Skip to content

vda5050-doctor v0.1.2 — Developer Preview

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Aug 01:50
v0.1.2
81f5973

vda5050-doctor v0.1.2 — Developer Preview

This is the first downloadable offline, evidence-bounded VDA 5050
trace-diagnosis preview. It accepts explicitly selected local JSON/JSONL
formats and explains what the observed trace supports, what remains unproven,
and which evidence to collect next.

v0.1.2 supersedes the immutable tag-only v0.1.0 and v0.1.1 attempts. No
release assets were published for either tag. The first stopped at annotated
tag validation; the second completed native builds and checksums but stopped
before publication because its CycloneDX document lacked the serialNumber
required by the pinned attestation action. This patch adds a deterministic
UUIDv5 serial number bound to the canonical SBOM body, source commit, tag, and
repository, then validates the guarded structure before attestation.

Highlights:

  • five incident families and eight stable rule IDs;
  • conservative order semantic comparison;
  • explicit UNKNOWN/UNEVALUATED and INCONCLUSIVE outcomes;
  • bounded hostile-input handling and safe output;
  • deterministic JSON with embedded build/source provenance;
  • Linux x86-64/Arm64, macOS Arm64, and Windows x86-64 archives;
  • native contract-suite execution on every distributed platform;
  • SHA-256 checksums, CycloneDX SBOM, and GitHub artifact attestations.

Important limitations:

  • VDA 5050 3.0.0 only; 2.1.0 fails closed;
  • no runtime source-bundle loading in diagnose yet;
  • no real customer-trace pilot or production validation;
  • no MQTT, robot control, simulation, certification, or safety claim.

Verify downloads:

gh release download v0.1.2 --repo ekusiadadus/vda5050-lab --dir vda5050-doctor-v0.1.2
cd vda5050-doctor-v0.1.2
sha256sum --check SHA256SUMS  # Linux; on macOS: shasum -a 256 --check SHA256SUMS
archive="vda5050-doctor-v0.1.2-x86_64-unknown-linux-gnu.tar.gz"
gh attestation verify "$archive" \
  --repo ekusiadadus/vda5050-lab \
  --signer-workflow ekusiadadus/vda5050-lab/.github/workflows/release.yml \
  --signer-digest 81f5973344efa04ae9f236e2f26aff156e305947 \
  --source-ref refs/tags/v0.1.2 \
  --source-digest 81f5973344efa04ae9f236e2f26aff156e305947 \
  --deny-self-hosted-runners
gh attestation verify "$archive" \
  --repo ekusiadadus/vda5050-lab \
  --signer-workflow ekusiadadus/vda5050-lab/.github/workflows/release.yml \
  --signer-digest 81f5973344efa04ae9f236e2f26aff156e305947 \
  --source-ref refs/tags/v0.1.2 \
  --source-digest 81f5973344efa04ae9f236e2f26aff156e305947 \
  --deny-self-hosted-runners \
  --predicate-type https://cyclonedx.org/bom

See CHANGELOG.md, README.md, and docs/PROTOCOL_SOURCES.md for the full
contract and provenance boundary.

Assets 8
Loading