vda5050-doctor v0.2.0 — Developer Preview

vda5050-doctor v0.2.0 — Synthetic Demo Preview

This release makes the evidence boundary visible end to end. An isolated Tier 1
harness creates a synthetic VDA 5050 reconnect incident, records the same MQTT
observations once, and shows why passive evidence remains INCONCLUSIVE while a
matching, trace-bound same-job manifest can support a synthetic FAIL.

The demo does not connect to customer software, a site broker, or a physical
robot. It is not a conformance suite, certification result, production finding,
or interoperability claim.

Highlights:

• an internal-only disposable Mosquitto topology with no host-published port;
• virtual fleet-control, mobile-robot, and recorder actors with bounded topics,
  retains, messages, duration, and actor count;
• trace-digest-bound actor, participant, session-epoch, capture-closure, and
  completeness assertions;
• a network-disabled Doctor container that analyzes the generated local trace;
• a fault/control comparison for reconnect state publication;
• MP4 and GIF views for 1, 2, 5, 10, 50, and 100 robots, rendered from actual
  trace payload x/y values; and
• a comparison MP4 and GIF overview of all six scales.

Important limitations:

• all actors, traces, assertions, and outcomes are synthetic;
• MQTT CONNECT and retained connection messages are deliberate side effects
  inside the disposable harness;
• the MP4 and GIF files are explanatory media and not source protocol evidence;
• no real customer trace, external DUT, shared broker, or physical robot was
  used; and
• this release remains a Developer Preview of an offline diagnostic tool.

The release contains exactly twenty assets: four native Doctor archives, one
binary-scoped CycloneDX SBOM, twelve per-scale fleet files, two overview files,
and SHA256SUMS. The checksum file covers the other nineteen. SLSA provenance
covers all nineteen checksummed payloads; the CycloneDX predicate intentionally
covers only the four Doctor archives.

Verify downloads:

gh release download v0.2.0 --repo ekusiadadus/vda5050-lab --dir vda5050-doctor-v0.2.0
cd vda5050-doctor-v0.2.0
sha256sum --check SHA256SUMS  # Linux; on macOS: shasum -a 256 --check SHA256SUMS

source_digest="$(git ls-remote https://github.com/ekusiadadus/vda5050-lab.git 'refs/tags/v0.2.0^{}' | cut -f1)"
test "${#source_digest}" -eq 40

archive="vda5050-doctor-v0.2.0-x86_64-unknown-linux-gnu.tar.gz"
gh attestation verify "$archive" \
  --repo ekusiadadus/vda5050-lab \
  --signer-workflow ekusiadadus/vda5050-lab/.github/workflows/release.yml \
  --signer-digest "$source_digest" \
  --source-ref refs/tags/v0.2.0 \
  --source-digest "$source_digest" \
  --deny-self-hosted-runners
gh attestation verify "$archive" \
  --repo ekusiadadus/vda5050-lab \
  --signer-workflow ekusiadadus/vda5050-lab/.github/workflows/release.yml \
  --signer-digest "$source_digest" \
  --source-ref refs/tags/v0.2.0 \
  --source-digest "$source_digest" \
  --deny-self-hosted-runners \
  --predicate-type https://cyclonedx.org/bom

video="vda5050-fleet-100-v0.2.0.mp4"
gh attestation verify "$video" \
  --repo ekusiadadus/vda5050-lab \
  --signer-workflow ekusiadadus/vda5050-lab/.github/workflows/release.yml \
  --signer-digest "$source_digest" \
  --source-ref refs/tags/v0.2.0 \
  --source-digest "$source_digest" \
  --deny-self-hosted-runners

See CHANGELOG.md, docs/DEMO.md, docs/PROTOCOL_SOURCES.md, and
docs/RELEASING.md for the diagnostic, safety, provenance, and publication
boundaries.