Chronolith 3.2.2 — What An Agent Found Using It

Chronolith 3.2.2 — What An Agent Found Using It

An agent used Chronolith from end to end while shipping another project, and
filed a reproduction for every defect it hit. This release is those fixes. The
theme is uncomfortable and worth stating plainly: the tool did not enforce the
doctrine it printed.

pip install --upgrade chronolith-pro

---

The one that mattered

check exited 0 on detected drift, by default.

With stock defaults — not permissive, no --strict — the old logic printed
[!] DNA DRIFT DETECTED and then fell through to exit 0. A CI job running plain
chronolith-pro check passed on a drifting repository. That is the exact
failure a fail-closed governance tool exists to prevent, and the opposite of the
module's own Law 3.

It was nearly invisible to a human — who sees the red text and reacts — and
catastrophic to an agent, who reads the exit code and proceeds. That distinction
is the lesson of the whole release.

check now fails closed by default. CHRONOLITH_MODE=permissive is the only way
past an inconsistency, and it says so.

---

The rest, all with reproductions

• Severity is respected. Any finding was collapsed into a security failure,
  so check halted on the very sovereign keys sovereign-init creates — it told
  you to make a key, then failed you for having one. Only a tracked key in the
  index (a real leak) is a failure now; an untracked local key is a warning.

• The pre-push hook is portable. It wrote a bare python and a hardcoded
  absolute site-packages path; under git-bash on Windows python is often not on
  PATH, so the hook died with "command not found" and blocked every push. It now
  invokes sys.executable -m the module.

• The status panel cannot lie. It printed Status: Status: OK above the
  fail-closed check, announcing OK on a run about to halt. The verdict is
  computed first; the panel says OK or INCONSISTENT to match the exit code.

• .chronolithignore. A repo that vendors backup trees had them hashed as
  governed content, so an edit inside a dead copy triggered drift on the live
  project. One fnmatch glob per line, the .gitignore syntax you already know.

• --quiet on check, for clean CI and agent output. The banner and spinner
  go; the status panel and exit code stay, because those are the contract.

• init is honest on re-run. A second init created nothing and printed
  nothing, reading as a successful re-crystallization. It now says the core is
  already present and points at check --accept.

• Docs reference real commands. HOW_TO_USE_IT.md told you to run
  chronolith status --fix. There is no status command and no --fix. Doc
  drift in a drift-detection tool is the one it can least afford.

• Descriptions say what each package does — not "industrial-grade" or
  "Enterprise Oracle" or "Shannon Entropy physics" (it computes an entropy
  metric). A tool whose verify reports what it did not prove should not
  overclaim in its own summary.

Every fix ships with a regression test that reproduces the original defect,
including the exit-0 reproduction.

---

First release published through Trusted Publishing across all four packages

chronolith, chronolith-lite, chronolith-pro and chronolith-omega are
built and published by this repository's workflow. PyPI holds an attestation
naming the repo and workflow for each file — you can confirm where the wheel came
from without trusting the author, which is the claim the tool makes about
everything else.

Full detail: CHANGELOG.md