found while
  commissioning the AstralDeep sandbox warden, 2026-08-23).

Changed

• Removed the mandatory production soak from release qualification, together with its harness,
  verifier and tests; image promotion now depends on production acceptance only.
• CI gates changed-line coverage against the pull request's base commit or, for a push to main,
  the commit the push replaced; a push previously compared origin/main with itself and measured
  nothing. The step fails closed unless that base is a 40-hex, non-zero commit in the checkout, and
  it records every decision with the base and candidate commits and the changed paths: pass or
  fail against the 90% threshold, or an explicit not-applicable record, instead of a silent pass,
  when a change has no executable lines in the measured packages.
• The production deployment, case-study, benchmark, and TLC command-line tools state their
  --help description explicitly instead of reusing their module docstring, and the production
  Compose files open with a short header. Tools whose bytes are bound by sealed NSDI evidence are
  unchanged.
• Refreshed the image and build inputs: the pinned Python 3.14 Alpine base digest, the
  libcrypto3/libssl3 3.5.8-r0 and libuuid 2.42.3-r1 security backports, the acceptance image's
  openssl 3.5.8-r0, uv 0.12.19, and the uv_build 0.12.18 build backend. The locked core, server,
  and client dependency closure is unchanged; only the development tools hypothesis, mypy, and ruff
  moved.
• CI verifies the signed v1.0.11 comparison anchor before tests, requires every owner gate through
  one aggregate, and caps each job at 30 minutes. The repository is governed by the LETS
  constitution v1.0.0, and its source follows the self-documenting convention; that conversion
  changed docstrings and comments only.

Compatibility, migration, and rollback

• The wire contracts (lets.receipt/v1, lets.lease-grant/v1, lets.manifest/v1), API_VERSION
v1 and the HTTP API, the warden storage schema (version 2), and the executor replay schema
  (version 5) are unchanged from v1.0.11. The committed protocol/openapi.yaml differs from
  v1.0.11 only in info.version, and the public client, executor, authorizer, and receipt exports
  and the AstralDeep tool scope profile are unchanged.
• No data, schema, or configuration migration is required. init now always writes
  peer_endpoints, and serve also accepts a config that omits it when the signed manifest names
  no other warden. LETS v1 still forbids a mixed-version cluster, so upgrade through the documented
  drain, stop-the-world replacement, verification, and activation procedure.
• The approved binary rollback target is the promoted v1.0.11 image
  ghcr.io/astraldeep/lets@sha256:73f6b442df0a849f1d8cf6e13e29ff8b23bf515aae2d34cfc56bac7ccc60774c,
  which is compatible with v1.0.12 state because no storage, replay, or audit schema changed. Drain
  and stop the whole cluster, redeploy that digest to every node, and verify and activate it
  through the same procedure. v1.0.11 refuses a single-warden config that omits peer_endpoints,
  so restage such a config with an explicit empty map before rolling back. Never move or reuse a
  signed tag.