v0.5.300

Paired core-chain release: CLI 0.5.300 / Server 0.1.2.post83.

Bounds host terminal waiting and recovers completed artifacts after a collect ACK is lost when the current execution identity, durable receipts and exit proofs all match. Personal history explains accepted but ungraded executions and uses the bound task hash while preserving formal zero grades.

Authoritative build source is runtime/current at 96dd1b2. The rebuilt main wheel is byte-identical to the isolated installed candidate. CLI71 / Server12 installed-wheel checks passed locally and on Linux; Web21 targeted checks and real Chrome BFCache evidence are retained. Actual web Pro accepted the runtime candidates; the subsequent release-document clarification was locally verified and changes no runtime bytes.

PAIR_RELEASE.json and SHA256SUMS identify both components. Collection recovery is limited to a surviving parent with verified completed evidence; unknown evidence retains its fence. No historical result migration, model benchmark batch or valid-grade rerun is included. Production activation and online verification are recorded separately.

Paired recovery release v0.5.299

Paired single-task recovery release: CLI 0.5.299 / Server 0.1.2.post74.

Fixes exact-request retry recovery, stopped-state replay protection and immutable raw-record recovery. Invalid or out-of-range usage stays explicitly missing.

Build source is runtime/current at the exact target commit; historical root src is not the current package. Package hashes and paired source commits are in PAIR_RELEASE.json and SHA256SUMS. Installed-wheel targeted tests: CLI 9, Server 22. Web Pro accepted both fixed business candidates. This release does not authorize or resume paused benchmark runs.

Known limits: no full production benchmark E2E was run; a nonblocking prepare/stop race and legacy nonserializable raw-orphan repair remain documented.

Bandit unchanged official image source materials

Source and preserved-license materials for the unchanged official Bandit environment mirror.

Official source and GHCR manifest: sha256:7207179b09db76a8a3864b9e69c5fdf10e0d41a5bba242854216f18aa90ac7b1
Official config: sha256:24d48828a38a60d1a9773b464d25cb25ca94f0fa9a214b08faf2fde8446c2f75

Image config, original source labels and 26 layers are unchanged. Codex is installed only after container start. Official-image real-model qualification completed after the unchanged mirror copy and anonymous full pull. The new execution b1c7eb53fef84c3d9b2fe7d84abde818 ran GPT-6.1 Sol Low with Codex0.160.1 installed after startup, submitted original logs/results, and received one valid official score0 (F2P62/66, P2P293/293); model/grader/API resources exited. This is a completed qualification lifecycle, not a benchmark pass. The earlier derived-image execution and score remain preserved separately and are not attributed to this official image. No default promotion or public CLI/Server production change is made.

Companion source archives contain the exact installed Bun application source, patched WebKit library source/interface/build material, TinyCC plus the Bun patch/build controls, and the 15 minimal Linux native source inputs including ICU75.1 data and Node24.3.0 headers. Their versions, checksums and archive/export/test-gitlink boundaries are recorded in the receipts. Preserved system/runtime licenses and source indices are separate. Keep the materials available alongside the binary mirror while it is distributed.

No additional upstream permission, universal redistribution clearance, completed relink or hermetic rebuild is claimed. The user's accepted unresolved-material boundary is recorded; all third-party terms remain intact. No auth, private verifier, answer, model logs or databases are included.

DRadar egress proxy cd7a4dbde2ff8ad111d1576d55ec48e12d8c0d91

Signed multi-architecture Pier egress image. GHCR manifest: sha256:1ad68731863066481ed87890862bc0a4fe2139241bb612dab37aeb30b41ef0c4