vda5050-doctor v0.2.0 — Developer Preview

vda5050-doctor v0.2.0 — Synthetic Demo Preview

This release makes the evidence boundary visible end to end. An isolated Tier 1
harness creates a synthetic VDA 5050 reconnect incident, records the same MQTT
observations once, and shows why passive evidence remains INCONCLUSIVE while a
matching, trace-bound same-job manifest can support a synthetic FAIL.

The demo does not connect to customer software, a site broker, or a physical
robot. It is not a conformance suite, certification result, production finding,
or interoperability claim.

Highlights:

• an internal-only disposable Mosquitto topology with no host-published port;
• virtual fleet-control, mobile-robot, and recorder actors with bounded topics,
  retains, messages, duration, and actor count;
• trace-digest-bound actor, participant, session-epoch, capture-closure, and
  completeness assertions;
• a network-disabled Doctor container that analyzes the generated local trace;
• a fault/control comparison for reconnect state publication;
• MP4 and GIF views for 1, 2, 5, 10, 50, and 100 robots, rendered from actual
  trace payload x/y values; and
• a comparison MP4 and GIF overview of all six scales.

Important limitations:

• all actors, traces, assertions, and outcomes are synthetic;
• MQTT CONNECT and retained connection messages are deliberate side effects
  inside the disposable harness;
• the MP4 and GIF files are explanatory media and not source protocol evidence;
• no real customer trace, external DUT, shared broker, or physical robot was
  used; and
• this release remains a Developer Preview of an offline diagnostic tool.

The release contains exactly twenty assets: four native Doctor archives, one
binary-scoped CycloneDX SBOM, twelve per-scale fleet files, two overview files,
and SHA256SUMS. The checksum file covers the other nineteen. SLSA provenance
covers all nineteen checksummed payloads; the CycloneDX predicate intentionally
covers only the four Doctor archives.

Verify downloads:

gh release download v0.2.0 --repo ekusiadadus/vda5050-lab --dir vda5050-doctor-v0.2.0
cd vda5050-doctor-v0.2.0
sha256sum --check SHA256SUMS  # Linux; on macOS: shasum -a 256 --check SHA256SUMS

source_digest="$(git ls-remote https://github.com/ekusiadadus/vda5050-lab.git 'refs/tags/v0.2.0^{}' | cut -f1)"
test "${#source_digest}" -eq 40

archive="vda5050-doctor-v0.2.0-x86_64-unknown-linux-gnu.tar.gz"
gh attestation verify "$archive" \
  --repo ekusiadadus/vda5050-lab \
  --signer-workflow ekusiadadus/vda5050-lab/.github/workflows/release.yml \
  --signer-digest "$source_digest" \
  --source-ref refs/tags/v0.2.0 \
  --source-digest "$source_digest" \
  --deny-self-hosted-runners
gh attestation verify "$archive" \
  --repo ekusiadadus/vda5050-lab \
  --signer-workflow ekusiadadus/vda5050-lab/.github/workflows/release.yml \
  --signer-digest "$source_digest" \
  --source-ref refs/tags/v0.2.0 \
  --source-digest "$source_digest" \
  --deny-self-hosted-runners \
  --predicate-type https://cyclonedx.org/bom

video="vda5050-fleet-100-v0.2.0.mp4"
gh attestation verify "$video" \
  --repo ekusiadadus/vda5050-lab \
  --signer-workflow ekusiadadus/vda5050-lab/.github/workflows/release.yml \
  --signer-digest "$source_digest" \
  --source-ref refs/tags/v0.2.0 \
  --source-digest "$source_digest" \
  --deny-self-hosted-runners

See CHANGELOG.md, docs/DEMO.md, docs/PROTOCOL_SOURCES.md, and
docs/RELEASING.md for the diagnostic, safety, provenance, and publication
boundaries.

vda5050-doctor v0.1.2 — Developer Preview

vda5050-doctor v0.1.2 — Developer Preview

This is the first downloadable offline, evidence-bounded VDA 5050
trace-diagnosis preview. It accepts explicitly selected local JSON/JSONL
formats and explains what the observed trace supports, what remains unproven,
and which evidence to collect next.

v0.1.2 supersedes the immutable tag-only v0.1.0 and v0.1.1 attempts. No
release assets were published for either tag. The first stopped at annotated
tag validation; the second completed native builds and checksums but stopped
before publication because its CycloneDX document lacked the serialNumber
required by the pinned attestation action. This patch adds a deterministic
UUIDv5 serial number bound to the canonical SBOM body, source commit, tag, and
repository, then validates the guarded structure before attestation.

Highlights:

• five incident families and eight stable rule IDs;
• conservative order semantic comparison;
• explicit UNKNOWN/UNEVALUATED and INCONCLUSIVE outcomes;
• bounded hostile-input handling and safe output;
• deterministic JSON with embedded build/source provenance;
• Linux x86-64/Arm64, macOS Arm64, and Windows x86-64 archives;
• native contract-suite execution on every distributed platform;
• SHA-256 checksums, CycloneDX SBOM, and GitHub artifact attestations.

Important limitations:

• VDA 5050 3.0.0 only; 2.1.0 fails closed;
• no runtime source-bundle loading in diagnose yet;
• no real customer-trace pilot or production validation;
• no MQTT, robot control, simulation, certification, or safety claim.

Verify downloads:

gh release download v0.1.2 --repo ekusiadadus/vda5050-lab --dir vda5050-doctor-v0.1.2
cd vda5050-doctor-v0.1.2
sha256sum --check SHA256SUMS  # Linux; on macOS: shasum -a 256 --check SHA256SUMS
archive="vda5050-doctor-v0.1.2-x86_64-unknown-linux-gnu.tar.gz"
gh attestation verify "$archive" \
  --repo ekusiadadus/vda5050-lab \
  --signer-workflow ekusiadadus/vda5050-lab/.github/workflows/release.yml \
  --signer-digest 81f5973344efa04ae9f236e2f26aff156e305947 \
  --source-ref refs/tags/v0.1.2 \
  --source-digest 81f5973344efa04ae9f236e2f26aff156e305947 \
  --deny-self-hosted-runners
gh attestation verify "$archive" \
  --repo ekusiadadus/vda5050-lab \
  --signer-workflow ekusiadadus/vda5050-lab/.github/workflows/release.yml \
  --signer-digest 81f5973344efa04ae9f236e2f26aff156e305947 \
  --source-ref refs/tags/v0.1.2 \
  --source-digest 81f5973344efa04ae9f236e2f26aff156e305947 \
  --deny-self-hosted-runners \
  --predicate-type https://cyclonedx.org/bom

See CHANGELOG.md, README.md, and docs/PROTOCOL_SOURCES.md for the full
contract and provenance boundary.