GuideCheck 0.4.0

GuideCheck 0.4.0

A security hardening release. It supersedes 0.3.2 (which was version-bumped but
never tagged or published) and covers everything since 0.3.1.

Security

• detector negation handling rewritten: a negation now suppresses a prohibited
  or encoded-execution pattern only when it directly governs that pattern, so
  inserting do not elsewhere on the line no longer disables the detector
• marker discipline: action and metadata fences that differ only by surrounding
  whitespace or letter case (for example [ACTION]) are no longer silently
  dropped; they raise a blocking malformed finding so a verifier and a lenient
  agent parser cannot diverge on which actions exist
• command and class consistency: a command is cross-checked against its declared
  class by command-head analysis; a network fetch piped into an interpreter
  blocks as command.fetch-execute, and under-declared network or code-executing
  commands raise warnings
• registry anchors: a registry-url is counted toward Level 4 only when its host
  is a recognized independent registry, closing a self-hosted-anchor path

Added

• finding ids command.fetch-execute, network.command-implies-networked,
  approval.command-implies-required, anchor.registry.unrecognized-host, and
  level4.requires-fetch
• verifier-conformance.md sections for marker discipline and command/class
  consistency
• a recorded adversarial review in threat-register.md

Changed

• the local-file reference verifier now caps the achieved level at Level 3. It
  still checks supplied manifest and anchor evidence for consistency and reports
  level4.requires-fetch, but Level 4 (independent provenance) is assertable
  only by the fetching hosted verifier, matching verifier-conformance.md
  section 6
• the eval runner imports the primary engine instead of carrying a second copy
  of the checks, so there is one source of truth
• profile, verifier, hosted verifier, spec, verifier-conformance, examples, and
  public pages now report 0.4.0; guide verifier-conformance ranges move to
  >=0.4.0, <0.5.0 and applies-to to guidecheck 0.4.x
• the published docs/.well-known/assistant-guide.txt is resynced byte-for-byte
  with the repository assistant-guide.txt (it had drifted at 0.3.1)

Verification

• make test: 130 eval cases, 66 reference fixtures, 76 contract fixtures,
  6 guide-artifact byte profiles, and the parser-edge, hosted-API, fetch-replay,
  fetch-safety, and CLI-contract suites all pass.
• Detector changes were re-attacked by an independent adversarial pass before
  release; verified bypasses and false positives were fixed and regression-tested.
• docs/.well-known/assistant-guide.txt confirmed byte-identical to the
  repository assistant-guide.txt at 0.4.0.

Residual risks

Recorded in threat-register.md (Adversarial review 2026-05-29): heuristic
command analysis is best-effort, verifier fingerprinting is not fully defeated,
the hosted checker is a modest request-proxy amplifier, anchor extraction can
pick a decoy hash, and the version string is still duplicated across files.