INVARA 0.2.0

INVARA 0.2.0

INVARA 0.2.0 adds the first generation of local transformation assurance while keeping the existing contract verdicts and six MCP tools unchanged.

What is new

• invara assure compares a declared before/after pair. It records the observable behavior named by an Equivalence Manifest, applies only the declared normalization policies, and can report a minimized counterexample or exhaustive result over a declared finite domain.
• invara repair manages a repair one unit at a time in disposable Git worktrees. A unit is kept only after the declared envelope accepts it; rejected work is recorded and rolled back from the accepted state.
• The bundled plugin adds /invara:assure and /invara:repair guidance while retaining /invara:doctor and the existing MCP tool set.

These workflows verify only the inputs, observations, policies, claims, and commands declared in the manifest. PASS does not prove general correctness, security, performance, or absence of bugs. User-named commands and local services run with the user's permissions. The engine makes no outbound network call; an HTTP probe may connect only to a loopback service that the manifest starts for that session.

Install

INVARA requires Python 3.12 or newer.

pip install invara==0.2.0

The self-contained plugin is attached as invara-plugin-0.2.0-ca78011a2fd8.zip.

Validation and provenance

Four identities describe different evidence and are intentionally kept separate:

• Behavioral evidence: 1339786840b1600c328d8b358eb0ffde7e9a1e9d. The accepted runs covered Windows and Ubuntu 24.04.4 under WSL2, including Python 3.12.3 on Ubuntu.
• Version-only candidate and sealed artifact provenance: ca78011a2fd87e043583fd0b56d13ba0c375fadb. The 0.2.0 package identity and fresh artifact checks ran on Windows with Python 3.12.10.
• Independently reviewed public source commit: e8e125f7a79f00bf0dd63d1df64f0f92056fe92e.
• Public promotion identity: merge commit 3fbcd3c6acc9cda1d085a3f3638ca1ddcacaec90. The reviewed source commit remains its second parent, and the merge tree is the reviewed tree 86ff0bd0427b8fe78ceb0abb9cf7a3c6bb62acf7.

The 33 executable Python modules match the candidate, wheel, sdist, and plugin ZIP byte for byte. Documentation was curated separately. Independent public-promotion review passed 70/70 checks, and the pull request passed the Ubuntu and Windows full suites plus both fresh-package jobs.

The public promotion was checked for exact executable parity. It is not presented as a fresh rerun of the complete behavioral evaluation. macOS behavior and editor UI installation were not verified for this release.

Sealed files

File	SHA256
invara-0.2.0-py3-none-any.whl	2a4d2fb7d3716b66abcac1aec826fa0c2ba696b9633912e8a9e4c9756c5af393
invara-0.2.0.tar.gz	80f4e4001327157b238e06c7b7a1a82f17ddccf88bb815a0ae8554e5a2d8bc2b
invara-plugin-0.2.0-ca78011a2fd8.zip	d38ec20fcc5007ca382f1a1f7b3dc8ca9022803289837009306a841657c26ace

The PyPI workflow downloads only the exact wheel and sdist from this draft release, checks these hashes plus package metadata and the wheel RECORD, and publishes those files without rebuilding them.

Packaged documentation limitation

The sealed wheel/sdist embed the README captured at the version candidate, including its historical v0.1 / Alpha status line. The public repository README adds the 0.2 Gen 1 onboarding and precise outbound-network/loopback wording after the sealed build.

The sealed plugin ZIP also retains the sentence that nothing in the verdict path is “a model, a service, or a network call.” Its executable engine makes no outbound communication, but a user-declared command may start a local service and an HTTP probe may use loopback. The curated public plugin README states that boundary precisely. The plugin archive ships unchanged with this explicit limitation so its reviewed bytes and provenance remain intact.

Try it free

Try the free browser example or prepare a local check plan: Open the free flow. The browser example uses made-up files and does not check your project. For a real check, use Python 3.12+ and follow the 0.2.0 quickstart. No purchase is required.