v1.7.0 — typed SDKs + audit-hardened release

Typed SDKs. hotato.sdk is a typed Python facade over the same code paths the CLI uses (frozen dataclasses whose fields are the CLI JSON keys; ships py.typed). A zero-dependency TypeScript client lives in sdk/typescript, driving the CLI JSON contract from Node.

CI generators. hotato init ci --system {gitlab,jenkins,azure,circleci} writes the one canonical config each system reads.

Release integrity. Source archives build only from the tagged tree via a git archive export at a fixed umask, and a test rejects any sdist member that is not git-tracked. Fleet contracts seal the real reviewer, rationale, stack, and candidate into the signed record, derive collision-free ids, and label atomically. demo/doctor --format json write exactly one JSON document to stdout. OS classifiers name Linux and macOS.

Full suite 3586 passed. Published artifacts are the exact bytes CI built and tested from this tag (wheel byte-identical, sdist content-identical).

v1.6.2 — clearer everywhere, CI everywhere

hotato init ci --system {gitlab,jenkins,azure,circleci} writes the one canonical config each system reads: install the pinned release, verify contracts/, re-score fixtures/, publish JSON + JUnit, fail the pipeline on a regression. An empty directory is a green starting state.

The README and all docs are rewritten for clarity: point-first headings, one idea per sentence, front-door pages readable in under a minute. Every command, link, and scope boundary is preserved.

Emitted paths and the scorer-identity hash use forward slashes on every OS, so artifacts and wheel_hash are byte-identical across machines; POSIX-only tests carry explicit skip reasons on Windows.

Full suite 3560 passed.

v1.6.1 — world-class first-run

First run leads with uvx hotato start --demo everywhere, so the first command works on a machine with an externally managed Python (PEP 668). pip stays shown for CI and containers, pipx or a virtualenv for a project install.

The demo and contract verify output reads as a designed surface: a metric with no finite value shows n/a, times carry their s unit, and a bundle whose canonical digest matches reads as integrity: intact (the stored authenticity field and schema are unchanged). The start --demo exit-code note is stated plainly (setup exits 0; the CI gate returns exit 1), and the epilogue is a verb-first aligned block.

Full suite 3522 passed; verified end to end from a fresh install.

v1.6.0 — proof-preserving counterexample compiler

Compile a deterministic failure into an offline regression capsule with explicit proof status.

Counterexample compiler. hotato counterexample compile turns one failing deterministic scripted scenario into a private, runnable regression capsule and applies deletion-only reduction. It records the source-selected structured failure branch and accepts a deletion only when that branch is preserved. Verification replays the accepted chain and fails closed under tampering; for proof status one_minimal it also checks every remaining deletable unit — 1-minimal under hotato.reducers.v1 within the documented bounds. budget_exhausted carries preservation evidence without a minimality claim. One durable object connects the failure report, local reproduction, CI, git bisect (predicate exits 1 while the failure is present), issue sharing (share-safe exports are inspectable and intentionally non-runnable), and coding-agent workflows (CLI + MCP parity). The proof path runs offline: no model, no network, no subprocess.

Also in this release. A content-addressed transcription cache with verify-by-diff (--no-transcribe-cache re-runs fresh and surfaces drift beside the cached baseline), and Silero VAD running directly on onnxruntime — the MIT-licensed weights ship in the package and [neural] installs onnxruntime + numpy, with segmentation equivalence-tested against the reference implementation.

Full suite green; artifacts built twice with byte-identical wheels; independently audited and adversarially verified.

v1.5.4 — docs + packaging refresh

Documentation and packaging refresh (no API change).

• README (also the PyPI project page) and docs streamlined and optimized to render cleanly on narrow / mobile screens: wide tables restructured into readable lists, long code lines wrapped, dense diagrams normalized; verified-Linux CI support stated plainly.
• A Ruff lint gate (import-sort, pyflakes, bugbear) runs in CI as a green ratchet, plus an MCP tool-registration smoke job.
• Release builds run through a pinned, hash-checked composite build action for reproducible sdists and wheels.

v1.5.3 — data-loss + security hardening

Continued independent-audit hardening.

Data-loss fix. Deleting a recording no longer destroys another workspace's evidence: delete_recording revokes only the caller's pointer and removes the shared content-addressed blob only when no workspace still references it, with canonical-digest + symlink-containment validation and legal-hold enforcement. Registry roots remain the authority; CAS lineage is never an ACL.

Security. Cross-origin redirects strip Authorization/Cookie/Proxy-Authorization and re-run SSRF checks; URLs are sanitized before entering any error, log, or CLI text; recording downloads are bounded (no memory scaling with response size).

Also. Canonical JSON rejects non-finite floats; every MCP tool result/error carries a uniform control envelope; redaction-span validation hardened; query-token keys are percent-decoded; first-run is robust to an uncreatable home; and the README banner scales to fit mobile.

All reproduce-then-fix + independently verified; full suite green.

v1.5.2 — security + correctness hardening

Remediates an independent validation pass, in full.

Security. Evidence reads in hotato serve are authorized by live workspace registry roots, not content-store presence — closing a boundary where a digest acted as a cross-workspace capability (one workspace could read another's evidence, and orphaned blobs stayed readable). Share-safe Failure Records now reject embedded Windows-absolute paths.

Correctness. Capability routing rejects arbitrary contract_uri, pairs only same-battery/config events, and degrades under-labelled events to engagement_control. Reference-run artifacts are byte-reproducible (deterministic manifest timestamp). Voice Failure Atlas: OS-independent publication gate, honest stored transcripts, footer-only attribution. A fleet trial is approvable only above the evidence floor. Neural runs label their backend in provenance (energy path byte-identical). MCP reports hotato's version with a single canonical tool inventory. The reference kit and shell scripts are pinned to LF.

Every fix was reproduced-then-fixed and independently verified. Full suite green; five honesty invariants held.

v1.5.1 — PyPI links resolve + zero-egress Action gate

PyPI links resolve. The PyPI long description is now generated from README.md with every repo-relative link rewritten to an absolute GitHub URL, so links on the PyPI page resolve instead of 404ing against pypi.org. A staleness test keeps it current.

The default Action gate makes zero package-index requests. In action mode the pinned checkout runs directly off PYTHONPATH (python -m hotato) — no pip, no isolated build backend, no index contact. The exact-version pin mode still installs from PyPI, its documented intent. docs/CI.md shows the canonical full-commit-SHA pin.

Full suite 2942 passed.

v1.5.0 — Voice Failure Atlas + prove-and-stop

Deltas D5 and D6.

Voice Failure Atlas (delta D5): a deterministic, static, server-rendered Atlas built from typed sources under atlas/{records,contracts,implementations} by scripts/build_atlas.py (stdlib-only). Every seeded record embeds a real hotato.failure-record.v1 produced by running the CLI against the bundled share-safe funnel-demo fixtures, and the builder computes each capability verdict by calling the real D3 router — a source never carries a pre-baked verdict. A hard publication gate decides what is indexed; origin=fixture is tied to a resolving examples/ path; two builds are byte-identical. The backchannel record routes to turn_intent_discriminator, the addressee-gate-eligible class ships as an honest zero-record noindex stub, and no vendor name appears in any verdict.

Prove-and-stop (delta D6): scripts/verify_delta.py, a machine-verifiable gate over the D2/D3/D5 deliverables, adjacent offline security + consumer suites, a frozen-surface check, the staged D4 bundle, and a recorded share-safe cold-path proof (hotato start --demo runs cold with no key, zero intervention). The human cold batteries ship as an un-fabricated template — never filled with invented counts.

Full suite 2939 passed. See CHANGELOG.md.

v1.4.1 — interaction labels + capability routing

Deltas D2 and D3.

Interaction labels v1 (hotato.interaction-label.v1): optional, backwards-compatible metadata about one event — speech_presence, addressed_to_agent, floor_intent, label_authority, label_ref. Every field is supplied by a human, a trusted source, or a marked fixture; Hotato never derives addressee or turn intent from timing, energy, transcript, or a model verdict. An event with no label reads as all-unknown, so existing artifacts stay valid.

Capability routing v1 (hotato.capability-requirement.v1): a pure, deterministic router that reads supplied interaction labels on a paired addressee-control battery and routes to the narrowest capability the paired evidence supports (a missed addressed floor bid plus a false trigger on the opposite risk), or to no recommendation at all. It never infers addressee or intent, never reads audio, names no vendor, and emits a provider-neutral verdict. Insufficient or untrusted labels route to engagement_control with the missing axes listed.

Also: the consumer GitHub Action hardened to install and gate on itself (--no-deps self-install, action-consumer conformance fixture, action-smoke CI job).

Full suite 2912 passed. See CHANGELOG.md.