Releases: s0fractal/sigma-glyph
Release list
sigma-glyph 0.6.7 — an adopted anchor set, and one signing path
The first release of the specification bundle since v0.6.6, and unlike 0.6.6.post1 it is a real one: the anchor set moved, and it was adopted before being named here — v0.6.7 AUTHORIZED — adopted by b4dc05e307b8 (2/2 of 3), signed by the human principal and by the roster identity this project's model actor actually holds.
Why the bundle moved
Warrant SPEC v0.4 domain-separates signatures: the signed message is "warrant-sig-v1:" || WarrantID_raw rather than the bare WarrantID. tests/spec_conformance/governance_vectors.json is a signature-bearing fixture, so the construction change moved its bytes and therefore its anchor — which made this a release adoption event under GOV-anchors rather than a code change.
All 50 records in .warrants were re-signed: 45 on the host that holds the claude-fable-5 key, which did not travel to do it, and 5 co-signatures locally. No body changed and no WarrantID moved; both were recomputed rather than assumed.
One signing path, after finding eight
The construction was open-coded in eight places — seven in Python and one in Go — and every one of them was found only because something went red. tools/warrant_sig.py now states it once; all seven Python sites call it, and the Go site holds it as a named constant, since Go cannot import Python.
tests/one_signing_path.py scores nine failures against either prior state — including against the tree from before domain separation existed, where there was no literal to grep for — and fails if a ninth copy appears.
The proof guard checks what the theorems mean
It began as a sorry grep and was shown, in turn, to accept: sorryAx _ true; a modifier-prefixed axiom; a #print axioms syntax override by the audited module itself; comment-blinding via a string literal; a vacuous theorem (: True := trivial); definition gutting, where deleting an inductive constructor leaves the pinned statement unchanged; lossily-pinned string literals that made the genesis hashes swappable; one-line namespace X … end X hiding a declaration; and a self-chosen audit scope taken from a config field nothing compiled from.
It now pins elaborated statements and their transitive definition dependencies computed from the kernel environment, queries axioms by loading compiled modules via Lean.Environment.importModules — data, not elaboration, so the audited module cannot influence the query — derives scope as the complement of a declared core-Lean allowance, and states its guarded set by identity. 36 statement pins, 155 definition pins.
The last of those was found by an external cross-family review: the file walk was os.listdir, not recursive, so proofs/Sub/Evil.lean carrying axiom backdoor : False produced zero problems from every textual layer while the bridge printed PREMISE HOLDS. Chasing it surfaced two holes the reviewer had not named, one of which reopened by path the exact route that once let an audited module override the guard's own axiom query.
The vectors now constrain the oracle
Book I 47/49 and Book II 16/17 conformance vectors are spec-derived — 31 quoted verbatim from Book I §7, the rest hand-computed through a second serializer transcribed from §1.1/§2 — and the generators refuse to write when the oracle disagrees. All 63 hand-derivations agreed with the oracle first try and both files regenerate byte-identically, so no vector changed. What changed is what a green regeneration means: against the previous generators, a new negative control scores 2/9, with seven forgeries passing silently including a forged genesis K.
Also
- Rust no longer answers hostile input with SIGABRT. A deep left spine and a nested-JSON bomb overflowed the stack; they are now Book I §3.6 local faults that cannot be widened into canonical failures. Three fence sites the review had not named needed it too, including the derived
Dropglue — fencingstepalone moved the overflow into cleanup. - A check that prints
FAILURES PRESENTno longer returns 0. The sweep that started withpython -m sigma_glyphfound five more, includinghermes_review.py && git pushpushing on a red gate. impl-go's Book I "coverage" was a hardcoded fixture; it now printsVACUOUSand is dropped from both sides of the tally.- An installed copy no longer accuses itself of failing, and every GitHub Action is pinned to a full commit SHA.
SECURITY-ASSUMPTIONS.md: the residuals as a declared scope boundary rather than scattered prose.
What this release does not claim
tools/test-all.sh is ALL GREEN with zero skips across 18 surfaces, and the cross-repo seam with Warrant is green. But no independent gate reviewed any of it — every reviewer was this model family or an external model run by the same operator. Core Lean is trusted rather than checked; the *Run.lean runners remain unproven-faithful I/O; GUARD_CLAIMS.txt is a review-visibility control, not an authority. SECURITY-ASSUMPTIONS.md carries the rest.
sigma-glyph 0.6.6.post1 — first PyPI distribution
pip install sigma-glyph now gives you Book I (a content-addressed SKI evaluator whose single integer budget provably prices both work and peak memory), Book II (wave annotations) and Book III (federation) as importable modules.
The spec bundle is unchanged. This is a PEP 440 post-release, not a new release of the specification: no anchored document differs from v0.6.6, and under GOV-anchors announcing a bundle is an adoption event, which this is not.
What actually changed: an installed copy no longer accuses itself of failing. The module self-tests now distinguish this distribution does not ship the conformance corpus from the corpus is missing where it should be, so python -m sigma_glyph / sigma_wave / sigma_federation run clean from site-packages and from an unpacked sdist — while deleting a vector file inside a checkout still fails, as it must.
The release is gated, not just built. The wheel is built, metadata-checked, installed into a fresh virtualenv, and required to do what the documentation says before the publish job runs. Verified against a wheel built without the fix: the gate reports all nine problems.
Verified before tagging: tools/test-all.sh ALL GREEN with zero skips — five Lean proof bridges, three-way differential fuzzing, Rust and Go conformance, governance replay, and the pinned cross-repo Warrant gate.
No independent gate reviewed this release.
v0.6.0 — Sovereign Views
Book III: FEDERATION is born. The protocol Book II has promised since v0.3.0 — how nodes share wave annotations without sharing beliefs — is now anchored law, adopted as ADR-006 after a design gate (three model families, blind convergence) and a full implementation gate (blocked → fixed → verified).
The core idea: an annotation is a claim, not a fact. Assertions travel as Warrant v0.3 records inside jurisdictions; a machine-readable selection policy picks zero-or-one per node; ties surface as explicit ConflictSets that clients MUST NOT merge. interfere() stays what it is — a computation operator — and is forbidden as an opinion-merge: the gate killed that idea with a verified algebra fact (grouping alone doubles amplitude). Waves are per-jurisdiction, per-policy derived coordinates; jurisdictions may diverge forever, by design, and the divergence has a mechanical name (AnnotationViewID).
Highlights:
- Replay resistance: assertion blobs embed their jurisdiction root (shared blob stores make cross-jurisdiction replay live otherwise).
- Weight is policy-metered, never proof-minted — one expensive
ski@v1check cannot back unlimited assertions. - Protocol-level aggregation profiles are forbidden (MUST NOT) — the governance-backdoor lesson: a nameable default profile becomes de-facto truth through network effects.
- Book I is untouched, and provably so:
FV-BOOK-I-UNREACHABLEreplays a Book I fixture byte-identically regardless of annotation state. - Two implementations (Python reference + stdlib-only Go with its own LUT generation), differential-tested 40/40 across adversarial inputs.
Gates: Book I ALL PASS · WAVE 30/30 · FEDERATION 37/37 · GO 21/21 · DIFFERENTIAL 40/40 · CONFORMANCE 49/49 · PROPERTIES 2103/2103 · anchors verified · 24 signed warrants, settlement-grade verification clean.
🤖 Generated with Claude Code
v0.5.2 — Honest Fences
Adjudicates the Opus 4.8 (1M) adversarial review of v0.5.1. The headline: consensus safety was attacked and did not break — no path was found where two conforming nodes disagree on a result hash. Everything shipped here is fence and discipline repair:
- M1: the reference's memory fence guarded on
spent(an upper bound on size, not a proxy), soeval(Ω, n)faulted instead of returning canonical ATP Exhausted for huge budgets — violating TV-7's∀n. Fixed: the guard measures actual size/depth; §3.4 prose corrected. - Version headers now match anchors (m1); the "phase coordinate stays visible" guarantee is executable via
coordinate()+WV-COORD-*vectors (m2);materialized_sizedefined in one sentence (m3); the ≥80-bit LUT demand dropped — the arbiter hash is authoritative (N1); three new eval vectors pin stuck normal forms and REF-enabled redexes — suite 46 → 49 (N2); width note for ports (N3).
No canonical eval result changes. Gates: oracle ALL PASS · WAVE 30/30 · CONFORMANCE 49/49 · PROPERTIES 2103/2103 · anchors verified · warrant store 18 records / 0 errors.
🤖 Generated with Claude Code
v0.5.1 — Scoped Silence
Adopts ADR-004 (LITERAL blob validation outside eval() — review gate 4/≥3, zero dissent, including a Codex concession of its own prior position) and ADR-005 (Book II wave totality: field-level pins R1, absent-wave base case, normative FALSE row — gate 2:1).
No Book I behavior changes — every v0.5.0 result hash, outcome and ATP cost is unchanged. Book I §1.1's self-contradicting blob paragraph is replaced; the wave layer becomes total-by-declaration.
Highlights:
- Book II §2:
WavePin {ph?, am?, en?}— a pin overrides exactly the fields it lists; the rest derive. - Book II §2.1:
wave()is a partial function; absence is legitimate and never touches Book I. - Book II §6.2:
FALSE = {ph=49152 (pin), am=0, en=−32512 (derived)}— the zero-amplitude cascade is a theorem: silence propagates, phase coordinates stay visible. wave_vectors.jsonformat v2: 14 vectors incl.WV-FALSE-DERIVED,WV-FALSE-ANCESTOR-SILENT,WV-ITER-DECAY(the full quadratic-decay rounding chain).- Entire post-release audit cycle (peer-Claude, Codex, Kimi k2.6, three-way ADR gate) recorded in
reviews/and adjudicated as signed warrants in.warrants/— verify locally withpython3 tools/warrant_verify.py.
Gates: Book I oracle ALL PASS · WAVE 27/27 · CONFORMANCE 46/46 · PROPERTIES 2103/2103 · anchors verified · warrant store 17 records / 0 errors.
🤖 Generated with Claude Code
v0.5.0 — Priced Reality
First breaking release, shipped through the project's own Decision Process: 3 ADRs, 3/3 dedicated model reviews (Codex, Gemini, DeepSeek), adoption warrants in .warrants/. Every v0.4 hash remains valid — what changed is what computation costs: hash-thunk evaluation (lazy left-spine; dead branches never fetched), size-priced ATP with the normative memory bound size − 1 ≤ spent, genesis intrinsic I/K/S, entropy–coherence coupling with crystallization to {am=65535, en=−32768}. Two oracles (Book I + Book II), 46 + 9 conformance vectors, 2103 property checks. Migration guide in CHANGELOG.