D Research v3.2.0

D Research v3.2.0 is a major workflow, security, and reliability upgrade. Compared with v3.1.1—which focused on skill metadata compatibility—v3.2.0 upgrades the complete research lifecycle: planning, execution, evidence integrity, browser collection, synthesis, reporting, evaluation, and release verification.

Upgrade at a glance: schema-2.0 research plans, explicit execution gates, signed evidence ledgers, safer browser automation, deterministic resource limits, stronger citation/report validation, and a cross-platform release pipeline.

Highlights

• Research Workflow 2.0 — Separate research and synthesis phases with explicit plan_ready, execute_ready, synthesize_ready, and release_ready gates.
• Evidence you can audit — HMAC-signed ledgers, claim/process/blocker records, stable reproducibility assertions, and 100% authored-claim coverage before release.
• Safer public-data collection — Read-only browser enforcement, SSRF protection, robots and TLS policy, credential isolation, same-origin pagination, and bounded network/output usage.
• Production-grade reporting — Preserve authored narrative while generating evidence and references; reject unsupported claims, malformed references, unsafe paths, and invalid signatures.
• Deterministic quality controls — Structured dogfood and frontier benches, hostile-input fixtures, mutation checks, performance budgets, and fail-closed promotion validation.
• Reproducible delivery — Cross-platform CI, deterministic package boundaries, versioned source archives, SHA-256 checksums, archive replay, and build provenance.

What’s new since v3.1.1

Research planning and execution

• Introduces research-plan schema 2.0 with explicit research and synthesis task phases.
• Adds immutable approval fingerprints so changes to research intent automatically revoke stale approval.
• Adds portable output-tree locking to prevent duplicate, aliased, overlapping, or concurrently written task outputs across Windows and Unix-like systems.
• Replaces free-form completion checks with the canonical DRC-001–DRC-037 reproducibility contract.
• Adds a loss-preserving v1-to-v2 migration path with byte-for-byte backup, phase inference, custom-gate preservation, approval revocation, and re-rendering.

Evidence, citations, and reports

• Extends the evidence ledger with optional claim, process, and blocker record types.
• Requires real HMAC verification for signed-ledger gates through D_RESEARCH_LEDGER_KEY.
• Preserves the authored report narrative while regenerating bounded Evidence and References sections.
• Adds strict [ref:claim_id] linting, authored-claim coverage checks, and terminal synthesis-output requirements.
• Improves source scoring with separate base and adjusted totals, explicit review gates, and publication-based freshness.
• Hardens BibTeX/RIS export with deterministic unique keys, escaping, exactly one record terminator, and year-only normalization.

Browser, API, and access safety

• Adds connection-bound SSRF defenses for browser and direct-HTTP routes, including hostile redirects and IPv4-mapped IPv6 cases.
• Enforces read-only browser methods and blocks service-worker or WebSocket paths that could bypass the guarded request flow.
• Adds deterministic limits for request count, response size, aggregate network traffic, runtime, memory-sensitive extraction, and final output size.
• Strengthens robots handling, TLS verification, timeout behavior, credential redaction, cache isolation, and same-origin pagination.
• Prevents credential-bearing responses from entering shared caches unless private cache mode is explicitly selected.
• Records blocked access, truncation, and completeness limits instead of converting them into false success claims.

Evaluation and release engineering

• Adds schema-validated dogfood and frontier suites with 12 and 52 tasks respectively.
• Adds hostile-content, integrity, path traversal, credential leakage, false-completeness, degraded-runtime, and mutation regressions.
• Expands CI across Python 3.10–3.12 and Node.js 18/20/22, with real Chromium integration on Ubuntu and Windows.
• Adds deterministic package-manifest validation, clean archive replay without .git, SHA-256 verification, and GitHub provenance attestation.
• Adds exact-SHA and annotated-tag binding so release evidence cannot be reused for another revision.

Compatibility and upgrade

• Python: 3.10 or newer
• Node.js: 18 or newer
• Browser runtime: Playwright 1.61.1 (locked)
• Existing schema-v1 plans remain readable until v4, but migration is required before using the new synthesis and release gates.
• In-place migration creates research-plan.json.bak and revokes the previous approval. Review, render, and approve the migrated plan again before execution.
• Signed-ledger gates require D_RESEARCH_LEDGER_KEY; never store this key inside the research workspace.

See the v3.1.1 → v3.2.0 upgrade guide for Bash and PowerShell migration steps, verification, and rollback.

Verification

• 23/23 required local release checks passed.
• 27/27 adversarial acceptance scenarios passed.
• All 14 real-browser smoke scenario groups passed.
• Deterministic quality evaluation passed 3/3 runs.
• Promotion anti-spoof suite passed 46/46 checks.
• Python 3.10–3.12, Node.js 18/20/22, Ubuntu Chromium, and Windows Chromium CI passed on the exact release SHA.
• Dependency audit reported 0 moderate-or-higher vulnerabilities.
• Source archive replay, checksum verification, and GitHub provenance attestation passed.

Downloads

GitHub provides the standard Source code (zip) and Source code (tar.gz) archives generated from the v3.2.0 tag.

Release assurance and residual risk

The stable release is bound to commit 8156b460b358636e69d66c10c16800045d258446 and the audited candidate 2974893c77415686b6bcd1d05b6b1f6738a4f320.

The version-scoped maintainer decision records four external assurances that were explicitly waived rather than represented as completed work: GitHub-verified candidate and stable tag signatures, an independent GitHub reviewer, and uncontaminated live Tier-1/Tier-2 dogfood against v3.1.1.

Annotated tags, candidate ancestry, exact-SHA CI, semantic metadata freeze, archive replay, SHA-256 verification, and provenance attestation were non-waivable and passed.

CI evidence: candidate matrix, stable matrix, and source archive/provenance.

Full changelog: v3.1.1...v3.2.0 · Detailed v3.2.0 notes