v0.6.0 — Commit-reveal verification enforced on-chain + Holochain 0.6.2

First release since v0.5.4 (2026-05-24) — 194 commits across the protocol, the attestation library, the demo stack, and testing infrastructure.

Versioning note: v0.5.5–v0.5.7 were used as internal milestone labels in project docs but never tagged; GitHub releases jump from v0.5.4 directly to v0.6.0. The minor bump reflects protocol-level changes below (including a DNA hash change).

Core protocol (valichord/)

• Commit-reveal hash verification enforced on-chain for real nonces. submit_attestation's verification bypass is narrowed from "credential issuer empty" to "issuer empty AND nonce empty", mirroring reveal_researcher_result. A validator's revealed verdict is now checked against their sealed commitment even on dev-mode networks whenever a real nonce is used — a tampered reveal is rejected with a hash mismatch. Proven by two new security sweettests: S7 (genuine seal → nonce → reveal flow passes verification) and S8 (verdict altered between sealing and reveal is rejected). Empty-nonce test flows are unaffected.
• StudyClaim immutability. Integrity-zome guards now block updates and deletes on StudyClaim — claims are vacated via StudyClaimRelease, as the architecture doc always stated. ⚠️ This is an integrity change: the attestation DNA hash has changed (dev-only impact; existing dev conductors must reinstall the hApp).
• DeliberateAbstention entry type (validator_workspace) — a validator can cryptographically record a reasoned recusal as a first-class, immutable private entry, distinct from simply never showing up. With duplicate-guard, link index, and 3 sweettests.
• Reveal-phase quorum gate counts distinct validators (was raw reading count).
• Holochain 0.6.2 — hdk 0.6.2, hdi 0.7.2, holochain/holo_hash/keystore 0.6.2 across all zomes; hApp repacked; CI binaries bumped.

Attestation library (valichord_attestation)

• LmEvalAdapter — converts lm-evaluation-harness results_*.json (+ optional samples_*.json) into canonical attestation bundles. Covers the de-facto industry standard for LLM benchmarking. 51 tests.
• AiluminateAdapter — converts MLCommons AILuminate (modelbench) safety-benchmark reports, committing model responses and grader-ensemble verdicts together as Merkle leaves — blind independent verification for LLM-as-judge grading. 42 tests.
• prml_lock_hash field — links a bundle to a Falsify/PRML pre-registration lock, plus canonicalization edge-case tests.
• Library now at 537 tests, 97% line coverage, five adapters total (InspectAI, InspectEvals, PiSession, LmEval, AILuminate).

Interoperability

• OETP bridge — embed a ValiChord HarmonyRecord into an Open Ethics Transparency Protocol disclosure (IETF Internet-Draft JSON standard); --emit-oetp flag on the demo runner. 28 tests.
• EveryEvalEver worked example — offline bundle generator for the EEE convergence path.

Demo & operations

• Security sweep: visitor API keys scrubbed from job state on completion + 1 h TTL eviction; agent-env cache keyed by key hash and size-capped; opt-in node-API write authentication (NODE_API_KEY, timing-safe); memory caps on node-side maps; constant-time API-key comparison in the backend; CI action pinned to SHA.
• Honest reveal-verification copy on the demo website — the site now states precisely what the demo network enforces versus what production networks enforce.
• CMA performance: one shared agent environment per run, session timeout, and tool-call cap.
• Claim-vocabulary headline for custom-claim results; node URLs default to localhost.

Project & governance

• CONTRIBUTING.md (contributor guide + lightweight CLA), NOTICE, and TRADEMARK.md — open-core IP structure established.
• EU AI Act Article 12 compliance plan — ValiChord as evaluation-layer evidence infrastructure.

Testing & infrastructure

• Wind-Tunnel: runner bumped to 0.7.0; two new propagation scenarios (dht_sync_lag, Kitsune substrate prototype); first live multi-conductor run — median cross-DHT sync lag ≈ 185 ms; CI smoke job.
• Badge sweettest hardening: gold, silver, and bronze badge tests now use a re-sync + re-query retry loop against the documented badge-index gossip-lag flake; full CI matrix green (97 Tryorama + 5 sweettest suites).
• Dev conductor lifetime tied to dev.sh (setpriv --pdeathsig); @holochain/client floor at 0.20.5.

Full changelog: v0.5.4...v0.6.0

---

Addendum (2026-07-06, same day): UI e2e suite + form-blocking bug fix

• Playwright e2e suite for the browser UI (valichord-ui/tests/e2e/) — one real throwaway conductor per run, no mocks: connection bootstrap, validator profile via the UI form, request submission via the researcher form, pending-request rendering, zome-seeded data, governance view. Runs locally via npm run test:e2e (~1.3 min) and in CI as a new independent ui-e2e job (~2 min, traces uploaded on failure). Pattern ported from happenings-community/requests-and-offers.
• Fixed: the researcher form's Submit button silently did nothing. Svelte parses {64} inside a quoted attribute as a template expression, so pattern="[0-9a-f]{64}" rendered as pattern="[0-9a-f]64" — native form validation rejected every real 64-character hash with no visible error. Caught by the e2e suite on its first run.
• README refreshed: repo links updated to the ValiChord org, current Your Hypothesis demo described, test counts corrected (183 across three suites), Holochain 0.6.2 quickstart, five attestation adapters.

---

Addendum (2026-07-08, post-tag — commits 7e8b2e6 + a2593d0 on main): local-read rule + first live coordinator hot-swap

• Self-authored lookups now read locally (attestation coordinator). release_claim, get_my_claimed_studies, and the duplicate-commitment guard in notify_commitment_sealed use GetStrategy::Local for reads whose results are entirely the calling agent's own writes — the source chain is complete by construction, so a network walk adds nothing except a hang risk on a fresh or cold cell. Everything that can include other agents' writes (reveal-quorum counts, reclaimer-written releases, protocol guards) still reads from the network. This is a reliability fix, not a speed-up: typical demo-run time is unchanged; what's eliminated is a class of cold-node stalls and timeouts, plus snappier claimed-studies views in the browser UI. Pattern borrowed from flowsta-signing-dna v1.4. Verified by the four sweettests covering the changed functions plus the full CI matrix.
• First live coordinator hot-swap. Because the change touches no integrity zome, it was rolled onto all four live Oracle demo nodes via AdminRequest::UpdateCoordinators — zero downtime, DNA hashes unchanged, no container restarts, every published HarmonyRecord URL preserved. The rollout tooling ships as demo/hotswap-coordinators.mjs (local rehearsal mode + per-container runbook in the header), establishing a minutes-not-hours upgrade path for future coordinator-level fixes to the live network.