SemanticCompute v1.23.0

Warning

The v1.23.0 MCP server assets were withdrawn on 21 September 2026. Its tools/call required a licence, but
resources/read (the family catalogue, the zoo and the build identity) and prompts/get answered without one.
The macOS, Linux and .mcpb MCP downloads and their container image are superseded by v1.24.0, which licenses
every content-serving method while leaving discovery open. The semanticcompute-parity and semanticcompute-live
binaries below were unaffected: both refuse to run without an entitlement. SHA256SUMS.txt still lists the
withdrawn files so the record of what was published stays intact.

SemanticCompute v1.23.0 — licensed distribution, exact audit families, and live verification

SemanticCompute 1.23.0 turns the post-1.22 engineering work into a coherent commercial release. It adds five
catalogued exact-integer/storage families, including three complete-audit families, a bounded Live byte-parity service,
typed MacResilience MCP adapters, a hash-only entitlement control plane, and fail-closed licensing in every native
distribution executable. The catalogue now contains 188 families and the MCP server exposes 20 tools.

The native release remains a numerical verification substrate. It does not claim that arbitrary Swift, arbitrary
MSL, recursive documents, filesystem traversal, or remote repositories can be converted into safe GPU kernels.
Host work remains explicit, CPU reference truth remains authoritative, and every GPU family retains a stated
semantic contract and parity gate.

Commercial distribution and entitlement lifecycle

The public semanticcompute-parity, semanticcompute-mcp, and semanticcompute-live binaries are compiled with
SC_COMMERCIAL_DISTRIBUTION. Compute operations fail closed unless all of the following are true:

• SEMANTICCOMPUTE_LICENCE_KEY contains an active sc_lic_… entitlement;
• the binary carries the exact 40-character source commit stamped during the release build;
• the entitlement has not expired or been disabled;
• a metered plan has remaining credits;
• the persistent installation identity is within the entitlement's device ceiling; and
• the licence service can authorise the named executable and operation.

Help, version output, MCP initialization/tool discovery, and Live health remain available for diagnosis. The key
is sent only in an HTTPS Authorization header to the configured SemanticCompute licence service. The server
stores a peppered key hash and SHA-256 device hashes, never the plaintext key. The plaintext key appears once in
the authenticated issue response.

The sales-assisted administration API can now issue, inspect, renew, reactivate, disable, and reset device
bindings. Renewal extends from the later of the current expiry or the current time, can add bounded credits, and
refuses to lower the device ceiling beneath current usage. Issue, renewal, disable, and device-reset operations
are recorded in the licence_admin_events audit table. Key rotation remains explicit: issue a replacement, deliver
it securely, then disable the old entitlement.

The release gate runs both sides of the contract against the exact packaged bytes:

1. no licence key must refuse CLI, MCP, and Live execution; and
2. a dedicated internal release-canary entitlement must authorise and execute all three products.

Source builds do not define SC_COMMERCIAL_DISTRIBUTION and continue to follow the repository's Business Source
License terms. This technical gate controls 1.23.0 and later distribution builds; it cannot revoke legacy binaries
that were already downloaded.

New exact families for storage, checkout, and resilience analysis

The catalogue grows from 183 to 188 families with exact evidence lanes designed for large checkout/storage data
sets:

• APFSMetadataChecksum validates APFS object-block Fletcher-64 checksums from explicit byte spans, excluding the
  stored checksum field and reporting valid, mismatch, invalid-span, or invalid-length status.
• VariableSpanSetOverlap compares host-normalised sorted spans and produces exact overlap evidence without
  converting offsets or counts through floating point.
• BatchedSourceLineLexicalEvidence scans explicit byte-rule tables over bounded source lines.
• SegmentedStableUInt64OrderingRanks assigns deterministic ranks with path and input-order tie breaks.
• BatchedNormalisedByteSpanSearch searches host-normalised byte spans without materialising enormous UI trees.

Existing family surfaces also gain exact variants: GraphAdjacencyCSR adds UInt32 degree and neighbor operations,
linear assignment adds a sparse lexicographic evidence variant, and rolling statistics exposes irregular-time
growth analysis. Host-side CSRGraphComponents supplies stable weak/strong components, condensation edges,
topological strata, and cycle witnesses; IrregularTimeGrowthBurst abstains explicitly on insufficient coverage,
identity changes, long gaps, and counter decreases.

Filesystem traversal, Unicode normalisation, persistence, deletion policy, and UI virtualization remain host
responsibilities. The families consume bounded, explicit buffers and return inspectable evidence.

SLUInt64Pair defines a stable two-UInt32 ABI for exact offsets, checksums, and byte counts. The compatibility
doctor and sc_check_integer_parity compare these values bit-for-bit without JSON/Double precision loss.

MacResilience and typed MCP integration

The MCP server adds bounded typed adapters for APFS checksum validation, CBOR preflight, CDDL validation,
variable-span overlap, sparse assignment, graph components/layout, and irregular growth evidence. The current
20-tool manifest is generated from one source for both release packaging paths, declares the licence key as a
sensitive required input, and is validated before the MCPB is accepted.

sc_detect_in_code now reports the rule-set digest, SemanticCompute version/build, exact matched line, family
symbols, and a reason when it abstains. sc_list_families includes the full registered catalogue, including the
previously omitted whole-token family.

Correlation contract fix for DICOM perfusion callers

BatchedCorrelation now exposes the same canonical binding names through discovery, semantic contracts, the CPU
reference, and Metal lowering: ref, signals, refLength, signalLength, numLags, and batchCount. Tests pin
the mirrored contract and the existing perfusion-safe role ordering, preventing callers from silently reversing
the reference curve and signal batch.

SemanticCompute Live and hosted-trial boundary

semanticcompute-live provides a bounded bearer-protected POST /v1/check/bytes endpoint. It validates a strict
JSON/canonical-Base64 envelope, executes the catalogued exact byte comparison, localises the first mismatch, and
returns a semanticcompute.live.byte-parity-receipt/1 receipt containing service, engine, build, input digest, and
result identity. The current attestation is deliberately labelled digest-only; it detects later modification
but is not a server signature.

The Cloudflare Worker/D1 control plane adds hash-only trial tokens, fixed credits and byte limits, atomic credit
reservation, idempotent replay, runner-credential isolation, receipt/input binding, and refunds for runner or
receipt failure. Twenty Worker unit tests and a real local Wrangler + D1 + Swift-runner integration cover the
control plane and entitlement lifecycle.

The deployed public endpoint currently reports control-plane-only. No public CPU runner, NVIDIA runner, or
paid hosted execution is claimed by this release. Enabling the browser trial remains gated on a pinned runner and
a successful public canary receipt.

Docker MCP distribution

Integrations/DockerMCP/Dockerfile builds a non-root, statically linked, licensed MCP image for Linux/amd64 and
Linux/arm64. It requires and embeds the exact release commit, persists only the installation identifier in a named
volume, and needs access only to the licence host. server.yaml declares the sensitive Docker MCP secret, named
device volume, and host allow-list.

The tag workflow publishes ghcr.io/entertrainment/semanticcompute-mcp:1.23.0 as a multi-architecture image with
BuildKit SBOM/provenance attestations and signs the immutable digest through GitHub OIDC/cosign. Production Docker
MCP catalogs should pin that digest after the workflow completes.

The private Cloudflare Live runner image is a separate metered execution component and is not published as an
unrestricted customer binary.

CUDA evidence

The recorded CUDA evidence remains scoped to the emitted specimens that actually executed. The 1.23 evidence
records 17 optional CUDA-package tests across three suites on an RTX 4070 Ti SUPER, including odd extents, folded
4D coordinate payloads, early returns, NaN/infinity handling, UInt marshalling, loop accumulation, and Float-vector
helpers under the documented precise-math flags. This is device parity for the covered kernels and configuration;
it is not a claim that every family has a CUDA runtime adapter.

Release artifacts

The GitHub release helper requires and checksums the same 15 native/evidence assets:

• macOS universal, Developer-ID signed and notarised: MCP tarball, MCPB, parity CLI, and Live tarball;
• Linux x86-64: MCP, parity, and Live tarballs;
• Linux AArch64: MCP, parity, and Live tarballs;
• NOTICE, CycloneDX SBOM, CUDA compile evidence, CUDA device-parity evidence, and SHA256SUMS.txt.

Release automation verifies version/tag/source alignment, universal architectures, signatures, notarisation,
archive payload identity, Linux architecture, exact checksums, MCPB manifest/tool coverage, fail-closed behavior,
and licensed execution before publication. It then downloads the published macOS assets and byte-compares them
with the reviewed local candidates.

Agent setup

All clients launch the same stdio executable and receive the same 20...

SemanticCompute v1.22.1

Distribution notice

The downloadable SemanticCompute binaries for this release are unavailable. SemanticCompute is commercial software; licensed builds are issued to customers and authorised trial users. View plans or request access. These notes remain available as the historical record of the release.

SemanticCompute v1.22.1 — texture truth, FDN reverb, bounded CBOR-LD, and the complete binary cut

SemanticCompute 1.22.1 is the complete public distribution of the work shipped since 1.20.0: the Imager
texture-validation lane, executable semantic texture kernels, an FDN late-reverb family, the adversarial stress
lab, and twelve structured-data families for CBOR-LD consumers. The catalogue moves from 170 families in 1.20.0
to 183. The patch number records a distribution repair: 1.22.0's source was tagged and its macOS binaries were
signed and notarised, but its public release omitted both Linux architectures, checksums, the SBOM, notice and
CUDA evidence, while the public landing page still presented the 1.13.0 surface.

This cut makes source commit and artifact identity one contract. Each Linux binary is built natively by the tag
CI job, stamped with that exact commit, smoke-tested before packaging, and rejected if its payload architecture
does not match its filename. The macOS pair is built universal, signed on a system-volume copy, verified across
both slices, notarised, and checked again after archive extraction. Publication refuses an incomplete asset set.

Added

External texture validation for complete consumer shaders

SLExternalMSLTextureValidator and the MCP tool sc_validate_metal_texture accept complete consumer-owned MSL,
raw input buffers, an output texture description and an independently supplied CPU reference. They compile,
dispatch, read back rgba16Float or rgba32Float, and compare row-major RGBA channels through
SLCompatibilityDoctor. Preflight, compilation, dispatch, readback and parity each report executed, skipped,
unavailable or failed with a reason, so a compile-only observation cannot turn into a pixel-parity claim.

The lane came from Imager's procedural phase-scope and texture-writing kernels. Those kernels already contain
their computation in MSL; their problem was the absence of a substrate-level way to execute the complete shader
and compare its pixels. The validator is that bridge. It does not claim an arbitrary semantic contract can invent
an executable body, and it does not smuggle consumer-specific shader meaning into the semantic IR.

Generic pointwise2D texture-writing execution

A legal SLKernel whose body reads or writes texture2D<Float4> now passes through the normal optimisation and
lowering front door to executable texture2d<float> MSL. Texture indices survive lowering, Metal's texture
argument namespace is represented in SLBackendBinding, and MetalRuntimeAdapter binds caller-owned
MTLTexture objects. Dispatch derives from the writable texture's intrinsic extent and refuses mismatched shapes.
The CPU texture executor and an exact CPU-to-Metal passthrough fixture close the reference-to-device loop.

The supported semantic subset is deliberately stated: pointwise2D Float4 reads and writes. Samplers, filtered
coordinates, other texture dimensions and formats, and texture execution on non-Metal backends remain explicit
gaps. A contract describes access and effects; SLKernel.body remains the executable source.

FDN late reverb

The new FDN late-reverb family is a configurable feedback-delay network built around a Householder feedback
matrix. It carries per-line decay gains, one-pole damping, wet/dry mix and explicit state across processing
blocks. The state boundary is part of the family rather than hidden in a host object: callers can prove a split
block and a continuous block mean the same thing under the stated contract.

The family ships through the full SemanticCompute path: deterministic CPU reference, semantic contract,
legality, derived read/write effects, generic Metal lowering, catalogue and usage-guide discovery, and audio/state
parity tests. It extends the signal/DSP lane without introducing a second audio engine.

Recursive adversarial stress lab

SC_STRESS=quick|full Tools/stress.sh sweeps the entire family library rather than replaying one friendly fixture.
Its four tiers cover every catalogued lowering over an adversarial shape ladder; CPU-to-Metal execution under
input hazards with automatic divergence shrinking; random well-typed IR through Metal and portable C; and
catalogue-to-guide-to-symbol-index coverage. Reports state what did not execute as well as what failed.

The first quick run found 394 tier-B and three tier-C criticals. They were not converted into green by widening a
tolerance. The lab instead drove fixes for NaN ordering, degenerate atan2, FMA association, undispatchable
threadgroups, singleton windows, binding lifetime, resize interpolation, stencil literals and family discovery.

Twelve CBOR-LD and structured-data families

Whole JSON/CBOR documents are recursive, allocate dynamically and may load remote contexts asynchronously. Those
operations do not fit a dense GPU dispatch. The new lane therefore introduces SLStructuredValue at the host
boundary and freezes it into fixed-width nodes, child indices and a byte pool under explicit depth, node and byte
limits. Device work sees bounded buffers; the CPU reference remains the authority for recursion, I/O and rich
diagnostics.

The twelve catalogued families are:

1. Batched SHA-256 (variable byte spans). One bounded sequential SHA-256 walk per record, producing eight
   exact UInt32 digest words. The batch dimension is parallel; block order within a digest is not reassociated.
2. Byte diff (mismatch mask / count / first mismatch). Exact unsigned-byte comparison with a per-byte mask,
   mismatch count and first divergent offset, so encoded output failures are localised rather than reported as a
   single false value.
3. Batched CBOR structural scan. A bounded parser for definite-length records that reports token count,
   maximum nesting depth and malformed status. Indefinite and reserved lengths refuse instead of being guessed.
4. UInt prefix scan and stream compaction. Exact UInt32 exclusive scan plus a stable keep-mask compaction,
   used by measured-size and output-offset stages.
5. Byte histogram and Shannon entropy. A 256-bin exact byte histogram with host-side entropy derived from the
   counts, keeping the integer accumulation separate from its floating-point interpretation.
6. Segmented canonical CBOR key ordering. RFC 8949 deterministic length-first unsigned-byte ordering with
   input position as the exact-duplicate tie-break.
7. Batched UTF-8 validation. A strict state walk that catches overlong forms, surrogate encodings, truncation
   and invalid continuation bytes before text enters CBOR-LD processing.
8. Batched Base58 / multibase codec. Bitcoin-alphabet Base58 plus the z multibase prefix, using bounded
   grade-school conversion and a caller-supplied output stride. The device encoder refuses records beyond its
   declared ceiling rather than overwriting the next lane.
9. Batched unsigned varint codec. Exact variable-width UInt encoding/decoding with explicit per-value lengths.
10. Frozen context / type-table probe. Deterministic lookups against a table frozen before dispatch, with an
    explicit missing sentinel instead of mutable dictionary state.
11. Whole-document CBOR-LD plan. CBORLDDocumentReference.prepare loads supplied contexts asynchronously,
    inherits term maps, rewrites known keys, flattens under limits, performs an exact measure/scan/allocation pass
    and writes deterministic RFC 8949 CBOR. Its device lowering operates only on the already-frozen key plan.
12. CDDL parse + flat validation VM. Grammar parsing, AST construction, recursive validation, regex controls
    and path-rich diagnostics stay on the CPU. Supported root-kind, required-key and signed-32-bit range checks
    compile to a bounded exact-integer instruction stream for batch execution.

Every device stage has a deterministic CPU reference, exact Byte/UInt32 comparison, semantic contract, legality,
Metal lowering, catalogue and usage-guide entries, compile-sweep coverage and bit-exact Apple-GPU fixtures. The
release benchmark runs the same flat CDDL instruction stream over 32K documents with a dead-code-elimination
barrier: 240.9 microseconds, 136.0 million elements per second and 4.93x over the matching CPU flat-plan oracle on
the release machine. That number is evidence for this bounded plan, not a promise for arbitrary document loading.

Changed

The 1.21 texture work preserves the complete 1.20 public API. Texture dispatch is an overload; existing
buffer-only dispatch, dispatchBatch and SLBackendProgram initialisers remain. The backend reuses the existing
semantic texture binding kind, and swift package diagnose-api-breaking-changes v1.20.0 found no breaking API.

The backend contract now records what Metal actually did rather than what its .safe label appeared to promise.
In a 65,536-input probe, the single expression a*b+c fused on 14,269 inputs while a separately stored product
fused on none. BACKENDS.md records contraction scope, the toward-zero Float representation of pi, subnormal
comparison behaviour, the degenerate atan2 boundary, encoder lifetime on errors and undispatchable geometry.

Linux releases now use native tag-CI jobs for both x86-64 and AArch64. Both products statically link the Swift
runtime, keep glibc dynamic, run the failure lab before packaging and expose their exact source commit through
--version/sc_version. The public installer selects the matching architecture instead of silently labelling an
emul...

SemanticCompute v1.22.0

Distribution notice

The downloadable SemanticCompute binaries for this release are unavailable. SemanticCompute is commercial software; licensed builds are issued to customers and authorised trial users. View plans or request access. These notes remain available as the historical record of the release.

Universal (arm64 + x86_64) macOS binaries — signed (Developer ID) and notarised.

SemanticCompute v1.20.0

Distribution notice

The downloadable SemanticCompute binaries for this release are unavailable. SemanticCompute is commercial software; licensed builds are issued to customers and authorised trial users. View plans or request access. These notes remain available as the historical record of the release.

SemanticCompute v1.20.0 — the FIR design lane, and three consumer defects fixed

A minor: two additive families (catalogue 168 → 170) closing the FIR design gap, plus a Kaiser
window and the Bessel I₀ underneath it — and the three defects an audio and a radiomics consumer
reported against 1.19.0, all reproduced here before being touched.

The lane exists because of one number. A consumer's own Remez engine reported delta = 8.9e-16 on a
filter measured +22.6 dB off spec. A designer cannot check itself: δ is a self-report about the
extremal set the exchange currently believes in, and if that set is wrong, δ is small and the filter
is wrong. Everything below is shaped around that.

Added

Equiripple FIR design (Parks–McClellan/Remez exchange, Type I/II) — the optimal designer. δ in
closed form from the barycentric weights, A(ω) as a barycentric Lagrange interpolant (no
Chebyshev–Vandermonde system, so nothing to condition badly), and the alternation set taken as the
peak of every constant-sign run of the weighted error. Fewer than r+2 alternations is REFUSED,
never padded out of the grid — padding is exactly how a missed spec comes back as a tiny δ. Measured
on a 61-tap lowpass: δ = 0.0014995 against realised band deviations of 0.0015113 and 0.0015070, and a
realised stopband of −56.44 dB against the −56.48 dB δ claims.

The external check ships with it. amplitudeResponse and bandDeviations evaluate the taps that
actually came out, through the Batched DTFT family, at frequencies the caller chooses rather than the
grid the design already agreed with itself about. The imaginary residual comes free and is a
linear-phase assertion without inspecting a single tap: 2.6e-6 worst on a 61-tap design.

Windowed-sinc FIR design — the predictable designer beside it, host-only like the RRC family.
Kaiser's own order formula is an estimate and measurably undershoots (59.3 dB for a 60 dB ask,
79.9 for 80), so kaiserDesignMeetingSpec designs, MEASURES, and grows the filter until the spec is
actually met — 60 dB needs 77 taps, 80 dB needs 111, 100 dB needs 139 — or refuses. The raw formula
is left as Kaiser's formula rather than quietly fudged.

WindowOp.kaiser and BesselReference. I₀ ships in two implementations that deliberately
disagree: Abramowitz–Stegun 9.8.1/9.8.2 in Float is the parity surface, and i0Exact is the ascending
series in Double run to convergence — the oracle, and the direct fix for a caller whose own besseli0
stopped at three terms. Measuring instead of quoting paid: A&S's published bounds hold comfortably in
exact arithmetic (3.3e-8, 8.4e-8) but the Float evaluation is ~8× worse (2.77e-7, 2.84e-7), so
what ships is dominated by the evaluation, not the approximation.

Both designers refuse an even-length highpass or bandstop — Type II carries a forced zero at Nyquist,
so that filter does not exist. At 61 taps and the same transition, equiripple reached −56.4 dB where
Kaiser windowed-sinc reached −36.7.

Changed

There is no DPSS/Slepian window, and the catalogue used to imply there was. sineTaper is a
Riedel–Sidorenko sine taper; the old "DPSS-like" wording plus dpss/slepian keywords led a consumer
surveying the library to report DPSS as shipped. Those keywords are gone and the file says so where it
cannot be missed.

The Window family gains the parityContract it never had — and writing it exposed that the cosine
windows are the worst ULP offenders, not the Bessel-backed one: hannPeriodic 1024 ULP on a value of
5.9e-4 near a zero, kaiser 14 ULP at 0.95 and the largest absolute error in the table. Those two
columns rank the ops in opposite orders, which is the argument for a combined absolute/relative bar
over a scale-free ULP one — now written down rather than assumed.

A gate flips rather than being deleted. SuggestionAbstentionTests asserted "SC ships FIR APPLY,
not FIR design — the top hit must sit below the abstention floor rather than masquerade as an answer",
on the very query that forged the floor. It now asserts the opposite, plus that every term the
consumer's survey found zero hits for — remez, parks-mcclellan, equiripple, minimax, alternation —
resolves. The flip is the evidence the gap closed; deleting the gate would lose the record it was real.

sc_detect_in_code learns three shapes: a named Remez exchange, a windowed-sinc designer (requiring a
band-spec term alongside the sinc, so a resampling kernel does not fire), and a hand-rolled Kaiser or
Bessel I₀.

Fixed

MarchingCubesMesh.surface returned a closed but INCONSISTENTLY WOUND mesh. The radiomics
consumer measured a divergence volume of 437 mm³ against IBSI's 556 ± 4 while the AREA agreed
(386.31 vs 388 ± 3), found 64 unpaired directed edges, and concluded holes. There were none: closure
was already perfect, and 158 directed edges per mesh had no opposite twin. Area is unsigned, which is
why it survived and hid the fault; every signed quantity did not. surface now propagates winding
across shared edges and fixes each component's sign outward, and enclosedVolume is added. The sphere
fixture went from 40% of analytic to 99.6%. A second defect is preserved in the header: welding
vertices by quantised POSITION splits crossings two cubes compute 1 ULP apart and strands the
propagation — identity is grid-edge PROVENANCE.

HarmonicFreqEKF walked its amplitude state negative and could never recover. Predicting
log(|a| + eps) against a caller's log(amplitude) gave an exactly-consistent state a permanent
−0.693 innovation at a = eps, against a Jacobian of 500,000; the unsigned Jacobian then made the
resulting excursion unrecoverable. Pre-fix, the constant-amplitude fixture returned −252.7 for a
truth of 1e-6.

HarmonicF0EKF tracked f0 in linear Hz against a log2 measurement, and one outlier killed the track
permanently. Once f0 ≤ 0 the clamped Jacobian drives the gain to zero, so the filter does not
mis-track — it stops correcting. The state is now log2(f0), which makes the measurement the identity
and positivity structural. Pre-fix, the octave-flip fixture left only 40 of 120 frames positive.
Parameter semantics changed: initVarF/initVarV/accelVar are now log2-domain (octaves);
baseMeasVar and the Hz output are unchanged. Callers passing Hz-domain variances must retune.

Both EKF fixes are mirrored into the Metal lowerings, so parity holds on the corrected maths. Every
regression test was verified to FAIL against the pre-fix code — one that passes on the broken code
proves nothing.

Verification surface: 1,265 tests in 271 suites; the kernel-compile sweep covers 371 programs across
229 lowerings, 0 failed.

SemanticCompute v1.19.0

Distribution notice

The downloadable SemanticCompute binaries for this release are unavailable. SemanticCompute is commercial software; licensed builds are issued to customers and authorised trial users. View plans or request access. These notes remain available as the historical record of the release.

SemanticCompute v1.19.0 — the SDR lane, all the way to cyclostationary

A minor: five additive families (catalogue 163 → 168) covering wideband SDR operation end to end —
ultrafast scanning, RX/TX, full waveform analysis, and modulation recognition — built for HackRF-class
work and wired into a real consumer (PC1) in the same pass.

Added

Polyphase filterbank channeliser — the ultrafast-scanning primitive: one pass splits a wideband
block into N simultaneously-analysed channels, instead of a retune-and-FFT sweep. The polyphase arm
stage is the kernel; the across-arms DFT composes with the FFT family. Forward-sign DFT pinned by a
tone test — which caught this family's own first draft using the mirrored sign. 62 dB measured channel
rejection.

CFAR detection (cell-averaging + ordered-statistic) — per-cell adaptive detection floors. The two
variants ship together because their failures differ, and one fixture pins both: CA masks a weaker
target inside a stronger one's training ring; OS at a stated rank detects it. The floor output is
exactly peak picking's floor buffer — CFAR ∘ PeakPicking is the detect-then-refine chain, tested as a
composition.

Quadrature FM discriminator — instantaneous frequency as the angle of x[i]·conj(x[i−1]); conjugate
order pinned (the flip decodes inverted FSK from a system that "works"), amplitude immunity pinned.

Root-raised-cosine tap design (host-only, apply via Batched FIR) — the zero-ISI matched cascade is
the defining test; singular points use analytic limits; unit-energy and integer-group-delay conventions
stated.

Spectral correlation + coherence (the cyclostationary lane) — a PSD says "there is power at f";
only cyclostationary analysis says "there is a MODULATED signal with symbol rate α". SCF by
cyclic-periodogram averaging over STFT frames, with coherence as the scale-free [0,1] surface. α in
even integer bins (half-bin shifts refused); α = 0 IS the periodogram (the scale anchor); zero-power
coherence is 0, never NaN. Measured: BPSK's symbol-rate coherence 1.0 against 0.10 off-cycle and 0.19
for noise — the modulation-vs-noise discrimination the lane exists for.

Verification surface: 1,221 tests in 265 suites; the kernel-compile sweep covers 370 programs across
229 lowerings, 0 failed.

SemanticCompute v1.18.0

Distribution notice

The downloadable SemanticCompute binaries for this release are unavailable. SemanticCompute is commercial software; licensed builds are issued to customers and authorised trial users. View plans or request access. These notes remain available as the historical record of the release.

SemanticCompute v1.18.0 — reachable, consistent, and honest about its own confidence

A minor shaped entirely by one consumer's verification discipline. Their standing test for done-ness —
merged, on a released main, discoverable by the normal route, AND consistent with the paths that
already existed — is this release's changelog in four clauses.

Fixed

precision is now in sc_check_parity's declared JSON schema. The v1.17.0 runtime accepted it,
validated it, and refused unknowns helpfully — and tools/list never mentioned it, so a client
discovering the tool by schema introspection (the normal MCP route) would report the feature missing
from a build that has it. The consumer's third instance of "a fix that exists but is not reachable by
the normal route", and the argument that has moved every change in this thread.

A passing float64 check now reports the OBSERVED maximum error. The first float64 path reported
maxAbsoluteError: 0 on a pass whose true maximum was 3.55e-15 — and the finding was worse than the
report: the float32 doctor had always reported the observed maximum over ALL elements, so the two
precisions carried differently-scoped numbers under the same field name. Not a convention; a
divergence, introduced by testing the new path in isolation. Now mirrored to float32 exactly,
including the relative-error denominator, pinned by a passing-check-reports-true-max test.

Added

The suggestion abstention floor. sc_suggest_families labels its own confidence regime: top
coverage below 40% returns confidence: "low" with an abstention-grade note — because a consumer
left a resampler unmapped for a week on a top-ranked nonsense hit, and "a confident wrong answer is
indistinguishable from a confident right one, so a detector that guesses costs more than one that
abstains". The floor is honest about its limits: the same 28–36 band has held both nonsense and
CORRECT top hits in the evidence, so below the floor the claim is "rank carries little signal here",
never "this is wrong". The pinned below-floor case is the consumer's own: a windowed-sinc FIR
DESIGNER, for which the honest answer is that no family covers it (SC ships FIR apply, not design).

The landing page's code-knowable numbers are gated (LandingNumbersSyncTests) — family counts and
the full kind-distribution bars are checked against the catalogue, closing the drift class found at
the v1.15.0 cut the way the README table gate closed its sibling.

Verification surface: 1,201 tests in 260 suites; the kernel-compile sweep covers 365 programs across
224 lowerings, 0 failed.

SemanticCompute v1.17.0

Distribution notice

The downloadable SemanticCompute binaries for this release are unavailable. SemanticCompute is commercial software; licensed builds are issued to customers and authorised trial users. View plans or request access. These notes remain available as the historical record of the release.

SemanticCompute v1.17.0 — the doctor learns float64

A minor: one capability, long asked for and now cleanly scoped. The longest-standing consumer question
— asked three times by a Double-native package whose 20+ family mappings could not be parity-checked
end to end — received its decision and its implementation the same day.

Added

Doctor-level float64 comparison. SLCompatibilityDoctor.compareDoubleBuffers judges two float64
buffers at FULL precision: bit identity under exact, absolute/relative bars evaluated in Double, and
ulp(n) counted in DOUBLE ULPs (slDoubleULPDistance, new) — one float32 step at 1.0 spans ~2²⁹ of
them, which is the resolution gap this surface exists for.

The scope is the design. Families and lowerings remain float32 — a verdict about whether two arrays
agree is not a claim about what a GPU will do with them, and conflating those is what made the original
silent-narrowing bug possible. A float64 result carries that scope in its own precision field rather
than leaving it to inference.

Over MCP: sc_check_parity gains precision: "float64". The float32 exact refusal — which was
always correct — now names the float64 path as its first remedy. An unknown precision refuses rather
than defaulting, per the house rule that a typo must never become a false green.

The pinned defining case is the requesting consumer's own: two Doubles differing by 6.66e-16 —
identical as float32 — are seen, measured exactly, and tolerable only under a knowingly-stated double
bar.

Verification surface: 1,196 tests in 258 suites; the kernel-compile sweep covers 365 programs across
224 lowerings, 0 failed. Four lowering targets, three executed in-core (Metal, portable C, WGSL) plus
the externally verified CUDA runner.

SemanticCompute v1.16.0

Distribution notice

The downloadable SemanticCompute binaries for this release are unavailable. SemanticCompute is commercial software; licensed builds are issued to customers and authorised trial users. View plans or request access. These notes remain available as the historical record of the release.

SemanticCompute v1.16.0 — the tracking lane

A minor, by the rule: four additive families (catalogue 159 → 163) — the estimator consumer's full
outstanding request queue, built in one cycle with their own trap characterisations pinned as tests.

Added

Linear assignment (gated bipartite matching) — tracks↔detections, detections↔ground truth, cells
across frames; three consumers hand-roll this shape. The OBJECTIVE is the family: maximise feasible
pairs first, minimise cost second, with gating STRUCTURAL — a forbidden pair is an absent edge, never a
big finite cost, because big-M does not gate, it only makes bad assignments expensive. Ships its own
brute-force oracle whose lexicographic ordering forbids the zero-cost empty matching (the requesting
consumer's reference trap: theirs declared a correct solver broken on every input). A third trap
surfaced during this family's own construction and is preserved as a test fixture: row-by-row
shortest-path assignment steals contested columns under gating — max cardinality survives, min cost
does not — so the solver augments globally from every unmatched row, confirmed by a 60-trial
brute-force cross-check. Host-only by design: the solve is sequential, and the parallel work in an
assignment pipeline is the caller's cost matrix, which composes from families that already ship.

Spectral peak picking — floored local maxima with log-parabolic sub-bin refinement. The floor is
LOAD-BEARING, in the consumer's own words kept in the header: without it every query finds "a peak" in
noise, a tracker can never miss a detection, and a dead track gets dragged around by the noise floor
with its covariance shrinking while its information gets worse. The plateau test is asymmetric
(b > a && b ≥ g) so a flat top is one peak; an exact log-parabola's position is recovered to float
precision (test-pinned); edge bins are never peaks. Goertzel and BatchedDTFT evaluate where you point
them — this finds where to point.

Batched EKF predict (per-track transition) — the narrowed remainder after the consumer's own
correction (their glide model fits BatchedEKF exactly as shipped; recorded). Every convention mirrors
BatchedEKF verbatim — n ≤ 4, per-track Q, row-major packing — with F now a per-track buffer, so a
model moves between the families by changing one buffer's shape. Bit-exact agreement with BatchedEKF
under a replicated F is a test, not a hope.

Phase unwrap (predictive + sequential) — both forms, because they fail differently and a consumer
should choose knowingly: predictive (pred + princarg(meas − pred)) isolates a glitch to one sample;
sequential (the numpy.unwrap shape) is path-dependent by definition — one glitch shifts every later
output by 2π. Both behaviours pinned side by side as facts of the forms. princarg uses
round-half-to-even on both backends, the convention shared with the complex-onset family.

Verification surface: 1,190 tests in 257 suites; the kernel-compile sweep covers 365 programs across
224 lowerings, 0 failed. Four lowering targets, three executed in-core (Metal, portable C, WGSL) plus
the externally verified CUDA runner.

SemanticCompute v1.15.0

Distribution notice

The downloadable SemanticCompute binaries for this release are unavailable. SemanticCompute is commercial software; licensed builds are issued to customers and authorised trial users. View plans or request access. These notes remain available as the historical record of the release.

SemanticCompute v1.15.0 — Savitzky–Golay, and two kinds of honesty about drift

A minor, by the rule: one additive family (catalogue 158 → 159), one latent GPU bug fixed before any
consumer could hit it, and a documentation-drift class killed with a gate after a consumer caught it.

Added

Savitzky–Golay smooth/derivative — batched, with POLYNOMIAL-CONSISTENT edges. The natural companion
to the Hampel identifier already in the catalogue: Hampel rejects the spikes a polynomial fit would
chase, S–G preserves the peaks Hampel leaves noisy; robust smoothing is the composition, no fused
kernel required.

• The requesting consumer's own analysis had correctly ruled the single-signal interior "Correlation
  with time-reversed taps — never a gap". What no family covered: the EDGES (a different weight row at
  each boundary position — the window's own least-squares fit evaluated off-centre, not a fixed-tap
  correlation) and the batch fused with them.
• The edge policy is pinned by the test that matters: a ramp's first derivative is exact at sample 0,
  where the common reflection convention collapses it toward zero — the mirror makes the boundary look
  locally symmetric precisely when a trend detector needs the slope most.
• Degree-≤p polynomials pass through EXACTLY, edges included. Derivative scaling is d!/hᵈ with the
  sample step a real parameter. Weight rows sum to 1 (smoothing) or 0 (derivatives), asserted at design
  time. Measured: 1.85× peak retention versus a same-width boxcar.
• Adopted by the FIRFilters package as a test-only oracle: its independently coded S–G design is held
  against the family (centre weights across a design grid, every interior output), and the edge-policy
  difference is asserted AS A FACT — with a sentinel that fires if the two conventions ever silently
  converge.

Fixed

• ResamplePolyphase's GPU kernel could overflow its position product — i·M in 32-bit overflows
  once outCount·M exceeds 2³² (a long file at a large reduced M). The CPU reference always used 64-bit
  positions, so the two sides were identical only until the file got long. Found while wiring the
  consumer estate; the kernel now computes positions in ulong, parity re-verified unchanged.
• The README family table had rotted to misinformation — a consumer diffing sc_list_families
  against it found 141 of 158 canonical names absent. Regenerated mechanically from the catalogue and
  GATED (ReadmeFamilyTableSyncTests: every name verbatim, stated count matches) so it cannot rot
  again. The landing page's live-surface numbers were trued in the same sweep and its release chips
  pinned to their true versions.

Verification surface: 1,172 tests in 253 suites; the kernel-compile sweep covers 361 programs across
220 lowerings, 0 failed. Four lowering targets, three executed in-core (Metal, portable C, WGSL) plus
the externally verified CUDA runner.

SemanticCompute v1.14.0

Distribution notice

The downloadable SemanticCompute binaries for this release are unavailable. SemanticCompute is commercial software; licensed builds are issued to customers and authorised trial users. View plans or request access. These notes remain available as the historical record of the release.

SemanticCompute v1.14.0 — the audio-estate lane

A minor, by the rule: seven additive families (catalogue 151 → 158), each traced to hand-rolled call
sites or an explicit consumer roadmap ask before being declared a gap. This is the release for the audio
estate that has been rewriting the same numerics in module after module — five LPC implementations, five
linear-interpolation resamplers, three envelope-follower recurrences — with conventions nobody wrote down.

Added

Batched LPC (Levinson–Durbin + all-pole spectral envelope) — the estate's most-duplicated numeric.
Conventions pinned rather than assumed: the analysis-polynomial sign (an AR(2) recovery test cannot pass
under the negated convention), silence yields zeros not NaN (a silent frame has no vocal tract), and an
unstable reflection coefficient freezes the recursion at the last stable order rather than sending poles
outside the unit circle into a formant display.

Sobel 2D gradient magnitude — a consumer plan's top priority verbatim: its MPS-based onset detector was
"the only unverified GPU path" in the module. The edge policy — the convention that silently diverges — is
stated (replicate) and pinned by a border-value test.

Polyphase windowed-sinc resample — rational L/M positions split exactly into integer + fraction, so
phase never drifts along the signal (pinned on 100k samples — the classic accumulator-resampler bug).
Per-position kernel normalisation passes DC at exactly unity. Measured: 99.7 dB interior SNR at
44100→48000 with 32 taps, where linear interpolation manages ~35.

True peak (BS.1770-4 method) — inter-sample peak metering, absent estate-wide. 4× oversampling through
the SAME windowed-sinc kernel as the resampler — one interpolator, two families, no second implementation
to disagree with. Stated honestly: the informative Annex 2 filter is not claimed. The canonical case
(fs/4 at π/4 phase: 0.707 sample peak hiding a 1.0 true peak) is pinned.

Batched attack/release envelope follower — the one-pole recurrence three modules rewrite. Pinned: the
attack/release branch compares against the PREVIOUS envelope, initial state is 0, k = 1 − exp(−1/(τ·fs))
with τ = 0 mapping to instant, never to a divide by zero. Sequential per band, parallel over bands — the
win is B bands in one dispatch, stated so nobody expects one band to speed up.

Gammatone/ERB filterbank band energies — requested by a consumer roadmap that recorded a −24 dB
surprise from an unstated normalisation in an earlier attempt. Pinned to the digit: ERB(1 kHz) = 132.639 Hz,
ERB-rate-spaced centres, the 4th-order spectral gammatone with Patterson's 1.019 factor, and area
normalisation as an explicit option rather than a default surprise.

Nearest-centroid assignment — asked for independently by two consumers (DUET spatial clustering and a
drum-piece peeling loop). Ties break to the lowest centroid index by construction (strict < in ascending
order), the chosen distance is returned so stopping criteria need no host recompute, and the update step is
deliberately absent: assignments are labels, and labels feed the fused labelwise scatter.

Verification surface: 1,165 tests in 251 suites; the kernel-compile sweep covers 360 programs across 219
lowerings, 0 failed. Four lowering targets, three executed in-core (Metal, portable C, WGSL) plus the
externally verified CUDA runner.