v0.1.3: Reliable reduction and atomic artifacts

TraceTwin 0.1.3

• Atomic artifact replacement protects an existing regression from partial writes and replacement failures. Input same-path/symlink/hardlink protection remains intact.
• Opt-in invalid-candidate verdicts let reduction skip unexecutable intermediate attack or benign candidates without hiding operational failures. Configure a dedicated oracle.invalid_candidate_exit_code, or return OracleVerdict.INVALID_CANDIDATE in Python. Full inputs and replay must still be executable.
• A short integration tutorial connects existing tests to a candidate-aware oracle, aligned twin, and CI replay using the runnable synthetic invoice workflow.

Compatibility

Existing cases without the optional field retain their JSON, source hashes, artifact bytes, and exit-code behavior. New opt-in cases require 0.1.3+ readers. Replacement resolves output symlinks, replaces only the named hardlink, and uses private temporary-file permissions (normally 0600), not existing permissions. It is atomic replacement, not a power-loss durability guarantee; cleanup failures are reported.

Python 3.11+; no runtime dependencies. Install the attached wheel. The source archive includes the synthetic demo and tutorial, but excludes third-party benchmark fixture directories.

Validation: 95 local tests; clean-wheel schema/protocol/demo checks; real OS write-failure preservation; vulnerable/fixed/disable-all fixed-mode results 1/0/1. These are synthetic and offline-fixture checks, not evidence of real-user adoption. Nested mutable Python payload/metadata aliasing remains deferred.

Changes: PR #7 · Main CI

TraceTwin v0.1.2

Makes cross-directory regression artifacts immediately replayable from the CLI output.

• Prints a copyable POSIX replay command when output is outside the case directory
• Uses absolute artifact and oracle working-directory paths
• Resolves output paths before running the oracle or writing artifacts
• Covers spaces, leading-dash filenames, and controlled path-resolution failures

TraceTwin v0.1.1 — preserve original cases

Fix a data-loss bug in minimize: an output path pointing to the input case is now rejected before the oracle runs, including equivalent paths, symbolic links and hard links. Version 0.1.0 could overwrite the original case in those situations.

Normal creation and replacement of independent regression artifacts continue to work. Output-path inspection errors return the documented exit code 2.

Verification: 56 tests pass on Python 3.11, 3.12 and 3.13. Fresh wheel and source-distribution installations each pass the output-preservation regressions and synthetic CLI workflows.

Install or upgrade in your virtual environment:

python -m pip install --upgrade https://github.com/mengchar-cmu-F25/tracetwin/releases/download/v0.1.1/tracetwin-0.1.1-py3-none-any.whl

See the README for the offline synthetic examples and full usage instructions.

TraceTwin v0.1.0

TraceTwin v0.1.0 is a dependency-free alpha CLI for reducing reproduced agent-security traces into paired regression artifacts.

• Minimize a failing attack while retaining a passing benign workflow.
• Verify a repair with replay --expect-fixed.
• Run an executable local demo with distinct regression and operational-error exit codes.
• Python 3.11–3.13; 46 tests pass on each supported version.

Install in a virtual environment:

python -m pip install https://github.com/mengchar-cmu-F25/tracetwin/releases/download/v0.1.0/tracetwin-0.1.0-py3-none-any.whl

See the README quickstart for complete 5-to-2 minimization and repair verification. The CLI works with deterministic paired oracles. Third-party benchmark fixtures are separately attributed research evidence and are excluded from the distributions.