Versioning and Compatibility

Versioning and Compatibility

PermitReceipt uses several identifiers because they describe different layers. Do not collapse them into one “version.”

Current taxonomy

Layer	Current identifier	Meaning
GitHub release/tag	v2.2.6-public-eval	Immutable reviewer-facing release lineage and asset tuple.
Python package	2.2.6	Package implementation version.
Evaluation suite	ORPRG-Eval v3.2	Version of the public evaluation semantics and vector suite.
Canonicalization profile	CP-JSON-2	Deterministic JSON canonicalization/action-binding profile used by the evaluation slice.
Authorization-reference profile	orprg.authorization-ref.public-eval.v2	Public evaluation authorization-reference behavior.
Carrier profile	PermitReceipt.authorization-ref.carrier.public-eval.v1	Version of the public carrier shape/semantics.
Internet-Draft	draft-lee-orprg-permit-receipts-00	Standards-discussion document revision; independent of software release numbering.

Compatibility rules

1. A package patch release does not automatically change a canonicalization, receipt, carrier, or evaluation profile.
2. A profile change that alters canonical bytes, covered fields, verification semantics, or required failure behavior should receive a new profile identifier.
3. A changed release byte requires a new release tag and checksum, even when the semantic change is “documentation only.”
4. An Internet-Draft revision does not automatically supersede a frozen public evaluation release; the relationship must be documented.
5. A verifier should reject unsupported or ambiguous profile identifiers rather than guessing compatibility.
6. Cross-version tests should cover both intended compatibility and required fail-closed rejection.

Release naming rules

Use one canonical reviewer-facing tag per immutable tuple. Do not replace published assets after checksums are public. If an erratum changes any released byte, publish a fresh tag and fresh checksum, manifest, and provenance.

Reviewer record

Every interoperability or reproduction report should state all applicable identifiers, not merely “v2.2.6.” At minimum record:

release tag
source commit
package version
evaluation suite
canonicalization profile
authorization-reference profile
carrier profile
Internet-Draft revision

Source of truth

The canonical taxonomy is maintained in the repository's version documentation and release lineage checks:

• Version taxonomy
• Current release
• Release lineage tooling