Steelmatter Systems R0 — corrected source preview

Steelmatter Systems R0 is an Apache-2.0 source preview from IronTrex CyberTechnology Private Limited. It demonstrates exact-action authorisation, shared-allowance enforcement, duplicate-order prevention and signed evidence in a local synthetic purchase-order workflow.

This follow-up fixes the public Go module path after the repository rename. The module declaration, 82 Go import references and 630 CI package identifiers now use github.com/IronTrex-CyberTechnology/steelmatter-systems. README, NOTICE and release-notes headings match the release name. Runtime logic and dependencies are unchanged. The original r0-source-preview tag stays intact as the audited historical snapshot; use this corrected preview for new clones and Go imports.

Public source commit: bab10bddd8f01b28c90fd00435dd9eb3e3909f79
Git tree: 51a95105d5ababfc7ac83d52bbe5e4164d99a345

Validation

• Public main-branch CI passed on this commit: 340/340 required checks PASS and 35/35 reviewed R0 acceptance cases PASS, with zero failures. Nine later-release cases remain out of scope.
• From a separate Go project, fetching this exact commit, importing and building core/contract, and installing cmd/smkeys through the new public module path all succeeded.
• Fresh release-checks passed on this exact commit from a clean runner without caches: protected synthetic action with offline-verified evidence in 47 seconds (900-second target), full CI in 83 seconds, govulncheck 1.9.0 found no vulnerabilities, and the log/result secret scan passed. The run retains its evidence artifact.
• PR #1 contains the reviewed module-path change.

Try it

git clone --branch r0-source-preview.1 https://github.com/IronTrex-CyberTechnology/steelmatter-systems.git
cd steelmatter-systems

Follow the quickstart for the pinned tools, disposable PostgreSQL database, synthetic protected action and offline evidence verification.

Scope

This remains a local reference using one organisation, INR integer paise, synthetic data, a simulated destination and a deterministic stand-in agent. The browser demo is recorded playback. It is not approved for real purchases or production deployment. npm packages remain private. Source downloads are available below under Apache-2.0 with NOTICE and third-party dependency notices.

Steelmatter Systems R0 — original source preview (superseded)

Superseded for Go module use: This original audited snapshot still declares the private development module path. For new clones, downloads and Go imports, use the corrected Steelmatter Systems R0 source preview at commit bab10bddd8f01b28c90fd00435dd9eb3e3909f79. This original tag and its validation evidence remain unchanged.

---

Steelmatter Systems R0 is an Apache-2.0 source preview from IronTrex CyberTechnology. It demonstrates exact-action authorisation, shared-allowance enforcement, duplicate-order prevention and signed evidence in a local synthetic purchase-order workflow.

Public source commit: ceb8fd6b4ce89020a667ba485af39daede3fcf80

Validation

Public-repository CI passed on the published commit.

• 35/35 reviewed R0 acceptance cases PASS.
• 340/340 required implementation checks PASS across seven phases.
• Nine R1/R2 cases remain out of scope.
• Fresh runner reached a protected action with offline-verified evidence in 79 seconds (900-second target); full CI took 129 seconds.
• govulncheck 1.9.0, Go 1.27.3, vulnerability database dated 21 October 2026: no vulnerabilities found.
• Source and log secret-pattern scans passed.
• All 233 published files and executable modes match the audited source export. The public repository starts with fresh history.

The reviewed case mappings and source-preview limits are described in RELEASE_NOTES.md.

Evaluating the current preview

For new evaluation, follow the corrected Steelmatter Systems R0 source preview. This original tag remains available below as an audit snapshot.

Scope and accepted limitations

This preview uses one organisation, INR integer paise, synthetic data, a simulated destination and a deterministic stand-in agent. The browser demo is recorded playback. It is not approved for real purchases or a production deployment; npm packages remain private.

The standalone CI aggregator can consume stale result files and retain the last result from concatenated runs. These two minor tooling limitations are accepted for R0 and documented, not claimed fixed. Release evidence used a fresh checkout and fresh raw results, with no duplicate terminal identities.

Export provenance

Validated source commit: 2b8fe2ad1037507882e2681e57cda87453d0b000. Public Git tree: 9a8263aa9caf92421a681b2caa286c90f02e3d6e.

Original audited build archive SHA-256: c891878f7ed0a3a67558ff1e44a1a8140f9c580a6eada6c1a853656507971c25. GitHub-generated source downloads use a different archive container; their 233 source files match the audited export.

Includes the unmodified Apache License 2.0, NOTICE and third-party dependency notices.