v1.11.1

Fixed

• Reading a value after deleting it in the same stage now returns undefined instead of the old value.

v1.11.1-rc.0

Release candidate 1.11.1-rc.0 from d4cb848.

v1.11.0

Added

• Bound per-write delivered call-source membership to the 32 most-recent distinct canonical IDs and record paired cumulative eviction counts. Preserve latest windows through delta/lossy reconstruction and saved reopening; CauseGraph and PROV disclose truncated ancestry. Legacy no-counter rows remain readable within existing budgets. Migration: retained duplicates now refresh source-window recency; readKeys keeps its existing state-read law. IDs remain whole, so the membership cap is not an absolute byte bound.
  Per-write traces can retain a disjoint readAttempts ceiling for delivered native call answers. The existing reads-prefix writer captures canonical attempt IDs independently of state paths, omits the field when empty/off, and clears it on discard. An offline host-adapter example reuses existing cause ports; recorded answer availability is conservative evidence, not proof of semantic use or external commitment.

Fixed

• Verify private Release App identity with a short-lived authenticated App metadata read inside the existing Actions control steps. Keep repository permissions, exact-head approval, source/tree, security, archive and publication-reservation checks unchanged.
• Recover an unpublished current version through a newly reviewed App proposal before consuming queued fragments, preserve retained release history with nonforce updates, and hold on package-input drift or ambiguous publication evidence.

Documentation

• Clarify the standalone execution-record and replay role, installation guidance and ecosystem routing, and align package search keywords with those use cases.

v1.10.0

Added

• Opt-in explain(..., { includeBackward: true }) returns a backward evidence result and the /cause BackwardResult type. It exposes the existing admitted reverse walk, including dependent-to-parent edges with their attribution and evidence, plus independent backward confidence and gaps. No extra traversal or graph calls occur; omitted/false keeps existing result bytes and call order.

Fixed

Release controls retain bounded, nonsecret failure codes across API, decoding and local IO boundaries, while preserving exact approval, source, artifact and publication safeguards. Failed or partial attempts remain held for the documented recovery process.
Release run-envelope refusals identify the first failing predicate with a fixed current-run-* label. API values, paths, bodies and credentials are not included. The existing checks, order, single run lookup, job validation and fail-closed release behavior are unchanged; legacy current-run remains an admitted diagnostic. This reporting change does not diagnose a historical response or authorize a retry.

Documentation

• Clarify that an explicitly owner-authorized agent may submit the real exact-head GitHub approval through the owner's existing User account after independent review and current checks. Identity, permission, release and publication safeguards are unchanged.

v1.8.0

Added

• Optional host-authorized root read-source evidence for cause and PROV. Exact committed reads link sources to consuming executions; supported entity joins export prov:used. Per-write ambiguity, missing ownership, staged/child/resume limits and partial capture retain gaps. Existing calls without the seam keep their results.
• GraphEdge.attribution adds 'recorded-read' for observed source-to-execution edges only. Per-write and semantic derivation stay unproved; exhaustive consumers must handle the new literal.

Fixed

• Keep missing execution ownership, attempts and read collection unknown in source-backed cause queries. Missing later consumer coverage limits impact without erasing a root established by complete backward evidence; explicit empty write prefixes retain their exclusions.
• Include exact scalar descendant consumers in ancestor-qualified source impact and count recorded source/control fan-out against one immediate edge cap.

Prepared and reviewed in #26.

v1.7.0

Foottrace 1.7.0 adds opt-in exact scalar root-read source capture through the native writer. It records bounded base, committed, staged or explicitly unavailable evidence during the actual read. Existing reads and record bytes stay unchanged when capture is off.

Capture ownership stays private, obsolete live metadata is reclaimed safely, and stored format-v1 size ceilings are fixed separately from writer defaults. The optional privacy verdict must be pure and decide by name only. Unsupported evidence and exhausted limits remain explicit gaps.

Exact source selection is not semantic derivation. Staged-generation-to-later-commit linkage, richer values, durable source histories and consumer adoption remain separate.

See the changelog for the complete release notes.

v1.6.0

Adds the optional asynchronous foottrace/prov entry for bounded, value-free PROV-O JSON-LD exports of one recorded scope.

• Native execution activities, write occurrences and supported control communication preserve their recorded identities.
• Read-before-write evidence remains extension-only candidate evidence. Exact prov:used and semantic derivation are withheld when the record cannot establish them.
• Whole-record redaction is resolved before disclosure. Opaque write placeholders retain count and position while withholding names and values.
• Gap reports reserve bounded space within the full output ceiling. Accepted graph prefixes survive truncation, routine limitations use counts, and exceptional problems retain their locations.
• Every P1 export remains complete: false pending supported native capture/end attestation and reader adoption.

CommonJS, ESM, strict TypeScript and browser consumers are supported. Existing record behavior, runtime dependencies and consumer version pins are unchanged. Fingerprints, host agents, connected scopes and live streaming remain separate work.

Implementation: #19. Release paperwork: #20. The changelog uses the local preparation date, 18 October 2026.

v1.5.0

Added

• Optional explain backward and impact allowances, including ranking, within one total work ceiling and deadline. /cause also exports the TraversalLimits type.
• Fixed allowance handles keep traversal and ranking charges attached to their direction. Local refusals remain explicit gaps and do not charge the refused operation against its matching total allowance or poison cached evidence.

Unchanged

• Existing query behavior, record bytes, defaults, dependencies and runtime exports remain unchanged.

Foottrace 1.4.0

Foottrace 1.4.0 exposes the existing foottrace/cause CommonJS build with matching typed exports, alongside ESM imports. This enables CommonJS consumers to use the cause tools without an import bridge.

• All public entrypoints use one strict package-resolution check. Algorithms, query limits, record bytes and the existing root, /write and /paths APIs are unchanged.
• The cause manual now explains per-write capture, authorized saved records, bounded queries and honest findings. It also covers checking coded errors across module formats and same-format writer registration.
• Strict public .cts and .mts consumers compile once outside coverage instrumentation, preserving the five-second runtime test limit.

Reviewed changes: #12, #13 and release metadata #14. Full validation passed 1,924 tests, strict public consumer types, and fresh installed CommonJS/ESM consumers on Node 22 and 24.

The existing trusted-publishing workflow builds, checks, retains and publishes the release archive to npm.

foottrace 1.3.0

Adds shared, reference-only requirement evidence on the foottrace root entry: RequirementResult, RequirementCheck, RequirementCheckDisposition, RequirementReason, and the bounded readRequirementResults() reader.

• Results bind a requirement to a finding, time window and affected claims, with evidence, attempt and host-owned action references. Source-valid and learned-time references stay separate.
• RequirementReason contains exactly 12 domain-evidence reasons from the single gap registry. Requirement and check reasons reject trace-walk limits such as cycle, node-limit and strategy-failed; cause gaps and admission errors retain their existing broader vocabulary.
• The reader returns detached, frozen records and uses fixed typed refusals for malformed or oversized inputs. Structural admission does not authenticate a producer, establish domain truth or authorize an action; claim enforcement remains a consumer responsibility.
• Existing public entry points and execution-record bytes remain compatible. The optional cause reader remains ESM-only; the new requirement reader supports both ESM and CommonJS.

Validated on Node 22 and 24, including packed type/browser consumers, independent security and code reviews, rejection regressions and unchanged flow-record fixtures. No model or storage service is built in.