sealr 0.1.0-alpha.15: capability-only publisher checks and measured retention

sealr 0.1.0-alpha.15

Alpha.15 adds a concrete publisher content decision through the public verified
capability, measured guidance for bounded retention, and a consistent visual
identity. It keeps the existing twelve explicit format selections, Deflate
completion correction, authenticated Linux worker, independent canonical
evidence verifier, and complete installer handoffs.

This is a development preview for evaluation and integration work. It is not
an independent security audit, a stable API freeze, or production containment.
This GitHub-only prerelease does not publish a crate to crates.io.

Make the decision the publisher needs

The new deepr_content_gate example implements
Deepr's dashboard and runtime asset requirements over VerifiedArchive.
Its business function receives no archive path or source bytes. A bounded
private source copy is admitted through the authenticated worker, canonical
evidence is independently verified, and that pathname is deleted before wheel
evaluation and the content decision. The caller's original wheel is preserved.

The gate requires five exact files, at least one dashboard JavaScript and CSS
asset, and no packaged build debris. It also applies the public wheel evaluator,
including filename, metadata, and RECORD validation. Those requirements and
explicit regular-file checks are stricter than the original names-only business
check. Source distributions are outside this example.

Optional exact metadata retention uses the existing public limits: at most
64 paths, 256 KiB per member, and 1 MiB total. Every archive member is still
verified. The decision installs no files and requires no second archive parser.

Twelve grouped regression tests cover valid business-policy mutations, missing
and substituted assets, forbidden content, harmless lookalikes, unrelated
corrupt and incomplete payloads, duplicate and unsafe paths, wheel-semantic
denial, retention identity parity, and source deletion. The packaged Linux
example is additionally exercised against the digest-pinned real Deepr wheel
and authenticated native companions.

This is an owner-maintained integration example and validation fixture. It is
not Deepr's production release gate and does not close independent adoption.

Measure repeated work before changing the boundary

The retention experiment uses immutable
Alpha.14 source and native artifacts in the separate validation repository.
It compares no retention, four semantic metadata members, and a bounded set
of up to 64 members across real Deepr, Primr, and Recon release wheels.

The measurements separate admission, evaluation, staging, installer invocation,
and output audit. They distinguish full installation from a narrow acceptance
decision and require identical semantic identities and installed outputs.
Individual timings describe specific runs, not a general benchmark or a
production latency promise. Retention avoids several kinds of repeated work;
this experiment does not attribute their individual costs.

No parser, worker lifecycle, source-binding check, protocol, profile, policy,
public library API, or runtime dependency changed in this release. A private
validated read authority remains a proposal with explicit review gates.

A consistent documentation identity

The visual identity provides a simple vector mark and wordmark,
light and dark variants, a one-color option, small-size specimens, and a concise
style guide. All six Linux walkthrough images were refreshed from the current
CLI with the same verified transcripts and visible version. Detailed usage and
integration explanations live under docs/; the README remains a short entry
point.

Validation and distribution

Required CI retains the full workspace, strict Clippy and documentation,
Linux/macOS/Windows native checks, exact source and native package contracts,
5,927-case ZipDiff gate, producer matrix, installer fixtures, supply-chain
checks, and real-kernel floor. Release promotion requires fourteen exact-commit
bounded fuzz campaigns, three native builds, checksums, provenance, and immutable
publication verification.

Rust 1.98 and the native floors remain unchanged: Ubuntu 24.04 x86_64 with glibc
2.39 and Linux 6.8, macOS 15 arm64, and Windows Server 2022 build 20348 x64.
Supervised ZIP32 additionally requires the supported x86_64 Linux Landlock ABI 3
and seccomp setup. Unsupported worker selections fail closed without fallback.

Download the matching archive and SHA256SUMS from the
release and
follow the verification guide. Receipts remain
unsigned. External adoption, authenticated abandoned-stage recovery, durable
directory publication, stable surface selection, and independent review remain
open gates in the roadmap.