ContractGraph-QA interoperability SDK v0.1.0

ContractGraph-QA interoperability SDK v0.1.0

Exact source subject: de7c765243dc86226b8554757ef1f9419c194a4c

This release contains fail-closed conformance-report consumers for
TypeScript/JavaScript, Go, Java/JVM, and .NET. Every package pins suite
cgqa-liminalqa-v0.1 and remains evidence-only with
mayAuthorizeAction=false.

The GitHub bundle is the durable public download channel. The Go module
is also published under sdks/go/v0.1.0. npm, Maven Central, and NuGet
publication remain separate credential-bound transitions and are not
implied by this release.

ContractGraph-QA v1.9.0 — Universal Smart-Contract Quickstart

ContractGraph-QA v1.9.0 — Universal Smart-Contract Quickstart

Frozen exact subject:

6ab1f8b79a3211a7139e6f52da6b3fb7a75c0fb9

One-command project entry

cgqa quickstart --target /path/to/project

The safe default performs no project-code execution. It detects common smart-contract ecosystems/frameworks, inventories source and declarations, computes an exact source fingerprint, surfaces bounded review prompts, plans the native test command, and writes machine-readable JSON plus a Markdown report.

Native tests remain explicit:

cgqa quickstart --target /path/to/project --run-native

Supported routes

• Foundry, Hardhat, Truffle, Ape/Brownie/Vyper;
• Soroban and Anchor;
• Move;
• Cairo/Scarb;
• standalone Solidity/Vyper/Cairo discovery with an explicit adapter-required boundary.

Unified vNext CLI

The installed cgqa command now directly exposes witness/debt/watch/replication/remediation, proof-integrity, durable-reopen, and active-verification planning commands. Validation/HOLD exits are normalized to the public exit code 10.

Bugs closed

• no safe first-mile path for an unfamiliar project;
• hidden causal-temporal commands requiring internal Python modules;
• Product CI did not exercise installed-wheel → unknown repository → report;
• a nested output directory could hide an ancestor source tree;
• a repository with no recognized contract source returned a success exit instead of bounded HOLD;
• generated output could contaminate git/source subject capture;
• release tag publication previously preceded artifact smoke testing in the one-shot pattern.

Verification evidence

PR #133 passed:

• CI
• Product
• Portability
• Measurement provenance gate
• Finding report
• CodeRabbit

Product E2E built and installed the wheel, verified unified help, and ran quickstart against an unfamiliar Foundry-style project outside the repository checkout without executing that project.

Claim boundary

Quickstart is a safe discovery and routing layer, not a universal automatic security audit. Review prompts are not findings, native tests are not a proof of security, and deep stateful analysis still requires a reviewed state/action/invariant model or adapter.

ContractGraph-QA v1.8.0 — Causal-Temporal Verification Core vNext

ContractGraph-QA v1.8.0 — Causal-Temporal Verification Core vNext

Frozen exact subject:

51c8e81a42e53ea8b26b396f0c1df4f64418c351

Roadmap #117 is complete.

What landed

• Phase 1: Transition Geometry, Ancestral Validity, Orientation Center, exact-subject receipt binding, negative controls.
• Phase 2: Independent Witness, Verification Debt, Dormant Watchpoints, Temporal/External Replication + Drift, Forward Remediation.
• Phase 3: Exact-Subject Freeze, preregistered verification plans, Trace Integrity, Evidence Readiness, Root-Cause Collapse, Metamorphic/Round-Trip checks, Durable Evidence Reopen.
• Phase 4: deterministic Active Verification Planning with cost provenance, risk/priority/aging, information-gain inputs, prerequisite blocking, anti-starvation, and explicit debt preservation.

End-to-end invariant

The final integration gate exercises:

fresh drift → SELECTED work → still unverified → verification debt → Orientation INDETERMINATE → explicit COMPLETED_PASS → Orientation BALANCED → durable reopen/hash verification

BALANCED remains readiness only: securityVerdictAuthorized=false.

Verification evidence

Final integration PR #129 and final protocol/capability-matrix PR #130 each passed the repository's five standard GitHub Actions gates:

• CI
• Product
• Portability
• Measurement provenance gate
• Finding report

Claim boundary

ContractGraph-QA produces bounded, reproducible verification evidence. A PASS-like or BALANCED result is not a formal proof of production correctness, and independent external authenticity still requires an independent anchor/witness where the claim depends on it.

ContractGraph-QA v1.7.0

ContractGraph-QA release

Causal-temporal smart-contract QA with reproducible, independently verifiable evidence.

30-second proof

1. Download the wheel and DEMO_EVIDENCE.zip from this release.
2. Install the wheel into Python 3.11+.
3. Run:

cgqa --version
cgqa demo --output-dir cgqa-demo
cgqa verify-bundle cgqa-demo/CGQA-005.evidence.zip

The demo uses only repository-owned packaged evidence. It makes no external RPC call, requires no Foundry installation, and is not presented as a third-party audit.

Verify release integrity

The release includes:

• SHA256SUMS — checksum manifest for the wheel and release proof files;
• SHA256SUMS.attestation.json — Sigstore/GitHub artifact attestation bundle for that checksum manifest;
• SBOM.cdx.json — CycloneDX 1.5 artifact-level SBOM for the wheel;
• SBOM.attestation.json — signed SBOM attestation bound to the wheel;
• DEMO_REPORT.md and DEMO_EVIDENCE.zip — repository-owned proof output;
• CLIENT_PROOF.md — the fixed-scope pilot proof pack.

Verify local checksums first:

sha256sum -c SHA256SUMS

Then, with GitHub CLI authentication available, verify the signed checksum manifest:

gh attestation verify SHA256SUMS --repo safal207/ContractGraph-QA

The release workflow itself also installs the built wheel, runs the self-serve demo outside the checkout, independently verifies its evidence bundle, verifies the SBOM against the wheel digest and version, and refuses to overwrite an existing GitHub Release for the same tag.

From proof to a real engagement

self-serve demo
  ↓
client proof pack
  ↓
fixed-scope pilot
  ↓
written authorization / safe-harbor scope
  ↓
cgqa init-engagement
  ↓
review adapter + state hash + invariants
  ↓
cgqa engagement-run
  ↓
report + independently verifiable evidence
  ↓
fix → replay → retest

A public address, ABI, source repository, or RPC endpoint is not authorization. Real target execution remains behind explicit written scope and the existing fail-closed engagement gates.