veridict 0.4.0 — research-sweep release (jury calibration, Rekor anchoring, SLSA export, ladder proofs)

[goun7]

What changed

The research-sweep release: seven grounded gaps from the 2026-09-14 literature/regulatory review, closed in dependency order — additive minor; the ledger format and digest preimages are untouched (§14).

• Jury calibration layer — structural mitigations for the three documented LLM-as-judge failure modes (position/self-enhancement bias, verbosity bias, self-preference): multi-sample majority voting with honest split-abstention, evidence-first extraction with validation, and author-family exclusion (new actor-family action input). Cited in-module: arXiv:2306.05685, 2305.17926, 2410.21819.
• External anchoring to Sigstore Rekor — the design doc's checkpoint-hardening promise ships: audit --anchor rekor, anchor publish/verify, verify --anchor. Offline verification against the TUF-pinned Rekor key; existence-at-time proof without transferring authority (anchor key ephemeral by design).
• SLSA v1.2 VSA export — export --format vsa projects any certificate onto an in-toto verification_summary/v1 statement for supply-chain tooling; honest lossy mapping + spec-sanctioned extension binding; optional DSSE envelope.
• Adjudication ladder bounded-exhaustive verification — 28,080 cases covering the complete finite input space; 10 safety invariants PASS (no-silent-pass, W1a-decisiveness, doctrine-cannot-topple, split-visibility, determinism, …); CI locks the truth-table digest; a meta-test proves the checks see an injected silent-pass bug. Issue Formal verification of the ladder's five tier rules (adjudication core) #8 annotated; general proofs stay open.
• EU AI Act transparency watcher (11th example) — deterministic Art. 50 / GPAI Code-of-Practice surface checks, vacuous-SUPPORTS for non-AI repos.
• AuditWeave positioning (arXiv:2607.09682) in design-doc §10.5 + jury-literature citations; IP & prior-art watch section in GOVERNANCE.md (US App 19/561,229 assessed against RFC 6962 + intervening art; not legal advice).

Receipts

• Test suite: 297 tests, full CI green on 51632d3 (3.12/3.13/3.14 + dogfood self-audit + badge regen + real-jury receipt with 3 samples)
• Rekor: v1's dogfood certificate anchored live before this release — docs/receipts-anchor-v1-dogfood.json (logIndex 2843194981); this release's dogfood cert is anchored too (sidecar attached here)
• Ladder proof receipt: docs/receipts-ladder-verification.json (truth table sha256 d0ab9978…)
• PyPI: veridict-standard==0.4.0 via Trusted Publishing (tag v0.4.0)

Notes for Action users

@v1 will be re-pointed at this release (the actor-family input landed after the previous v1 pin). New optional inputs work immediately; everything else is compatible.

---

This discussion was created from the release veridict 0.4.0 — research-sweep release (jury calibration, Rekor anchoring, SLSA export, ladder proofs).