ScopeProof v0.2.7 — downloadable evaluation release

ScopeProof v0.2.7 is a downloadable evaluation release. It is an evidence assistant, not a correctness oracle, production certification or completed beta. Stage 3 remains dormant. No personal testing or qualifying reviews were used or are requested.

What changed since v0.2.6

• CSV and HTML reports of an explicitly selected historical analysis use its recorded criteria revision, including unknown, rather than defaulting to revision 1 (#273). Pending current-state report denial and analysis-only boundaries remain intact.
• Saved-history validation groups already validated decision events once per revision, preserving audit order, final-acceptance/revocation rules and every schema, gate, evidence and temporal check (#277). This removes repeated whole-event scans; it is not a latency, memory or maximum-history guarantee.
• Native public-v0.2.6 records have permanent preservation checks, the continuation browser observer has a scoped test repair, and the evaluation guide includes a no-install constructed report. These are engineering/distribution improvements, not genuine-use evidence or new correctness-verification capabilities.

Exact final source and assets

Final source/tag target: e099679ed63309716a7ce4726557ef794bfd5c80.
Package version: 0.2.7. Ruleset: 2.0.0. Saved-record format: 9.
Installed reader core fingerprint: eb3b723c9b3ba0bba69e005c935a7f1a8b6075633f09ef38576fe2ad93f31a37. The fingerprint covers core Python only, not the whole package, policy, platform or execution provenance.

Asset	Bytes	SHA-256
scopeproof-0.2.7-py3-none-any.whl	449386	7f64e61e6b46f97de9ef4ed314db372f6239dced7b387d8354736cbe6f1f8d56
scopeproof-0.2.7.tar.gz	7829279	df408c97d3973c7888d730e5457a634f1a04d6f957fabbdf9c36ae132776ccb9
SHA256SUMS.txt	190	dc4bf28e1f43a43d20cd9e2d23c4c137bbfa7abe89b4683200e5788dbc8aaaea

These are freshly rebuilt final-version assets, not renamed 0.2.7.dev0 private archives. The direct wheel and wheel rebuilt from this source archive are byte-identical. Verify checksums against SHA256SUMS.txt; hashes bind bytes and do not provide code-signing or product-correctness assurance.

Automated engineering verification

• Exact-head PR checks and independent engineering agent review cleared reviewed source 77ae80e192336931a4f76256ca8f21654c64637a before merge.
• Resulting-main CI passed 4,888 tests, 38 intentional skips and the unrounded 95% coverage floor (reported 95.5192%), with seven installed CLI and 34 browser-suite checks. Required Python 3.11/3.13, Windows and locked-environment lanes passed; CodeQL/base-advance evidence is recorded separately.
• These exact final archives passed fresh local wheel/source installations on macOS arm64/Python 3.11.15; the wheel also passed on Python 3.13.14. Runtime/runner dependencies use the source lock. File/import/version/dependency checks and the existing 12-case/13-criterion and two-case comparison benchmarks passed. This does not establish every dependency combination or a fresh Windows install of these local archive bytes.
• The exact final wheel passed seven installed CLI checks, eight fresh browser cases across seven journey families, and 34 native-preservation/report/event checks. Both ordinary and controlled-status-loss continuation cases are explicitly identified. Health checks for wheel/source workbenches passed and were stopped.
• Copies of existing actual-public-v0.2.6 active/pending records preserve complete state, producer identities, audit history and original bytes across read, copy-only resave, transfer and reopen. Pending current reports remain denied. The existing large PR #277 constructed input retains its full state and bounded helper work; no new timing campaign was performed.

Public download verification: completed 2026-11-09T05:04:51.538274+00:00.

Boundaries and use

Public-only intake and the evaluation-only use policy remain in force; this is not an open-source or commercial-use grant. Local setup, asserted reviewer identities, static candidate-retrieval limitations and platform-dependent filesystem behavior remain. Back up saved reviews before switching versions; do not assume downgrade compatibility.

All fixture actors, decisions, CI metadata and recorded runtime assertions used in these checks are constructed automation. ScopeProof did not execute untrusted target-repository code. Static implementation/test candidates are not runtime proof; normalized criteria still require explicit confirmation and final acceptance remains an explicit reviewer decision.

Frozen R-002 inputs/results and the native released-writer corpus are unchanged; no historical rescore, retune, customer validation, independent usefulness/reuse evidence or accessibility conformance is claimed. The public v0.2.6 report example retains its actual original producer; it was not regenerated or relabelled as v0.2.7. The separately deployed website remains at its authorized 388b7da snapshot; this package release does not deploy Pages.

Use the evaluation guide for optional evaluation and version distinctions. Public v0.2.6 remains the verified fallback if this release's final assets or completed public verification are unavailable.

Completed public-download checks

Anonymous requests with curl configuration disabled reached the public release page/API and downloaded all three assets. Sizes, official asset digests, the checksum manifest and complete bytes matched the independently reviewed final build. The annotated tag peeled to the exact final source.

Fresh isolated installations from both public wheel and source archive passed imported-version/path/core checks, dependency and hash-locked-runtime checks, the 12-case/13-criterion and two-case comparison benchmarks, and copied native v0.2.6 active/pending preservation and historical-label probes. Original producer/history and pending current-report denial were retained. These are automated engineering checks on macOS/Python 3.11; no public-byte Windows install, human testing, qualifying review, customer validation or Stage 3 advancement is claimed.