Highlights
reproduce(beta): re-run a recorded invocation + byte-compare vs the receipt → REPRODUCED / DIVERGED / TAMPERED / INCONCLUSIVE. Verify by re-execution, not trust (sound for network-off runs).- Hardened receipts: Ed25519 / in-toto / DSSE → real pubkey-only public verification.
dokan verify+pubkeyoffline. /outputrun-artifacts (content-addressed, folded into the receipt).- True exactly-once: partial UNIQUE index + atomic insert-or-return.
list_runs: verdict-vs-error outcome,script_idfilter,all_green.- Plus
dokan updateself-updater, GAP-2/4 security, clippy CI gate.
Beta framing on the wedge — runtime deterministic; output reproduces iff your code is.