Skip to content

v0.4.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 12 Oct 16:58
· 211 commits to main since this release
v0.4.3
97cd041

v0.4.3: qualified JavaScript analysis and stronger verification

Semctx 0.4.3 keeps the npm CLI and host plugins on one release identity. Bun >=1.4.0,
Codex 0.147.0 and Claude Code 2.1.229 remain the declared host baseline.

What changes

  • Setup reports expose the observed source scope, exclusions and bounded exact-path include
    proposals. A proposal does not change configuration or establish readiness.
  • The opt-in qualified-static-v1 profile admits supported JavaScript ESM inputs with
    qualified-static-v1 selection. Admission binds Git changes, retained inputs, the analyzed
    scope and fresh index evidence. Unsupported loaders, callbacks, coercions, protocol effects
    and browser code execution refuse explicitly. This is not a universal JavaScript guarantee.
  • Outside qualified selection, committed-range verification recovers guards removed from the
    merge-base, including replaced invariant identities. Ordinary deleted-node recovery can borrow
    a former covering test only when its canonical test endpoint survives at the head. Existing
    rules keep configured severities and head-side test checks. Qualified refreshed working-tree
    removals separately recover immutable HEAD guards under current policy and SDK/compiler;
    unavailable, unbound or unsupported capture refuses explicitly. Base findings use file-only
    locations, not old lines presented as head declarations. This is structural comparison, not
    historical admission or runtime test execution. Qualified committed removals still refuse;
    pure additions retain their existing domain. Verify qualified replacements before committing.
  • Public report fields remain version 1, with stricter rejection of contradictory admitted scope
    or complete repository outcomes.
  • SQLite stores bound writer contention and CLI commands reliably release their stores.
  • Multicore CI smoke reports are archived separately for each OS, shard and workflow attempt.
  • Documentation keeps indexing outside pre-commit hooks. Development tools, MCP SDK packages and
    GitHub Actions receive maintenance updates with regenerated runtime bundles.

The qualification contract owns the supported
profile and its explicit refusals. Static admission does not prove runtime or business behavior.

Install or upgrade

After the unchanged release workflow publishes and attests this version:

bunx semctx@0.4.3 install

Installation does not reload an active session. Open a new Codex task, or run
/reload-plugins in Claude Code (restart if reload fails). Roll back with the previously
published 0.4.2 through the native host mechanism, not by editing a locked cache. This is a
consumer rollback; it does not replace the immutable 0.4.3 npm version, move stable by hand or
prove an active session reloaded. Reopen or reload the host after a rollback as after an upgrade.

Evidence and limits

Source tests, CI, package publication, two-host delivery and active-session loading remain
separate observations. The annotated release tag must pass the canonical gate; npm must expose
that exact commit; both immutable host payloads must pass delivery before stable advances.
A historical host-baseline receipt is not a receipt for this version. The declared baseline comes
from delivery run 34664142432,
not a 0.4.3 delivery observation.

Publication targets (not evidence that publication already completed):

The demo is a three-case packaged TypeScript fixture, not a JavaScript qualification or runtime
correctness proof. Its candidate projection records the observed package version and exact runtime
digest; older observations retain their original identities. After publication, the demo must be
rerun from the exact downloaded 0.4.3 artifact before release-phase Pages evidence is published.
The page cannot turn candidate bytes or an older demo into released-artifact evidence.

Oh My Pi remains experimental and outside the two-host delivery proof. Unsupported semantic
coverage, UNKNOWN runtime effects, untested hosts and active-session loading remain explicit.
The packaged JavaScript consumer is synthetic; it does not qualify an unrelated private pipeline.
Adoption, retention and human contribution time remain NOT_MEASURED.

Third-party identifiers have been removed from these historical notes. The original release artifacts predate the confidentiality cleanup; these notes do not assert that those artifacts were sanitized.

Assets 2
Loading