VeriRun v0.3.0 — Isolated Execution

VeriRun v0.3.0 — Isolated Execution

v0.3.0 delivers M2's explicit execution tiers and its strongest published evidence:
an attack/replay matrix on one recorded local Linux Kubernetes environment using
kind and gVisor RuntimeClass(handler: runsc).

Included

• A digest-pinned Docker development-container tier with no network, read-only
  filesystem, non-root execution, removed Linux capabilities, resource limits, and
  bounded cleanup.
• A restricted Kubernetes Job tier with explicit context, namespace and RuntimeClass;
  default-deny-egress preflight; bounded logs; zero retry backoff; and mandatory Job
  cleanup.
• container-smoke and kubernetes-smoke CLI workflows for controlled baseline and
  replay exercises.
• Automated regressions and a local Kubernetes/gVisor attack matrix covering timeout,
  output flood, memory pressure, denied egress, root filesystem write, privilege
  escalation, invalid source, and artifact tampering.

Evidence

The release assets include the final clean-revision Kubernetes/gVisor report and its
full artifact bundle. The checked-in runtime report
documents the same matrix, environment identity, and replay semantics. The release
CI run validates formatting, typing, schema export, unit tests, build, and trusted
smoke workflows.

Supported boundary

The Kubernetes/gVisor claim is limited to the recorded local, single-node kind
environment with RuntimeClass(handler: runsc), a restricted namespace, and an
enforced default-deny-egress policy. The development-container tier is for local
development and regression work only.

Known limitations

• This is not a production-security certification or an absolute containment claim.
• Other Kubernetes distributions, CNI implementations, container runtimes, default
  Docker/Colima profiles, and cluster configurations have not been declared
  compatible by this release.
• Kernel, gVisor, container image, Kubernetes control-plane, and operator-managed
  network-policy vulnerabilities remain outside the verifier's trust boundary.
• A portable per-Pod PID limit is unavailable in the Kubernetes contract, so live
  fork-bomb validation is intentionally excluded.
• Durable result idempotency across failures belongs to v0.4/M3's control plane.

Upgrade notes

The public Python package version changes from 0.2.0 to 0.3.0. Existing local
and gateway workflows are retained. To use Kubernetes execution, provide all
explicit runtime inputs described in the isolation contract;
VeriRun does not provision cluster security boundaries on an operator's behalf.

VeriRun v0.2.0 — Async Model Gateway

VeriRun v0.2.0 — Async Model Gateway

v0.2.0 delivers the M1 bounded async candidate-generation gateway.

Included

• OpenAI-compatible asynchronous HTTP client with one reusable connection pool per gateway lifetime.
• Independent local controls for concurrency, QPS, and anticipated in-flight output tokens.
• Bounded worker/queue batch submission, layered HTTP timeouts, cancellation cleanup, fail-fast, and partial-failure behavior.
• Classified 429, 5xx, timeout, transport, malformed-response, and client errors with capped full-jitter retry and retained retry root-cause history.
• Public gateway schemas, contract documentation, ADR, credential-free fake-server smoke, and checked-in evidence.

Evidence

The gateway smoke report is bound to implementation revision d6021141fd6bdff6c6366fa7a0b593f612146354. It records 429/5xx retries, slow response, disconnect, malformed JSON, bounded concurrency, and a local sequential/eager-task/bounded-worker comparison.

Validation: GitHub Actions quality passed on PR #17; local release checks passed ruff, strict mypy, 48 pytest cases at 89.57% coverage, schema verification, pip check, and sdist/wheel build.

Limitations

• This release is local-process admission policy, not distributed rate limiting or durable idempotency.
• The local fake-server comparison is directional; it is not a provider-compatibility, model-quality, CPU-parallelism, or production-scale performance claim.
• v0.2 does not run untrusted code and does not make a sandbox-security claim.

VeriRun v0.1.0 — Protocol Baseline

VeriRun v0.1.0 — Protocol Baseline

The first VeriRun release establishes an evidence-first protocol baseline for reproducible executable evaluation. It supports trusted fixtures only; it is not a sandbox for model-generated or otherwise untrusted code.

Included

• Immutable manifests, candidates, attempts, verification results, and replay records.
• Canonical JSON, content hashing, exported JSON Schemas, and content-addressed artifacts.
• Structured verification outcomes and deterministic replay comparison.
• verify, replay, smoke, and optional evalplus-smoke command-line workflows.
• EvalPlus v0.3.1 HumanEval+ compatibility adapter and labeled subset evidence.

Release evidence

• Synthetic protocol and replay report
• EvalPlus HumanEval+ compatibility report
• GitHub CI and Linux EvalPlus smoke both passed.

The release gate includes 39 passing tests, 88.60% branch coverage against an 85% threshold, strict type checking, schema drift checks, and a clean sdist/wheel build.

Supported environment

• Python 3.12
• EvalPlus v0.3.1 is optional and pinned by the published lockfile.
• macOS evidence uses the documented EvalPlus Darwin memory-limit workaround only for deterministic trusted smoke; it is not a resource-isolation claim.

Deliberately not included

• Real model endpoints or provider orchestration.
• A security boundary for untrusted code.
• PostgreSQL, Ray, Kubernetes, KubeRay, gVisor, or object storage.
• A benchmark score or full HumanEval+/MBPP+ result claim.

Release assets

Asset	SHA-256
verirun-0.1.0.tar.gz	593b6d6b8b0049dcf246736caf6b6bc98597973c76f292c3ba6448209487816a
verirun-0.1.0-py3-none-any.whl	06eb2e73ad9b9596d10177fac2efd326a9dcb989f4bdbca618c62276e8e41030