v0.14.3

v0.14.3 - 2026-08-25

This patch release removes the two remaining v0.14.1 customer blockers in
large Bazel monorepos: the broad-pattern enumeration gate now honors the
resolved candidate budget, and external-repository labels no longer abort
source-coverage queries. Raising the enumeration ceiling requires both
--bazel-candidate-budget and --bazel-dynamic-attempt-budget. The pinned
Chuck/Bazel release tripwire now reproduces both failing customer shapes so
release evidence proves the enforced limits, not the requested ones. (v0.14.2
was tagged but never published: its release run was killed by the CI step
timeout corrected here, so no v0.14.2 artifacts exist.)

Fixed

• Honor the resolved candidate budget on the broad-pattern Bazel enumeration
  gate: when source-rdeps narrowing declines with a per-pattern limit error
  and the observed cardinality fits the admitted budget, admit the complete
  enumeration instead of failing closed at the 16-label default. Selection
  limit errors now report the enforced limit, and canonical selector receipts
  gain an additive effective_package_enumeration_limit field so receipts
  reflect the limit that was actually applied. (00e261c3)
• Skip external-repository labels (@repo//... and canonical
  @@repo+version//...) during Bazel source-coverage validation instead of
  failing the whole query as malformed; hermetic-toolchain labels surfaced by
  dependency-walking queries no longer abort selection, while shell-hostile
  labels still fail closed. (00e261c3)
• Reshape the pinned Chuck/Bazel release tripwire to reproduce the failing
  customer shapes: an overflow package whose source-rdeps rescue declines, an
  external toolchain label reached through data, and receipt assertions on
  the enforced enumeration limit with a negative assertion that no
  per-pattern limit error occurs. (850b06d5)
• Record per-target Bazel query provenance without aliasing the run-wide
  aggregate attempt trail: every target in a package serialized every
  per-label coverage attempt, producing O(targets x attempts) duplicate
  records (55 MB receipts on a 302-target package, scaling toward GB on
  customer monorepos). Per-target provenance now carries the enumeration
  attempts plus that target's own coverage attempt; the union across targets
  preserves every distinct attempt. Measured on the live tripwire fixture:
  55 MB -> 2.2 MB (~96%), with every distinct query attempt retained.
  (7acb1555)

Internal

• Recalibrate the lv2 Chuck/Bazel tripwire bounds to the reshaped fixture's
  measured cold runtime, then reduce the fixture to mechanism scale. The
  reshaped 302-label fixture measured ~4,312 s cold (dominated by sequential
  dynamic verification proofs), making a 3-success gate cost 2.5-5.5 h. Its
  302-label package is the control the source-rdeps hatch narrows, and its
  magnitude was never what it proved, so it is now 41 labels - still
  decisively above the pinned 16. The packages carrying the customer
  mechanisms are unchanged: the 18-label package whose hatch declines, and
  the external-repository toolchain package. Measured cold runtime is now
  1,198 s with every enforced-behavior assertion intact, and the contract
  digest is re-pinned. (ed6bb526)
• Order the release tripwire's runtime bounds against the CI step budget that
  actually binds them. The gate's runtime is mirrored in five places, and the
  outermost - the GitHub Actions timeout-minutes on the tripwire step - was
  never reconciled with the others: the per-attempt bound (55 min) exceeded
  the whole step budget (50 min), so a single hung attempt could outlive the
  step that runs it and die without emitting a verdict. On GitHub's runner the
  gate measures ~25.5 min per attempt (1.7x the local host), so a 3-success
  gate needs ~77 min. Bounds are now ordered inner to outer: per-command
  timeout 1500 s, per-attempt max_runtime_ms 2,400,000 (40 min), step
  timeout 130 min. The per-attempt bound now fires before the step ceiling, so
  a genuine hang produces a receipt instead of an unexplained step kill.