v0.14.4

[v0.14.4] - 2026-08-26

This patch release unblocks Bazel fail-to-pass proof on repositories with a
warm or shared Bazel cache. v0.14.3 cleared the two reported selection
blockers, but running the customer-shaped journey end to end surfaced a third,
independent defect: the broad-command parent proof abstained on every Bazel
repository whose cache was not cold, because Bazel console attestation refused
the stream that a cached run produces. Any operator passing
--bazel-cache-root, or simply running a second build, hit it.

Fixed

• Accept (cached) rows in Bazel console attestation. A cached row is an
  explicit per-target result Bazel attests for that action key, but the result
  regex matched only //label PASSED in Ns, so every cached row fell through
  to the unsupported-status branch and refused the whole stream. On a warm
  cache this refused the base and gold receipts for the unnarrowed command,
  and the declared-broad parent proof abstained with "base trial lacks exact
  command-bound output".
• Enforce Bazel closed-world coverage against the selected count rather than
  the executed count. Bazel reports Executed 3 out of 60 tests when 57
  targets hit the cache; requiring executed == selected made the parent
  proof structurally impossible under caching. Coverage is now proven by one
  unique explicit result row per selected target, so a stream carrying fewer
  rows than selected targets is still refused.
• Match Bazel's plural footer grammar. The footer pattern accepted only
  passes/fails, but Bazel conjugates with the count and writes
  57 tests pass and 3 fail locally for multi-test runs. Every footer above
  one test failed to parse, independent of caching.
• Read durable receipt copies when binding raw command-bound output. The raw
  fallback in the declared-broad admission path consulted only the receipt
  path the trial reported, which lives under a verifier scratch root that is
  already released by the time the binding runs, so the fallback could never
  rescue a stream no parser recognizes. It now consults the task-local copies
  under build_logs/worktree_verifier/ as well, still bound to the exact
  command.
• Restore targeted Bazel narrowing for repositories that configure a selector
  runner. A prior change upgraded command_intent to declared_broad for any
  explicitly loaded config carrying a test_selector block with no explicit
  intent, which made the broad command an immutable parent and disabled
  targeted fail-to-pass selection entirely: the customer-shaped Bazel journey
  abstained and ran bazel test //.... Only a route whose fallback is
  keep_broad now declares the broad parent; skip_task and every other
  fallback keep narrowing authority. The live tripwire again proves
  narrowed_proven_dynamic_f2p with exact labels.

Internal

• Move the Bazel cached result case from the attestation refusal table into
  accept coverage, and add regression tests for a partially cached run, a
  fully cached run, and raw binding after scratch release.

v0.14.3

v0.14.3 - 2026-08-25

This patch release removes the two remaining v0.14.1 customer blockers in
large Bazel monorepos: the broad-pattern enumeration gate now honors the
resolved candidate budget, and external-repository labels no longer abort
source-coverage queries. Raising the enumeration ceiling requires both
--bazel-candidate-budget and --bazel-dynamic-attempt-budget. The pinned
Chuck/Bazel release tripwire now reproduces both failing customer shapes so
release evidence proves the enforced limits, not the requested ones. (v0.14.2
was tagged but never published: its release run was killed by the CI step
timeout corrected here, so no v0.14.2 artifacts exist.)

Fixed

• Honor the resolved candidate budget on the broad-pattern Bazel enumeration
  gate: when source-rdeps narrowing declines with a per-pattern limit error
  and the observed cardinality fits the admitted budget, admit the complete
  enumeration instead of failing closed at the 16-label default. Selection
  limit errors now report the enforced limit, and canonical selector receipts
  gain an additive effective_package_enumeration_limit field so receipts
  reflect the limit that was actually applied. (00e261c3)
• Skip external-repository labels (@repo//... and canonical
  @@repo+version//...) during Bazel source-coverage validation instead of
  failing the whole query as malformed; hermetic-toolchain labels surfaced by
  dependency-walking queries no longer abort selection, while shell-hostile
  labels still fail closed. (00e261c3)
• Reshape the pinned Chuck/Bazel release tripwire to reproduce the failing
  customer shapes: an overflow package whose source-rdeps rescue declines, an
  external toolchain label reached through data, and receipt assertions on
  the enforced enumeration limit with a negative assertion that no
  per-pattern limit error occurs. (850b06d5)
• Record per-target Bazel query provenance without aliasing the run-wide
  aggregate attempt trail: every target in a package serialized every
  per-label coverage attempt, producing O(targets x attempts) duplicate
  records (55 MB receipts on a 302-target package, scaling toward GB on
  customer monorepos). Per-target provenance now carries the enumeration
  attempts plus that target's own coverage attempt; the union across targets
  preserves every distinct attempt. Measured on the live tripwire fixture:
  55 MB -> 2.2 MB (~96%), with every distinct query attempt retained.
  (7acb1555)

Internal

• Recalibrate the lv2 Chuck/Bazel tripwire bounds to the reshaped fixture's
  measured cold runtime, then reduce the fixture to mechanism scale. The
  reshaped 302-label fixture measured ~4,312 s cold (dominated by sequential
  dynamic verification proofs), making a 3-success gate cost 2.5-5.5 h. Its
  302-label package is the control the source-rdeps hatch narrows, and its
  magnitude was never what it proved, so it is now 41 labels - still
  decisively above the pinned 16. The packages carrying the customer
  mechanisms are unchanged: the 18-label package whose hatch declines, and
  the external-repository toolchain package. Measured cold runtime is now
  1,198 s with every enforced-behavior assertion intact, and the contract
  digest is re-pinned. (ed6bb526)
• Order the release tripwire's runtime bounds against the CI step budget that
  actually binds them. The gate's runtime is mirrored in five places, and the
  outermost - the GitHub Actions timeout-minutes on the tripwire step - was
  never reconciled with the others: the per-attempt bound (55 min) exceeded
  the whole step budget (50 min), so a single hung attempt could outlive the
  step that runs it and die without emitting a verdict. On GitHub's runner the
  gate measures ~25.5 min per attempt (1.7x the local host), so a 3-success
  gate needs ~77 min. Bounds are now ordered inner to outer: per-command
  timeout 1500 s, per-attempt max_runtime_ms 2,400,000 (40 min), step
  timeout 130 min. The per-attempt bound now fires before the step ceiling, so
  a genuine hang produces a receipt instead of an unexplained step kill.

v0.14.1

v0.14.1 - 2026-08-19

This patch release unblocks Bazel task selection in large, multi-platform
monorepos and closes the validation gap that allowed lower-level selector tests
to pass without proving the public build path.

Fixed

• Wire --bazel-candidate-budget and --bazel-dynamic-attempt-budget through
  pre-materialization selection, retain complete overflow-aware candidate sets
  instead of enforcing the legacy 16-label gate, and keep first-N sampling
  forbidden with explicit no-sampling authority in canonical selector receipts.
  (398f22c1, 4cbef53c)
• Treat exhausted dependency-query retries as task-local selector
  infrastructure failures, so an unhealthy canary is rejected without ending
  healthy sibling or fanout work; shared authentication, toolchain, resource,
  and timeout failures remain run-blocking. (398f22c1)
• Execute explicit manual fixed-manifest keep_broad fallback through real
  base/gold verification, while automatic and omitted fallback policies remain
  fail-closed with durable selector rejection receipts. (398f22c1)
• Strengthen the Chuck/Bazel release guard with closed-world scenario and
  receipt validation, mutation coverage, and CI ownership triggers so release
  evidence must prove the public high-cardinality selector boundary.
  (398f22c1)
• Persist an explicit empty termination error for successful live-scenario
  verification results, so the release guard can distinguish verified success
  from an omitted execution state and fail closed on incomplete receipts.
  (2c9b08e0)

v0.14.0

v0.14.0 - 2026-08-10

This release makes onboarding recovery and Dataset Factory decisions
evidence-bound, expands Bazel selection safely for large packages, and hardens
grader execution and CLI recovery. A candidate-bound Chuck/Bazel tripwire now
blocks publication unless three pinned customer-shaped runs satisfy the release
identity, evidence, and resource checks.

Added

• Add a sealed onboarding recovery policy and ledger: bind the target floor,
  recovery pool, cleanup receipt, retryability, and producer action to exact
  operation, candidate, and attempt identities; persist decisions and return
  typed next actions for resume, retry, replacement, or human intervention.
  (206fc2e7, 4c43c2bb, ec727a76, 599d371e)
• Add no-spend stet suite factory universe source admission. Validate
  candidate-blind source manifests and keep invalid states as typed
  needs_action without discovery, qualification, provider calls, tests, or
  evaluation. (52becc8a)
• Add source- and ledger-bound Dataset Factory readiness and materialization
  planning. Keep prospective facts no-spend and return typed new-request
  actions without claiming qualification, selection, provider execution,
  tests, or corpus authority. (de35bbf9)
• Add stet suite factory universe seal to persist a source-bound
  prospective-universe membership ledger; shortfalls remain typed
  needs_action and do not authorize selection, qualification, provider calls,
  tests, or evaluation. (a174d420)
• Add --provider-cost-cap-usd to grader regrade admission. Require a
  provider-issued, non-overridable all-in reservation and per-call/total cost
  observability; unavailable authority blocks before any provider invocation.
  (b24c79d2)
• Add a native Codex v2.alpha_rewardkit judge path with macOS Seatbelt
  admission, isolated HOME and runtime state, read-only/no-delegation policy,
  strict structured-output and usage validation, and raw-free fixed failure
  receipts. (303e63d6)
• Add bounded full-set Bazel candidate and dynamic-attempt budgets
  (--bazel-candidate-budget / build.bazel_candidate_budget and
  --bazel-dynamic-attempt-budget / build.bazel_dynamic_attempt_budget),
  each capped at 4096 and rejecting overflow instead of sampling or truncating
  the first N labels. (0bf88c1c, b26ee13e)
• Add Docker-free local worktree controls to stet eval run and persist
  source-bound agent-test replay worktrees for durable recovery.
  (0c783f5d, 1bbb0fe8)
• Require a clean-candidate Chuck/Bazel release tripwire in CI and release
  workflows: run the pinned journey three times, bind source/scenario/candidate
  identity, and block publication on missing dynamic proof, manual rescue,
  unresolved release-blocking incidents, or resource-bound evidence.
  (84e6e5e4, 3eeb8e9f)

Changed

• Make Bazel overflow recovery source-scoped: after every changed test source
  is exactly query-proven, scoped keep-going rdeps may retain only safe,
  in-pattern actual test labels. A typed transient ExternalDepsException /
  exit 37 receives one same-identity retry; partial query evidence stays
  non-authoritative, and dynamic base-fail/gold-pass remains the only F2P/READY
  authority. (0bf88c1c)
• Keep onboarding readiness tied to the requested launch floor; under-floor
  receipts now recommend expansion instead of presenting partial setup as
  ready. (b8133bf6)
• Bind RewardKit contract synthesis, provider usage, and per-task grader
  applicability to task and contract identity; distinguish missing from
  not-applicable grading and retain typed unavailable outcomes instead of
  fabricating scores. (303e63d6)
• Verify manifest ai_task attestation against the retained enrichment
  response (llm-diagnostics/<task_id>/enrichment.raw.txt): recorded digests
  must match the file and the re-parsed <ai-task> body must equal the
  manifest ai_task. A manifest separated from its llm-diagnostics/
  directory is no longer certifiable; --allow-unattested-ai-task remains a
  recorded degradation. (c36e64b9)
• Keep repository context read-only, expose lifecycle readiness in baseline
  status, and preserve machine-readable context and strict-manifest errors.
  (48c5c3f0, cd42ed99, 35ad4de7, 0637a8b8)
• Preserve retained failed compare-arm evidence and make mixed-vintage combine,
  multi-arm repair revalidation, retest repair, and P2P adequacy honor
  authoritative proof state. (a20f6686, ed39bb2c, ae85df95,
  ee9d77c3, b3dd0591)

Fixed

• Separate release readiness from post-release customer acceptance in the live
  guard. Three clean candidate-bound journey receipts can authorize publication,
  while customer-only incidents, arbitrary-repository assertions, and external
  acceptance remain fail-closed under the customer profile. (3eeb8e9f)
• Preserve the one same-identity retry for a transient Bazel
  ExternalDepsException even when Bazel also prints its generic internal-crash
  banner, while continuing to fail closed on authentication, Java/toolchain,
  sysctl, timeout, and negated-marker diagnostics. (01a0e731)
• Classify Bazel internal-query, sysctl, and ProcessHandle crashes as typed
  toolchain infrastructure failures instead of semantic F2P failures.
  (dbef7740)
• Admit deletion only for UUID-scoped Bazel
  command-<UUID>.profile.gz files under verifier output bases; other cache
  mutations and deletions remain blocked. (9d1eacc8)
• Distinguish logically removed scratch roots awaiting physical reclamation
  from failed or retained cleanup in verifier warnings. (308727b0)
• Disable Git-LFS filters at every git invocation against the disposable
  worktree object store — agent patch capture, worktree file overlay commits,
  and the verifier status snapshot — so a global gitconfig declaring a required
  LFS filter with no reachable endpoint no longer loses agent patches with exit
  128 or degrades verifier parser evidence.
  (db14130c)
• Skip Bazel config-variant pseudo-labels (.asan/.dbg/.tsan siblings
  returned by the gold test query) after the primary label proves, recording a
  redundant_variant_coverage receipt instead of burning one gold trial each;
  record a gold-trial Bazel exit 4 ("no test targets were found") on a
  query-derived candidate as a benign no_test_targets skip instead of a
  failed trial. Explicit test commands and the no-proof failure path are
  unchanged. (cd3cf6dc)
• Let --retry-rejected recover an interrupted manifest root missing
  build-summary.json when prior task or rejection evidence exists, while
  still refusing empty or mistyped output roots; recovery makes no completed-
  root claim. Persist direct-build failure summaries and bounded aggregate
  rejection evidence, and classify selector/executor infrastructure failures
  as "task not judged" rather than F2P verdicts. (43bada49, f0915f61,
  cf082ba0)
• Reject manifest-mode --limit and --skip, fail closed on runstore source or
  request drift, and propagate cancellation through eval rules plan replay
  preflight. (38bffbab, bf2dd472, 1cc54a1d)
• Accept the canonical Bazel <version> label for exact Bazel/Bazelisk runtime
  probes while rejecting mismatched or free-form labels. (eaba5c61)
• Classify oracle test.patch conflicts separately from behavioral failures and
  bound adapted-reference AI work to a 10-minute call with one timeout retry.
  ([a6787a7d])
• Harden Windows live-scenario executable resolution and native-runtime
  boundaries for hosted toolcache paths. ([8095c3fb], [2b0fb253])

v0.13.0

v0.13.0 - 2026-08-05

This release makes onboarding and builds work on real customer repositories:
forked Bazel toolchains, LFS-tracked paths, network-restricted hosts, and
fixed-HOME credential helpers are now handled in trusted phases, manifest
ai_task instructions require attested provenance, and subprocess, cache, and
Harbor execution layers are hardened against parallel-load races and hung
cleanup.

Added

• --credential-home-file <src>[=<relative-dest>] (and the
  build.credential_home_file / runner.worktree.credential_home_file config
  keys) materialize operator-approved credential files into the replaced HOME
  of trusted phases, for tooling that reads fixed HOME paths such as a Bazel
  remote-cache credential helper. File bytes are snapshotted at authorization,
  written 0700/0600 behind a symlink-refusing join, redacted from Stet-owned
  diagnostics, and bound into the run fingerprint; destinations that collide
  with Stet-owned agent directories (.claude, .codex, .config/cursor)
  are rejected. (30506f8e)

Changed

• Manifest-carried ai_task instructions now require a generation receipt
  (ai_task_provenance, or a clean llm_diagnostics.enrichment reference for
  older manifests). Unattested tasks are skipped as
  unattested_ai_task_not_allowed; --allow-unattested-ai-task admits them as
  a recorded degradation (prompt_regime: unattested-provenance, not
  certified READY). (342d0ac0)
• Enrichment now emits the manifest ai_task as a single outcome-focused
  instruction instead of a multi-part template. (5c53988a)

Fixed

• Runtime probes whose output is recognized but unparsable — for example a
  fork-suffixed Build label: 9.1.1-glyd1 from a patched Bazel — no longer
  abstain with a missing observed-environment fingerprint: the fingerprint
  falls back to hashing the raw normalized probe output, and every
  empty-fingerprint branch now records an explicit unavailable reason in
  parser evidence and the gate message. Genuinely ambiguous output (two or
  more distinct version records) still fails closed. (30506f8e)
• Materialized Python tasks now probe python3 --version instead of
  python --version, matching hosts that ship no bare python. (30506f8e)
• Git-LFS smudge is disabled in the disposable object store used for worktree
  materialization and when the verifier resets held-out test targets to base,
  so repos with LFS-tracked paths build and validate without a reachable LFS
  remote even when a global gitconfig declares a required LFS filter.
  (30506f8e, 4f387368)
• Successful --source-mode reference base/head builds now write
  build-summary.json; previously the build exited 1 after materializing the
  task ("read build summary: … no such file or directory"), which failed CI
  wrappers and left eval tooling treating the dataset as incomplete.
  (4f387368)
• Share the worktree Bazel selector's Bazelisk and repository download caches
  across environment-group cohorts under --bazel-cache-root (both are
  content-addressed, so cross-cohort reuse is byte-safe). Changing the test
  command no longer starts a cohort with a cold repository cache, which on
  network-restricted hosts failed the selector as abstained_query_failed.
  Repository caches under existing
  .stet-bazel-verifier-cache-v1/cohorts/<fingerprint>/trusted/ directories
  are no longer read, so the new .stet-bazel-verifier-cache-v1/shared/
  directory starts cold: on a network-restricted host, warm it once with
  network access or copy an existing cohort's trusted/repository contents
  into .stet-bazel-verifier-cache-v1/shared/repository before the first
  post-upgrade run. Stet never deletes an operator-owned
  cache root, so reclaim the old per-cohort directories manually if disk
  space matters. (f0caded9)
• Serialize the worktree Bazel selector's binary-readiness cache and retry
  preflights that failed for non-cacheable reasons, so concurrent cohorts no
  longer inherit a neighbor's transient failure. (dd8cd346)
• Cancel subprocess process groups SIGTERM-first with a bounded force-kill
  fallback so buffered agent output is flushed before termination, and bound
  Harbor agent execution, Docker cleanup, and Claude command timeouts
  explicitly. (fafd5496, e928166f, 904a4a58)
• Tolerate never-materialized output roots during completion registration
  instead of failing with a raw lstat error. (ded8db24)
• Honor declared test-command overrides for opaque commands and bind the
  worktree selector to its final harness authority in stet suite build.
  (1d33be65, 5c684fdf, b3fbf154)
• Make onboarding completion replay idempotent and route target selection
  through a deterministic authority. (9222d23b, 60a0e6c2)
• Void candidate test verdicts when the gold baseline itself fails, instead
  of scoring against a broken baseline. (6b1cb716)

Internal

• Harden R7 head-to-head decision and report authority to fail closed on
  stale, contradictory, or asymmetric evidence, and centralize decision
  projection (STET-743, plus related eval-report correctness fixes).
  (d609fffc, eb2e5da3)
• Migrate durable build evidence to a single revisioned writer core with
  secured provenance and path reads (STET-729). (96b5be9c, cf28669a)
• Add deterministic live-scenario validation lanes that prove worktree,
  Docker, Harbor, and Windows execution boundaries before release
  (STET-732–STET-767). (c919a690, 207089c5)

v0.12.2

v0.12.2 - 2026-08-03

Fixed

• Let trusted .stet/stet.yaml configuration forward explicitly named
  environment and file-backed credentials into worktree coding-agent and
  candidate-verifier execution. Stet keeps a replacement HOME, withholds
  unlisted ambient variables, exposes disposable file snapshots, redacts exact
  credential material from owned output, and refuses credential-bearing
  candidate patches. (e8f0e686)
• Prevent automatic update checks from replacing a newer running Stet binary
  with an older cached or published release, and reject malformed release
  versions rather than guessing their precedence. (861f453f, 04b47f31)

v0.12.1

v0.12.1 - 2026-08-03

Fixed

• Let operators explicitly forward names-only GitHub and AWS file-backed
  credential inputs from trusted .stet/stet.yaml configuration or CLI flags
  into selector and base/gold worktree phases. This prevents private dependency
  wrappers from falling into interactive login under Stet's replaced HOME,
  while candidate execution remains credential-free and durable output redacts
  credential values, paths, and file contents. ([274421f0])

v0.12.1-rc.1

v0.12.1-rc.1 - 2026-08-03

Fixed

• Let operators explicitly forward names-only GitHub and AWS file-backed
  credential inputs from trusted .stet/stet.yaml configuration or CLI flags
  into selector and base/gold worktree phases. This prevents private dependency
  wrappers from falling into interactive login under Stet's replaced HOME,
  while candidate execution remains credential-free and durable output redacts
  credential values, paths, and file contents. (274421f0)

v0.12.0

v0.12.0 - 2026-08-01

This release makes the agent-first build and onboarding loop more trustworthy on
unfamiliar repositories: Stet records the exact scoring and execution authority
it observed, keeps retries bound to that authority, and preserves clear
infrastructure outcomes instead of inferring success. Onboarding now uses the
requested ready-task floor by default; representative selection is available
only as an explicit temporary opt-in while it is validated on real repositories.

Added

• Attest the observed named scoring targets that prove fail-to-pass behavior and
  project only complete, supported evidence into the scoring surface. (545f2251)
• Add an evidence-only blind cheat challenger as a third fail-to-pass proof leg
  in stet suite build, so a cheap solution to the selected tests is recorded
  without changing the build's proof strength. (70b4ce18)
• Deduplicate exact-match authority executions while retaining canonical
  receipts, and resume completed authority plans without rerunning proof.
  (4a2a94f2, 80812435)

Changed

• Keep stet suite onboard --target-ready N at its requested ready-task floor
  by default. Set STET_ONBOARD_REPRESENTATIVE_V1=1 before a fresh onboarding
  to validate a bounded 2N reservoir and select a static-diversity panel.
  (ad426e73, b23d5b2b)
• Give candidate agents a consistent fair-internet-use policy: documentation and
  general references are allowed, while upstream solutions and reference patches
  remain blocked. (eebd6911)

Fixed

• Retry one gold verification only when the first attempt failed before any test
  executed while acquiring dependencies. Both attempt receipts are retained
  across direct, batched, Harbor, and worktree validation; network activity
  during repository tests remains a normal test failure. (f033b557)
• Let CMake/CTest plans ignore non-test support paths in a test patch while
  still requiring exactly one declared test source to select a target.
  (9636aed6)
• Bind validation replay, authority receipts, and R3 artifacts to their exact
  certified content identity; ambiguous or incomplete authority fails closed.
  (1f3b9a2e, 4208c894, c79a79dc)
• Preserve selected head-to-head validation evidence across revalidation and
  distinguish absent smoke failure kinds rather than silently borrowing or
  misclassifying them. (23df59ab, 27f5e406)
• Isolate Codex evaluator runtime state under the owning output root and forward
  the selected AI command through onboarding, avoiding shared runtime leakage.
  (dcf4e35e, 46435f1d)
• Recognize CMake CTest, PHPUnit, and Swift test plans while keeping incomplete
  source history and verifier runtime blockers explicit and fail-closed.
  (fee2e89d, 13f4fe88, 7c43c491, e5584e3e, 06d79c3c)
• Publish Harbor companion agents as version 0.9.1, matching the version the
  Stet Harbor invocation pins at runtime. (b23d5b2b)

v0.12.0-rc.2

v0.12.0-rc.2 - 2026-07-31

Fixed

• Retry one gold verification only when the first attempt failed before any test
  executed while acquiring dependencies. Both attempt receipts are retained
  across direct, batched, Harbor, and worktree validation; network activity
  during repository tests remains a normal test failure. (f033b557)
• Let CMake/CTest plans ignore non-test support paths in a test patch while
  still requiring exactly one declared test source to select a target.
  (9636aed6)