StateProof v1.0.0

No CHANGELOG.md section for 1.0.0; using the tag message.
StateProof v1.0.0 — first public release

The verification engine, the benchmark, the frozen evaluation and the product
are unchanged from the final competition submission. This release adds the
flagship README, contributing guide, security policy, issue and PR templates,
CI, CodeQL, Dependabot, a release workflow, screenshots, a walkthrough GIF, an
architecture diagram, a changelog and a roadmap.

Submission v1 (2026-08-28)

Historical tag, released retroactively. The first complete submission: the locked evaluation had been run exactly once, and a clean-checkout reproduction had passed.

• The one-time locked evaluation: four held-out cases run once after the freeze, under a protocol that refuses a second attempt and records every attempt in an append-only ledger.
• pnpm reproduce: credential-free replay of all twelve Hard cases from the committed contract bundle, 27 checks.
• pnpm test:clean-reproduction: a fresh clone with no .env, no node_modules and both credential variables removed.
• submission/: the final evaluation, claims-to-evidence map, run registry, package manifest and reproduction manifest, generated from pinned artifacts.

See CHANGELOG.md and IMPROVEMENT_CHANGELOG.md.

Final submission (2026-08-29)

Historical tag, released retroactively. The final competition submission.

• apps/product: the interactive application around the frozen engine. A landing page whose worked example is generated by the verifier on request, a credential-free demo of PBH-B03, a run inspector with clickable evidence references, an import screen that validates and then verifies a run package, a benchmark view, and JSON/Markdown evidence export.
• A single-container deployment (Dockerfile, railway.json) serving the product and the evidence dashboard on one origin with no credential.
• samples/stateproof-sample-run.zip, a gold-isolated sample run package.
• API cost estimates against a dated, sourced price list.
• Two product defects found and fixed while building it, both now guarded by tests: inline style attributes silently dropped by the product's own CSP, and a whole-trajectory schema violation escaping as an HTTP 500.

No measured result changed in this release: nothing that produces a metric was touched. See CHANGELOG.md.

Evaluation freeze v1 (2026-08-28)

Historical tag, released retroactively. This is the source freeze taken before the one-time locked evaluation. Prompts, benchmark fixtures, the evaluator, the verifier and the lockfile were frozen at this commit and have not changed since.

What was frozen:

• PhantomBench-12 (Core) and PhantomBench-Hard-12, each with an 8/4 development/locked split, deterministic schema and semantic validation, and a gold-isolation package boundary.
• The frontier baseline evaluator prompt (prompts/baseline-evaluator/v2.md).
• Contract Agent v1, v2 and v3, the assertion DSL (2.1.0), the semantic contract lint, task-fingerprint caching and fail-closed warm verification.
• The deterministic verifier, requirement-level metrics, and the static evidence dashboard.

The locked baseline and locked StateProof runs both name this commit as their expected freeze. See submission/final-evaluation-ledger.jsonl and CHANGELOG.md.