v0.2.3 — concurrency-safe governance, structural accountability, source-consistency gate

A fifth adversarial review pass (AI-assisted self-audit) found that v0.2.2's "governance semantics closed" held only under sequential execution. v0.2.3 closes the concurrency, persistence, and accountability gaps it surfaced — each reproduced before fixing, each now a regression test.

Pinned to commit ac0ada0. The credential packet is attached to this release (sha256 af6e4142299b58cbfbeb67b3b357a6e438c272f7e074ee17b9c8e012a4dd01f1).

Review-debt is now concurrency-safe and reopen-aware (findings 1–2)

The cleared-debt Prometheus counter was a non-atomic read-before/count-after: 24 concurrent clears of one item moved it by up to 24, and it could never go back down when an overwritten run reopened its debt (so a stale attestation kept the SLO green). Replaced with store-derived gauges (aro_review_debt_open / _cleared / _stale / _oldest_open_age_seconds) computed from actual state at scrape time — race-free by construction, and they track state up and down. SLO #6 now watches these.

Accountability is structural, and the digest is content-bound (findings 3–4)

• Seat integrity: a Script's goal.owner_seat_id must reference a declared reviewer seat, and clearing a specific debt item requires a seat_id that the run declared. Not just a non-empty self-reported name — a named, declared seat.
• Versioned canonical subject digest: an attestation is bound to the reviewed content (v1:sha256:… over run id, per-step digests, policy decisions), not the raw serialization. Adding a defaulted field to a run no longer stales historical attestations; different content still reopens the debt.

The evidence gate checks current source, not just a frozen asset (finding 5)

release-evidence now checks out current source, verifies files↔MANIFEST↔provenance, and diffs the packet's bundled verdict script against the current source — red if the published evidence drifts from what the repo actually contains.

Also

• All package versions aligned to 0.2.3 (were 0.1.0 while releases had moved on — finding 6).
• Release-note wording corrected: these are adversarial review passes / AI-assisted self-audits, not independent external audits (finding 7). No PR here has had third-party review.

Honest status

Sequential and concurrent governance semantics ✅ · persistence-aware SLO ✅ · structural accountability ✅. Still open, and deliberately not overclaimed: independent external reproduction — no third party has run the packet/quickstart (0 stars/forks; CI is the main packet downloader). That, plus a 90-second demo, is the next step, and it needs a real external developer — worth more now than more infrastructure.