0.1.0-alpha.4

Added

• A committed example results document, examples/results.example.json,
  generated by the crate's own machinery (cargo run --example make_example_results, deterministic): schema-valid, invariant-checked,
  with a real embedded HDR V2 histogram and a verdict computed against the
  catalogue's POC case. It doubles as reader documentation for the results
  schema and as a real seed for the party_document and hdr_v2 fuzz
  targets, which previously started from mutations.
• A deliberate library API, veredictum::pipeline, so the engine is
  consumable by something other than the command line. It carries one seam per
  whole operation — catalogue validates an artifact tree, conformance
  drives it against a running system under test, judgement computes the
  verdicts and renders the submission set, assets renders the published
  visuals and the schema set, and measured runs the class window, the stress
  ladder and the AQL probe. Every seam returns typed values: a validation
  carries its findings and the tree it loaded, a run carries the results
  record and its outcome tally, a judgement carries the verdict report and its
  documents as named bodies, and the measured window reports its progress as
  typed events. Nothing returns console text, so a consumer renders its own
  views over the same facts the command line prints. The veredictum binary
  is now a clap front end over exactly those seams; its behaviour, its output
  and its exit codes are unchanged.
• A documentation website at https://veredictum.eu, built from website/ and
  deployed to GitHub Pages by a new Docs workflow. The root serves a
  hand-written landing page in the project's own brand palette, and /docs/
  serves an mdBook with five chapters: an introduction, installation, running
  the instrument, a command reference covering every subcommand with its real
  flags, the conformance method (the attribution law, positive and negative
  testing, the ambiguity-register lifecycle), and catalogue authoring. The site
  loads nothing from an external host, renders in both light and dark, and takes
  its palette from the brand tokens. scripts/site/build.sh assembles the same
  tree locally that the workflow deploys, the CNAME for the custom domain
  included. A pull request touching the site builds, lints and link-checks it
  without deploying.
• The vendored CKM ADL 1.4 archetype pack is exercised in this repository, by
  tests/it/corpus_packs.rs on every cargo nextest run. All 944 ADL 1.4
  exports are decoded as UTF-8 and required to open with an archetype (…)
  header declaring adl_version=1.4 and to declare the archetype id their file
  name carries; all 944 AM 1.4 XML twins are read to end of input and required
  to root at archetype in http://schemas.openehr.org/v1 with that same
  identity; both counts are pinned against the pack's own inventory record. The
  pack had no exerciser here — its only one was an ADL-engine parse gate in the
  repository this instrument was split out of, and this repository ships no ADL
  parser. The pack stays as reserve material for wire batteries the catalogue
  has not authored yet, and the exercise is at the byte level, which is what the
  instrument can perform first-hand.
• The ADL 2 pair pack and the CKM Operational Template breadth pack gain the
  same byte-level exercisers, so every vendored corpus tree in this repository
  now has one. The pair pack's 654 files are all read and refused when empty,
  its 322 ADL 2 sources are checked for adl_version=2.0.6 and its 330 ADL 1.4
  twins for adl_version=1.4, each against the archetype id written inside it,
  and the 321 archetypes upstream published in both dialects are proven to pair
  with a twin in the same directory. The files that do not pair are pinned as
  what they are: one ADL 2 template, which the archetypes-only 1.4 half has
  nothing to hold, and nine ADL 1.4 archetypes this snapshot never converted.
  The template pack's 305 exports are each parsed to end of input and checked
  to root at template in http://schemas.openehr.org/v1 carrying a template
  id, and its file list is compared against the record's own vendored table
  rather than against its count alone.
• A fuzzing lane over the readers that parse text or bytes the instrument did
  not write, in its own nightly fuzz/ workspace: six libFuzzer targets
  covering the ${…} reference and identifier grammars, the decision-table
  literal grammar, the citation reader, a case core end to end through YAML and
  the published schema into the typed model, the IXIT, statement and results
  documents a party publishes, and the HDR histogram V2 decode path a measured
  verdict is re-derived from. Seeds come from the catalogue and the party
  declarations already committed here; recorded findings live in
  fuzz/regressions/ and are re-checked by every run. The harnesses compile on
  the pull-request path as a gating CI job, and a weekly campaign fuzzes each
  target with its corpus kept between runs. fuzz/README.md carries the threat
  model and the commands, .claude/rules/fuzzing.md the discipline and the
  crash-to-regression-test procedure.
• veredictum::load::yaml_str_to_value parses artifact YAML from a string under
  the same budget and duplicate-key refusal the file reader uses, and
  veredictum::validate exposes citation_clauses, expand_braces and
  section_candidates, so a consumer can read a citation the way the validator
  does.
• A published VEX record under security/vex/, in OpenVEX format: the
  distroless base's adjudicated OpenSSL finding as a hand-authored statement
  beside its .trivyignore.yaml twin, and the Rust advisories deny.toml
  accepts as a GENERATED document whose id set cannot drift from the gate —
  scripts/security/vex-generate.sh refuses on any disagreement and the CI
  guard tier regenerates and diffs on every pull request. The scheduled
  published-image scan applies the documents, and
  scripts/security/scan-images.sh reruns that exact scan locally.

Changed

• The container image is the web console now. ghcr.io/rubentalstra/veredictum
  ships the new veredictum-console Leptos server (app/veredictum-console,
  a second workspace package that never publishes to crates.io) instead of the
  CLI, per the ruling recorded in docker/Dockerfile when the image first
  shipped: the CLI payload was a placeholder, and its no-toolchain paths are
  cargo install veredictum and the attested release binaries. Start the
  console with docker run --rm -p 127.0.0.1:3000:3000 -v "$PWD:/work" ghcr.io/rubentalstra/veredictum:<tag>; it binds loopback through the
  publish flag because the console has no login. The server answers
  /healthz, the image bakes a HEALTHCHECK that probes it (the binary is
  its own probe, because distroless carries no curl), and the binary drains
  in-flight requests on SIGTERM, so docker stop ends it gracefully. The
  image build properties are unchanged: pushed by digest, smoke-driven and
  scanned before any tag applies, SLSA provenance and an SBOM attested on
  the digest, :latest moving only on a release tag.
• The CKM template breadth pack is re-vendored. CKM published new asset
  versions of ips-problem-list and ips-allergies-and-intolerances on
  2026-08-19, so those two exports carry different bytes. The library is still
  305 vendored templates beside the one private-incubator template that answers
  404 without an account.

Fixed

• Three ways a document the instrument was JUDGING could stop the instrument,
  all found by the new fuzzing lane on its first local campaign. A
  decision-table cell nesting 4000 lists deep, or chaining 4000 ordinal tuples,
  ran Literal::from_text off the stack; a Rust stack overflow aborts rather
  than unwinding, so a validator run died instead of reporting a finding. And a
  113-byte citation carrying 22 {a,b} groups in one path hint asked citation
  resolution for four million strings, hanging the run: the 32-variant ceiling
  was applied across a clause's tokens but not within one. Literal nesting is
  now bounded at literal::MAX_NESTING and brace expansion at
  validate::MAX_CITATION_VARIANTS, both refusing with a typed finding. The
  grammars' own forms are unaffected — a literal reaches three levels and an
  authored shorthand names two or three sibling documents.
• The README quoted 1107 spec-cited cases, which was the file count under
  artifacts/schedule/. The instrument reports 1103, because the four
  schedule/performance/ journey definitions load as measured-workload
  definitions and are not case cores. The page now carries the number
  validate prints and says where that number comes from.
• Re-running scripts/vendor/ckm-archetypes.sh would have regressed two facts
  in the pack's PROVENANCE.md: the corrected mixed-licence count, and now the
  exerciser. The script emits both, so the record survives a refresh.
• The SonarQube lane no longer runs on a Dependabot pull request. SONAR_TOKEN
  is an Actions secret and a Dependabot run reads a separate store, so every
  such run failed on the missing secret. The lane is advisory and gates no
  merge, so skipping it costs nothing.