v1.5.0

Canary v1.5.0

A reliability and evidence-integrity release. v1.5 closes the seven findings of an independent audit and
hardens the separation between what this project claims and what it has actually measured. It adds no
new feature area.

What changed

Seven audited product defects are fixed with adversarial regressions:

• A rewritten existing check no longer inherits independent authority — provenance is decided by git
  (addedChecks vs new modifiedChecks), and both are worker-authored evidence.
• Token accounting refuses mixed ledgers — a cell counts only on a completed provider-native ledger, and
  a run counts only if all its cells share one instrument digest. (This is why the previous token
  headline was withdrawn — see below.)
• --from-saved is HISTORICAL, not a current PASS — exit 2, every row labelled, and it prints its own
  disproof; a failed live battery exits 4.
• One attempt per output directory, with refusal on existing evidence.
• LOCAL is stated as same-user / operator-selected, not as worker-independent proof; HARDENED remains
  the worker-independent path.
• The sealed step no longer loses python / java / git and blame the project — an
  operator-authorized toolchain directory is appended after the trusted dirs (never in front), and an
  unresolvable program is attributed with SEALED ENV CANNOT RESOLVE instead of PROJECT CHECK FAILURE.
• A legitimate sealed-script check outside a test path is no longer a false red — the discrimination
  surface is anchored to a sealed plan script's text instead of a path heuristic. Less false red, no more
  false green.

Evidence

Gate	Result
CI 36168541720 (head d3f6a9c)	all six legs SUCCESS
Windows core leg	1,211 tests — 1,206 pass, 0 fail, 5 skipped, 0 cancelled, 0 todo, zero not ok; terminal, not timed out
HARDENED boundary, live	6/6 controls measured — every control re-derived from native return values and broker transcripts
Unit suite (e51b6fc)	1,284 pass, 0 fail, 4 skipped
Productization battery (e51b6fc)	104 PASS / 0 FAIL / 3 SKIP
Unit suite (released head, after the version bump)	1,284 pass, 0 fail, 4 skipped
Productization battery (released head)	106 PASS / 0 FAIL / 3 SKIP

HARDENED means one thing only: a boundary measurement in which every control was observed available. A
host that cannot confine is reported HOST UNSUPPORTED — never a pass.

Audit and trust improvements

• A claim/evidence matrix in which every public claim carries one of five statuses, its reproduction
  command, and its limitation — including the claims this release explicitly does not make.
• A public audit kit written for a reviewer who did not build Canary, listing the author's own weakest
  points.
• A tripwire (tooling/probes/v15-evidence-consistency.mjs) that fails when a withdrawn figure is
  presented as current, when a retired statement reappears, or when a required statement of the current
  truth disappears.
• The token headline is withdrawn with no replacement rather than quietly restated: the corrected data
  has two COMPLETE runs that disagree in sign (80.74 % / −19.26 % and 102.91 % / +2.91 %), and at n=1 per cell
  this benchmark cannot resolve an effect of that size in either direction.

Known limitation — an unresolved, unexplained containment-sweep failure

One hosted Windows run failed sweepDescendants finds and kills a live parent's child process
(sweep killed [7564] but not 2144, duration_ms 35980). Four consecutive runs since have been green, and
that green is not presented as a fix:

• no product change was made between the failing run and the green ones — the only delta is a
  diagnostic in a test failure message, which cannot change product behaviour;
• the improved diagnostic emitted no output at all in the green runs, because its failure path never
  fired;
• 14 local reproduction attempts (idle, 48-way CPU load, 2-core pinning) could not reach it.

A missed descendant is a containment concern. It is recorded as OPEN / UNEXPLAINED / NOT FIXED rather
than re-rolled until it looked green, and it is the first target for the next audit.

Operational note

The Windows core leg ran 224.1 min here against 170.9 min on the previous green (e51b6fc) — about
31 % slower, leaving roughly 76 min of headroom under the 300-min cap. Whether that is runner
variance, host load or something in these bytes is not established; it is not classified as a product
defect, and the timeout was not raised.

Docs

• docs/AUDIT-KIT-1.5.md — attack this release
• docs/CLAIM-EVIDENCE-MATRIX-1.5.md — every claim and its limits
• docs/POST-AUDIT-CLOSURE-1.5.md — the seven findings, fixes and regressions
• docs/HARDENED-1.5.md — what the boundary does and does not protect