WorldBisect 1.2.1

Fixed

• Bind optional daemon file opens and workspace capture to authorized directory
  descriptors, and reject special files without blocking. Bound file_digest
  rules read captured regular files; links and missing entries return an explicit
  failed result.
• Accept GitHub's provider-selected OIDC request route and direct-job
  job_workflow_ref when it exactly matches the configured workflow. Preserve
  signature, issuer, audience, repository, branch and replay checks; emit only
  fixed diagnostic categories on publication failures.
• Exclude generated build state and Python caches from source/SBOM artifacts,
  populate deterministic binary build timestamps, and include existing license,
  notice and copyright files in Debian packages.
• Compute the SPDX 2.3 package verification code from sorted file SHA-1
  checksums while retaining SHA-256 file and release checksums.

Added

• Experimental, source-built team hub with isolated workspaces, named identities,
  scoped credentials, atomic revocation/reload, bounded audit records, verified
  GitHub Actions publisher origin and encrypted backup/recovery. Diagnosis
  confidence remains client-reported; this preview is not a hosted SaaS.
• Live GitHub identity checks, restart replay protection tests and encrypted
  recovery checks, including a restore quarantine for previously issued tokens.
• Root Action mode: ci, first-diagnosis onboarding and a tested reviewdog SARIF
  integration. Marketplace Action action-v1.0.0 is versioned separately from
  engine archives; existing verified engine download pins remain unchanged.

Changed

• Update pinned CI tools and run real age encryption checks in the release gate.
• Release binary archives continue to contain the CLI and diagnostic daemon;
  the team hub remains available through the source distribution.

WorldBisect CI Action 1.0.1 — Verified engine 1.2.1

Your pipeline passed yesterday. Today it fails. Test what changed.

This Action update defaults to the published, checksum-verified WorldBisect engine 1.2.1 on Linux AMD64 and ARM64. The Action and engine use separate release versions.

- uses: ClusterPilot-System/worldbisect@db6b33f891779cf8e636393cf0b6afb242f6a282 # action-v1.0.1
  with:
    mode: ci
    command: '["./ci/check.sh"]'
    files: |
      ci/check.sh
      config/app.conf

Run successfully on the default branch first. A later failed check can retrieve compatible selected inputs and test changes on the current runner. Select only safe files: their raw contents are retained, for seven days by default. If the failure cannot be reproduced, the result says so.

Default compare mode remains available for existing explicit-workspace integrations. Both implementations are pinned to reviewed commit 1ef4595f36e5153a1f4c072b6d115e4104d00dba.

• Merged change and validation
• Engine 1.2.1 binaries, checksums and release notes
• Run the first diagnosis
• CI setup, permissions and retention
• Proof boundary

The actual 1.2.1 demo reports PROVEN for a deliberately changed configuration file in nine experiments. Both released-engine architectures, root compare mode and required CI checks passed. This is tested evidence from a controlled regression, not a customer adoption or performance claim.

The team report hub remains an experimental source-built preview. This release does not announce a managed SaaS.

Existing immutable tags and engine assets are unchanged.

Verified on the release commit: successful baseline → automatic dispatcher → separate controlled failure. The test observed PROVEN and preserved the original failing outcome and exit code. Live OIDC verification also passed.

WorldBisect CI Action 1.0.0 — Yesterday green. Today red.

Your CI passed yesterday. Today it fails. Test what changed.

This release publishes the root GitHub Action with an explicit mode: ci. It saves only the safe files you select after a successful default-branch run, then tests a later reproducible failure against that baseline.

• Automatic baseline capture and a concise diagnosis summary.
• The original failed check remains failed.
• Existing explicit-workspace users retain the default compare mode.
• Implementation Actions use immutable commit pins.

Try one diagnosis in three commands, or start from the complete pinned CI workflow.

Verified on GitHub: successful baseline and compare-mode compatibility, followed by a controlled failure and PROVEN cross-run diagnosis. These are controlled tests, not customer incidents.

Scope: this is an Action distribution release. The downloaded diagnosis engine remains checksum-verified 1.2.0. The separate source-built team hub remains an experimental preview; this release does not announce a hosted SaaS service.

Select only non-secret files. Baseline artifacts contain raw file contents, default to seven-day retention, and do not recreate historical packages, services or machine state. If the pass/fail pair cannot be reproduced, WorldBisect reports that limit. See the CI contract.

Share your first setup attempt. If it helps, a star helps other developers discover it.

WorldBisect 1.2.0

Added

• Opt-in CI companion Action retains explicitly selected successful inputs,
  finds compatible trusted baselines, reproduces both outcomes, and preserves
  the original check failure while testing candidate causes.
• Short workflow summaries and optional updatable PR comments explain the
  finding, executed tests, confidence, and next step.
• Bounded retention and input sizes, credential rejection, clean environments,
  fork isolation, and explicit non-reproducible outcomes.
• Real-tool integration checks cover Node.js, GCC and the pinned ItsDangerous
  upstream suite (297 tests), plus automatic cross-run artifact verification.
• Reviewed VERSION changes on main run the gated, attested release pipeline.

Fixed

• Native Linux AMD64 tracing keeps ptrace operations on their owning OS
  thread, scopes child waits to the isolated process group, drains command
  output, and bounds cancellation of nested processes. Commands that change
  process groups use documented portable fallback. This fixes a compiler-check
  hang and concurrent command exit-status theft.
• Release archives include the standalone installer.

Community

• Added contributor onboarding with two concrete good first issue tickets,
  public Discussions guidance, a bounded 1.x roadmap, and monthly maintenance
  notes.
• Added a consented/anonymized user-report intake form and publication gate;
  no synthetic demo is presented as real user evidence.

Security

• Future GitHub releases are published through the repository's Immutable
  Releases setting using a draft-first asset upload flow.
• Documented the moving v1 Action compatibility tag separately from full
  commit-SHA pins and archive/attestation verification for security-critical
  workflows.

WorldBisect 1.1.1

Changed

• The v1.1.1 Action release supplies the verified v1.1.0 Linux archive digest
  by default; custom releases and repositories still require an explicit
  sha256.
• GitHub Action runs publish the diagnosis, report link, and diagnostic artifact
  link in GITHUB_STEP_SUMMARY and expose artifact URLs as outputs.

Fixed

• Action failure handling now reports a clear operational failure when a
  diagnosis output is unavailable instead of masking it with a secondary file
  error.

WorldBisect 1.1.0

Added

• Production-ready GitHub Action for deterministic workspace diagnosis.
• Markdown, JSON, JUnit, and SARIF Action outputs with redacted diagnostic handoffs.
• Explicit Action failure policies and stable analysis outputs.
• Public five-minute demo workflow and reproducible PROVEN fixture.
• Hardened workspace capture against hardlinks, symlinks, and in-place races.

Security

• Action downloads verify the selected immutable release archive before execution.
• GitHub workflows use explicit permissions and immutable action references.

WorldBisect 1.0.0

WorldBisect v1.0.0

WorldBisect is an open-source Linux diagnostic tool that compares a known-good and a known-bad workspace to identify the smallest
tested factor that explains a failure.

This is the first stable release.

Highlights

• Deterministic comparison of good and bad workspaces
• Analysis of environment and workspace factors
• Bidirectional causal verification
• Result states:
  • PROVEN
  • SUPPORTED
  • CORRELATED
  • UNPROVEN
• Signed Ed25519 causal certificates
• Deterministic diagnostic bundles
• Human-readable Markdown, JSON, JUnit, and SARIF reports
• File-backed storage with migrations
• Audit hash chain and content-addressed blobs
• API, daemon, dashboard, metrics, and trace output
• Execution timeouts, quotas, job leases, and secret redaction
• Linux AMD64 and ARM64 packages
• Debian and systemd integration
• SPDX SBOM and deterministic release packaging
• Unit, integration, race, security, determinism, and end-to-end tests

GitHub Action

WorldBisect can be used in GitHub Actions to compare two explicitly selected workspaces and publish diagnostic artifacts.

The Action provides:

• Analysis status
• Stable analysis ID
• Markdown and machine-readable reports
• JUnit and SARIF output
• Redacted diagnostic bundle
• Configurable experiment limits and failure policies
• SHA-256 verification of the selected immutable release archive

Security

• Remote command execution is disabled by default.
• Remote execution requires canonical executable paths and permitted working directories.
• Workspace access is protected against path, symlink, hardlink, and in-place replacement attacks.
• Secret-looking environment variables are redacted.
• Redacted secrets are excluded from automatic causal claims.
• Diagnostic bundles are designed to remain secret-safe.

Supported Platforms

• Linux AMD64
• Linux ARM64

Important Limitations

WorldBisect only makes causal claims within the explicitly captured and tested model. A PROVEN result means that the factor was
proven within the tested evidence boundary; it does not prove that no other external factor exists.

WorldBisect does not automatically repair production systems.

License

Apache-2.0

Die bestehenden Release Notes enthalten bereits die technischen Kernpunkte. Diese Version ist stärker für Marketplace-Nutzer
formuliert und erklärt zusätzlich Action, Sicherheit und Grenzen.