v0.3.31

Operator-authorized resolution of all 9 issues in the "Semantic Audit
Follow-ups (Rounds 1-6)" milestone, acting with full authorization to
make the judgment calls each issue was filed needing.

• (#68) REQ-001 hardcoded-identifier violations: genericized every real, accidental violation -- renamed the sandbox-sbom-reporting/* schema-namespace prefix to projectbuddy/* across 17 real producer/consumer file pairs (verified every pair still matches post-rename with a dedicated script); renamed the /SandboxSBOMReporting/SshHostEd25519Fingerprint guest-property path to /ProjectBuddy/... (4 files, plus the guestproperty enumerate --patterns call that searched for the old pattern); renamed /var/lib/sandbox-sbom-reporting to /var/lib/projectbuddy and the matching ~/.local/state/... path; genericized Register-WslRunnerKeepAlive.ps1's default shortcut name, unattended-template.xml's 4 <Description> fields, pipeline-config.schema.json's 2 self-referential field descriptions, and removed Run-WindowsSbom.ps1/Run-LinuxSbom.ps1's false "VIT Super Network Streams is the default" claim. Formally scoped REQ-001's wording to exclude the 2 already-disclosed, intentional, narrow-purpose consumer-vendored exceptions (Build-LvlibpCandidate.ps1, provision-ubuntu-vm.yml's package-build template) instead of treating them as bugs. Marked REQ-001 "Verified (manual)" in the wiki, no longer "NOT met."
• (#69) batch-provision.sh hostname collision: added optional guestHostname/guestFullName fields to runner-inventory.json (schema bumped to @4), wired through to each VM's create-vm dispatch; when omitted, derives a unique, deterministic fallback (an 11-character hash-based hostname, well under Windows's 15-character NetBIOS limit). Live-verified via a real 2-VM dry-run batch (one explicit, one derived, both distinct, full dispatch chain completing for both).
• (#70) 3 sub-findings, all resolved: (1) aligned both containerized SBOM pipelines' ALLOW_PACKAGE_DRIFT default from lenient ("1") to strict ("0"), matching the native pipeline's already-documented fail-closed-by-default behavior -- a real default-behavior change for any consumer relying on the old lenient container default without explicitly setting the variable; (2) wired ci-assurance.yml's new toolchain-smoke-test job to call this repo's own reusable toolchain-smoke-test.yml against itself (uses: ./.github/workflows/toolchain-smoke-test.yml, projectbuddy-ref: ${{ github.sha }}), making REQ-008's "validated via real CI dispatch" claim genuinely true in this repo; (3) authored real Pester fixture tests for Test-SbomArtifact.ps1 (scripts/tests/Test-SbomArtifact.Tests.ps1, 6 tests covering all 3 documented failure classes plus success and a self-contradiction guard), wired into a new pester-tests CI job.
• (#76) Install-VerifiedNugetPackage.ps1 falsely removed: restored the script (confirmed generic/reusable -- a SHA-512-verify-then-extract utility, nothing signing-specific) with a corrected header comment explaining the real history. Added 4 real Pester tests (success, hash-mismatch refusal, missing-archive, already-exists-destination), all passing; also manually verified end-to-end with a real .nupkg. Did not re-wire it into the Dockerfile (the signing toolchain it originally supported stays correctly removed). Courtesy fix in SandboxSBOMReporting itself: updated its stale pin-warning comment (private repo, PR #310, merged).
• (#77) remaining formal-completeness + smaller REQ gaps: added a lightweight Document Control block (Status/Last-update/Owner) to 6 docs lacking one, plus a real Notation + Glossary section to the wiki SRS -- deliberately scoped out a full ISO 29119-3 test-plan rewrite of CONTRIBUTING.md/ci-assurance.yml (risk register, staffing, schedule) as disproportionate for this repo's current maturity. Fixed Enable-RepoIssueTracking.ps1 (REQ-004: gh label create --force, real failures now surfaced, not silently swallowed -- live-verified against the real repo) and New-HumanEscalation.ps1 (REQ-005: verifies the marker is actually present in the returned issue body client-side, not trusting GitHub's search index alone; a search failure now warns instead of silently falling through -- live-verified: real create + real update-in-place on the same issue, confirmed via gh issue view, test issue closed after). Reworded REQ-003/REQ-021/REQ-024 to accurately scope their actual guarantees instead of overclaiming.
• (#80) more Architecture Packet gaps + practice-vs-document gaps: added 7 missing components (Run-WindowsSbom.ps1, Run-LinuxSbom.ps1, Test-Environment.ps1, Test-RunnerAdministrator.ps1, winrm-service-bootstrap-installer.nsi disclosed as an unwired research prototype, Install-VerifiedNugetPackage.ps1) plus 2 new containers (Release automation, Agent orientation) to the Component/Container Views. Fixed the Context View's stale feature/*-only claim and SHA-pinning overclaim. Decision: adopt wiki release-tagging going forward -- added a new Release Flow step tagging the wiki repo at the same vX.Y.Z as each main-repo release (this release is the first, v0.3.31). Reworded Release Flow Step 2 to disclose that CHANGELOG.md is typically already on develop before the release branch is cut. Corrected the wiki's own "branch-then-push, reviewed" claim (cm-plan.md, the wiki's Home page, the SRS) -- real git history shows zero branches were ever used; disclosed honestly instead of left overclaiming.
• (#52/#63) REQ-018/REQ-019 merge + configuration-schema.md dangling refs: merged REQ-019 into REQ-018 (its own Fit Criterion read "Same evidence as REQ-018," failing ISO/IEC/IEEE 29148 §5.2.5's "Necessary" characteristic) -- REQ-019's ID formally retired, every cross-reference updated (REQ-032, the RTM, the Architecture Packet). Repointed configuration-schema.md's 3 dangling references instead of authoring a new doc: Run-Pipeline.ps1's pipeline-config error now cites pipeline-config.schema.json (the real, validated schema); its VIPM_TOML_CONFIGS errors now describe the expected shape inline; add-project.yml's error summary now links to Add-Project.ps1 itself.
• (#62) triaged, not closed: the critical all-phases-blocking bug was already resolved in round 3/4 (restored script, confirmed intentional package-build exception). Explicitly scoped the remaining work (live-dispatch-proving the other 9 phases, which requires a real multi-hour VM-provisioning cycle including a human-interactive LabVIEW activation step) as out of scope for this documentation-focused round -- a good candidate for a dedicated future VM-provisioning session.
• All 6 validation/syntax checks (JSON/YAML/XML/Python/bash/PowerShell) pass across every changed file; the full Pester suite (10 tests) and pytest suite (17 tests) pass; the local release-gate assurance scan shows all 5 required gates still PASS (High confidence, 99-100%), matching the established baseline.