AINRA v0.3.3 — the release that could actually be published

v0.3.2 is a real, signed, board-proven tag, and it cannot be published. Finding out why is this release.

With v0.3.2 tagged and publish-preflight printing READY locally, the publish workflow was dispatched — and its own preflight blocked:

[BLOCK] tag matches tree   packages differ from tag v0.3.2 — Drifted: packages/sdk-ts/package-lock.json

Nothing had drifted. The workflow provisions the SDK before running the release gate, and it did so with npm install, which writes package-lock.json. That lockfile had said 0.1.0 since v0.1.0 — through four version bumps that each touched package.json and never the lock. So the provisioning step synced it, and the gate three lines later diffed a tree that step had just dirtied.

The publish path had therefore never once got past its own preflight, on any version. It never failed visibly either, because it had never been run to completion. It never reproduced locally and never would have: the lockfile is only rewritten when npm install runs, and a developer machine already has node_modules.

Fixed

• The lockfiles state their real version, and make lockfile-sync is a board row so they cannot drift again.
• Provisioning can no longer dirty the tree it is about to gate — npm ci reads the lockfile and never writes it, and a new step asserts the tree is still pristine afterwards.
• The npm publish job no longer self-upgrades npm. npm install -g npm@latest replaces npm's own install mid-run and can die with MODULE_NOT_FOUND; the dry-run job already refused to do this, while the job actually holding the credential still did it.
• make declaration could not read what kits/soak/soak.mjs writes. The instrument emits {body:{wall_start,wall_end,slo:{measured_p95_sec}},sig_ed25519_b64}; the consumer read days, p95_seconds and signature — fields that have never existed in a report. Inside a try/catch, so real reports were silently skipped: three genuine fourteen-day soaks would have left the founding declaration still printing "0/3 regions passed", discoverable only on genesis day. make soak-ingest now connects the two, with controls for short, breached, unsigned and under-replicated runs.

Also in this release

The operations work from v0.3.2 — the staging network stands as a service that survives logout, reboot and a wedged daemon; the deployed site is walked daily as a stranger (SITE BROKEN / NETWORK DOWN / ALL UP, with the monitor's own negative control in the same job); and eleven things the public surface told visitors that were not true are fixed, each paired with a gate that would have caught it.

The published library source is byte-identical to v0.3.1.

Board: docs/releases/v0.3.3-board.md — ALL GREEN 24/24 from a fresh public clone.

Verify this release

ssh-keygen -Y verify -f allowed_signers -I release@ainra.org -n file -s SHA256SUMS.sig < SHA256SUMS
sha256sum -c SHA256SUMS

Then rebuild byte-for-byte from source per RELEASE-VERIFY.md.

AINRA v0.3.2 — the operations release (superseded by v0.3.3 for publishing)

This tag carries no binary artifacts, and that is deliberate. v0.3.2 is a real, signed, board-proven release, and within a day of tagging it we discovered it cannot be published to a package registry — see v0.3.3 for the whole story. Publishing binaries here would suggest a release we would then have to tell people not to use. The source, the tag signature and the board stand; use v0.3.3.

What v0.3.2 is

The operations release. The published library source is byte-identical to v0.3.1 — git diff v0.3.1..v0.3.2 -- packages/*/src crates/ is empty. What moved is the surface around it.

Eleven things the public site told visitors that were not true, found by walking production end to end as a stranger with no context and no login. Not one was a failing test; every one was a claim nothing checked:

• The 404's own escape links were relative, so at any nested path they resolved into that directory and were themselves 404 — the one page a lost visitor lands on had no working way back.
• Two pages published two different networks, each denying the other's passports, under a banner reading NUMBERS ARE MEASURED OR THEY ARE ABSENT.
• llms.txt named the wrong release — the file that calls itself an AI agent's map.
• The install step pointed at a download that does not contain what the sentence promised: "runs with just node" against a release carrying only a Linux x86_64 binary.
• The verifier kit documented an install route that cannot work, and the remedy its troubleshooting page offered for the failure was the cause of the failure.
• A registrar that accepts and never answers hung the page forever — a refused port always failed in milliseconds, which is exactly why nobody caught the host that drops instead.
• A "110 days old" staleness warning over a byte-current record, read out of a pinned staging constant that is not a publication time.
• Plus a share card resolving to the wrong page, a stale release count on the status page, "nine checks" over seven rows, and "live" surviving above a panel corrected to say published.

And the surface is now watched rather than assumed: the staging network stands as a service that survives logout, reboot and a wedged daemon (two recovery layers, both proven by killing things); the deployed site is walked daily as a stranger with three separate verdicts and the monitor's own negative control in the same job; and make site-net stamps the published record when it is copied, so its freshness is a measured fact.

Board: docs/releases/v0.3.2-board.md — ALL GREEN 22/22 from a clean clone.

AINRA v0.3.1 — security: RUSTSEC-2025-0144 fixed, and the checks that hid it

Security release. Fixes one advisory end to end, and closes the class of CI failure that hid it.

Board evidence: docs/releases/v0.3.1-board.md — ALL GREEN 22/22 from a clean clone at the release commit.
Full workings: docs/PLAN-M26.md · post-mortem: SECURITY.md

The advisory

RUSTSEC-2025-0144 — timing side-channel in ml-dsa decompose(). Taken to 0.1.1, where Barrett reduction
replaces an operand-dependent hardware division on values derived from the secret components s2 and t0.

Blast radius, including the part that lets us off. This is a signing-side leak: verification consumes only
public inputs, so relying parties had no secret exposed. Registrar issuance, ceremony delegates and the CLI all
sign, so it was fixed in full regardless.

The pinning vector is NIST's, not ours. Our 745 conformance vectors were generated by the vulnerable crate
and could not adjudicate a change to it. FIPS 204 ML-DSA-65 known-answer tests were wired in first — keyGen,
byte-exact sigGen, and 15 sigVer cases of which 12 are negative. 0.0.4 passed them, so there was no second
finding. They run on every board now.

getrandom is also gone from the verify path — a default feature of ml-dsa 0.1 that our seed-first key
derivation never reaches, and which broke the WebAssembly build outright.

Checks that had never once run

Check	Appeared to be	Actually was
scorecard	a published OpenSSF score	referenced a tag that does not exist — never resolved
clusterfuzzlite	continuous parser fuzzing	failed at build every run — had never fuzzed one input
cargo-audit	advisories gated	short-circuited on an unmaintained notice, hiding this advisory

All three fixed, and every security gate now carries a proof it can go red on demand. cargo-audit reports
every finding before it gates. 56 GitHub Actions references pinned to commit SHAs, 0 floating.

Verifying these artifacts

ssh-keygen -Y verify -f allowed_signers -I release@ainra.org -n file -s SHA256SUMS.sig < SHA256SUMS
sha256sum -c SHA256SUMS

Then rebuild byte-for-byte from the tagged source: make repro. See RELEASE-VERIFY.md.

Artifacts were produced by make release at the tagged commit and signed with the offline release key
(D-042 — that key never enters CI). The tag-triggered workflow is fixed for the next release; its v0.3.1 run
failed on a missing Python runtime in the release container, and a tag is never moved to patch it.

AINRA v0.3.0 — a fourth independent verifier · self-serve conformance · signed releases

A fourth independent verifier · self-serve conformance · signed releases.

What this release proves. Four independently written implementations — the Rust core, the TypeScript SDK, the reference CLI, and a new Python verifier written from the Standard alone — agree byte-for-byte on 745/745 passport + 17/17 delta + 9/9 directory conformance vectors, on verdict and named reason. The full 18-row preflight board ran ALL GREEN from a clean clone at this exact commit (docs/releases/v0.3.0-board.md), and again from a pristine credential-less container cloning this public repository (docs/releases/stranger-test-2026-07-31.md).

The self-serve conformance programme. tools/conformance/ + docs/conformance/PROGRAMME.md: a language-agnostic runner any third party points at their own implementation over a documented stdin/stdout contract. Proven both ways — three real implementations pass clean; a deliberately sabotaged one is caught with 66 named divergences. Implementers self-attest with their own key; anyone re-runs the corpus and checks. We don't certify implementations — we make certification unnecessary.

Supply-chain trust (D-042). The attached SHA256SUMS is signed with the project's offline SSH Ed25519 release key (public half: release/ainra-release.pub, fingerprint SHA256:V1ZbCNdPDEe5plpYq07dGCsoensF4Q+MPPQQkcj5pi4). provenance.json (SLSA-shaped) and sbom.json (CycloneDX) describe exactly what was built from what. Verify everything with the four-step guide in RELEASE-VERIFY.md — the strongest check, rebuilding the corpus byte-for-byte from this tag, needs no key at all.

Honest status. The three real-world genesis rows — a recorded public ceremony with independent custodians, ≥3 external verifiers, a 14-day 3-region soak — remain pending; the machinery for all three is built and rehearsed. The staging network runs on a TEST-ROOT; production log entries sealed: 0.

Full changelog: CHANGELOG.md → [v0.3.0].

AINRA v0.2.0 — the reference CLI goes hybrid Ed25519 + ML-DSA-65

The downloadable reference CLI goes hybrid — Ed25519 + ML-DSA-65, both-or-invalid.

What this release delivers. The one-file reference CLI now signs and verifies with hybrid Ed25519 + ML-DSA-65 everywhere (keygen, issuance, certs, checkpoints, status), at parity with the Rust core and the browser SDK — still a single self-contained download that runs with just node. Suite Migration Drill 01 proves a real Ed25519→hybrid migration over a running network with fail-closed alg_downgrade semantics and an auto-expiring opt-in overlap. The distributable genesis ceremony runs FROST 5-of-9 across nine isolated OS processes; witness kit v2 ships a single-binary witnessd.

Proof. The full 17-row preflight board ran ALL GREEN from a clean clone at this exact commit — committed as docs/releases/v0.2.0-board.md. The attached SHA256SUMS is signed with the project's offline release key (release/ainra-release.pub at the current tip); verification steps: RELEASE-VERIFY.md.

Honest status. Single-key root pending the recorded public ceremony; local witness keys pending independent witnesses; the three real-world genesis DoD rows unmoved.

Full changelog: CHANGELOG.md → [v0.2.0].