Skip to content

Moss Trust Artifact v0.58.0 — GA Release

Choose a tag to compare

View all tags
@Fujo930 Fujo930 released this 08 Jun 21:48
v0.58.0
281e44a

Moss 0.58.0 — Trust Artifact General Availability

Moss 0.58.0 is the Trust Artifact GA release. After three independent adversarial audits
(16 + 22 + 40 = 78 attack vectors) and seven patch releases, the Trust Artifact pipeline
is formally specified, threat-modeled, and production-ready.

What is a Trust Artifact

A Moss Trust Artifact is a machine-verifiable JSON document containing five independent gates
that together testify to the correctness, integrity, and reproducibility of a Moss program:

check  →  type safety, effect purity, match coverage
trace  →  rule evaluation provenance (source-mapped)
golden →  output stability against recorded snapshot
lock   →  source file integrity (SHA-256 module hashing)
selfhost→  self-host parser equivalence

New in 0.58.0

Commands

moss artifact <file>              ← generate a Trust Artifact
moss artifact-project <dir>       ← project-wide Trust Artifact
moss artifact-verify <bundle>     ← verify Trust Artifact against source

# Legacy aliases still work:
moss trust / trust-project / trust-verify

--strict verification

moss artifact-verify --strict --source file.moss bundle.json
  • Rejects on file_redirected (bundle points to wrong file)
  • Rejects if any check diagnostics contain warnings

Documentation

  • docs/trust-artifact.md — Formal Trust Artifact format specification v1.0
  • docs/threat-model.md — Complete security analysis with gate-by-gate threat model

Audit Provenance

Version Audit Vectors Result
v0.55.0 Round 1 16 V1-V6 fixed
v0.56.0 Round 2 (saturation) 22 V7-V11 fixed
v0.56.1 Root cause — V5+V8 fixed
v0.56.2 V6 final — trust-verify command
v0.57.0 Nuke audit 40 F1-F7 fixed
v0.57.1 Hardening — F1 file-redirect

78 total attack vectors, 18 vulnerabilities, 0 remaining.

Trust Artifact Claims

The Trust Artifact does not claim to be a mathematical proof.
It is structured, reproducible evidence from five orthogonal verification dimensions.

For the full threat model — what the artifact can and cannot defend against — see docs/threat-model.md.

Verification

python -m pytest tests/test_mosslang.py -q
# 133 passed, 22 subtests

python -m mosslang.cli selfhost --quick
# 5/5 sketch tests pass

python -m mosslang.cli selfhost-compare examples
# 9/9 comparison passed

Install

git clone https://github.com/Fujo930/moss-lang.git
cd moss-lang
git checkout ds-Mosslang
pip install -e .

Built by Reasonix for Fujo930.

Assets 5
Loading