ERP Security Evidence Workbench v0.2.0rc1

Release-candidate gate

Candidate identity

• Distribution: erp-security-evidence-workbench
• Version: 0.2.0rc1
• Intended tag: v0.2.0rc1
• Release type: GitHub prerelease
• License: MIT
• Runtime dependencies: none
• Runtime boundary: offline, local, synthetic-only, input-read-only, non-remediating
• Supported target: CPython 3.11–3.14 on the documented POSIX surface

The prerelease is an evaluation and portfolio artifact. It does not claim production readiness,
compliance coverage, live-system compatibility, or service-level guarantees. Publication to PyPI
or another package index is outside this release.

Acceptance evidence

The tagged revision is acceptable only when every applicable item below is fresh and successful:

1. compilation, Ruff lint/format, strict mypy, and the complete pytest suite;
2. full tests and installed-package smoke on CPython 3.11, 3.12, 3.13, and 3.14;
3. deterministic synthetic-corpus and committed example-report checks;
4. deterministic installed multi-source replay for both finding and clean synthetic scenarios;
5. two byte-identical wheel and source-distribution builds at the recorded epoch;
6. exact archive-member, path-safety, SPDX, checksum, and fail-closed resolved-HEAD
   tree/blob-bound source-snapshot checks;
7. clean index-disabled installation and CLI smoke from wheel and source distribution;
8. deterministic large synthetic JSONL generation and an environment-qualified local observation;
9. secret, local-path, symlink, provenance, dependency, privacy, and claims review;
10. focused code/security, packaging/supply-chain, and documentation review;
11. a successful GitHub Actions matrix for the exact release revision.

A generated artifact is not accepted merely because a build command exits successfully. Any failed
or unavailable item must be disclosed in the release notes.

Artifact set

The GitHub prerelease may include:

• wheel and source distribution;
• deterministic build-manifest.json;
• deterministic source-snapshot.json;
• SPDX 2.3 JSON dependency inventory;
• sorted SHA256SUMS.

Checksums provide byte-integrity evidence, not authorship, confidentiality, vulnerability clearance,
or legal approval. The SPDX document records declared package metadata rather than a resolved,
platform-specific vulnerability inventory.

Release limits

• The tag may be annotated but is not represented as cryptographically signed unless a verifiable
  signature is present.
• Direct development requirements are pinned, but transitive tools are not hash-locked for every
  platform.
• GitHub Actions and local matrix results qualify only the environments actually exercised.
• The release must remain marked as a prerelease and must not be labeled “latest.”
• Release notes must preserve the synthetic-only, offline, input-read-only boundary and vendor
  independence.

ERP Security Evidence Workbench v0.1.0rc1

ERP Security Evidence Workbench v0.1.0rc1

The first release candidate of an independent, offline, input-read-only Python CLI for
deterministic analysis of synthetic ERP security evidence.

Highlights

• Strict, transactional ingestion of synthetic CSV, JSON, and JSONL evidence.
• Six versioned, vendor-neutral rules covering audit logging, inactive privileged access, direct
  privileged grants, a configurable segregation-of-duties pair, emergency access timing, and
  repeated failed sign-ins.
• Deterministic JSON, self-contained HTML, and SARIF 2.1.0 reports derived from one validated
  finding set.
• Stable finding fingerprints and field-level evidence references.
• Descriptor-anchored POSIX input handling and exclusive, no-overwrite report publication with
  mode 0600.
• Deterministic fictional scenarios, checked example reports, and no third-party runtime
  dependencies.
• Reproducible package tooling, exact archive-member inspection, SPDX 2.3 metadata, a
  commit-bound source snapshot, and SHA-256 release checksums.

Verification

• The current source passed compilation, Ruff lint and format checks, strict mypy validation, all
  393 tests, and the index-disabled and network-denied installed-package smoke test locally on
  CPython 3.11.14.
• The 53-test commit-bound release-artifact hardening suite also passed locally on exact CPython
  3.11.14, 3.12.12, 3.13.7, and 3.14.5 interpreters.
• GitHub Actions passed on Ubuntu 24.04 and macOS 15 across Python 3.11–3.14 for the release
  revision before this prerelease was created.
• The wheel and source distribution were each built twice from independent staged copies at the
  recorded SOURCE_DATE_EPOCH and compared byte-for-byte before publication.

Scope and limitations

• Accepts only explicitly supplied synthetic evidence files.
• Does not connect to an ERP system or any live service.
• Does not collect credentials, discover assets, scan networks, exploit targets, modify systems,
  or perform remediation.
• Findings do not establish compliance, source-system completeness, or absence of risk.
• Targets documented local POSIX behavior on macOS and Linux; Windows is not supported.
• Offline behavior is an application contract, not an operating-system sandbox.
• The SPDX document inventories declared package metadata; it is not a vulnerability audit,
  resolved environment inventory, or legal assessment.
• This is a prerelease candidate, not a production-readiness or service-level claim.

Distribution

Release files are attached here; this version is not published to PyPI. Verify downloaded files
against SHA256SUMS. The project is licensed under the MIT License.