SerdeProof 0.1.1: safer cleanup, protected inputs and strict coverage

SerdeProof 0.1.1 makes adapter cleanup and report publication safer and adds an explicit strict coverage gate.

• Cleanup validates process birth times and ancestry, rejects stale/reused/unverifiable descendant identities, and terminates the root through its owned Process object. This fixes a Windows failure observed during installed-artifact validation. Cleanup is still best effort, not a sandbox.
• Report destinations cannot overlap declared manifest, fixture, mapper configuration, Java executable or classpath inputs—even with --force. New reports inside classpath directory trees are refused. Existing report replacement remains opt-in; ordinary aliases and edits are checked, but hostile filesystem races are not prevented atomically.
• --fail-on-untested makes any untested fixture exit 2 with consistent JSON/JUnit coverage errors. Existing default behavior remains useful for rejection corpora. The library has a matching fourth boolean argument.
• The README now starts with a no-build release example and explains exact expected counts, privacy, limits and troubleshooting.

Download the ZIP and SHA256SUMS, verify the checksum, extract everything and open a terminal in serdeproof-0.1.1. Java 17+ is required:

java -jar lib/serdeproof-cli-0.1.1.jar run --manifest examples/release-demo.json --json reports/first.json --junit reports/first.xml --as-of 2026-10-08

Expected exit 1: 17 fixtures, 12 unexpected differences, 5 untested and zero infrastructure errors. The example intentionally exercises incompatibilities. For your acceptance corpus, use --fail-on-untested and fail CI on any nonzero exit. Never treat an all-rejected corpus as semantic proof.

Exact release files come from successful main CI: Java 17/21 on Linux, macOS and Windows, full 78-test reactor, seven installed-artifact scenarios, a custom API/library consumer, source/license preservation and dependency/license/secret audit. Platform-specific link tests may skip where the OS does not permit link creation. These are synthetic checks, not proof of arbitrary business semantics.

Artifacts are unsigned; Maven Central publication is not claimed. Preserve the existing license and notices. The ZIP includes maintained examples and source; SHA256SUMS and release-manifest.json bind the supplied files to source d158d55ec78c6c10f6eb3776863da83d3287eabe.

Verification: https://github.com/rad1092/serdeproof/actions/runs/38246525844

SerdeProof 0.1.0

SerdeProof runs real Java DTO/mapper adapters in separate JVMs against a local payload corpus. It records acceptance changes, exact JSON-pointer differences, domain observations, and all four baseline/candidate producer-consumer combinations.

This initial release includes the dependency-free adapter API, library, CLI, pinned Jackson 2/3 examples, scoped expected-change rules with reasons and expiry, and privacy-conscious deterministic JSON/JUnit reports.

Download serdeproof-0.1.0.zip, extract it, then with Java 17 or newer run:

java -jar lib/serdeproof-cli-0.1.0.jar --help
java -jar lib/serdeproof-cli-0.1.0.jar run --manifest examples/release-demo.json --json reports/demo.json --junit reports/demo.xml --details

The demo intentionally exits 1 because it finds differences. Exit 2 is an incomplete or invalid experiment. See the included README and Korean quickstart for a clean corpus and an installed custom-adapter/library example.

validation.json records the exact source commit, CI run and job outcomes, local tests, installation smoke, dependency/license audit, Gitleaks history scan, and packaging inspection. bom.json inventories resolved dependencies, and SHA256SUMS covers the published primary artifacts and validation record.

Adapters are trusted local code; process isolation is not a sandbox. Passing only describes observations from the chosen corpus and does not guarantee semantic equivalence. Default reports hide IDs/pointers and omit payload values; --details reveals IDs/pointers and rule reasons. Review reports before sharing.

Artifacts are unsigned and not notarized. These coordinates are available via local Maven installation/source builds; this release does not publish them to Maven Central.