GaugeMesh 0.2.1 — Invariant Routing Developer Preview

GaugeMesh 0.2.1 — Registry Publication Patch

GaugeMesh 0.2.1 is a packaging and documentation patch over the 0.2.0
developer preview. It does not add product behavior or change the route-decision
schema.

The patch includes the already reviewed correction to the public decision
examples. Emit and validate a selected decision with shell redirection:

gaugemesh route explain --decision-contract > selected.json
gaugemesh route validate selected.json

Emit and validate the built-in all-constraints-fail decision:

gaugemesh route explain --deny-all > denied.json
gaugemesh route validate denied.json

The workspace and lockfile now report 0.2.1, and both crates carry explicit
crates.io metadata. The package-acceptance workflow builds and inspects the exact
gaugemesh-core candidate and validates the dependent gaugemesh file set.
Cargo cannot prepare the dependent upload until its exact core version exists in
the registry, so a first crates.io publication must publish gaugemesh-core
before producing, dry-running, and publishing gaugemesh.

The GitHub release remains independently useful through native Linux, Windows,
and macOS archives, SHA-256 checksums, an SPDX SBOM, attestations, and the public
multi-architecture GHCR image. Do not infer crates.io availability until
https://crates.io/crates/gaugemesh/0.2.1 resolves publicly.

The limitations from 0.2.0 remain unchanged. GaugeMesh is a developer preview,
not a production-readiness or security certification. Decision digests are
unsigned integrity checks, route reasoning can contain configured identifiers
or rejection text, and only declared constraints are enforced.

GaugeMesh 0.2.0 — Invariant Routing Developer Preview

GaugeMesh 0.2.0 — Invariant Routing Developer Preview

GaugeMesh 0.2.0 adds an opt-in, versioned route-decision contract while
preserving the original 0.1.0 bare-plan output for existing route explain
consumers.

Emit and validate a selected decision:

gaugemesh route explain --decision-contract > selected.json
gaugemesh route validate selected.json

Emit and validate a denied decision with the built-in all-constraints-fail
fixture:

gaugemesh route explain --deny-all > denied.json
gaugemesh route validate denied.json

The checked-in JSON Schema and offline validator cover both statuses.

This release includes:

• deterministic selected and denied decision envelopes with schema version and
  unsigned, recomputable SHA-256 decision digests;
• complete hard-constraint rejection reasons for every denied candidate;
• fail-closed checks for duplicate route IDs, malformed or conflicting fields,
  noncanonical ordering, unexplained denials, arithmetic overflow, excessive
  input, and digest tampering;
• compatibility for the existing bare-plan JSON unless the decision contract is
  explicitly requested;
• native Linux x64/ARM64, Windows x64, and macOS ARM64/x64 archives, SHA-256
  checksums, SPDX SBOM, GitHub artifact attestations, and a non-root public GHCR
  image.

The hosted gates cover Rust 1.88 and stable, Ubuntu/Windows/macOS, official MCP
conformance for revisions 2025-11-25 and 2026-07-28, the documented OpenAI
Python SDK subset, focused mutation testing, Miri, AddressSanitizer, bounded
fuzzing, supply-chain policy, archive extraction, and container execution.

gaugemesh verify --resilireplay invokes the exact public
resilireplay@0.7.0 package. The required clean, timeout, and deterministic
error recovery cases pass with cleanup and zero duplicate effects; the full
thirteen-scenario aggregate remains honestly PARTIAL, and no MCP-RES claim is
made.

This GitHub/GHCR developer preview is independently useful without crates.io.
The release workflow does not publish a crate, and crates.io publication must
not be inferred from this tag or release.

This is not production-ready software, routing correctness for undeclared
constraints, an authentication signature, an official MCP certification,
security certification, exactly-once execution, or universal client/provider
compatibility. Route reasoning can contain configured identifiers and policy
rejection text; sanitize inputs and treat exported decisions as potentially
sensitive.

GaugeMesh 0.1.0 — Invariant Routing Developer Preview

GaugeMesh 0.1.0 — Invariant Routing Developer Preview

GaugeMesh 0.1.0 is the first developer preview of a local-first router that
preserves typed identity, authority, budget, deadline, side-effect, schema, and
causal constraints across MCP capabilities and model requests.

Start without an account, provider, database, or network target:

gaugemesh demo

This release includes:

• MCP server and client paths for revisions 2025-11-25 and 2026-07-28 over stdio
  and Streamable HTTP;
• collision-safe tools, resources, prompts, transparent aliases, and bounded
  capability leases;
• deterministic integer route planning with hard constraints and digest-bound
  explanations;
• a bounded OpenAI-compatible models/chat/Responses subset and configured
  provider adapter;
• memory and SQLite storage, bounded admission/process pooling, restart limits,
  cancellation, and cleanup;
• loopback local mode plus a fail-closed TLS/OIDC remote resource-server mode;
• native Linux x64/ARM64, Windows x64, and macOS ARM64/x64 archives, SHA-256
  checksums, SPDX SBOM, GitHub artifact attestations, and a non-root GHCR image.

Verification is deliberately bounded. Official MCP conformance scored 70/70 for
2025-11-25 and 117/117 for 2026-07-28. Focused mutation testing killed all 108
viable mutants; 13 generated domain-default mutants were compile-invalid. Local
60-second fuzz runs completed 1,288,807 config and 42,672,607 protocol-revision
executions without a finding. Miri ran 18 selected deterministic tests and
AddressSanitizer ran the 89-test executable suite without diagnostics.

ResiliReplay 0.7.0 exercised 13 scenarios: three required recovery cases passed,
ten unsupported recovery outcomes failed explicitly, cleanup completed, and
duplicate effects were zero. The aggregate is PARTIAL. No MCP-RES profile was
emitted, so this release makes no MCP-RES claim.

This is not production-ready software, an official MCP implementation status,
MCP certification, security certification, exactly-once execution, or a claim of
universal client/provider compatibility. Read the compatibility, adversarial,
performance, and threat-model documents before evaluating non-local use.