Skip to content

GaugeMesh 0.2.0 — Invariant Routing Developer Preview

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Sep 12:40
· 2 commits to main since this release
v0.2.0
c7279f7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

GaugeMesh 0.2.0 — Invariant Routing Developer Preview

GaugeMesh 0.2.0 adds an opt-in, versioned route-decision contract while
preserving the original 0.1.0 bare-plan output for existing route explain
consumers.

Emit and validate a selected decision:

gaugemesh route explain --decision-contract > selected.json
gaugemesh route validate selected.json

Emit and validate a denied decision with the built-in all-constraints-fail
fixture:

gaugemesh route explain --deny-all > denied.json
gaugemesh route validate denied.json

The checked-in JSON Schema and offline validator cover both statuses.

This release includes:

  • deterministic selected and denied decision envelopes with schema version and
    unsigned, recomputable SHA-256 decision digests;
  • complete hard-constraint rejection reasons for every denied candidate;
  • fail-closed checks for duplicate route IDs, malformed or conflicting fields,
    noncanonical ordering, unexplained denials, arithmetic overflow, excessive
    input, and digest tampering;
  • compatibility for the existing bare-plan JSON unless the decision contract is
    explicitly requested;
  • native Linux x64/ARM64, Windows x64, and macOS ARM64/x64 archives, SHA-256
    checksums, SPDX SBOM, GitHub artifact attestations, and a non-root public GHCR
    image.

The hosted gates cover Rust 1.88 and stable, Ubuntu/Windows/macOS, official MCP
conformance for revisions 2025-11-25 and 2026-07-28, the documented OpenAI
Python SDK subset, focused mutation testing, Miri, AddressSanitizer, bounded
fuzzing, supply-chain policy, archive extraction, and container execution.

gaugemesh verify --resilireplay invokes the exact public
resilireplay@0.7.0 package. The required clean, timeout, and deterministic
error recovery cases pass with cleanup and zero duplicate effects; the full
thirteen-scenario aggregate remains honestly PARTIAL, and no MCP-RES claim is
made.

This GitHub/GHCR developer preview is independently useful without crates.io.
The release workflow does not publish a crate, and crates.io publication must
not be inferred from this tag or release.

This is not production-ready software, routing correctness for undeclared
constraints, an authentication signature, an official MCP certification,
security certification, exactly-once execution, or universal client/provider
compatibility. Route reasoning can contain configured identifiers and policy
rejection text; sanitize inputs and treat exported decisions as potentially
sensitive.

Assets 9
Loading