v0.51.12 — Verification Must Never Rewrite Reality

v0.51.12 — Verification Must Never Rewrite Reality

PR #1916 and RFC #1917 closed the hidden-checklist convergence loop: the worker could no longer see the answer key, and rejected results could continue through evaluation and bounded evolution. This release closes the remaining verification boundary.

Machine verification is now monotonic. It may add evidence. It may reject a genuinely failed check. It may never erase a worker failure, manufacture a success, or retry completed work merely because the verifier itself is unavailable.

What's Changed

Monotonic verification

• Separate worker execution facts from machine-verification facts.
• Preserve successful completed work when Bash, command startup, timeout handling, or transcript verification is unavailable; report the result explicitly as unverified instead of rewriting it as failure.
• Keep genuine verify_command failures authoritative when rejecting otherwise successful work.
• Add VerifierStatus.UNAVAILABLE without retry or redispatch authority.

Monotonic evidence

• Keep files_touched, commands_run, and tests_passed obligations even when a verify_command exists.
• Prevent a passing verifier command from recovering a failed worker execution.
• Preserve the Seed authoring warning and explicit verify_exemption_reason for criteria without a machine command.

Trusted verification boundary

• Execute verification only through a resolved, absolute, real Bash implementation across POSIX and Windows Git Bash environments.
• Never substitute cmd.exe, WSL launchers, sh, or shell emulation.
• Strip environment controls capable of bending a verdict, including Bash startup hooks, exported functions, preload hooks, and pytest, Python, and Node controls.
• Contain timed-out and cancelled verifier process trees.

Deliberate simplification

• Remove the shell-free Bash interpreter, constant-verdict proof machinery, workspace baseline probes, verdict tiers, and durable prototype policy.
• Leave sandboxed discrimination research outside the critical ooo run path rather than pretending an unsandboxed verifier can prove more than it observed.

Why this release matters

A convergence loop is trustworthy only if its judge cannot rewrite the work it judges. #1916 and #1917 gave the loop secrecy, independent judgment, and recurrence. #2187 gives that judgment its final invariant: verification can strengthen the record, but never reverse history.

This is the closing movement of that loop-engineering line: not a larger loop, but a harder boundary around truth.

Full Changelog: v0.51.11...v0.51.12

What's Changed

• feat(verify): make AC verification monotonic by @Q00 in #2187

Full Changelog: v0.51.11...v0.51.12