VerifyCraft v0.1.0

VerifyCraft v0.1.0 Release Notes

VerifyCraft v0.1.0 is the first public release of VerifyCraft: composable review, testing, and verification capabilities designed specifically for AI agents, automated development workflows, and regression mitigation.

VerifyCraft replaces naive command execution heuristics with explicit hypothesis testing, bounded safety invariants, and cryptographic state tracking—eliminating false confirmations and hallucinated verification.

---

What is VerifyCraft?

AI code generation systems often declare tasks "verified" merely because a command exited with code 0 or failed with a generic error code. VerifyCraft formalizes verification into an empirical, falsifiable science:

1. Explicit Hypothesis & Expected Observations: Requires explicit diagnostic signatures (regex/literal error patterns) and expected exit codes. Exit code 1 alone without a matching diagnostic signature cannot support a regression claim.
2. Four Strict Verdict States:
   • supported: The observed evidence precisely matches the expected diagnostic signature and exit conditions.
   • refuted: The evidence directly contradicts the hypothesis (e.g., a test passed when a regression failure was predicted).
   • inconclusive: Evidence was truncated, timed out, or produced an unexpected error signature.
   • blocked: Execution was prohibited by safety policy, authorization rules, untrusted code boundaries, or uncomputable state.
3. Deterministic Scope & Cryptographic Fingerprinting: Computes deterministic SHA-256 fingerprints across repository revision, unified diff, check specification, and scoped files, automatically detecting stale evidence and preventing replay attacks.
4. Hardened Local Execution Safety:
   • Strictly prohibits shell=True.
   • Isolates execution under trusted_local mode with process-group wall-clock timeouts (terminating stubborn child processes).
   • Enforces real-time stdout/stderr byte caps to prevent memory denial-of-service.
   • Sanitizes environment variables to prevent accidental secret leakage.

---

Features & Highlights

1. Canonical Schema Contracts (verifycraft.contracts)

• Full Pydantic v2 data models with verifycraft.v0 schema compatibility.
• Seamless JSON serialization and validation (VerificationInput, Hypothesis, CheckSpec, Evidence, Finding, VerificationResult).

2. High-Precision Evaluation Engine (verifycraft.core.evaluator)

• Multi-phase evaluation: timeout detection, explicit contradict pattern checks, and diagnostic signature matching.
• Honest handling of output truncation: truncated outputs missing required signatures yield inconclusive, preventing false confirmations.

3. Verification Scope & Fingerprinting (verifycraft.core.fingerprint)

• Discovers bounded scope across target paths, diff modifications, and hypothesis locations.
• Directory traversal defenses prevent path escape outside repository boundaries.
• Rejects stale cached evidence when repository or check specifications diverge.

4. Command-Line Interface (verifycraft)

• Subcommand verifycraft verify supports both direct CLI flags (--target, --claim, --match-pattern) and file-based batch inputs (--input <file.json>).
• Supports human-readable --format summary and machine-readable --format json.
• Canonical POSIX exit codes mapped directly to verification verdicts (0 for supported, 2 for refuted, 3 for inconclusive, 4 for blocked).

5. Benchmark Suite & Quality Assurance

• Automated benchmark suite (python -m benchmarks.evaluate) evaluating Stage 0 / Stage 1 regression invariants.
• 99.7% branch and statement test coverage across Linux, macOS, and Windows.
• Full type safety verified with MyPy strict mode and SonarCloud Quality Gate A.

---

Installation

VerifyCraft 0.1.0 is available on PyPI:

# Using pip
pip install verifycraft==0.1.0

# Using uv
uv add verifycraft==0.1.0

Verify installation:

verifycraft --help

---

Verified Release Artifacts

The official release distributions were built in a hardened CI pipeline and published via PyPI Trusted Publishing:

File Name	Distribution	SHA-256 Checksum
verifycraft-0.1.0-py3-none-any.whl	Wheel	71f026411825d34dd340b45e4e8ebe5207301da408696e51b96cc7a11fa0f603
verifycraft-0.1.0.tar.gz	Source Archive (sdist)	b865b7bd4d1763951d62b643fabc5e673a41960b8280c75081d1e38ffb7c6a70

Verifying Checksums

# Verify wheel
echo "71f026411825d34dd340b45e4e8ebe5207301da408696e51b96cc7a11fa0f603  verifycraft-0.1.0-py3-none-any.whl" | sha256sum -c

# Verify sdist
echo "b865b7bd4d1763951d62b643fabc5e673a41960b8280c75081d1e38ffb7c6a70  verifycraft-0.1.0.tar.gz" | sha256sum -c