Tickline v1.0.0 — Portfolio release

v1.0.0 — Portfolio release

Tickline v1.0.0 is the completed portfolio baseline for the deterministic
security-engineering range.

It consolidates the implemented C++, Go, Python, SQLite, Unity and Docker
subsystems into one documented and reproducibly verified release.

Delivered system

• Deterministic authoritative simulation with fixed ticks and integer units.
• Strict command envelopes, validation and session replay protection.
• Bounded binary framing and incremental protocol parsing.
• Canonical evidence for accepted and rejected command submissions.
• SHA-256 evidence chaining and trusted-head archive verification.
• Transactional SQLite investigation persistence.
• Native schema-versioned investigation bundle export.
• Read-only Unity forensic replay and evidence inspection.
• Deterministic Python statistics, baselines, outliers and human review data.
• Go developer console for diagnostics, workflows and artifact verification.
• CMake, CTest, sanitizer, race-detector, Docker and GitHub Actions coverage.

Portfolio hardening

The final milestone also:

• aligns every component version with v1.0.0;
• removes known C++ release-build warnings;
• adds Go verification to the hosted CI matrix;
• rebuilds the root README as a project landing page;
• clarifies security boundaries and non-goals;
• freezes the milestone roadmap into a completed release history.

Verification

The release is validated through:

bash scripts/check-local.sh

The repository gate covers documentation, C++, sanitizers, Python, Go and
Docker.

The operational workflow is executed through:

build/tools/tickline-dev/tickline-dev \
  workflow run \
  --plain \
  release-readiness

Unity EditMode coverage is executed separately through:

bash scripts/check-unity.sh

Unity remains separate because it requires a locally installed and licensed
Windows Unity Editor.

Integrity model

Console runs persist canonical results, stage logs and an SHA-256 artifact
inventory under:

reports/check-local/<run-id>/

The inventory detects artifact changes relative to the supplied manifest. It
is not digitally signed and does not establish authorship, provenance or
manifest authenticity.

Scope boundary

Tickline is lawful defensive engineering against repository-owned code and
artifacts.

It is not a cheat implementation, anti-cheat bypass, malware project,
third-party reverse-engineering target or production attack toolkit.

Limitations

• No production TCP or UDP service.
• No authenticated remote sessions.
• No transport encryption or key management.
• No digital signatures.
• No multi-tenant investigation service.
• No hosted Unity execution.
• No collision or hit-validation subsystem.
• No production anti-cheat deployment.

These exclusions are deliberate and remain visible in the public project
documentation.

Tickline v0.9.0 — Runtime diagnostics and service hardening

v0.9.0 — Runtime diagnostics and service hardening

Tickline v0.9.0 introduces a Go-based developer console that consolidates
local verification, diagnostics, operational workflows, persisted execution
evidence, and artifact-integrity verification.

Highlights

• Shared execution engine for plain output, versioned JSON, and an interactive
  Bubble Tea terminal interface.
• Declarative verification stages with dependency-aware planning.
• Repository and toolchain diagnostics through tickline-dev doctor.
• Operational workflow discovery and execution.
• Process-tree cancellation using Linux process groups.
• Per-run stdout, stderr, and combined stage logs.
• Canonical schema-version-2 result.json documents.
• Schema-version-1 artifacts.json integrity inventories.
• Plain and JSON verification through tickline-dev artifacts verify.
• Release-readiness workflow metadata and persisted evidence.
• Unit, integration, race-detector, and static-analysis coverage.

Artifact model

Executed verification runs write their evidence under:

reports/check-local/<run-id>/

The directory contains the canonical result, stage logs, and an integrity
manifest. Verification checks manifest structure, repository containment,
artifact type, file size, and SHA-256 digest.

The manifest is an integrity inventory, not an authenticity mechanism. It is
not digitally signed and does not establish authorship, provenance, or trust
in the manifest itself.

Limitations

• The console is repository-local and is not a remote orchestration service.
• Generated reports are excluded from Git.
• Artifact manifests are not digitally signed.
• Hosted Unity execution is not configured in GitHub Actions.
• Production deployment and remote evidence services remain outside this release.

v0.8.0 — Analytics and statistics

v0.8.0 — Analytics and statistics

Tickline v0.8.0 adds deterministic Python analytics for validated investigation bundles.

Added

• Strict schema-version-1 investigation-bundle parsing and validation.
• Duplicate-key, unknown-field, unsigned-integer, digest, timestamp, session, evidence-chain, trusted-head, and summary consistency checks.
• Deterministic overall, session, command-type, rejection-code, and target-tick statistics.
• Verified multi-investigation baseline construction.
• Duplicate archive and candidate-in-baseline protection.
• Baseline minimum, maximum, mean, median, median absolute deviation, and explicit zero-MAD tolerance values.
• Explainable outlier findings using modified z-scores or explicit zero-MAD tolerances.
• Stable finding severity and ordering.
• Human review dispositions for confirmed anomalies, expected behavior, false positives, and findings requiring more context.
• Review rationales, reviewer identifiers, UTC timestamps, and optional evidence-record references.
• Deterministic schema-version-1 JSON reports.
• Command-line report generation with baseline, candidate, review, threshold, timestamp, stdout, and file-output options.
• Repository-local scripts/tickline-analytics.sh launcher.
• Analytics architecture, methodology, trust-boundary, report-contract, and limitation documentation.
• Python tests covering validation, statistics, baselines, outliers, reviews, reports, CLI behavior, and launcher execution.

Verification

Run from the repository root:

bash scripts/check-local.sh
bash scripts/check-unity.sh

The repository gate covers documentation validation, normal C++ tests, sanitizer tests, Python tests, Go tests and vet, developer-console version verification, and the Docker smoke build.

The Unity gate executes the EditMode suite through the WSL-compatible disposable Windows project mirror.

The Python analytics suite includes 46 tests.

Security and trust boundary

The native C++ implementation remains authoritative for evidence-chain verification, deterministic replay, investigation storage, and bundle export.

Python analytics operate only on bundles that pass strict structural and consistency validation. Analytics do not execute authoritative commands, modify evidence, repair invalid input, or replace manual investigation.

Automated outlier findings are not final determinations. Review metadata preserves the distinction between an unusual observation, an expected workload, a false positive, and a confirmed anomaly.

Limitations

• The analytics layer does not prove malicious intent or evidence authorship.
• No machine-learning model is trained or executed.
• Baselines must be selected with appropriate operational context.
• Workload and environment differences are not normalized automatically.
• Correlation and statistical distance do not establish causality.
• No production monitoring, alerting, remote analytics service, authentication, encryption, digital signatures, or key management is included.
• Collision validation and production anti-cheat deployment remain out of scope.

v0.7.0 — Unity forensic replay viewer

v0.7.0 — Unity forensic replay viewer

Tickline v0.7.0 adds a deterministic, read-only Unity Editor investigation client for evidence archives verified and exported by the native C++ layer.

Added

• Deterministic investigation-bundle JSON export from the SQLite investigation repository.
• Schema-versioned native-to-Unity compatibility contract.
• Lossless decimal-string transport for unsigned 64-bit values.
• Export-time evidence-count, chain-head, session-summary, and replay-metadata checks.
• Unity file and in-memory JSON loading.
• Stable validation findings for malformed investigation bundles.
• Schema, identity, integer, digest, ordinal, session-reference, evidence-chain, trusted-head, and replay-count validation.
• Deterministic replay timeline and nearest-tick selection.
• Play, pause, step, seek, reset, and configurable playback speed.
• Session, command, replay, archive, and evidence-chain inspection.
• Accepted and rejected outcome filtering.
• Exact client and session filtering.
• Stable mapping between filtered evidence and original timeline positions.
• Transactional loading that preserves the active investigation after a rejected replacement.
• Unity Editor forensic replay window.
• Native exporter compatibility tests.
• Unity EditMode coverage.
• WSL-compatible Unity test execution through a disposable Windows project mirror.

Verification

Run from the repository root:

bash scripts/check-local.sh
bash scripts/check-unity.sh

The local repository gate covers documentation validation, normal C++ tests, sanitizer tests, Python tests, Go tests and vet, developer-console version verification, and the Docker smoke build.

The Unity gate opens the staged project in batch mode, executes the EditMode suite, writes NUnit-compatible XML results, and fails unless Unity reports a passing test run.

Security and trust boundary

The C++ implementation remains authoritative for evidence verification, archive storage, deterministic replay, and investigation-bundle export.

The Unity viewer consumes immutable exported investigation bundles. It does not execute authoritative commands, modify evidence, repair malformed input, or replace native replay decisions.

Limitations

• The viewer runs inside the Unity Editor; no standalone viewer build is included.
• Unity verification requires an installed and licensed Windows Unity Editor.
• Hosted Unity execution is not configured in GitHub Actions.
• Investigation bundles are not digitally signed.
• The viewer does not prove evidence authorship.
• No remote investigation service is included.
• Authentication, transport encryption, key management, collision validation, and production anti-cheat deployment remain out of scope.

v0.6.0 — Investigation storage and query layer

v0.6.0 — Investigation storage and query layer

Tickline v0.6.0 adds a persistent investigation repository for verified evidence archives.

Added

• Migration-managed SQLite schema.
• Transactional verified-archive imports.
• Idempotent archive-digest protection.
• Persisted sessions, submissions, evidence records, and replay metadata.
• Lossless storage for unsigned 64-bit protocol and simulation values.
• Archive and evidence pagination.
• Identity, outcome, rejection-code, and tick-range filtering.
• Query-time evidence digest verification.
• Duplicate-import, corruption, rollback, and storage-failure tests.
• Investigation storage architecture and operational documentation.
• SQLite development dependency in the Docker verification image.

Verification

Run bash scripts/check-local.sh from the repository root.

The release gate includes documentation validation, normal C++ tests, sanitizer tests, Python tests, Go tests and vet, and the Docker smoke build.

Limitations

This release does not include a production network service, remote authentication, encryption, digital signatures, key management, a multi-tenant query API, Unity visualization, or production anti-cheat deployment.

v0.5.0 — Protocol boundary and parser hardening

v0.5.0 — Protocol boundary and parser hardening

Tickline v0.5.0 adds the binary boundary between untrusted bytes and the authoritative command pipeline.

Included

• Fixed 32-byte big-endian frame header and bounded frame size.
• Strict command-envelope decoding with stable protocol errors.
• Rejection of malformed, truncated, oversized, and trailing data.
• Incremental stream reassembly and frame-boundary handling.
• Authoritative gateway integration without pre-validation state mutation.
• Compatibility tests, regression corpus, and a Clang/libFuzzer target.

Verification

Run bash scripts/check-local.sh from the repository root.

Limitations

This release does not include a production network server, transport authentication, encryption, digital signatures, durable investigation storage, database ingestion, Unity visualization, or production anti-cheat deployment.

v0.4.0 — Authoritative command pipeline

v0.4.0 — Authoritative command pipeline

Tickline v0.4.0 introduces the authoritative boundary between typed,
untrusted command claims and deterministic simulation state.

Added

Command validation

• versioned command envelopes;
• explicit client and session identity;
• monotonic session sequences;
• bounded future-tick validation;
• velocity bounds;
• stable numeric rejection codes.

Replay protection

• duplicate-sequence detection;
• sequence-regression detection;
• independent per-session sequence state;
• commit only after authoritative world acceptance.

Authoritative submission

• deterministic command translation;
• authoritative world-level validation;
• transactional session commit;
• no session-sequence consumption on rejection;
• deterministic pending-command ordering.

Evidence integrity

• evidence for accepted and rejected submissions;
• fixed-size canonical evidence encoding;
• SHA-256-linked evidence records;
• standard SHA-256 test vectors;
• explicit separation between deterministic world fingerprints and
  cryptographic evidence digests.

Binary evidence archives

• versioned TLCA archive format;
• strict fixed-length decoding;
• truncation and trailing-data detection;
• record invariant validation;
• external trusted-head verification;
• filesystem round-trip coverage.

Forensic replay

• replay from trusted initial world and session state;
• observed-tick reconstruction;
• replay work limits;
• world, session, and queue-state comparison;
• regenerated evidence comparison;
• semantic tampering detection.

Verification

The release is verified with:

bash scripts/check-local.sh

The repository gate covers documentation, C++ builds and tests, sanitizers,
Python tests, Go tests and vet, developer-console version verification, and
Docker checks.

Limitations

This release does not include network transport, byte-level protocol parsing,
transport authentication, encryption, digital signatures, key management,
durable append-only evidence storage, database ingestion, Unity visualization,
or collision and hit validation.

The SHA-256 chain detects modification relative to an independently trusted
head. It does not authenticate the producer of the archive.

v0.2.0 - Deterministic simulation core

Introduces Tickline's deterministic C++23 reference simulation.

Included:

• explicit integer units
• fixed-step tick clock
• stable entity ordering
• authoritative world state
• scheduled velocity commands
• sequence and target-tick validation
• bounded integration
• fractional displacement preservation
• transactional world advancement
• canonical big-endian state encoding
• deterministic replay fingerprints
• boundary, replay, and sanitizer tests
• simulation contract documentation

The state fingerprint uses FNV-1a only for deterministic comparison. It is not used for evidence integrity or authentication.

Not included:

• networking
• protocol parsing
• collision or hit validation
• rollback or lag compensation
• multithreaded simulation
• cryptographic evidence hashing
• Unity visualization
• analytics

v0.1.1 - Local workflow automation and CI repair

Adds a project-local quality gate and repairs CI isolation.

Included:

• scripts/check-local.sh
• scripts/clean.sh
• justfile
• README local workflow section
• supported actions/checkout runtime
• removal of the accidentally tracked sanitized CMake cache
• build-* ignore coverage for generated CMake trees

The local quality gate runs documentation checks, CMake configure/build, CTest, sanitizer checks, Python tests, and the Docker smoke build.

No simulation, protocol parser, evidence writer, Unity viewer, or analytics implementation was added in this patch release.

v0.1.0 - Blueprint and engineering skeleton

Initial Tickline release.

Defines the project identity, safety boundary, architecture, threat model, protocol specification, evidence-integrity specification, GitHub workflow, debugging workflow, release process, security policy, C++23 CMake skeleton, Python tooling skeleton, documentation sanity check, Docker smoke build, .dockerignore hygiene, and GitHub Actions CI.

Verification:

• documentation sanity check
• CMake configure/build
• CTest
• sanitizer build
• Python unittest discovery
• Docker smoke image build
• GitHub Actions workflow

Not included yet:

• runtime simulation
• protocol parser implementation
• evidence writer
• Unity forensic viewer
• analytics engine
• cloud/Kubernetes/service-mesh infrastructure