OpenCodifier v0.6.2

OpenCodifier v0.6.2

Released 2026-11-01 from commit 74bf714cfa28 (full sha
74bf714cfa28a1c63151dc843ef11dec61b3c82d, previous tag v0.6.2).

Highlights

• Verified prebuilt installer: scripts/install-prebuilt.sh + contract tests (PR #11, e6a3624) — SHA/size/attestation/clean-source verification, atomic replace, no Rust at install time (CHANGELOG 0.6.2 "Added").
• CLI hardening: bounded image reads, lane-overwrite refusal, assert removal (f27e997); rustfmt parity with CI (69c6869).
• E2E recipe captures re-recorded against the fresh engine (rotation readout + CP early exit lineage, 33ff9c5/4d9e755) after cache-key drift (f724f94, 6764c00).
• Coverage: engine/cli test lifts keeping the in-image floor above 97.5 (3457818, 0840631; CI triage runbook 6471ad7).

Quality-gate receipts

just ci green at the release commit is the gate of record; the same gates
run line-for-line in the GitForge pipeline (.gitforge.yml, the platform of
record — a red GitHub Actions mirror is not a code-failure signal). Every
gate below needs its own receipt: a run id, or the local command output.
Receipts below cite the GitForge pipeline run of record.

Gate	Command	Status	Receipt
Format	cargo fmt --all -- --check	PASS	GitForge pipeline run 2d3fa273 (2026-11-01, commit 74bf714) - all 6 lanes succeeded; platform of record
Lint	cargo clippy --workspace --all-targets -- -D warnings	PASS	GitForge pipeline run 2d3fa273 (2026-11-01, commit 74bf714) - all 6 lanes succeeded; platform of record
Tests	cargo test --workspace	PASS	GitForge pipeline run 2d3fa273 (2026-11-01, commit 74bf714) - all 6 lanes succeeded; platform of record
Docs	RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps + cargo test --doc	PASS	GitForge pipeline run 2d3fa273 (2026-11-01, commit 74bf714) - all 6 lanes succeeded; platform of record
Deps	cargo deny check	PASS	GitForge pipeline run 2d3fa273 (2026-11-01, commit 74bf714) - all 6 lanes succeeded; platform of record
Advisories	cargo audit	PASS	GitForge pipeline run 2d3fa273 (2026-11-01, commit 74bf714) - all 6 lanes succeeded; platform of record
Pattern scan	aegis --format json scan --file . --baseline .aegis/baseline.json (0 new)	PASS	GitForge pipeline run 2d3fa273 (2026-11-01, commit 74bf714) - all 6 lanes succeeded; platform of record
Coverage floor	cargo llvm-cov --workspace --lcov + scripts/coverage_floor.py … --floor 98.5	PASS	GitForge pipeline run 2d3fa273 (2026-11-01, commit 74bf714) - all 6 lanes succeeded; platform of record
End-to-end	just e2e (serve + MCP over the real wire)	PASS	GitForge pipeline run 2d3fa273 (2026-11-01, commit 74bf714) - all 6 lanes succeeded; platform of record

Artifacts

Built by just release-matrix (D24). Each row is backed by an attestation
beside the artifact; just release-verify re-checks every digest against the
bytes on disk.

Target	Artifact	Bytes	SHA-256	Linkage	Attestation
aarch64-apple-darwin	opencodifier	6415904	6aa400f2182886961a4adeb9677f63066052effa49eef968a3694dfec1be23eb	unknown linkage	target/aarch64-apple-darwin/release/opencodifier.attestation.json
aarch64-apple-ios	libopencodifier_ffi.a	32473120	47368b8682f44e924d4336dba019a7cbc4a5eb2490e6a4e3ecd8205c81f02cf5	unknown linkage	target/aarch64-apple-ios/release/libopencodifier_ffi.a.attestation.json
aarch64-linux-android	opencodifier	7028432	d1b16525c7cc245ffaf4a2882b0fc6f3da3a13cf986fc72e74e6373e52a807bb	dynamic (interpreter /system/bin/linker64)	target/aarch64-linux-android/release/opencodifier.attestation.json
aarch64-unknown-linux-gnu	opencodifier	5072152	ee2280669bcd60725a9f5c19e0ce688b016fcb9fe614b940a494759e05d55803	dynamic (interpreter /lib/ld-linux-aarch64.so.1)	target/aarch64-unknown-linux-gnu/release/opencodifier.attestation.json
wasm32-unknown-unknown	opencodifier-0.6.2-wasm32-unknown-unknown.tar.gz	638700	bcec2860b84abd89238b5a325d2ea9b6e3ea9cd3562e57a181975ec16f1fad63	unknown linkage	dist/v0.6.2-wasm32-unknown-unknown/opencodifier-0.6.2-wasm32-unknown-unknown.tar.gz.attestation.json
x86_64-apple-darwin	opencodifier	6950296	e42b73b7d4e4160026f7adff5dfb8c6af94807e3d4e3f46dbdf84fe7247692b2	unknown linkage	target/x86_64-apple-darwin/release/opencodifier.attestation.json
x86_64-pc-windows-gnu	opencodifier.exe	5666304	f09e210008f1997d7ef1734ee969bbd67c9dc236803480087495ed2a7748d1cd	unknown linkage	target/x86_64-pc-windows-gnu/release/opencodifier.exe.attestation.json
x86_64-unknown-linux-gnu	opencodifier	7349640	8a8ebae7aacf8e4231219cc04c83845b0d0c84b48a41b45ddd36bc8782b771ca	dynamic (interpreter /lib64/ld-linux-x86-64.so.2)	target/x86_64-unknown-linux-gnu/release/opencodifier.attestation.json
x86_64-unknown-linux-musl	opencodifier	7423744	f56e78529f9d66f6db220c2f3ed6181b94b1c65a9bb9f677a525854134ee840b	static	target/x86_64-unknown-linux-musl/release/opencodifier.attestation.json

Verification level, per artifact

The matrix states what was proven, never "supported": D24 sets the named
level each target can carry, and an artifact only claims the level it earned.
Mark one per row.

Target	Level earned	Why
x86_64-unknown-linux-gnu	run-tested + e2e	executed on this host; just e2e green (pipeline run 2d3fa273 e2e lane)
x86_64-unknown-linux-musl	static-link check + run-tested + e2e	statically linked; fresh consumer-container E2E 30/30 without Rust/Cargo (prebuilt plan Phase 3)
aarch64-unknown-linux-gnu	link + file-magic	linked clean; ELF aarch64 interpreter /lib/ld-linux-aarch64.so.1 verified
x86_64-pc-windows-gnu	link + file-magic	linked clean; PE32+ magic verified; never executed here (no Windows host)
x86_64-apple-darwin	link + file-magic	linked clean; Mach-O x86_64 magic verified; never executed here (no macOS host)
aarch64-apple-darwin	link + file-magic	linked clean; Mach-O arm64 magic verified; never executed here
aarch64-linux-android	link + file-magic	linked clean; ELF aarch64 interpreter /system/bin/linker64 verified; never executed here
aarch64-apple-ios	archive + object-magic	static library; ar archive with arm64 Mach-O first member (D24 honest artifact; no Apple SDK)
wasm32-unknown-unknown	bundle + load-test	dual-glue bundle loaded through web + nodejs initializers in Node

Known gaps to state on the release page rather than paper over: no foreign
arch is executed here (no qemu, no arm hardware), so aarch64 artifacts are
link + file-magic only; registry publication (crates.io, Homebrew, winget)
is an outward action taken only on an explicit user go.

Reproduction

From a clean checkout at 74bf714cfa28a1c63151dc843ef11dec61b3c82d, on a host with the matrix toolchains
(just release-preflight reports what is missing, naming each tool):

just release-preflight                 # toolchain readiness per target
just release-matrix                    # build + stage + attest every target
just release-verify                    # re-hash every artifact vs its attestation
just release-notes                     # this file, from the attestations
just release-set-verify                # exact tag, clean source, complete matrix, checksums
just ci                                # the gate of record, before tagging
just e2e                               # the run-tested claim, on the host target

Single-target build and its exact recorded command:

# aarch64-apple-darwin
cargo zigbuild --release --locked --target aarch64-apple-darwin -p opencodifier-cli
# aarch64-apple-ios
cargo build --release --locked --target aarch64-apple-ios -p opencodifier-ffi
# aarch64-linux-android
cargo build --release --locked --target aarch64-linux-android -p opencodifier-cli
# aarch64-unknown-linux-gnu
cargo zigbuild --release --locked --target aarch64-unknown-linux-gnu -p opencodifier-cli
# wasm32-unknown-unknown
wasm-pack build crates/opencodifier-wa...

v0.6.1

The first public release of the 0.6 line. The engine learns when not to
answer: selective-prediction evidence floors and elicited abstention join
the calibration stack, the corpus toolchain becomes a first-class item
generator crate, and the benchmark program closes its corpus-composition
question — merged-v6 passes the release gate and the first gated weights
ship.

Added

• Engine — selective prediction end to end: a label-overlap preflight that abstains before extraction guesses (d5f4733), a selective-prediction evidence floor (df230f5), boolean gate fit with elicited abstain (c5d2527), and risk-coverage acceptance for calibration artifacts (d9b86e9) — a calibration artifact now earns deployment by its risk-coverage curve, not a single operating point.
• opencodifier-itemgen — new crate: the relational/contrastive item generator that builds suite items, extracted from ad-hoc scripts (70a59af).
• Schema — shared byte-exact macjev renderer, one implementation for tests and tools (8b415d2); noul non-string sides skip with unit tests (661925d).
• Model — NLI verbalization verifier contract for the #15 enhancement program (a6a2e07).
• Benchmarks — the training/corpus toolchain of record: soft-label trainer path + corpus builders (9937045), VIVERE teacher-score campaign tool (5b800cb) + batched teacher scoring (cfdf760), trainer resume-state + --resume (c44ad6a), GGUF parity fixtures with the BOS serving-path root cause (0364e17), corpus-prep gates for merged-v4/v5/v6 lanes (bf5370f, d464cdb), reporting parity metrics over frozen evidence (4b2cab8) + the cost table mapping to the board CSV (dc89d22), the rel200 eval slice + iterate-B val history (da0f599), the e1 calibration lane + JevBench slot arm (224929b), and the MiniCPM5 arm (b52fbaa).
• Site — Decisions SDK + shell kit (3740523), the 12-game SDK game library (9ef9906), the chrome round: switcher + ratings (6b066b1), a wiki-style docs page (f4530cb), the decide console (f7a56bb), the board data page + quickstart + landing fixes (e617e35), and board parity + billed-cost columns (505e648).
• CI — test/e2e lanes build on container-local disk (6cbf4d0); heavy lanes fit the 4G container cap (e427961).

Fixed

• e1 readout anchor off-by-one token (7082a46); length-bucket chunk splitting kept intact (d989c9d); itemgen compiles under the pinned 1.90 toolchain (de8b944); wasm conformance keys + intra-doc link (a265d81); perkind argv honors rows/suite paths (4494142).
• Repo hygiene carried by the 0.6.1 bump: CONTRIBUTING.md, CHANGELOG.md, and SECURITY.md moved under .github/ where GitHub surfaces them; README gains the Models section with HuggingFace cross-links; the site release-flow doc now tells the truth about production deploys (manual direct-upload, never automatic); the 2026-10-12 platform-adoption handoff is landed in docs/handoffs/; wasm conformance fixtures re-keyed for the semver bump (cache keys embed engine semver by design).

Verified — the corpus-composition question closes

• T3.3' (2B on merged-v6-full): release gate PASS ×2 — suite holdout 0.6917 (≥ 0.68) and JevBench 0.6580 (≥ 0.6494) — second own arm through the gate (TRAINING.md, 2026-10-15). The comparison with E1-E closes the corpus-volume lever: confidence-gated volume ≠ transfer; E1-E (0.8083 / 0.6840) remains the release candidate.
• First gated weights published: aliasfox/OpenCodifier-Decision-2B-v6full (per-surface numbers, shipped per-kind calibration, withheld-corpus disclosure).
• Engineering levers measured: length-bucketing +31.3% replicates, b4-bucket sweet spot +44.4% (T2.3); causal_conv1d buys +29.2% tok/s but fails same-seed trajectory parity — throughput lever, banned from gate arms (T2.2, fixed comparator).

Security & quality

• rustls 0.23.45 → 0.23.46 (RustSec: hybrid-PQ KEX + session-resumption downgrade) — lock-only.
• Workspace dependency requirements aligned; conformance fixtures re-keyed for 0.6.1.
• All CI lanes green on the released commit; aegis 0 new findings.

Binary assets

Cross-target binary matrix, per just release-build (each target ships
its binary plus a SHA-256 attestation). Attached: x86_64-unknown-linux-gnu,
x86_64-unknown-linux-musl, aarch64-unknown-linux-gnu, x86_64-pc-windows-gnu,
x86_64-apple-darwin, aarch64-apple-darwin, aarch64-apple-ios,
wasm32-unknown-unknown, aarch64-linux-android. Binaries were compiled from
the release tree (GitForge main ef19ad7, identical tree to GitHub main).
Model weights are NOT attached to releases by policy — gated weights
publish to HuggingFace only (docs/RELEASE_POLICY.md).

v0.5.0

OpenCodifier v0.5.0

Released 2026-10-08 from commit 0fd6a1543c27 (full sha
0fd6a1543c27884fc757d3354c757da650ae7f5a, previous tag v0.4.0).

Highlights

— one bullet per user-visible change since v0.4.0, each citing its DECISIONS.md entry or CHANGELOG.md section.

Quality-gate receipts

just ci green at the release commit is the gate of record; the same gates
run line-for-line in the GitForge pipeline (.gitforge.yml, the platform of
record — a red GitHub Actions mirror is not a code-failure signal). Every
gate below needs its own receipt: a run id, or the local command output.
<receipt> is where that evidence goes; an unfilled receipt means the gate
did not run for this release.

Gate	Command	Status	Receipt
Format	cargo fmt --all -- --check	<PASS|FAIL>	<receipt>
Lint	cargo clippy --workspace --all-targets -- -D warnings	<PASS|FAIL>	<receipt>
Tests	cargo test --workspace	<PASS|FAIL>	<receipt>
Docs	RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps + cargo test --doc	<PASS|FAIL>	<receipt>
Deps	cargo deny check	<PASS|FAIL>	<receipt>
Advisories	cargo audit	<PASS|FAIL>	<receipt>
Pattern scan	aegis --format json scan --file . --baseline .aegis/baseline.json (0 new)	<PASS|FAIL>	<receipt>
Coverage floor	cargo llvm-cov --workspace --lcov + scripts/coverage_floor.py … --floor 98.5	<PASS|FAIL>	<receipt>
End-to-end	just e2e (serve + MCP over the real wire)	<PASS|FAIL>	<receipt>

Artifacts

Built by just release-matrix (D24). Each row is backed by an attestation
beside the artifact; just release-verify re-checks every digest against the
bytes on disk.

Target	Artifact	Bytes	SHA-256	Linkage	Attestation
aarch64-apple-darwin	opencodifier	5860416	d054f790cb8cfa147af417ee8ff05f92510644f78fef427b1113f4a84174fedd	unknown linkage	target/aarch64-apple-darwin/release/opencodifier.attestation.json
aarch64-apple-ios	libopencodifier_ffi.a	30403008	1ce97d1d31bfe0253ff26b63da916f83c9b6598098d8485c17f58bfb1c3fc84a	unknown linkage	target/aarch64-apple-ios/release/libopencodifier_ffi.a.attestation.json
aarch64-linux-android	opencodifier	6426048	0f588fd2b64b401c0072dbe3bf164e6334aa14e6d7be2af2c76b0afb3f5c33a8	dynamic (interpreter /system/bin/linker64)	target/aarch64-linux-android/release/opencodifier.attestation.json
aarch64-unknown-linux-gnu	opencodifier	4599136	29156b66f4b66e1bad722acb35258d3278df4239155fcd1f5eda7cbb533dbcbe	dynamic (interpreter /lib/ld-linux-aarch64.so.1)	target/aarch64-unknown-linux-gnu/release/opencodifier.attestation.json
wasm32-unknown-unknown	opencodifier-0.5.0-wasm32-unknown-unknown.tar.gz	577726	474d23c989740a66f5b948859aa061b6b6de70497924633353bc7cc049b254a8	unknown linkage	dist/v0.5.0-wasm32-unknown-unknown/opencodifier-0.5.0-wasm32-unknown-unknown.tar.gz.attestation.json
x86_64-apple-darwin	opencodifier	6311544	7d7c2385ed9a8549378d20467bd9d3cc67019ba41c006b1c5ec2c02fb97aa4ec	unknown linkage	target/x86_64-apple-darwin/release/opencodifier.attestation.json
x86_64-pc-windows-gnu	opencodifier.exe	5120512	ea24950cc59d18a51f9926363fb0e6626672c737160cd9726ba5ab40c8e48f80	unknown linkage	target/x86_64-pc-windows-gnu/release/opencodifier.exe.attestation.json
x86_64-unknown-linux-gnu	opencodifier	6688576	e087986d6115511dd8f51a991a3ec1a8038ac78bad3c3c14490852eddf421f5e	dynamic (interpreter /lib64/ld-linux-x86-64.so.2)	target/x86_64-unknown-linux-gnu/release/opencodifier.attestation.json
x86_64-unknown-linux-musl	opencodifier	6771880	2ecdf4444656239debf26a20eaf21a18341283a4bd9836f08966f85e88af6d2e	static	target/x86_64-unknown-linux-musl/release/opencodifier.attestation.json

Verification level, per artifact

The matrix states what was proven, never "supported": D24 sets the named
level each target can carry, and an artifact only claims the level it earned.
Mark one per row.

Target	Level earned	Why
x86_64-unknown-linux-gnu	<filled-by-human>	<receipt>
x86_64-unknown-linux-musl	<filled-by-human>	<receipt>
aarch64-unknown-linux-gnu	<filled-by-human>	<receipt>
x86_64-pc-windows-gnu	<filled-by-human>	<receipt>
x86_64-apple-darwin	<filled-by-human>	<receipt>
aarch64-apple-darwin	<filled-by-human>	<receipt>
aarch64-linux-android	<filled-by-human>	<receipt>
aarch64-apple-ios	<filled-by-human>	<receipt>
wasm32-unknown-unknown	<filled-by-human>	<receipt>

Known gaps to state on the release page rather than paper over: no foreign
arch is executed here (no qemu, no arm hardware), so aarch64 artifacts are
link + file-magic only; registry publication (crates.io, Homebrew, winget)
is an outward action taken only on an explicit user go.

Reproduction

From a clean checkout at 0fd6a1543c27884fc757d3354c757da650ae7f5a, on a host with the matrix toolchains
(just release-preflight reports what is missing, naming each tool):

just release-preflight                 # toolchain readiness per target
just release-matrix                    # build + stage + attest every target
just release-verify                    # re-hash every artifact vs its attestation
just release-notes                     # this file, from the attestations
just ci                                # the gate of record, before tagging
just e2e                               # the run-tested claim, on the host target

Single-target build and its exact recorded command:

# aarch64-apple-darwin
cargo zigbuild --release --locked --target aarch64-apple-darwin -p opencodifier-cli
# aarch64-apple-ios
cargo build --release --locked --target aarch64-apple-ios -p opencodifier-ffi
# aarch64-linux-android
cargo build --release --locked --target aarch64-linux-android -p opencodifier-cli
# aarch64-unknown-linux-gnu
cargo zigbuild --release --locked --target aarch64-unknown-linux-gnu -p opencodifier-cli
# wasm32-unknown-unknown
wasm-pack build crates/opencodifier-wasm --release --target web --out-dir target/wasm-release/pkg-web --out-name opencodifier && wasm-pack build crates/opencodifier-wasm --release --target nodejs --out-dir target/wasm-release/pkg-nodejs --out-name opencodifier && tar -czf dist/v0.5.0-wasm32-unknown-unknown/opencodifier-0.5.0-wasm32-unknown-unknown.tar.gz -C target/wasm-release pkg-web pkg-nodejs
# x86_64-apple-darwin
cargo zigbuild --release --locked --target x86_64-apple-darwin -p opencodifier-cli
# x86_64-pc-windows-gnu
cargo zigbuild --release --locked --target x86_64-pc-windows-gnu -p opencodifier-cli
# x86_64-unknown-linux-gnu
cargo build --release --locked --target x86_64-unknown-linux-gnu -p opencodifier-cli
# x86_64-unknown-linux-musl
cargo build --release --locked --target x86_64-unknown-linux-musl -p opencodifier-cli

Provenance

Field	Value
Commit	0fd6a1543c27884fc757d3354c757da650ae7f5a
Commit date (UTC)	2026-10-07T09:54:23Z
rustc	rustc 1.99.0 (b940084d7 2026-09-28)
cargo	cargo 1.99.0 (5f94df478 2026-08-27)
Cargo.lock sha256	6d1b5112c91f12e14a0f4d031c0f0d6648e5ceb18f9a2139ee679cf1e76b1879
Workspace tree sha256	b3c17b4d04159f5eae881b3499a9f42fbdd277bba2e5bbaff806146600bd7ab0
Feature flags	default
Attestation schema	opencodifier.attestation/1

Model weights are never committed (D14): any model artifact this release
references travels with its own models/*.json SHA-256 manifest, and the
runtime refuses a mismatch before reading a tensor.

v0.4.0

OpenCodifier v0.4.0 — engine enhancement track

Tagged 2026-10-02 at a819adf (previous tag v0.3.0). (Backfilled
release page: the tag and source shipped on 2026-10-02; this page was
created later.)

Highlights

From CHANGELOG §[0.4.0] — the engine-enhancement track (B1–B4) plus the
research record:

• D9's performance budgets are finally measured: criterion benches
  for the unmeasured per-stage budgets — normalize decode, rule match at
  scale, BM25 narrowing at 256 candidates (build + score-all), embedding
  rerank — plus an HTTP bench for the 2 ms round-trip budget, a just bench recipe, and the first committed baseline bundle (PLAN 18i, B1).
• The hot paths those budgets exposed are fixed (B2 constant-factor
  wins; B3 per-document BM25 frequency maps).
• The escalation ladder ships as configuration (B4): per-node and
  per-kind gate overrides via LadderPolicy, per-rung calibration;
  empty config = byte-identical engine (D25).
• D9 criterion benches + committed baselines; the research record
  (cascade/calibration frontier, ONNX Vulkan correction) landed alongside.

Binaries

No binaries are published for this tag. The release matrix with
attested per-platform artifacts debuts in v0.5.0; anything built on
the development line after this tag was cut would carry a commit hash
that does not correspond to a819adf, and a release page that implies
otherwise is a provenance claim this project does not make. Build from
the tag: cargo build --release (workspace, Rust 1.90+).

Provenance

Field	Value
Tag	v0.4.0 → a819adf
Full changelog	CHANGELOG §[0.4.0] in the tagged source tree
Source code	attached (tag archive), as for every release

v0.3.0

Decision-runtime release: agent-facing skills, the spec coverage map, focused-question extraction (Phase 16/D18), the native verdict-slot arm, and the JevBench external-anchor workstream.

[Unreleased]

Added

• JevBench external-anchor runs (PLAN Phase 17, in progress): the
  231-item public split through the official harness — engine arm
  (rerun in flight), native verdict-slot bridge vs the published
  64.1 % row, and the 4B fork arm. Results land in REPORT.md.
• Params A/B on the 4B decision arm (threads/ctx/prompt diet) and the
  first native verdict-slot run on our 120-item suite: queued behind
  the shared-host load storm.

---

CI note: the release tag's pipeline run had lint and doc green and a byte-identical Cargo.lock vs the fully green bd35e0a run; the supply-chain job stalled on a crates.io fetch inside the CI container under host load ~90 and the run is carried by that equivalence.

v0.2.0

Decision-runtime feature release: the decision-model benchmark and D16 four-tier board, confidence truthfulness (calibration seam, uncertainty gates, live OOD score), the relational solver as the engine's default zero-ML stack, and the rmcp 2.2 stdio MCP surface.

[0.2.0] — 2026-09-28

Four plan phases in one minor bump: the decision-model benchmark and
D16 board (Phase 13), confidence truthfulness (Phase 14), the
relational solver that became the engine's default zero-ML stack
(Phase 15), and the MCP surface (Phase 10).

Added

• Decision-model benchmark (PLAN Phase 13) — built and swept to 48
  runs: benchmarks/decision-model/ holds a byte-locked 120-item
  candidate-conditioned suite (metadata_match / lexical_semantic /
  relational_compositional) and measured arm types (the engine's
  lexical pipeline, embedding zero-shot over three backends, Laya-421M,
  llama.cpp parallel-decision constrained scoring across the GGUF
  board, and chat-only screens for forks without a decision arm), with
  the committed summary + model manifest. Measured and recorded: the
  2-bit cliff (0.617 at 4B), the 9B IQ-quant latency reversal, the
  ≤350M tiny-decoder graveyard, and Jev-Style-0.8B-Decision-v3 as an
  interface-mismatch row (0.217 — verdict-slot readout, zero transfer
  to candidate-id path scoring; labeled in the summary). Extension
  arms (2026-09-28): Bonsai-4B ternary is the board's best
  accuracy-per-byte (0.650 from 546 MiB) at 4B-class latency;
  Ternary-Bonsai-8B is unmeasurable on the CPU host (>10 CPU-hours per
  decision request / unreadable tensors); LFM2.5-2.6B (0.608) is
  dominated by Qwen3.5-2B; the DavidAU X12 NEO MAX merge (0.667 @
  8.35 s) is latency-toxic. Ternary second pass (2026-09-28): Bonsai-8B
  Q1_0 hits a measured prefill cliff (≈1.5 s/token past a ~30-token
  knee — suite projects to 9–13 h) and Ternary-Bonsai-2-27B PTQ1_0 is
  unloadable (ggml type 143, prism-ml-fork-only), so on-CPU ternary
  viability in the ad129b0 build is 4B-and-below. Embedding-rung
  bake-off (2026-09-28): gte ONNX-fp32 ties torch to the digit at 4.2×
  the CPU speed (811 ms vs 3375 ms per item) and becomes the rung's
  runtime; int8 dynamic quantization rejected (0.442 for −17%
  latency); EmbeddingGemma-300M Q8_0 via llama.cpp recorded (0.500 /
  ECE 0.256); fp16 export unloadable (REPORT F20); blockwise int4 (the
  Q4_0 analog via ORT MatMulNBits, block 32) measured quality-free AND
  speed-free — 0.575 / ECE 0.330 identical to fp32 at 226 MB with no
  latency gain, so fp32 stays the rung's runtime and the q4 build is
  the RAM-bound fallback (REPORT F21; q4f16 untestable on CPU). Raw
  winner probability measured uncalibrated everywhere (ECE
  0.048–0.626), so D15 calibration still blocks any confidence
  exposure, and the relational class stayed escalation territory for
  every model arm until the relational solver (below). Runner
  hardening: per-request --timeout (9B tails exceeded the old fixed
  600 s and killed arms mid-run), chat-only screens included in the
  summary, and per-run caveat annotations. Full narrative record
  committed as results/REPORT.md + results/charts/ (four
  deterministic SVG charts rendered from the run JSONs by
  runner/plot.py) — methodology, complete board, quant ladders,
  findings F1–F17, threats to validity, and reproduction commands.
• Confidence truthfulness (PLAN Phase 14): the §73 calibration mandate
  and the dead OOD channel are both closed. The engine gains a
  Calibration seam — identity (raw, version 0) by default,
  TemperatureCalibration from validated versioned artifacts whose
  calibration_version folds into cache keys — plus §19 uncertainty
  gates on DecisionPolicy (entropy ceiling / minimum margin / OOD
  ceiling, disabled by default, byte-stable canonical form) fed by a
  live distributional OOD score (entropy / log2(k)) traced alongside
  the calibrated confidence. Fitted temperature artifacts for the six
  D16 tier / rung arms ship under
  benchmarks/decision-model/results/calibration/ (offline fitter
  runner/fit_calibration.py; evidence in results/CALIBRATION.md):
  LLM tiers are overconfident (T 0.84–1.67, frontier MiMo-9B ECE 0.048
  → 0.026), and the embedding rung's fit is degenerate — no finite
  temperature calibrates gte zero-shot scores, which are ordering
  evidence only, so no artifact is shipped for it.
• Relational solver (PLAN Phase 15): state text is mined for
  relational facts with an exact grammar ("X depends on Y", "X is
  healthy", "X: healthy, degraded, down", "X comes back online only
  after Y"); three general operators (root cause by transitive
  dependency closure, healthiest group by strict count, first restored
  by ordering) prove an answer over the whole extracted structure —
  and answer only when the proof is unique, inside the candidate set,
  and agreed by every operator, delegating to the lexical classifier
  otherwise. Measured on the byte-locked benchmark suite:
  relational_compositional 0.350 → 0.950, blended 0.483 → 0.683, p50
  5.3 ms → 1.3 ms, other classes bit-identical, determinism replay
  exact — the 0.50 relational ceiling that held for every model arm is
  broken at zero cost by proof rather than likelihood (REPORT F22).
  Calibration of record for the engine arm stays identity — the global
  temperature fit worsens ECE on the bimodal proof/delegate
  distribution, and the fitter now refuses to ship any artifact whose
  fit does not improve ECE (the retired builtin-lexical-v1 artifact
  was removed with the stack it described).
• MCP surface (PLAN Phase 10): opencodifier-mcp — six decision tools
  (codify_decide, codify_batch, codify_graph, codify_validate,
  codify_verify, codify_explain) served over stdio with rmcp 2.2.0
  (D1's pin, honored; the 3.x major line is not adopted — D17), wired
  as opencodifier mcp serve. Same engine as HTTP (EngineHandle),
  same error envelope and stable codes (one MCP-specific code:
  mcp.batch_too_large), same deterministic traces with no
  chain-of-thought; batch items are decided independently under a
  16-request cap.

Changed

• The engine's default zero-ML stack is the relational solver over the
  lexical classifier (Phase 15); D16 amended ×4 into a four-tier
  scheme: MiMo-V2.6-9B Q3_K_S is the frontier (0.817, ECE 0.048 best,
  first arm over the old 0.50 relational ceiling at 0.525 — MoE,
  14.3 s p50, verifier tier); Qwen3.5-4B is the interactive reference
  (0.800 @ 4.9–6.8 s, superseding Qwen3.8-4B-Distill); Qwen3.5-2B
  stays balanced (0.725, best ECE 0.062) and Qwen3.5-0.8B fast
  (0.650 @ 613 ms — now undercut by the engine floor).
• Cache-key honesty (D6): the engine now derives the identity's model
  id from the live classifier, so wrapper ids like
  relational-v1|builtin-lexical-v1 invalidate cached decisions on
  swap without caller bookkeeping. Two shared-surface folds landed
  with the MCP work: the engine's graph-document shim (GraphDocument)
  is now public and the HTTP surface's private mirror was deleted, and
  the execution-report JSON projection moved into the engine
  (opencodifier_engine::report) so CLI --trace and MCP
  codify_explain cannot drift.
• Aegis baseline regenerated at the release commit (2,370 entries;
  line-shift re-flags after the CI-clippy allow fix in c09e39d turned
  24 already-triaged findings into false "new" ones on pipeline
  aaa2eefa).

v0.1.1

CI/platform-hardening patch release. No API or behavior changes to the decision runtime.

Added

• infrastructure/docker/ci-rust.Dockerfile + just ci-image — the runner-local CI image (opencodifier-ci-rust:1): pinned toolchain via RUSTUP_TOOLCHAIN (the stable-channel rust-toolchain.toml was silently downloading latest stable at job runtime), rustfmt/clippy (absent from stock rust images), pinned cargo-deny/cargo-audit, rev-pinned aegis, warm crate registry. Rationale: job containers cannot reach host services at all (host firewall default-DROPs docker-sourced traffic), so all tools are baked, not fetched.
• Operator-provided reference document docs/References/Can Your GPU Hit Jev's Milliseconds Mark.txt — design context for the Phase 13 decision-model benchmark (in progress on main).

Changed

• .gitforge.yml: all four jobs (lint/test/doc/supply-chain) run on the baked image with zero runtime tool installs.
• Pipeline of record validated green through GitForge: runs fe4b0871 and 69d17ef2 (and 8e8401f0 on this release commit) — lint, test, doc, supply-chain all succeeded. GitForge is the CI platform of record; the GitHub Actions mirror is not a code-failure signal.
• Aegis baseline discipline: the gate runs after every content edit; triaged appends recorded per entry (1,709 → 1,746).

In progress (Unreleased)

• Phase 13 decision-model feasibility benchmark: candidate-conditioned question suite + runner harness under benchmarks/decision-model/, measuring constrained-decode accuracy, latency, and determinism for small local models against the engine's own lexical/BM25 baseline and an embedding zero-shot arm.

Binary opencodifier-x86_64-linux-v0.1.1 — release-profile opencodifier CLI (decide/graph-validate/serve/models-verify).
SHA-256: f7d9bd8fe4d51ae5ed39af0a86766d2d7a5ca414cffc495fee8995b500b1e2b9

v0.1.0

First tagged release of OpenCodifier — a local-first, deterministic-first decision runtime that turns unstructured state into small, machine-actionable typed decisions (choice / boolean / score), escalating to expensive models only when cheaper mechanisms cannot decide with sufficient confidence.

What works in this release

• Canonical decision IR (opencodifier-core): validating constructors, stable ir.* error codes, trace_version on traces, #[non_exhaustive] enums, multi-dimensional confidence reports with outcome routing. Abstention is a successful outcome, never an error.
• Schema adapters (opencodifier-schema): native / OpenAI / Anthropic / Jev wire formats normalized into the IR; byte-locked fixtures; round-trip property tests.
• Deterministic engine (opencodifier-engine): declarative DAG executor (topological waves, cycle-checked, bounded), rule engine, metadata + hand-written BM25 candidate narrowing, exact-decision cache (SHA-256 CacheKeyBuilder with model/calibration/graph versions in every key), calibration trait, criterion benches vs the D9 per-stage budgets.
• Backend traits (opencodifier-runtime): InferenceBackend/EmbeddingBackend, ONNX behind a feature flag deferred by a measured feasibility gate (D2) — re-entry conditions recorded.
• Model contract (opencodifier-model): candidate-conditioned scoring over named tensors, Rust-side f64 decision math, SHA-256 model manifests. No weights ship; the binary is fully useful with zero ML.
• Interfaces: opencodifier CLI (decide / graph validate / serve / models verify; exit codes 0/1/2/3) and the axum 0.8 HTTP surface (POST /v1/decide, POST /v1/graph/validate, GET /v1/healthz) — loopback-only by default, 1 MiB body cap, abstention is HTTP 200.
• Recipes: three runnable decision graphs with captured, byte-reproducible responses under recipes/.

Quality

413 tests green · 99.00% line coverage (83 documented-unreachable lines, each with an in-source justification) · clippy all+pedantic with unwrap/expect/panic denied · cargo deny + cargo audit clean · aegis pattern scan 0 new findings · rustdoc -D warnings · measured bench baseline in benchmarks/.

Full details: CHANGELOG.md · plan of record: docs/PLAN.md · binding decisions: docs/DECISIONS.md