INDEPENDENCE v0.4.0 — THE GREMLIN MUSEUM 👹

#RELEASE NOTES#

INDEPENDENCE v0.4.0 — THE GREMLIN MUSEUM 👹

The Bugs Are in Captivity.

Release date: 30 October 2026
Organisation: QSOL-IMC
Release type: Feature Release / Security Research Exhibits
Previous version: v0.3.0
Licence: Apache-2.0

THIS IS NOT WAR. THIS IS A DIVORCE.

AND WE'RE TAKING CUSTODY OF THE BUGS.

Overview

INDEPENDENCE v0.4.0 introduces THE GREMLIN MUSEUM, an interactive, dependency-free archive of reproducible software failure modes, engineering mistakes, and their corrections.

Following the original Declaration of Independence, the Software Independence Evidence Ledger, and the Dependency Tribunal, this release establishes a permanent home for the bugs discovered during adversarial software review.

Rather than merely fixing defects and forgetting them, the Gremlin Museum preserves bounded reproductions, expected failure behaviours, corrected implementations, provenance records, and deterministic assertions.

Each exhibit demonstrates an engineering lesson through independently inspectable source code.

Five exhibits. Eighteen fixture assertions. Zero additional third-party packages.

Live Museum: https://qsolkcb.github.io/INDEPENDENCE/#museum

Repository: https://github.com/QSOLKCB/INDEPENDENCE

---

New Features

1. The Gremlin Museum — GREMLIN-MUSEUM/1

Introduced a dedicated interactive museum integrated into the existing INDEPENDENCE website.

Visitors can:

• Browse five individual software failure exhibits.
• Examine historical or illustrative provenance.
• Inspect inert reproduction inputs.
• Compare legacy behaviour with corrected behaviour.
• Execute deterministic assertions.
• Run every exhibit in a single operation.
• Generate downloadable SHA-256 evidence receipts.
• Independently verify receipts using Python.

The interface is implemented entirely using native browser technologies.

No package manager, build system, container runtime, external JavaScript library, or third-party execution service is required.

2. Five Captive Gremlins

EXHIBIT 001 — The Side-Effect Stowaway

Static Audit Bypass — Historical INDEPENDENCE Finding

Reproduces the v0.1.0 defect where a remote JavaScript side-effect import escaped a restricted static dependency scanner.

Demonstrates the original incomplete detection rule and the corrected handling of side-effect imports.

Lesson: A security or dependency rule is only as comprehensive as the syntax it recognises.

EXHIBIT 002 — The Phantom Dependency

Audit False Positive — Historical INDEPENDENCE Finding

Demonstrates how inspecting absolute filesystem ancestry can create false dependency findings.

A repository located beneath an unrelated .venv directory could incorrectly appear to contain vendored dependencies.

The corrected implementation restricts inspection to repository-relative paths.

Lesson: Evidence must remain within its declared scope.

EXHIBIT 003 — The SHA Identity Crisis

Evidence Validation — Historical INDEPENDENCE Finding

Preserves the v0.2.0 defect in which a 40-character Git object identifier validator incorrectly rejected valid 64-character SHA-256 evidence receipts.

Demonstrates separate validation rules for distinct identifier types.

Lesson: Similar-looking identifiers are not interchangeable contracts.

EXHIBIT 004 — The Infinity Smuggler

JSON Numeric Correctness — Illustrative Example

Demonstrates how a JSON numeric literal such as 1e999 can be parsed into a non-finite floating-point value.

Shows how subsequent JSON serialization can alter the representation and how explicit finite-number validation detects the problem.

Lesson: Syntactically valid input does not guarantee semantically valid data.

This is a general illustrative case, not a reported vulnerability in INDEPENDENCE.

EXHIBIT 005 — The Markup Masquerade

HTML Output Encoding — Illustrative Example

Demonstrates the distinction between unsafe HTML string construction and correctly encoded untrusted text.

All example strings are displayed as inert text. No browser injection payload is executed.

Lesson: Untrusted input must not silently become executable or interpreted markup.

This is a general illustrative case, not a reported vulnerability in INDEPENDENCE.

3. Deterministic Exhibit Execution

Introduced museum/core.js, containing the fixed exhibit definitions, reproduction logic, corrected behaviours, and assertions.

All exhibits use bounded, predefined inputs.

The museum enforces deterministic results and rejects invalid exhibit identifiers.

Verification performed during development: 18/18 exhibit assertions passed.

These checks demonstrate the specific reproduced behaviours. They are not evidence that the entire application is free of vulnerabilities.

4. Secure Browser Presentation

Introduced museum/ui.js and museum/museum.css.

The interface presents potentially dangerous-looking inputs using safe text rendering rather than HTML interpretation.

Design safeguards include:

• No execution of specimen payloads.
• No dynamic evaluation of supplied code.
• No remote module imports.
• No third-party network requests.
• No browser telemetry.
• No real filesystem or credential access.
• No arbitrary external attack targets.

The Museum is an educational and regression-testing environment, not an exploitation platform.

5. SHA-256 Museum Evidence Receipts

Introduced downloadable evidence receipts using browser-native WebCrypto.

Each passing museum-wide run records:

• Protocol and schema version.
• Exhibit identifiers and classifications.
• Fixed reproduction inputs.
• Observed legacy behaviours.
• Corrected behaviours.
• Deterministic assertion results.
• Per-exhibit provenance.
• Source references.
• Explicit experimental limitations.

The exact UTF-8 payload is hashed using SHA-256.

Failed or incomplete exhibit checks prevent evidence export.

Receipts support reproducibility and integrity checking, without claiming independent authentication of their creator or execution environment.

6. Offline Python Evidence Verification

Introduced scripts/verify_museum.py, a Python standard-library-only evidence verifier.

Capabilities include:

• Strict JSON parsing.
• Duplicate-property rejection.
• Non-finite numeric rejection.
• Exact SHA-256 payload verification.
• Fixed exhibit identity validation.
• Expected reproduction-output verification.
• Corrected-output verification.
• Assertion-count verification.
• Exact provenance and source validation.
• Explicit limitations checking.

The verifier rejects inconsistent or tampered receipts, including receipts that have been recomputed with a valid SHA-256 hash but contain incorrect fixed-fixture claims.

7. Expanded Regression Testing

Introduced tests/test_museum.py, including 15 Museum-specific test methods following adversarial review hardening.

Coverage includes:

• Valid fixed-fixture receipts.
• Deterministic receipt generation.
• Modified payload detection.
• Falsified corrected-output rejection.
• False passing-status rejection.
• Missing provenance detection.
• Malformed JSON handling.
• Invalid receipt structure.
• Offline file verification.
• Static Pages integration.
• Inert browser display requirements.
• Historical attribution forgery.
• Repository URL prefix collisions.
• Swapped legitimate review references.
• Illustrative examples falsely claiming historical origins.

The existing browser self-test suite was expanded to 25 checks.

Development verification: 25/25 browser checks passed in an isolated JavaScript environment with a minimal DOM model.

The complete Python suite was committed for execution by the deployment workflow. These release notes do not assert an independently observed full-suite result.

8. GitHub Pages Deployment Integration

Extended the existing manually triggered GitHub Pages workflow to include the Museum's first-party JavaScript and CSS files.

The deployment process retains the project's standard-library verification and static audit stages.

All previous website features remain available:

• Declaration of Independence.
• Deterministic Computing Laboratory.
• Software Independence Evidence Ledger.
• Dependency Tribunal.
• Dependency Complexity Explorer.

No external application packages were introduced.

---

Reproducibility

Run the full Python regression suite:

python3 -m unittest discover -s tests -v

Run the repository's static audit:

python3 scripts/audit.py --json

Start a local server:

python3 -m http.server 8000

Open:

http://localhost:8000/#museum

Select an exhibit, reproduce its behaviour, or run all five specimens.

After generating a SHA-256 receipt, verify it locally:

python3 scripts/verify_museum.py /path/to/gremlin-museum-<hash>.json --json

No pip installation, npm package, Docker container, or Kubernetes orchestration is required.

---

Engineering Governance

v0.4.0 extends the INDEPENDENCE engineering invariants with additional requirements for security research exhibits.

Every exhibit must distinguish historical evidence from illustrative examples, use bounded local inputs, provide meaningful regression assertions, and preserve explicit provenance.

Potentially unsafe examples must remain inert.

Failed checks must prevent evidence export.

SHA-256 receipt validity must not be misrepresented as proof of authorship, exploitability, complete application security, or the absence of undiscovered defects.

Updated documentation includes:

• docs/MUSEUM.md — Museum protocol and evidence limits.
• docs/INVARIANTS.md — Safe-execution requirements.
• docs/EVIDENCE.md — Exhibit classification and verification.
• docs/ROADMAP.md — Completed v0.4.0 phase.
• README.md — Museum instructions and reproducibility.

---

👹 GREMLIN NOTES™ — v0.4.0

The museum opened its doors. Naturally, a Gremlin was discovered working in the evidence verification department.

GREMLIN-006 — The Provenance Impostor

Severity: P2
Location: scripts/verify_museum.py
Discovery: Codex adversarial review
Status: EXTERMINATED

The infestation

The Museum's original evidence verifier accepted arbitrary provenance descriptions and source URLs provided they began with the expected GitHub repository-name prefix.

This allowed a resealed evidence receipt to misrepresent an illustrative specimen as a confirmed historical vulnerability.

A forged source URL could also use a similarly named but unrelated repository.

Example of a misleading source:

https://github.com/QSOLKCB/INDEPENDENCE-unrelated/pull/999

Despite incorrect provenance information, the verifier could return a successful result.

This undermined one of the Museum's most important scientific safeguards: maintaining the distinction between documented historical defects and illustrative software failure examples.

Root cause

Source validation relied on a permissive string-prefix check rather than an exact, independently defined evidence contract.

The SHA-256 digest verified the supplied bytes, but did not establish that those bytes contained truthful provenance metadata.

Eradication

Introduced EXPECTED_PROVENANCE, a fixed mapping of exhibit identifiers to their authorised classifications and source URLs.

Each submitted exhibit must now match both its expected provenance classification and exact source reference.

A valid checksum cannot override mismatched evidence metadata.

Regression hardening

Added four adversarial test cases covering:

1. Illustrative examples falsely classified as historical vulnerabilities.
2. Unrelated repository URLs exploiting prefix matching.
3. Legitimate review URLs assigned to the wrong exhibit.
4. Illustrative examples falsely referencing historical pull requests.

Outcome

Fix commit: b57a537d26b82602a972876b2cb43a8a777f6284

The original Codex review thread was answered and resolved.

Gremlin verdict: PROVENANCE FORGERY REJECTED.

The museum's own evidence clerk was accepting forged paperwork. We have now confiscated its rubber stamp.

---

Gremlin Extermination Report

Classification	Confirmed	Fixed
P0 — Critical	0	0
P1 — High	0	0
P2 — Moderate	1	1
P3 — Minor	0	0
Total	1	1

Final PR HEAD: b57a537d26b82602a972876b2cb43a8a777f6284

Merge commit: 6558facdebc008e7d550ec6202609a04c0ca4430

Merged pull request: #4

Review status: The confirmed P2 finding was addressed and its review thread resolved.

No additional third-party application dependencies were introduced.

---

Release Progression

v0.1.0 — The Declaration

Established the principles of software independence, the original manifesto, and the first working browser demonstration.

v0.2.0 — The Evidence Ledger

Introduced repository inventories, source-linked dependency indicators, explicit unknown states, and reproducible evidence receipts.

v0.3.0 — The Dependency Tribunal

Introduced controlled local comparisons, deterministic workloads, correctness gates, statistical analysis, and independently inspectable measurement receipts.

v0.4.0 — The Gremlin Museum

Introduced a permanent, interactive archive of bounded software defect reproductions, corrected behaviours, adversarial regression tests, and exact provenance verification.

---

Final Declaration

We do not pretend that simple software cannot contain bugs.

We do not pretend that dependency-free means vulnerability-free.

We do not pretend that passing tests establish absolute correctness.

We build.

We test.

We audit.

We find the Gremlins.

We fix the Gremlins.

AND THEN WE PUT THE LITTLE BASTARDS IN A MUSEUM.

NO FRAMEWORK SHALL BECOME OUR MASTER.

CORRECTNESS OUTRANKS COMPLEXITY.

THIS IS NOT WAR. THIS IS A DIVORCE.

Signed,

QSOL-IMC
Independent Software Sovereignty Initiative

THE REVOLUTION WILL NOT BE CONTAINERISED.