v0.1.2-alpha: A Promised Target, Kept

Tracefold v0.1.2-alpha

Repairs and additions landed since v0.1.1-alpha, cut at commit 1cfdfa0001c8c31a9d0f4a2648354369794d00d3 (pub_sync round 6, from the private development tree's committed HEAD -- nothing staged from a dirty working copy).

What changed since v0.1.1-alpha

• A plan() now actually promises a post-state digest, on both shipped stateful adapters. gx-adapter-fs and gx-adapter-git's plan() call the with_promised_target constructor path for the first time in a shipped release (previously always None) -- WM-5a Phase 1.
• A cold-undo / cold-redo data-loss-shaped defect was found and fixed while wiring the above. A second site in gx-engine that constructs a Transformation (rehydrate_committed, used after an engine restart) was zeroing the promised target instead of carrying it, which meant every undo or redo issued after a cold restart silently lost the promised-target check the hot path already had. Both demo30.sh and demo_one_screen.sh (the fs and git tamper-and-undo demos) now pass end-to-end against this build; they did not before this lane.
• PredictionOutcome: the engine used to record only a failed post-state prediction (as the seventh not-attempted cause added in v0.1.1-alpha) and stay silent when a prediction held. That made "the engine predicted correctly" and "the engine never checked" look identical from outside. The comparison is now recorded either way, at one site, for both branches. This is an internal engine record -- nothing on the wire changed, and no shipped client needs to do anything differently.
• Escrowed-inverse resolution now falls through to a Σ-shadow fallback when the direct escrow lookup misses, per the R1017 ruling, instead of surfacing an avoidable failure.
• GET /v1/transformations/{id} carries inverse_status. A subsequent investigation (prompted by a TUI-side report of a spurious error state) confirmed the wire contract was correct from the start: the API was already sending null correctly for the no-inverse-yet case. The bug was on the reading side, in the terminal face, which is fixed separately in the tui/ sources this sync also carries -- a status_reason classifier now reads a null as Absent (--) instead of misreporting it. Nothing in this repository's gx-api/gx-engine needed to change for that fix.
• Four Cedar policy packs, previously private, now ship: policies/{fs,git,mcp,postgres}/deny-*.cedar, each with its own scenarios.json fixture beside it (PACK_FORMAT.md F1).
• docs/ADAPTER_GUIDE.md is new: how to write a SubstrateAdapter against the shipped fs/git/mcp adapters and the conformance harness, without reaching into engine internals.
• A new example, examples/openclaw-plugin-demo/: a before_tool_call-hook plugin against a real gx binary, demonstrating the escrow/undo membrane pattern for OpenClaw-shaped agent harnesses. It drives a real filesystem and a real gx process; it does not drive OpenClaw itself (the firing order is reproduced by a harness in the same example, and the README says so). One honest note about this example specifically: an earlier working copy of it defaulted an environment variable (GX_DEMO_BIN) to the machine-local absolute path of the machine that wrote it. That default was removed before this sync (the variable is now required, with a clear error if unset) -- named here because it is exactly the kind of thing a "diff, don't trust" sync gate exists to catch, and did.
• Crate versions bumped 0.1.0 -> 0.1.2 across all 13 crates this tree ships plus tui (gx-tui), workspace-consistently, including every internal path-dependency version pin. gx --version now prints gx 0.1.2 (previous tags shipped a binary that printed gx 0.1.0 regardless of the tag name; this one does not have that mismatch). Not bumped: the TypeScript SDK's package.json (still 0.1.0) -- that drift is disclosed here rather than fixed silently, since fixing it was not part of what this bump covered.

What is still not true of this release (read before assuming otherwise)

• crates.io publishing is still blocked, for two independent, unresolved reasons found while checking: (1) gx-core, gx-tui, and bare gx are already registered on crates.io by an unrelated third party (a different Rust tool, galax, that happens to use the same short name) -- every crate in this workspace path-depends on gx-core, so the name collision blocks the whole dependency closure, not just one crate; a rename (candidate: tracefold-*) is pending an operator decision, not yet applied to any shipped file. (2) gx-gate's packs.rs reaches three directories above its own crate root via include_str! for policy files that, per cargo package --list, do not end up in the packaged tarball -- publishing gx-gate (and its dependents gx-engine, gx-api, gx-cli) as-is from a cargo publish tarball would build broken. Every crate in this tree still carries publish = false.
• CI has still run zero jobs on any push, unchanged since the GitHub Actions billing block that started 2026-08-15T17:25:29Z (req/908) -- not a code defect. See docs/LIMITS.md item 8 for the full, dated account; the last run before the block (commit f65aac2f) covered 16 of this tree's 17 workspace crates.
• The postgres and mysql SubstrateAdapters are not in this public tree at all (private-only, per the sync's own scope ruling), so anything they, or a PostgreSQL-17-specific suite, would test is not just unmeasured here -- the code that would run it is not present in a clone of this repository. docs/LIMITS.md's own postgres disclosures ("not measured for power cuts", four releases running as of that doc) describe the private engineering state, not something buildable from this tree.
• The published Test Floor number (2,602 probes / 454 suites + SDK 36) is dated 25 Aug 2026 and was not re-measured for this release. Four new test files landed in this sync (wm5a_promised_target.rs x2, r1017_escrowed_inverse_shadow.rs, wm5a_prediction_on_real_data.rs); the badge and README table do not yet reflect them. Re-counting is a docs-sync change, named here rather than silently left implying a number this release did not check.
• No pre-built binary is attached to this release at publish time (unlike v0.1.0-alpha and v0.1.1-alpha, which each got one added by hand after the tag). gx --version on a self-built binary from this tag prints gx 0.1.2, confirmed on a fresh worktree of the exact tagged commit before this tag was cut; a binary asset may follow the same way the prior two tags' did.
• Everything else this project does not guarantee is unchanged and still enumerated in docs/LIMITS.md -- the same 8 clauses gx limits prints.

Getting the source

git clone https://github.com/TraceFold/tracefold.git
cd tracefold
cargo build --release -p gx-cli

No binary asset ships with this tag; building from source is the only path for now.