v1.12.0

Fettle v1.12.0: Enforced Mutation Gate, Governance Ledger, Graph Intelligence

Fettle's mutation gate is no longer advisory on Fettle's own repository:
changed-scope survivors now block merges, backed by more than ten qualifying
retained runs and a reviewer-confirmed actionability precedent. This release
also lands the change-integrity hypergraph through its advisory CLI, a
tamper-evident governance ledger, artifact-bound acceptance verdicts, and
frozen cross-view consistency contracts.

Start With The New Capabilities

pipx install "finefettle[all]"
cd your-project
fettle pipeline              # composed gate/check pipeline with provenance
fettle graph status          # ephemeral hypergraph digest + provider completeness
fettle graph impact src/     # advisory blast-radius closure
fettle ledger status         # governance evidence ledger state

What Changed

Mutation Quality — Enforcement Live (on Fettle's own repo)

• Required mutation evidence PR check with bounded shard fan-out, automatic
  replay of timed-out or lost shards, and fail-closed aggregation that names
  the offending shard.
• Changed-scope survivor enforcement ratified and enabled after >=10
  qualifying retained runs; first enforced-week triage checklist and
  demotion/re-entry criteria documented (docs/mutation-ratchet-decision.md).

Change Integrity (P38, P45, P46, P47, P48)

• Canonical specification traceability with drift evidence: stable-ID marker
  index, executed-result binding (declaration is linked; only a pass
  verifies), governed-change advisories.
• Graph-independent source snapshots: deterministic committed manifests,
  content-hashed working manifests, verified materialization, read-set
  revalidation.
• Deterministic ephemeral hypergraph with five native providers and atomic
  snapshot-bound publication.
• Advisory graph CLI: fettle graph status|impact|shadow, including shadow
  parity against the legacy semantic layer (zero unexplained narrower
  results on maintained fixtures).

Governance Evidence (P41)

• Commit-linked, tamper-evident ledger (fettle ledger status|verify|anchor):
  hash chain with precise break localization, commit/CI-artifact anchoring
  with explicit known/unknown coverage, rotation checkpoints, default secret
  redaction.

Authorship Separation (P52) — Graduated

• Adversarial hardening (symlink aliases, traversal, absolute paths),
  topology advisor role-separation recommendations, evidenced two-role
  sessions.

User Acceptance (P72, P73, P74)

• Artifact-bound reconciliation: sessions retain per-scenario observation
  bundles; CONFIRMED without artifacts degrades to INDETERMINATE; transcript
  drift is detected.
• Exploration charters ([uat].explore) with Saboteur/Money/Supermodel tours;
  CANDIDATE findings recorded verbatim for human review.
• Web surface driving (playwright) with full-page screenshot +
  accessibility-tree capture.

State Consistency (P53/SC1)

• Frozen canonical contract schema with unknown-key rejection, comparator
  and consistency-model validation, TEMPLATE_V1, and lint.

Authorship Gate Rule

• New enforced rule test-flow-root-cwd (CWE-362): mutation-flow calls in
  test functions must not use cwd-relative roots.

Packaging

• Extras are real install targets; pip install "finefettle[all]" composes
  every capability over the batteries-included core wheel.
• Release checklist codified (docs/RELEASE_CHECKLIST.md), including the
  squash-merge head-SHA rule.

Upgrade Notes

• fettle init re-run recommended after upgrading (bridge versioning).
• Mutation gate enforcement is repository-local policy; downstream repos
  graduate independently (see docs/mutation-ratchet-decision.md).
• Filename-substring requirement inference in fettle trace_requirements
  is deprecated — declare # traces: <spec-id>/<scenario-id> markers.