CIGAR 0.10.0 beta 1 — local context core and SDKs

CIGAR 0.10.0 beta 1

This beta releases the offline Rust context core and the Python/TypeScript SDKs.
It does not replace the Honey 0.9.4 daemon, CLI, MCP, Rust remote SDK, or Go remote SDK.

What's available

• cigar-context 0.10.0-beta.1: incremental context graphs, exact rendered o200k token budgets,
  dependency/contradiction closure, authorization filters, source-line citations, source replacement,
  optional query excerpts, semantic candidate input, bounded token caching, and verified transport deltas.
• Python hol-cigar 0.10.0b1, import cigar_sdk: local LocalContextGraph plus the compatible remote client.
• TypeScript @hol-org/cigar 0.10.0-beta.1: local LocalContextGraph, a lightweight /context entry point,
  and the compatible remote client. ESM, Node 24.10–24.x; no install-time scripts or downloads.

The bundled worker is qualified on macOS ARM64 only. Python requires 3.14.x.
The Python source distribution is portable; on other platforms, local graph APIs require an explicit
trusted absolute path to a worker built from this exact beta source. The remote SDK APIs remain available.
The macOS 11 wheel deployment floor is not a test result on macOS 11. This is beta software, not a
production certification or a claim that every supported OS/runtime combination was tested.

Install the GitHub assets

Download the matching files from this prerelease, verify them first, then install:

python3.14 -m pip install ./hol_cigar-0.10.0b1-py3-none-macosx_11_0_arm64.whl
npm install ./hol-org-cigar-0.10.0-beta.1.tgz

Registry publication is separate. Once the respective registry lists this exact version:

python3.14 -m pip install 'hol-cigar==0.10.0b1'
npm install '@hol-org/cigar@0.10.0-beta.1'

npm uses the beta channel, never latest, and requires independent maintainer approval.
The Rust .crate source is included here; crates.io publication is not part of this beta workflow.
The SDK READMEs include local graph examples and worker build instructions.

Evidence and signatures

beta-release-manifest.json records the exact source commit, payload hashes, qualified target,
two fresh hosted builds, and the qualification run URL. Both builders must independently compile
the packaged native source, produce identical archive/worker bytes, and qualify fresh SDK installs
against the Rust oracle and the preserved 0.9.4 SDK suites. No model is required for these tests.

Each build also reruns all 516 installed-consumer oracle comparisons under OS-enforced network denial.
qualification-evidence.tar.gz retains both builders' test logs and raw results.
sbom.cdx.json and sbom.spdx.json cover the native worker closure and SDK runtime dependencies; bundled packages contain
the native third-party license notices. Current public dependency advisories are checked during each build.
These checks do not constitute an exhaustive source security audit.

Every payload, manifest, and checksum inventory is signed with short-lived GitHub/Sigstore provenance;
provenance.sigstore.jsonl retains the certificate, signature, and transparency evidence. Verification
must pin the repository, workflow, tag, and expected source commit, not just check a self-supplied hash.
From the exact tagged source checkout, with all eleven release assets in a new directory:

python3 scripts/release/context_sdk_beta.py verify --verify-attestations \
  --directory /absolute/path/to/downloaded-assets --commit "$(git rev-parse HEAD)"

Use an independently obtained source commit; read gh attestation verify --help for direct verification.
Two VMs are independent builds within one GitHub trust domain, not separate signing organizations or
a claimed SLSA level. PyPI supplies its own additional publication attestations when publication succeeds.

Compatibility and limitations

All previously qualified 43 Python and 104 TypeScript legacy exports and all 45 remote operations remain.
No new token-reduction, answer-quality, or performance percentage is claimed by SDK packaging.
The underlying core measurements remain available in the versioned reports with their benchmark limits.
Transport deltas save bytes, not stateless model prompt tokens. Source excerpts are opt-in and may omit
important context; source text is data, not an authority grant. Reuse graphs to amortize worker startup.

The SDK worker inherits caller OS privileges and environment; it is not a security sandbox. Package hash
checks detect changed worker bytes but do not replace publisher trust. Keep graph caches within a privacy
boundary and pass current authorized IDs for every access-filtered compilation.

v0.9.4

CIGAR Honey v0.9.4 candidate release notes

CIGAR is an alpha project from HOL.org.

Field	Value
Version	0.9.4
Channel	honey
State	Alpha developer preview
Context ABI	cigar.context.v1

Honey 0.9.4 adds an opt-in balanced_v4 context profile focused on lower repeated context, higher
evidence value per token, deterministic workflow recovery, and less ranking/packing work. It remains
unpublished and unsupported. These notes describe source-qualified candidate behavior; they do not
claim that the final installed artifacts, signatures, reproducibility, or long-running campaigns
have passed.

What changed

• balanced_v4 adds dense ordinal retrieval state, bounded requirement bitsets, an allocation-free
  winner/runner-up scan, cached similarity state, and a maximum 32-candidate cancellation polling
  interval. balanced_v1 and balanced_v3 identifiers, digests, errors, and golden outputs remain
  frozen.
• Retrieval derives five risk classes from trusted operation and requirement metadata. Effect-
  critical requirements reserve independent corroboration when available, and optional intake
  stops when contextual marginal utility is no longer positive.
• Compiler packing uses exact tokenizer counts, cached representation/dependency closures,
  conservative dominance, risk-aware corroboration, and a positive-utility stop rule. Mandatory
  material, blocking evidence, dependency closure, lane budgets, and conflict constraints remain
  fail-closed.
• Workflow context sessions are now first-class in Rust, Python, TypeScript, and Go. The four SDKs
  share the same bounded phase/event contract, durable resume actions, exact replay dimensions,
  error vocabulary, delta-chain checkpoint, ambiguous-effect reconciliation, and retry
  revalidation fences.
• Daemon workflow checkpoints persist identity-only state through the existing v5 service-record
  path. No storage format v6 or new SQLite migration is introduced.
• Behavior rollback selects balanced_v3 or balanced_v1 and restarts. Binary rollback is allowed
  only against a separately restored verified compatible state; an older runtime must never open or
  rewrite candidate state.

Retained source and workflow evidence

The integrated source-linked five-workflow-by-20 diagnostic completed all 300 treatment
observations with 100% completion, blocking coverage, gold-source coverage, citation resolution,
and useful precision, with zero semantic duplicates. Mean exact selected tokens were 622.63 for
0.9.4, 1,253.36 for frozen 0.9.3, and 2,252.99 for frozen 0.9.2: reductions of 50.323% and 72.364%
for that registered cohort.

Against frozen 0.9.3, aggregate planner/reducer/compiler p50 improved 63.846%, compiler p95 improved
67.987%, and reducer p50/p95 improved 69.790%/74.207%. Aggregate phase p50 improved 51.322% versus
frozen 0.9.2. These are source-linked measurements on the registered qualification host, not a
cross-machine wall-clock guarantee.

The independent deterministic Hiero RC cohort retained 250 candidate observations, 50 per
workflow. Completion, blocking/gold/citation coverage, replay, fail-closed behavior, and all nine
negative cases were 100%; mean delta reuse was 75.134%. Mean CIGAR-supplied tokens improved 50.039%
over 0.9.3 and 72.217% over 0.9.2; mean CIGAR pipeline latency improved 59.781% and 77.306%. Provider
latency and provider tokens were recorded separately and did not enter those claims. No live-model
experiment was treated as deterministic evidence.

A current-source rerun against 0.9.4 commit de8ec221 independently verified as evidence ID
ae0abda8daa92a00b1c5e1d75b947ee35d9abc75ef7364be0549558ad7b5c1e4. All 44 evaluated claims
passed. Mean exact tokens improved 50.039% versus frozen 0.9.3 and 72.217% versus frozen 0.9.2;
mean internal CIGAR pipeline latency improved 59.627% and 73.584%. Its larger 50-trial cohort also
showed a 48.339% EVM reducer-p95 improvement over 0.9.3, closing the tail uncertainty from the
preceding 20-trial diagnostic. See the
content-free three-way comparison report.
Because this documentation update follows the measured commit, final frozen installed-artifact
qualification remains required.

A separate clean-source allocation qualification ran 200 alternating v3/v4 pairs after 40 warmups
at both 128 and 512 candidates. Peak request-scoped compiler allocation fell 46.806% and 53.263%;
allocated bytes fell 12.681% and 9.041%; allocation counts fell 20.416% and 12.813%. The fixed 40%
peak-reduction threshold, absolute peak bounds, and byte/count non-regression gates all passed and
were independently recomputed from the content-free raw observations. This is source qualification
for commit 1d7bf983, not final installed-RC evidence; it must be rerun after the source freeze.

The retrieval v3-equivalence oracle matched 102,400 generated cases, and the v4 implementation
retained exact legacy profile outputs. Property/model tests, Miri, restart/crash-boundary tests,
content-free telemetry canaries, four-SDK workflow parity, and the focused compatibility/storage
sentinels pass. Long-duration fuzz, mutation, sanitizer, installed-runtime, two-builder, signing,
and soak gates remain separate and must not be inferred from those results.

Compatibility and upgrade

The Context ABI remains cigar.context.v1; the public surface remains 45 operations and 70 nominal
payload types; protocol compatibility remains 1.0 through 1.x; Python keeps distribution
hol-cigar and import cigar_sdk; and storage remains v5. During candidate qualification an
omitted intelligence profile still selects balanced_v3; select balanced_v4 explicitly and
require getCapabilities to report intelligence-balanced-v4.

Upgrade only from a verified backup, retain the prior versioned installation and checksum, and
rehearse the candidate on a separately restored empty target. Follow
docs/guides/honey-0.9.4-upgrade.md for exact stop conditions
and rollback separation.

Candidate inventory and open gates

The intended attachment inventory remains the closed 13-file Honey set: source, docs,
schemas/conformance, Apple-silicon runtime, TypeScript SDK, Python wheel and sdist, Rust local-
registry kit, Claude Code plugin, demos, these release notes, release manifest, and SHA256SUMS.

The Python distribution uses the public repository's authorized
.github/workflows/publish-hol-cigar.yml Trusted Publishing identity. After the source PR is
merged, publication still requires the exact v0.9.4 tag, a non-draft GitHub prerelease containing
the exact 13 verified attachments, the approved manifest SHA-256, the protected pypi environment,
and an explicit owner confirmation. Follow the
0.9.4 PyPI release gate; merging the source PR alone does
not publish a package.

No attachment is authorized by this source change. Before any promotion, the exact candidate must
still pass clean artifact assembly/installation, upgrade and binary rollback rehearsals, final
checksums/SBOM/provenance/license bindings, two-builder unsigned-byte comparison, independent
evidence recomputation, and every deferred long-running gate selected by the release owner. The
24-hour soak remains deliberately last.

CIGAR Honey v0.9.2 — balanced developer preview

CIGAR Honey v0.9.2 release-candidate notes

CIGAR is an alpha project from HOL.org.

Version: 0.9.2
Channel: honey
State: alpha developer preview
Context ABI: cigar.context.v1

Honey 0.9.2 is the balanced release-candidate line for the persistence, restart, retrieval,
duplicate-content, and correlation-related efficiency issues observed during the 100-with/100-without
CIGAR security-platform evaluation. It descends from the published hol-cigar==0.9.1 PyPI build at
ee9b52b69f4245c27b46da6ef2fc4a070430caed. The candidate remains unpublished until explicit release-owner
approval. Publication keeps it an unsupported developer preview that is not production-qualified.

Attachments

The public candidate contains exactly these 13 files:

Attachment	Purpose
cigar-0.9.2-source.tar.gz	Exact release source
cigar-0.9.2-docs.tar.gz	Version-bound documentation
cigar-0.9.2-schemas-conformance.tar.gz	Protocol schemas, vectors, and conformance inputs
cigar-0.9.2-aarch64-apple-darwin.tar.gz	CLI, daemon, MCP, hook, man page, and completions
cigar-sdk-0.9.2.tgz	TypeScript ESM SDK
hol_cigar-0.9.2-py3-none-any.whl	hol-cigar Python wheel
hol_cigar-0.9.2.tar.gz	hol-cigar Python source distribution
cigar-rust-sdk-0.9.2-local-registry.tar.gz	Offline Rust registry kit
cigar-claude-code-0.9.2.tar.gz	Claude Code plugin using matching runtime bytes
cigar-honey-demos-0.9.2.tar.gz	Deterministic installed-artifact demonstrations
RELEASE_NOTES_HONEY_v0.9.2.md	This document
honey-release-manifest.json	Exact artifact, source, profile, and evidence inventory
SHA256SUMS	SHA-256 for every other public attachment

What changed

• balanced_v1 is the only intelligence profile exposed by ordinary embedded and local-sidecar
  execution, preserving the published 0.9.1 context-selection behavior. Capability discovery
  reports intelligence-balanced-v1 without changing the Context ABI or public operation set.

• SQLite storage format v5 keeps normalized catalog rows authoritative while representing retained
  revisions as typed incremental deltas plus bounded checkpoints. Ordinary mutations no longer
  persist a complete catalog-free residual state.

• Startup authenticates the latest checkpoint and bounded delta suffix needed for readiness.
  Full retained-history authentication is an explicit deep-integrity operation.

• The v5 hot path retains the authenticated latest committed state in process, revalidates it
  against the durable authority revision before use, and publishes it only after a successful
  atomic commit. Retention checks and startup recovery reuse already-authenticated state instead of
  replaying the same checkpoint suffix repeatedly. Canonical checkpoints now use a bounded,
  deterministic zstd storage envelope while their existing canonical digest remains the chain
  authority. That reduction permits a 4-delta release-default suffix, selected from the frozen
  4/16/64/128/256 fail-fast matrix to satisfy serial-latency, cold-start, and physical-growth gates
  without changing any threshold. Existing uncompressed v5 checkpoint rows remain readable; 256
  remains the accepted protocol maximum for authenticated v5 data.

• Durable daemon heartbeats advance one worker per two-second tick instead of bursting every worker
  through the single SQLite writer. All worker kinds still complete a durable refresh within the
  30-second health bound and three times within the 60-second lease, while reducing background
  revision amplification and context-compilation write contention.

• Latest-revision v5 reads reuse one in-process authenticated snapshot after rechecking its exact
  durable authority identity. Historical reads still reconstruct their exact revision, and a revision
  advanced by another handle invalidates and refreshes the cache without allowing an older read
  transaction to move the shared cache backward.

• Local daemon startup selects an activated v5 target only through the explicit owner-private
  production.active_store_descriptor; v4 remains the default when that field is absent, and
  shared deployments reject the setting.

• Generated migration, crash-boundary recovery, backup/restore, compaction, pin, and downgrade
  tests fail closed on revision, checksum, semantic-root, catalog-root, or policy drift.

• The signed v4-to-v5 migration-receipt schema now declares explicit maximum lengths for every
  string field, and its reviewed schema digest/test vector are updated together.

• Compiler selection groups content-equivalent candidates, preserves every governed provenance and
  citation alias, and deterministically chooses one emitted representation.

• Downstream shadow testing exposed and repaired seven additional integration defects: restart now
  reconstructs a pruned mandatory index from authenticated repository state; sparse graph hashing
  walks authorized edges instead of every document pair; per-requirement allowance is distributed
  once across retrieval channels; semantic kind filtering occurs before ranking; combined blocking
  requirements retain their protected allowance; equivalent displaced provenance remains valid; and
  projection integrity is bound to the catalog root so non-catalog revisions do not invalidate an
  otherwise exact projection.

• The SDK documents a stable semantic request key that excludes run/job/trace correlation while
  retaining authorization, disclosure, policy, catalog, tokenizer, materializer, target, and
  compiler pins. Correlation remains in a separate execution receipt.

• New content-free telemetry records commit phases/bytes, retained chain counts, startup stages,
  candidate reduction, result quality, and closed cache reasons.

Upgrade and rollback

Stop the daemon and create and verify a backup before migration. Migration reads v4 as immutable
source evidence and builds v5 in a distinct, empty, owner-controlled target. Preflight checks exact
source/backup identity, exclusive access, available space, capacity profile, retention policy, and
every retained v4 revision. Duration and free-space requirements are workload-dependent and are
reported by preflight; do not proceed when the bound estimate or reserve is unavailable.

Activation occurs only after the target, signed migration receipt, latest projection, and revision
anchor authenticate. An interrupted migration resumes its signed operation or leaves the prior
source active. Rollback restores the verified backup into another distinct empty target and then
activates that target; v5 is never opened by an older v4 runtime and in-place downgrade is rejected.
The original v4 source remains untouched until an owner separately authorizes removal.

After activation, keep production.metadata_database pointed at the retained v4 source and set
production.active_store_descriptor to the descriptor under state_directory. On restart the
local daemon opens only the descriptor-selected v5 target, verifies bounded readiness, reconciles
the revision anchor and encrypted blob roots, and fails closed on descriptor, path, capacity, lock,
chain, or projection mismatch. See docs/guides/honey-storage-v5.md for the exact configuration.

Retention is governed by authenticated count, age, byte, checkpoint, replay-window, pin, legal-hold,
and backup constraints. Compaction is explicit preview/execute/status administration. It rejects an
active writer, missing backup, legal hold, insufficient space, revision/policy/pin drift, or failed
post-verification. VACUUM, manual row deletion, and a larger capacity ceiling are not repairs.

Qualification and compatibility

The 0.9.2 release-candidate gate binds one clean source commit/tree, the exact release manifest, package
contracts, strict metadata checks, and installed Python SDK smoke tests. It establishes artifact
integrity and SDK installability, not full-product efficiency or production qualification. Only
balanced_v1 is eligible for release qualification. The separate internal efficiency/reliability
program remains fail-closed and may not be reported as passed without its authenticated raw cohort
and complete evidence ledger.

The public v1 API remains exactly 45 operations and 70 nominal payload types. Existing granular
clients remain the compatibility surface. Atomic context compilation, signed semantic/execution
identity protocol objects, and retention RPCs are future proposals, not 0.9.2 v1 operations. The
release records commit counts for the existing granular workflow and does not claim a one-commit
atomic RPC.

Known limits

Only Apple-silicon macOS, embedded mode, and local-sidecar mode are selected. Archives are unsigned
and unnotarized. Honey does not claim production support, remote multi-tenancy, shared deployment,
cross-platform qualification, public registries, live-provider replay, remote OTLP, HTTPS effects,
or vulnerability-finding efficacy. Longevity, full production chaos, notarization, two-builder
reproducibility, and non-macOS qualification remain deferred.

Use the repository discussion/issue channel for content-free product feedback and the private
process in SECURITY.md for vulnerabilities. Never post protected source, prompts, credentials,
handoff capsules, stores, or raw qualification attachments.